@microagi/alchemy-gcp 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.7.0 — 2026-06-16
+
+### Added
+
+- **`GCP.KubernetesManifest`** — generic Alchemy resource for *any*
+  Kubernetes Kind/CRD, server-side-applied via
+  `Content-Type: application/apply-patch+yaml` with `fieldManager=alchemy`
+  and `force=true`. Kind → REST resource (plural + scope) resolved through
+  the apiserver's discovery endpoint, so built-ins and CRDs work without a
+  hard-coded kind→plural table. Adoption gated on the standard
+  `alchemy_app`/`alchemy_stage`/`alchemy_id` label triple.
+
+- **`clusterLayer` (`src/Kubernetes/connection.ts`)** — wires a GKE
+  cluster into the typed `@distilled.cloud/kubernetes` SDK: ADC bearer
+  token (`Credentials`) + an `HttpClient` whose `FetchHttpClient.Fetch` is
+  overridden with a `node:https` fetch that trusts the per-cluster CA.
+  The stock fetch can't verify the GKE cert (it's signed by the
+  cluster's own CA, not a public root), so the override is required.
+
+### Changed
+
+- **`GCP.KubernetesSecret` convergence** — moved off the hand-rolled
+  client onto typed `@distilled.cloud/kubernetes` core/v1 ops. Reconcile
+  is now **create + replace (PUT)** with the observed `resourceVersion`
+  for optimistic concurrency, bounded `Conflict` retry (recursive on the
+  whole observe→write flow, up to 3 re-attempts), and read-modify-write
+  metadata that preserves foreign annotations/owner references/finalizers
+  (a PUT replaces the whole object, so spreading `...observed.metadata`
+  first and overlaying only what we manage is essential — without it
+  every reconcile would strip an `ownerReference` and break garbage
+  collection). Validation scripts in `scripts/validate-k8s-{connection,
+  secret,manifest}.ts` cover live cluster runs against `research-cluster-a`.
+
+## 0.6.0 — 2026-06-14
+
+### Added
+
+- **`GCP.KubernetesSecret`** — first Kubernetes resource in the
+  provider. Opaque Secret in a GKE cluster, driven via a hand-rolled
+  REST client with ADC bearer auth + per-cluster CA trust. Adoptable via
+  the standard alchemy-internal label triple.
+
+### Changed
+
+- **`Auth/Credentials.fromAuthProvider`** — same fix as `0.5.1`,
+  re-asserted against the freshly bumped workspace pins.
+
 ## 0.5.1 — 2026-06-08
 
 ### Fixed

package/lib/Auth/Credentials.d.ts

@@ -1,5 +1,5 @@
-import { ConfigError, Credentials } from "@distilled.cloud/gcp";
-import { Profile } from "alchemy/Auth/Profile";
+import { Credentials } from "@distilled.cloud/gcp";
+import { AlchemyProfile } from "alchemy/Auth/Profile";
 import * as Config from "effect/Config";
 import * as Layer from "effect/Layer";
 export { Credentials } from "@distilled.cloud/gcp";
@@ -12,8 +12,14 @@ export { Credentials } from "@distilled.cloud/gcp";
  *
  * Prefer {@link fromAuthProvider} when the stack runs through
  * `alchemy login` / `ALCHEMY_PROFILE`.
+ *
+ * The `Credentials` service is lazy (its value is an `Effect<Config>`
+ * re-evaluated per SDK call), so minting happens at request time —
+ * `google-auth-library` caches and refreshes underneath. Failures
+ * become defects: the service channel carries no typed error, matching
+ * distilled's own `CredentialsFromEnv`.
  */
-export declare const fromADC: (project?: string) => Layer.Layer<Credentials, ConfigError, never>;
+export declare const fromADC: (project?: string) => Layer.Layer<Credentials, never, never>;
 /**
  * Build a `Credentials` Layer that resolves GCP credentials via the
  * Alchemy AuthProvider registry, using the active profile (from
@@ -25,5 +31,5 @@ export declare const fromADC: (project?: string) => Layer.Layer<Credentials, Con
  * ultimately call `mintToken`, which is just a thin wrapper over
  * `google-auth-library`.
  */
-export declare const fromAuthProvider: () => Layer.Layer<Credentials, ConfigError | Config.ConfigError | import("alchemy/Auth/AuthProvider").AuthError, import("alchemy").AuthProviders | Profile>;
+export declare const fromAuthProvider: () => Layer.Layer<Credentials, Config.ConfigError | import("alchemy/Auth/AuthProvider").AuthError, import("alchemy").AuthProviders | AlchemyProfile>;
 //# sourceMappingURL=Credentials.d.ts.map

package/lib/Auth/Credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAmB,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASnD;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,GAAI,UAAU,MAAM,iDAIrC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,6JAoB1B,CAAC"}
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAmB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASnD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,GAAI,UAAU,MAAM,2CAIrC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,sJAwB1B,CAAC"}

package/lib/Auth/Credentials.js

@@ -1,6 +1,6 @@
 import { ConfigError, Credentials } from "@distilled.cloud/gcp";
 import { getAuthProvider } from "alchemy/Auth/AuthProvider";
-import { ALCHEMY_PROFILE, Profile } from "alchemy/Auth/Profile";
+import { ALCHEMY_PROFILE, AlchemyProfile } from "alchemy/Auth/Profile";
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -18,8 +18,14 @@ const toConfigError = (e) => new ConfigError({
  *
  * Prefer {@link fromAuthProvider} when the stack runs through
  * `alchemy login` / `ALCHEMY_PROFILE`.
+ *
+ * The `Credentials` service is lazy (its value is an `Effect<Config>`
+ * re-evaluated per SDK call), so minting happens at request time —
+ * `google-auth-library` caches and refreshes underneath. Failures
+ * become defects: the service channel carries no typed error, matching
+ * distilled's own `CredentialsFromEnv`.
  */
-export const fromADC = (project) => Layer.effect(Credentials, mintToken({ project }).pipe(Effect.mapError(toConfigError)));
+export const fromADC = (project) => Layer.succeed(Credentials, mintToken({ project }).pipe(Effect.mapError(toConfigError), Effect.orDie));
 /**
  * Build a `Credentials` Layer that resolves GCP credentials via the
  * Alchemy AuthProvider registry, using the active profile (from
@@ -32,11 +38,14 @@ export const fromADC = (project) => Layer.effect(Credentials, mintToken({ projec
  * `google-auth-library`.
  */
 export const fromAuthProvider = () => Layer.effect(Credentials, Effect.gen(function* () {
-    const profile = yield* Profile;
+    const profile = yield* AlchemyProfile;
     const auth = yield* getAuthProvider(GCP_AUTH_PROVIDER_NAME);
     const profileName = yield* ALCHEMY_PROFILE;
     const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
     const ctx = yield* Effect.context();
-    return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((cfg) => auth.read(profileName, cfg)), Effect.map(({ accessToken, project }) => ({ accessToken, project })), Effect.mapError(toConfigError), Effect.provide(ctx));
+    // The service value is itself an Effect (lazy credentials):
+    // profile/provider wiring resolves once at layer build, while
+    // loadOrConfigure + token read run per SDK call.
+    return profile.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((cfg) => auth.read(profileName, cfg)), Effect.map(({ accessToken, project }) => ({ accessToken, project })), Effect.mapError(toConfigError), Effect.provide(ctx), Effect.orDie);
 }));
 //# sourceMappingURL=Credentials.js.map

package/lib/Auth/Credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EAGtB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,CAAiC,EAAE,EAAE,CAC1D,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,sCACN,CAA0B,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAClD,EAAE;CACH,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAC1C,KAAK,CAAC,MAAM,CACV,WAAW,EACX,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC5D,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAGjC,sBAAsB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAE3C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAoB,CAAC,CAAC,EACrE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EACpE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CACpB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EAGtB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,CAAiC,EAAE,EAAE,CAC1D,IAAI,WAAW,CAAC;IACd,OAAO,EAAE,sCACN,CAA0B,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAClD,EAAE;CACH,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAC1C,KAAK,CAAC,OAAO,CACX,WAAW,EACX,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAC1E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAGjC,sBAAsB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAE3C,4DAA4D;IAC5D,8DAA8D;IAC9D,iDAAiD;IACjD,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAoB,CAAC,CAAC,EACrE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EACpE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EACnB,MAAM,CAAC,KAAK,CACb,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/Address.d.ts

@@ -0,0 +1,97 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A regional compute Address. The intended use here is a **Private
+ * Service Connect consumer endpoint IP** — a single internal address
+ * reserved in a subnet (`addressType=INTERNAL`, `purpose=GCE_ENDPOINT`)
+ * that a `ForwardingRule` then binds to a producer service attachment
+ * (e.g. a Cloud SQL instance in another VPC).
+ *
+ * For global PSA *ranges* (`purpose=VPC_PEERING`) use
+ * {@link GlobalAddress} — that is a different API surface
+ * (`globalAddresses` vs regional `addresses`).
+ *
+ * Adoption uses the labels field (Address carries `labels` +
+ * `labelFingerprint`).
+ *
+ * @section Reserving a PSC endpoint IP
+ * @example Internal address inside a subnet for a PSC forwarding rule
+ * ```typescript
+ * const endpointIp = yield* GCP.Address("DbPscAddress", {
+ *   project: hostProject.projectId,
+ *   region: "europe-west1",
+ *   subnetwork: pscSubnet.selfLink,
+ *   address: "10.0.16.5",
+ * });
+ * ```
+ */
+export type AddressProps = {
+    /** GCP project ID hosting the address. Immutable — replace if changed. */
+    project: string;
+    /** GCP region. Addresses are regional — a different region requires replace. */
+    region: string;
+    /**
+     * Address name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 63 })`. Immutable — replace if changed.
+     */
+    name?: string;
+    /** Description (free-form). Set on create; immutable. */
+    description?: string;
+    /**
+     * Internal vs external. Defaults to `INTERNAL` (the only value that
+     * makes sense for a PSC endpoint IP). Immutable — replace.
+     */
+    addressType?: "INTERNAL" | "EXTERNAL";
+    /**
+     * Address purpose. For a PSC endpoint IP use `GCE_ENDPOINT` (the
+     * default GCP assigns to plain internal addresses). Immutable — replace.
+     */
+    purpose?: "GCE_ENDPOINT" | "SHARED_LOADBALANCER_VIP" | "DNS_RESOLVER";
+    /**
+     * URL of the subnetwork the address is allocated from. Pass
+     * `subnet.selfLink` from a `GCP.Subnetwork` to make alchemy sequence
+     * the address after the subnet. Required for INTERNAL addresses.
+     * Immutable — replace.
+     */
+    subnetwork: string;
+    /**
+     * Explicit IP to reserve inside the subnet's range. If omitted, GCP
+     * picks one. Immutable — replace.
+     */
+    address?: string;
+    /**
+     * Resource labels. Alchemy internal labels (`alchemy_app`,
+     * `alchemy_stage`, `alchemy_id`) are merged on top automatically and
+     * are reserved. Mutable via `setLabels`.
+     */
+    labels?: Record<string, string>;
+};
+export type AddressAttributes = {
+    /** Address name. */
+    name: string;
+    /** GCP project ID, threaded through from props for delete/read. */
+    project: string;
+    /** GCP region, threaded through from props for delete/read. */
+    region: string;
+    /** Server-defined URL. */
+    selfLink: string;
+    /** Server-assigned numeric id. */
+    id: string;
+    /** The reserved IP. */
+    address: string;
+    /** Address type. */
+    addressType: string | undefined;
+    /** Purpose. */
+    purpose: string | undefined;
+    /** Subnetwork URL. */
+    subnetwork: string | undefined;
+    /** Status: `RESERVING`, `RESERVED`, `IN_USE`. */
+    status: string | undefined;
+    /** Labels currently set, including the alchemy internals. */
+    labels: Record<string, string>;
+};
+export type Address = Resource<"GCP.Address", AddressProps, AddressAttributes, never, GCP.Providers>;
+export declare const Address: import("alchemy").ResourceClass<Address>;
+export declare const AddressProvider: () => import("effect/Layer").Layer<Provider.Provider<Address>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Address.d.ts.map

package/lib/Compute/Address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Address.d.ts","sourceRoot":"","sources":["../../src/Compute/Address.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,GAAG,yBAAyB,GAAG,cAAc,CAAC;IACtE;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,eAAe;IACf,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,sBAAsB;IACtB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iDAAiD;IACjD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AAmBxD,eAAO,MAAM,eAAe,8NA6JzB,CAAC"}

package/lib/Compute/Address.js

@@ -0,0 +1,143 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeAwaitRegionOperation } from "./Operations.js";
+export const Address = Resource("GCP.Address");
+const toAddressAttributes = (a, parent) => ({
+    name: a.name ?? "",
+    project: parent.project,
+    region: parent.region,
+    selfLink: a.selfLink ?? "",
+    id: a.id ?? "",
+    address: a.address ?? "",
+    addressType: a.addressType,
+    purpose: a.purpose,
+    subnetwork: a.subnetwork,
+    status: a.status,
+    labels: { ...(a.labels ?? {}) },
+});
+export const AddressProvider = () => Provider.effect(Address, Effect.gen(function* () {
+    const getAddresses = yield* compute.getAddresses;
+    const insertAddresses = yield* compute.insertAddresses;
+    const deleteAddresses = yield* compute.deleteAddresses;
+    const setLabelsAddresses = yield* compute.setLabelsAddresses;
+    const getRegionOperations = yield* compute.getRegionOperations;
+    const awaitOp = makeAwaitRegionOperation(getRegionOperations);
+    const observe = (project, region, name) => getAddresses({ project, region, address: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncLabels = Effect.fn(function* (args) {
+        if (deepEqual(args.observed.labels ?? {}, args.desired))
+            return;
+        const op = yield* setLabelsAddresses({
+            project: args.project,
+            region: args.region,
+            resource: args.observed.name ?? "",
+            body: {
+                labels: args.desired,
+                labelFingerprint: args.observed.labelFingerprint,
+            },
+        });
+        if (op.name) {
+            yield* awaitOp(args.project, args.region, op.name, args.session);
+        }
+    });
+    return {
+        stables: ["name", "project", "region", "selfLink", "id", "address"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "region",
+                "name",
+                "addressType",
+                "purpose",
+                "subnetwork",
+                "address",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            let observed = yield* observe(news.project, news.region, desiredName);
+            if (!observed) {
+                const body = {
+                    name: desiredName,
+                    ...(news.description ? { description: news.description } : {}),
+                    addressType: news.addressType ?? "INTERNAL",
+                    ...(news.purpose ? { purpose: news.purpose } : {}),
+                    subnetwork: news.subnetwork,
+                    ...(news.address ? { address: news.address } : {}),
+                    labels: desiredLabels,
+                };
+                const op = yield* insertAddresses({
+                    project: news.project,
+                    region: news.region,
+                    body,
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (op?.name) {
+                    yield* awaitOp(news.project, news.region, op.name, session);
+                }
+                observed = yield* getAddresses({
+                    project: news.project,
+                    region: news.region,
+                    address: desiredName,
+                });
+            }
+            yield* syncLabels({
+                project: news.project,
+                region: news.region,
+                observed,
+                desired: desiredLabels,
+                session,
+            });
+            const final = yield* getAddresses({
+                project: news.project,
+                region: news.region,
+                address: desiredName,
+            });
+            return toAddressAttributes(final, {
+                project: news.project,
+                region: news.region,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteAddresses({
+                project: output.project,
+                region: output.region,
+                address: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOp(output.project, output.region, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const region = output?.region ?? olds?.region;
+            if (!project || !region)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, region, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAddressAttributes(observed, { project, region });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Address.js.map

package/lib/Compute/Address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Address.js","sourceRoot":"","sources":["../../src/Compute/Address.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAqG3D,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD,MAAM,mBAAmB,GAAG,CAC1B,CAAkB,EAClB,MAA2C,EACxB,EAAE,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACvD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC7D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,OAAO,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAChE,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAwC,CAAC,CACzD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAwC,CAAC,CACzD,CACF,CAAC;IAEJ,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMvC;QACC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAChE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;aACjD;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QACnE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAoB,EAAE,IAAI,EAAE;gBAChD,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,aAAa;gBACb,SAAS;gBACT,YAAY;gBACZ,SAAS;aACV,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,GAAoB;oBAC5B,IAAI,EAAE,WAAW;oBACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,UAAU;oBAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,EAAE,aAAa;iBACtB,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI;iBACL,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA0C,CAAC,CAC3D,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;oBACb,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,WAAW;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,CAAC,UAAU,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;gBACR,OAAO,EAAE,aAAa;gBACtB,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,eAAe,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,IAAI;aACrB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAM/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Compute/Firewall.d.ts

@@ -0,0 +1,108 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/** One allow entry: a protocol plus optional port list. */
+export type FirewallAllowed = {
+    /** `tcp` | `udp` | `icmp` | `esp` | `ah` | `sctp` | protocol number. */
+    IPProtocol: string;
+    /** Ports / ranges (`"8000"`, `"8000-8100"`). Omit = all ports. */
+    ports?: ReadonlyArray<string>;
+};
+/**
+ * A VPC firewall rule (allow rules only — `denied` is not modelled;
+ * add it when a consumer needs it).
+ *
+ * Firewalls have no `labels` field, so adoption gating uses the
+ * alchemy marker embedded in `description` (same as `GCP.Network`).
+ * Unlike Network, firewall `description` IS mutable, and the sync step
+ * keeps the marker prefix in place on every reconcile.
+ *
+ * GCP rejects rules carrying BOTH `targetTags` and
+ * `targetServiceAccounts` — prefer service accounts for GKE node
+ * targeting: node tags embed a per-cluster random suffix and go stale
+ * on every cluster rebuild, while the compute default SA is stable.
+ *
+ * @section Creating a firewall rule
+ * @example GCLB health checks → GKE pods on 8000
+ * ```typescript
+ * yield* GCP.Firewall("LbHealthChecks", {
+ *   project: host.projectId,
+ *   network: vpc.selfLink,
+ *   name: "k8s-app-hc",
+ *   sourceRanges: ["130.211.0.0/22", "35.191.0.0/16"],
+ *   allowed: [{ IPProtocol: "tcp", ports: ["8000"] }],
+ *   targetServiceAccounts: [nodeSa],
+ * });
+ * ```
+ */
+export type FirewallProps = {
+    /** GCP project ID hosting the rule. Immutable — replace if changed. */
+    project: string;
+    /**
+     * Rule name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 63 })`. Immutable — replace if changed.
+     */
+    name?: string;
+    /**
+     * VPC the rule attaches to — short name or selfLink. Immutable —
+     * replace if changed.
+     */
+    network: string;
+    /** User-visible description (stored after the alchemy marker). Mutable. */
+    description?: string;
+    /** INGRESS (default) or EGRESS. Immutable — replace if changed. */
+    direction?: "INGRESS" | "EGRESS";
+    /** 0–65535, lower wins. GCP default 1000. Mutable. */
+    priority?: number;
+    /** Source CIDRs (INGRESS). Mutable. */
+    sourceRanges?: ReadonlyArray<string>;
+    /** Destination CIDRs (EGRESS). Mutable. */
+    destinationRanges?: ReadonlyArray<string>;
+    /** Allow entries. Required — this resource models allow rules only. Mutable. */
+    allowed: ReadonlyArray<FirewallAllowed>;
+    /**
+     * Instance network tags the rule applies to. Mutually exclusive with
+     * `targetServiceAccounts`. Mutable.
+     */
+    targetTags?: ReadonlyArray<string>;
+    /**
+     * Service accounts whose instances the rule applies to. Preferred
+     * over tags for GKE nodes (stable across cluster rebuilds). Mutually
+     * exclusive with `targetTags`. Mutable.
+     */
+    targetServiceAccounts?: ReadonlyArray<string>;
+    /** Rule disabled (kept but not enforced). Mutable. */
+    disabled?: boolean;
+};
+export type FirewallAttributes = {
+    /** Rule name. */
+    name: string;
+    /** GCP project ID, threaded through from props for delete/read. */
+    project: string;
+    /** Server-defined URL. */
+    selfLink: string;
+    /** Server-assigned numeric id. */
+    id: string;
+    /** VPC selfLink the rule is attached to. */
+    network: string;
+    /** INGRESS / EGRESS. */
+    direction: string | undefined;
+    /** Effective priority. */
+    priority: number | undefined;
+    /** Source CIDRs. */
+    sourceRanges: ReadonlyArray<string> | undefined;
+    /** Allow entries. */
+    allowed: ReadonlyArray<FirewallAllowed> | undefined;
+    /** Target network tags. */
+    targetTags: ReadonlyArray<string> | undefined;
+    /** Target service accounts. */
+    targetServiceAccounts: ReadonlyArray<string> | undefined;
+    /** User description (alchemy marker stripped). */
+    description: string | undefined;
+    /** Disabled flag. */
+    disabled: boolean | undefined;
+};
+export type Firewall = Resource<"GCP.Firewall", FirewallProps, FirewallAttributes, never, GCP.Providers>;
+export declare const Firewall: import("alchemy").ResourceClass<Firewall>;
+export declare const FirewallProvider: () => import("effect/Layer").Layer<Provider.Provider<Firewall>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Firewall.d.ts.map

package/lib/Compute/Firewall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Firewall.d.ts","sourceRoot":"","sources":["../../src/Compute/Firewall.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAO7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,oBAAoB;IACpB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAChD,qBAAqB;IACrB,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;IACpD,2BAA2B;IAC3B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,+BAA+B;IAC/B,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACzD,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAC7B,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,QAAQ,2CAAqC,CAAC;AAqD3D,eAAO,MAAM,gBAAgB,+NAsJ1B,CAAC"}