@microagi/alchemy-gcp 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.10.0 — 2026-07-02
+
+### Added
+
+- **`GCP.StorageBucketIamMember`** — standalone resource managing a
+  single `(bucket, role, member)` IAM entry on an **existing** GCS
+  bucket by raw name (a bucket the stack does not create, adopt, or
+  delete). Unlike the `storageBucketIamMember` binding helper — which
+  requires a stack-owned `StorageBucket` target and is additive-only —
+  this resource **revokes the member on delete** (dropping the binding
+  if emptied), so grants disappear when the declaring resource leaves
+  the stack. Member-scoped read-modify-write preserves all foreign
+  roles/members verbatim; the get→set cycle retries with backoff for
+  etag races; a missing bucket fails fast as `ConfigError`. `diff`
+  replaces on any change to the triple (persisted `output` checked
+  first, `||`-fallback so empty persisted fields are never treated as
+  a prior identity); `read` reports member absence as drift so the
+  engine re-grants. First consumer: research-infra's collab-reconciler
+  per-group bucket read grants.
+
+## 0.9.0 — 2026-06-30
+
+### Added
+
+- **`GCP.HelmRelease`** — Alchemy resource for managing Helm chart
+  releases on GKE clusters (#8). _(Entry backfilled — 0.9.0 shipped
+  without a changelog entry.)_
+
 ## 0.8.0 — 2026-06-17
 
 ### Added

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA+DtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaAqEnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAmEtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaAuEnB,CAAC"}

package/lib/Providers.js

@@ -24,6 +24,7 @@ import { Job, JobProvider } from "./Run/Job.js";
 import { Service, ServiceProvider } from "./Run/Service.js";
 import { PsaConnection, PsaConnectionProvider, } from "./ServiceNetworking/PsaConnection.js";
 import { StorageBucket, StorageBucketProvider, } from "./Storage/Bucket.js";
+import { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./Storage/StorageBucketIamMember.js";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.js";
 import { SqlDatabase, SqlDatabaseProvider } from "./Sqladmin/Database.js";
 import { SqlInstance, SqlInstanceProvider } from "./Sqladmin/Instance.js";
@@ -61,6 +62,7 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     PsaConnection,
     ManagedLustreInstance,
     StorageBucket,
+    StorageBucketIamMember,
     Service,
     Job,
     SqlInstance,
@@ -72,7 +74,7 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     KubernetesSecret,
     KubernetesManifest,
     HelmRelease,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), StorageBucketIamMemberProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,8BAA8B,EAAE,EAChC,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/Storage/StorageBucketIamMember.d.ts

@@ -0,0 +1,66 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A single `(role, member)` IAM binding entry on an **existing** GCS
+ * bucket that this stack does not manage. Contrast with
+ * {@link storageBucketIamMember}, the target-side binding helper: that
+ * one requires a stack-owned {@link StorageBucket} and is additive-only
+ * (bindings written into the bucket's binding bag are merged on
+ * reconcile but never pruned). This standalone resource takes the raw
+ * bucket name, adds the member on reconcile, and — the part the helper
+ * cannot do — **removes it again on delete**, so grants revoke when the
+ * declaring resource leaves the stack.
+ *
+ * Identity is the `(bucket, role, member)` triple; all three are
+ * immutable — changing any replaces (the old triple is revoked, the new
+ * one granted).
+ *
+ * The read-modify-write on the shared bucket policy is member-scoped:
+ * exactly one member is added/removed, every foreign role and member is
+ * preserved verbatim, and the whole cycle retries with backoff so
+ * concurrent writers on the same bucket compose safely (GCS rejects a
+ * stale-etag set with `Conflict`/`PreconditionFailed`).
+ *
+ * There is nothing GCP-side to carry alchemy ownership labels on an IAM
+ * binding, so `read` has no `Unowned` adoption gate — presence of the
+ * exact member under the exact role IS the resource.
+ *
+ * @section Granting on an unmanaged bucket
+ * @example Read access for a collaborator group's namespace identity
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("SrlPackagingRead", {
+ *   bucket: "srl_200hr_packaging",
+ *   role: "roles/storage.objectViewer",
+ *   member:
+ *     "principal://iam.googleapis.com/projects/864268824536/locations/global/workloadIdentityPools/micro-research-cluster-a.svc.id.goog/subject/ns/collab-srl/sa/default",
+ * });
+ * ```
+ */
+export type StorageBucketIamMemberProps = {
+    /**
+     * Name of the (pre-existing) GCS bucket to grant on. The bucket is
+     * NOT created, adopted, or deleted by this resource. Immutable —
+     * replace.
+     */
+    bucket: string;
+    /** IAM role, e.g. `roles/storage.objectViewer`. Immutable — replace. */
+    role: string;
+    /**
+     * IAM member string (`serviceAccount:…`, `principal://…`,
+     * `group:…`, …). Immutable — replace.
+     */
+    member: string;
+};
+export type StorageBucketIamMemberAttributes = {
+    /** Bucket name, threaded through from props. */
+    bucket: string;
+    /** IAM role, threaded through from props. */
+    role: string;
+    /** IAM member, threaded through from props. */
+    member: string;
+};
+export type StorageBucketIamMember = Resource<"GCP.StorageBucketIamMember", StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, never, GCP.Providers>;
+export declare const StorageBucketIamMember: import("alchemy").ResourceClass<StorageBucketIamMember>;
+export declare const StorageBucketIamMemberProvider: () => import("effect/Layer").Layer<Provider.Provider<StorageBucketIamMember>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=StorageBucketIamMember.d.ts.map

package/lib/Storage/StorageBucketIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.d.ts","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,sBAAsB,yDAElC,CAAC;AAEF,eAAO,MAAM,8BAA8B,yLAgKxC,CAAC"}

package/lib/Storage/StorageBucketIamMember.js

@@ -0,0 +1,130 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+export const StorageBucketIamMember = Resource("GCP.StorageBucketIamMember");
+export const StorageBucketIamMemberProvider = () => Provider.effect(StorageBucketIamMember, Effect.gen(function* () {
+    const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+    const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+    // Same backoff as StorageBucket's syncIam: the get→set cycle races
+    // other writers on the bucket policy (including sibling instances
+    // of this resource); a stale etag fails the set, the retry re-reads.
+    // ConfigError (bucket doesn't exist) is a terminal misconfiguration
+    // — fail fast instead of burning the ~8-minute backoff on it.
+    const etagRetry = (eff) => eff.pipe(Effect.retry({
+        while: (e) => e?._tag !== "ConfigError",
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    // Membership check scoped to the unconditional binding for `role`
+    // — conditional bindings are someone else's and never touched.
+    const hasMember = (policy, role, member) => (policy.bindings ?? []).some((b) => b.role === role && !b.condition && (b.members ?? []).includes(member));
+    return {
+        // Identity IS the triple; all three are static strings.
+        stables: ["bucket", "role", "member"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            // Prior identity from persisted attributes first, then olds —
+            // mirrors Bucket.ts (`output?.name || olds.name`). `||`, not
+            // `??`: an empty string in a partially-persisted attribute is
+            // NOT a prior identity — treating it as one would force a
+            // spurious replace whose delete targets the wrong (empty)
+            // identity. If only `output` survives (e.g. props were lost),
+            // a changed triple must still replace, or the old member is
+            // never revoked.
+            const priorBucket = output?.bucket || olds.bucket;
+            const priorRole = output?.role || olds.role;
+            const priorMember = output?.member || olds.member;
+            if ((priorBucket && priorBucket !== news.bucket) ||
+                (priorRole && priorRole !== news.role) ||
+                (priorMember && priorMember !== news.member)) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: news.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(Effect.catchTag("NotFound", () => Effect.fail(new ConfigError({
+                    message: `Bucket ${news.bucket} does not exist — StorageBucketIamMember grants on pre-existing buckets only.`,
+                }))));
+                if (hasMember(current, news.role, news.member))
+                    return;
+                const bindings = (current.bindings ?? []).map((b) => ({
+                    ...b,
+                    members: [...(b.members ?? [])],
+                }));
+                const existing = bindings.find((b) => b.role === news.role && !b.condition);
+                if (existing) {
+                    existing.members = [...(existing.members ?? []), news.member];
+                }
+                else {
+                    bindings.push({ role: news.role, members: [news.member] });
+                }
+                yield* setIamPolicyBuckets({
+                    bucket: news.bucket,
+                    body: { ...current, bindings, version: 3 },
+                });
+            }));
+            return { bucket: news.bucket, role: news.role, member: news.member };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            // Partially-persisted attributes (empty fields) name no real
+            // grant — nothing to revoke, and getIamPolicy("") would 4xx.
+            if (!output.bucket || !output.role || !output.member)
+                return;
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: output.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(
+                // Bucket gone (or unreadable because gone) — the grant
+                // went with it; idempotent success.
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+                if (!current || !hasMember(current, output.role, output.member)) {
+                    return;
+                }
+                // Remove exactly our member from the unconditional binding;
+                // drop the binding entirely if that empties it (GCS rejects
+                // bindings with zero members).
+                const bindings = (current.bindings ?? [])
+                    .map((b) => b.role === output.role && !b.condition
+                    ? {
+                        ...b,
+                        members: (b.members ?? []).filter((m) => m !== output.member),
+                    }
+                    : { ...b, members: [...(b.members ?? [])] })
+                    .filter((b) => (b.members?.length ?? 0) > 0);
+                yield* setIamPolicyBuckets({
+                    bucket: output.bucket,
+                    body: { ...current, bindings, version: 3 },
+                }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }));
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+            const bucket = output?.bucket ?? olds?.bucket;
+            const role = output?.role ?? olds?.role;
+            const member = output?.member ?? olds?.member;
+            if (!bucket || !role || !member)
+                return undefined;
+            const current = yield* getIamPolicyBuckets({
+                bucket,
+                optionsRequestedPolicyVersion: 3,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+            if (!current)
+                return undefined;
+            // Absent member → undefined: the engine treats that as drift
+            // and the next plan re-grants.
+            if (!hasMember(current, role, member))
+                return undefined;
+            return { bucket, role, member };
+        }),
+    };
+}));
+//# sourceMappingURL=StorageBucketIamMember.js.map

package/lib/Storage/StorageBucketIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.js","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAwE5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,MAAM,CACb,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAE/D,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,CAAU,GAA2B,EAAE,EAAE,CACzD,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAuB,EAAE,IAAI,KAAK,aAAa;QAC9D,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAChB,MAAsB,EACtB,IAAY,EACZ,MAAc,EACd,EAAE,CACF,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC7E,CAAC;IAEJ,OAAO;QACL,wDAAwD;QACxD,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACrC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,8DAA8D;YAC9D,6DAA6D;YAC7D,8DAA8D;YAC9D,0DAA0D;YAC1D,0DAA0D;YAC1D,8DAA8D;YAC9D,4DAA4D;YAC5D,iBAAiB;YACjB,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,IACE,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC;gBAC5C,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC;gBACtC,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,EAC5C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;YACtC,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;oBACd,OAAO,EAAE,UAAU,IAAI,CAAC,MAAM,+EAA+E;iBAC9G,CAAC,CACH,CACF,CACF,CAAC;gBACF,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAEvD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC;oBACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;iBAChC,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAC5C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,6DAA6D;YAC7D,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO;YAC7D,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI;gBACL,uDAAuD;gBACvD,oCAAoC;gBACpC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;gBACF,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,4DAA4D;gBAC5D,4DAA4D;gBAC5D,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;qBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;oBACpC,CAAC,CAAC;wBACE,GAAG,CAAC;wBACJ,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAC3B;qBACF;oBACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,CAC9C;qBACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBACzC,MAAM;gBACN,6BAA6B,EAAE,CAAC;aACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,6DAA6D;YAC7D,+BAA+B;YAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Storage/index.d.ts

@@ -1,4 +1,6 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.ts";
 export type { StorageBucketProps, StorageBucketIamBinding, StorageBucketBindingContract, } from "./Bucket.ts";
 export * from "./BucketIamMember.ts";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.ts";
+export type { StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, } from "./StorageBucketIamMember.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAC"}

package/lib/Storage/index.js

@@ -1,3 +1,4 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.js";
 export * from "./BucketIamMember.js";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.js";
 //# sourceMappingURL=index.js.map

package/lib/Storage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",

package/src/Providers.ts

@@ -57,6 +57,10 @@ import {
   StorageBucket,
   StorageBucketProvider,
 } from "./Storage/Bucket.ts";
+import {
+  StorageBucketIamMember,
+  StorageBucketIamMemberProvider,
+} from "./Storage/StorageBucketIamMember.ts";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.ts";
 import { SqlDatabase, SqlDatabaseProvider } from "./Sqladmin/Database.ts";
 import { SqlInstance, SqlInstanceProvider } from "./Sqladmin/Instance.ts";
@@ -100,6 +104,7 @@ export const providers = () =>
       PsaConnection,
       ManagedLustreInstance,
       StorageBucket,
+      StorageBucketIamMember,
       Service,
       Job,
       SqlInstance,
@@ -130,6 +135,7 @@ export const providers = () =>
         PsaConnectionProvider(),
         ManagedLustreInstanceProvider(),
         StorageBucketProvider(),
+        StorageBucketIamMemberProvider(),
         ServiceProvider(),
         JobProvider(),
         SqlInstanceProvider(),

package/src/Storage/StorageBucketIamMember.ts

@@ -0,0 +1,244 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as GCP from "../Providers.ts";
+
+/**
+ * A single `(role, member)` IAM binding entry on an **existing** GCS
+ * bucket that this stack does not manage. Contrast with
+ * {@link storageBucketIamMember}, the target-side binding helper: that
+ * one requires a stack-owned {@link StorageBucket} and is additive-only
+ * (bindings written into the bucket's binding bag are merged on
+ * reconcile but never pruned). This standalone resource takes the raw
+ * bucket name, adds the member on reconcile, and — the part the helper
+ * cannot do — **removes it again on delete**, so grants revoke when the
+ * declaring resource leaves the stack.
+ *
+ * Identity is the `(bucket, role, member)` triple; all three are
+ * immutable — changing any replaces (the old triple is revoked, the new
+ * one granted).
+ *
+ * The read-modify-write on the shared bucket policy is member-scoped:
+ * exactly one member is added/removed, every foreign role and member is
+ * preserved verbatim, and the whole cycle retries with backoff so
+ * concurrent writers on the same bucket compose safely (GCS rejects a
+ * stale-etag set with `Conflict`/`PreconditionFailed`).
+ *
+ * There is nothing GCP-side to carry alchemy ownership labels on an IAM
+ * binding, so `read` has no `Unowned` adoption gate — presence of the
+ * exact member under the exact role IS the resource.
+ *
+ * @section Granting on an unmanaged bucket
+ * @example Read access for a collaborator group's namespace identity
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("SrlPackagingRead", {
+ *   bucket: "srl_200hr_packaging",
+ *   role: "roles/storage.objectViewer",
+ *   member:
+ *     "principal://iam.googleapis.com/projects/864268824536/locations/global/workloadIdentityPools/micro-research-cluster-a.svc.id.goog/subject/ns/collab-srl/sa/default",
+ * });
+ * ```
+ */
+export type StorageBucketIamMemberProps = {
+  /**
+   * Name of the (pre-existing) GCS bucket to grant on. The bucket is
+   * NOT created, adopted, or deleted by this resource. Immutable —
+   * replace.
+   */
+  bucket: string;
+  /** IAM role, e.g. `roles/storage.objectViewer`. Immutable — replace. */
+  role: string;
+  /**
+   * IAM member string (`serviceAccount:…`, `principal://…`,
+   * `group:…`, …). Immutable — replace.
+   */
+  member: string;
+};
+
+export type StorageBucketIamMemberAttributes = {
+  /** Bucket name, threaded through from props. */
+  bucket: string;
+  /** IAM role, threaded through from props. */
+  role: string;
+  /** IAM member, threaded through from props. */
+  member: string;
+};
+
+export type StorageBucketIamMember = Resource<
+  "GCP.StorageBucketIamMember",
+  StorageBucketIamMemberProps,
+  StorageBucketIamMemberAttributes,
+  never,
+  GCP.Providers
+>;
+
+export const StorageBucketIamMember = Resource<StorageBucketIamMember>(
+  "GCP.StorageBucketIamMember",
+);
+
+export const StorageBucketIamMemberProvider = () =>
+  Provider.effect(
+    StorageBucketIamMember,
+    Effect.gen(function* () {
+      const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+      const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+
+      // Same backoff as StorageBucket's syncIam: the get→set cycle races
+      // other writers on the bucket policy (including sibling instances
+      // of this resource); a stale etag fails the set, the retry re-reads.
+      // ConfigError (bucket doesn't exist) is a terminal misconfiguration
+      // — fail fast instead of burning the ~8-minute backoff on it.
+      const etagRetry = <A, E, R>(eff: Effect.Effect<A, E, R>) =>
+        eff.pipe(
+          Effect.retry({
+            while: (e) => (e as { _tag?: string })?._tag !== "ConfigError",
+            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+
+      // Membership check scoped to the unconditional binding for `role`
+      // — conditional bindings are someone else's and never touched.
+      const hasMember = (
+        policy: storage.Policy,
+        role: string,
+        member: string,
+      ) =>
+        (policy.bindings ?? []).some(
+          (b) => b.role === role && !b.condition && (b.members ?? []).includes(member),
+        );
+
+      return {
+        // Identity IS the triple; all three are static strings.
+        stables: ["bucket", "role", "member"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          // Prior identity from persisted attributes first, then olds —
+          // mirrors Bucket.ts (`output?.name || olds.name`). `||`, not
+          // `??`: an empty string in a partially-persisted attribute is
+          // NOT a prior identity — treating it as one would force a
+          // spurious replace whose delete targets the wrong (empty)
+          // identity. If only `output` survives (e.g. props were lost),
+          // a changed triple must still replace, or the old member is
+          // never revoked.
+          const priorBucket = output?.bucket || olds.bucket;
+          const priorRole = output?.role || olds.role;
+          const priorMember = output?.member || olds.member;
+          if (
+            (priorBucket && priorBucket !== news.bucket) ||
+            (priorRole && priorRole !== news.role) ||
+            (priorMember && priorMember !== news.member)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+          yield* etagRetry(
+            Effect.gen(function* () {
+              const current = yield* getIamPolicyBuckets({
+                bucket: news.bucket,
+                optionsRequestedPolicyVersion: 3,
+              }).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.fail(
+                    new ConfigError({
+                      message: `Bucket ${news.bucket} does not exist — StorageBucketIamMember grants on pre-existing buckets only.`,
+                    }),
+                  ),
+                ),
+              );
+              if (hasMember(current, news.role, news.member)) return;
+
+              const bindings = (current.bindings ?? []).map((b) => ({
+                ...b,
+                members: [...(b.members ?? [])],
+              }));
+              const existing = bindings.find(
+                (b) => b.role === news.role && !b.condition,
+              );
+              if (existing) {
+                existing.members = [...(existing.members ?? []), news.member];
+              } else {
+                bindings.push({ role: news.role, members: [news.member] });
+              }
+              yield* setIamPolicyBuckets({
+                bucket: news.bucket,
+                body: { ...current, bindings, version: 3 },
+              });
+            }),
+          );
+          return { bucket: news.bucket, role: news.role, member: news.member };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          // Partially-persisted attributes (empty fields) name no real
+          // grant — nothing to revoke, and getIamPolicy("") would 4xx.
+          if (!output.bucket || !output.role || !output.member) return;
+          yield* etagRetry(
+            Effect.gen(function* () {
+              const current = yield* getIamPolicyBuckets({
+                bucket: output.bucket,
+                optionsRequestedPolicyVersion: 3,
+              }).pipe(
+                // Bucket gone (or unreadable because gone) — the grant
+                // went with it; idempotent success.
+                Effect.catchTag("NotFound", () =>
+                  Effect.succeed(undefined as storage.Policy | undefined),
+                ),
+              );
+              if (!current || !hasMember(current, output.role, output.member)) {
+                return;
+              }
+              // Remove exactly our member from the unconditional binding;
+              // drop the binding entirely if that empties it (GCS rejects
+              // bindings with zero members).
+              const bindings = (current.bindings ?? [])
+                .map((b) =>
+                  b.role === output.role && !b.condition
+                    ? {
+                        ...b,
+                        members: (b.members ?? []).filter(
+                          (m) => m !== output.member,
+                        ),
+                      }
+                    : { ...b, members: [...(b.members ?? [])] },
+                )
+                .filter((b) => (b.members?.length ?? 0) > 0);
+              yield* setIamPolicyBuckets({
+                bucket: output.bucket,
+                body: { ...current, bindings, version: 3 },
+              }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const bucket = output?.bucket ?? olds?.bucket;
+          const role = output?.role ?? olds?.role;
+          const member = output?.member ?? olds?.member;
+          if (!bucket || !role || !member) return undefined;
+          const current = yield* getIamPolicyBuckets({
+            bucket,
+            optionsRequestedPolicyVersion: 3,
+          }).pipe(
+            Effect.catchTag("NotFound", () =>
+              Effect.succeed(undefined as storage.Policy | undefined),
+            ),
+            Effect.catchTag("Forbidden", () =>
+              Effect.succeed(undefined as storage.Policy | undefined),
+            ),
+          );
+          if (!current) return undefined;
+          // Absent member → undefined: the engine treats that as drift
+          // and the next plan re-grants.
+          if (!hasMember(current, role, member)) return undefined;
+          return { bucket, role, member };
+        }),
+      };
+    }),
+  );

package/src/Storage/index.ts

@@ -8,3 +8,11 @@ export type {
   StorageBucketBindingContract,
 } from "./Bucket.ts";
 export * from "./BucketIamMember.ts";
+export {
+  StorageBucketIamMember,
+  StorageBucketIamMemberProvider,
+} from "./StorageBucketIamMember.ts";
+export type {
+  StorageBucketIamMemberProps,
+  StorageBucketIamMemberAttributes,
+} from "./StorageBucketIamMember.ts";