@microagi/alchemy-gcp 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.8.0 — 2026-06-17
+
+### Added
+
+- **`GCP.ServiceAccount`** — Alchemy resource for managing Google
+  Cloud service accounts (GSAs). Wraps the iam-v1 API
+  (`@distilled.cloud/gcp/unstable/iam-v1` — the `iamcredentials-v1`
+  surface was already in the stable index; `iam-v1` lives under
+  `unstable/` because the auto-generated codegen hasn't been manually
+  reviewed). Adoption gated on an alchemy marker embedded in the
+  GSA's `description` field (GSAs have no labels field, so the
+  label-based pattern used by `GCP.Project` doesn't apply — see
+  `Tags.descriptionHasAlchemyMarker`). Cold recovery (state loss)
+  falls back to a project-wide scan-by-marker when persisted
+  `output`/`olds` lack the `uniqueId`. Synchronous lifecycle — no LRO
+  polling required.
+
+- **`GCP.serviceAccountIamMember`** — target-side binding helper, the
+  same shape as the existing `projectIamMember` and
+  `subnetworkIamMember`. Records a `(role, member)` grant onto the
+  GSA's binding bag; the ServiceAccount provider's `reconcile` merges
+  all bound entries by role into a single `setIamPolicy` call on the
+  GSA. Foreign bindings on the policy (non-alchemy roles, or members
+  we don't manage on the same role) are preserved verbatim. Etag
+  round-trip handles concurrent edits; `Conflict` triggers a
+  re-read + retry.
+
+### Use cases
+
+- Workload Identity bindings — `roles/iam.workloadIdentityUser` on a
+  GSA from a k8s SA. Replaces the manual `gcloud iam service-accounts
+  add-iam-policy-binding` dance that's been applied out-of-band for
+  the `research-ui` and `preview-builder` GSAs.
+- Per-namespace `roles/artifactregistry.writer` on a GSA scoped to
+  a single research pod (instead of project-wide via
+  `projectIamMember`).
+- Impersonation grants — `roles/iam.serviceAccountTokenCreator` /
+  `roles/iam.serviceAccountUser`.
+
 ## 0.7.0 — 2026-06-16
 
 ### Added

package/lib/Iam/ServiceAccount.d.ts

@@ -0,0 +1,104 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A GCP service account (GSA). Lives under a {@link import("../CloudResourceManager/Project.ts").Project}
+ * and serves as the federated identity target for Workload Identity
+ * (`iam.gke.io/gcp-service-account: <email>` on a k8s SA) and as the
+ * principal in any IAM grant that should out-live a human user.
+ *
+ * Adoption is gated on an alchemy marker embedded in the GSA's
+ * `description` field (see `gcpAlchemyDescription` /
+ * `descriptionHasAlchemyMarker`) — GSAs have no labels field, so the
+ * label-based adoption gate used by Project can't apply. The marker is
+ * only written on insert; `description` is mutable but we never *clear*
+ * it because doing so would orphan the adoption signal.
+ *
+ * All lifecycle operations (`createProjectsServiceAccounts`,
+ * `patchProjectsServiceAccounts`, `deleteProjectsServiceAccounts`) are
+ * synchronous — no LRO polling required.
+ *
+ * @section Creating a ServiceAccount
+ * @example Minimal GSA under a project
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push (BuildKit client)",
+ * });
+ * ```
+ *
+ * @example With explicit description and Workload Identity binding
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push",
+ *   description: "Used by per-researcher BuildKit clients to push to AR.",
+ * });
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${projectA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export type ServiceAccountProps = {
+    /**
+     * GCP project id (e.g. `micro-research-shared`) the GSA lives under.
+     * Immutable — changing this orphans the GSA's unique id and any
+     * bindings, so `diff` triggers a replacement.
+     */
+    project: string;
+    /**
+     * The account id segment of the service account's email. Must match
+     * `[a-z]([-a-z0-9]*[a-z0-9])`, 6-30 chars. Immutable — replaces.
+     */
+    accountId: string;
+    /**
+     * User-visible display name. Max 100 UTF-8 bytes. Mutable.
+     */
+    displayName?: string;
+    /**
+     * User-supplied description (max 256 UTF-8 bytes). The alchemy
+     * ownership marker is prepended automatically — see
+     * `gcpAlchemyDescription`. The user-supplied portion is preserved
+     * verbatim and surfaced back through `Attributes.description`.
+     */
+    description?: string;
+};
+/**
+ * Single (role, members) entry on a GSA's IAM policy. Targets declare
+ * this contract so capabilities (e.g. Workload Identity) can `.bind`
+ * IAM grants onto the GSA — the provider's `reconcile` merges all
+ * bound entries by role into a single `setIamPolicy` call.
+ */
+export type ServiceAccountIamBinding = {
+    /** IAM role, e.g. `"roles/iam.workloadIdentityUser"`. */
+    role: string;
+    /** Principals, e.g. `["serviceAccount:foo.svc.id.goog[ns/ksa]"]`. */
+    members: ReadonlyArray<string>;
+};
+export type ServiceAccountBindingContract = {
+    iamBindings: ReadonlyArray<ServiceAccountIamBinding>;
+};
+export type ServiceAccount = Resource<"GCP.ServiceAccount", ServiceAccountProps, {
+    /** Full resource name, e.g. `projects/micro-research-shared/serviceAccounts/research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    name: string;
+    /** Email address derived from the account id, e.g. `research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    email: string;
+    /** Server-assigned stable numeric id. */
+    uniqueId: string;
+    /** Project the GSA lives under. */
+    projectId: string;
+    /** Account id (the part before `@`). */
+    accountId: string;
+    /** User-visible display name, or `undefined` if never set. */
+    displayName: string | undefined;
+    /** User-visible description (without the alchemy marker), or `undefined` if never set. */
+    description: string | undefined;
+    /** Whether the GSA is currently disabled. */
+    disabled: boolean;
+}, ServiceAccountBindingContract, GCP.Providers>;
+export declare const ServiceAccount: import("alchemy").ResourceClass<ServiceAccount>;
+export declare const ServiceAccountProvider: () => import("effect/Layer").Layer<Provider.Provider<ServiceAccount>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=ServiceAccount.d.ts.map

package/lib/Iam/ServiceAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccount.d.ts","sourceRoot":"","sources":["../../src/Iam/ServiceAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,WAAW,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,oBAAoB,EACpB,mBAAmB,EACnB;IACE,gJAAgJ;IAChJ,IAAI,EAAE,MAAM,CAAC;IACb,wHAAwH;IACxH,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0FAA0F;IAC1F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAC;CACnB,EACD,6BAA6B,EAC7B,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,cAAc,iDAAiD,CAAC;AAgB7E,eAAO,MAAM,sBAAsB,qOAiShC,CAAC"}

package/lib/Iam/ServiceAccount.js

@@ -0,0 +1,236 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+export const ServiceAccount = Resource("GCP.ServiceAccount");
+const toAttributes = (sa) => {
+    const accountId = (sa.email ?? "").split("@")[0];
+    return {
+        name: sa.name ?? "",
+        email: sa.email ?? "",
+        uniqueId: sa.uniqueId ?? "",
+        projectId: sa.projectId ?? "",
+        accountId,
+        displayName: sa.displayName,
+        description: stripAlchemyMarker(sa.description),
+        disabled: sa.disabled ?? false,
+    };
+};
+export const ServiceAccountProvider = () => Provider.effect(ServiceAccount, Effect.gen(function* () {
+    const getProjectsServiceAccounts = yield* iam.getProjectsServiceAccounts;
+    const createProjectsServiceAccounts = yield* iam.createProjectsServiceAccounts;
+    const patchProjectsServiceAccounts = yield* iam.patchProjectsServiceAccounts;
+    const deleteProjectsServiceAccounts = yield* iam.deleteProjectsServiceAccounts;
+    const listProjectsServiceAccounts = yield* iam.listProjectsServiceAccounts;
+    const getIamPolicyProjectsServiceAccounts = yield* iam.getIamPolicyProjectsServiceAccounts;
+    const setIamPolicyProjectsServiceAccounts = yield* iam.setIamPolicyProjectsServiceAccounts;
+    const resourceName = (projectId, accountId) => `projects/${projectId}/serviceAccounts/${accountId}`;
+    const observeServiceAccount = (projectId, accountId) => getProjectsServiceAccounts({
+        name: resourceName(projectId, accountId),
+    }).pipe(
+    // GSAs that don't exist OR that the caller can't see both
+    // collapse to "absent" — same 403→missing pattern as the
+    // project observer.
+    Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const requireServiceAccount = (projectId, accountId, context) => observeServiceAccount(projectId, accountId).pipe(Effect.flatMap((sa) => sa
+        ? Effect.succeed(sa)
+        : Effect.fail(new ConfigError({
+            message: `ServiceAccount ${accountId} in project ${projectId} ${context}.`,
+        }))));
+    // List-page scan for cold recovery. Alchemy marker in the
+    // description field identifies our GSAs; the page boundary is
+    // arbitrary — we still need to page through to find any marker
+    // that happens to fall past the first page.
+    const findByAlchemyMarker = Effect.fn(function* (id, projectId) {
+        let pageToken;
+        // Up to 100 pages × 100 items per page = 10000 GSAs; well past
+        // any realistic project size. If we ever exceed that we should
+        // cap and warn rather than silently miss matches.
+        for (let i = 0; i < 100; i++) {
+            const page = yield* listProjectsServiceAccounts({
+                name: `projects/${projectId}`,
+                ...(pageToken ? { pageToken } : {}),
+                pageSize: 100,
+            });
+            for (const sa of page.accounts ?? []) {
+                if (yield* descriptionHasAlchemyMarker(id, sa.description)) {
+                    return sa;
+                }
+            }
+            pageToken = page.nextPageToken;
+            if (!pageToken)
+                return undefined;
+        }
+        return undefined;
+    });
+    // Sync mutable fields: displayName + description. Both use
+    // `updateMask` so we only PATCH what actually changed. Diff
+    // against OBSERVED state, not `olds`, so adoption converges
+    // correctly when a foreign description is on the GSA.
+    const syncMutable = Effect.fn(function* (observed, desired) {
+        const updateMaskFields = [];
+        if (desired.displayName !== observed.displayName) {
+            updateMaskFields.push("display_name");
+        }
+        const descDiff = diffTags({ description: observed.description ?? "" }, { description: desired.descriptionWithMarker });
+        if (descDiff.removed.length > 0 ||
+            descDiff.upsert.length > 0) {
+            updateMaskFields.push("description");
+        }
+        if (updateMaskFields.length === 0)
+            return observed;
+        return yield* patchProjectsServiceAccounts({
+            name: observed.name,
+            body: {
+                updateMask: updateMaskFields.join(","),
+                serviceAccount: {
+                    displayName: desired.displayName,
+                    description: desired.descriptionWithMarker,
+                },
+            },
+        });
+    });
+    // Apply merged IAM bindings as a single setIamPolicy. Same
+    // foreign-binding preservation + etag-retry pattern as the
+    // Project's `syncIam` — see `src/CloudResourceManager/Project.ts:421-474`.
+    const syncIam = (args) => Effect.gen(function* () {
+        const desiredByRole = new Map();
+        for (const b of args.bindings) {
+            for (const ib of b.data.iamBindings) {
+                const set = desiredByRole.get(ib.role) ?? new Set();
+                for (const m of ib.members)
+                    set.add(m);
+                desiredByRole.set(ib.role, set);
+            }
+        }
+        if (desiredByRole.size === 0)
+            return;
+        const current = yield* getIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            "options.requestedPolicyVersion": 3,
+        });
+        const existingBindings = (current.bindings ?? []).map((b) => ({
+            ...b,
+            members: [...(b.members ?? [])],
+        }));
+        let mutated = false;
+        for (const [role, members] of desiredByRole) {
+            let existing = existingBindings.find((b) => b.role === role && !b.condition);
+            if (!existing) {
+                existing = { role, members: [] };
+                existingBindings.push(existing);
+            }
+            const merged = new Set([...(existing.members ?? []), ...members]);
+            if (merged.size !== (existing.members?.length ?? 0))
+                mutated = true;
+            existing.members = [...merged];
+        }
+        if (!mutated)
+            return;
+        yield* setIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            body: {
+                policy: { ...current, bindings: existingBindings, version: 3 },
+            },
+        });
+    }).pipe(Effect.retry({
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    return {
+        // Stable identity: accountId + project; both immutable; either
+        // change → replace. The server-assigned uniqueId is also stable
+        // for the lifetime of the GSA (re-create gets a different one).
+        stables: ["accountId", "projectId", "uniqueId", "name", "email"],
+        diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            if (news.accountId !== (output?.accountId ?? olds.accountId) ||
+                news.project !== (output?.projectId ?? olds.project)) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings }) {
+            const descriptionWithMarker = yield* gcpAlchemyDescription(id, news.description);
+            // 1. Observe — cloud state is authoritative. A second
+            //    scan-by-marker covers the cold-recovery case where
+            //    persisted `output`/`olds` lost the uniqueId after
+            //    state loss. We prefer the direct-by-name probe first
+            //    (cheap) and fall back to the scan only when direct
+            //    observation returned `undefined`.
+            let observed = yield* observeServiceAccount(news.project, news.accountId);
+            if (!observed) {
+                observed = yield* findByAlchemyMarker(id, news.project);
+            }
+            // 2. Ensure — create if missing. createProjectsServiceAccounts
+            //    is synchronous (returns the SA, not an LRO). Conflict
+            //    covers a peer reconciler race — re-observe.
+            if (!observed) {
+                observed = yield* createProjectsServiceAccounts({
+                    name: `projects/${news.project}`,
+                    body: {
+                        accountId: news.accountId,
+                        serviceAccount: {
+                            displayName: news.displayName,
+                            description: descriptionWithMarker,
+                        },
+                    },
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                if (!observed) {
+                    observed = yield* requireServiceAccount(news.project, news.accountId, "did not appear after create");
+                }
+            }
+            // 3. Sync mutable fields against OBSERVED state.
+            const synced = yield* syncMutable(observed, {
+                displayName: news.displayName ?? observed.displayName,
+                descriptionWithMarker,
+                descriptionUserOnly: news.description,
+            });
+            // 4. Sync IAM bindings (Workload Identity, impersonators, …).
+            //    Single setIamPolicy on the GSA with merged bindings;
+            //    foreign roles preserved. Etag-retried internally.
+            yield* syncIam({
+                resourceName: synced.name,
+                bindings,
+            });
+            return toAttributes(synced);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            // Synchronous delete — Empty response, no LRO. NotFound
+            // means the GSA was already deleted (or never existed in our
+            // scope); both are idempotent successes.
+            yield* deleteProjectsServiceAccounts({
+                name: output.name,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("Forbidden", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            // Direct-by-name probe when we have any handle on the
+            // accountId. Falls back to a project-wide scan-by-marker
+            // for cold recovery after state loss.
+            const accountId = output?.accountId ?? olds?.accountId;
+            const projectId = output?.projectId ?? olds?.project;
+            let observed;
+            if (accountId && projectId) {
+                observed = yield* observeServiceAccount(projectId, accountId);
+            }
+            if (!observed && projectId) {
+                observed = yield* findByAlchemyMarker(id, projectId);
+            }
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed);
+            // Adoption gate via description marker (see Tags.ts §description).
+            return (yield* descriptionHasAlchemyMarker(id, observed.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=ServiceAccount.js.map

package/lib/Iam/ServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccount.js","sourceRoot":"","sources":["../../src/Iam/ServiceAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AA+GpB,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,oBAAoB,CAAC,CAAC;AAE7E,MAAM,YAAY,GAAG,CAAC,EAAsB,EAAgC,EAAE;IAC5E,MAAM,SAAS,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE;QACnB,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;QAC3B,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;QAC7B,SAAS;QACT,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAAC;QAC/C,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,KAAK;KAC/B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,MAAM,CACb,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,0BAA0B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACzE,MAAM,6BAA6B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,4BAA4B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC7E,MAAM,6BAA6B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,2BAA2B,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3E,MAAM,mCAAmC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;IAC3F,MAAM,mCAAmC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;IAE3F,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,EAAE,CAC5D,YAAY,SAAS,oBAAoB,SAAS,EAAE,CAAC;IAEvD,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,EAAE,CACrE,0BAA0B,CAAC;QACzB,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC;KACzC,CAAC,CAAC,IAAI;IACL,0DAA0D;IAC1D,yDAAyD;IACzD,oBAAoB;IACpB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,CACF,CAAC;IAEJ,MAAM,qBAAqB,GAAG,CAC5B,SAAiB,EACjB,SAAiB,EACjB,OAAe,EACf,EAAE,CACF,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE;QACA,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,kBAAkB,SAAS,eAAe,SAAS,IAAI,OAAO,GAAG;SAC3E,CAAC,CACH,CACN,CACF,CAAC;IAEJ,0DAA0D;IAC1D,8DAA8D;IAC9D,+DAA+D;IAC/D,4CAA4C;IAC5C,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC7C,EAAU,EACV,SAAiB;QAEjB,IAAI,SAA6B,CAAC;QAClC,+DAA+D;QAC/D,+DAA+D;QAC/D,kDAAkD;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC;gBAC9C,IAAI,EAAE,YAAY,SAAS,EAAE;gBAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3D,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;YAC/B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,4DAA4D;IAC5D,4DAA4D;IAC5D,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACrC,QAA4B,EAC5B,OAIC;QAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjD,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CACvB,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAC3C,EAAE,WAAW,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAC/C,CAAC;QACF,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEnD,OAAO,KAAK,CAAC,CAAC,4BAA4B,CAAC;YACzC,IAAI,EAAE,QAAQ,CAAC,IAAK;YACpB,IAAI,EAAE;gBACJ,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtC,cAAc,EAAE;oBACd,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,qBAAqB;iBAC3C;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,2DAA2D;IAC3D,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,IAKhB,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mCAAmC,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,gCAAgC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC;YACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SAChC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,IAAI,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBACjC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,KAAK,CAAC,CAAC,mCAAmC,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAAE;aAC/D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;QACX,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,OAAO;QACL,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;QAChE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;gBACxD,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,EACpD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACxD,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,sDAAsD;YACtD,wDAAwD;YACxD,uDAAuD;YACvD,0DAA0D;YAC1D,wDAAwD;YACxD,uCAAuC;YACvC,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YAED,+DAA+D;YAC/D,2DAA2D;YAC3D,iDAAiD;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC;oBAC9C,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE;oBAChC,IAAI,EAAE;wBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE;4BACd,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,WAAW,EAAE,qBAAqB;yBACnC;qBACF;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA2C,CAAC,CAC5D,CACF,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,6BAA6B,CAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;gBACrD,qBAAqB;gBACrB,mBAAmB,EAAE,IAAI,CAAC,WAAW;aACtC,CAAC,CAAC;YAEH,8DAA8D;YAC9D,0DAA0D;YAC1D,uDAAuD;YACvD,KAAK,CAAC,CAAC,OAAO,CAAC;gBACb,YAAY,EAAE,MAAM,CAAC,IAAK;gBAC1B,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,wDAAwD;YACxD,6DAA6D;YAC7D,yCAAyC;YACzC,KAAK,CAAC,CAAC,6BAA6B,CAAC;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,sDAAsD;YACtD,yDAAyD;YACzD,sCAAsC;YACtC,MAAM,SAAS,GACb,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvC,MAAM,SAAS,GACb,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC;YAErC,IAAI,QAAwC,CAAC;YAC7C,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,mEAAmE;YACnE,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/ServiceAccountIamMember.d.ts

@@ -0,0 +1,49 @@
+import * as Effect from "effect/Effect";
+import type { ServiceAccount } from "./ServiceAccount.ts";
+/**
+ * Bind a single `(role, member)` IAM grant onto a {@link ServiceAccount}.
+ *
+ * This is a **target-side binding** — it records the grant onto the
+ * GSA's binding bag (`stack.bindings[gsa]`); the ServiceAccount
+ * provider's `reconcile` later merges all such bindings (across all
+ * callers, including parallel ones from different stack stages) into
+ * a single `setIamPolicy` call on the GSA. Same pattern as
+ * `projectIamMember` / `subnetworkIamMember`.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<gsa>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (gsa, role, member) triple — otherwise a
+ * later bind silently overwrites an earlier one with the same key.
+ *
+ * The reason `key` exists: `member` is usually an `Output<string>`
+ * (e.g. `Output.interpolate\`...${cluster.projectId}...\``), and
+ * `Output` expressions stringify by their AST shape, not by the
+ * eventual value. Two interpolations of the same shape but different
+ * literal templates render the same SID. `key` sidesteps that by
+ * forcing a static, caller-supplied label into the SID.
+ *
+ * Use this for the "Pulumi `gcp.serviceAccount.IAMMember`" pattern:
+ * authoritative-for-(role, member)-tuple, additive (does not displace
+ * other members on the same role).
+ *
+ * @example Workload Identity binding for one cluster
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ *
+ * @example Same GSA, second cluster (separate key → distinct SID)
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterB-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterB.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export declare const serviceAccountIamMember: (gsa: ServiceAccount, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+//# sourceMappingURL=ServiceAccountIamMember.d.ts.map

package/lib/Iam/ServiceAccountIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccountIamMember.d.ts","sourceRoot":"","sources":["../../src/Iam/ServiceAccountIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAMiB,CAAC"}

package/lib/Iam/ServiceAccountIamMember.js

@@ -0,0 +1,50 @@
+/**
+ * Bind a single `(role, member)` IAM grant onto a {@link ServiceAccount}.
+ *
+ * This is a **target-side binding** — it records the grant onto the
+ * GSA's binding bag (`stack.bindings[gsa]`); the ServiceAccount
+ * provider's `reconcile` later merges all such bindings (across all
+ * callers, including parallel ones from different stack stages) into
+ * a single `setIamPolicy` call on the GSA. Same pattern as
+ * `projectIamMember` / `subnetworkIamMember`.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<gsa>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (gsa, role, member) triple — otherwise a
+ * later bind silently overwrites an earlier one with the same key.
+ *
+ * The reason `key` exists: `member` is usually an `Output<string>`
+ * (e.g. `Output.interpolate\`...${cluster.projectId}...\``), and
+ * `Output` expressions stringify by their AST shape, not by the
+ * eventual value. Two interpolations of the same shape but different
+ * literal templates render the same SID. `key` sidesteps that by
+ * forcing a static, caller-supplied label into the SID.
+ *
+ * Use this for the "Pulumi `gcp.serviceAccount.IAMMember`" pattern:
+ * authoritative-for-(role, member)-tuple, additive (does not displace
+ * other members on the same role).
+ *
+ * @example Workload Identity binding for one cluster
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ *
+ * @example Same GSA, second cluster (separate key → distinct SID)
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterB-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterB.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export const serviceAccountIamMember = (gsa, key, args) => 
+// Tagged-template `.bind` records into the target's binding bag.
+// ServiceAccount's reconcile sees `bindings: ResourceBinding<…>[]`
+// and merges all entries by role into one setIamPolicy call.
+gsa.bind `IamMember(${gsa}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+//# sourceMappingURL=ServiceAccountIamMember.js.map

package/lib/Iam/ServiceAccountIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAccountIamMember.js","sourceRoot":"","sources":["../../src/Iam/ServiceAccountIamMember.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,GAAmB,EACnB,GAAW,EACX,IAAsC,EACjB,EAAE;AACvB,iEAAiE;AACjE,mEAAmE;AACnE,6DAA6D;AAC7D,GAAG,CAAC,IAAI,CAAA,aAAa,GAAG,KAAK,GAAG,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC"}

package/lib/Iam/index.d.ts

@@ -0,0 +1,4 @@
+export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.ts";
+export type { ServiceAccountProps } from "./ServiceAccount.ts";
+export * from "./ServiceAccountIamMember.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Iam/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC"}

package/lib/Iam/index.js

@@ -0,0 +1,3 @@
+export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.js";
+export * from "./ServiceAccountIamMember.js";
+//# sourceMappingURL=index.js.map

package/lib/Iam/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC"}

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA+CtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,8QA6DnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAmDtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,8QA+DnB,CAAC"}

package/lib/Providers.js

@@ -14,6 +14,7 @@ import { SharedVpcServiceProject, SharedVpcServiceProjectProvider, } from "./Com
 import { Subnetwork, SubnetworkProvider } from "./Compute/Subnetwork.js";
 import { Cluster, ClusterProvider } from "./Container/Cluster.js";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.js";
+import { ServiceAccount, ServiceAccountProvider, } from "./Iam/ServiceAccount.js";
 import { KubernetesManifest, KubernetesManifestProvider, } from "./Kubernetes/KubernetesManifest.js";
 import { KubernetesSecret, KubernetesSecretProvider, } from "./Kubernetes/Secret.js";
 import { ManagedLustreInstance, ManagedLustreInstanceProvider, } from "./ManagedLustre/Instance.js";
@@ -62,9 +63,10 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     SqlDatabase,
     SqlUser,
     ArtifactRegistryRepository,
+    ServiceAccount,
     KubernetesSecret,
     KubernetesManifest,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), KubernetesSecretProvider(), KubernetesManifestProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ServiceAccountProvider(), KubernetesSecretProvider(), KubernetesManifestProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,CAC7B,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,sBAAsB,EAAE,EACxB,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,CAC7B,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/index.d.ts

@@ -5,6 +5,7 @@ export * from "./ArtifactRegistry/index.ts";
 export * from "./CloudResourceManager/index.ts";
 export * from "./Compute/index.ts";
 export * from "./Container/index.ts";
+export * from "./Iam/index.ts";
 export * from "./Kubernetes/index.ts";
 export * from "./ManagedLustre/index.ts";
 export * from "./Run/index.ts";

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/lib/index.js

@@ -4,6 +4,7 @@ export * from "./ArtifactRegistry/index.js";
 export * from "./CloudResourceManager/index.js";
 export * from "./Compute/index.js";
 export * from "./Container/index.js";
+export * from "./Iam/index.js";
 export * from "./Kubernetes/index.js";
 export * from "./ManagedLustre/index.js";
 export * from "./Run/index.js";

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.7.0",
-  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), with ADC-backed credentials and target-side IAM bindings.",
+  "version": "0.8.0",
+  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
     "alchemy-effect",

package/src/Iam/ServiceAccount.ts

@@ -0,0 +1,431 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import {
+  descriptionHasAlchemyMarker,
+  gcpAlchemyDescription,
+  stripAlchemyMarker,
+} from "../Tags.ts";
+import type * as GCP from "../Providers.ts";
+
+/**
+ * A GCP service account (GSA). Lives under a {@link import("../CloudResourceManager/Project.ts").Project}
+ * and serves as the federated identity target for Workload Identity
+ * (`iam.gke.io/gcp-service-account: <email>` on a k8s SA) and as the
+ * principal in any IAM grant that should out-live a human user.
+ *
+ * Adoption is gated on an alchemy marker embedded in the GSA's
+ * `description` field (see `gcpAlchemyDescription` /
+ * `descriptionHasAlchemyMarker`) — GSAs have no labels field, so the
+ * label-based adoption gate used by Project can't apply. The marker is
+ * only written on insert; `description` is mutable but we never *clear*
+ * it because doing so would orphan the adoption signal.
+ *
+ * All lifecycle operations (`createProjectsServiceAccounts`,
+ * `patchProjectsServiceAccounts`, `deleteProjectsServiceAccounts`) are
+ * synchronous — no LRO polling required.
+ *
+ * @section Creating a ServiceAccount
+ * @example Minimal GSA under a project
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push (BuildKit client)",
+ * });
+ * ```
+ *
+ * @example With explicit description and Workload Identity binding
+ * ```typescript
+ * const gsa = yield* GCP.ServiceAccount("Builder", {
+ *   project: project.projectId,
+ *   accountId: "research-builder",
+ *   displayName: "Research pod build + push",
+ *   description: "Used by per-researcher BuildKit clients to push to AR.",
+ * });
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${projectA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export type ServiceAccountProps = {
+  /**
+   * GCP project id (e.g. `micro-research-shared`) the GSA lives under.
+   * Immutable — changing this orphans the GSA's unique id and any
+   * bindings, so `diff` triggers a replacement.
+   */
+  project: string;
+  /**
+   * The account id segment of the service account's email. Must match
+   * `[a-z]([-a-z0-9]*[a-z0-9])`, 6-30 chars. Immutable — replaces.
+   */
+  accountId: string;
+  /**
+   * User-visible display name. Max 100 UTF-8 bytes. Mutable.
+   */
+  displayName?: string;
+  /**
+   * User-supplied description (max 256 UTF-8 bytes). The alchemy
+   * ownership marker is prepended automatically — see
+   * `gcpAlchemyDescription`. The user-supplied portion is preserved
+   * verbatim and surfaced back through `Attributes.description`.
+   */
+  description?: string;
+};
+
+/**
+ * Single (role, members) entry on a GSA's IAM policy. Targets declare
+ * this contract so capabilities (e.g. Workload Identity) can `.bind`
+ * IAM grants onto the GSA — the provider's `reconcile` merges all
+ * bound entries by role into a single `setIamPolicy` call.
+ */
+export type ServiceAccountIamBinding = {
+  /** IAM role, e.g. `"roles/iam.workloadIdentityUser"`. */
+  role: string;
+  /** Principals, e.g. `["serviceAccount:foo.svc.id.goog[ns/ksa]"]`. */
+  members: ReadonlyArray<string>;
+};
+
+export type ServiceAccountBindingContract = {
+  iamBindings: ReadonlyArray<ServiceAccountIamBinding>;
+};
+
+export type ServiceAccount = Resource<
+  "GCP.ServiceAccount",
+  ServiceAccountProps,
+  {
+    /** Full resource name, e.g. `projects/micro-research-shared/serviceAccounts/research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    name: string;
+    /** Email address derived from the account id, e.g. `research-builder@micro-research-shared.iam.gserviceaccount.com`. */
+    email: string;
+    /** Server-assigned stable numeric id. */
+    uniqueId: string;
+    /** Project the GSA lives under. */
+    projectId: string;
+    /** Account id (the part before `@`). */
+    accountId: string;
+    /** User-visible display name, or `undefined` if never set. */
+    displayName: string | undefined;
+    /** User-visible description (without the alchemy marker), or `undefined` if never set. */
+    description: string | undefined;
+    /** Whether the GSA is currently disabled. */
+    disabled: boolean;
+  },
+  ServiceAccountBindingContract,
+  GCP.Providers
+>;
+
+export const ServiceAccount = Resource<ServiceAccount>("GCP.ServiceAccount");
+
+const toAttributes = (sa: iam.ServiceAccount): ServiceAccount["Attributes"] => {
+  const accountId = (sa.email ?? "").split("@")[0];
+  return {
+    name: sa.name ?? "",
+    email: sa.email ?? "",
+    uniqueId: sa.uniqueId ?? "",
+    projectId: sa.projectId ?? "",
+    accountId,
+    displayName: sa.displayName,
+    description: stripAlchemyMarker(sa.description),
+    disabled: sa.disabled ?? false,
+  };
+};
+
+export const ServiceAccountProvider = () =>
+  Provider.effect(
+    ServiceAccount,
+    Effect.gen(function* () {
+      const getProjectsServiceAccounts = yield* iam.getProjectsServiceAccounts;
+      const createProjectsServiceAccounts = yield* iam.createProjectsServiceAccounts;
+      const patchProjectsServiceAccounts = yield* iam.patchProjectsServiceAccounts;
+      const deleteProjectsServiceAccounts = yield* iam.deleteProjectsServiceAccounts;
+      const listProjectsServiceAccounts = yield* iam.listProjectsServiceAccounts;
+      const getIamPolicyProjectsServiceAccounts = yield* iam.getIamPolicyProjectsServiceAccounts;
+      const setIamPolicyProjectsServiceAccounts = yield* iam.setIamPolicyProjectsServiceAccounts;
+
+      const resourceName = (projectId: string, accountId: string) =>
+        `projects/${projectId}/serviceAccounts/${accountId}`;
+
+      const observeServiceAccount = (projectId: string, accountId: string) =>
+        getProjectsServiceAccounts({
+          name: resourceName(projectId, accountId),
+        }).pipe(
+          // GSAs that don't exist OR that the caller can't see both
+          // collapse to "absent" — same 403→missing pattern as the
+          // project observer.
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as iam.ServiceAccount | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as iam.ServiceAccount | undefined),
+          ),
+        );
+
+      const requireServiceAccount = (
+        projectId: string,
+        accountId: string,
+        context: string,
+      ) =>
+        observeServiceAccount(projectId, accountId).pipe(
+          Effect.flatMap((sa) =>
+            sa
+              ? Effect.succeed(sa)
+              : Effect.fail(
+                  new ConfigError({
+                    message: `ServiceAccount ${accountId} in project ${projectId} ${context}.`,
+                  }),
+                ),
+          ),
+        );
+
+      // List-page scan for cold recovery. Alchemy marker in the
+      // description field identifies our GSAs; the page boundary is
+      // arbitrary — we still need to page through to find any marker
+      // that happens to fall past the first page.
+      const findByAlchemyMarker = Effect.fn(function* (
+        id: string,
+        projectId: string,
+      ) {
+        let pageToken: string | undefined;
+        // Up to 100 pages × 100 items per page = 10000 GSAs; well past
+        // any realistic project size. If we ever exceed that we should
+        // cap and warn rather than silently miss matches.
+        for (let i = 0; i < 100; i++) {
+          const page = yield* listProjectsServiceAccounts({
+            name: `projects/${projectId}`,
+            ...(pageToken ? { pageToken } : {}),
+            pageSize: 100,
+          });
+          for (const sa of page.accounts ?? []) {
+            if (yield* descriptionHasAlchemyMarker(id, sa.description)) {
+              return sa;
+            }
+          }
+          pageToken = page.nextPageToken;
+          if (!pageToken) return undefined;
+        }
+        return undefined;
+      });
+
+      // Sync mutable fields: displayName + description. Both use
+      // `updateMask` so we only PATCH what actually changed. Diff
+      // against OBSERVED state, not `olds`, so adoption converges
+      // correctly when a foreign description is on the GSA.
+      const syncMutable = Effect.fn(function* (
+        observed: iam.ServiceAccount,
+        desired: {
+          displayName: string | undefined;
+          descriptionWithMarker: string;
+          descriptionUserOnly: string | undefined;
+        },
+      ) {
+        const updateMaskFields: string[] = [];
+        if (desired.displayName !== observed.displayName) {
+          updateMaskFields.push("display_name");
+        }
+        const descDiff = diffTags(
+          { description: observed.description ?? "" },
+          { description: desired.descriptionWithMarker },
+        );
+        if (
+          descDiff.removed.length > 0 ||
+          descDiff.upsert.length > 0
+        ) {
+          updateMaskFields.push("description");
+        }
+
+        if (updateMaskFields.length === 0) return observed;
+
+        return yield* patchProjectsServiceAccounts({
+          name: observed.name!,
+          body: {
+            updateMask: updateMaskFields.join(","),
+            serviceAccount: {
+              displayName: desired.displayName,
+              description: desired.descriptionWithMarker,
+            },
+          },
+        });
+      });
+
+      // Apply merged IAM bindings as a single setIamPolicy. Same
+      // foreign-binding preservation + etag-retry pattern as the
+      // Project's `syncIam` — see `src/CloudResourceManager/Project.ts:421-474`.
+      const syncIam = (args: {
+        resourceName: string;
+        bindings: ReadonlyArray<
+          import("alchemy/Resource").ResourceBinding<ServiceAccountBindingContract>
+        >;
+      }) =>
+        Effect.gen(function* () {
+          const desiredByRole = new Map<string, Set<string>>();
+          for (const b of args.bindings) {
+            for (const ib of b.data.iamBindings) {
+              const set = desiredByRole.get(ib.role) ?? new Set<string>();
+              for (const m of ib.members) set.add(m);
+              desiredByRole.set(ib.role, set);
+            }
+          }
+          if (desiredByRole.size === 0) return;
+
+          const current = yield* getIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            "options.requestedPolicyVersion": 3,
+          });
+
+          const existingBindings = (current.bindings ?? []).map((b) => ({
+            ...b,
+            members: [...(b.members ?? [])],
+          }));
+          let mutated = false;
+          for (const [role, members] of desiredByRole) {
+            let existing = existingBindings.find(
+              (b) => b.role === role && !b.condition,
+            );
+            if (!existing) {
+              existing = { role, members: [] };
+              existingBindings.push(existing);
+            }
+            const merged = new Set([...(existing.members ?? []), ...members]);
+            if (merged.size !== (existing.members?.length ?? 0)) mutated = true;
+            existing.members = [...merged];
+          }
+          if (!mutated) return;
+
+          yield* setIamPolicyProjectsServiceAccounts({
+            resource: args.resourceName,
+            body: {
+              policy: { ...current, bindings: existingBindings, version: 3 },
+            },
+          });
+        }).pipe(
+          Effect.retry({
+            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+
+      return {
+        // Stable identity: accountId + project; both immutable; either
+        // change → replace. The server-assigned uniqueId is also stable
+        // for the lifetime of the GSA (re-create gets a different one).
+        stables: ["accountId", "projectId", "uniqueId", "name", "email"],
+        diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            news.accountId !== (output?.accountId ?? olds.accountId) ||
+            news.project !== (output?.projectId ?? olds.project)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings }) {
+          const descriptionWithMarker = yield* gcpAlchemyDescription(
+            id,
+            news.description,
+          );
+
+          // 1. Observe — cloud state is authoritative. A second
+          //    scan-by-marker covers the cold-recovery case where
+          //    persisted `output`/`olds` lost the uniqueId after
+          //    state loss. We prefer the direct-by-name probe first
+          //    (cheap) and fall back to the scan only when direct
+          //    observation returned `undefined`.
+          let observed = yield* observeServiceAccount(news.project, news.accountId);
+          if (!observed) {
+            observed = yield* findByAlchemyMarker(id, news.project);
+          }
+
+          // 2. Ensure — create if missing. createProjectsServiceAccounts
+          //    is synchronous (returns the SA, not an LRO). Conflict
+          //    covers a peer reconciler race — re-observe.
+          if (!observed) {
+            observed = yield* createProjectsServiceAccounts({
+              name: `projects/${news.project}`,
+              body: {
+                accountId: news.accountId,
+                serviceAccount: {
+                  displayName: news.displayName,
+                  description: descriptionWithMarker,
+                },
+              },
+            }).pipe(
+              Effect.catchTag("Conflict", () =>
+                Effect.succeed(undefined as iam.ServiceAccount | undefined),
+              ),
+            );
+
+            if (!observed) {
+              observed = yield* requireServiceAccount(
+                news.project,
+                news.accountId,
+                "did not appear after create",
+              );
+            }
+          }
+
+          // 3. Sync mutable fields against OBSERVED state.
+          const synced = yield* syncMutable(observed, {
+            displayName: news.displayName ?? observed.displayName,
+            descriptionWithMarker,
+            descriptionUserOnly: news.description,
+          });
+
+          // 4. Sync IAM bindings (Workload Identity, impersonators, …).
+          //    Single setIamPolicy on the GSA with merged bindings;
+          //    foreign roles preserved. Etag-retried internally.
+          yield* syncIam({
+            resourceName: synced.name!,
+            bindings,
+          });
+
+          return toAttributes(synced);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          // Synchronous delete — Empty response, no LRO. NotFound
+          // means the GSA was already deleted (or never existed in our
+          // scope); both are idempotent successes.
+          yield* deleteProjectsServiceAccounts({
+            name: output.name,
+          }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+            Effect.catchTag("Forbidden", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          // Direct-by-name probe when we have any handle on the
+          // accountId. Falls back to a project-wide scan-by-marker
+          // for cold recovery after state loss.
+          const accountId =
+            output?.accountId ?? olds?.accountId;
+          const projectId =
+            output?.projectId ?? olds?.project;
+
+          let observed: iam.ServiceAccount | undefined;
+          if (accountId && projectId) {
+            observed = yield* observeServiceAccount(projectId, accountId);
+          }
+          if (!observed && projectId) {
+            observed = yield* findByAlchemyMarker(id, projectId);
+          }
+          if (!observed) return undefined;
+
+          const attrs = toAttributes(observed);
+          // Adoption gate via description marker (see Tags.ts §description).
+          return (yield* descriptionHasAlchemyMarker(id, observed.description))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );

package/src/Iam/ServiceAccountIamMember.ts

@@ -0,0 +1,56 @@
+import * as Effect from "effect/Effect";
+import type { ServiceAccount } from "./ServiceAccount.ts";
+
+/**
+ * Bind a single `(role, member)` IAM grant onto a {@link ServiceAccount}.
+ *
+ * This is a **target-side binding** — it records the grant onto the
+ * GSA's binding bag (`stack.bindings[gsa]`); the ServiceAccount
+ * provider's `reconcile` later merges all such bindings (across all
+ * callers, including parallel ones from different stack stages) into
+ * a single `setIamPolicy` call on the GSA. Same pattern as
+ * `projectIamMember` / `subnetworkIamMember`.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<gsa>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (gsa, role, member) triple — otherwise a
+ * later bind silently overwrites an earlier one with the same key.
+ *
+ * The reason `key` exists: `member` is usually an `Output<string>`
+ * (e.g. `Output.interpolate\`...${cluster.projectId}...\``), and
+ * `Output` expressions stringify by their AST shape, not by the
+ * eventual value. Two interpolations of the same shape but different
+ * literal templates render the same SID. `key` sidesteps that by
+ * forcing a static, caller-supplied label into the SID.
+ *
+ * Use this for the "Pulumi `gcp.serviceAccount.IAMMember`" pattern:
+ * authoritative-for-(role, member)-tuple, additive (does not displace
+ * other members on the same role).
+ *
+ * @example Workload Identity binding for one cluster
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterA-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterA.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ *
+ * @example Same GSA, second cluster (separate key → distinct SID)
+ * ```typescript
+ * yield* GCP.serviceAccountIamMember(gsa, "ClusterB-WorkloadIdentity", {
+ *   role: "roles/iam.workloadIdentityUser",
+ *   member: `serviceAccount:${clusterB.projectId}.svc.id.goog[researchers/build]`,
+ * });
+ * ```
+ */
+export const serviceAccountIamMember = (
+  gsa: ServiceAccount,
+  key: string,
+  args: { role: string; member: string },
+): Effect.Effect<void> =>
+  // Tagged-template `.bind` records into the target's binding bag.
+  // ServiceAccount's reconcile sees `bindings: ResourceBinding<…>[]`
+  // and merges all entries by role into one setIamPolicy call.
+  gsa.bind`IamMember(${gsa}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+  }) as unknown as Effect.Effect<void>;

package/src/Iam/index.ts

@@ -0,0 +1,3 @@
+export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.ts";
+export type { ServiceAccountProps } from "./ServiceAccount.ts";
+export * from "./ServiceAccountIamMember.ts";

package/src/Providers.ts

@@ -23,6 +23,10 @@ import {
 import { Subnetwork, SubnetworkProvider } from "./Compute/Subnetwork.ts";
 import { Cluster, ClusterProvider } from "./Container/Cluster.ts";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.ts";
+import {
+  ServiceAccount,
+  ServiceAccountProvider,
+} from "./Iam/ServiceAccount.ts";
 import {
   KubernetesManifest,
   KubernetesManifestProvider,
@@ -89,6 +93,7 @@ export const providers = () =>
       SqlDatabase,
       SqlUser,
       ArtifactRegistryRepository,
+      ServiceAccount,
       KubernetesSecret,
       KubernetesManifest,
     ]),
@@ -115,6 +120,7 @@ export const providers = () =>
         SqlDatabaseProvider(),
         SqlUserProvider(),
         ArtifactRegistryRepositoryProvider(),
+        ServiceAccountProvider(),
         KubernetesSecretProvider(),
         KubernetesManifestProvider(),
       ),

package/src/index.ts

@@ -11,6 +11,7 @@ export * from "./ArtifactRegistry/index.ts";
 export * from "./CloudResourceManager/index.ts";
 export * from "./Compute/index.ts";
 export * from "./Container/index.ts";
+export * from "./Iam/index.ts";
 export * from "./Kubernetes/index.ts";
 export * from "./ManagedLustre/index.ts";
 export * from "./Run/index.ts";