@microagi/alchemy-gcp 0.6.0 → 0.7.0

package/lib/Kubernetes/client.d.ts

@@ -19,8 +19,8 @@ export declare class KubernetesApiError extends KubernetesApiError_base<{
     body: string;
 }> {
 }
-/** Live view of a Kubernetes Secret object (subset we care about). */
-export interface SecretObject {
+/** A Kubernetes object as seen on the wire (only the fields we read back). */
+export interface KubeObject {
     apiVersion?: string;
     kind?: string;
     metadata?: {
@@ -29,30 +29,34 @@ export interface SecretObject {
         uid?: string;
         resourceVersion?: string;
         labels?: Record<string, string>;
+        [key: string]: unknown;
     };
-    type?: string;
+    [key: string]: unknown;
+}
+/** Where a Kind lives in the REST hierarchy, from the discovery doc. */
+interface ResourceInfo {
+    /** Plural resource name, e.g. `secrets`, `deployments`. */
+    plural: string;
+    /** Whether instances are namespaced (vs cluster-scoped). */
+    namespaced: boolean;
 }
-/** GET a Secret; the caller maps `KubernetesApiError(404)` to "missing". */
-export declare const getSecret: (connection: GkeConnection, namespace: string, name: string) => Effect.Effect<SecretObject, KubernetesApiError>;
 /**
- * Server-side apply a Secret (idempotent create-or-update). `force=true`
- * makes alchemy the field manager even if another manager owns fields.
- *
- * Values go through `data` (base64), NOT `stringData`: server-side apply
- * tracks the field manager's ownership of `data` keys, so dropping a key
- * from a later apply prunes it from the stored Secret. `stringData` is
- * write-only/ephemeral and isn't tracked, which would leave stale keys.
+ * Resolve a Kind to its REST resource (plural + scope) via the apiserver's
+ * discovery endpoint. This is what lets SSA work for ANY kind — built-ins and
+ * CRDs — without a hard-coded kind→plural table.
  */
-export declare const applySecret: (connection: GkeConnection, secret: {
-    metadata: {
-        name: string;
-        namespace: string;
-        labels?: Record<string, string>;
-    };
-    type: string;
-    data: Record<string, string>;
-}) => Effect.Effect<SecretObject | undefined, KubernetesApiError>;
-/** DELETE a Secret; 404 is tolerated as success (idempotent teardown). */
-export declare const deleteSecret: (connection: GkeConnection, namespace: string, name: string) => Effect.Effect<unknown, never, never>;
+export declare const resolveResource: (connection: GkeConnection, apiVersion: string, kind: string) => Effect.Effect<ResourceInfo, KubernetesApiError>;
+/**
+ * Server-side apply an arbitrary object (idempotent create-or-converge).
+ * `force=true` makes alchemy the field manager even where another manager
+ * currently owns a field we declare. Only the fields present in `object` are
+ * managed; fields owned by other managers are left untouched, and dropping a
+ * previously-declared field prunes it.
+ */
+export declare const applyObject: (connection: GkeConnection, object: KubeObject, fieldManager?: string) => Effect.Effect<KubeObject | undefined, KubernetesApiError>;
+/** GET an object; the caller maps `KubernetesApiError(404)` to "missing". */
+export declare const getObject: (connection: GkeConnection, apiVersion: string, kind: string, namespace: string | undefined, name: string) => Effect.Effect<KubeObject, KubernetesApiError>;
+/** DELETE an object; 404 is tolerated as success (idempotent teardown). */
+export declare const deleteObject: (connection: GkeConnection, apiVersion: string, kind: string, namespace: string | undefined, name: string) => Effect.Effect<void, KubernetesApiError>;
 export {};
 //# sourceMappingURL=client.d.ts.map

package/lib/Kubernetes/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAuBxC,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;;;;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,wBAEtC;IACA,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;AA0GL,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD,4EAA4E;AAC5E,eAAO,MAAM,SAAS,GACpB,YAAY,aAAa,EACzB,WAAW,MAAM,EACjB,MAAM,MAAM,KAMN,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GACtB,YAAY,aAAa,EACzB,QAAQ;IACN,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KAQK,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEpE,0EAA0E;AAC1E,eAAO,MAAM,YAAY,GACvB,YAAY,aAAa,EACzB,WAAW,MAAM,EACjB,MAAM,MAAM,yCAYX,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAgExC,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;;;;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,wBAEtC;IACA,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;AA0GL,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,UAAU,YAAY;IACpB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;CACrB;AASD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CA0BhD,CAAC;AAuCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GACtB,YAAY,aAAa,EACzB,QAAQ,UAAU,EAClB,qBAAwB,KACvB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,kBAAkB,CA+B1D,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,GACpB,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,SAAS,EAC7B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAc5C,CAAC;AAEJ,2EAA2E;AAC3E,eAAO,MAAM,YAAY,GACvB,YAAY,aAAa,EACzB,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,SAAS,EAC7B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAkBtC,CAAC"}

package/lib/Kubernetes/client.js

@@ -2,22 +2,63 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as https from "node:https";
 /**
- * Minimal GKE Kubernetes REST client.
+ * Raw, **server-side-apply-capable** GKE Kubernetes REST client.
  *
- * Talks to a GKE cluster's control plane over HTTPS using:
- * - a Google OAuth bearer token (cloud-platform scope), minted from the
- *   provider's ADC {@link Credentials}, and
- * - the cluster's own CA certificate for TLS verification.
+ * # Two ways this provider writes to a cluster — and when to use each
  *
- * `node:https` is used deliberately here (rather than the Effect
+ * There are two transports for talking to a GKE control plane. They are not
+ * redundant; each is correct for a different shape of resource.
+ *
+ * ### 1. Typed per-kind ops — `@distilled.cloud/kubernetes` via `connection.ts`
+ *
+ * What {@link "./Secret.ts"} uses. A **create + replace (PUT)** upsert built
+ * from the typed `core/v1` operations, with the cluster wired in by
+ * `clusterLayer`.
+ *
+ * **Use when** the kind is known at author time and the resource fully owns the
+ * object (Secret, ConfigMap, …).
+ * - ✅ Typed inputs/outputs (real `metadata`/`data`/`type` fields), no
+ *   discovery round-trip, no content-type fiddling.
+ * - ⚠️ A PUT is a *full-object replacement*: it carries `resourceVersion` and
+ *   overwrites every field — so it clobbers anything another manager set that
+ *   you didn't include. Fine for objects you solely own; wrong for shared ones.
+ * - ⚠️ Per-kind only — there's a distinct typed op per Kind.
+ *
+ * ### 2. This raw client — server-side apply of an **arbitrary** object
+ *
+ * What {@link "./KubernetesManifest.ts"} uses. A single `PATCH` with
+ * `Content-Type: application/apply-patch+yaml`, `?fieldManager=alchemy&force=true`,
+ * the object itself as the (untyped) body, and the resource path resolved from
+ * the apiserver's **discovery** endpoint so *any* Kind works — built-ins and
+ * CRDs alike.
+ *
+ * **Use when** the kind is dynamic/unknown (generic manifests, CRDs), **or**
+ * you need server-side-apply semantics:
+ * - **field-level merge / ownership** — apply touches only the fields
+ *   `fieldManager: alchemy` declares, leaving fields owned by other managers
+ *   (controllers, defaulting, admission) intact instead of clobbering them;
+ * - **declarative pruning** — dropping a field you previously owned removes it,
+ *   without a read-merge-write dance;
+ * - **one idempotent call** — no read-before-write, no create-vs-replace
+ *   branch, no `resourceVersion` juggling.
+ * - ⚠️ Untyped body, plus one extra discovery `GET` to map Kind → resource.
+ *
+ * Rule of thumb: **known Kind you fully own → typed create/replace (path 1);
+ * arbitrary Kind or shared/merge semantics → SSA (this client).**
+ *
+ * ---
+ *
+ * Both transports authenticate with a Google OAuth bearer token (cloud-platform
+ * scope, minted from the provider's ADC credentials) and trust the cluster's
+ * own CA. `node:https` is used here deliberately (rather than the Effect
  * `HttpClient`): the GKE API server presents a certificate signed by the
- * *per-cluster* CA — not a public root — so the request must trust an
- * explicit, runtime-resolved `ca` PEM. This is the same justified TLS
- * exception alchemy makes in its own (EKS-only) Kubernetes client. Calls
- * are wrapped in `Effect.tryPromise` so failures surface as typed errors
- * in the Effect runtime; a socket timeout bounds hung requests. (Effect
- * interruption won't abort an in-flight socket — the timeout is what
- * guarantees a deploy can't block forever.)
+ * *per-cluster* CA — not a public root — so the request must trust an explicit,
+ * runtime-resolved `ca` PEM. (`connection.ts`'s `clusterLayer` solves the same
+ * CA-trust problem for the distilled path, by overriding `FetchHttpClient`.)
+ * Calls are wrapped in `Effect.tryPromise` so failures surface as typed errors;
+ * a socket timeout bounds hung requests (Effect interruption won't abort an
+ * in-flight socket — the timeout is what guarantees a deploy can't block
+ * forever).
  */
 const REQUEST_TIMEOUT_MS = 30_000;
 /** A non-2xx (or transport) response from the Kubernetes API server. */
@@ -99,33 +140,94 @@ const requestJson = Effect.fn("k8s.requestJson")(function* ({ connection, method
             }),
     });
 });
-const secretPath = (namespace, name) => `/api/v1/namespaces/${namespace}/secrets/${name}`;
-/** GET a Secret; the caller maps `KubernetesApiError(404)` to "missing". */
-export const getSecret = (connection, namespace, name) => requestJson({
-    connection,
-    method: "GET",
-    path: secretPath(namespace, name),
-});
 /**
- * Server-side apply a Secret (idempotent create-or-update). `force=true`
- * makes alchemy the field manager even if another manager owns fields.
- *
- * Values go through `data` (base64), NOT `stringData`: server-side apply
- * tracks the field manager's ownership of `data` keys, so dropping a key
- * from a later apply prunes it from the stored Secret. `stringData` is
- * write-only/ephemeral and isn't tracked, which would leave stale keys.
+ * Discovery path for an `apiVersion`: core group (`v1`) lives under `/api/v1`,
+ * named groups (`apps/v1`, `networking.k8s.io/v1`) under `/apis/{group}/{ver}`.
+ */
+const apiPathPrefix = (apiVersion) => apiVersion.includes("/") ? `/apis/${apiVersion}` : `/api/${apiVersion}`;
+/**
+ * Resolve a Kind to its REST resource (plural + scope) via the apiserver's
+ * discovery endpoint. This is what lets SSA work for ANY kind — built-ins and
+ * CRDs — without a hard-coded kind→plural table.
  */
-export const applySecret = (connection, secret) => requestJson({
+export const resolveResource = (connection, apiVersion, kind) => {
+    const path = apiPathPrefix(apiVersion);
+    return requestJson({ connection, method: "GET", path }).pipe(Effect.flatMap((doc) => {
+        // Match on Kind, excluding subresources (their `name` contains a `/`,
+        // e.g. `pods/status`).
+        const match = (doc.resources ?? []).find((r) => r.kind === kind && !r.name.includes("/"));
+        return match
+            ? Effect.succeed({ plural: match.name, namespaced: match.namespaced })
+            : Effect.fail(new KubernetesApiError({
+                method: "GET",
+                path,
+                statusCode: 0,
+                body: `Kind ${apiVersion}/${kind} not found in discovery (${path})`,
+            }));
+    }));
+};
+const objectPath = (apiVersion, info, namespace, name) => {
+    const prefix = apiPathPrefix(apiVersion);
+    const collection = info.namespaced
+        ? `${prefix}/namespaces/${namespace}/${info.plural}`
+        : `${prefix}/${info.plural}`;
+    return name ? `${collection}/${name}` : collection;
+};
+/**
+ * Guard against building a `/namespaces/undefined/…` path: a namespaced Kind
+ * with no namespace would otherwise GET/DELETE a bogus URL — the API returns
+ * 404, which read treats as "absent" (phantom recreate) and delete tolerates as
+ * success (orphan). Fail loudly instead. (No-op for cluster-scoped Kinds.)
+ */
+const requireNamespace = (method, apiVersion, kind, info, namespace) => info.namespaced && !namespace
+    ? Effect.fail(new KubernetesApiError({
+        method,
+        path: "",
+        statusCode: 0,
+        body: `${apiVersion}/${kind} is namespaced — a namespace is required`,
+    }))
+    : Effect.void;
+/**
+ * Server-side apply an arbitrary object (idempotent create-or-converge).
+ * `force=true` makes alchemy the field manager even where another manager
+ * currently owns a field we declare. Only the fields present in `object` are
+ * managed; fields owned by other managers are left untouched, and dropping a
+ * previously-declared field prunes it.
+ */
+export const applyObject = (connection, object, fieldManager = "alchemy") => {
+    const apiVersion = object.apiVersion;
+    const kind = object.kind;
+    const name = object.metadata?.name;
+    const namespace = object.metadata?.namespace;
+    if (!apiVersion || !kind || !name) {
+        return Effect.fail(new KubernetesApiError({
+            method: "PATCH",
+            path: "",
+            statusCode: 0,
+            body: "object must have apiVersion, kind and metadata.name",
+        }));
+    }
+    return resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("PATCH", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => {
+        const path = `${objectPath(apiVersion, info, namespace, name)}?fieldManager=${fieldManager}&force=true`;
+        return requestJson({
+            connection,
+            method: "PATCH",
+            path,
+            contentType: "application/apply-patch+yaml",
+            body: object,
+        });
+    }))));
+};
+/** GET an object; the caller maps `KubernetesApiError(404)` to "missing". */
+export const getObject = (connection, apiVersion, kind, namespace, name) => resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("GET", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => requestJson({
     connection,
-    method: "PATCH",
-    path: `${secretPath(secret.metadata.namespace, secret.metadata.name)}?fieldManager=alchemy&force=true`,
-    contentType: "application/apply-patch+yaml",
-    body: { apiVersion: "v1", kind: "Secret", ...secret },
-});
-/** DELETE a Secret; 404 is tolerated as success (idempotent teardown). */
-export const deleteSecret = (connection, namespace, name) => requestJson({
+    method: "GET",
+    path: objectPath(apiVersion, info, namespace, name),
+})))));
+/** DELETE an object; 404 is tolerated as success (idempotent teardown). */
+export const deleteObject = (connection, apiVersion, kind, namespace, name) => resolveResource(connection, apiVersion, kind).pipe(Effect.flatMap((info) => requireNamespace("DELETE", apiVersion, kind, info, namespace).pipe(Effect.flatMap(() => requestJson({
     connection,
     method: "DELETE",
-    path: secretPath(namespace, name),
-}).pipe(Effect.catchIf((e) => e instanceof KubernetesApiError && e.statusCode === 404, () => Effect.void));
+    path: objectPath(apiVersion, info, namespace, name),
+})))), Effect.catchIf((e) => e instanceof KubernetesApiError && e.statusCode === 404, () => Effect.void));
 //# sourceMappingURL=client.js.map

package/lib/Kubernetes/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAYlC,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CACtD,oBAAoB,CAMpB;CAAG;AAEL,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAC1D,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,WAAW,GAOZ;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9B,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE;oBAC3C,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC;4BACE,cAAc,EACZ,WAAW,IAAI,kBAAkB;4BACnC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;yBAC7C;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,EAAE;gBACF,OAAO,EAAE,kBAAkB;aAC5B,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;oBAE9C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;wBAC1C,MAAM,CACJ,IAAI,kBAAkB,CAAC;4BACrB,MAAM;4BACN,IAAI;4BACJ,UAAU;4BACV,IAAI,EAAE,YAAY;yBACnB,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzB,OAAO,CAAC,SAAS,CAAC,CAAC;wBACnB,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,YAAY,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,8DAA8D;YAC9D,uDAAuD;YACvD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACzB,OAAO,CAAC,OAAO,CACb,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,2BAA2B,kBAAkB,IAAI;aACxD,CAAC,CACH,CACF,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC;QACJ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,kBAAkB;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAgBH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CACrD,sBAAsB,SAAS,YAAY,IAAI,EAAE,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,UAAyB,EACzB,SAAiB,EACjB,IAAY,EACZ,EAAE,CACF,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC;CAClC,CAAoD,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,UAAyB,EACzB,MAIC,EACD,EAAE,CACF,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,kCAAkC;IACtG,WAAW,EAAE,8BAA8B;IAC3C,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE;CACtD,CAAgE,CAAC;AAEpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,UAAyB,EACzB,SAAiB,EACjB,IAAY,EACZ,EAAE,CACF,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC;CAClC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAA2B,EAAE,CAC7B,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/Kubernetes/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAYlC,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CACtD,oBAAoB,CAMpB;CAAG;AAEL,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAC1D,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,WAAW,GAOZ;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9B,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE;oBAC3C,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC;4BACE,cAAc,EACZ,WAAW,IAAI,kBAAkB;4BACnC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;yBAC7C;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,EAAE;gBACF,OAAO,EAAE,kBAAkB;aAC5B,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;oBAE9C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;wBAC1C,MAAM,CACJ,IAAI,kBAAkB,CAAC;4BACrB,MAAM;4BACN,IAAI;4BACJ,UAAU;4BACV,IAAI,EAAE,YAAY;yBACnB,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzB,OAAO,CAAC,SAAS,CAAC,CAAC;wBACnB,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,YAAY,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,8DAA8D;YAC9D,uDAAuD;YACvD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACzB,OAAO,CAAC,OAAO,CACb,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,2BAA2B,kBAAkB,IAAI;aACxD,CAAC,CACH,CACF,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC;QACJ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,kBAAkB;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAyBH;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACqC,EAAE;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,OACE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAIhD,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACrB,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;QACF,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,kBAAkB,CAAC;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,QAAQ,UAAU,IAAI,IAAI,4BAA4B,IAAI,GAAG;aACpE,CAAC,CACH,CAAC;IACR,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,UAAkB,EAClB,IAAkB,EAClB,SAA6B,EAC7B,IAAwB,EAChB,EAAE;IACV,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU;QAChC,CAAC,CAAC,GAAG,MAAM,eAAe,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE;QACpD,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,IAAkB,EAClB,SAA6B,EACY,EAAE,CAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;IAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,kBAAkB,CAAC;QACrB,MAAM;QACN,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,UAAU,IAAI,IAAI,0CAA0C;KACtE,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,UAAyB,EACzB,MAAkB,EAClB,YAAY,GAAG,SAAS,EACmC,EAAE;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,kBAAkB,CAAC;YACrB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiB,YAAY,aAAa,CAAC;QACxG,OAAO,WAAW,CAAC;YACjB,UAAU;YACV,MAAM,EAAE,OAAO;YACf,IAAI;YACJ,WAAW,EAAE,8BAA8B;YAC3C,IAAI,EAAE,MAAiC;SACxC,CAA8D,CAAC;IAClE,CAAC,CAAC,CACH,CACF,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,SAA6B,EAC7B,IAAY,EACmC,EAAE,CACjD,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,CACH,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;CACpD,CAAkD,CACtD,CACF,CACF,CACF,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,SAA6B,EAC7B,IAAY,EAC6B,EAAE,CAC3C,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,WAAW,CAAC;IACV,UAAU;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;CACpD,CAAC,CACH,CACF,CACF,EACD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAA2B,EAAE,CAC7B,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CAAC"}

package/lib/Kubernetes/connection.d.ts

@@ -0,0 +1,48 @@
+import { Credentials } from "@distilled.cloud/kubernetes/Credentials";
+import * as Layer from "effect/Layer";
+import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+/**
+ * Bridges a GKE control plane into the layers that `@distilled.cloud/kubernetes`
+ * operations require — letting us drive the cluster's kube-apiserver through the
+ * typed distilled SDK (core/v1, apps/v1, batch, rbac, apiextensions/CRDs, …)
+ * instead of hand-rolling one HTTP resource per kind.
+ *
+ * distilled operations resolve two services from context:
+ *
+ * - `KubernetesCredentials` (`{ token, apiBaseUrl }`) — the bearer token (a
+ *   Google OAuth access token minted from the provider's ADC `Credentials`) and
+ *   the API base URL (`https://<cluster endpoint>`).
+ * - `HttpClient.HttpClient` — the transport. The GKE API server presents a cert
+ *   signed by the cluster's *own* CA (not a public root), so a stock fetch fails
+ *   TLS verification. We override {@link FetchHttpClient.Fetch} with a
+ *   `node:https`-backed fetch that trusts the per-cluster CA — the same
+ *   justified TLS exception the bespoke client made, but now routed through the
+ *   typed SDK. (undici's `Agent`/`dispatcher` would be the fetch-native route,
+ *   but undici isn't resolvable as a bare import here, and this reuses the
+ *   transport we already trust.)
+ *
+ * @example
+ * ```typescript
+ * import { readCoreV1NamespacedSecret } from "@distilled.cloud/kubernetes/core";
+ *
+ * const secret = yield* readCoreV1NamespacedSecret({ namespace, name }).pipe(
+ *   Effect.provide(clusterLayer({ endpoint, caCertificate, token })),
+ * );
+ * ```
+ */
+/** A resolved connection to a single GKE control plane. */
+export interface ClusterConnection {
+    /** Master endpoint — IP or hostname, no scheme (e.g. `34.1.2.3`). */
+    readonly endpoint: string;
+    /** Base64-encoded cluster CA certificate (PEM), as GKE returns it. */
+    readonly caCertificate: string;
+    /** Google OAuth access token (cloud-platform scope) for `Authorization`. */
+    readonly token: Redacted.Redacted<string>;
+}
+/**
+ * The full requirements layer for any `@distilled.cloud/kubernetes` operation
+ * against one GKE cluster: credentials + a CA-trusting HTTP client.
+ */
+export declare const clusterLayer: (connection: ClusterConnection) => Layer.Layer<Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=connection.d.ts.map

package/lib/Kubernetes/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3C;AA2HD;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,YAAY,iBAAiB,KAC5B,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAI/C,CAAC"}

package/lib/Kubernetes/connection.js

@@ -0,0 +1,93 @@
+import { Credentials } from "@distilled.cloud/kubernetes/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as https from "node:https";
+/** Bounds a hung socket — Effect interruption can't abort an in-flight request. */
+const REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * A `globalThis.fetch`-shaped function that issues the request over `node:https`
+ * trusting an explicit CA PEM, then resolves a standard `Response`. Effect's
+ * {@link FetchHttpClient.layer} reads this via `fiber.getRef(Fetch)` and feeds
+ * it `(url, { method, headers, body, signal })` per request.
+ */
+const caFetch = (caPem) => ((input, init) => {
+    const href = typeof input === "string"
+        ? input
+        : input instanceof URL
+            ? input.href
+            : input.url;
+    const url = new URL(href);
+    const headers = {};
+    if (init?.headers) {
+        new Headers(init.headers).forEach((value, key) => {
+            headers[key] = value;
+        });
+    }
+    const body = init?.body;
+    if (body != null &&
+        typeof body !== "string" &&
+        !(body instanceof Uint8Array)) {
+        // Our k8s calls only ever send JSON (Raw/Uint8Array) bodies. A streaming
+        // body would need different handling — fail loudly rather than silently
+        // dropping it.
+        return Promise.reject(new TypeError("caFetch: only string/Uint8Array request bodies are supported"));
+    }
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: `${url.pathname}${url.search}`,
+            method: init?.method ?? "GET",
+            headers,
+            ca: caPem,
+            timeout: REQUEST_TIMEOUT_MS,
+        }, (response) => {
+            const chunks = [];
+            response.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            response.on("end", () => {
+                const buffer = Buffer.concat(chunks);
+                const responseHeaders = new Headers();
+                for (const [key, value] of Object.entries(response.headers)) {
+                    if (Array.isArray(value)) {
+                        for (const v of value)
+                            responseHeaders.append(key, v);
+                    }
+                    else if (value != null) {
+                        responseHeaders.set(key, value);
+                    }
+                }
+                resolve(new Response(buffer.length > 0 ? buffer : null, {
+                    status: response.statusCode ?? 500,
+                    statusText: response.statusMessage ?? "",
+                    headers: responseHeaders,
+                }));
+            });
+        });
+        request.on("error", reject);
+        // `timeout` only fires the event — destroy the socket ourselves so the
+        // promise rejects instead of hanging.
+        request.on("timeout", () => request.destroy(new Error(`Kubernetes request timed out after ${REQUEST_TIMEOUT_MS}ms`)));
+        // Honour Effect's abort signal so interruption tears down the socket.
+        if (init?.signal) {
+            if (init.signal.aborted)
+                request.destroy(new Error("aborted"));
+            else
+                init.signal.addEventListener("abort", () => request.destroy(new Error("aborted")));
+        }
+        if (body != null)
+            request.write(body);
+        request.end();
+    });
+});
+/** `HttpClient` layer whose fetch trusts the given (base64 PEM) cluster CA. */
+const caHttpClient = (caCertificate) => Layer.provide(FetchHttpClient.layer, Layer.succeed(FetchHttpClient.Fetch, caFetch(Buffer.from(caCertificate, "base64").toString("utf8"))));
+/** `KubernetesCredentials` layer for a single cluster + bearer token. */
+const credentials = (endpoint, token) => Layer.succeed(Credentials, Effect.succeed({ token, apiBaseUrl: `https://${endpoint}` }));
+/**
+ * The full requirements layer for any `@distilled.cloud/kubernetes` operation
+ * against one GKE cluster: credentials + a CA-trusting HTTP client.
+ */
+export const clusterLayer = (connection) => Layer.merge(credentials(connection.endpoint, connection.token), caHttpClient(connection.caCertificate));
+//# sourceMappingURL=connection.js.map

package/lib/Kubernetes/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/Kubernetes/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAExE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AA0CpC,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAA2B,EAAE,CACzD,CAAC,CAAC,KAAwB,EAAE,IAAkB,EAAqB,EAAE;IACnE,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,GAAG;YACpB,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;IAClB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,IACE,IAAI,IAAI,IAAI;QACZ,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAC7B,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,eAAe;QACf,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;YACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO;YACP,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,kBAAkB;SAC5B,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACjE,CAAC;YACF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;gBACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,KAAK,MAAM,CAAC,IAAI,KAAK;4BAAE,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACxD,CAAC;yBAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBACzB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAO,CACL,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;oBAC9C,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;oBACxC,OAAO,EAAE,eAAe;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,uEAAuE;QACvE,sCAAsC;QACtC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACzB,OAAO,CAAC,OAAO,CACb,IAAI,KAAK,CAAC,sCAAsC,kBAAkB,IAAI,CAAC,CACxE,CACF,CAAC;QACF,sEAAsE;QACtE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;;gBAE7D,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CACzC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CACtC,CAAC;QACN,CAAC;QACD,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAA4B,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,YAAY,GAAG,CACnB,aAAqB,EACe,EAAE,CACtC,KAAK,CAAC,OAAO,CACX,eAAe,CAAC,KAAK,EACrB,KAAK,CAAC,OAAO,CACX,eAAe,CAAC,KAAK,EACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC/D,CACF,CAAC;AAEJ,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAClB,QAAgB,EAChB,KAAgC,EACN,EAAE,CAC5B,KAAK,CAAC,OAAO,CACX,WAAW,EACX,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,QAAQ,EAAE,EAAE,CAAC,CAC7D,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,UAA6B,EACqB,EAAE,CACpD,KAAK,CAAC,KAAK,CACT,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAClD,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,CACvC,CAAC"}

package/lib/Kubernetes/index.d.ts

@@ -1,2 +1,3 @@
+export * from "./KubernetesManifest.ts";
 export * from "./Secret.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Kubernetes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC"}

package/lib/Kubernetes/index.js

@@ -1,2 +1,3 @@
+export * from "./KubernetesManifest.js";
 export * from "./Secret.js";
 //# sourceMappingURL=index.js.map

package/lib/Kubernetes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Kubernetes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Kubernetes/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC"}

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA2CtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,8QA2DnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA+CtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,8QA6DnB,CAAC"}

package/lib/Providers.js

@@ -14,6 +14,7 @@ import { SharedVpcServiceProject, SharedVpcServiceProjectProvider, } from "./Com
 import { Subnetwork, SubnetworkProvider } from "./Compute/Subnetwork.js";
 import { Cluster, ClusterProvider } from "./Container/Cluster.js";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.js";
+import { KubernetesManifest, KubernetesManifestProvider, } from "./Kubernetes/KubernetesManifest.js";
 import { KubernetesSecret, KubernetesSecretProvider, } from "./Kubernetes/Secret.js";
 import { ManagedLustreInstance, ManagedLustreInstanceProvider, } from "./ManagedLustre/Instance.js";
 import { Job, JobProvider } from "./Run/Job.js";
@@ -62,7 +63,8 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     SqlUser,
     ArtifactRegistryRepository,
     KubernetesSecret,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), KubernetesSecretProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+    KubernetesManifest,
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), KubernetesSecretProvider(), KubernetesManifestProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,gBAAgB;CACjB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,wBAAwB,EAAE,CAC3B,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,CAC7B,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
@@ -54,11 +54,13 @@
   },
   "peerDependencies": {
     "@distilled.cloud/gcp": ">=0.16.9",
+    "@distilled.cloud/kubernetes": ">=0.24.9",
     "alchemy": ">=2.0.0-beta.30",
     "effect": ">=4.0.0-beta.60 || >=4.0.0"
   },
   "devDependencies": {
     "@distilled.cloud/gcp": "workspace:*",
+    "@distilled.cloud/kubernetes": "workspace:*",
     "@types/bun": "latest",
     "@types/node": "latest",
     "alchemy": "workspace:*",