@microagi/alchemy-gcp 0.2.1 → 0.5.0

package/lib/Run/IamMember.js

@@ -0,0 +1,65 @@
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run
+ * {@link Service}.
+ *
+ * Target-side binding — see
+ * {@link import("../Compute/SubnetworkIamMember.ts").subnetworkIamMember}
+ * for the pattern, the SID-collision pitfall, and why `key` exists.
+ * Service's `reconcile` merges all bindings into a single
+ * `setIamPolicy` call against the service, preserving foreign roles
+ * and members on the policy. To remove a binding, drop the call and
+ * re-deploy — the provider is additive within the bindings we
+ * declared, but does NOT prune.
+ *
+ * The most common usage:
+ *
+ * - **Public invoker:** `{ role: "roles/run.invoker", member: "allUsers" }`
+ *   makes the service publicly reachable. Prefer this over
+ *   `invokerIamDisabled: true` on the {@link Service} props — declarative
+ *   IAM is auditable in `setIamPolicy` history; `invokerIamDisabled`
+ *   is a flag with no audit trail.
+ * - **Service-to-service:** a downstream service's runtime SA bound
+ *   to `roles/run.invoker` on the upstream service.
+ *
+ * @example Public Cloud Run service
+ * ```typescript
+ * const api = yield* GCP.Service("PublicApi", { ... });
+ * yield* GCP.serviceIamMember(api, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ *
+ * @example Service-to-service auth
+ * ```typescript
+ * const upstream = yield* GCP.Service("Upstream", { ... });
+ * yield* GCP.serviceIamMember(upstream, "DownstreamCaller", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${downstreamSa.email}`,
+ * });
+ * ```
+ */
+export const serviceIamMember = (service, key, args) => service.bind `IamMember(${service}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run {@link Job}.
+ *
+ * Same target-side pattern as {@link serviceIamMember}. The most
+ * common Job binding is `roles/run.invoker` on the service account
+ * that triggers the job (Cloud Scheduler, Eventarc, Workflows, or a
+ * developer's user identity).
+ *
+ * @example Letting a Cloud Scheduler SA trigger the job
+ * ```typescript
+ * const nightly = yield* GCP.Job("Nightly", { ... });
+ * yield* GCP.jobIamMember(nightly, "SchedulerInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${schedulerSa.email}`,
+ * });
+ * ```
+ */
+export const jobIamMember = (job, key, args) => job.bind `IamMember(${job}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+//# sourceMappingURL=IamMember.js.map

package/lib/Run/IamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamMember.js","sourceRoot":"","sources":["../../src/Run/IamMember.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAgB,EAChB,GAAW,EACX,IAAsC,EACjB,EAAE,CACvB,OAAO,CAAC,IAAI,CAAA,aAAa,OAAO,KAAK,GAAG,GAAG,CAAC;IAC1C,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAAQ,EACR,GAAW,EACX,IAAsC,EACjB,EAAE,CACvB,GAAG,CAAC,IAAI,CAAA,aAAa,GAAG,KAAK,GAAG,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC"}

package/lib/Run/IamSync.d.ts

@@ -0,0 +1,80 @@
+import type * as run from "@distilled.cloud/gcp/run-v2";
+import type { ResourceBinding } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+/**
+ * Common shape of Cloud Run's `getIamPolicy` / `setIamPolicy` request
+ * inputs — Service and Job declare nominally distinct request types,
+ * but both reduce to `{ resource, body? }` plus the version query for
+ * get. We model the operation surface generically so {@link makeSyncIam}
+ * can serve both targets without duplication.
+ *
+ * @internal
+ */
+type GetIamPolicyOp = (input: {
+    resource: string;
+    "options.requestedPolicyVersion"?: number;
+}) => Effect.Effect<run.GoogleIamV1Policy, unknown, never>;
+type SetIamPolicyOp = (input: {
+    resource: string;
+    body?: run.GoogleIamV1SetIamPolicyRequest;
+}) => Effect.Effect<run.GoogleIamV1Policy, unknown, never>;
+/**
+ * Single `(role, members)` entry on a Cloud Run target's IAM policy.
+ * Identical shape between Service and Job — both Cloud Run resources
+ * speak the same `iam.v1.Policy`, so the binding contract is shared.
+ *
+ * @example
+ * ```typescript
+ * yield* GCP.serviceIamMember(svc, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ */
+export type RunIamBinding = {
+    /** IAM role, e.g. `"roles/run.invoker"`. */
+    role: string;
+    /** Principals, e.g. `["allUsers"]` or `["serviceAccount:foo@bar.iam.gserviceaccount.com"]`. */
+    members: ReadonlyArray<string>;
+};
+/**
+ * Binding contract for a Cloud Run target — services and jobs both
+ * accept a list of `iamBindings` records via the alchemy `.bind`
+ * mechanism. The reconciler reads `bindings` from its arguments and
+ * routes them through {@link makeSyncIam}.
+ */
+export type RunIamBindingContract = {
+    iamBindings: ReadonlyArray<RunIamBinding>;
+};
+/**
+ * Build a reusable `syncIam` step parametrised by the resolved
+ * `getIamPolicy` / `setIamPolicy` callables. Cloud Run's Service and
+ * Job IAM endpoints have identical request/response shapes (both
+ * `resource: "projects/{p}/locations/{l}/{kind}/{n}"`), so the same
+ * helper works for both — the caller just hands in the right pair of
+ * callables.
+ *
+ * Semantics, mirroring `Compute/Subnetwork.ts`:
+ *
+ * - **Union bindings per role across all `.bind` callers.** Multiple
+ *   capabilities granting the same role get their members merged into
+ *   a single binding.
+ * - **Preserve foreign roles and members verbatim.** We never displace
+ *   bindings we didn't author. The provider is additive — to remove a
+ *   binding, drop the `.bind` call and re-deploy (a future revision
+ *   could narrow this; for now it matches the existing idiom).
+ * - **Etag round-trip.** `getIamPolicy` returns an etag; we pass it
+ *   through `setIamPolicy` so a concurrent edit racing us surfaces as
+ *   `Conflict`. We retry exponentially up to ~1.5 min — enough to
+ *   absorb normal CI/human contention without masking real failures.
+ */
+export declare const makeSyncIam: (api: {
+    getIamPolicy: GetIamPolicyOp;
+    setIamPolicy: SetIamPolicyOp;
+}) => (args: {
+    /** Fully-qualified resource name: `projects/{p}/locations/{l}/{kind}/{n}`. */
+    resource: string;
+    bindings: ReadonlyArray<ResourceBinding<RunIamBindingContract>>;
+}) => Effect.Effect<void, unknown, never>;
+export {};
+//# sourceMappingURL=IamSync.d.ts.map

package/lib/Run/IamSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamSync.d.ts","sourceRoot":"","sources":["../../src/Run/IamSync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;;;;;;GAQG;AACH,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC,CAAC,EAAE,MAAM,CAAC;CAC3C,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3D,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,GAAG,CAAC,8BAA8B,CAAC;CAC3C,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,WAAW,GACrB,KAAK;IAAE,YAAY,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,cAAc,CAAA;CAAE,MACnE,MAAM;IACL,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC;CACjE,wCAkDE,CAAC"}

package/lib/Run/IamSync.js

@@ -0,0 +1,73 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+/**
+ * Build a reusable `syncIam` step parametrised by the resolved
+ * `getIamPolicy` / `setIamPolicy` callables. Cloud Run's Service and
+ * Job IAM endpoints have identical request/response shapes (both
+ * `resource: "projects/{p}/locations/{l}/{kind}/{n}"`), so the same
+ * helper works for both — the caller just hands in the right pair of
+ * callables.
+ *
+ * Semantics, mirroring `Compute/Subnetwork.ts`:
+ *
+ * - **Union bindings per role across all `.bind` callers.** Multiple
+ *   capabilities granting the same role get their members merged into
+ *   a single binding.
+ * - **Preserve foreign roles and members verbatim.** We never displace
+ *   bindings we didn't author. The provider is additive — to remove a
+ *   binding, drop the `.bind` call and re-deploy (a future revision
+ *   could narrow this; for now it matches the existing idiom).
+ * - **Etag round-trip.** `getIamPolicy` returns an etag; we pass it
+ *   through `setIamPolicy` so a concurrent edit racing us surfaces as
+ *   `Conflict`. We retry exponentially up to ~1.5 min — enough to
+ *   absorb normal CI/human contention without masking real failures.
+ */
+export const makeSyncIam = (api) => (args) => Effect.gen(function* () {
+    const desiredByRole = new Map();
+    for (const b of args.bindings) {
+        for (const ib of b.data.iamBindings) {
+            const set = desiredByRole.get(ib.role) ?? new Set();
+            for (const m of ib.members)
+                set.add(m);
+            desiredByRole.set(ib.role, set);
+        }
+    }
+    if (desiredByRole.size === 0)
+        return;
+    const current = yield* api.getIamPolicy({
+        resource: args.resource,
+        "options.requestedPolicyVersion": 3,
+    });
+    const bindings = (current.bindings ?? []).map((b) => ({
+        ...b,
+        members: [...(b.members ?? [])],
+    }));
+    let mutated = false;
+    for (const [role, members] of desiredByRole) {
+        let existing = bindings.find((b) => b.role === role && !b.condition);
+        if (!existing) {
+            existing = { role, members: [] };
+            bindings.push(existing);
+        }
+        const merged = new Set([...(existing.members ?? []), ...members]);
+        if (merged.size !== (existing.members?.length ?? 0))
+            mutated = true;
+        existing.members = [...merged];
+    }
+    if (!mutated)
+        return;
+    yield* api.setIamPolicy({
+        resource: args.resource,
+        body: {
+            policy: {
+                ...current,
+                bindings,
+                version: 3,
+            },
+        },
+    });
+}).pipe(Effect.retry({
+    schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+}));
+//# sourceMappingURL=IamSync.js.map

package/lib/Run/IamSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamSync.js","sourceRoot":"","sources":["../../src/Run/IamSync.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAmD5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,WAAW,GACtB,CAAC,GAAmE,EAAE,EAAE,CACxE,CAAC,IAIA,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gCAAgC,EAAE,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC;QACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;KAChC,CAAC,CAAC,CAAC;IACJ,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5C,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;QACpE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,QAAQ;gBACR,OAAO,EAAE,CAAC;aACX;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;CACF,CAAC,CACH,CAAC"}

package/lib/Run/Job.d.ts

@@ -0,0 +1,167 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+import { type RunIamBindingContract } from "./IamSync.ts";
+/**
+ * A Cloud Run v2 Job — a managed batch workload. A Job holds an
+ * `ExecutionTemplate` (parallelism + a `TaskTemplate` containing
+ * containers); invoking the Job via `runProjectsLocationsJobs` creates
+ * an immutable Execution that runs the configured number of tasks to
+ * completion.
+ *
+ * **Declarative vs imperative.** This resource models the Job
+ * *definition* — its template, parallelism, task count, IAM. The act
+ * of *running* the Job is event-shaped (does not fit the
+ * converge-to-desired-state model) and is left to user-side code:
+ *
+ * ```typescript
+ * import * as run from "@distilled.cloud/gcp/run-v2";
+ * const job = yield* GCP.Job("Nightly", { ... });
+ * const runJob = yield* run.runProjectsLocationsJobs;
+ * yield* runJob({
+ *   name: `projects/${job.project}/locations/${job.location}/jobs/${job.name}`,
+ * });
+ * // returns an LRO; poll if you want to wait for completion
+ * ```
+ *
+ * **Lifecycle.** observe → ensure (create, retrying the API-enable
+ * race) → sync (patch full body if anything changed; Job's patch has
+ * no `updateMask` — server diffs the body itself) → sync IAM bindings
+ * → return.
+ *
+ * **Replace triggers.** Only identity fields (project, location, name)
+ * force replacement. Everything else is in-place via `patch`. New
+ * Executions are created independently by `runProjectsLocationsJobs`.
+ *
+ * **Optimistic concurrency.** Delete passes through the observed
+ * `etag`; patch passes etag in the body so concurrent edits surface
+ * as `Conflict` instead of silently overwriting.
+ *
+ * **Adoption.** Label-gated, same as {@link import("./Service.ts").Service}.
+ *
+ * **IAM.** Use {@link import("./IamMember.ts").jobIamMember} to bind
+ * `(role, member)` grants — typically `roles/run.invoker` on the
+ * service account that triggers the job.
+ *
+ * @section Creating a Cloud Run Job
+ * @example Single-shot batch job
+ * ```typescript
+ * const job = yield* GCP.Job("ProcessBatch", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   template: {
+ *     taskCount: 1,
+ *     template: {
+ *       maxRetries: 3,
+ *       containers: [{
+ *         image: "europe-west4-docker.pkg.dev/proj/repo/worker:latest",
+ *       }],
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * @example Parallel job with custom service account and GPU
+ * ```typescript
+ * const train = yield* GCP.Job("Train", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   launchStage: "BETA",
+ *   template: {
+ *     taskCount: 8,
+ *     parallelism: 8,
+ *     template: {
+ *       serviceAccount: sa.email,
+ *       maxRetries: 0,
+ *       timeout: "21600s",
+ *       containers: [{
+ *         image: "europe-west4-docker.pkg.dev/proj/repo/train:v2",
+ *         resources: { limits: { cpu: "4", memory: "16Gi", "nvidia.com/gpu": "1" } },
+ *       }],
+ *       nodeSelector: { accelerator: "nvidia-l4" },
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export type JobProps = {
+    /** GCP project ID hosting the Job. Immutable — replace if changed. */
+    project: string;
+    /** Cloud Run region. Immutable — replace if changed. */
+    location: string;
+    /**
+     * Job name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 49 })`. Lowercase letters/digits/hyphens; must begin
+     * with a letter and not end with a hyphen; **fewer than 50 characters**.
+     * Immutable — replace if changed.
+     */
+    name?: string;
+    /** User-visible description. Mutable via `patch`. */
+    description?: string;
+    /**
+     * Resource labels. Alchemy internal labels are merged on top
+     * automatically. Cloud Run rejects reserved namespaces (same as
+     * Service). Mutable via `patch`.
+     */
+    labels?: Record<string, string>;
+    /** Free-form annotations. Mutable via `patch`. */
+    annotations?: Record<string, string>;
+    /**
+     * Launch stage — `BETA` (or higher) required for preview features
+     * (GPU node selectors, Direct VPC). Mutable via `patch`.
+     */
+    launchStage?: "ALPHA" | "BETA" | "GA" | "EARLY_ACCESS" | "PRELAUNCH" | "DEPRECATED";
+    /** Binary Authorization policy. Mutable via `patch`. */
+    binaryAuthorization?: run.GoogleCloudRunV2BinaryAuthorization;
+    /**
+     * Token-suffix used to compose Execution names when the Job is
+     * started via the GCP UI or `gcloud run jobs execute`. Required to
+     * keep distinct from Job name + 63 chars. Mutable.
+     */
+    startExecutionToken?: string;
+    /** Same as `startExecutionToken` but used on run completion. Mutable. */
+    runExecutionToken?: string;
+    /**
+     * The Execution template — describes parallelism, task count, and
+     * the inner `TaskTemplate` (containers, volumes, retry policy).
+     * **Required at create.** Mutable via `patch`.
+     */
+    template: run.GoogleCloudRunV2ExecutionTemplate;
+};
+export type JobAttributes = {
+    /** Job name (bare). */
+    name: string;
+    /** Server-assigned UID. */
+    uid: string;
+    /** Fully-qualified resource name. */
+    resourceName: string;
+    /** GCP project ID. */
+    project: string;
+    /** Region. */
+    location: string;
+    /** Monotonically increasing generation, bumped on every patch. */
+    generation: string | undefined;
+    /** Generation reflected in the latest reconciled state. */
+    observedGeneration: string | undefined;
+    /** Overall readiness condition. */
+    terminalCondition: run.GoogleCloudRunV2Condition | undefined;
+    /** Number of Executions created for this Job. */
+    executionCount: number | undefined;
+    /** Reference to the most recently created Execution, if any. */
+    latestCreatedExecution: run.GoogleCloudRunV2ExecutionReference | undefined;
+    /** True while Cloud Run is reconciling toward the desired state. */
+    reconciling: boolean | undefined;
+    /** Optimistic-concurrency etag. */
+    etag: string | undefined;
+    /** Labels currently set, including internals. */
+    labels: Record<string, string>;
+    /** Creation time. */
+    createTime: string | undefined;
+    /** Last-modified time. */
+    updateTime: string | undefined;
+};
+export type Job = Resource<"GCP.Job", JobProps, JobAttributes, RunIamBindingContract, GCP.Providers>;
+export declare const Job: import("alchemy").ResourceClass<Job>;
+export declare const JobProvider: () => import("effect/Layer").Layer<Provider.Provider<Job>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+//# sourceMappingURL=Job.d.ts.map

package/lib/Run/Job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Job.d.ts","sourceRoot":"","sources":["../../src/Run/Job.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAUvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EACR,OAAO,GACP,MAAM,GACN,IAAI,GACJ,cAAc,GACd,WAAW,GACX,YAAY,CAAC;IACjB,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,GAAG,CAAC,mCAAmC,CAAC;IAC9D;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,GAAG,CAAC,iCAAiC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mCAAmC;IACnC,iBAAiB,EAAE,GAAG,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAC7D,iDAAiD;IACjD,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,gEAAgE;IAChE,sBAAsB,EAAE,GAAG,CAAC,kCAAkC,GAAG,SAAS,CAAC;IAC3E,oEAAoE;IACpE,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,mCAAmC;IACnC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qBAAqB;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,GAAG,GAAG,QAAQ,CACxB,SAAS,EACT,QAAQ,EACR,aAAa,EACb,qBAAqB,EACrB,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,GAAG,sCAA2B,CAAC;AAgG5C,eAAO,MAAM,WAAW,0NAgKrB,CAAC"}

package/lib/Run/Job.js

@@ -0,0 +1,199 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeSyncIam } from "./IamSync.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { reshapeBadRequest, validateAnnotations, validateContainers, validateLabels, validateRunName, } from "./Validation.js";
+export const Job = Resource("GCP.Job");
+const fqName = (project, location, name) => `projects/${project}/locations/${location}/jobs/${name}`;
+const toJobBody = (news, desiredLabels) => ({
+    labels: desiredLabels,
+    ...(news.annotations ? { annotations: news.annotations } : {}),
+    ...(news.launchStage ? { launchStage: news.launchStage } : {}),
+    ...(news.binaryAuthorization
+        ? { binaryAuthorization: news.binaryAuthorization }
+        : {}),
+    ...(news.startExecutionToken
+        ? { startExecutionToken: news.startExecutionToken }
+        : {}),
+    ...(news.runExecutionToken
+        ? { runExecutionToken: news.runExecutionToken }
+        : {}),
+    template: news.template,
+});
+const toAttributes = (j, parent) => ({
+    name: parent.name,
+    uid: j.uid ?? "",
+    resourceName: j.name ?? fqName(parent.project, parent.location, parent.name),
+    project: parent.project,
+    location: parent.location,
+    generation: j.generation,
+    observedGeneration: j.observedGeneration,
+    terminalCondition: j.terminalCondition,
+    executionCount: j.executionCount,
+    latestCreatedExecution: j.latestCreatedExecution,
+    reconciling: j.reconciling,
+    etag: j.etag,
+    labels: { ...(j.labels ?? {}) },
+    createTime: j.createTime,
+    updateTime: j.updateTime,
+});
+/**
+ * Decide whether anything mutable on the Job changed since the last
+ * reconcile. Job's `patch` has no `updateMask` parameter — the server
+ * diffs the full body — so we just emit a single "changed / unchanged"
+ * verdict and re-send the whole body if it differs.
+ *
+ * Labels go through `diffTags` (consistent with every other GCP
+ * resource here); everything else is a `deepEqual` on the relevant
+ * field. The `template` deep-equal is the load-bearing check —
+ * Cloud Run injects server-side defaults into `template.template`
+ * (e.g. `maxRetries: 3` when omitted), so the observed template may
+ * have keys we never sent. Deep-equal on the OBSERVED side ⊆ NEWS
+ * side is too strict; we rely on the user re-sending equivalent
+ * inputs across reconciles so observed==news after the first patch.
+ */
+const jobMutated = (observed, news, desiredLabels) => {
+    const labelDiff = diffTags({ ...(observed.labels ?? {}) }, desiredLabels);
+    if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0)
+        return true;
+    if (!deepEqual(observed.annotations ?? {}, news.annotations ?? {}))
+        return true;
+    if (news.launchStage !== undefined && observed.launchStage !== news.launchStage) {
+        return true;
+    }
+    if (news.binaryAuthorization &&
+        !deepEqual(observed.binaryAuthorization, news.binaryAuthorization)) {
+        return true;
+    }
+    if (news.startExecutionToken !== undefined &&
+        observed.startExecutionToken !== news.startExecutionToken) {
+        return true;
+    }
+    if (news.runExecutionToken !== undefined &&
+        observed.runExecutionToken !== news.runExecutionToken) {
+        return true;
+    }
+    if (!deepEqual(observed.template, news.template))
+        return true;
+    return false;
+};
+export const JobProvider = () => Provider.effect(Job, Effect.gen(function* () {
+    const getJob = yield* run.getProjectsLocationsJobs;
+    const createJob = yield* run.createProjectsLocationsJobs;
+    const patchJob = yield* run.patchProjectsLocationsJobs;
+    const deleteJob = yield* run.deleteProjectsLocationsJobs;
+    const getOperation = yield* run.getProjectsLocationsOperations;
+    const getIamPolicy = yield* run.getIamPolicyProjectsLocationsJobs;
+    const setIamPolicy = yield* run.setIamPolicyProjectsLocationsJobs;
+    const awaitOperation = makeAwaitOperation(getOperation);
+    const syncIam = makeSyncIam({ getIamPolicy, setIamPolicy });
+    const observe = (project, location, name) => getJob({ name: fqName(project, location, name) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncMutable = Effect.fn(function* (args) {
+        if (!jobMutated(args.observed, args.news, args.desiredLabels))
+            return;
+        const bodyWithEtag = {
+            ...toJobBody(args.news, args.desiredLabels),
+            ...(args.observed.etag ? { etag: args.observed.etag } : {}),
+        };
+        const op = yield* patchJob({
+            name: args.name,
+            body: bodyWithEtag,
+        }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("Job", "patch")));
+        if (op.name)
+            yield* awaitOperation(op.name, args.session);
+    });
+    return {
+        stables: ["name", "uid", "resourceName", "project", "location"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "location",
+                "name",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session, bindings }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            yield* validateRunName("Job", desiredName);
+            yield* validateLabels(news.labels);
+            yield* validateAnnotations(news.annotations);
+            // Job container constraint lives one level deeper (inside the
+            // ExecutionTemplate's TaskTemplate).
+            yield* validateContainers("Job", news.template.template?.containers);
+            const parent = `projects/${news.project}/locations/${news.location}`;
+            const name = fqName(news.project, news.location, desiredName);
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            let observed = yield* observe(news.project, news.location, desiredName);
+            if (!observed) {
+                const op = yield* createJob({
+                    parent,
+                    jobId: desiredName,
+                    body: toJobBody(news, desiredLabels),
+                }).pipe(Effect.retry({
+                    while: (e) => e?._tag === "Forbidden" &&
+                        /enabled this API recently|has not been used/i.test(e.message ?? ""),
+                    schedule: Schedule.spaced(Duration.seconds(15)).pipe(Schedule.both(Schedule.recurs(20)), Schedule.tapOutput(() => session.note("Waiting for Cloud Run API enablement to propagate…"))),
+                }), Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("Job", "create")));
+                if (op?.name)
+                    yield* awaitOperation(op.name, session);
+                observed = yield* getJob({ name });
+            }
+            yield* syncMutable({
+                name,
+                observed,
+                news,
+                desiredLabels,
+                session,
+            });
+            yield* syncIam({ resource: name, bindings });
+            const final = yield* getJob({ name });
+            return toAttributes(final, {
+                project: news.project,
+                location: news.location,
+                name: desiredName,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            const name = fqName(output.project, output.location, output.name);
+            yield* deleteJob({
+                name,
+                ...(output.etag ? { etag: output.etag } : {}),
+            }).pipe(Effect.flatMap((op) => op.name ? awaitOperation(op.name, session) : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const location = output?.location ?? olds?.location;
+            if (!project || !location)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            const observed = yield* observe(project, location, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, { project, location, name });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Job.js.map

package/lib/Run/Job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Job.js","sourceRoot":"","sources":["../../src/Run/Job.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAC;AA+KzB,MAAM,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAM,SAAS,CAAC,CAAC;AAE5C,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CACjE,YAAY,OAAO,cAAc,QAAQ,SAAS,IAAI,EAAE,CAAC;AAE3D,MAAM,SAAS,GAAG,CAChB,IAAc,EACd,aAAqC,EACZ,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,aAAa;IACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,mBAAmB;QAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,mBAAmB;QAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,iBAAiB;QACxB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;CACxB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAA0B,EAC1B,MAA2D,EAC5C,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;IACxC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,cAAc,EAAE,CAAC,CAAC,cAAc;IAChC,sBAAsB,EAAE,CAAC,CAAC,sBAAsB;IAChD,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,GAAG,CACjB,QAAiC,EACjC,IAAc,EACd,aAAqC,EAC5B,EAAE;IACX,MAAM,SAAS,GAAG,QAAQ,CACxB,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAC9B,aAAa,CACd,CAAC;IACF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,IAAI,CAAC,mBAAmB;QACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,IAAI,CAAC,mBAAmB,KAAK,SAAS;QACtC,QAAQ,CAAC,mBAAmB,KAAK,IAAI,CAAC,mBAAmB,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,IAAI,CAAC,iBAAiB,KAAK,SAAS;QACpC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,CAAC,iBAAiB,EACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAC9B,QAAQ,CAAC,MAAM,CACb,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAClE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAgD,CAAC,CACjE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAgD,CAAC,CACjE,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMxC;QACC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO;QACtE,MAAM,YAAY,GAA4B;YAC5C,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CACjE,CAAC;QACF,IAAI,EAAE,CAAC,IAAI;YAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAgB,EAAE,IAAI,EAAE;gBAC5C,SAAS;gBACT,UAAU;gBACV,MAAM;aACP,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;YAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAEnE,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3C,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,8DAA8D;YAC9D,qCAAqC;YACrC,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC9D,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;oBAC1B,MAAM;oBACN,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC;iBACrC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,EAAE,CAAC,CAAsC,EAAE,EAAE,CAChD,CAAC,EAAE,IAAI,KAAK,WAAW;wBACvB,8CAA8C,CAAC,IAAI,CACjD,CAAC,CAAC,OAAO,IAAI,EAAE,CAChB;oBACH,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CACV,oDAAoD,CACrD,CACF,CACF;iBACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CACZ,SAAuD,CACxD,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAClE,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACtD,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,IAAI;gBACJ,QAAQ;gBACR,IAAI;gBACJ,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,CAAC,SAAS,CAAC;gBACf,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAChE,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}