@microagi/alchemy-gcp 0.8.1 → 0.10.0

package/lib/Storage/StorageBucketIamMember.d.ts

@@ -0,0 +1,66 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A single `(role, member)` IAM binding entry on an **existing** GCS
+ * bucket that this stack does not manage. Contrast with
+ * {@link storageBucketIamMember}, the target-side binding helper: that
+ * one requires a stack-owned {@link StorageBucket} and is additive-only
+ * (bindings written into the bucket's binding bag are merged on
+ * reconcile but never pruned). This standalone resource takes the raw
+ * bucket name, adds the member on reconcile, and — the part the helper
+ * cannot do — **removes it again on delete**, so grants revoke when the
+ * declaring resource leaves the stack.
+ *
+ * Identity is the `(bucket, role, member)` triple; all three are
+ * immutable — changing any replaces (the old triple is revoked, the new
+ * one granted).
+ *
+ * The read-modify-write on the shared bucket policy is member-scoped:
+ * exactly one member is added/removed, every foreign role and member is
+ * preserved verbatim, and the whole cycle retries with backoff so
+ * concurrent writers on the same bucket compose safely (GCS rejects a
+ * stale-etag set with `Conflict`/`PreconditionFailed`).
+ *
+ * There is nothing GCP-side to carry alchemy ownership labels on an IAM
+ * binding, so `read` has no `Unowned` adoption gate — presence of the
+ * exact member under the exact role IS the resource.
+ *
+ * @section Granting on an unmanaged bucket
+ * @example Read access for a collaborator group's namespace identity
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("SrlPackagingRead", {
+ *   bucket: "srl_200hr_packaging",
+ *   role: "roles/storage.objectViewer",
+ *   member:
+ *     "principal://iam.googleapis.com/projects/864268824536/locations/global/workloadIdentityPools/micro-research-cluster-a.svc.id.goog/subject/ns/collab-srl/sa/default",
+ * });
+ * ```
+ */
+export type StorageBucketIamMemberProps = {
+    /**
+     * Name of the (pre-existing) GCS bucket to grant on. The bucket is
+     * NOT created, adopted, or deleted by this resource. Immutable —
+     * replace.
+     */
+    bucket: string;
+    /** IAM role, e.g. `roles/storage.objectViewer`. Immutable — replace. */
+    role: string;
+    /**
+     * IAM member string (`serviceAccount:…`, `principal://…`,
+     * `group:…`, …). Immutable — replace.
+     */
+    member: string;
+};
+export type StorageBucketIamMemberAttributes = {
+    /** Bucket name, threaded through from props. */
+    bucket: string;
+    /** IAM role, threaded through from props. */
+    role: string;
+    /** IAM member, threaded through from props. */
+    member: string;
+};
+export type StorageBucketIamMember = Resource<"GCP.StorageBucketIamMember", StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, never, GCP.Providers>;
+export declare const StorageBucketIamMember: import("alchemy").ResourceClass<StorageBucketIamMember>;
+export declare const StorageBucketIamMemberProvider: () => import("effect/Layer").Layer<Provider.Provider<StorageBucketIamMember>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=StorageBucketIamMember.d.ts.map

package/lib/Storage/StorageBucketIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.d.ts","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,sBAAsB,yDAElC,CAAC;AAEF,eAAO,MAAM,8BAA8B,yLAgKxC,CAAC"}

package/lib/Storage/StorageBucketIamMember.js

@@ -0,0 +1,130 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+export const StorageBucketIamMember = Resource("GCP.StorageBucketIamMember");
+export const StorageBucketIamMemberProvider = () => Provider.effect(StorageBucketIamMember, Effect.gen(function* () {
+    const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+    const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+    // Same backoff as StorageBucket's syncIam: the get→set cycle races
+    // other writers on the bucket policy (including sibling instances
+    // of this resource); a stale etag fails the set, the retry re-reads.
+    // ConfigError (bucket doesn't exist) is a terminal misconfiguration
+    // — fail fast instead of burning the ~8-minute backoff on it.
+    const etagRetry = (eff) => eff.pipe(Effect.retry({
+        while: (e) => e?._tag !== "ConfigError",
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    // Membership check scoped to the unconditional binding for `role`
+    // — conditional bindings are someone else's and never touched.
+    const hasMember = (policy, role, member) => (policy.bindings ?? []).some((b) => b.role === role && !b.condition && (b.members ?? []).includes(member));
+    return {
+        // Identity IS the triple; all three are static strings.
+        stables: ["bucket", "role", "member"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            // Prior identity from persisted attributes first, then olds —
+            // mirrors Bucket.ts (`output?.name || olds.name`). `||`, not
+            // `??`: an empty string in a partially-persisted attribute is
+            // NOT a prior identity — treating it as one would force a
+            // spurious replace whose delete targets the wrong (empty)
+            // identity. If only `output` survives (e.g. props were lost),
+            // a changed triple must still replace, or the old member is
+            // never revoked.
+            const priorBucket = output?.bucket || olds.bucket;
+            const priorRole = output?.role || olds.role;
+            const priorMember = output?.member || olds.member;
+            if ((priorBucket && priorBucket !== news.bucket) ||
+                (priorRole && priorRole !== news.role) ||
+                (priorMember && priorMember !== news.member)) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: news.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(Effect.catchTag("NotFound", () => Effect.fail(new ConfigError({
+                    message: `Bucket ${news.bucket} does not exist — StorageBucketIamMember grants on pre-existing buckets only.`,
+                }))));
+                if (hasMember(current, news.role, news.member))
+                    return;
+                const bindings = (current.bindings ?? []).map((b) => ({
+                    ...b,
+                    members: [...(b.members ?? [])],
+                }));
+                const existing = bindings.find((b) => b.role === news.role && !b.condition);
+                if (existing) {
+                    existing.members = [...(existing.members ?? []), news.member];
+                }
+                else {
+                    bindings.push({ role: news.role, members: [news.member] });
+                }
+                yield* setIamPolicyBuckets({
+                    bucket: news.bucket,
+                    body: { ...current, bindings, version: 3 },
+                });
+            }));
+            return { bucket: news.bucket, role: news.role, member: news.member };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            // Partially-persisted attributes (empty fields) name no real
+            // grant — nothing to revoke, and getIamPolicy("") would 4xx.
+            if (!output.bucket || !output.role || !output.member)
+                return;
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: output.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(
+                // Bucket gone (or unreadable because gone) — the grant
+                // went with it; idempotent success.
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+                if (!current || !hasMember(current, output.role, output.member)) {
+                    return;
+                }
+                // Remove exactly our member from the unconditional binding;
+                // drop the binding entirely if that empties it (GCS rejects
+                // bindings with zero members).
+                const bindings = (current.bindings ?? [])
+                    .map((b) => b.role === output.role && !b.condition
+                    ? {
+                        ...b,
+                        members: (b.members ?? []).filter((m) => m !== output.member),
+                    }
+                    : { ...b, members: [...(b.members ?? [])] })
+                    .filter((b) => (b.members?.length ?? 0) > 0);
+                yield* setIamPolicyBuckets({
+                    bucket: output.bucket,
+                    body: { ...current, bindings, version: 3 },
+                }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }));
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+            const bucket = output?.bucket ?? olds?.bucket;
+            const role = output?.role ?? olds?.role;
+            const member = output?.member ?? olds?.member;
+            if (!bucket || !role || !member)
+                return undefined;
+            const current = yield* getIamPolicyBuckets({
+                bucket,
+                optionsRequestedPolicyVersion: 3,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+            if (!current)
+                return undefined;
+            // Absent member → undefined: the engine treats that as drift
+            // and the next plan re-grants.
+            if (!hasMember(current, role, member))
+                return undefined;
+            return { bucket, role, member };
+        }),
+    };
+}));
+//# sourceMappingURL=StorageBucketIamMember.js.map

package/lib/Storage/StorageBucketIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.js","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAwE5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,MAAM,CACb,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAE/D,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,CAAU,GAA2B,EAAE,EAAE,CACzD,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAuB,EAAE,IAAI,KAAK,aAAa;QAC9D,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAChB,MAAsB,EACtB,IAAY,EACZ,MAAc,EACd,EAAE,CACF,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC7E,CAAC;IAEJ,OAAO;QACL,wDAAwD;QACxD,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACrC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,8DAA8D;YAC9D,6DAA6D;YAC7D,8DAA8D;YAC9D,0DAA0D;YAC1D,0DAA0D;YAC1D,8DAA8D;YAC9D,4DAA4D;YAC5D,iBAAiB;YACjB,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,IACE,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC;gBAC5C,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC;gBACtC,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,EAC5C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;YACtC,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;oBACd,OAAO,EAAE,UAAU,IAAI,CAAC,MAAM,+EAA+E;iBAC9G,CAAC,CACH,CACF,CACF,CAAC;gBACF,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAEvD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC;oBACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;iBAChC,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAC5C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,6DAA6D;YAC7D,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO;YAC7D,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI;gBACL,uDAAuD;gBACvD,oCAAoC;gBACpC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;gBACF,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,4DAA4D;gBAC5D,4DAA4D;gBAC5D,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;qBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;oBACpC,CAAC,CAAC;wBACE,GAAG,CAAC;wBACJ,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAC3B;qBACF;oBACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,CAC9C;qBACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBACzC,MAAM;gBACN,6BAA6B,EAAE,CAAC;aACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,6DAA6D;YAC7D,+BAA+B;YAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Storage/index.d.ts

@@ -1,4 +1,6 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.ts";
 export type { StorageBucketProps, StorageBucketIamBinding, StorageBucketBindingContract, } from "./Bucket.ts";
 export * from "./BucketIamMember.ts";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.ts";
+export type { StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, } from "./StorageBucketIamMember.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAC"}

package/lib/Storage/index.js

@@ -1,3 +1,4 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.js";
 export * from "./BucketIamMember.js";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.js";
 //# sourceMappingURL=index.js.map

package/lib/Storage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC"}

package/lib/Tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Tags.d.ts","sourceRoot":"","sources":["../src/Tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AAEH,QAAA,MAAM,aAAa,gBAAgB,CAAC;AACpC,QAAA,MAAM,eAAe,kBAAkB,CAAC;AACxC,QAAA,MAAM,YAAY,eAAe,CAAC;AAQlC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;wBAQ5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,0GAW3B,CAAC;AAEH,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,eAAe,IAAI,mBAAmB,EACtC,YAAY,IAAI,gBAAgB,GACjC,CAAC;AAsBF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mGAQhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,+FAStC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gBAAiB,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAI7E,CAAC"}
+{"version":3,"file":"Tags.d.ts","sourceRoot":"","sources":["../src/Tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AAEH,QAAA,MAAM,aAAa,gBAAgB,CAAC;AACpC,QAAA,MAAM,eAAe,kBAAkB,CAAC;AACxC,QAAA,MAAM,YAAY,eAAe,CAAC;AAQlC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;wBAQ5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,0GAW3B,CAAC;AAEH,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,eAAe,IAAI,mBAAmB,EACtC,YAAY,IAAI,gBAAgB,GACjC,CAAC;AAsBF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mGAQhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,+FAStC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAI7E,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.8.1",
-  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest), with ADC-backed credentials and target-side IAM bindings.",
+  "version": "0.10.0",
+  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
     "alchemy-effect",
@@ -43,7 +43,7 @@
     }
   },
   "scripts": {
-    "build": "tsgo -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json",
     "clean": "rm -rf lib",
     "test": "CI=1 bun test",
     "test:watch": "CI=1 bun test --watch",

package/src/Iam/ServiceAccountKey.ts

@@ -131,7 +131,7 @@ export const ServiceAccountKeyProvider = () =>
       ) {
         const page = yield* listProjectsServiceAccountsKeys({
           name: serviceAccount,
-          keyTypes: "USER_MANAGED",
+          keyTypes: ["USER_MANAGED"],
         });
         const keys = page.keys ?? [];
         if (keys.length === 0) return undefined;