@microagi/alchemy-gcp 0.8.0 → 0.9.0

package/lib/Storage/Bucket.d.ts

@@ -0,0 +1,117 @@
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A GCS bucket. Lives under a
+ * {@link import("../CloudResourceManager/Project.ts").Project} and serves
+ * as the target for {@link storageBucketIamMember} bindings (bucket-level
+ * IAM grants merged into a single `setIamPolicy` call).
+ *
+ * Adoption is gated on alchemy internal labels (`alchemy_app` /
+ * `alchemy_stage` / `alchemy_id`) — GCS buckets support labels, so the
+ * same label-based adoption gate as `Project` applies. The labels are
+ * merged into the user-supplied label set on create and never cleared.
+ *
+ * All lifecycle operations (`insertBuckets`, `getBuckets`, `patchBuckets`,
+ * `deleteBuckets`) are synchronous — no LRO polling required.
+ *
+ * @section Creating a StorageBucket
+ * @example Bucket with a 48-hour object TTL
+ * ```typescript
+ * const bucket = yield* GCP.StorageBucket("TempBucket", {
+ *   project: project.projectId,
+ *   name: "microagi-shared-temp",
+ *   location: "europe-west4",
+ *   storageClass: "STANDARD",
+ *   lifecycle: {
+ *     rule: [{
+ *       action: { type: "Delete" },
+ *       condition: { age: 2 },  // 2 days = 48 hours
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export type StorageBucketProps = {
+    /**
+     * GCP project id (e.g. `micro-research-shared`) the bucket lives
+     * under. Immutable — changing this orphans the bucket and its IAM
+     * bindings, so `diff` triggers a replacement.
+     */
+    project: string;
+    /**
+     * The bucket name. Must be globally unique, 3-222 chars, lowercase
+     * letters, digits, hyphens, underscores, and dots. Immutable —
+     * replaces.
+     */
+    name: string;
+    /**
+     * Bucket location, e.g. `europe-west4` (single region) or `EU`
+     * (multi-region). Immutable — replaces.
+     */
+    location: string;
+    /**
+     * Storage class, e.g. `STANDARD`, `NEARLINE`, `COLDLINE`,
+     * `ARCHIVE`. Defaults to `STANDARD` server-side. Mutable.
+     */
+    storageClass?: string;
+    /**
+     * Bucket lifecycle configuration. Used for object TTL (e.g.
+     * `{ rule: [{ action: { type: "Delete" }, condition: { age: 2 } }] }`
+     * deletes objects older than 2 days). Mutable.
+     */
+    lifecycle?: storage.Bucket["lifecycle"];
+    /**
+     * User-supplied labels. The alchemy internal labels are merged
+     * automatically (see `gcpInternalLabels`). Alchemy keys are reserved
+     * and overwrite user-supplied collisions.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Whether uniform bucket-level access is enabled. Defaults to
+     * `true` (recommended — ACLs are disabled, IAM is the sole authz
+     * path). Mutable.
+     */
+    uniformBucketLevelAccess?: boolean;
+};
+/**
+ * Single (role, members) entry on a bucket's IAM policy. Targets
+ * declare this contract so {@link storageBucketIamMember} can `.bind`
+ * IAM grants onto the bucket — the provider's `reconcile` merges all
+ * bound entries by role into a single `setIamPolicy` call.
+ */
+export type StorageBucketIamBinding = {
+    /** IAM role, e.g. `"roles/storage.objectUser"`. */
+    role: string;
+    /** Principals, e.g. `["serviceAccount:sa@project.iam.gserviceaccount.com"]`. */
+    members: ReadonlyArray<string>;
+};
+export type StorageBucketBindingContract = {
+    iamBindings: ReadonlyArray<StorageBucketIamBinding>;
+};
+export type StorageBucket = Resource<"GCP.StorageBucket", StorageBucketProps, {
+    /** Bucket name (same as the prop). */
+    name: string;
+    /** Bucket ID (server-assigned, same as name for buckets). */
+    id: string;
+    /** Self-link URL. */
+    selfLink: string;
+    /** Bucket location. */
+    location: string;
+    /** Storage class. */
+    storageClass: string | undefined;
+    /** Lifecycle configuration. */
+    lifecycle: storage.Bucket["lifecycle"];
+    /** Labels (including alchemy internal labels). */
+    labels: Record<string, string> | undefined;
+    /** Metageneration (changes on metadata updates). */
+    metageneration: string;
+    /** Creation time (RFC 3339). */
+    timeCreated: string;
+    /** Last update time (RFC 3339). */
+    updated: string;
+}, StorageBucketBindingContract, GCP.Providers>;
+export declare const StorageBucket: import("alchemy").ResourceClass<StorageBucket>;
+export declare const StorageBucketProvider: () => import("effect/Layer").Layer<Provider.Provider<StorageBucket>, never, import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Bucket.d.ts.map

package/lib/Storage/Bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bucket.d.ts","sourceRoot":"","sources":["../../src/Storage/Bucket.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAS7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,CAClC,mBAAmB,EACnB,kBAAkB,EAClB;IACE,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,+BAA+B;IAC/B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC3C,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB,EACD,4BAA4B,EAC5B,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,aAAa,gDAA+C,CAAC;AAe1E,eAAO,MAAM,qBAAqB,oOA+R/B,CAAC"}

package/lib/Storage/Bucket.js

@@ -0,0 +1,239 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels, } from "../Tags.js";
+export const StorageBucket = Resource("GCP.StorageBucket");
+const toAttributes = (b) => ({
+    name: b.name ?? "",
+    id: b.id ?? b.name ?? "",
+    selfLink: b.selfLink ?? "",
+    location: b.location ?? "",
+    storageClass: b.storageClass,
+    lifecycle: b.lifecycle,
+    labels: b.labels,
+    metageneration: b.metageneration ?? "",
+    timeCreated: b.timeCreated ?? "",
+    updated: b.updated ?? "",
+});
+export const StorageBucketProvider = () => Provider.effect(StorageBucket, Effect.gen(function* () {
+    const getBuckets = yield* storage.getBuckets;
+    const insertBuckets = yield* storage.insertBuckets;
+    const patchBuckets = yield* storage.patchBuckets;
+    const deleteBuckets = yield* storage.deleteBuckets;
+    const listBuckets = yield* storage.listBuckets;
+    const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+    const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+    const observeBucket = (name) => getBuckets({ bucket: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const requireBucket = (name, context) => observeBucket(name).pipe(Effect.flatMap((b) => b
+        ? Effect.succeed(b)
+        : Effect.fail(new ConfigError({
+            message: `Bucket ${name} ${context}.`,
+        }))));
+    // List-scan for cold recovery. Alchemy labels on the bucket
+    // identify our resources; the prefix narrows the scan.
+    const findByAlchemyLabels = Effect.fn(function* (id, project, name) {
+        let pageToken;
+        for (let i = 0; i < 100; i++) {
+            const page = yield* listBuckets({
+                project,
+                prefix: name.slice(0, Math.min(name.length, 10)),
+                maxResults: 100,
+                ...(pageToken ? { pageToken } : {}),
+            });
+            for (const b of page.items ?? []) {
+                if (b.name === name && (yield* hasAlchemyLabels(id, b.labels))) {
+                    return b;
+                }
+            }
+            pageToken = page.nextPageToken;
+            if (!pageToken)
+                return undefined;
+        }
+        return undefined;
+    });
+    // Sync mutable fields: storageClass, lifecycle, labels,
+    // uniformBucketLevelAccess. Uses PATCH with the full bucket body
+    // (GCS patch semantics merge supplied fields). Diff against
+    // OBSERVED state, not `olds`, so adoption converges correctly.
+    const syncMutable = Effect.fn(function* (observed, desired) {
+        const needsUpdate = desired.storageClass !== observed.storageClass ||
+            JSON.stringify(desired.lifecycle) !==
+                JSON.stringify(observed.lifecycle) ||
+            JSON.stringify(desired.labels) !==
+                JSON.stringify(observed.labels ?? {}) ||
+            desired.uniformBucketLevelAccess !==
+                (observed.iamConfiguration?.uniformBucketLevelAccess?.enabled ?? false);
+        if (!needsUpdate)
+            return observed;
+        return yield* patchBuckets({
+            bucket: observed.name,
+            body: {
+                storageClass: desired.storageClass,
+                lifecycle: desired.lifecycle,
+                labels: desired.labels,
+                iamConfiguration: {
+                    uniformBucketLevelAccess: {
+                        enabled: desired.uniformBucketLevelAccess,
+                    },
+                },
+            },
+        });
+    });
+    // Apply merged IAM bindings as a single setIamPolicy. Same
+    // foreign-binding preservation + etag-retry pattern as
+    // ServiceAccount's `syncIam`.
+    const syncIam = (args) => Effect.gen(function* () {
+        const desiredByRole = new Map();
+        for (const b of args.bindings) {
+            for (const ib of b.data.iamBindings) {
+                const set = desiredByRole.get(ib.role) ?? new Set();
+                for (const m of ib.members)
+                    set.add(m);
+                desiredByRole.set(ib.role, set);
+            }
+        }
+        if (desiredByRole.size === 0)
+            return;
+        const current = yield* getIamPolicyBuckets({
+            bucket: args.bucketName,
+            optionsRequestedPolicyVersion: 3,
+        });
+        const existingBindings = (current.bindings ?? []).map((b) => ({
+            ...b,
+            members: [...(b.members ?? [])],
+        }));
+        let mutated = false;
+        for (const [role, members] of desiredByRole) {
+            let existing = existingBindings.find((b) => b.role === role && !b.condition);
+            if (!existing) {
+                existing = { role, members: [] };
+                existingBindings.push(existing);
+            }
+            const merged = new Set([...(existing.members ?? []), ...members]);
+            if (merged.size !== (existing.members?.length ?? 0))
+                mutated = true;
+            existing.members = [...merged];
+        }
+        if (!mutated)
+            return;
+        yield* setIamPolicyBuckets({
+            bucket: args.bucketName,
+            body: {
+                ...current,
+                bindings: existingBindings,
+                version: 3,
+            },
+        });
+    }).pipe(Effect.retry({
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    return {
+        stables: ["name", "id", "selfLink", "location", "timeCreated"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const priorName = output?.name || olds.name;
+            const priorProject = olds.project;
+            const priorLocation = olds.location;
+            if ((priorName && news.name !== priorName) ||
+                (priorProject && news.project !== priorProject) ||
+                (priorLocation && news.location !== priorLocation)) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings, output }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const mergedLabels = { ...(news.labels ?? {}), ...internalLabels };
+            let created = false;
+            // 1. Observe — cloud state is authoritative. Fall back to
+            //    label-scan for cold recovery.
+            let observed = yield* observeBucket(news.name);
+            if (!observed) {
+                observed = yield* findByAlchemyLabels(id, news.project, news.name);
+            }
+            // 2. Ensure — create if missing. insertBuckets is
+            //    synchronous (returns the bucket, not an LRO). Conflict
+            //    covers a peer reconciler race — re-observe.
+            if (!observed) {
+                observed = yield* insertBuckets({
+                    project: news.project,
+                    body: {
+                        name: news.name,
+                        location: news.location,
+                        storageClass: news.storageClass,
+                        lifecycle: news.lifecycle,
+                        labels: mergedLabels,
+                        iamConfiguration: {
+                            uniformBucketLevelAccess: {
+                                enabled: news.uniformBucketLevelAccess ?? true,
+                            },
+                        },
+                    },
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                created = !!observed;
+                if (!observed) {
+                    observed = yield* requireBucket(news.name, "did not appear after create");
+                }
+            }
+            // Refuse to mutate an existing unowned bucket on greenfield
+            // create. The `read` handler returns Unowned(attrs) for
+            // buckets without our labels, which gates adoption behind
+            // --adopt. But reconcile runs before read on a first deploy,
+            // so without this guard we'd sync mutable fields (labels,
+            // lifecycle, UBLA) on a foreign bucket — bypassing the
+            // adoption gate. Skip the check when we just created the
+            // bucket (it has our labels) or when the engine already
+            // adopted it (output is defined).
+            if (!created &&
+                !output &&
+                !(yield* hasAlchemyLabels(id, observed.labels))) {
+                return yield* Effect.fail(new ConfigError({
+                    message: `Bucket ${news.name} already exists without matching alchemy labels; use --adopt to take it over.`,
+                }));
+            }
+            // 3. Sync mutable fields against OBSERVED state.
+            const synced = yield* syncMutable(observed, {
+                storageClass: news.storageClass ?? observed.storageClass,
+                lifecycle: news.lifecycle ?? observed.lifecycle,
+                labels: mergedLabels,
+                uniformBucketLevelAccess: news.uniformBucketLevelAccess ?? true,
+            });
+            // 4. Sync IAM bindings (storage.objectUser, etc.).
+            yield* syncIam({
+                bucketName: synced.name,
+                bindings,
+            });
+            return toAttributes(synced);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* deleteBuckets({
+                bucket: output.name,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("Forbidden", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const name = output?.name ?? olds?.name;
+            const project = olds?.project;
+            let observed;
+            if (name) {
+                observed = yield* observeBucket(name);
+            }
+            if (!observed && project) {
+                observed = yield* findByAlchemyLabels(id, project, name ?? "");
+            }
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed);
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Bucket.js.map

package/lib/Storage/Bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bucket.js","sourceRoot":"","sources":["../../src/Storage/Bucket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AA2HpB,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAgB,mBAAmB,CAAC,CAAC;AAE1E,MAAM,YAAY,GAAG,CAAC,CAAiB,EAA+B,EAAE,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,MAAM,EAAE,CAAC,CAAC,MAA4C;IACtD,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CACxC,QAAQ,CAAC,MAAM,CACb,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACnD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC/C,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAE/D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;IAEJ,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CACtD,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,CAAC;QACC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,UAAU,IAAI,IAAI,OAAO,GAAG;SACtC,CAAC,CACH,CACN,CACF,CAAC;IAEJ,4DAA4D;IAC5D,uDAAuD;IACvD,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC7C,EAAU,EACV,OAAe,EACf,IAAY;QAEZ,IAAI,SAA6B,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAC9B,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChD,UAAU,EAAE,GAAG;gBACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,MAA4C,CAAC,CAAC,EAAE,CAAC;oBACrG,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;YAC/B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,iEAAiE;IACjE,4DAA4D;IAC5D,+DAA+D;IAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACrC,QAAwB,EACxB,OAKC;QAED,MAAM,WAAW,GACf,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;YAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,wBAAwB;gBAC9B,CAAC,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAElC,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;YACzB,MAAM,EAAE,QAAQ,CAAC,IAAK;YACtB,IAAI,EAAE;gBACJ,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gBAAgB,EAAE;oBAChB,wBAAwB,EAAE;wBACxB,OAAO,EAAE,OAAO,CAAC,wBAAwB;qBAC1C;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,uDAAuD;IACvD,8BAA8B;IAC9B,MAAM,OAAO,GAAG,CAAC,IAKhB,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;YACzC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,6BAA6B,EAAE,CAAC;SACjC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC;YACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SAChC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,IAAI,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBACjC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,KAAK,CAAC,CAAC,mBAAmB,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,IAAI,EAAE;gBACJ,GAAG,OAAO;gBACV,QAAQ,EAAE,gBAAgB;gBAC1B,OAAO,EAAE,CAAC;aACX;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;QACX,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC;QAC9D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;YACpC,IACE,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;gBACtC,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC;gBAC/C,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,CAAC,EAClD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC5D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;YACnE,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,0DAA0D;YAC1D,mCAAmC;YACnC,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC;YAED,kDAAkD;YAClD,4DAA4D;YAC5D,iDAAiD;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;oBAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,MAAM,EAAE,YAAY;wBACpB,gBAAgB,EAAE;4BAChB,wBAAwB,EAAE;gCACxB,OAAO,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;6BAC/C;yBACF;qBACF;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;gBACF,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAErB,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,wDAAwD;YACxD,0DAA0D;YAC1D,6DAA6D;YAC7D,0DAA0D;YAC1D,uDAAuD;YACvD,yDAAyD;YACzD,wDAAwD;YACxD,kCAAkC;YAClC,IACE,CAAC,OAAO;gBACR,CAAC,MAAM;gBACP,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CACvB,EAAE,EACF,QAAQ,CAAC,MAA4C,CACtD,CAAC,EACF,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,WAAW,CAAC;oBACd,OAAO,EACL,UAAU,IAAI,CAAC,IAAI,+EAA+E;iBACrG,CAAC,CACH,CAAC;YACJ,CAAC;YAED,iDAAiD;YACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;gBACxD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAC/C,MAAM,EAAE,YAAY;gBACpB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;aAChE,CAAC,CAAC;YAEH,mDAAmD;YACnD,KAAK,CAAC,CAAC,OAAO,CAAC;gBACb,UAAU,EAAE,MAAM,CAAC,IAAK;gBACxB,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,aAAa,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,EAAE,OAA6B,CAAC;YAEpD,IAAI,QAAoC,CAAC;YACzC,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAA4C,CAAC,CAAC;gBACzF,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Storage/BucketIamMember.d.ts

@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import type { StorageBucket } from "./Bucket.ts";
+/**
+ * Bind a single `(role, member)` IAM grant onto a
+ * {@link StorageBucket}.
+ *
+ * Target-side binding — same pattern as
+ * {@link import("../CloudResourceManager/ProjectIamMember.ts").projectIamMember}
+ * / `serviceAccountIamMember`. The bucket's `reconcile` merges all
+ * bindings into a single `setIamPolicy` call on the bucket, preserving
+ * foreign roles + members.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<bucket>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (bucket, role, member) triple.
+ *
+ * @example Granting a service account read+write on a bucket
+ * ```typescript
+ * yield* GCP.storageBucketIamMember(bucket, "TempBucketRw", {
+ *   role: "roles/storage.objectUser",
+ *   member: `serviceAccount:${sa.email}`,
+ * });
+ * ```
+ */
+export declare const storageBucketIamMember: (bucket: StorageBucket, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+//# sourceMappingURL=BucketIamMember.d.ts.map

package/lib/Storage/BucketIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BucketIamMember.d.ts","sourceRoot":"","sources":["../../src/Storage/BucketIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,GACjC,QAAQ,aAAa,EACrB,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGiB,CAAC"}

package/lib/Storage/BucketIamMember.js

@@ -0,0 +1,26 @@
+/**
+ * Bind a single `(role, member)` IAM grant onto a
+ * {@link StorageBucket}.
+ *
+ * Target-side binding — same pattern as
+ * {@link import("../CloudResourceManager/ProjectIamMember.ts").projectIamMember}
+ * / `serviceAccountIamMember`. The bucket's `reconcile` merges all
+ * bindings into a single `setIamPolicy` call on the bucket, preserving
+ * foreign roles + members.
+ *
+ * Identity for dedup: the rendered SID is `IamMember(<bucket>, <key>)`.
+ * The engine collapses binds by SID, so callers MUST supply a
+ * stack-unique `key` per (bucket, role, member) triple.
+ *
+ * @example Granting a service account read+write on a bucket
+ * ```typescript
+ * yield* GCP.storageBucketIamMember(bucket, "TempBucketRw", {
+ *   role: "roles/storage.objectUser",
+ *   member: `serviceAccount:${sa.email}`,
+ * });
+ * ```
+ */
+export const storageBucketIamMember = (bucket, key, args) => bucket.bind `IamMember(${bucket}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+//# sourceMappingURL=BucketIamMember.js.map

package/lib/Storage/BucketIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BucketIamMember.js","sourceRoot":"","sources":["../../src/Storage/BucketIamMember.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAAqB,EACrB,GAAW,EACX,IAAsC,EACjB,EAAE,CACvB,MAAM,CAAC,IAAI,CAAA,aAAa,MAAM,KAAK,GAAG,GAAG,CAAC;IACxC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC"}

package/lib/Storage/index.d.ts

@@ -0,0 +1,4 @@
+export { StorageBucket, StorageBucketProvider, } from "./Bucket.ts";
+export type { StorageBucketProps, StorageBucketIamBinding, StorageBucketBindingContract, } from "./Bucket.ts";
+export * from "./BucketIamMember.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC"}

package/lib/Storage/index.js

@@ -0,0 +1,3 @@
+export { StorageBucket, StorageBucketProvider, } from "./Bucket.js";
+export * from "./BucketIamMember.js";
+//# sourceMappingURL=index.js.map

package/lib/Storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC"}

package/lib/index.d.ts

@@ -12,5 +12,6 @@ export * from "./Run/index.ts";
 export * from "./ServiceNetworking/index.ts";
 export * from "./Sqladmin/index.ts";
 export * from "./ServiceUsage/index.ts";
+export * from "./Storage/index.ts";
 export * from "./Providers.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC"}

package/lib/index.js

@@ -11,5 +11,6 @@ export * from "./Run/index.js";
 export * from "./ServiceNetworking/index.js";
 export * from "./Sqladmin/index.js";
 export * from "./ServiceUsage/index.js";
+export * from "./Storage/index.js";
 export * from "./Providers.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.8.0",
-  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest), with ADC-backed credentials and target-side IAM bindings.",
+  "version": "0.9.0",
+  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
     "alchemy-effect",

package/src/Container/NodePool.ts

@@ -144,6 +144,14 @@ export type NodePoolProps = {
     gvnic?: { enabled: boolean };
     /** Confidential VM. Mutable via `update`. */
     confidentialNodes?: { enabled: boolean };
+    /**
+     * GCFS (Image Streaming) — stream container image data from Artifact
+     * Registry so containers start before the full image is pulled,
+     * cutting cold start for large images. Only accelerates images stored
+     * in Artifact Registry. Mutable via `update`. Enabling/disabling on an
+     * existing pool re-creates its nodes (rolling node recreation).
+     */
+    gcfsConfig?: { enabled: boolean };
   };
   /** Cluster autoscaler. Mutable via `setAutoscaling`. */
   autoscaling?: {
@@ -295,6 +303,7 @@ export const toNodeConfigCreateBody = (
       : {}),
     ...(config.gvnic ? { gvnic: config.gvnic } : {}),
     ...(config.confidentialNodes ? { confidentialNodes: config.confidentialNodes } : {}),
+    ...(config.gcfsConfig ? { gcfsConfig: config.gcfsConfig } : {}),
   };
 };
 
@@ -374,6 +383,9 @@ const toNodePoolUpdateBody = (
   if (nc.confidentialNodes && !deepEqual(oc.confidentialNodes, nc.confidentialNodes)) {
     body.confidentialNodes = nc.confidentialNodes;
   }
+  if (nc.gcfsConfig && !deepEqual(oc.gcfsConfig, nc.gcfsConfig)) {
+    body.gcfsConfig = nc.gcfsConfig;
+  }
   if (
     nc.workloadMetadataConfig &&
     !deepEqual(oc.workloadMetadataConfig, nc.workloadMetadataConfig)

package/src/Iam/ServiceAccount.ts

@@ -321,9 +321,28 @@ export const ServiceAccountProvider = () =>
         stables: ["accountId", "projectId", "uniqueId", "name", "email"],
         diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;
+          // Replace ONLY when a prior identity is actually known AND differs.
+          // A partial/adopted state can lack the persisted accountId/projectId
+          // (an adoption that never persisted full Attributes leaves
+          // output.projectId === "" / undefined). Treating that "unknown" as a
+          // replace spuriously deletes+recreates a live, correctly-named GSA
+          // (and churns its uniqueId → breaks Workload-Identity bindings).
+          // When the prior identity is absent, fall through to reconcile, which
+          // observes the live resource and re-persists its Attributes. The
+          // truthiness guard covers both `undefined` and the `""` toAttributes
+          // default; a genuine accountId/project change still has a non-empty
+          // prior value to compare against, so real replacements are unaffected.
+          // `||` (not `??`): toAttributes persists `accountId`/`projectId` as
+          // `""` when absent, and an empty string must fall through to `olds`
+          // (the previous Props) rather than mask it — otherwise a genuine
+          // identity change with an empty `output` but a populated `olds` would
+          // skip the replace and adopt/create at the new identity without
+          // deleting the old GSA.
+          const priorAccount = output?.accountId || olds.accountId;
+          const priorProject = output?.projectId || olds.project;
           if (
-            news.accountId !== (output?.accountId ?? olds.accountId) ||
-            news.project !== (output?.projectId ?? olds.project)
+            (priorAccount && news.accountId !== priorAccount) ||
+            (priorProject && news.project !== priorProject)
           ) {
             return { action: "replace" } as const;
           }