@microagi/alchemy-gcp 0.5.1 → 0.6.0

package/lib/Auth/Credentials.d.ts

@@ -1,5 +1,5 @@
-import { ConfigError, Credentials } from "@distilled.cloud/gcp";
-import { Profile } from "alchemy/Auth/Profile";
+import { Credentials } from "@distilled.cloud/gcp";
+import { AlchemyProfile } from "alchemy/Auth/Profile";
 import * as Config from "effect/Config";
 import * as Layer from "effect/Layer";
 export { Credentials } from "@distilled.cloud/gcp";
@@ -12,8 +12,14 @@ export { Credentials } from "@distilled.cloud/gcp";
  *
  * Prefer {@link fromAuthProvider} when the stack runs through
  * `alchemy login` / `ALCHEMY_PROFILE`.
+ *
+ * The `Credentials` service is lazy (its value is an `Effect<Config>`
+ * re-evaluated per SDK call), so minting happens at request time —
+ * `google-auth-library` caches and refreshes underneath. Failures
+ * become defects: the service channel carries no typed error, matching
+ * distilled's own `CredentialsFromEnv`.
  */
-export declare const fromADC: (project?: string) => Layer.Layer<Credentials, ConfigError, never>;
+export declare const fromADC: (project?: string) => Layer.Layer<Credentials, never, never>;
 /**
  * Build a `Credentials` Layer that resolves GCP credentials via the
  * Alchemy AuthProvider registry, using the active profile (from
@@ -25,5 +31,5 @@ export declare const fromADC: (project?: string) => Layer.Layer<Credentials, Con
  * ultimately call `mintToken`, which is just a thin wrapper over
  * `google-auth-library`.
  */
-export declare const fromAuthProvider: () => Layer.Layer<Credentials, ConfigError | Config.ConfigError | import("alchemy/Auth/AuthProvider").AuthError, import("alchemy").AuthProviders | Profile>;
+export declare const fromAuthProvider: () => Layer.Layer<Credentials, Config.ConfigError | import("alchemy/Auth/AuthProvider").AuthError, import("alchemy").AuthProviders | AlchemyProfile>;
 //# sourceMappingURL=Credentials.d.ts.map

package/lib/Auth/Credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAmB,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASnD;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,GAAI,UAAU,MAAM,iDAIrC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,6JAoB1B,CAAC"}
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAmB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASnD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,GAAI,UAAU,MAAM,2CAIrC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,sJAwB1B,CAAC"}

package/lib/Auth/Credentials.js

@@ -1,6 +1,6 @@
 import { ConfigError, Credentials } from "@distilled.cloud/gcp";
 import { getAuthProvider } from "alchemy/Auth/AuthProvider";
-import { ALCHEMY_PROFILE, Profile } from "alchemy/Auth/Profile";
+import { ALCHEMY_PROFILE, AlchemyProfile } from "alchemy/Auth/Profile";
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -18,8 +18,14 @@ const toConfigError = (e) => new ConfigError({
  *
  * Prefer {@link fromAuthProvider} when the stack runs through
  * `alchemy login` / `ALCHEMY_PROFILE`.
+ *
+ * The `Credentials` service is lazy (its value is an `Effect<Config>`
+ * re-evaluated per SDK call), so minting happens at request time —
+ * `google-auth-library` caches and refreshes underneath. Failures
+ * become defects: the service channel carries no typed error, matching
+ * distilled's own `CredentialsFromEnv`.
  */
-export const fromADC = (project) => Layer.effect(Credentials, mintToken({ project }).pipe(Effect.mapError(toConfigError)));
+export const fromADC = (project) => Layer.succeed(Credentials, mintToken({ project }).pipe(Effect.mapError(toConfigError), Effect.orDie));
 /**
  * Build a `Credentials` Layer that resolves GCP credentials via the
  * Alchemy AuthProvider registry, using the active profile (from
@@ -32,11 +38,14 @@ export const fromADC = (project) => Layer.effect(Credentials, mintToken({ projec
  * `google-auth-library`.
  */
 export const fromAuthProvider = () => Layer.effect(Credentials, Effect.gen(function* () {
-    const profile = yield* Profile;
+    const profile = yield* AlchemyProfile;
     const auth = yield* getAuthProvider(GCP_AUTH_PROVIDER_NAME);
     const profileName = yield* ALCHEMY_PROFILE;
     const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
     const ctx = yield* Effect.context();
-    return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((cfg) => auth.read(profileName, cfg)), Effect.map(({ accessToken, project }) => ({ accessToken, project })), Effect.mapError(toConfigError), Effect.provide(ctx));
+    // The service value is itself an Effect (lazy credentials):
+    // profile/provider wiring resolves once at layer build, while
+    // loadOrConfigure + token read run per SDK call.
+    return profile.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((cfg) => auth.read(profileName, cfg)), Effect.map(({ accessToken, project }) => ({ accessToken, project })), Effect.mapError(toConfigError), Effect.provide(ctx), Effect.orDie);
 }));
 //# sourceMappingURL=Credentials.js.map

package/lib/Auth/Credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EAGtB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,CAAiC,EAAE,EAAE,CAC1D,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,sCACN,CAA0B,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAClD,EAAE;CACH,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAC1C,KAAK,CAAC,MAAM,CACV,WAAW,EACX,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC5D,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAGjC,sBAAsB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAE3C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAoB,CAAC,CAAC,EACrE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EACpE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CACpB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EAGtB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,CAAiC,EAAE,EAAE,CAC1D,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,sCACN,CAA0B,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAClD,EAAE;CACH,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAC1C,KAAK,CAAC,OAAO,CACX,WAAW,EACX,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAC1E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAGjC,sBAAsB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAE3C,4DAA4D;IAC5D,8DAA8D;IAC9D,iDAAiD;IACjD,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAoB,CAAC,CAAC,EACrE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EACpE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EACnB,MAAM,CAAC,KAAK,CACb,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/Address.d.ts

@@ -0,0 +1,97 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A regional compute Address. The intended use here is a **Private
+ * Service Connect consumer endpoint IP** — a single internal address
+ * reserved in a subnet (`addressType=INTERNAL`, `purpose=GCE_ENDPOINT`)
+ * that a `ForwardingRule` then binds to a producer service attachment
+ * (e.g. a Cloud SQL instance in another VPC).
+ *
+ * For global PSA *ranges* (`purpose=VPC_PEERING`) use
+ * {@link GlobalAddress} — that is a different API surface
+ * (`globalAddresses` vs regional `addresses`).
+ *
+ * Adoption uses the labels field (Address carries `labels` +
+ * `labelFingerprint`).
+ *
+ * @section Reserving a PSC endpoint IP
+ * @example Internal address inside a subnet for a PSC forwarding rule
+ * ```typescript
+ * const endpointIp = yield* GCP.Address("DbPscAddress", {
+ *   project: hostProject.projectId,
+ *   region: "europe-west1",
+ *   subnetwork: pscSubnet.selfLink,
+ *   address: "10.0.16.5",
+ * });
+ * ```
+ */
+export type AddressProps = {
+    /** GCP project ID hosting the address. Immutable — replace if changed. */
+    project: string;
+    /** GCP region. Addresses are regional — a different region requires replace. */
+    region: string;
+    /**
+     * Address name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 63 })`. Immutable — replace if changed.
+     */
+    name?: string;
+    /** Description (free-form). Set on create; immutable. */
+    description?: string;
+    /**
+     * Internal vs external. Defaults to `INTERNAL` (the only value that
+     * makes sense for a PSC endpoint IP). Immutable — replace.
+     */
+    addressType?: "INTERNAL" | "EXTERNAL";
+    /**
+     * Address purpose. For a PSC endpoint IP use `GCE_ENDPOINT` (the
+     * default GCP assigns to plain internal addresses). Immutable — replace.
+     */
+    purpose?: "GCE_ENDPOINT" | "SHARED_LOADBALANCER_VIP" | "DNS_RESOLVER";
+    /**
+     * URL of the subnetwork the address is allocated from. Pass
+     * `subnet.selfLink` from a `GCP.Subnetwork` to make alchemy sequence
+     * the address after the subnet. Required for INTERNAL addresses.
+     * Immutable — replace.
+     */
+    subnetwork: string;
+    /**
+     * Explicit IP to reserve inside the subnet's range. If omitted, GCP
+     * picks one. Immutable — replace.
+     */
+    address?: string;
+    /**
+     * Resource labels. Alchemy internal labels (`alchemy_app`,
+     * `alchemy_stage`, `alchemy_id`) are merged on top automatically and
+     * are reserved. Mutable via `setLabels`.
+     */
+    labels?: Record<string, string>;
+};
+export type AddressAttributes = {
+    /** Address name. */
+    name: string;
+    /** GCP project ID, threaded through from props for delete/read. */
+    project: string;
+    /** GCP region, threaded through from props for delete/read. */
+    region: string;
+    /** Server-defined URL. */
+    selfLink: string;
+    /** Server-assigned numeric id. */
+    id: string;
+    /** The reserved IP. */
+    address: string;
+    /** Address type. */
+    addressType: string | undefined;
+    /** Purpose. */
+    purpose: string | undefined;
+    /** Subnetwork URL. */
+    subnetwork: string | undefined;
+    /** Status: `RESERVING`, `RESERVED`, `IN_USE`. */
+    status: string | undefined;
+    /** Labels currently set, including the alchemy internals. */
+    labels: Record<string, string>;
+};
+export type Address = Resource<"GCP.Address", AddressProps, AddressAttributes, never, GCP.Providers>;
+export declare const Address: import("alchemy").ResourceClass<Address>;
+export declare const AddressProvider: () => import("effect/Layer").Layer<Provider.Provider<Address>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Address.d.ts.map

package/lib/Compute/Address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Address.d.ts","sourceRoot":"","sources":["../../src/Compute/Address.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,GAAG,yBAAyB,GAAG,cAAc,CAAC;IACtE;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,eAAe;IACf,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,sBAAsB;IACtB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iDAAiD;IACjD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AAmBxD,eAAO,MAAM,eAAe,8NA6JzB,CAAC"}

package/lib/Compute/Address.js

@@ -0,0 +1,143 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeAwaitRegionOperation } from "./Operations.js";
+export const Address = Resource("GCP.Address");
+const toAddressAttributes = (a, parent) => ({
+    name: a.name ?? "",
+    project: parent.project,
+    region: parent.region,
+    selfLink: a.selfLink ?? "",
+    id: a.id ?? "",
+    address: a.address ?? "",
+    addressType: a.addressType,
+    purpose: a.purpose,
+    subnetwork: a.subnetwork,
+    status: a.status,
+    labels: { ...(a.labels ?? {}) },
+});
+export const AddressProvider = () => Provider.effect(Address, Effect.gen(function* () {
+    const getAddresses = yield* compute.getAddresses;
+    const insertAddresses = yield* compute.insertAddresses;
+    const deleteAddresses = yield* compute.deleteAddresses;
+    const setLabelsAddresses = yield* compute.setLabelsAddresses;
+    const getRegionOperations = yield* compute.getRegionOperations;
+    const awaitOp = makeAwaitRegionOperation(getRegionOperations);
+    const observe = (project, region, name) => getAddresses({ project, region, address: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncLabels = Effect.fn(function* (args) {
+        if (deepEqual(args.observed.labels ?? {}, args.desired))
+            return;
+        const op = yield* setLabelsAddresses({
+            project: args.project,
+            region: args.region,
+            resource: args.observed.name ?? "",
+            body: {
+                labels: args.desired,
+                labelFingerprint: args.observed.labelFingerprint,
+            },
+        });
+        if (op.name) {
+            yield* awaitOp(args.project, args.region, op.name, args.session);
+        }
+    });
+    return {
+        stables: ["name", "project", "region", "selfLink", "id", "address"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "region",
+                "name",
+                "addressType",
+                "purpose",
+                "subnetwork",
+                "address",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            let observed = yield* observe(news.project, news.region, desiredName);
+            if (!observed) {
+                const body = {
+                    name: desiredName,
+                    ...(news.description ? { description: news.description } : {}),
+                    addressType: news.addressType ?? "INTERNAL",
+                    ...(news.purpose ? { purpose: news.purpose } : {}),
+                    subnetwork: news.subnetwork,
+                    ...(news.address ? { address: news.address } : {}),
+                    labels: desiredLabels,
+                };
+                const op = yield* insertAddresses({
+                    project: news.project,
+                    region: news.region,
+                    body,
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (op?.name) {
+                    yield* awaitOp(news.project, news.region, op.name, session);
+                }
+                observed = yield* getAddresses({
+                    project: news.project,
+                    region: news.region,
+                    address: desiredName,
+                });
+            }
+            yield* syncLabels({
+                project: news.project,
+                region: news.region,
+                observed,
+                desired: desiredLabels,
+                session,
+            });
+            const final = yield* getAddresses({
+                project: news.project,
+                region: news.region,
+                address: desiredName,
+            });
+            return toAddressAttributes(final, {
+                project: news.project,
+                region: news.region,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteAddresses({
+                project: output.project,
+                region: output.region,
+                address: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOp(output.project, output.region, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const region = output?.region ?? olds?.region;
+            if (!project || !region)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, region, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAddressAttributes(observed, { project, region });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Address.js.map

package/lib/Compute/Address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Address.js","sourceRoot":"","sources":["../../src/Compute/Address.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAqG3D,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD,MAAM,mBAAmB,GAAG,CAC1B,CAAkB,EAClB,MAA2C,EACxB,EAAE,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC7D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,OAAO,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAChE,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAwC,CAAC,CACzD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAwC,CAAC,CACzD,CACF,CAAC;IAEJ,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMvC;QACC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAChE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;aACjD;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QACnE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAoB,EAAE,IAAI,EAAE;gBAChD,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,aAAa;gBACb,SAAS;gBACT,YAAY;gBACZ,SAAS;aACV,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,GAAoB;oBAC5B,IAAI,EAAE,WAAW;oBACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,UAAU;oBAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,EAAE,aAAa;iBACtB,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI;iBACL,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA0C,CAAC,CAC3D,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;oBACb,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,WAAW;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,CAAC,UAAU,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;gBACR,OAAO,EAAE,aAAa;gBACtB,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,eAAe,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,IAAI;aACrB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAM/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/Firewall.d.ts

@@ -0,0 +1,108 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/** One allow entry: a protocol plus optional port list. */
+export type FirewallAllowed = {
+    /** `tcp` | `udp` | `icmp` | `esp` | `ah` | `sctp` | protocol number. */
+    IPProtocol: string;
+    /** Ports / ranges (`"8000"`, `"8000-8100"`). Omit = all ports. */
+    ports?: ReadonlyArray<string>;
+};
+/**
+ * A VPC firewall rule (allow rules only — `denied` is not modelled;
+ * add it when a consumer needs it).
+ *
+ * Firewalls have no `labels` field, so adoption gating uses the
+ * alchemy marker embedded in `description` (same as `GCP.Network`).
+ * Unlike Network, firewall `description` IS mutable, and the sync step
+ * keeps the marker prefix in place on every reconcile.
+ *
+ * GCP rejects rules carrying BOTH `targetTags` and
+ * `targetServiceAccounts` — prefer service accounts for GKE node
+ * targeting: node tags embed a per-cluster random suffix and go stale
+ * on every cluster rebuild, while the compute default SA is stable.
+ *
+ * @section Creating a firewall rule
+ * @example GCLB health checks → GKE pods on 8000
+ * ```typescript
+ * yield* GCP.Firewall("LbHealthChecks", {
+ *   project: host.projectId,
+ *   network: vpc.selfLink,
+ *   name: "k8s-app-hc",
+ *   sourceRanges: ["130.211.0.0/22", "35.191.0.0/16"],
+ *   allowed: [{ IPProtocol: "tcp", ports: ["8000"] }],
+ *   targetServiceAccounts: [nodeSa],
+ * });
+ * ```
+ */
+export type FirewallProps = {
+    /** GCP project ID hosting the rule. Immutable — replace if changed. */
+    project: string;
+    /**
+     * Rule name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 63 })`. Immutable — replace if changed.
+     */
+    name?: string;
+    /**
+     * VPC the rule attaches to — short name or selfLink. Immutable —
+     * replace if changed.
+     */
+    network: string;
+    /** User-visible description (stored after the alchemy marker). Mutable. */
+    description?: string;
+    /** INGRESS (default) or EGRESS. Immutable — replace if changed. */
+    direction?: "INGRESS" | "EGRESS";
+    /** 0–65535, lower wins. GCP default 1000. Mutable. */
+    priority?: number;
+    /** Source CIDRs (INGRESS). Mutable. */
+    sourceRanges?: ReadonlyArray<string>;
+    /** Destination CIDRs (EGRESS). Mutable. */
+    destinationRanges?: ReadonlyArray<string>;
+    /** Allow entries. Required — this resource models allow rules only. Mutable. */
+    allowed: ReadonlyArray<FirewallAllowed>;
+    /**
+     * Instance network tags the rule applies to. Mutually exclusive with
+     * `targetServiceAccounts`. Mutable.
+     */
+    targetTags?: ReadonlyArray<string>;
+    /**
+     * Service accounts whose instances the rule applies to. Preferred
+     * over tags for GKE nodes (stable across cluster rebuilds). Mutually
+     * exclusive with `targetTags`. Mutable.
+     */
+    targetServiceAccounts?: ReadonlyArray<string>;
+    /** Rule disabled (kept but not enforced). Mutable. */
+    disabled?: boolean;
+};
+export type FirewallAttributes = {
+    /** Rule name. */
+    name: string;
+    /** GCP project ID, threaded through from props for delete/read. */
+    project: string;
+    /** Server-defined URL. */
+    selfLink: string;
+    /** Server-assigned numeric id. */
+    id: string;
+    /** VPC selfLink the rule is attached to. */
+    network: string;
+    /** INGRESS / EGRESS. */
+    direction: string | undefined;
+    /** Effective priority. */
+    priority: number | undefined;
+    /** Source CIDRs. */
+    sourceRanges: ReadonlyArray<string> | undefined;
+    /** Allow entries. */
+    allowed: ReadonlyArray<FirewallAllowed> | undefined;
+    /** Target network tags. */
+    targetTags: ReadonlyArray<string> | undefined;
+    /** Target service accounts. */
+    targetServiceAccounts: ReadonlyArray<string> | undefined;
+    /** User description (alchemy marker stripped). */
+    description: string | undefined;
+    /** Disabled flag. */
+    disabled: boolean | undefined;
+};
+export type Firewall = Resource<"GCP.Firewall", FirewallProps, FirewallAttributes, never, GCP.Providers>;
+export declare const Firewall: import("alchemy").ResourceClass<Firewall>;
+export declare const FirewallProvider: () => import("effect/Layer").Layer<Provider.Provider<Firewall>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Firewall.d.ts.map

package/lib/Compute/Firewall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Firewall.d.ts","sourceRoot":"","sources":["../../src/Compute/Firewall.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAO7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,oBAAoB;IACpB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAChD,qBAAqB;IACrB,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;IACpD,2BAA2B;IAC3B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,+BAA+B;IAC/B,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACzD,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAC7B,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,QAAQ,2CAAqC,CAAC;AAqD3D,eAAO,MAAM,gBAAgB,+NAsJ1B,CAAC"}

package/lib/Compute/Firewall.js

@@ -0,0 +1,163 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitGlobalOperation } from "./Operations.js";
+export const Firewall = Resource("GCP.Firewall");
+const toFirewallAttributes = (f, parent) => ({
+    name: f.name ?? "",
+    project: parent.project,
+    selfLink: f.selfLink ?? "",
+    id: f.id ?? "",
+    network: f.network ?? "",
+    direction: f.direction,
+    priority: f.priority,
+    sourceRanges: f.sourceRanges,
+    allowed: f.allowed,
+    targetTags: f.targetTags,
+    targetServiceAccounts: f.targetServiceAccounts,
+    description: stripAlchemyMarker(f.description),
+    disabled: f.disabled,
+});
+/**
+ * Normalize for drift comparison: GCP reorders list fields and the
+ * `allowed` entries' ports — compare order-insensitively so a
+ * cosmetic reordering doesn't trigger a PATCH every reconcile.
+ */
+const normalized = (f) => ({
+    priority: f.priority ?? 1000,
+    sourceRanges: [...(f.sourceRanges ?? [])].sort(),
+    destinationRanges: [...(f.destinationRanges ?? [])].sort(),
+    allowed: [...(f.allowed ?? [])]
+        .map((a) => ({
+        IPProtocol: (a.IPProtocol ?? "").toLowerCase(),
+        ports: [...(a.ports ?? [])].sort(),
+    }))
+        .sort((x, y) => x.IPProtocol.localeCompare(y.IPProtocol)),
+    targetTags: [...(f.targetTags ?? [])].sort(),
+    targetServiceAccounts: [...(f.targetServiceAccounts ?? [])].sort(),
+    disabled: f.disabled ?? false,
+    description: f.description,
+});
+export const FirewallProvider = () => Provider.effect(Firewall, Effect.gen(function* () {
+    const getFirewalls = yield* compute.getFirewalls;
+    const insertFirewalls = yield* compute.insertFirewalls;
+    const patchFirewalls = yield* compute.patchFirewalls;
+    const deleteFirewalls = yield* compute.deleteFirewalls;
+    const getGlobalOperations = yield* compute.getGlobalOperations;
+    const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+    const observe = (project, name) => getFirewalls({ project, firewall: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    return {
+        stables: ["name", "project", "selfLink", "id", "network"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "name",
+                "network",
+                "direction",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            if (news.targetTags?.length && news.targetServiceAccounts?.length) {
+                return yield* Effect.fail(new Error("Firewall: targetTags and targetServiceAccounts are mutually exclusive (GCP rejects rules with both)"));
+            }
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredDescription = yield* gcpAlchemyDescription(id, news.description);
+            const mutableBody = () => ({
+                description: desiredDescription,
+                ...(news.priority !== undefined ? { priority: news.priority } : {}),
+                ...(news.sourceRanges
+                    ? { sourceRanges: [...news.sourceRanges] }
+                    : {}),
+                ...(news.destinationRanges
+                    ? { destinationRanges: [...news.destinationRanges] }
+                    : {}),
+                allowed: news.allowed.map((a) => ({
+                    IPProtocol: a.IPProtocol,
+                    ...(a.ports ? { ports: [...a.ports] } : {}),
+                })),
+                // Always send both target fields: switching tags → service
+                // accounts must CLEAR the other side, and PATCH leaves
+                // omitted fields untouched.
+                targetTags: [...(news.targetTags ?? [])],
+                targetServiceAccounts: [...(news.targetServiceAccounts ?? [])],
+                disabled: news.disabled ?? false,
+            });
+            // 1. Observe — collapse 403 to "missing" alongside 404.
+            let observed = yield* observe(news.project, desiredName);
+            // 2. Ensure — create if missing. `Conflict` covers concurrent
+            //    creates and state-persistence races.
+            if (!observed) {
+                const op = yield* insertFirewalls({
+                    project: news.project,
+                    body: {
+                        name: desiredName,
+                        network: news.network,
+                        ...(news.direction ? { direction: news.direction } : {}),
+                        ...mutableBody(),
+                    },
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (op?.name)
+                    yield* awaitOp(news.project, op.name, session);
+                observed = yield* getFirewalls({
+                    project: news.project,
+                    firewall: desiredName,
+                });
+            }
+            // 3. Sync — everything except name/network/direction is
+            //    PATCHable. Diff against OBSERVED state (cloud is
+            //    authoritative), order-insensitively.
+            const desired = mutableBody();
+            if (!deepEqual(normalized(observed), normalized(desired))) {
+                const op = yield* patchFirewalls({
+                    project: news.project,
+                    firewall: desiredName,
+                    body: desired,
+                });
+                if (op.name)
+                    yield* awaitOp(news.project, op.name, session);
+            }
+            const final = yield* getFirewalls({
+                project: news.project,
+                firewall: desiredName,
+            });
+            return toFirewallAttributes(final, { project: news.project });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteFirewalls({
+                project: output.project,
+                firewall: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOp(output.project, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            if (!project)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, name);
+            if (!observed)
+                return undefined;
+            const attrs = toFirewallAttributes(observed, { project });
+            // Adoption gate via the description marker — firewalls have
+            // no labels field (same situation as GCP.Network).
+            return (yield* descriptionHasAlchemyMarker(id, observed.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Firewall.js.map

package/lib/Compute/Firewall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Firewall.js","sourceRoot":"","sources":["../../src/Compute/Firewall.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAiH3D,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,cAAc,CAAC,CAAC;AAE3D,MAAM,oBAAoB,GAAG,CAC3B,CAAmB,EACnB,MAA2B,EACP,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAqD;IAChE,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;IAC9C,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,QAAQ;CACrB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,CAWnB,EAAE,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;IAC5B,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3D,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAC5C,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;IAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,MAAM,CACb,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,OAAO,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE,CAChD,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAyC,CAAC,CAC1D,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAyC,CAAC,CAC1D,CACF,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QACzD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAqB,EAAE,IAAI,EAAE;gBACjD,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,WAAW;aACZ,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,qGAAqG,CACtG,CACF,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrD,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,MAAM,WAAW,GAAG,GAAqB,EAAE,CAAC,CAAC;gBAC3C,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,YAAY;oBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,iBAAiB;oBACxB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,2DAA2D;gBAC3D,uDAAuD;gBACvD,4BAA4B;gBAC5B,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACxC,qBAAqB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;gBAC9D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;aACjC,CAAC,CAAC;YAEH,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEzD,8DAA8D;YAC9D,0CAA0C;YAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE;wBACJ,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxD,GAAG,WAAW,EAAE;qBACjB;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA0C,CAAC,CAC3D,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,wDAAwD;YACxD,sDAAsD;YACtD,0CAA0C;YAC1C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,oBAAoB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,eAAe,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1D,4DAA4D;YAC5D,mDAAmD;YACnD,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}