@microagi/alchemy-gcp 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,92 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.8.0 — 2026-06-17
+
+### Added
+
+- **`GCP.ServiceAccount`** — Alchemy resource for managing Google
+  Cloud service accounts (GSAs). Wraps the iam-v1 API
+  (`@distilled.cloud/gcp/unstable/iam-v1` — the `iamcredentials-v1`
+  surface was already in the stable index; `iam-v1` lives under
+  `unstable/` because the auto-generated codegen hasn't been manually
+  reviewed). Adoption gated on an alchemy marker embedded in the
+  GSA's `description` field (GSAs have no labels field, so the
+  label-based pattern used by `GCP.Project` doesn't apply — see
+  `Tags.descriptionHasAlchemyMarker`). Cold recovery (state loss)
+  falls back to a project-wide scan-by-marker when persisted
+  `output`/`olds` lack the `uniqueId`. Synchronous lifecycle — no LRO
+  polling required.
+
+- **`GCP.serviceAccountIamMember`** — target-side binding helper, the
+  same shape as the existing `projectIamMember` and
+  `subnetworkIamMember`. Records a `(role, member)` grant onto the
+  GSA's binding bag; the ServiceAccount provider's `reconcile` merges
+  all bound entries by role into a single `setIamPolicy` call on the
+  GSA. Foreign bindings on the policy (non-alchemy roles, or members
+  we don't manage on the same role) are preserved verbatim. Etag
+  round-trip handles concurrent edits; `Conflict` triggers a
+  re-read + retry.
+
+### Use cases
+
+- Workload Identity bindings — `roles/iam.workloadIdentityUser` on a
+  GSA from a k8s SA. Replaces the manual `gcloud iam service-accounts
+  add-iam-policy-binding` dance that's been applied out-of-band for
+  the `research-ui` and `preview-builder` GSAs.
+- Per-namespace `roles/artifactregistry.writer` on a GSA scoped to
+  a single research pod (instead of project-wide via
+  `projectIamMember`).
+- Impersonation grants — `roles/iam.serviceAccountTokenCreator` /
+  `roles/iam.serviceAccountUser`.
+
+## 0.7.0 — 2026-06-16
+
+### Added
+
+- **`GCP.KubernetesManifest`** — generic Alchemy resource for *any*
+  Kubernetes Kind/CRD, server-side-applied via
+  `Content-Type: application/apply-patch+yaml` with `fieldManager=alchemy`
+  and `force=true`. Kind → REST resource (plural + scope) resolved through
+  the apiserver's discovery endpoint, so built-ins and CRDs work without a
+  hard-coded kind→plural table. Adoption gated on the standard
+  `alchemy_app`/`alchemy_stage`/`alchemy_id` label triple.
+
+- **`clusterLayer` (`src/Kubernetes/connection.ts`)** — wires a GKE
+  cluster into the typed `@distilled.cloud/kubernetes` SDK: ADC bearer
+  token (`Credentials`) + an `HttpClient` whose `FetchHttpClient.Fetch` is
+  overridden with a `node:https` fetch that trusts the per-cluster CA.
+  The stock fetch can't verify the GKE cert (it's signed by the
+  cluster's own CA, not a public root), so the override is required.
+
+### Changed
+
+- **`GCP.KubernetesSecret` convergence** — moved off the hand-rolled
+  client onto typed `@distilled.cloud/kubernetes` core/v1 ops. Reconcile
+  is now **create + replace (PUT)** with the observed `resourceVersion`
+  for optimistic concurrency, bounded `Conflict` retry (recursive on the
+  whole observe→write flow, up to 3 re-attempts), and read-modify-write
+  metadata that preserves foreign annotations/owner references/finalizers
+  (a PUT replaces the whole object, so spreading `...observed.metadata`
+  first and overlaying only what we manage is essential — without it
+  every reconcile would strip an `ownerReference` and break garbage
+  collection). Validation scripts in `scripts/validate-k8s-{connection,
+  secret,manifest}.ts` cover live cluster runs against `research-cluster-a`.
+
+## 0.6.0 — 2026-06-14
+
+### Added
+
+- **`GCP.KubernetesSecret`** — first Kubernetes resource in the
+  provider. Opaque Secret in a GKE cluster, driven via a hand-rolled
+  REST client with ADC bearer auth + per-cluster CA trust. Adoptable via
+  the standard alchemy-internal label triple.
+
+### Changed
+
+- **`Auth/Credentials.fromAuthProvider`** — same fix as `0.5.1`,
+  re-asserted against the freshly bumped workspace pins.
+
 ## 0.5.1 — 2026-06-08
 
 ### Fixed

package/lib/Iam/ServiceAccount.d.ts

@@ -0,0 +1,104 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A GCP service account (GSA). Lives under a {@link import("../CloudResourceManager/Project.ts").Project}
+ * and serves as the federated identity target for Workload Identity
+ * (`iam.gke.io/gcp-service-account: <email>` on a k8s SA) and as the
+ * principal in any IAM grant that should out-live a human user.
+ *
+ * Adoption is gated on an alchemy marker embedded in the GSA's
+ * `description` field (see `gcpAlchemyDescription` /
+ * `descriptionHasAlchemyMarker`) — GSAs have no labels field, so the
+ * label-based adoption gate used by Project can't apply. The marker is
+ * only written on insert; `description` is mutable but we never *clear*
+ * it because doing so would orphan the adoption signal.
+ *
+ * All lifecycle operations (`createProjectsServiceAccounts`,
+ * `patchProjectsServiceAccounts`, `deleteProjectsServiceAccounts`) are
+ * synchronous — no LRO polling required.
+ *
+ * @section Creating a ServiceAccount
+ * @example Minimal GSA under a project
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push (BuildKit client)",
+ * });
+ * ```
+ *
+ * @example With explicit description and Workload Identity binding
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push",
+ *   description: "Used by per-researcher BuildKit clients to push to AR.",
+ * });
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${projectA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export type ServiceAccountProps = {
+    /**
+     * GCP project id (e.g. `micro-research-shared`) the GSA lives under.
+     * Immutable — changing this orphans the GSA's unique id and any
+     * bindings, so `diff` triggers a replacement.
+     */
+    project: string;
+    /**
+     * The account id segment of the service account's email. Must match
+     * `[a-z]([-a-z0-9]*[a-z0-9])`, 6-30 chars. Immutable — replaces.
+     */
+    accountId: string;
+    /**
+     * User-visible display name. Max 100 UTF-8 bytes. Mutable.
+     */
+    displayName?: string;
+    /**
+     * User-supplied description (max 256 UTF-8 bytes). The alchemy
+     * ownership marker is prepended automatically — see
+     * `gcpAlchemyDescription`. The user-supplied portion is preserved
+     * verbatim and surfaced back through `Attributes.description`.
+     */
+    description?: string;
+};
+/**
+ * Single (role, members) entry on a GSA's IAM policy. Targets declare
+ * this contract so capabilities (e.g. Workload Identity) can `.bind`
+ * IAM grants onto the GSA — the provider's `reconcile` merges all
+ * bound entries by role into a single `setIamPolicy` call.
+ */
+export type ServiceAccountIamBinding = {
+    /** IAM role, e.g. `"roles/iam.workloadIdentityUser"`. */
+    role: string;
+    /** Principals, e.g. `["serviceAccount:foo.svc.id.goog[ns/ksa]"]`. */
+    members: ReadonlyArray<string>;
+};
+export type ServiceAccountBindingContract = {
+    iamBindings: ReadonlyArray<ServiceAccountIamBinding>;
+};
+export type ServiceAccount = Resource<"GCP.ServiceAccount", ServiceAccountProps, {
+    /** Full resource name, e.g. `projects/micro-research-shared/serviceAccounts/research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    name: string;
+    /** Email address derived from the account id, e.g. `research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    email: string;
+    /** Server-assigned stable numeric id. */
+    uniqueId: string;
+    /** Project the GSA lives under. */
+    projectId: string;
+    /** Account id (the part before `@`). */
+    accountId: string;
+    /** User-visible display name, or `undefined` if never set. */
+    displayName: string | undefined;
+    /** User-visible description (without the alchemy marker), or `undefined` if never set. */
+    description: string | undefined;
+    /** Whether the GSA is currently disabled. */
+    disabled: boolean;
+}, ServiceAccountBindingContract, GCP.Providers>;
+export declare const ServiceAccount: import("alchemy").ResourceClass<ServiceAccount>;
+export declare const ServiceAccountProvider: () => import("effect/Layer").Layer<Provider.Provider<ServiceAccount>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=ServiceAccount.d.ts.map

package/lib/Iam/ServiceAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccount.d.ts","sourceRoot":"","sources":["../../src/Iam/ServiceAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,WAAW,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,oBAAoB,EACpB,mBAAmB,EACnB;IACE,gJAAgJ;IAChJ,IAAI,EAAE,MAAM,CAAC;IACb,wHAAwH;IACxH,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0FAA0F;IAC1F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAC;CACnB,EACD,6BAA6B,EAC7B,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,cAAc,iDAAiD,CAAC;AAgB7E,eAAO,MAAM,sBAAsB,qOAiShC,CAAC"}

package/lib/Iam/ServiceAccount.js

@@ -0,0 +1,236 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+export const ServiceAccount = Resource("GCP.ServiceAccount");
+const toAttributes = (sa) => {
+    const accountId = (sa.email ?? "").split("@")[0];
+    return {
+        name: sa.name ?? "",
+        email: sa.email ?? "",
+        uniqueId: sa.uniqueId ?? "",
+        projectId: sa.projectId ?? "",
+        accountId,
+        displayName: sa.displayName,
+        description: stripAlchemyMarker(sa.description),
+        disabled: sa.disabled ?? false,
+    };
+};
+export const ServiceAccountProvider = () => Provider.effect(ServiceAccount, Effect.gen(function* () {
+    const getProjectsServiceAccounts = yield* iam.getProjectsServiceAccounts;
+    const createProjectsServiceAccounts = yield* iam.createProjectsServiceAccounts;
+    const patchProjectsServiceAccounts = yield* iam.patchProjectsServiceAccounts;
+    const deleteProjectsServiceAccounts = yield* iam.deleteProjectsServiceAccounts;
+    const listProjectsServiceAccounts = yield* iam.listProjectsServiceAccounts;
+    const getIamPolicyProjectsServiceAccounts = yield* iam.getIamPolicyProjectsServiceAccounts;
+    const setIamPolicyProjectsServiceAccounts = yield* iam.setIamPolicyProjectsServiceAccounts;
+    const resourceName = (projectId, accountId) => `projects/${projectId}/serviceAccounts/${accountId}`;
+    const observeServiceAccount = (projectId, accountId) => getProjectsServiceAccounts({
+        name: resourceName(projectId, accountId),
+    }).pipe(
+    // GSAs that don't exist OR that the caller can't see both
+    // collapse to "absent" — same 403→missing pattern as the
+    // project observer.
+    Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const requireServiceAccount = (projectId, accountId, context) => observeServiceAccount(projectId, accountId).pipe(Effect.flatMap((sa) => sa
+        ? Effect.succeed(sa)
+        : Effect.fail(new ConfigError({
+            message: `ServiceAccount ${accountId} in project ${projectId} ${context}.`,
+        }))));
+    // List-page scan for cold recovery. Alchemy marker in the
+    // description field identifies our GSAs; the page boundary is
+    // arbitrary — we still need to page through to find any marker
+    // that happens to fall past the first page.
+    const findByAlchemyMarker = Effect.fn(function* (id, projectId) {
+        let pageToken;
+        // Up to 100 pages × 100 items per page = 10000 GSAs; well past
+        // any realistic project size. If we ever exceed that we should
+        // cap and warn rather than silently miss matches.
+        for (let i = 0; i < 100; i++) {
+            const page = yield* listProjectsServiceAccounts({
+                name: `projects/${projectId}`,
+                ...(pageToken ? { pageToken } : {}),
+                pageSize: 100,
+            });
+            for (const sa of page.accounts ?? []) {
+                if (yield* descriptionHasAlchemyMarker(id, sa.description)) {
+                    return sa;
+                }
+            }
+            pageToken = page.nextPageToken;
+            if (!pageToken)
+                return undefined;
+        }
+        return undefined;
+    });
+    // Sync mutable fields: displayName + description. Both use
+    // `updateMask` so we only PATCH what actually changed. Diff
+    // against OBSERVED state, not `olds`, so adoption converges
+    // correctly when a foreign description is on the GSA.
+    const syncMutable = Effect.fn(function* (observed, desired) {
+        const updateMaskFields = [];
+        if (desired.displayName !== observed.displayName) {
+            updateMaskFields.push("display_name");
+        }
+        const descDiff = diffTags({ description: observed.description ?? "" }, { description: desired.descriptionWithMarker });
+        if (descDiff.removed.length > 0 ||
+            descDiff.upsert.length > 0) {
+            updateMaskFields.push("description");
+        }
+        if (updateMaskFields.length === 0)
+            return observed;
+        return yield* patchProjectsServiceAccounts({
+            name: observed.name,
+            body: {
+                updateMask: updateMaskFields.join(","),
+                serviceAccount: {
+                    displayName: desired.displayName,
+                    description: desired.descriptionWithMarker,
+                },
+            },
+        });
+    });
+    // Apply merged IAM bindings as a single setIamPolicy. Same
+    // foreign-binding preservation + etag-retry pattern as the
+    // Project's `syncIam` — see `src/CloudResourceManager/Project.ts:421-474`.
+    const syncIam = (args) => Effect.gen(function* () {
+        const desiredByRole = new Map();
+        for (const b of args.bindings) {
+            for (const ib of b.data.iamBindings) {
+                const set = desiredByRole.get(ib.role) ?? new Set();
+                for (const m of ib.members)
+                    set.add(m);
+                desiredByRole.set(ib.role, set);
+            }
+        }
+        if (desiredByRole.size === 0)
+            return;
+        const current = yield* getIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            "options.requestedPolicyVersion": 3,
+        });
+        const existingBindings = (current.bindings ?? []).map((b) => ({
+            ...b,
+            members: [...(b.members ?? [])],
+        }));
+        let mutated = false;
+        for (const [role, members] of desiredByRole) {
+            let existing = existingBindings.find((b) => b.role === role && !b.condition);
+            if (!existing) {
+                existing = { role, members: [] };
+                existingBindings.push(existing);
+            }
+            const merged = new Set([...(existing.members ?? []), ...members]);
+            if (merged.size !== (existing.members?.length ?? 0))
+                mutated = true;
+            existing.members = [...merged];
+        }
+        if (!mutated)
+            return;
+        yield* setIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            body: {
+                policy: { ...current, bindings: existingBindings, version: 3 },
+            },
+        });
+    }).pipe(Effect.retry({
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    return {
+        // Stable identity: accountId + project; both immutable; either
+        // change → replace. The server-assigned uniqueId is also stable
+        // for the lifetime of the GSA (re-create gets a different one).
+        stables: ["accountId", "projectId", "uniqueId", "name", "email"],
+        diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            if (news.accountId !== (output?.accountId ?? olds.accountId) ||
+                news.project !== (output?.projectId ?? olds.project)) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings }) {
+            const descriptionWithMarker = yield* gcpAlchemyDescription(id, news.description);
+            // 1. Observe — cloud state is authoritative. A second
+            //    scan-by-marker covers the cold-recovery case where
+            //    persisted `output`/`olds` lost the uniqueId after
+            //    state loss. We prefer the direct-by-name probe first
+            //    (cheap) and fall back to the scan only when direct
+            //    observation returned `undefined`.
+            let observed = yield* observeServiceAccount(news.project, news.accountId);
+            if (!observed) {
+                observed = yield* findByAlchemyMarker(id, news.project);
+            }
+            // 2. Ensure — create if missing. createProjectsServiceAccounts
+            //    is synchronous (returns the SA, not an LRO). Conflict
+            //    covers a peer reconciler race — re-observe.
+            if (!observed) {
+                observed = yield* createProjectsServiceAccounts({
+                    name: `projects/${news.project}`,
+                    body: {
+                        accountId: news.accountId,
+                        serviceAccount: {
+                            displayName: news.displayName,
+                            description: descriptionWithMarker,
+                        },
+                    },
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (!observed) {
+                    observed = yield* requireServiceAccount(news.project, news.accountId, "did not appear after create");
+                }
+            }
+            // 3. Sync mutable fields against OBSERVED state.
+            const synced = yield* syncMutable(observed, {
+                displayName: news.displayName ?? observed.displayName,
+                descriptionWithMarker,
+                descriptionUserOnly: news.description,
+            });
+            // 4. Sync IAM bindings (Workload Identity, impersonators, …).
+            //    Single setIamPolicy on the GSA with merged bindings;
+            //    foreign roles preserved. Etag-retried internally.
+            yield* syncIam({
+                resourceName: synced.name,
+                bindings,
+            });
+            return toAttributes(synced);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            // Synchronous delete — Empty response, no LRO. NotFound
+            // means the GSA was already deleted (or never existed in our
+            // scope); both are idempotent successes.
+            yield* deleteProjectsServiceAccounts({
+                name: output.name,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("Forbidden", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            // Direct-by-name probe when we have any handle on the
+            // accountId. Falls back to a project-wide scan-by-marker
+            // for cold recovery after state loss.
+            const accountId = output?.accountId ?? olds?.accountId;
+            const projectId = output?.projectId ?? olds?.project;
+            let observed;
+            if (accountId && projectId) {
+                observed = yield* observeServiceAccount(projectId, accountId);
+            }
+            if (!observed && projectId) {
+                observed = yield* findByAlchemyMarker(id, projectId);
+            }
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed);
+            // Adoption gate via description marker (see Tags.ts §description).
+            return (yield* descriptionHasAlchemyMarker(id, observed.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=ServiceAccount.js.map

package/lib/Iam/ServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccount.js","sourceRoot":"","sources":["../../src/Iam/ServiceAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AA+GpB,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,oBAAoB,CAAC,CAAC;AAE7E,MAAM,YAAY,GAAG,CAAC,EAAsB,EAAgC,EAAE;IAC5E,MAAM,SAAS,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE;QACnB,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;QAC3B,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;QAC7B,SAAS;QACT,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAAC;QAC/C,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,KAAK;KAC/B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,MAAM,CACb,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,0BAA0B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACzE,MAAM,6BAA6B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,4BAA4B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC7E,MAAM,6BAA6B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,2BAA2B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3E,MAAM,mCAAmC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;IAC3F,MAAM,mCAAmC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;IAE3F,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,EAAE,CAC5D,YAAY,SAAS,oBAAoB,SAAS,EAAE,CAAC;IAEvD,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,EAAE,CACrE,0BAA0B,CAAC;QACzB,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC;KACzC,CAAC,CAAC,IAAI;IACL,0DAA0D;IAC1D,yDAAyD;IACzD,oBAAoB;IACpB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,CACF,CAAC;IAEJ,MAAM,qBAAqB,GAAG,CAC5B,SAAiB,EACjB,SAAiB,EACjB,OAAe,EACf,EAAE,CACF,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE;QACA,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,kBAAkB,SAAS,eAAe,SAAS,IAAI,OAAO,GAAG;SAC3E,CAAC,CACH,CACN,CACF,CAAC;IAEJ,0DAA0D;IAC1D,8DAA8D;IAC9D,+DAA+D;IAC/D,4CAA4C;IAC5C,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC7C,EAAU,EACV,SAAiB;QAEjB,IAAI,SAA6B,CAAC;QAClC,+DAA+D;QAC/D,+DAA+D;QAC/D,kDAAkD;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC;gBAC9C,IAAI,EAAE,YAAY,SAAS,EAAE;gBAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3D,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;YAC/B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,4DAA4D;IAC5D,4DAA4D;IAC5D,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACrC,QAA4B,EAC5B,OAIC;QAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjD,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CACvB,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAC3C,EAAE,WAAW,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAC/C,CAAC;QACF,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEnD,OAAO,KAAK,CAAC,CAAC,4BAA4B,CAAC;YACzC,IAAI,EAAE,QAAQ,CAAC,IAAK;YACpB,IAAI,EAAE;gBACJ,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtC,cAAc,EAAE;oBACd,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,qBAAqB;iBAC3C;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,2DAA2D;IAC3D,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,IAKhB,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mCAAmC,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,gCAAgC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC;YACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SAChC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,IAAI,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBACjC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,KAAK,CAAC,CAAC,mCAAmC,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAAE;aAC/D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;QACX,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,OAAO;QACL,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;QAChE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;gBACxD,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,EACpD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACxD,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,sDAAsD;YACtD,wDAAwD;YACxD,uDAAuD;YACvD,0DAA0D;YAC1D,wDAAwD;YACxD,uCAAuC;YACvC,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YAED,+DAA+D;YAC/D,2DAA2D;YAC3D,iDAAiD;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC;oBAC9C,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE;oBAChC,IAAI,EAAE;wBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE;4BACd,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,WAAW,EAAE,qBAAqB;yBACnC;qBACF;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,CACF,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,6BAA6B,CAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;gBACrD,qBAAqB;gBACrB,mBAAmB,EAAE,IAAI,CAAC,WAAW;aACtC,CAAC,CAAC;YAEH,8DAA8D;YAC9D,0DAA0D;YAC1D,uDAAuD;YACvD,KAAK,CAAC,CAAC,OAAO,CAAC;gBACb,YAAY,EAAE,MAAM,CAAC,IAAK;gBAC1B,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,wDAAwD;YACxD,6DAA6D;YAC7D,yCAAyC;YACzC,KAAK,CAAC,CAAC,6BAA6B,CAAC;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,sDAAsD;YACtD,yDAAyD;YACzD,sCAAsC;YACtC,MAAM,SAAS,GACb,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvC,MAAM,SAAS,GACb,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC;YAErC,IAAI,QAAwC,CAAC;YAC7C,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,mEAAmE;YACnE,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/ServiceAccountIamMember.d.ts

@@ -0,0 +1,49 @@
+import * as Effect from "effect/Effect";
+import type { ServiceAccount } from "./ServiceAccount.ts";
+/**
+ * Bind a single `(role, member)` IAM grant onto a {@link ServiceAccount}.
+ *
+ * This is a **target-side binding** — it records the grant onto the
+ * GSA's binding bag (`stack.bindings[gsa]`); the ServiceAccount
+ * provider's `reconcile` later merges all such bindings (across all
+ * callers, including parallel ones from different stack stages) into
+ * a single `setIamPolicy` call on the GSA. Same pattern as
+ * `projectIamMember` / `subnetworkIamMember`.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<gsa>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (gsa, role, member) triple — otherwise a
+ * later bind silently overwrites an earlier one with the same key.
+ *
+ * The reason `key` exists: `member` is usually an `Output<string>`
+ * (e.g. `Output.interpolate\`...${cluster.projectId}...\``), and
+ * `Output` expressions stringify by their AST shape, not by the
+ * eventual value. Two interpolations of the same shape but different
+ * literal templates render the same SID. `key` sidesteps that by
+ * forcing a static, caller-supplied label into the SID.
+ *
+ * Use this for the "Pulumi `gcp.serviceAccount.IAMMember`" pattern:
+ * authoritative-for-(role, member)-tuple, additive (does not displace
+ * other members on the same role).
+ *
+ * @example Workload Identity binding for one cluster
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ *
+ * @example Same GSA, second cluster (separate key → distinct SID)
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterB-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterB.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export declare const serviceAccountIamMember: (gsa: ServiceAccount, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+//# sourceMappingURL=ServiceAccountIamMember.d.ts.map

package/lib/Iam/ServiceAccountIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccountIamMember.d.ts","sourceRoot":"","sources":["../../src/Iam/ServiceAccountIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAMiB,CAAC"}

package/lib/Iam/ServiceAccountIamMember.js

@@ -0,0 +1,50 @@
+/**
+ * Bind a single `(role, member)` IAM grant onto a {@link ServiceAccount}.
+ *
+ * This is a **target-side binding** — it records the grant onto the
+ * GSA's binding bag (`stack.bindings[gsa]`); the ServiceAccount
+ * provider's `reconcile` later merges all such bindings (across all
+ * callers, including parallel ones from different stack stages) into
+ * a single `setIamPolicy` call on the GSA. Same pattern as
+ * `projectIamMember` / `subnetworkIamMember`.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<gsa>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (gsa, role, member) triple — otherwise a
+ * later bind silently overwrites an earlier one with the same key.
+ *
+ * The reason `key` exists: `member` is usually an `Output<string>`
+ * (e.g. `Output.interpolate\`...${cluster.projectId}...\``), and
+ * `Output` expressions stringify by their AST shape, not by the
+ * eventual value. Two interpolations of the same shape but different
+ * literal templates render the same SID. `key` sidesteps that by
+ * forcing a static, caller-supplied label into the SID.
+ *
+ * Use this for the "Pulumi `gcp.serviceAccount.IAMMember`" pattern:
+ * authoritative-for-(role, member)-tuple, additive (does not displace
+ * other members on the same role).
+ *
+ * @example Workload Identity binding for one cluster
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ *
+ * @example Same GSA, second cluster (separate key → distinct SID)
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterB-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterB.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export const serviceAccountIamMember = (gsa, key, args) => 
+// Tagged-template `.bind` records into the target's binding bag.
+// ServiceAccount's reconcile sees `bindings: ResourceBinding<…>[]`
+// and merges all entries by role into one setIamPolicy call.
+gsa.bind `IamMember(${gsa}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+//# sourceMappingURL=ServiceAccountIamMember.js.map

package/lib/Iam/ServiceAccountIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccountIamMember.js","sourceRoot":"","sources":["../../src/Iam/ServiceAccountIamMember.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,GAAmB,EACnB,GAAW,EACX,IAAsC,EACjB,EAAE;AACvB,iEAAiE;AACjE,mEAAmE;AACnE,6DAA6D;AAC7D,GAAG,CAAC,IAAI,CAAA,aAAa,GAAG,KAAK,GAAG,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC"}

package/lib/Iam/index.d.ts

@@ -0,0 +1,4 @@
+export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.ts";
+export type { ServiceAccountProps } from "./ServiceAccount.ts";
+export * from "./ServiceAccountIamMember.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Iam/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC"}

package/lib/Iam/index.js

@@ -0,0 +1,3 @@
+export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.js";
+export * from "./ServiceAccountIamMember.js";
+//# sourceMappingURL=index.js.map

package/lib/Iam/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC"}