@microagi/alchemy-gcp 0.5.0 → 0.6.0

package/lib/Compute/Firewall.js

@@ -0,0 +1,163 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitGlobalOperation } from "./Operations.js";
+export const Firewall = Resource("GCP.Firewall");
+const toFirewallAttributes = (f, parent) => ({
+    name: f.name ?? "",
+    project: parent.project,
+    selfLink: f.selfLink ?? "",
+    id: f.id ?? "",
+    network: f.network ?? "",
+    direction: f.direction,
+    priority: f.priority,
+    sourceRanges: f.sourceRanges,
+    allowed: f.allowed,
+    targetTags: f.targetTags,
+    targetServiceAccounts: f.targetServiceAccounts,
+    description: stripAlchemyMarker(f.description),
+    disabled: f.disabled,
+});
+/**
+ * Normalize for drift comparison: GCP reorders list fields and the
+ * `allowed` entries' ports — compare order-insensitively so a
+ * cosmetic reordering doesn't trigger a PATCH every reconcile.
+ */
+const normalized = (f) => ({
+    priority: f.priority ?? 1000,
+    sourceRanges: [...(f.sourceRanges ?? [])].sort(),
+    destinationRanges: [...(f.destinationRanges ?? [])].sort(),
+    allowed: [...(f.allowed ?? [])]
+        .map((a) => ({
+        IPProtocol: (a.IPProtocol ?? "").toLowerCase(),
+        ports: [...(a.ports ?? [])].sort(),
+    }))
+        .sort((x, y) => x.IPProtocol.localeCompare(y.IPProtocol)),
+    targetTags: [...(f.targetTags ?? [])].sort(),
+    targetServiceAccounts: [...(f.targetServiceAccounts ?? [])].sort(),
+    disabled: f.disabled ?? false,
+    description: f.description,
+});
+export const FirewallProvider = () => Provider.effect(Firewall, Effect.gen(function* () {
+    const getFirewalls = yield* compute.getFirewalls;
+    const insertFirewalls = yield* compute.insertFirewalls;
+    const patchFirewalls = yield* compute.patchFirewalls;
+    const deleteFirewalls = yield* compute.deleteFirewalls;
+    const getGlobalOperations = yield* compute.getGlobalOperations;
+    const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+    const observe = (project, name) => getFirewalls({ project, firewall: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    return {
+        stables: ["name", "project", "selfLink", "id", "network"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "name",
+                "network",
+                "direction",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            if (news.targetTags?.length && news.targetServiceAccounts?.length) {
+                return yield* Effect.fail(new Error("Firewall: targetTags and targetServiceAccounts are mutually exclusive (GCP rejects rules with both)"));
+            }
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredDescription = yield* gcpAlchemyDescription(id, news.description);
+            const mutableBody = () => ({
+                description: desiredDescription,
+                ...(news.priority !== undefined ? { priority: news.priority } : {}),
+                ...(news.sourceRanges
+                    ? { sourceRanges: [...news.sourceRanges] }
+                    : {}),
+                ...(news.destinationRanges
+                    ? { destinationRanges: [...news.destinationRanges] }
+                    : {}),
+                allowed: news.allowed.map((a) => ({
+                    IPProtocol: a.IPProtocol,
+                    ...(a.ports ? { ports: [...a.ports] } : {}),
+                })),
+                // Always send both target fields: switching tags → service
+                // accounts must CLEAR the other side, and PATCH leaves
+                // omitted fields untouched.
+                targetTags: [...(news.targetTags ?? [])],
+                targetServiceAccounts: [...(news.targetServiceAccounts ?? [])],
+                disabled: news.disabled ?? false,
+            });
+            // 1. Observe — collapse 403 to "missing" alongside 404.
+            let observed = yield* observe(news.project, desiredName);
+            // 2. Ensure — create if missing. `Conflict` covers concurrent
+            //    creates and state-persistence races.
+            if (!observed) {
+                const op = yield* insertFirewalls({
+                    project: news.project,
+                    body: {
+                        name: desiredName,
+                        network: news.network,
+                        ...(news.direction ? { direction: news.direction } : {}),
+                        ...mutableBody(),
+                    },
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (op?.name)
+                    yield* awaitOp(news.project, op.name, session);
+                observed = yield* getFirewalls({
+                    project: news.project,
+                    firewall: desiredName,
+                });
+            }
+            // 3. Sync — everything except name/network/direction is
+            //    PATCHable. Diff against OBSERVED state (cloud is
+            //    authoritative), order-insensitively.
+            const desired = mutableBody();
+            if (!deepEqual(normalized(observed), normalized(desired))) {
+                const op = yield* patchFirewalls({
+                    project: news.project,
+                    firewall: desiredName,
+                    body: desired,
+                });
+                if (op.name)
+                    yield* awaitOp(news.project, op.name, session);
+            }
+            const final = yield* getFirewalls({
+                project: news.project,
+                firewall: desiredName,
+            });
+            return toFirewallAttributes(final, { project: news.project });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteFirewalls({
+                project: output.project,
+                firewall: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOp(output.project, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            if (!project)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, name);
+            if (!observed)
+                return undefined;
+            const attrs = toFirewallAttributes(observed, { project });
+            // Adoption gate via the description marker — firewalls have
+            // no labels field (same situation as GCP.Network).
+            return (yield* descriptionHasAlchemyMarker(id, observed.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Firewall.js.map

package/lib/Compute/Firewall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Firewall.js","sourceRoot":"","sources":["../../src/Compute/Firewall.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAiH3D,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,cAAc,CAAC,CAAC;AAE3D,MAAM,oBAAoB,GAAG,CAC3B,CAAmB,EACnB,MAA2B,EACP,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAqD;IAChE,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;IAC9C,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,QAAQ;CACrB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,CAWnB,EAAE,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;IAC5B,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3D,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAC5C,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;IAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,MAAM,CACb,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,OAAO,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE,CAChD,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAyC,CAAC,CAC1D,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAyC,CAAC,CAC1D,CACF,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QACzD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAqB,EAAE,IAAI,EAAE;gBACjD,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,WAAW;aACZ,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,qGAAqG,CACtG,CACF,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrD,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,MAAM,WAAW,GAAG,GAAqB,EAAE,CAAC,CAAC;gBAC3C,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,YAAY;oBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,iBAAiB;oBACxB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,2DAA2D;gBAC3D,uDAAuD;gBACvD,4BAA4B;gBAC5B,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACxC,qBAAqB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;gBAC9D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;aACjC,CAAC,CAAC;YAEH,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEzD,8DAA8D;YAC9D,0CAA0C;YAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE;wBACJ,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxD,GAAG,WAAW,EAAE;qBACjB;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA0C,CAAC,CAC3D,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,wDAAwD;YACxD,sDAAsD;YACtD,0CAA0C;YAC1C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,oBAAoB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,eAAe,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1D,4DAA4D;YAC5D,mDAAmD;YACnD,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/ForwardingRule.d.ts

@@ -0,0 +1,106 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A regional forwarding rule. The intended use here is a **Private
+ * Service Connect consumer endpoint** — binding a reserved internal
+ * {@link Address} to a producer *service attachment* (e.g. the one
+ * Cloud SQL publishes per PSC-enabled instance), so clients in this
+ * VPC reach the producer service at that IP.
+ *
+ * PSC endpoint rules carry no ports / load-balancing scheme — the API
+ * requires `loadBalancingScheme: ""` for them, which is what this
+ * resource sends. The endpoint must be created in the **same region as
+ * the service attachment**; set `allowPscGlobalAccess` so clients in
+ * other regions of the VPC can still use it.
+ *
+ * Other forwarding-rule shapes (L4 ILB, NetLB, proxy LBs) are not
+ * modelled — add props if/when needed.
+ *
+ * All connection-defining props are immutable here and trigger replace;
+ * a PSC endpoint is cheap to recreate. Labels are mutable.
+ *
+ * @section Creating a PSC endpoint
+ * @example Cloud SQL PSC endpoint with global access
+ * ```typescript
+ * const endpoint = yield* GCP.ForwardingRule("DbPscEndpoint", {
+ *   project: hostProject.projectId,
+ *   region: "europe-west1",
+ *   network: vpc.selfLink,
+ *   ipAddress: endpointIp.selfLink,
+ *   target: "projects/<producer>/regions/europe-west1/serviceAttachments/<sa>",
+ *   allowPscGlobalAccess: true,
+ * });
+ * ```
+ */
+export type ForwardingRuleProps = {
+    /** GCP project ID hosting the rule. Immutable — replace if changed. */
+    project: string;
+    /** GCP region. Must match the target service attachment's region. Immutable — replace. */
+    region: string;
+    /**
+     * Rule name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 63 })`. Immutable — replace if changed.
+     */
+    name?: string;
+    /** Description (free-form). Set on create; immutable. */
+    description?: string;
+    /**
+     * URL of the consumer VPC. Pass `vpc.selfLink` from a `GCP.Network`
+     * to make alchemy sequence the rule after the VPC. Immutable — replace.
+     */
+    network: string;
+    /**
+     * The endpoint IP — a URL of a reserved `GCP.Address` (pass
+     * `address.selfLink` for the dep edge) or a literal IP. Immutable —
+     * replace.
+     */
+    ipAddress: string;
+    /**
+     * URI of the producer service attachment to connect to
+     * (`projects/{p}/regions/{r}/serviceAttachments/{name}`). Immutable —
+     * replace.
+     */
+    target: string;
+    /**
+     * Let clients in any region of the VPC use this endpoint (PSC global
+     * access). Defaults to `false`. Immutable — replace.
+     */
+    allowPscGlobalAccess?: boolean;
+    /**
+     * Resource labels. Alchemy internal labels (`alchemy_app`,
+     * `alchemy_stage`, `alchemy_id`) are merged on top automatically and
+     * are reserved. Mutable via `setLabels`.
+     */
+    labels?: Record<string, string>;
+};
+export type ForwardingRuleAttributes = {
+    /** Rule name. */
+    name: string;
+    /** GCP project ID, threaded through from props for delete/read. */
+    project: string;
+    /** GCP region, threaded through from props for delete/read. */
+    region: string;
+    /** Server-defined URL. */
+    selfLink: string;
+    /** Server-assigned numeric id. */
+    id: string;
+    /** The endpoint IP (the API always returns the literal IP). */
+    ipAddress: string;
+    /** Producer service attachment URI. */
+    target: string | undefined;
+    /** Consumer VPC URL. */
+    network: string | undefined;
+    /** PSC global access flag. */
+    allowPscGlobalAccess: boolean;
+    /** Server-assigned PSC connection id. */
+    pscConnectionId: string | undefined;
+    /** PSC connection status: `ACCEPTED`, `PENDING`, `REJECTED`, `CLOSED`, … */
+    pscConnectionStatus: string | undefined;
+    /** Labels currently set, including the alchemy internals. */
+    labels: Record<string, string>;
+};
+export type ForwardingRule = Resource<"GCP.ForwardingRule", ForwardingRuleProps, ForwardingRuleAttributes, never, GCP.Providers>;
+export declare const ForwardingRule: import("alchemy").ResourceClass<ForwardingRule>;
+export declare const ForwardingRuleProvider: () => import("effect/Layer").Layer<Provider.Provider<ForwardingRule>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=ForwardingRule.d.ts.map

package/lib/Compute/ForwardingRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForwardingRule.d.ts","sourceRoot":"","sources":["../../src/Compute/ForwardingRule.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wBAAwB;IACxB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,8BAA8B;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,cAAc,iDAAiD,CAAC;AAoB7E,eAAO,MAAM,sBAAsB,qOAgKhC,CAAC"}

package/lib/Compute/ForwardingRule.js

@@ -0,0 +1,152 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeAwaitRegionOperation } from "./Operations.js";
+export const ForwardingRule = Resource("GCP.ForwardingRule");
+const toForwardingRuleAttributes = (f, parent) => ({
+    name: f.name ?? "",
+    project: parent.project,
+    region: parent.region,
+    selfLink: f.selfLink ?? "",
+    id: f.id ?? "",
+    ipAddress: f.IPAddress ?? "",
+    target: f.target,
+    network: f.network,
+    allowPscGlobalAccess: f.allowPscGlobalAccess ?? false,
+    pscConnectionId: f.pscConnectionId,
+    pscConnectionStatus: f.pscConnectionStatus,
+    labels: { ...(f.labels ?? {}) },
+});
+export const ForwardingRuleProvider = () => Provider.effect(ForwardingRule, Effect.gen(function* () {
+    const getForwardingRules = yield* compute.getForwardingRules;
+    const insertForwardingRules = yield* compute.insertForwardingRules;
+    const deleteForwardingRules = yield* compute.deleteForwardingRules;
+    const setLabelsForwardingRules = yield* compute.setLabelsForwardingRules;
+    const getRegionOperations = yield* compute.getRegionOperations;
+    const awaitOp = makeAwaitRegionOperation(getRegionOperations);
+    const observe = (project, region, name) => getForwardingRules({ project, region, forwardingRule: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncLabels = Effect.fn(function* (args) {
+        if (deepEqual(args.observed.labels ?? {}, args.desired))
+            return;
+        const op = yield* setLabelsForwardingRules({
+            project: args.project,
+            region: args.region,
+            resource: args.observed.name ?? "",
+            body: {
+                labels: args.desired,
+                labelFingerprint: args.observed.labelFingerprint,
+            },
+        });
+        if (op.name) {
+            yield* awaitOp(args.project, args.region, op.name, args.session);
+        }
+    });
+    return {
+        stables: ["name", "project", "region", "selfLink", "id"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "region",
+                "name",
+                "network",
+                "ipAddress",
+                "target",
+                "allowPscGlobalAccess",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            let observed = yield* observe(news.project, news.region, desiredName);
+            if (!observed) {
+                const body = {
+                    name: desiredName,
+                    ...(news.description ? { description: news.description } : {}),
+                    network: news.network,
+                    IPAddress: news.ipAddress,
+                    target: news.target,
+                    // PSC consumer endpoints take no scheme — the API rejects
+                    // anything other than the empty string for them.
+                    loadBalancingScheme: "",
+                    ...(news.allowPscGlobalAccess !== undefined
+                        ? { allowPscGlobalAccess: news.allowPscGlobalAccess }
+                        : {}),
+                    labels: desiredLabels,
+                };
+                const op = yield* insertForwardingRules({
+                    project: news.project,
+                    region: news.region,
+                    body,
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (op?.name) {
+                    yield* awaitOp(news.project, news.region, op.name, session);
+                }
+                observed = yield* getForwardingRules({
+                    project: news.project,
+                    region: news.region,
+                    forwardingRule: desiredName,
+                });
+            }
+            yield* syncLabels({
+                project: news.project,
+                region: news.region,
+                observed,
+                desired: desiredLabels,
+                session,
+            });
+            const final = yield* getForwardingRules({
+                project: news.project,
+                region: news.region,
+                forwardingRule: desiredName,
+            });
+            return toForwardingRuleAttributes(final, {
+                project: news.project,
+                region: news.region,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteForwardingRules({
+                project: output.project,
+                region: output.region,
+                forwardingRule: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOp(output.project, output.region, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const region = output?.region ?? olds?.region;
+            if (!project || !region)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, region, name);
+            if (!observed)
+                return undefined;
+            const attrs = toForwardingRuleAttributes(observed, {
+                project,
+                region,
+            });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=ForwardingRule.js.map

package/lib/Compute/ForwardingRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForwardingRule.js","sourceRoot":"","sources":["../../src/Compute/ForwardingRule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AA8G3D,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,oBAAoB,CAAC,CAAC;AAE7E,MAAM,0BAA0B,GAAG,CACjC,CAAyB,EACzB,MAA2C,EACjB,EAAE,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;IACrD,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;IAC1C,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,MAAM,CACb,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACnE,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACnE,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzE,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,OAAO,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAChE,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA+C,CAAC,CAChE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAA+C,CAAC,CAChE,CACF,CAAC;IAEJ,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMvC;QACC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAChE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;aACjD;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAA2B,EAAE,IAAI,EAAE;gBACvD,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,SAAS;gBACT,WAAW;gBACX,QAAQ;gBACR,sBAAsB;aACvB,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,GAA2B;oBACnC,IAAI,EAAE,WAAW;oBACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,0DAA0D;oBAC1D,iDAAiD;oBACjD,mBAAmB,EAAE,EAAE;oBACvB,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE;wBACrD,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,EAAE,aAAa;iBACtB,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;oBACtC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI;iBACL,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA0C,CAAC,CAC3D,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;oBACb,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,WAAW;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,CAAC,UAAU,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;gBACR,OAAO,EAAE,aAAa;gBACtB,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACtC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc,EAAE,WAAW;aAC5B,CAAC,CAAC;YACH,OAAO,0BAA0B,CAAC,KAAK,EAAE;gBACvC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,qBAAqB,CAAC;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,IAAI;aAC5B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,EAAE;gBACjD,OAAO;gBACP,MAAM;aACP,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/GlobalAddress.d.ts

@@ -97,5 +97,5 @@ export type GlobalAddressAttributes = {
 };
 export type GlobalAddress = Resource<"GCP.GlobalAddress", GlobalAddressProps, GlobalAddressAttributes, never, GCP.Providers>;
 export declare const GlobalAddress: import("alchemy").ResourceClass<GlobalAddress>;
-export declare const GlobalAddressProvider: () => import("effect/Layer").Layer<Provider.Provider<GlobalAddress>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+export declare const GlobalAddressProvider: () => import("effect/Layer").Layer<Provider.Provider<GlobalAddress>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=GlobalAddress.d.ts.map

package/lib/Compute/Network.d.ts

@@ -146,6 +146,6 @@ export type NetworkAttributes = {
 };
 export type Network = Resource<"GCP.Network", NetworkProps, NetworkAttributes, never, GCP.Providers>;
 export declare const Network: import("alchemy").ResourceClass<Network>;
-export declare const NetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<Network>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+export declare const NetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<Network>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 export {};
 //# sourceMappingURL=Network.d.ts.map

package/lib/Compute/SharedVpcHost.d.ts

@@ -40,5 +40,5 @@ export type SharedVpcHostAttributes = {
 };
 export type SharedVpcHost = Resource<"GCP.SharedVpcHost", SharedVpcHostProps, SharedVpcHostAttributes, never, GCP.Providers>;
 export declare const SharedVpcHost: import("alchemy").ResourceClass<SharedVpcHost>;
-export declare const SharedVpcHostProvider: () => import("effect/Layer").Layer<Provider.Provider<SharedVpcHost>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/gcp").Credentials>;
+export declare const SharedVpcHostProvider: () => import("effect/Layer").Layer<Provider.Provider<SharedVpcHost>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=SharedVpcHost.d.ts.map

package/lib/Compute/SharedVpcServiceProject.d.ts

@@ -42,5 +42,5 @@ export type SharedVpcServiceProjectAttributes = {
 };
 export type SharedVpcServiceProject = Resource<"GCP.SharedVpcServiceProject", SharedVpcServiceProjectProps, SharedVpcServiceProjectAttributes, never, GCP.Providers>;
 export declare const SharedVpcServiceProject: import("alchemy").ResourceClass<SharedVpcServiceProject>;
-export declare const SharedVpcServiceProjectProvider: () => import("effect/Layer").Layer<Provider.Provider<SharedVpcServiceProject>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/gcp").Credentials>;
+export declare const SharedVpcServiceProjectProvider: () => import("effect/Layer").Layer<Provider.Provider<SharedVpcServiceProject>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=SharedVpcServiceProject.d.ts.map

package/lib/Compute/Subnetwork.d.ts

@@ -119,5 +119,5 @@ export type SubnetworkBindingContract = {
 };
 export type Subnetwork = Resource<"GCP.Subnetwork", SubnetworkProps, SubnetworkAttributes, SubnetworkBindingContract, GCP.Providers>;
 export declare const Subnetwork: import("alchemy").ResourceClass<Subnetwork>;
-export declare const SubnetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<Subnetwork>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+export declare const SubnetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<Subnetwork>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=Subnetwork.d.ts.map

package/lib/Compute/index.d.ts

@@ -1,3 +1,6 @@
+export * from "./Address.ts";
+export * from "./Firewall.ts";
+export * from "./ForwardingRule.ts";
 export * from "./GlobalAddress.ts";
 export * from "./Network.ts";
 export * from "./SharedVpcHost.ts";

package/lib/Compute/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Compute/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Compute/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC"}

package/lib/Compute/index.js

@@ -1,3 +1,6 @@
+export * from "./Address.js";
+export * from "./Firewall.js";
+export * from "./ForwardingRule.js";
 export * from "./GlobalAddress.js";
 export * from "./Network.js";
 export * from "./SharedVpcHost.js";

package/lib/Compute/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Compute/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Compute/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC"}

package/lib/Container/Cluster.d.ts

@@ -62,6 +62,26 @@ export type ClusterProps = {
         clusterSecondaryRangeName?: string;
         servicesSecondaryRangeName?: string;
     };
+    /**
+     * Cluster-level network settings. `datapathProvider:
+     * "ADVANCED_DATAPATH"` enables GKE Dataplane V2 (eBPF/Cilium
+     * dataplane with built-in NetworkPolicy enforcement). GKE only
+     * honors this at cluster creation — existing clusters cannot be
+     * migrated in place.
+     *
+     * **Consumed only on the create path** (like `initialNodePool`):
+     * changing it on an existing cluster is a silent no-op, NOT a
+     * replace trigger. A diff-driven same-name replace would be
+     * destructive here — the engine creates the new generation first,
+     * which observe-adopts the still-existing same-name cluster, and
+     * end-of-deploy GC would then delete that physical cluster out from
+     * under the "new" generation. To rebuild with a different datapath,
+     * delete the cluster out-of-band and redeploy; reconcile observes
+     * it missing and creates with the new setting.
+     */
+    networkConfig?: {
+        datapathProvider?: "LEGACY_DATAPATH" | "ADVANCED_DATAPATH";
+    };
     /** GKE release channel. Mutable via `update` (`desiredReleaseChannel`). */
     releaseChannel?: {
         channel: "RAPID" | "REGULAR" | "STABLE" | "UNSPECIFIED";
@@ -237,5 +257,5 @@ export type ClusterAttributes = {
  */
 export type Cluster = Resource<"GCP.Cluster", ClusterProps, ClusterAttributes, never, GCP.Providers>;
 export declare const Cluster: import("alchemy").ResourceClass<Cluster>;
-export declare const ClusterProvider: () => import("effect/Layer").Layer<Provider.Provider<Cluster>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+export declare const ClusterProvider: () => import("effect/Layer").Layer<Provider.Provider<Cluster>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=Cluster.d.ts.map

package/lib/Container/Cluster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Cluster.d.ts","sourceRoot":"","sources":["../../src/Container/Cluster.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,aAAa,EAA0B,MAAM,eAAe,CAAC;AAG3E;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,wEAAwE;IACxE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,iCAAiC;IACjC,WAAW,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,kCAAkC;IAClC,UAAU,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACzC,8BAA8B;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;KACrC,CAAC;IACF,2EAA2E;IAC3E,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAA;KAAE,CAAC;IAC7E;;;OAGG;IACH,sBAAsB,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC3C,wBAAwB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAClD,mBAAmB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,gCAAgC,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACzD,sBAAsB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC/C;;;;;WAKG;QACH,qBAAqB,CAAC,EAAE;YACtB,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB;;;;;;;eAOG;YACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;YACjC;;;;;eAKG;YACH,eAAe,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;QACF,oBAAoB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACvC,qBAAqB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/C,CAAC;IACF,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE;QAClB,MAAM,CAAC,EAAE;YACP,sBAAsB,CAAC,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,CAAC;YAC/C,eAAe,CAAC,EAAE;gBAChB,MAAM,EAAE;oBAAE,SAAS,EAAE,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,CAAA;iBAAE,CAAC;gBAC/C,UAAU,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,sBAAsB,GAAG,QAAQ,CAAC;KAC9C,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,EAAE,sBAAsB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,wBAAwB;IACxB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,cAAc,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AA8CxD,eAAO,MAAM,eAAe,8NA0VzB,CAAC"}
+{"version":3,"file":"Cluster.d.ts","sourceRoot":"","sources":["../../src/Container/Cluster.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,aAAa,EAA0B,MAAM,eAAe,CAAC;AAG3E;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,wEAAwE;IACxE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,iCAAiC;IACjC,WAAW,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,kCAAkC;IAClC,UAAU,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACzC,8BAA8B;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;KACrC,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE;QACd,gBAAgB,CAAC,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;KAC5D,CAAC;IACF,2EAA2E;IAC3E,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAA;KAAE,CAAC;IAC7E;;;OAGG;IACH,sBAAsB,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC3C,wBAAwB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAClD,mBAAmB,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,gCAAgC,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACzD,sBAAsB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC/C;;;;;WAKG;QACH,qBAAqB,CAAC,EAAE;YACtB,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB;;;;;;;eAOG;YACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;YACjC;;;;;eAKG;YACH,eAAe,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;QACF,oBAAoB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACvC,qBAAqB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/C,CAAC;IACF,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE;QAClB,MAAM,CAAC,EAAE;YACP,sBAAsB,CAAC,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,CAAC;YAC/C,eAAe,CAAC,EAAE;gBAChB,MAAM,EAAE;oBAAE,SAAS,EAAE,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,CAAA;iBAAE,CAAC;gBAC/C,UAAU,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,sBAAsB,GAAG,QAAQ,CAAC;KAC9C,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,EAAE,sBAAsB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,wBAAwB;IACxB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,cAAc,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AA8CxD,eAAO,MAAM,eAAe,8NA6VzB,CAAC"}

package/lib/Container/Cluster.js

@@ -201,8 +201,10 @@ export const ClusterProvider = () => Provider.effect(Cluster, Effect.gen(functio
             if (!deepEqual(olds.ipAllocationPolicy, news.ipAllocationPolicy)) {
                 return { action: "replace" };
             }
-            // `initialNodePool` is intentionally NOT part of diff — it is
-            // consumed only on create. See ClusterProps JSDoc.
+            // `initialNodePool` and `networkConfig` are intentionally NOT
+            // part of diff — both are consumed only on create. See the
+            // ClusterProps JSDoc (networkConfig explains why a same-name
+            // replace would be destructive).
             return undefined;
         }),
         reconcile: Effect.fn(function* ({ id, news, session }) {
@@ -243,6 +245,7 @@ export const ClusterProvider = () => Provider.effect(Cluster, Effect.gen(functio
                             ...(news.ipAllocationPolicy
                                 ? { ipAllocationPolicy: news.ipAllocationPolicy }
                                 : {}),
+                            ...(news.networkConfig ? { networkConfig: news.networkConfig } : {}),
                             ...(news.releaseChannel ? { releaseChannel: news.releaseChannel } : {}),
                             ...(news.workloadIdentityConfig
                                 ? { workloadIdentityConfig: news.workloadIdentityConfig }