@microagi/alchemy-gcp 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.10.0 — 2026-07-02
+
+### Added
+
+- **`GCP.StorageBucketIamMember`** — standalone resource managing a
+  single `(bucket, role, member)` IAM entry on an **existing** GCS
+  bucket by raw name (a bucket the stack does not create, adopt, or
+  delete). Unlike the `storageBucketIamMember` binding helper — which
+  requires a stack-owned `StorageBucket` target and is additive-only —
+  this resource **revokes the member on delete** (dropping the binding
+  if emptied), so grants disappear when the declaring resource leaves
+  the stack. Member-scoped read-modify-write preserves all foreign
+  roles/members verbatim; the get→set cycle retries with backoff for
+  etag races; a missing bucket fails fast as `ConfigError`. `diff`
+  replaces on any change to the triple (persisted `output` checked
+  first, `||`-fallback so empty persisted fields are never treated as
+  a prior identity); `read` reports member absence as drift so the
+  engine re-grants. First consumer: research-infra's collab-reconciler
+  per-group bucket read grants.
+
+## 0.9.0 — 2026-06-30
+
+### Added
+
+- **`GCP.HelmRelease`** — Alchemy resource for managing Helm chart
+  releases on GKE clusters (#8). _(Entry backfilled — 0.9.0 shipped
+  without a changelog entry.)_
+
 ## 0.8.0 — 2026-06-17
 
 ### Added

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA+DtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaAqEnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAmEtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaAuEnB,CAAC"}

package/lib/Providers.js

@@ -24,6 +24,7 @@ import { Job, JobProvider } from "./Run/Job.js";
 import { Service, ServiceProvider } from "./Run/Service.js";
 import { PsaConnection, PsaConnectionProvider, } from "./ServiceNetworking/PsaConnection.js";
 import { StorageBucket, StorageBucketProvider, } from "./Storage/Bucket.js";
+import { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./Storage/StorageBucketIamMember.js";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.js";
 import { SqlDatabase, SqlDatabaseProvider } from "./Sqladmin/Database.js";
 import { SqlInstance, SqlInstanceProvider } from "./Sqladmin/Instance.js";
@@ -61,6 +62,7 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     PsaConnection,
     ManagedLustreInstance,
     StorageBucket,
+    StorageBucketIamMember,
     Service,
     Job,
     SqlInstance,
@@ -72,7 +74,7 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     KubernetesSecret,
     KubernetesManifest,
     HelmRelease,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), StorageBucketIamMemberProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,8BAA8B,EAAE,EAChC,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/Storage/StorageBucketIamMember.d.ts

@@ -0,0 +1,118 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A single `(role, member)` IAM binding entry on an **existing** GCS
+ * bucket that this stack does not manage. Contrast with
+ * {@link storageBucketIamMember}, the target-side binding helper: that
+ * one requires a stack-owned {@link StorageBucket} and is additive-only
+ * (bindings written into the bucket's binding bag are merged on
+ * reconcile but never pruned). This standalone resource takes the raw
+ * bucket name, adds the member on reconcile, and — the part the helper
+ * cannot do — **removes it again on delete**, so grants revoke when the
+ * declaring resource leaves the stack.
+ *
+ * Identity is the `(bucket, role, member, condition.expression)` tuple;
+ * all are immutable — changing any replaces (the old grant is revoked,
+ * the new one granted).
+ *
+ * With a `condition`, the member lands in the binding whose condition
+ * **expression** matches (CEL, compared byte-for-byte) — the binding is
+ * created with the given title/description if absent. Title and
+ * description are create-time metadata only: an existing binding with
+ * the same expression but a different title is adopted as-is, never
+ * retitled (that lets hand-applied conditional grants converge into the
+ * stack without a duplicate binding). Conditional bindings require the
+ * bucket to have uniform bucket-level access (GCS rejects conditions
+ * otherwise) and policy version 3 — the read-modify-write here always
+ * requests/writes version 3.
+ *
+ * The read-modify-write on the shared bucket policy is member-scoped:
+ * exactly one member is added/removed, every foreign role and member is
+ * preserved verbatim, and the whole cycle retries with backoff so
+ * concurrent writers on the same bucket compose safely (GCS rejects a
+ * stale-etag set with `Conflict`/`PreconditionFailed`).
+ *
+ * There is nothing GCP-side to carry alchemy ownership labels on an IAM
+ * binding, so `read` has no `Unowned` adoption gate — presence of the
+ * exact member under the exact role IS the resource.
+ *
+ * @section Granting on an unmanaged bucket
+ * @example Read access for a collaborator group's namespace identity
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("SrlPackagingRead", {
+ *   bucket: "srl_200hr_packaging",
+ *   role: "roles/storage.objectViewer",
+ *   member:
+ *     "principal://iam.googleapis.com/projects/864268824536/locations/global/workloadIdentityPools/micro-research-cluster-a.svc.id.goog/subject/ns/collab-srl/sa/default",
+ * });
+ * ```
+ *
+ * @section Prefix-scoped read on a customer bucket
+ * @example Conditional grant limited to one object prefix (+ bucket-level list)
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("QaDatasetRead", {
+ *   bucket: "golden-zone-prod-770927",
+ *   role: "roles/storage.objectViewer",
+ *   member: "principal://iam.googleapis.com/…/subject/ns/collab-jeffrey-coworking/sa/default",
+ *   condition: {
+ *     title: "collab-jeffrey-coworking",
+ *     expression:
+ *       'resource.name.startsWith("projects/_/buckets/golden-zone-prod-770927/objects/qa/") || resource.name == "projects/_/buckets/golden-zone-prod-770927"',
+ *   },
+ * });
+ * ```
+ */
+export type StorageBucketIamMemberCondition = {
+    /**
+     * Binding title — create-time metadata only. NOT identity: a live
+     * binding with the same expression but another title is adopted, not
+     * retitled/replaced.
+     */
+    title: string;
+    /** Optional human note on the binding. Create-time metadata only. */
+    description?: string;
+    /**
+     * CEL condition expression. Part of the resource identity — compared
+     * byte-for-byte against live bindings' expressions, so keep the
+     * rendering deterministic. Immutable — replace.
+     */
+    expression: string;
+};
+export type StorageBucketIamMemberProps = {
+    /**
+     * Name of the (pre-existing) GCS bucket to grant on. The bucket is
+     * NOT created, adopted, or deleted by this resource. Immutable —
+     * replace.
+     */
+    bucket: string;
+    /** IAM role, e.g. `roles/storage.objectViewer`. Immutable — replace. */
+    role: string;
+    /**
+     * IAM member string (`serviceAccount:…`, `principal://…`,
+     * `group:…`, …). Immutable — replace.
+     */
+    member: string;
+    /**
+     * Optional IAM Condition scoping the grant (e.g. to an object
+     * prefix). Absent → the member joins the role's UNCONDITIONAL
+     * binding. The condition **expression** is identity (immutable —
+     * replace); title/description are create-time metadata. Requires
+     * uniform bucket-level access on the bucket.
+     */
+    condition?: StorageBucketIamMemberCondition;
+};
+export type StorageBucketIamMemberAttributes = {
+    /** Bucket name, threaded through from props. */
+    bucket: string;
+    /** IAM role, threaded through from props. */
+    role: string;
+    /** IAM member, threaded through from props. */
+    member: string;
+    /** IAM Condition, threaded through from props (absent = unconditional). */
+    condition?: StorageBucketIamMemberCondition;
+};
+export type StorageBucketIamMember = Resource<"GCP.StorageBucketIamMember", StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, never, GCP.Providers>;
+export declare const StorageBucketIamMember: import("alchemy").ResourceClass<StorageBucketIamMember>;
+export declare const StorageBucketIamMemberProvider: () => import("effect/Layer").Layer<Provider.Provider<StorageBucketIamMember>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=StorageBucketIamMember.d.ts.map

package/lib/Storage/StorageBucketIamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.d.ts","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,+BAA+B,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,SAAS,CAAC,EAAE,+BAA+B,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AAEF,eAAO,MAAM,sBAAsB,yDAElC,CAAC;AAEF,eAAO,MAAM,8BAA8B,yLA0NxC,CAAC"}

package/lib/Storage/StorageBucketIamMember.js

@@ -0,0 +1,176 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+export const StorageBucketIamMember = Resource("GCP.StorageBucketIamMember");
+export const StorageBucketIamMemberProvider = () => Provider.effect(StorageBucketIamMember, Effect.gen(function* () {
+    const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+    const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+    // Same backoff as StorageBucket's syncIam: the get→set cycle races
+    // other writers on the bucket policy (including sibling instances
+    // of this resource); a stale etag fails the set, the retry re-reads.
+    // ConfigError (bucket doesn't exist) is a terminal misconfiguration
+    // — fail fast instead of burning the ~8-minute backoff on it.
+    const etagRetry = (eff) => eff.pipe(Effect.retry({
+        while: (e) => e?._tag !== "ConfigError",
+        schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+    }));
+    // Binding selector: with no condition, ONLY the unconditional
+    // binding for `role` (conditional bindings are someone else's);
+    // with a condition, the binding whose expression matches
+    // byte-for-byte — title/description deliberately ignored so
+    // hand-applied grants with the same expression are adopted.
+    const bindingMatches = (b, role, condition) => b.role === role &&
+        (condition
+            ? b.condition?.expression === condition.expression
+            : !b.condition);
+    const hasMember = (policy, role, member, condition) => (policy.bindings ?? []).some((b) => bindingMatches(b, role, condition) &&
+        (b.members ?? []).includes(member));
+    return {
+        // Identity IS the tuple; all fields are static values.
+        stables: ["bucket", "role", "member", "condition"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+            if (!isResolved(news))
+                return undefined;
+            // Prior identity from persisted attributes first, then olds —
+            // mirrors Bucket.ts (`output?.name || olds.name`). `||`, not
+            // `??`: an empty string in a partially-persisted attribute is
+            // NOT a prior identity — treating it as one would force a
+            // spurious replace whose delete targets the wrong (empty)
+            // identity. If only `output` survives (e.g. props were lost),
+            // a changed triple must still replace, or the old member is
+            // never revoked.
+            const priorBucket = output?.bucket || olds.bucket;
+            const priorRole = output?.role || olds.role;
+            const priorMember = output?.member || olds.member;
+            if ((priorBucket && priorBucket !== news.bucket) ||
+                (priorRole && priorRole !== news.role) ||
+                (priorMember && priorMember !== news.member)) {
+                return { action: "replace" };
+            }
+            // Condition expression is identity too — but only when a prior
+            // identity exists at all (a partially-persisted record with no
+            // bucket names no grant to revoke). Absent condition compares
+            // as "" so unconditional↔conditional flips replace, while a
+            // 0.10.x record (no condition attribute) vs. unconditional
+            // props stays a no-op.
+            const priorCond = output?.condition?.expression ?? olds.condition?.expression ?? "";
+            const newsCond = news.condition?.expression ?? "";
+            if (priorBucket && priorCond !== newsCond) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: news.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(Effect.catchTag("NotFound", () => Effect.fail(new ConfigError({
+                    message: `Bucket ${news.bucket} does not exist — StorageBucketIamMember grants on pre-existing buckets only.`,
+                }))));
+                if (hasMember(current, news.role, news.member, news.condition)) {
+                    return;
+                }
+                const bindings = (current.bindings ?? []).map((b) => ({
+                    ...b,
+                    members: [...(b.members ?? [])],
+                }));
+                const existing = bindings.find((b) => bindingMatches(b, news.role, news.condition));
+                if (existing) {
+                    existing.members = [...(existing.members ?? []), news.member];
+                }
+                else {
+                    bindings.push({
+                        role: news.role,
+                        members: [news.member],
+                        ...(news.condition
+                            ? {
+                                condition: {
+                                    title: news.condition.title,
+                                    ...(news.condition.description
+                                        ? { description: news.condition.description }
+                                        : {}),
+                                    expression: news.condition.expression,
+                                },
+                            }
+                            : {}),
+                    });
+                }
+                yield* setIamPolicyBuckets({
+                    bucket: news.bucket,
+                    body: { ...current, bindings, version: 3 },
+                });
+            }));
+            return {
+                bucket: news.bucket,
+                role: news.role,
+                member: news.member,
+                ...(news.condition ? { condition: news.condition } : {}),
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            // Partially-persisted attributes (empty fields) name no real
+            // grant — nothing to revoke, and getIamPolicy("") would 4xx.
+            if (!output.bucket || !output.role || !output.member)
+                return;
+            yield* etagRetry(Effect.gen(function* () {
+                const current = yield* getIamPolicyBuckets({
+                    bucket: output.bucket,
+                    optionsRequestedPolicyVersion: 3,
+                }).pipe(
+                // Bucket gone (or unreadable because gone) — the grant
+                // went with it; idempotent success.
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+                if (!current ||
+                    !hasMember(current, output.role, output.member, output.condition)) {
+                    return;
+                }
+                // Remove exactly our member from the matched binding;
+                // drop the binding entirely if that empties it (GCS rejects
+                // bindings with zero members).
+                const bindings = (current.bindings ?? [])
+                    .map((b) => bindingMatches(b, output.role, output.condition)
+                    ? {
+                        ...b,
+                        members: (b.members ?? []).filter((m) => m !== output.member),
+                    }
+                    : { ...b, members: [...(b.members ?? [])] })
+                    .filter((b) => (b.members?.length ?? 0) > 0);
+                yield* setIamPolicyBuckets({
+                    bucket: output.bucket,
+                    body: { ...current, bindings, version: 3 },
+                }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }));
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+            const bucket = output?.bucket ?? olds?.bucket;
+            const role = output?.role ?? olds?.role;
+            const member = output?.member ?? olds?.member;
+            const condition = output?.condition ?? olds?.condition;
+            if (!bucket || !role || !member)
+                return undefined;
+            const current = yield* getIamPolicyBuckets({
+                bucket,
+                optionsRequestedPolicyVersion: 3,
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+            if (!current)
+                return undefined;
+            // Absent member → undefined: the engine treats that as drift
+            // and the next plan re-grants.
+            if (!hasMember(current, role, member, condition))
+                return undefined;
+            return {
+                bucket,
+                role,
+                member,
+                ...(condition ? { condition } : {}),
+            };
+        }),
+    };
+}));
+//# sourceMappingURL=StorageBucketIamMember.js.map

package/lib/Storage/StorageBucketIamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageBucketIamMember.js","sourceRoot":"","sources":["../../src/Storage/StorageBucketIamMember.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AA6H5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,MAAM,CACb,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAE/D,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,CAAU,GAA2B,EAAE,EAAE,CACzD,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAuB,EAAE,IAAI,KAAK,aAAa;QAC9D,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;KACF,CAAC,CACH,CAAC;IAEJ,8DAA8D;IAC9D,gEAAgE;IAChE,yDAAyD;IACzD,4DAA4D;IAC5D,4DAA4D;IAC5D,MAAM,cAAc,GAAG,CACrB,CAAyD,EACzD,IAAY,EACZ,SAA2C,EAC3C,EAAE,CACF,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,SAAS;YACR,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,UAAU;YAClD,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,CAChB,MAAsB,EACtB,IAAY,EACZ,MAAc,EACd,SAA2C,EAC3C,EAAE,CACF,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC;QAClC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrC,CAAC;IAEJ,OAAO;QACL,uDAAuD;QACvD,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;QAClD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,8DAA8D;YAC9D,6DAA6D;YAC7D,8DAA8D;YAC9D,0DAA0D;YAC1D,0DAA0D;YAC1D,8DAA8D;YAC9D,4DAA4D;YAC5D,iBAAiB;YACjB,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAClD,IACE,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC;gBAC5C,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC;gBACtC,CAAC,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,EAC5C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,+DAA+D;YAC/D,+DAA+D;YAC/D,8DAA8D;YAC9D,4DAA4D;YAC5D,2DAA2D;YAC3D,uBAAuB;YACvB,MAAM,SAAS,GACb,MAAM,EAAE,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC;YAClD,IAAI,WAAW,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;YACtC,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;oBACd,OAAO,EAAE,UAAU,IAAI,CAAC,MAAM,+EAA+E;iBAC9G,CAAC,CACH,CACF,CACF,CAAC;gBACF,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC;oBACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;iBAChC,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAC7C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBACtB,GAAG,CAAC,IAAI,CAAC,SAAS;4BAChB,CAAC,CAAC;gCACE,SAAS,EAAE;oCACT,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;oCAC3B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW;wCAC5B,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;wCAC7C,CAAC,CAAC,EAAE,CAAC;oCACP,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;iCACtC;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,6DAA6D;YAC7D,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO;YAC7D,KAAK,CAAC,CAAC,SAAS,CACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,6BAA6B,EAAE,CAAC;iBACjC,CAAC,CAAC,IAAI;gBACL,uDAAuD;gBACvD,oCAAoC;gBACpC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;gBACF,IACE,CAAC,OAAO;oBACR,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EACjE,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,sDAAsD;gBACtD,4DAA4D;gBAC5D,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;qBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC;oBAC9C,CAAC,CAAC;wBACE,GAAG,CAAC;wBACJ,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAC3B;qBACF;oBACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,CAC9C;qBACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBACzC,MAAM;gBACN,6BAA6B,EAAE,CAAC;aACjC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAuC,CAAC,CACxD,CACF,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,6DAA6D;YAC7D,+BAA+B;YAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnE,OAAO;gBACL,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Storage/index.d.ts

@@ -1,4 +1,6 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.ts";
 export type { StorageBucketProps, StorageBucketIamBinding, StorageBucketBindingContract, } from "./Bucket.ts";
 export * from "./BucketIamMember.ts";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.ts";
+export type { StorageBucketIamMemberProps, StorageBucketIamMemberAttributes, StorageBucketIamMemberCondition, } from "./StorageBucketIamMember.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,6BAA6B,CAAC"}

package/lib/Storage/index.js

@@ -1,3 +1,4 @@
 export { StorageBucket, StorageBucketProvider, } from "./Bucket.js";
 export * from "./BucketIamMember.js";
+export { StorageBucketIamMember, StorageBucketIamMemberProvider, } from "./StorageBucketIamMember.js";
 //# sourceMappingURL=index.js.map

package/lib/Storage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",

package/src/Providers.ts

@@ -57,6 +57,10 @@ import {
   StorageBucket,
   StorageBucketProvider,
 } from "./Storage/Bucket.ts";
+import {
+  StorageBucketIamMember,
+  StorageBucketIamMemberProvider,
+} from "./Storage/StorageBucketIamMember.ts";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.ts";
 import { SqlDatabase, SqlDatabaseProvider } from "./Sqladmin/Database.ts";
 import { SqlInstance, SqlInstanceProvider } from "./Sqladmin/Instance.ts";
@@ -100,6 +104,7 @@ export const providers = () =>
       PsaConnection,
       ManagedLustreInstance,
       StorageBucket,
+      StorageBucketIamMember,
       Service,
       Job,
       SqlInstance,
@@ -130,6 +135,7 @@ export const providers = () =>
         PsaConnectionProvider(),
         ManagedLustreInstanceProvider(),
         StorageBucketProvider(),
+        StorageBucketIamMemberProvider(),
         ServiceProvider(),
         JobProvider(),
         SqlInstanceProvider(),

package/src/Storage/StorageBucketIamMember.ts

@@ -0,0 +1,355 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as storage from "@distilled.cloud/gcp/storage-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as GCP from "../Providers.ts";
+
+/**
+ * A single `(role, member)` IAM binding entry on an **existing** GCS
+ * bucket that this stack does not manage. Contrast with
+ * {@link storageBucketIamMember}, the target-side binding helper: that
+ * one requires a stack-owned {@link StorageBucket} and is additive-only
+ * (bindings written into the bucket's binding bag are merged on
+ * reconcile but never pruned). This standalone resource takes the raw
+ * bucket name, adds the member on reconcile, and — the part the helper
+ * cannot do — **removes it again on delete**, so grants revoke when the
+ * declaring resource leaves the stack.
+ *
+ * Identity is the `(bucket, role, member, condition.expression)` tuple;
+ * all are immutable — changing any replaces (the old grant is revoked,
+ * the new one granted).
+ *
+ * With a `condition`, the member lands in the binding whose condition
+ * **expression** matches (CEL, compared byte-for-byte) — the binding is
+ * created with the given title/description if absent. Title and
+ * description are create-time metadata only: an existing binding with
+ * the same expression but a different title is adopted as-is, never
+ * retitled (that lets hand-applied conditional grants converge into the
+ * stack without a duplicate binding). Conditional bindings require the
+ * bucket to have uniform bucket-level access (GCS rejects conditions
+ * otherwise) and policy version 3 — the read-modify-write here always
+ * requests/writes version 3.
+ *
+ * The read-modify-write on the shared bucket policy is member-scoped:
+ * exactly one member is added/removed, every foreign role and member is
+ * preserved verbatim, and the whole cycle retries with backoff so
+ * concurrent writers on the same bucket compose safely (GCS rejects a
+ * stale-etag set with `Conflict`/`PreconditionFailed`).
+ *
+ * There is nothing GCP-side to carry alchemy ownership labels on an IAM
+ * binding, so `read` has no `Unowned` adoption gate — presence of the
+ * exact member under the exact role IS the resource.
+ *
+ * @section Granting on an unmanaged bucket
+ * @example Read access for a collaborator group's namespace identity
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("SrlPackagingRead", {
+ *   bucket: "srl_200hr_packaging",
+ *   role: "roles/storage.objectViewer",
+ *   member:
+ *     "principal://iam.googleapis.com/projects/864268824536/locations/global/workloadIdentityPools/micro-research-cluster-a.svc.id.goog/subject/ns/collab-srl/sa/default",
+ * });
+ * ```
+ *
+ * @section Prefix-scoped read on a customer bucket
+ * @example Conditional grant limited to one object prefix (+ bucket-level list)
+ * ```typescript
+ * yield* GCP.StorageBucketIamMember("QaDatasetRead", {
+ *   bucket: "golden-zone-prod-770927",
+ *   role: "roles/storage.objectViewer",
+ *   member: "principal://iam.googleapis.com/…/subject/ns/collab-jeffrey-coworking/sa/default",
+ *   condition: {
+ *     title: "collab-jeffrey-coworking",
+ *     expression:
+ *       'resource.name.startsWith("projects/_/buckets/golden-zone-prod-770927/objects/qa/") || resource.name == "projects/_/buckets/golden-zone-prod-770927"',
+ *   },
+ * });
+ * ```
+ */
+export type StorageBucketIamMemberCondition = {
+  /**
+   * Binding title — create-time metadata only. NOT identity: a live
+   * binding with the same expression but another title is adopted, not
+   * retitled/replaced.
+   */
+  title: string;
+  /** Optional human note on the binding. Create-time metadata only. */
+  description?: string;
+  /**
+   * CEL condition expression. Part of the resource identity — compared
+   * byte-for-byte against live bindings' expressions, so keep the
+   * rendering deterministic. Immutable — replace.
+   */
+  expression: string;
+};
+
+export type StorageBucketIamMemberProps = {
+  /**
+   * Name of the (pre-existing) GCS bucket to grant on. The bucket is
+   * NOT created, adopted, or deleted by this resource. Immutable —
+   * replace.
+   */
+  bucket: string;
+  /** IAM role, e.g. `roles/storage.objectViewer`. Immutable — replace. */
+  role: string;
+  /**
+   * IAM member string (`serviceAccount:…`, `principal://…`,
+   * `group:…`, …). Immutable — replace.
+   */
+  member: string;
+  /**
+   * Optional IAM Condition scoping the grant (e.g. to an object
+   * prefix). Absent → the member joins the role's UNCONDITIONAL
+   * binding. The condition **expression** is identity (immutable —
+   * replace); title/description are create-time metadata. Requires
+   * uniform bucket-level access on the bucket.
+   */
+  condition?: StorageBucketIamMemberCondition;
+};
+
+export type StorageBucketIamMemberAttributes = {
+  /** Bucket name, threaded through from props. */
+  bucket: string;
+  /** IAM role, threaded through from props. */
+  role: string;
+  /** IAM member, threaded through from props. */
+  member: string;
+  /** IAM Condition, threaded through from props (absent = unconditional). */
+  condition?: StorageBucketIamMemberCondition;
+};
+
+export type StorageBucketIamMember = Resource<
+  "GCP.StorageBucketIamMember",
+  StorageBucketIamMemberProps,
+  StorageBucketIamMemberAttributes,
+  never,
+  GCP.Providers
+>;
+
+export const StorageBucketIamMember = Resource<StorageBucketIamMember>(
+  "GCP.StorageBucketIamMember",
+);
+
+export const StorageBucketIamMemberProvider = () =>
+  Provider.effect(
+    StorageBucketIamMember,
+    Effect.gen(function* () {
+      const getIamPolicyBuckets = yield* storage.getIamPolicyBuckets;
+      const setIamPolicyBuckets = yield* storage.setIamPolicyBuckets;
+
+      // Same backoff as StorageBucket's syncIam: the get→set cycle races
+      // other writers on the bucket policy (including sibling instances
+      // of this resource); a stale etag fails the set, the retry re-reads.
+      // ConfigError (bucket doesn't exist) is a terminal misconfiguration
+      // — fail fast instead of burning the ~8-minute backoff on it.
+      const etagRetry = <A, E, R>(eff: Effect.Effect<A, E, R>) =>
+        eff.pipe(
+          Effect.retry({
+            while: (e) => (e as { _tag?: string })?._tag !== "ConfigError",
+            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+
+      // Binding selector: with no condition, ONLY the unconditional
+      // binding for `role` (conditional bindings are someone else's);
+      // with a condition, the binding whose expression matches
+      // byte-for-byte — title/description deliberately ignored so
+      // hand-applied grants with the same expression are adopted.
+      const bindingMatches = (
+        b: { role?: string; condition?: { expression?: string } },
+        role: string,
+        condition?: StorageBucketIamMemberCondition,
+      ) =>
+        b.role === role &&
+        (condition
+          ? b.condition?.expression === condition.expression
+          : !b.condition);
+
+      const hasMember = (
+        policy: storage.Policy,
+        role: string,
+        member: string,
+        condition?: StorageBucketIamMemberCondition,
+      ) =>
+        (policy.bindings ?? []).some(
+          (b) =>
+            bindingMatches(b, role, condition) &&
+            (b.members ?? []).includes(member),
+        );
+
+      return {
+        // Identity IS the tuple; all fields are static values.
+        stables: ["bucket", "role", "member", "condition"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          // Prior identity from persisted attributes first, then olds —
+          // mirrors Bucket.ts (`output?.name || olds.name`). `||`, not
+          // `??`: an empty string in a partially-persisted attribute is
+          // NOT a prior identity — treating it as one would force a
+          // spurious replace whose delete targets the wrong (empty)
+          // identity. If only `output` survives (e.g. props were lost),
+          // a changed triple must still replace, or the old member is
+          // never revoked.
+          const priorBucket = output?.bucket || olds.bucket;
+          const priorRole = output?.role || olds.role;
+          const priorMember = output?.member || olds.member;
+          if (
+            (priorBucket && priorBucket !== news.bucket) ||
+            (priorRole && priorRole !== news.role) ||
+            (priorMember && priorMember !== news.member)
+          ) {
+            return { action: "replace" } as const;
+          }
+          // Condition expression is identity too — but only when a prior
+          // identity exists at all (a partially-persisted record with no
+          // bucket names no grant to revoke). Absent condition compares
+          // as "" so unconditional↔conditional flips replace, while a
+          // 0.10.x record (no condition attribute) vs. unconditional
+          // props stays a no-op.
+          const priorCond =
+            output?.condition?.expression ?? olds.condition?.expression ?? "";
+          const newsCond = news.condition?.expression ?? "";
+          if (priorBucket && priorCond !== newsCond) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+          yield* etagRetry(
+            Effect.gen(function* () {
+              const current = yield* getIamPolicyBuckets({
+                bucket: news.bucket,
+                optionsRequestedPolicyVersion: 3,
+              }).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.fail(
+                    new ConfigError({
+                      message: `Bucket ${news.bucket} does not exist — StorageBucketIamMember grants on pre-existing buckets only.`,
+                    }),
+                  ),
+                ),
+              );
+              if (hasMember(current, news.role, news.member, news.condition)) {
+                return;
+              }
+
+              const bindings = (current.bindings ?? []).map((b) => ({
+                ...b,
+                members: [...(b.members ?? [])],
+              }));
+              const existing = bindings.find((b) =>
+                bindingMatches(b, news.role, news.condition),
+              );
+              if (existing) {
+                existing.members = [...(existing.members ?? []), news.member];
+              } else {
+                bindings.push({
+                  role: news.role,
+                  members: [news.member],
+                  ...(news.condition
+                    ? {
+                        condition: {
+                          title: news.condition.title,
+                          ...(news.condition.description
+                            ? { description: news.condition.description }
+                            : {}),
+                          expression: news.condition.expression,
+                        },
+                      }
+                    : {}),
+                });
+              }
+              yield* setIamPolicyBuckets({
+                bucket: news.bucket,
+                body: { ...current, bindings, version: 3 },
+              });
+            }),
+          );
+          return {
+            bucket: news.bucket,
+            role: news.role,
+            member: news.member,
+            ...(news.condition ? { condition: news.condition } : {}),
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          // Partially-persisted attributes (empty fields) name no real
+          // grant — nothing to revoke, and getIamPolicy("") would 4xx.
+          if (!output.bucket || !output.role || !output.member) return;
+          yield* etagRetry(
+            Effect.gen(function* () {
+              const current = yield* getIamPolicyBuckets({
+                bucket: output.bucket,
+                optionsRequestedPolicyVersion: 3,
+              }).pipe(
+                // Bucket gone (or unreadable because gone) — the grant
+                // went with it; idempotent success.
+                Effect.catchTag("NotFound", () =>
+                  Effect.succeed(undefined as storage.Policy | undefined),
+                ),
+              );
+              if (
+                !current ||
+                !hasMember(current, output.role, output.member, output.condition)
+              ) {
+                return;
+              }
+              // Remove exactly our member from the matched binding;
+              // drop the binding entirely if that empties it (GCS rejects
+              // bindings with zero members).
+              const bindings = (current.bindings ?? [])
+                .map((b) =>
+                  bindingMatches(b, output.role, output.condition)
+                    ? {
+                        ...b,
+                        members: (b.members ?? []).filter(
+                          (m) => m !== output.member,
+                        ),
+                      }
+                    : { ...b, members: [...(b.members ?? [])] },
+                )
+                .filter((b) => (b.members?.length ?? 0) > 0);
+              yield* setIamPolicyBuckets({
+                bucket: output.bucket,
+                body: { ...current, bindings, version: 3 },
+              }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const bucket = output?.bucket ?? olds?.bucket;
+          const role = output?.role ?? olds?.role;
+          const member = output?.member ?? olds?.member;
+          const condition = output?.condition ?? olds?.condition;
+          if (!bucket || !role || !member) return undefined;
+          const current = yield* getIamPolicyBuckets({
+            bucket,
+            optionsRequestedPolicyVersion: 3,
+          }).pipe(
+            Effect.catchTag("NotFound", () =>
+              Effect.succeed(undefined as storage.Policy | undefined),
+            ),
+            Effect.catchTag("Forbidden", () =>
+              Effect.succeed(undefined as storage.Policy | undefined),
+            ),
+          );
+          if (!current) return undefined;
+          // Absent member → undefined: the engine treats that as drift
+          // and the next plan re-grants.
+          if (!hasMember(current, role, member, condition)) return undefined;
+          return {
+            bucket,
+            role,
+            member,
+            ...(condition ? { condition } : {}),
+          };
+        }),
+      };
+    }),
+  );

package/src/Storage/index.ts

@@ -8,3 +8,12 @@ export type {
   StorageBucketBindingContract,
 } from "./Bucket.ts";
 export * from "./BucketIamMember.ts";
+export {
+  StorageBucketIamMember,
+  StorageBucketIamMemberProvider,
+} from "./StorageBucketIamMember.ts";
+export type {
+  StorageBucketIamMemberProps,
+  StorageBucketIamMemberAttributes,
+  StorageBucketIamMemberCondition,
+} from "./StorageBucketIamMember.ts";