@microagi/alchemy-gcp 0.5.1 → 0.7.0

package/lib/Kubernetes/Secret.js

@@ -0,0 +1,173 @@
+import { Credentials } from "@distilled.cloud/gcp";
+import { createCoreV1NamespacedSecret, deleteCoreV1NamespacedSecret, readCoreV1NamespacedSecret, replaceCoreV1NamespacedSecret, } from "@distilled.cloud/kubernetes/core";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { clusterLayer } from "./connection.js";
+export const KubernetesSecret = Resource("GCP.KubernetesSecret");
+const toAttributes = (s, parent) => ({
+    name: s?.metadata?.name ?? parent.name,
+    namespace: s?.metadata?.namespace ?? parent.namespace,
+    endpoint: parent.endpoint,
+    caCertificate: parent.caCertificate,
+    type: s?.type ?? parent.type,
+    uid: s?.metadata?.uid,
+    resourceVersion: s?.metadata?.resourceVersion,
+});
+/** Mint a fresh GKE connection from props + ADC credentials. */
+const connect = Effect.fn("k8sSecret.connect")(function* (props) {
+    const { accessToken } = yield* yield* Credentials;
+    return {
+        endpoint: props.endpoint,
+        caCertificate: props.caCertificate,
+        token: accessToken,
+    };
+});
+/** GET a Secret, mapping a 404 (`NotFound`) to `undefined`. */
+const observe = (connection, namespace, name) => readCoreV1NamespacedSecret({ namespace, name }).pipe(Effect.provide(clusterLayer(connection)), Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+/** Base64-encode the (possibly redacted) string values for the `data` field. */
+const encodeData = (stringData) => {
+    const data = {};
+    for (const [k, v] of Object.entries(stringData)) {
+        const raw = Redacted.isRedacted(v) ? Redacted.value(v) : v;
+        data[k] = Buffer.from(raw, "utf8").toString("base64");
+    }
+    return data;
+};
+export const KubernetesSecretProvider = () => Provider.effect(KubernetesSecret, Effect.gen(function* () {
+    return {
+        // Attributes unchanged by an in-place update (so dependents can resolve
+        // them at plan time): identity (name/namespace), the server-assigned
+        // uid, and endpoint — which is a replace trigger, so it never changes
+        // on update. caCertificate is intentionally excluded: it can rotate on
+        // the same cluster.
+        stables: ["name", "namespace", "endpoint", "uid"],
+        diff: Effect.fn(function* ({ id, news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            const o = olds;
+            // Compare the RESOLVED name and type (with their defaults applied),
+            // not the raw props — otherwise omitting `name` on one side and
+            // setting it to the generated physical name on the other (or the
+            // same for `type`/"Opaque") triggers a spurious replace.
+            const defaultName = (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const sameName = (o.name ?? defaultName) === (news.name ?? defaultName);
+            const sameType = (o.type ?? "Opaque") === (news.type ?? "Opaque");
+            // Replace (create new + delete old) rather than in-place upsert on:
+            // - `endpoint`: points at a different cluster (would orphan the old
+            //   Secret). caCertificate is excluded — it can rotate on the same
+            //   cluster and should just re-apply.
+            // - `namespace`/`name`: the object's identity.
+            // - `type`: immutable on a Kubernetes Secret; a PUT with a new type
+            //   is rejected by the API.
+            if (!sameName ||
+                !sameType ||
+                somePropsAreDifferent(o, news, ["namespace", "endpoint"])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news }) {
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const desiredType = news.type ?? "Opaque";
+            const labels = {
+                ...(news.labels ?? {}),
+                ...(yield* gcpInternalLabels(id)),
+            };
+            const connection = yield* connect(news);
+            const layer = clusterLayer(connection);
+            const data = encodeData(news.stringData);
+            // Full-object PUT for an existing Secret — carries the observed
+            // resourceVersion (the API requires it for updates and uses it for
+            // optimistic concurrency).
+            const replaceFrom = (observed) => replaceCoreV1NamespacedSecret({
+                namespace: news.namespace,
+                name: desiredName,
+                fieldManager: "alchemy",
+                // Read-modify-write: a PUT replaces the WHOLE object, so preserve
+                // the observed metadata (annotations, ownerReferences, finalizers,
+                // …) and overlay only what we manage — otherwise every reconcile
+                // strips fields other managers set (e.g. an ownerReference, which
+                // would break garbage collection). `observed.metadata` carries the
+                // full server object at runtime (the local type is a subset).
+                // Labels merge (ours win) so foreign labels survive too. (The SSA
+                // path — GCP.KubernetesManifest — does field-level pruning instead;
+                // the typed PUT path deliberately preserves rather than prunes.)
+                metadata: {
+                    ...observed.metadata,
+                    name: desiredName,
+                    labels: { ...observed.metadata?.labels, ...labels },
+                    resourceVersion: observed.metadata?.resourceVersion,
+                },
+                type: desiredType,
+                data,
+            }).pipe(Effect.provide(layer));
+            // Observe → ensure: create if absent, else read-modify-write replace.
+            // Adoption (output defined, olds undefined) traverses the same flow.
+            const writeOnce = observe(connection, news.namespace, desiredName).pipe(Effect.flatMap((observed) => observed
+                ? replaceFrom(observed)
+                : createCoreV1NamespacedSecret({
+                    namespace: news.namespace,
+                    fieldManager: "alchemy",
+                    metadata: { name: desiredName, labels },
+                    type: desiredType,
+                    data,
+                }).pipe(Effect.provide(layer))));
+            // Retry the WHOLE observe→write flow on Conflict — a stale
+            // resourceVersion (replace) or a create/delete race re-observes fresh
+            // state and writes again, so a second conflict is handled too. Bounded
+            // so a persistently-contended object fails (and the engine
+            // re-reconciles) rather than spinning forever.
+            const upsert = (attempt) => writeOnce.pipe(Effect.catchTag("Conflict", (e) => attempt < 3 ? upsert(attempt + 1) : Effect.fail(e)));
+            const result = yield* upsert(0);
+            return toAttributes(result, {
+                name: desiredName,
+                namespace: news.namespace,
+                endpoint: news.endpoint,
+                caCertificate: news.caCertificate,
+                type: desiredType,
+            });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const connection = yield* connect(output);
+            yield* deleteCoreV1NamespacedSecret({
+                namespace: output.namespace,
+                name: output.name,
+            }).pipe(Effect.provide(clusterLayer(connection)), 
+            // 404 is success (idempotent teardown).
+            Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const endpoint = output?.endpoint ?? olds?.endpoint;
+            const caCertificate = output?.caCertificate ?? olds?.caCertificate;
+            const namespace = output?.namespace ?? olds?.namespace;
+            if (!endpoint || !caCertificate || !namespace)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const type = output?.type ?? olds?.type ?? "Opaque";
+            const connection = yield* connect({ endpoint, caCertificate });
+            const observed = yield* observe(connection, namespace, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, {
+                name,
+                namespace,
+                endpoint,
+                caCertificate,
+                type,
+            });
+            return (yield* hasAlchemyLabels(id, observed.metadata?.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Secret.js.map

package/lib/Kubernetes/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/Kubernetes/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,YAAY,EAA0B,MAAM,iBAAiB,CAAC;AAkGvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CACtC,sBAAsB,CACvB,CAAC;AAcF,MAAM,YAAY,GAAG,CACnB,CAA2B,EAC3B,MAMC,EAC2B,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IACtC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS;IACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IAC5B,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG;IACrB,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe;CAC9C,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAGzD;IACC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,WAAW;KACS,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,OAAO,GAAG,CACd,UAA6B,EAC7B,SAAiB,EACjB,IAAY,EACZ,EAAE,CACF,0BAA0B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EACxC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAqC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,MAAM,UAAU,GAAG,CACjB,UAA8D,EACtC,EAAE;IAC1B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAC3C,QAAQ,CAAC,MAAM,CACb,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,oBAAoB;QACpB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,CAAC,GAAG,IAA6B,CAAC;YACxC,oEAAoE;YACpE,gEAAgE;YAChE,iEAAiE;YACjE,yDAAyD;YACzD,MAAM,WAAW,GAAG,CAClB,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACjD,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GACZ,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,sCAAsC;YACtC,+CAA+C;YAC/C,oEAAoE;YACpE,4BAA4B;YAC5B,IACE,CAAC,QAAQ;gBACT,CAAC,QAAQ;gBACT,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,EACzD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YAC1C,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;YAC1C,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEzC,gEAAgE;YAChE,mEAAmE;YACnE,2BAA2B;YAC3B,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAE,EAAE,CAC7C,6BAA6B,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,WAAW;gBACjB,YAAY,EAAE,SAAS;gBACvB,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,kEAAkE;gBAClE,oEAAoE;gBACpE,iEAAiE;gBACjE,QAAQ,EAAE;oBACR,GAAG,QAAQ,CAAC,QAAQ;oBACpB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;oBACnD,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;iBACpD;gBACD,IAAI,EAAE,WAAW;gBACjB,IAAI;aACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAEjC,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,SAAS,GAAG,OAAO,CACvB,UAAU,EACV,IAAI,CAAC,SAAS,EACd,WAAW,CACZ,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACvB,CAAC,CAAC,4BAA4B,CAAC;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,SAAS;oBACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;oBACvC,IAAI,EAAE,WAAW;oBACjB,IAAI;iBACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACnC,CACF,CAAC;YAEF,2DAA2D;YAC3D,sEAAsE;YACtE,uEAAuE;YACvE,2DAA2D;YAC3D,+CAA+C;YAC/C,MAAM,MAAM,GAAG,CAAC,OAAe,EAAoB,EAAE,CACnD,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CACnD,CACF,CAAC;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEhC,OAAO,YAAY,CAAC,MAAM,EAAE;gBAC1B,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,CAAC,CAAC,4BAA4B,CAAC;gBAClC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACxC,wCAAwC;YACxC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC;YAEpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE;gBACnC,IAAI;gBACJ,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,IAAI;aACL,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Kubernetes/client.d.ts

@@ -0,0 +1,62 @@
+import * as Effect from "effect/Effect";
+/** Connection details for a single GKE control plane. */
+export interface GkeConnection {
+    /** Master endpoint — IP or hostname, no scheme (e.g. `34.1.2.3`). */
+    endpoint: string;
+    /** Base64-encoded cluster CA certificate (PEM), as GKE returns it. */
+    caCertificate: string;
+    /** Google OAuth access token (cloud-platform scope) for `Authorization`. */
+    token: string;
+}
+declare const KubernetesApiError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "KubernetesApiError";
+} & Readonly<A>;
+/** A non-2xx (or transport) response from the Kubernetes API server. */
+export declare class KubernetesApiError extends KubernetesApiError_base<{
+    method: string;
+    path: string;
+    statusCode: number;
+    body: string;
+}> {
+}
+/** A Kubernetes object as seen on the wire (only the fields we read back). */
+export interface KubeObject {
+    apiVersion?: string;
+    kind?: string;
+    metadata?: {
+        name?: string;
+        namespace?: string;
+        uid?: string;
+        resourceVersion?: string;
+        labels?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+/** Where a Kind lives in the REST hierarchy, from the discovery doc. */
+interface ResourceInfo {
+    /** Plural resource name, e.g. `secrets`, `deployments`. */
+    plural: string;
+    /** Whether instances are namespaced (vs cluster-scoped). */
+    namespaced: boolean;
+}
+/**
+ * Resolve a Kind to its REST resource (plural + scope) via the apiserver's
+ * discovery endpoint. This is what lets SSA work for ANY kind — built-ins and
+ * CRDs — without a hard-coded kind→plural table.
+ */
+export declare const resolveResource: (connection: GkeConnection, apiVersion: string, kind: string) => Effect.Effect<ResourceInfo, KubernetesApiError>;
+/**
+ * Server-side apply an arbitrary object (idempotent create-or-converge).
+ * `force=true` makes alchemy the field manager even where another manager
+ * currently owns a field we declare. Only the fields present in `object` are
+ * managed; fields owned by other managers are left untouched, and dropping a
+ * previously-declared field prunes it.
+ */
+export declare const applyObject: (connection: GkeConnection, object: KubeObject, fieldManager?: string) => Effect.Effect<KubeObject | undefined, KubernetesApiError>;
+/** GET an object; the caller maps `KubernetesApiError(404)` to "missing". */
+export declare const getObject: (connection: GkeConnection, apiVersion: string, kind: string, namespace: string | undefined, name: string) => Effect.Effect<KubeObject, KubernetesApiError>;
+/** DELETE an object; 404 is tolerated as success (idempotent teardown). */
+export declare const deleteObject: (connection: GkeConnection, apiVersion: string, kind: string, namespace: string | undefined, name: string) => Effect.Effect<void, KubernetesApiError>;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/lib/Kubernetes/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAgExC,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;;;;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,wBAEtC;IACA,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;AA0GL,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,UAAU,YAAY;IACpB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;CACrB;AASD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CA0BhD,CAAC;AAuCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GACtB,YAAY,aAAa,EACzB,QAAQ,UAAU,EAClB,qBAAwB,KACvB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,kBAAkB,CA+B1D,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,GACpB,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,SAAS,EAC7B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAc5C,CAAC;AAEJ,2EAA2E;AAC3E,eAAO,MAAM,YAAY,GACvB,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,SAAS,EAC7B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAkBtC,CAAC"}

package/lib/Kubernetes/client.js

@@ -0,0 +1,233 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as https from "node:https";
+/**
+ * Raw, **server-side-apply-capable** GKE Kubernetes REST client.
+ *
+ * # Two ways this provider writes to a cluster — and when to use each
+ *
+ * There are two transports for talking to a GKE control plane. They are not
+ * redundant; each is correct for a different shape of resource.
+ *
+ * ### 1. Typed per-kind ops — `@distilled.cloud/kubernetes` via `connection.ts`
+ *
+ * What {@link "./Secret.ts"} uses. A **create + replace (PUT)** upsert built
+ * from the typed `core/v1` operations, with the cluster wired in by
+ * `clusterLayer`.
+ *
+ * **Use when** the kind is known at author time and the resource fully owns the
+ * object (Secret, ConfigMap, …).
+ * - ✅ Typed inputs/outputs (real `metadata`/`data`/`type` fields), no
+ *   discovery round-trip, no content-type fiddling.
+ * - ⚠️ A PUT is a *full-object replacement*: it carries `resourceVersion` and
+ *   overwrites every field — so it clobbers anything another manager set that
+ *   you didn't include. Fine for objects you solely own; wrong for shared ones.
+ * - ⚠️ Per-kind only — there's a distinct typed op per Kind.
+ *
+ * ### 2. This raw client — server-side apply of an **arbitrary** object
+ *
+ * What {@link "./KubernetesManifest.ts"} uses. A single `PATCH` with
+ * `Content-Type: application/apply-patch+yaml`, `?fieldManager=alchemy&force=true`,
+ * the object itself as the (untyped) body, and the resource path resolved from
+ * the apiserver's **discovery** endpoint so *any* Kind works — built-ins and
+ * CRDs alike.
+ *
+ * **Use when** the kind is dynamic/unknown (generic manifests, CRDs), **or**
+ * you need server-side-apply semantics:
+ * - **field-level merge / ownership** — apply touches only the fields
+ *   `fieldManager: alchemy` declares, leaving fields owned by other managers
+ *   (controllers, defaulting, admission) intact instead of clobbering them;
+ * - **declarative pruning** — dropping a field you previously owned removes it,
+ *   without a read-merge-write dance;
+ * - **one idempotent call** — no read-before-write, no create-vs-replace
+ *   branch, no `resourceVersion` juggling.
+ * - ⚠️ Untyped body, plus one extra discovery `GET` to map Kind → resource.
+ *
+ * Rule of thumb: **known Kind you fully own → typed create/replace (path 1);
+ * arbitrary Kind or shared/merge semantics → SSA (this client).**
+ *
+ * ---
+ *
+ * Both transports authenticate with a Google OAuth bearer token (cloud-platform
+ * scope, minted from the provider's ADC credentials) and trust the cluster's
+ * own CA. `node:https` is used here deliberately (rather than the Effect
+ * `HttpClient`): the GKE API server presents a certificate signed by the
+ * *per-cluster* CA — not a public root — so the request must trust an explicit,
+ * runtime-resolved `ca` PEM. (`connection.ts`'s `clusterLayer` solves the same
+ * CA-trust problem for the distilled path, by overriding `FetchHttpClient`.)
+ * Calls are wrapped in `Effect.tryPromise` so failures surface as typed errors;
+ * a socket timeout bounds hung requests (Effect interruption won't abort an
+ * in-flight socket — the timeout is what guarantees a deploy can't block
+ * forever).
+ */
+const REQUEST_TIMEOUT_MS = 30_000;
+/** A non-2xx (or transport) response from the Kubernetes API server. */
+export class KubernetesApiError extends Data.TaggedError("KubernetesApiError") {
+}
+const requestJson = Effect.fn("k8s.requestJson")(function* ({ connection, method, path, body, contentType, }) {
+    const url = new URL(path, `https://${connection.endpoint}`);
+    const payload = body ? JSON.stringify(body) : undefined;
+    const ca = Buffer.from(connection.caCertificate, "base64").toString("utf8");
+    return yield* Effect.tryPromise({
+        try: () => new Promise((resolve, reject) => {
+            const request = https.request({
+                protocol: url.protocol,
+                hostname: url.hostname,
+                port: url.port || 443,
+                path: `${url.pathname}${url.search}`,
+                method,
+                headers: {
+                    Authorization: `Bearer ${connection.token}`,
+                    Accept: "application/json",
+                    ...(payload
+                        ? {
+                            "Content-Type": contentType ?? "application/json",
+                            "Content-Length": Buffer.byteLength(payload),
+                        }
+                        : {}),
+                },
+                ca,
+                timeout: REQUEST_TIMEOUT_MS,
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => {
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                });
+                response.on("end", () => {
+                    const responseBody = Buffer.concat(chunks).toString("utf8");
+                    const statusCode = response.statusCode ?? 500;
+                    if (statusCode < 200 || statusCode >= 300) {
+                        reject(new KubernetesApiError({
+                            method,
+                            path,
+                            statusCode,
+                            body: responseBody,
+                        }));
+                        return;
+                    }
+                    if (!responseBody.trim()) {
+                        resolve(undefined);
+                        return;
+                    }
+                    try {
+                        resolve(JSON.parse(responseBody));
+                    }
+                    catch {
+                        resolve(responseBody);
+                    }
+                });
+            });
+            request.on("error", reject);
+            // `timeout` only fires the event — we must destroy the socket
+            // ourselves so the promise rejects instead of hanging.
+            request.on("timeout", () => request.destroy(new KubernetesApiError({
+                method,
+                path,
+                statusCode: 0,
+                body: `request timed out after ${REQUEST_TIMEOUT_MS}ms`,
+            })));
+            if (payload)
+                request.write(payload);
+            request.end();
+        }),
+        catch: (error) => error instanceof KubernetesApiError
+            ? error
+            : new KubernetesApiError({
+                method,
+                path,
+                statusCode: 0,
+                body: error instanceof Error ? error.message : String(error),
+            }),
+    });
+});
+/**
+ * Discovery path for an `apiVersion`: core group (`v1`) lives under `/api/v1`,
+ * named groups (`apps/v1`, `networking.k8s.io/v1`) under `/apis/{group}/{ver}`.
+ */
+const apiPathPrefix = (apiVersion) => apiVersion.includes("/") ? `/apis/${apiVersion}` : `/api/${apiVersion}`;
+/**
+ * Resolve a Kind to its REST resource (plural + scope) via the apiserver's
+ * discovery endpoint. This is what lets SSA work for ANY kind — built-ins and
+ * CRDs — without a hard-coded kind→plural table.
+ */
+export const resolveResource = (connection, apiVersion, kind) => {
+    const path = apiPathPrefix(apiVersion);
+    return requestJson({ connection, method: "GET", path }).pipe(Effect.flatMap((doc) => {
+        // Match on Kind, excluding subresources (their `name` contains a `/`,
+        // e.g. `pods/status`).
+        const match = (doc.resources ?? []).find((r) => r.kind === kind && !r.name.includes("/"));
+        return match
+            ? Effect.succeed({ plural: match.name, namespaced: match.namespaced })
+            : Effect.fail(new KubernetesApiError({
+                method: "GET",
+                path,
+                statusCode: 0,
+                body: `Kind ${apiVersion}/${kind} not found in discovery (${path})`,
+            }));
+    }));
+};
+const objectPath = (apiVersion, info, namespace, name) => {
+    const prefix = apiPathPrefix(apiVersion);
+    const collection = info.namespaced
+        ? `${prefix}/namespaces/${namespace}/${info.plural}`
+        : `${prefix}/${info.plural}`;
+    return name ? `${collection}/${name}` : collection;
+};
+/**
+ * Guard against building a `/namespaces/undefined/…` path: a namespaced Kind
+ * with no namespace would otherwise GET/DELETE a bogus URL — the API returns
+ * 404, which read treats as "absent" (phantom recreate) and delete tolerates as
+ * success (orphan). Fail loudly instead. (No-op for cluster-scoped Kinds.)
+ */
+const requireNamespace = (method, apiVersion, kind, info, namespace) => info.namespaced && !namespace
+    ? Effect.fail(new KubernetesApiError({
+        method,
+        path: "",
+        statusCode: 0,
+        body: `${apiVersion}/${kind} is namespaced — a namespace is required`,
+    }))
+    : Effect.void;
+/**
+ * Server-side apply an arbitrary object (idempotent create-or-converge).
+ * `force=true` makes alchemy the field manager even where another manager
+ * currently owns a field we declare. Only the fields present in `object` are
+ * managed; fields owned by other managers are left untouched, and dropping a
+ * previously-declared field prunes it.
+ */
+export const applyObject = (connection, object, fieldManager = "alchemy") => {
+    const apiVersion = object.apiVersion;
+    const kind = object.kind;
+    const name = object.metadata?.name;
+    const namespace = object.metadata?.namespace;
+    if (!apiVersion || !kind || !name) {
+        return Effect.fail(new KubernetesApiError({
+            method: "PATCH",
+            path: "",
+            statusCode: 0,
+            body: "object must have apiVersion, kind and metadata.name",
+        }));
+    }
+    return resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("PATCH", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => {
+        const path = `${objectPath(apiVersion, info, namespace, name)}?fieldManager=${fieldManager}&force=true`;
+        return requestJson({
+            connection,
+            method: "PATCH",
+            path,
+            contentType: "application/apply-patch+yaml",
+            body: object,
+        });
+    }))));
+};
+/** GET an object; the caller maps `KubernetesApiError(404)` to "missing". */
+export const getObject = (connection, apiVersion, kind, namespace, name) => resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("GET", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => requestJson({
+    connection,
+    method: "GET",
+    path: objectPath(apiVersion, info, namespace, name),
+})))));
+/** DELETE an object; 404 is tolerated as success (idempotent teardown). */
+export const deleteObject = (connection, apiVersion, kind, namespace, name) => resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("DELETE", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => requestJson({
+    connection,
+    method: "DELETE",
+    path: objectPath(apiVersion, info, namespace, name),
+})))), Effect.catchIf((e) => e instanceof KubernetesApiError && e.statusCode === 404, () => Effect.void));
+//# sourceMappingURL=client.js.map

package/lib/Kubernetes/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAYlC,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CACtD,oBAAoB,CAMpB;CAAG;AAEL,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAC1D,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,WAAW,GAOZ;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9B,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE;oBAC3C,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC;4BACE,cAAc,EACZ,WAAW,IAAI,kBAAkB;4BACnC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;yBAC7C;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,EAAE;gBACF,OAAO,EAAE,kBAAkB;aAC5B,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;oBAE9C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;wBAC1C,MAAM,CACJ,IAAI,kBAAkB,CAAC;4BACrB,MAAM;4BACN,IAAI;4BACJ,UAAU;4BACV,IAAI,EAAE,YAAY;yBACnB,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzB,OAAO,CAAC,SAAS,CAAC,CAAC;wBACnB,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,YAAY,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,8DAA8D;YAC9D,uDAAuD;YACvD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACzB,OAAO,CAAC,OAAO,CACb,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,2BAA2B,kBAAkB,IAAI;aACxD,CAAC,CACH,CACF,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC;QACJ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,kBAAkB;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAyBH;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACqC,EAAE;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,OACE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAIhD,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACrB,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;QACF,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,kBAAkB,CAAC;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,QAAQ,UAAU,IAAI,IAAI,4BAA4B,IAAI,GAAG;aACpE,CAAC,CACH,CAAC;IACR,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,UAAkB,EAClB,IAAkB,EAClB,SAA6B,EAC7B,IAAwB,EAChB,EAAE;IACV,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU;QAChC,CAAC,CAAC,GAAG,MAAM,eAAe,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE;QACpD,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,IAAkB,EAClB,SAA6B,EACY,EAAE,CAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;IAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,kBAAkB,CAAC;QACrB,MAAM;QACN,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,UAAU,IAAI,IAAI,0CAA0C;KACtE,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,UAAyB,EACzB,MAAkB,EAClB,YAAY,GAAG,SAAS,EACmC,EAAE;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,kBAAkB,CAAC;YACrB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiB,YAAY,aAAa,CAAC;QACxG,OAAO,WAAW,CAAC;YACjB,UAAU;YACV,MAAM,EAAE,OAAO;YACf,IAAI;YACJ,WAAW,EAAE,8BAA8B;YAC3C,IAAI,EAAE,MAAiC;SACxC,CAA8D,CAAC;IAClE,CAAC,CAAC,CACH,CACF,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,SAA6B,EAC7B,IAAY,EACmC,EAAE,CACjD,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,CACH,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;CACpD,CAAkD,CACtD,CACF,CACF,CACF,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,SAA6B,EAC7B,IAAY,EAC6B,EAAE,CAC3C,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;CACpD,CAAC,CACH,CACF,CACF,EACD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAA2B,EAAE,CAC7B,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CAAC"}

package/lib/Kubernetes/connection.d.ts

@@ -0,0 +1,48 @@
+import { Credentials } from "@distilled.cloud/kubernetes/Credentials";
+import * as Layer from "effect/Layer";
+import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+/**
+ * Bridges a GKE control plane into the layers that `@distilled.cloud/kubernetes`
+ * operations require — letting us drive the cluster's kube-apiserver through the
+ * typed distilled SDK (core/v1, apps/v1, batch, rbac, apiextensions/CRDs, …)
+ * instead of hand-rolling one HTTP resource per kind.
+ *
+ * distilled operations resolve two services from context:
+ *
+ * - `KubernetesCredentials` (`{ token, apiBaseUrl }`) — the bearer token (a
+ *   Google OAuth access token minted from the provider's ADC `Credentials`) and
+ *   the API base URL (`https://<cluster endpoint>`).
+ * - `HttpClient.HttpClient` — the transport. The GKE API server presents a cert
+ *   signed by the cluster's *own* CA (not a public root), so a stock fetch fails
+ *   TLS verification. We override {@link FetchHttpClient.Fetch} with a
+ *   `node:https`-backed fetch that trusts the per-cluster CA — the same
+ *   justified TLS exception the bespoke client made, but now routed through the
+ *   typed SDK. (undici's `Agent`/`dispatcher` would be the fetch-native route,
+ *   but undici isn't resolvable as a bare import here, and this reuses the
+ *   transport we already trust.)
+ *
+ * @example
+ * ```typescript
+ * import { readCoreV1NamespacedSecret } from "@distilled.cloud/kubernetes/core";
+ *
+ * const secret = yield* readCoreV1NamespacedSecret({ namespace, name }).pipe(
+ *   Effect.provide(clusterLayer({ endpoint, caCertificate, token })),
+ * );
+ * ```
+ */
+/** A resolved connection to a single GKE control plane. */
+export interface ClusterConnection {
+    /** Master endpoint — IP or hostname, no scheme (e.g. `34.1.2.3`). */
+    readonly endpoint: string;
+    /** Base64-encoded cluster CA certificate (PEM), as GKE returns it. */
+    readonly caCertificate: string;
+    /** Google OAuth access token (cloud-platform scope) for `Authorization`. */
+    readonly token: Redacted.Redacted<string>;
+}
+/**
+ * The full requirements layer for any `@distilled.cloud/kubernetes` operation
+ * against one GKE cluster: credentials + a CA-trusting HTTP client.
+ */
+export declare const clusterLayer: (connection: ClusterConnection) => Layer.Layer<Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=connection.d.ts.map

package/lib/Kubernetes/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3C;AA2HD;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,YAAY,iBAAiB,KAC5B,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAI/C,CAAC"}

package/lib/Kubernetes/connection.js

@@ -0,0 +1,93 @@
+import { Credentials } from "@distilled.cloud/kubernetes/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as https from "node:https";
+/** Bounds a hung socket — Effect interruption can't abort an in-flight request. */
+const REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * A `globalThis.fetch`-shaped function that issues the request over `node:https`
+ * trusting an explicit CA PEM, then resolves a standard `Response`. Effect's
+ * {@link FetchHttpClient.layer} reads this via `fiber.getRef(Fetch)` and feeds
+ * it `(url, { method, headers, body, signal })` per request.
+ */
+const caFetch = (caPem) => ((input, init) => {
+    const href = typeof input === "string"
+        ? input
+        : input instanceof URL
+            ? input.href
+            : input.url;
+    const url = new URL(href);
+    const headers = {};
+    if (init?.headers) {
+        new Headers(init.headers).forEach((value, key) => {
+            headers[key] = value;
+        });
+    }
+    const body = init?.body;
+    if (body != null &&
+        typeof body !== "string" &&
+        !(body instanceof Uint8Array)) {
+        // Our k8s calls only ever send JSON (Raw/Uint8Array) bodies. A streaming
+        // body would need different handling — fail loudly rather than silently
+        // dropping it.
+        return Promise.reject(new TypeError("caFetch: only string/Uint8Array request bodies are supported"));
+    }
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: `${url.pathname}${url.search}`,
+            method: init?.method ?? "GET",
+            headers,
+            ca: caPem,
+            timeout: REQUEST_TIMEOUT_MS,
+        }, (response) => {
+            const chunks = [];
+            response.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            response.on("end", () => {
+                const buffer = Buffer.concat(chunks);
+                const responseHeaders = new Headers();
+                for (const [key, value] of Object.entries(response.headers)) {
+                    if (Array.isArray(value)) {
+                        for (const v of value)
+                            responseHeaders.append(key, v);
+                    }
+                    else if (value != null) {
+                        responseHeaders.set(key, value);
+                    }
+                }
+                resolve(new Response(buffer.length > 0 ? buffer : null, {
+                    status: response.statusCode ?? 500,
+                    statusText: response.statusMessage ?? "",
+                    headers: responseHeaders,
+                }));
+            });
+        });
+        request.on("error", reject);
+        // `timeout` only fires the event — destroy the socket ourselves so the
+        // promise rejects instead of hanging.
+        request.on("timeout", () => request.destroy(new Error(`Kubernetes request timed out after ${REQUEST_TIMEOUT_MS}ms`)));
+        // Honour Effect's abort signal so interruption tears down the socket.
+        if (init?.signal) {
+            if (init.signal.aborted)
+                request.destroy(new Error("aborted"));
+            else
+                init.signal.addEventListener("abort", () => request.destroy(new Error("aborted")));
+        }
+        if (body != null)
+            request.write(body);
+        request.end();
+    });
+});
+/** `HttpClient` layer whose fetch trusts the given (base64 PEM) cluster CA. */
+const caHttpClient = (caCertificate) => Layer.provide(FetchHttpClient.layer, Layer.succeed(FetchHttpClient.Fetch, caFetch(Buffer.from(caCertificate, "base64").toString("utf8"))));
+/** `KubernetesCredentials` layer for a single cluster + bearer token. */
+const credentials = (endpoint, token) => Layer.succeed(Credentials, Effect.succeed({ token, apiBaseUrl: `https://${endpoint}` }));
+/**
+ * The full requirements layer for any `@distilled.cloud/kubernetes` operation
+ * against one GKE cluster: credentials + a CA-trusting HTTP client.
+ */
+export const clusterLayer = (connection) => Layer.merge(credentials(connection.endpoint, connection.token), caHttpClient(connection.caCertificate));
+//# sourceMappingURL=connection.js.map