alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/lib/GCP/Container/Cluster.d.ts

@@ -41,6 +41,40 @@ export type ClusterProps = {
      * Subnetwork name or URL. Immutable — changing it replaces the cluster.
      */
     subnetwork?: string;
+    /**
+     * Alias-IP allocation for Pods and Services. Secondary range names and
+     * CIDRs are create-time topology, so changing this replaces the cluster.
+     * @default `{ useIpAliases: true }` (VPC-native)
+     */
+    ipAllocationPolicy?: container.IPAllocationPolicy;
+    /**
+     * Private control-plane and node networking. Changing private-node mode,
+     * the control-plane CIDR, or the private endpoint subnetwork replaces the
+     * cluster; `enablePrivateEndpoint` and `masterGlobalAccessConfig` update
+     * in place.
+     */
+    privateClusterConfig?: container.PrivateClusterConfig;
+    /**
+     * Networks allowed to reach the public control-plane endpoint.
+     */
+    masterAuthorizedNetworksConfig?: container.MasterAuthorizedNetworksConfig;
+    /**
+     * Cluster datapath implementation (`LEGACY_DATAPATH` or
+     * `ADVANCED_DATAPATH` for Dataplane V2).
+     */
+    datapathProvider?: container.NetworkConfigDatapathProviderEnum;
+    /**
+     * Enable Shielded GKE Nodes.
+     */
+    enableShieldedNodes?: boolean;
+    /**
+     * GKE addon configuration (HTTP load balancing, network policy, …).
+     */
+    addonsConfig?: container.AddonsConfig;
+    /**
+     * Fine-grained cost allocation configuration.
+     */
+    costManagementConfig?: container.CostManagementConfig;
     /**
      * Create an Autopilot cluster. Immutable — changing it replaces the
      * cluster. Node pool props (`initialNodeCount`, `machineType`, …) are
@@ -57,10 +91,18 @@ export type ClusterProps = {
      * Logging service (`logging.googleapis.com/kubernetes` or `none`).
      */
     loggingService?: string;
+    /**
+     * Components exported through Cloud Logging.
+     */
+    loggingConfig?: container.LoggingConfig;
     /**
      * Monitoring service (`monitoring.googleapis.com/kubernetes` or `none`).
      */
     monitoringService?: string;
+    /**
+     * Components exported through Cloud Monitoring.
+     */
+    monitoringConfig?: container.MonitoringConfig;
     /**
      * Enable Kubernetes alpha APIs. The cluster is deleted after 30 days
      * and has no SLA. Immutable — changing it replaces the cluster.
@@ -77,42 +119,74 @@ export type ClusterProps = {
      */
     nodeLocations?: string[];
     /**
-     * Initial node count for the default pool. Ignored on Autopilot.
-     * Immutable — changing it replaces the cluster.
+     * Initial node count for the default pool. Ignored on Autopilot, and on
+     * update when `removeDefaultNodePool` is set. Otherwise immutable —
+     * changing it replaces the cluster.
      * @default 1
      */
     initialNodeCount?: number;
     /**
-     * Machine type for the default pool. Ignored on Autopilot. Immutable —
-     * changing it replaces the cluster.
+     * Machine type for the default pool. Ignored on Autopilot, and on update
+     * when `removeDefaultNodePool` is set. Otherwise immutable — changing it
+     * replaces the cluster.
      * @default "e2-medium"
      */
     machineType?: string;
     /**
-     * Boot disk size in GB for the default pool. Ignored on Autopilot.
-     * Immutable — changing it replaces the cluster.
+     * Boot disk size in GB for the default pool. Ignored on Autopilot, and on
+     * update when `removeDefaultNodePool` is set. Otherwise immutable —
+     * changing it replaces the cluster.
      * @default 20
      */
     diskSizeGb?: number;
     /**
      * Boot disk type for the default pool (`pd-standard`, `pd-balanced`,
-     * `pd-ssd`). Ignored on Autopilot. Immutable — changing it replaces
-     * the cluster.
+     * `pd-ssd`). Ignored on Autopilot, and on update when
+     * `removeDefaultNodePool` is set. Otherwise immutable — changing it
+     * replaces the cluster.
      * @default "pd-standard"
      */
     diskType?: string;
     /**
-     * Use Spot VMs for the default pool. Ignored on Autopilot. Immutable —
-     * changing it replaces the cluster.
+     * Use Spot VMs for the default pool. Ignored on Autopilot, and on update
+     * when `removeDefaultNodePool` is set. Otherwise immutable — changing it
+     * replaces the cluster.
      * @default false
      */
     spot?: boolean;
     /**
-     * Use preemptible VMs for the default pool. Ignored on Autopilot.
-     * Immutable — changing it replaces the cluster.
+     * Use preemptible VMs for the default pool. Ignored on Autopilot, and on
+     * update when `removeDefaultNodePool` is set. Otherwise immutable —
+     * changing it replaces the cluster.
      * @default false
      */
     preemptible?: boolean;
+    /**
+     * Service account email for the default pool's nodes. Changing it
+     * replaces the cluster unless `removeDefaultNodePool` is set.
+     */
+    serviceAccount?: string;
+    /**
+     * OAuth scopes for the default pool's nodes. Changing them replaces the
+     * cluster unless `removeDefaultNodePool` is set.
+     */
+    oauthScopes?: string[];
+    /**
+     * Delete GKE's bootstrap `default-pool` once the cluster is ready, so
+     * separately declared `NodePool` resources own every node. While set,
+     * the default-pool props above never replace the cluster. Turning it back
+     * off replaces the cluster, since GKE only creates `default-pool` at
+     * cluster creation.
+     * @default false
+     */
+    removeDefaultNodePool?: boolean;
+    /**
+     * Refuse replacement and destruction while set. A change that would
+     * replace a protected cluster fails at plan time, so disable protection
+     * in its own deploy first. Account-wide `nuke` bypasses this guard.
+     * @default false
+     */
+    deletionProtection?: boolean;
 };
 export type Cluster = Resource<"GCP.Container.Cluster", ClusterProps, {
     /** Full resource name `projects/{project}/locations/{location}/clusters/{cluster}`. */
@@ -160,10 +234,28 @@ export type Cluster = Resource<"GCP.Container.Cluster", ClusterProps, {
     network: string | undefined;
     /** Subnetwork. */
     subnetwork: string | undefined;
+    /** Alias-IP allocation. */
+    ipAllocationPolicy: container.IPAllocationPolicy | undefined;
+    /** Private-cluster configuration. */
+    privateClusterConfig: container.PrivateClusterConfig | undefined;
+    /** Control-plane authorized networks. */
+    masterAuthorizedNetworksConfig: container.MasterAuthorizedNetworksConfig | undefined;
+    /** Datapath provider (omitted by GKE for `LEGACY_DATAPATH`). */
+    datapathProvider: string | undefined;
+    /** Whether Shielded GKE Nodes are enabled. */
+    enableShieldedNodes: boolean;
+    /** GKE addon configuration. */
+    addonsConfig: container.AddonsConfig | undefined;
+    /** Fine-grained cost allocation configuration. */
+    costManagementConfig: container.CostManagementConfig | undefined;
     /** Logging service. */
     loggingService: string | undefined;
+    /** Cloud Logging component configuration. */
+    loggingConfig: container.LoggingConfig | undefined;
     /** Monitoring service. */
     monitoringService: string | undefined;
+    /** Cloud Monitoring component configuration. */
+    monitoringConfig: container.MonitoringConfig | undefined;
     /** Whether Autopilot is enabled. */
     autopilot: boolean;
     /** Whether Kubernetes alpha APIs are enabled. */
@@ -183,11 +275,14 @@ export type Cluster = Resource<"GCP.Container.Cluster", ClusterProps, {
  * A Google Kubernetes Engine cluster.
  *
  * Changing `clusterId`, `location`, `description`, `network`,
- * `subnetwork`, `autopilot`, `enableKubernetesAlpha`, or default-pool
- * node shape (`initialNodeCount`, `machineType`, `diskSizeGb`,
- * `diskType`, `spot`, `preemptible`) replaces the cluster. Labels,
- * logging/monitoring services, release channel, and node locations are
- * updated in place.
+ * `subnetwork`, `ipAllocationPolicy`, private-node topology, `autopilot`,
+ * `enableKubernetesAlpha`, or default-pool node shape
+ * (`initialNodeCount`, `machineType`, `diskSizeGb`, `diskType`, `spot`,
+ * `preemptible`, `serviceAccount`, `oauthScopes`) replaces the cluster —
+ * except that default-pool props are ignored on update while
+ * `removeDefaultNodePool` is set. Labels, endpoint access, Shielded Nodes,
+ * addons, datapath, logging/monitoring, cost management, release channel,
+ * and node locations update in place.
  *
  * Provisioning typically takes several minutes.
  *
@@ -209,6 +304,39 @@ export type Cluster = Resource<"GCP.Container.Cluster", ClusterProps, {
  * });
  * ```
  *
+ * ### Private Clusters
+ * **Example:** Private nodes, Dataplane V2, and separately managed pools
+ * ```typescript
+ * const nodes = yield* GCP.IAM.ServiceAccount("GkeNodes", {});
+ * const cluster = yield* GCP.Container.Cluster("App", {
+ *   network: network.networkName,
+ *   subnetwork: subnet.subnetworkName,
+ *   ipAllocationPolicy: {
+ *     useIpAliases: true,
+ *     clusterSecondaryRangeName: "pods",
+ *     servicesSecondaryRangeName: "services",
+ *   },
+ *   privateClusterConfig: {
+ *     enablePrivateNodes: true,
+ *     masterIpv4CidrBlock: "172.16.0.0/28",
+ *   },
+ *   masterAuthorizedNetworksConfig: {
+ *     enabled: true,
+ *     cidrBlocks: [{ cidrBlock: "203.0.113.0/24", displayName: "office" }],
+ *   },
+ *   datapathProvider: "ADVANCED_DATAPATH",
+ *   enableShieldedNodes: true,
+ *   serviceAccount: nodes.email,
+ *   removeDefaultNodePool: true,
+ *   deletionProtection: true,
+ * });
+ * yield* GCP.Container.NodePool("Workers", {
+ *   cluster: cluster.name,
+ *   serviceAccount: nodes.email,
+ *   shieldedInstanceConfig: { enableSecureBoot: true },
+ * });
+ * ```
+ *
  * ### Autopilot
  * **Example:** Regional Autopilot cluster
  * ```typescript
@@ -271,6 +399,13 @@ export declare class ClusterStillExists extends ClusterStillExists_base<{
     name: string;
 }> {
 }
+declare const ClusterDeletionProtected_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "GCP.Container.ClusterDeletionProtected";
+} & Readonly<A>;
+export declare class ClusterDeletionProtected extends ClusterDeletionProtected_base<{
+    name: string;
+}> {
+}
 export declare const ClusterProvider: () => import("effect/Layer").Layer<Provider.Provider<Cluster>, never, GcpEnvironment | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage | container.GcpOpContext>;
 export {};
 //# sourceMappingURL=Cluster.d.ts.map

package/lib/GCP/Container/Cluster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Cluster.d.ts","sourceRoot":"","sources":["../../../src/GCP/Container/Cluster.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mCAAmC,CAAC;AAM/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAiBjD,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;OAEG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,uBAAuB,EACvB,YAAY,EACZ;IACE,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;;;OAGG;IACH,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACzC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB;IACnB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uBAAuB;IACvB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2CAA2C;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,kCAAkC;IAClC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,EACD,uBAAuB,EACvB,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,eAAO,MAAM,OAAO,oDAA6C,CAAC;;;;AAElE,qBAAa,kBAAmB,SAAQ,wBAAqD;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;;;;AAEL,qBAAa,eAAgB,SAAQ,qBAAkD;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;;;;AAEL,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;;;;AAEL,qBAAa,kBAAmB,SAAQ,wBAAqD;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;AA2SL,eAAO,MAAM,eAAe,kLAoRxB,CAAC"}
+{"version":3,"file":"Cluster.d.ts","sourceRoot":"","sources":["../../../src/GCP/Container/Cluster.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mCAAmC,CAAC;AAM/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAUnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAiBjD,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC;IAClD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACtD;;OAEG;IACH,8BAA8B,CAAC,EAAE,SAAS,CAAC,8BAA8B,CAAC;IAC1E;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,iCAAiC,CAAC;IAC/D;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC,YAAY,CAAC;IACtC;;OAEG;IACH,oBAAoB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACtD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC;IACxC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;OAEG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,uBAAuB,EACvB,YAAY,EACZ;IACE,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;;;OAGG;IACH,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACzC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,qCAAqC;IACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB;IACnB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2BAA2B;IAC3B,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC7D,qCAAqC;IACrC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACjE,yCAAyC;IACzC,8BAA8B,EAAE,SAAS,CAAC,8BAA8B,GAAG,SAAS,CAAC;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,mBAAmB,EAAE,OAAO,CAAC;IAC7B,+BAA+B;IAC/B,YAAY,EAAE,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;IACjD,kDAAkD;IAClD,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACjE,uBAAuB;IACvB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,6CAA6C;IAC7C,aAAa,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,CAAC;IACnD,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gDAAgD;IAChD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACzD,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2CAA2C;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,kCAAkC;IAClC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,EACD,uBAAuB,EACvB,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgGG;AACH,eAAO,MAAM,OAAO,oDAA6C,CAAC;;;;AAElE,qBAAa,kBAAmB,SAAQ,wBAAqD;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;;;;AAEL,qBAAa,eAAgB,SAAQ,qBAAkD;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;;;;AAEL,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;;;;AAEL,qBAAa,kBAAmB,SAAQ,wBAAqD;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;;;;AAEL,qBAAa,wBAAyB,SAAQ,8BAE5C;IACA,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;AAyXL,eAAO,MAAM,eAAe,kLAibxB,CAAC"}

package/lib/GCP/Container/Cluster.js

@@ -3,7 +3,7 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import { Unowned } from "../../AdoptPolicy.js";
-import { isResolved } from "../../Diff.js";
+import { deepEqual, isResolved } from "../../Diff.js";
 import { deleteObjects, reconcileObjects } from "../../Kubernetes/internal/client.js";
 import {} from "../../Kubernetes/internal/objects.js";
 import { createPhysicalName } from "../../PhysicalName.js";
@@ -13,6 +13,7 @@ import { tagRecord } from "../../Tags.js";
 import { GcpEnvironment } from "../Environment.js";
 import { createInternalLabels, diffLabels, hasAlchemyLabels, stripInternalLabels, toLabels, } from "../Labels.js";
 import { waitForOperation as waitForGcpOperation } from "../Operation.js";
+import { matchesDesired } from "../Proto.js";
 import { apiServerEndpoint, gkeConnectionOf, makeGkeTransport, workloadPoolOf, } from "./KubernetesAdapter.js";
 // A zone, not a region: `GCP.Region` has no zone and a regional default would triple node count.
 const DEFAULT_LOCATION = "us-central1-a";
@@ -26,11 +27,14 @@ const MAX_NAME_LENGTH = 40;
  * A Google Kubernetes Engine cluster.
  *
  * Changing `clusterId`, `location`, `description`, `network`,
- * `subnetwork`, `autopilot`, `enableKubernetesAlpha`, or default-pool
- * node shape (`initialNodeCount`, `machineType`, `diskSizeGb`,
- * `diskType`, `spot`, `preemptible`) replaces the cluster. Labels,
- * logging/monitoring services, release channel, and node locations are
- * updated in place.
+ * `subnetwork`, `ipAllocationPolicy`, private-node topology, `autopilot`,
+ * `enableKubernetesAlpha`, or default-pool node shape
+ * (`initialNodeCount`, `machineType`, `diskSizeGb`, `diskType`, `spot`,
+ * `preemptible`, `serviceAccount`, `oauthScopes`) replaces the cluster —
+ * except that default-pool props are ignored on update while
+ * `removeDefaultNodePool` is set. Labels, endpoint access, Shielded Nodes,
+ * addons, datapath, logging/monitoring, cost management, release channel,
+ * and node locations update in place.
  *
  * Provisioning typically takes several minutes.
  *
@@ -52,6 +56,39 @@ const MAX_NAME_LENGTH = 40;
  * });
  * ```
  *
+ * ### Private Clusters
+ * **Example:** Private nodes, Dataplane V2, and separately managed pools
+ * ```typescript
+ * const nodes = yield* GCP.IAM.ServiceAccount("GkeNodes", {});
+ * const cluster = yield* GCP.Container.Cluster("App", {
+ *   network: network.networkName,
+ *   subnetwork: subnet.subnetworkName,
+ *   ipAllocationPolicy: {
+ *     useIpAliases: true,
+ *     clusterSecondaryRangeName: "pods",
+ *     servicesSecondaryRangeName: "services",
+ *   },
+ *   privateClusterConfig: {
+ *     enablePrivateNodes: true,
+ *     masterIpv4CidrBlock: "172.16.0.0/28",
+ *   },
+ *   masterAuthorizedNetworksConfig: {
+ *     enabled: true,
+ *     cidrBlocks: [{ cidrBlock: "203.0.113.0/24", displayName: "office" }],
+ *   },
+ *   datapathProvider: "ADVANCED_DATAPATH",
+ *   enableShieldedNodes: true,
+ *   serviceAccount: nodes.email,
+ *   removeDefaultNodePool: true,
+ *   deletionProtection: true,
+ * });
+ * yield* GCP.Container.NodePool("Workers", {
+ *   cluster: cluster.name,
+ *   serviceAccount: nodes.email,
+ *   shieldedInstanceConfig: { enableSecureBoot: true },
+ * });
+ * ```
+ *
  * ### Autopilot
  * **Example:** Regional Autopilot cluster
  * ```typescript
@@ -92,6 +129,8 @@ export class ClusterOperationFailed extends Data.TaggedError("GCP.Container.Clus
 }
 export class ClusterStillExists extends Data.TaggedError("GCP.Container.ClusterStillExists") {
 }
+export class ClusterDeletionProtected extends Data.TaggedError("GCP.Container.ClusterDeletionProtected") {
+}
 const lastSegment = (value) => {
     const trimmed = value.replace(/\/+$/, "");
     const parts = trimmed.split("/");
@@ -102,13 +141,21 @@ const normalizeChannel = (channel) => {
     const value = (channel ?? "").toUpperCase();
     return value === "UNSPECIFIED" || value.length === 0 ? "" : value;
 };
-const sameLocations = (left, right) => {
+/** Order- and case-insensitive set comparison for string lists. */
+const sameStrings = (left, right) => {
     if (left.length !== right.length)
         return false;
     const a = [...left].map((item) => item.toLowerCase()).sort();
     const b = [...right].map((item) => item.toLowerCase()).sort();
     return a.every((value, index) => value === b[index]);
 };
+const desiredIpAllocationPolicy = (policy) => ({ useIpAliases: true, ...policy });
+/** The create-time part of `privateClusterConfig`. */
+const privateTopology = (config) => ({
+    enablePrivateNodes: config?.enablePrivateNodes === true,
+    masterIpv4CidrBlock: config?.masterIpv4CidrBlock ?? "",
+    privateEndpointSubnetwork: config?.privateEndpointSubnetwork ?? "",
+});
 const rfc1035 = (name) => {
     let next = name
         .toLowerCase()
@@ -177,8 +224,17 @@ const toAttrs = (cluster, project, kubernetesObjects = []) => {
         labels: userLabels(cluster.resourceLabels),
         network: cluster.network,
         subnetwork: cluster.subnetwork,
+        ipAllocationPolicy: cluster.ipAllocationPolicy,
+        privateClusterConfig: cluster.privateClusterConfig,
+        masterAuthorizedNetworksConfig: cluster.masterAuthorizedNetworksConfig,
+        datapathProvider: cluster.networkConfig?.datapathProvider,
+        enableShieldedNodes: cluster.shieldedNodes?.enabled === true,
+        addonsConfig: cluster.addonsConfig,
+        costManagementConfig: cluster.costManagementConfig,
         loggingService: cluster.loggingService,
+        loggingConfig: cluster.loggingConfig,
         monitoringService: cluster.monitoringService,
+        monitoringConfig: cluster.monitoringConfig,
         autopilot: cluster.autopilot?.enabled === true,
         enableKubernetesAlpha: cluster.enableKubernetesAlpha === true,
         releaseChannel: cluster.releaseChannel?.channel,
@@ -255,6 +311,38 @@ const waitUntilGone = (name) => getByName(name).pipe(Effect.flatMap((cluster) =>
     while: (error) => error._tag === "GCP.Container.ClusterStillExists",
     schedule: clusterOperationSchedule,
 }));
+/**
+ * GKE rejects a delete (400 "Cluster is running incompatible operation")
+ * while a create/update is still in flight — e.g. a recovery delete after an
+ * interrupted create. Wait for the cluster to leave its transitional states
+ * first; a cluster that vanishes meanwhile is fine.
+ */
+const waitUntilSettled = (name) => getByName(name).pipe(Effect.filterOrFail((cluster) => {
+    const status = cluster?.status ?? "STATUS_UNSPECIFIED";
+    return status !== "PROVISIONING" && status !== "RECONCILING" && status !== "STOPPING";
+}, (cluster) => new ClusterNotReady({
+    name,
+    status: cluster?.status ?? "STATUS_UNSPECIFIED",
+})), Effect.retry({
+    while: (error) => error._tag === "GCP.Container.ClusterNotReady",
+    schedule: clusterOperationSchedule,
+}));
+/** Delete GKE's bootstrap `default-pool`; returns whether it existed. */
+const ensureDefaultPoolRemoved = (project, location, clusterName) => Effect.gen(function* () {
+    const operation = yield* container
+        .deleteProjectsLocationsClustersNodePools({
+        name: `${clusterName}/nodePools/${DEFAULT_POOL_NAME}`,
+    })
+        .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.retry({
+        while: (error) => error._tag === "Conflict",
+        times: 8,
+        schedule: Schedule.spaced("5 seconds"),
+    }));
+    if (operation === undefined)
+        return false;
+    yield* waitForOperation(project, location, operation, { notFoundOk: true });
+    return true;
+});
 const defaultPool = (news) => ({
     name: DEFAULT_POOL_NAME,
     initialNodeCount: news.initialNodeCount ?? DEFAULT_NODE_COUNT,
@@ -264,6 +352,8 @@ const defaultPool = (news) => ({
         diskType: news.diskType ?? DEFAULT_DISK_TYPE,
         spot: news.spot === true,
         preemptible: news.preemptible === true,
+        serviceAccount: news.serviceAccount,
+        oauthScopes: news.oauthScopes,
         workloadMetadataConfig: { mode: "GKE_METADATA" },
     },
 });
@@ -275,15 +365,23 @@ const toCreateBody = (news, clusterId, desiredLabels, autopilot, project) => {
         resourceLabels: desiredLabels,
         network: news.network,
         subnetwork: news.subnetwork,
+        ipAllocationPolicy: desiredIpAllocationPolicy(news.ipAllocationPolicy),
+        privateClusterConfig: news.privateClusterConfig,
+        masterAuthorizedNetworksConfig: news.masterAuthorizedNetworksConfig,
+        networkConfig: news.datapathProvider !== undefined ? { datapathProvider: news.datapathProvider } : undefined,
+        shieldedNodes: news.enableShieldedNodes !== undefined ? { enabled: news.enableShieldedNodes } : undefined,
+        addonsConfig: news.addonsConfig,
+        costManagementConfig: news.costManagementConfig,
         initialClusterVersion: news.initialClusterVersion,
         loggingService: news.loggingService,
+        loggingConfig: news.loggingConfig,
         monitoringService: news.monitoringService,
+        monitoringConfig: news.monitoringConfig,
         enableKubernetesAlpha: news.enableKubernetesAlpha === true,
         locations: news.nodeLocations,
         autopilot: autopilot ? { enabled: true } : undefined,
         workloadIdentityConfig: { workloadPool: workloadPoolOf(project) },
         releaseChannel: channel.length > 0 ? { channel: channel } : undefined,
-        ipAllocationPolicy: { useIpAliases: true },
         nodePools: autopilot ? undefined : [defaultPool(news)],
     };
 };
@@ -315,7 +413,32 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
         const nextAlpha = news.enableKubernetesAlpha === true;
         const previousDescription = olds?.description ?? output?.description ?? "";
         const nextDescription = news.description ?? previousDescription;
+        const previousServiceAccount = olds?.serviceAccount ?? "";
+        const nextServiceAccount = news.serviceAccount ?? previousServiceAccount;
+        const previousOauthScopes = olds?.oauthScopes ?? [];
+        const nextOauthScopes = news.oauthScopes ?? previousOauthScopes;
+        // Without previous props (adoption), compare against the observed
+        // cluster so declaring what already runs is not a replacement.
+        const ipAllocationChanged = olds !== undefined
+            ? !deepEqual(desiredIpAllocationPolicy(olds.ipAllocationPolicy), desiredIpAllocationPolicy(news.ipAllocationPolicy), { stripNullish: true })
+            : output !== undefined &&
+                !matchesDesired(output.ipAllocationPolicy, desiredIpAllocationPolicy(news.ipAllocationPolicy));
+        const privateTopologyChanged = news.privateClusterConfig !== undefined &&
+            (olds !== undefined
+                ? !deepEqual(privateTopology(olds.privateClusterConfig), privateTopology(news.privateClusterConfig))
+                : output !== undefined &&
+                    !matchesDesired(privateTopology(output.privateClusterConfig), privateTopology(news.privateClusterConfig)));
+        // Default-pool props only describe GKE's bootstrap `default-pool`.
+        // Once it is removed (before or after this change) they describe no
+        // live node and must not replace the cluster.
+        const defaultPoolKept = news.removeDefaultNodePool !== true && olds?.removeDefaultNodePool !== true;
+        // GKE only creates `default-pool` at cluster creation, so turning
+        // `removeDefaultNodePool` back off can only be honored by replacing.
+        const defaultPoolRestored = !nextAutopilot &&
+            olds?.removeDefaultNodePool === true &&
+            news.removeDefaultNodePool !== true;
         const nodeShapeChanged = !nextAutopilot &&
+            defaultPoolKept &&
             olds !== undefined &&
             ((olds.initialNodeCount ?? DEFAULT_NODE_COUNT) !==
                 (news.initialNodeCount ?? DEFAULT_NODE_COUNT) ||
@@ -325,7 +448,9 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
                 (olds.diskType ?? DEFAULT_DISK_TYPE).toLowerCase() !==
                     (news.diskType ?? DEFAULT_DISK_TYPE).toLowerCase() ||
                 (olds.spot === true) !== (news.spot === true) ||
-                (olds.preemptible === true) !== (news.preemptible === true));
+                (olds.preemptible === true) !== (news.preemptible === true) ||
+                previousServiceAccount !== nextServiceAccount ||
+                (news.oauthScopes !== undefined && !sameStrings(previousOauthScopes, nextOauthScopes)));
         const replace = (previousId !== undefined && nextId !== undefined && nextId !== previousId) ||
             previousLocation !== nextLocation ||
             previousAutopilot !== nextAutopilot ||
@@ -333,9 +458,21 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
             previousSubnetwork !== nextSubnetwork ||
             previousAlpha !== nextAlpha ||
             previousDescription !== nextDescription ||
+            ipAllocationChanged ||
+            privateTopologyChanged ||
+            defaultPoolRestored ||
             nodeShapeChanged;
         if (!replace)
             return undefined;
+        // A replacement deletes the old cluster with the OLD props, so it would
+        // create the new cluster and then strand on ClusterDeletionProtected.
+        // Fail at plan time instead. (Adoption has no previous props; the
+        // delete-side guard is the backstop there.)
+        if (olds?.deletionProtection === true) {
+            return yield* new ClusterDeletionProtected({
+                name: output?.name ?? previousId ?? nextId ?? "",
+            });
+        }
         return {
             action: "replace",
             deleteFirst: previousLocation === nextLocation && previousId !== undefined && nextId === previousId,
@@ -425,6 +562,11 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
         if (status !== "RUNNING" && status !== "DEGRADED") {
             live = yield* waitUntilReady(name);
         }
+        if (!autopilot && news.removeDefaultNodePool === true) {
+            const removed = yield* ensureDefaultPoolRemoved(env.project, location, name);
+            if (removed)
+                live = yield* waitUntilReady(name);
+        }
         const observedLabels = tagRecord(live.resourceLabels);
         const { upsert, removed } = diffLabels(observedLabels, desiredLabels);
         const labelsChanged = upsert.length > 0 || removed.length > 0;
@@ -460,24 +602,81 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
         const desiredChannel = normalizeChannel(news.releaseChannel);
         const observedChannel = normalizeChannel(live.releaseChannel?.channel);
         const desiredLocations = news.nodeLocations;
-        const locationsChanged = desiredLocations !== undefined && !sameLocations(live.locations ?? [], desiredLocations);
+        const locationsChanged = desiredLocations !== undefined && !sameStrings(live.locations ?? [], desiredLocations);
         const channelChanged = desiredChannel.length > 0 && desiredChannel !== observedChannel;
-        if (channelChanged || locationsChanged) {
-            const update = {};
-            if (channelChanged) {
-                update.desiredReleaseChannel = {
-                    channel: desiredChannel,
-                };
-            }
-            if (locationsChanged) {
-                update.desiredLocations = desiredLocations;
-            }
+        // GKE applies exactly one `desired*` field per update request.
+        const applyUpdate = (update) => Effect.gen(function* () {
             const updated = yield* container.updateProjectsLocationsClusters({
                 name,
                 body: { update },
             });
             yield* waitForOperation(env.project, location, updated);
-            live = yield* waitUntilReady(name);
+            return yield* waitUntilReady(name);
+        });
+        if (channelChanged) {
+            live = yield* applyUpdate({
+                desiredReleaseChannel: {
+                    channel: desiredChannel,
+                },
+            });
+        }
+        if (locationsChanged) {
+            live = yield* applyUpdate({ desiredLocations });
+        }
+        if (news.masterAuthorizedNetworksConfig !== undefined &&
+            !matchesDesired(live.masterAuthorizedNetworksConfig, news.masterAuthorizedNetworksConfig)) {
+            live = yield* applyUpdate({
+                desiredMasterAuthorizedNetworksConfig: news.masterAuthorizedNetworksConfig,
+            });
+        }
+        const desiredPrivateEndpoint = news.privateClusterConfig?.enablePrivateEndpoint;
+        if (desiredPrivateEndpoint !== undefined &&
+            !matchesDesired(live.privateClusterConfig, {
+                enablePrivateEndpoint: desiredPrivateEndpoint,
+            })) {
+            live = yield* applyUpdate({
+                desiredEnablePrivateEndpoint: desiredPrivateEndpoint,
+            });
+        }
+        const desiredMasterGlobalAccess = news.privateClusterConfig?.masterGlobalAccessConfig;
+        if (desiredMasterGlobalAccess !== undefined &&
+            !matchesDesired(live.privateClusterConfig?.masterGlobalAccessConfig, desiredMasterGlobalAccess)) {
+            live = yield* applyUpdate({
+                desiredPrivateClusterConfig: {
+                    masterGlobalAccessConfig: desiredMasterGlobalAccess,
+                },
+            });
+        }
+        if (news.enableShieldedNodes !== undefined &&
+            (live.shieldedNodes?.enabled === true) !== news.enableShieldedNodes) {
+            live = yield* applyUpdate({
+                desiredShieldedNodes: { enabled: news.enableShieldedNodes },
+            });
+        }
+        if (news.addonsConfig !== undefined &&
+            !matchesDesired(live.addonsConfig, news.addonsConfig)) {
+            live = yield* applyUpdate({ desiredAddonsConfig: news.addonsConfig });
+        }
+        if (news.datapathProvider !== undefined &&
+            // GKE omits the proto3 default, so an unset provider is LEGACY.
+            (live.networkConfig?.datapathProvider ?? "LEGACY_DATAPATH") !== news.datapathProvider) {
+            live = yield* applyUpdate({
+                desiredDatapathProvider: news.datapathProvider,
+            });
+        }
+        if (news.loggingConfig !== undefined &&
+            !matchesDesired(live.loggingConfig, news.loggingConfig)) {
+            live = yield* applyUpdate({ desiredLoggingConfig: news.loggingConfig });
+        }
+        if (news.monitoringConfig !== undefined &&
+            !matchesDesired(live.monitoringConfig, news.monitoringConfig)) {
+            live = yield* applyUpdate({ desiredMonitoringConfig: news.monitoringConfig });
+        }
+        if (news.costManagementConfig !== undefined &&
+            !matchesDesired(live.costManagementConfig, news.costManagementConfig)) {
+            live = yield* applyUpdate({
+                desiredCostManagementConfig: news.costManagementConfig,
+            });
         }
         const observedPool = live.workloadIdentityConfig?.workloadPool ?? "";
         if (observedPool !== desiredPool) {
@@ -500,7 +699,10 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
         });
         return { ...attrs, kubernetesObjects };
     }),
-    delete: Effect.fn(function* ({ output }) {
+    delete: Effect.fn(function* ({ olds, output, force }) {
+        if (olds.deletionProtection === true && force !== true) {
+            return yield* new ClusterDeletionProtected({ name: output.name });
+        }
         if ((output.kubernetesObjects ?? []).length > 0) {
             yield* deleteObjects({
                 transport: yield* getKubernetesTransport(output),
@@ -509,10 +711,12 @@ export const ClusterProvider = () => Provider.succeed(Cluster, {
         }
         const env = yield* GcpEnvironment.current;
         const location = normalizeLocation(output.location);
+        yield* waitUntilSettled(output.name);
         const operation = yield* container
             .deleteProjectsLocationsClusters({ name: output.name })
             .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.retry({
-            while: (error) => error._tag === "Conflict",
+            while: (error) => error._tag === "Conflict" ||
+                (error._tag === "BadRequest" && /incompatible operation/i.test(error.message)),
             times: 8,
             schedule: Schedule.spaced("5 seconds"),
         }));