puls-dev 0.2.1 → 0.2.2

package/dist/providers/gcp/iam.js

@@ -0,0 +1,309 @@
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { gcpFetch, getProjectId } from "./api.js";
+const IAM_BASE = "https://iam.googleapis.com";
+const CRM_BASE = "https://cloudresourcemanager.googleapis.com";
+export class GCPServiceAccountBuilder extends BaseBuilder {
+    out = {
+        email: new Output(),
+        name: new Output(),
+    };
+    _displayName;
+    _description;
+    constructor(accountId) {
+        super(accountId);
+        this.discoveryPromise = this.discoverServiceAccount();
+    }
+    get email() {
+        const project = getProjectId();
+        return `${this.name}@${project}.iam.gserviceaccount.com`;
+    }
+    displayName(name) {
+        this._displayName = name;
+        return this;
+    }
+    description(desc) {
+        this._description = desc;
+        return this;
+    }
+    async discoverServiceAccount() {
+        try {
+            const project = getProjectId();
+            const sa = await gcpFetch(IAM_BASE, `/v1/projects/${project}/serviceAccounts/${this.email}`);
+            if (sa) {
+                this.out.email.resolve(this.email);
+                this.out.name.resolve(sa.name ?? `projects/${project}/serviceAccounts/${this.email}`);
+            }
+            return sa;
+        }
+        catch (e) {
+            if (e.message?.includes("404") ||
+                e.message?.includes("403") ||
+                e.message?.includes("credentials not configured")) {
+                return null;
+            }
+            throw e;
+        }
+    }
+    async deploy() {
+        const dryRun = this.isDryRunActive();
+        const project = getProjectId();
+        const existing = await this.discoveryPromise;
+        console.log(`\n👤 Finalizing GCP Service Account "${this.name}"...`);
+        if (dryRun) {
+            if (existing) {
+                console.log(`   ✅ Service account "${this.name}" exists (email: ${this.email})`);
+                if (this._displayName || this._description) {
+                    console.log(`   📝 [PLAN] Update service account metadata`);
+                }
+            }
+            else {
+                console.log(`   📝 [PLAN] Create service account "${this.name}"`);
+            }
+            this.out.email.resolve(this.email);
+            this.out.name.resolve(`projects/${project}/serviceAccounts/${this.email}`);
+            return { email: this.email, name: `projects/${project}/serviceAccounts/${this.email}` };
+        }
+        if (!existing) {
+            console.log(`🚀 Creating GCP Service Account "${this.name}"...`);
+            const sa = await gcpFetch(IAM_BASE, `/v1/projects/${project}/serviceAccounts`, {
+                method: "POST",
+                body: JSON.stringify({
+                    accountId: this.name,
+                    serviceAccount: {
+                        displayName: this._displayName,
+                        description: this._description,
+                    },
+                }),
+            });
+            this.out.email.resolve(this.email);
+            this.out.name.resolve(sa.name ?? `projects/${project}/serviceAccounts/${this.email}`);
+            console.log(`   ✅ Service account created: ${this.email}`);
+        }
+        else {
+            console.log(`   ✅ Service account "${this.name}" exists`);
+            const needsUpdate = (this._displayName && existing.displayName !== this._displayName) ||
+                (this._description && existing.description !== this._description);
+            if (needsUpdate) {
+                console.log(`🔄 Updating GCP Service Account "${this.name}" metadata...`);
+                await gcpFetch(IAM_BASE, `/v1/projects/${project}/serviceAccounts/${this.email}`, {
+                    method: "PATCH",
+                    body: JSON.stringify({
+                        displayName: this._displayName,
+                        description: this._description,
+                    }),
+                });
+                console.log(`   ✅ Metadata updated.`);
+            }
+        }
+        await this.deploySidecars();
+        return {
+            email: this.email,
+            name: `projects/${project}/serviceAccounts/${this.email}`,
+        };
+    }
+    async destroy() {
+        const dryRun = this.isDryRunActive();
+        const project = getProjectId();
+        console.log(`\n🗑️  Destroying GCP Service Account "${this.name}"...`);
+        const existing = await this.discoverServiceAccount();
+        if (!existing) {
+            console.log(`   ✅ Service account "${this.name}" does not exist - nothing to do.`);
+            return { destroyed: this.name };
+        }
+        if (dryRun) {
+            console.log(`   📝 [PLAN] Delete service account "${this.name}" (${this.email})`);
+            return { destroyed: this.name };
+        }
+        await gcpFetch(IAM_BASE, `/v1/projects/${project}/serviceAccounts/${this.email}`, {
+            method: "DELETE",
+        });
+        console.log(`   ✅ Service account "${this.name}" deleted.`);
+        await this.destroySidecars();
+        return { destroyed: this.name };
+    }
+}
+export class GCPIAMBindingBuilder extends BaseBuilder {
+    _role;
+    _members = [];
+    constructor(name) {
+        super(name);
+        // Bindings are project-wide and dynamic, so discovery of project policy happens during deploy
+        this.discoveryPromise = Promise.resolve(null);
+    }
+    role(name) {
+        this._role = name;
+        return this;
+    }
+    member(m) {
+        this._members.push(m);
+        return this;
+    }
+    members(...m) {
+        this._members.push(...m);
+        return this;
+    }
+    async resolveMembers() {
+        const resolved = [];
+        for (const m of this._members) {
+            if (m instanceof GCPServiceAccountBuilder) {
+                resolved.push(`serviceAccount:${m.email}`);
+            }
+            else if (m instanceof Output) {
+                const val = await m.get();
+                resolved.push(val.includes(":") ? val : `serviceAccount:${val}`);
+            }
+            else {
+                const val = String(m);
+                if (val.includes(":")) {
+                    resolved.push(val);
+                }
+                else if (val.includes("@")) {
+                    if (val.endsWith(".gserviceaccount.com")) {
+                        resolved.push(`serviceAccount:${val}`);
+                    }
+                    else {
+                        resolved.push(`user:${val}`);
+                    }
+                }
+                else {
+                    const project = getProjectId();
+                    resolved.push(`serviceAccount:${val}@${project}.iam.gserviceaccount.com`);
+                }
+            }
+        }
+        return resolved;
+    }
+    async deploy() {
+        const dryRun = this.isDryRunActive();
+        const project = getProjectId();
+        console.log(`\n🔐 Finalizing GCP IAM Binding for Role "${this._role}"...`);
+        if (!this._role) {
+            throw new Error(`[GCP.IAMBinding:${this.name}] .role("...") is required`);
+        }
+        if (this._members.length === 0) {
+            throw new Error(`[GCP.IAMBinding:${this.name}] At least one member is required via .member()/.members()`);
+        }
+        const resolvedMembers = await this.resolveMembers();
+        // 1. Fetch current policy
+        let policy;
+        try {
+            policy = await gcpFetch(CRM_BASE, `/v1/projects/${project}:getIamPolicy`, {
+                method: "POST",
+                body: JSON.stringify({}),
+            });
+        }
+        catch (e) {
+            if (dryRun || e.message?.includes("credentials not configured")) {
+                policy = { bindings: [], etag: "DRYRUN_ETAG" };
+            }
+            else {
+                throw e;
+            }
+        }
+        const bindings = policy.bindings ?? [];
+        let binding = bindings.find((b) => b.role === this._role);
+        // 2. Compute members to add
+        const toAdd = [];
+        if (!binding) {
+            toAdd.push(...resolvedMembers);
+        }
+        else {
+            const existingMembers = binding.members ?? [];
+            for (const m of resolvedMembers) {
+                if (!existingMembers.includes(m)) {
+                    toAdd.push(m);
+                }
+            }
+        }
+        if (toAdd.length === 0) {
+            console.log(`   ✅ IAM binding for role "${this._role}" is up to date (members already bound)`);
+            return { role: this._role, bound: resolvedMembers };
+        }
+        if (dryRun) {
+            console.log(`   📝 [PLAN] Bind members [${toAdd.join(", ")}] to role "${this._role}"`);
+            return { role: this._role, bound: resolvedMembers };
+        }
+        // 3. Mutate policy safely
+        if (!binding) {
+            binding = { role: this._role, members: resolvedMembers };
+            bindings.push(binding);
+        }
+        else {
+            binding.members = [...(binding.members ?? []), ...toAdd];
+        }
+        policy.bindings = bindings;
+        // 4. Set updated policy with optimistic locking etag
+        await gcpFetch(CRM_BASE, `/v1/projects/${project}:setIamPolicy`, {
+            method: "POST",
+            body: JSON.stringify({
+                policy,
+            }),
+        });
+        console.log(`🚀 Successfully bound members [${toAdd.join(", ")}] to role "${this._role}"`);
+        await this.deploySidecars();
+        return {
+            role: this._role,
+            bound: resolvedMembers,
+        };
+    }
+    async destroy() {
+        const dryRun = this.isDryRunActive();
+        const project = getProjectId();
+        console.log(`\n🗑️  Removing GCP IAM Bindings for Role "${this._role}"...`);
+        if (!this._role) {
+            return { destroyed: this.name };
+        }
+        const resolvedMembers = await this.resolveMembers();
+        // 1. Fetch current policy
+        let policy;
+        try {
+            policy = await gcpFetch(CRM_BASE, `/v1/projects/${project}:getIamPolicy`, {
+                method: "POST",
+                body: JSON.stringify({}),
+            });
+        }
+        catch (e) {
+            if (dryRun || e.message?.includes("credentials not configured")) {
+                return { destroyed: this.name };
+            }
+            throw e;
+        }
+        const bindings = policy.bindings ?? [];
+        const binding = bindings.find((b) => b.role === this._role);
+        if (!binding) {
+            console.log(`   ✅ No bindings found for role "${this._role}" - nothing to do.`);
+            return { destroyed: this.name };
+        }
+        const existingMembers = binding.members ?? [];
+        const remaining = existingMembers.filter((m) => !resolvedMembers.includes(m));
+        const removed = existingMembers.filter((m) => resolvedMembers.includes(m));
+        if (removed.length === 0) {
+            console.log(`   ✅ Bound members already removed - nothing to do.`);
+            return { destroyed: this.name };
+        }
+        if (dryRun) {
+            console.log(`   📝 [PLAN] Remove members [${removed.join(", ")}] from role "${this._role}"`);
+            return { destroyed: this.name };
+        }
+        // 2. Safe removal
+        if (remaining.length === 0) {
+            // If no members left in this role, remove the role binding block completely
+            policy.bindings = bindings.filter((b) => b.role !== this._role);
+        }
+        else {
+            binding.members = remaining;
+            policy.bindings = bindings;
+        }
+        // 3. Set updated policy with etag
+        await gcpFetch(CRM_BASE, `/v1/projects/${project}:setIamPolicy`, {
+            method: "POST",
+            body: JSON.stringify({
+                policy,
+            }),
+        });
+        console.log(`   ✅ Removed members [${removed.join(", ")}] from role "${this._role}".`);
+        await this.destroySidecars();
+        return { destroyed: this.name };
+    }
+}

package/dist/providers/gcp/iam.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/providers/gcp/iam.test.js

@@ -0,0 +1,305 @@
+import { test, describe, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { GoogleAuth } from "google-auth-library";
+import { GCPServiceAccountBuilder, GCPIAMBindingBuilder } from "./iam.js";
+import { Config } from "../../core/config.js";
+import { Output } from "../../core/output.js";
+describe("GCP IAM Builders Unit Tests", () => {
+    let originalFetch;
+    let fetchCalls = [];
+    let mockResponses = {};
+    beforeEach(() => {
+        Config.set({
+            dryRun: false,
+            providers: {
+                gcp: {
+                    projectId: "my-gcp-project",
+                    serviceAccountPath: "/fake/sa.json",
+                    region: "us-central1",
+                },
+            },
+        });
+        originalFetch = globalThis.fetch;
+        fetchCalls = [];
+        mockResponses = {};
+        globalThis.fetch = async (input, init) => {
+            const url = String(input);
+            const method = init?.method ?? "GET";
+            let body;
+            if (init?.body) {
+                if (typeof init.body === "string") {
+                    try {
+                        body = JSON.parse(init.body);
+                    }
+                    catch {
+                        body = init.body;
+                    }
+                }
+                else {
+                    body = "[Binary/Buffer Body]";
+                }
+            }
+            const headers = init?.headers;
+            fetchCalls.push({ url, method, body, headers });
+            const matchKey = Object.keys(mockResponses)
+                .filter((key) => {
+                const [mMethod, mPath] = key.split(" ");
+                return method === mMethod && url.includes(mPath);
+            })
+                .sort((a, b) => b.split(" ")[1].length - a.split(" ")[1].length)[0];
+            if (matchKey) {
+                const resp = mockResponses[matchKey];
+                return {
+                    ok: resp.status >= 200 && resp.status < 300,
+                    status: resp.status,
+                    json: async () => resp.body,
+                    text: async () => JSON.stringify(resp.body),
+                };
+            }
+            return {
+                ok: false,
+                status: 404,
+                json: async () => ({ error: { message: `Endpoint not mocked: ${method} ${url}` } }),
+                text: async () => `Endpoint not mocked: ${method} ${url}`,
+            };
+        };
+        mock.method(GoogleAuth.prototype, "getClient", async () => {
+            return {
+                getAccessToken: async () => ({ token: "fake-gcp-token" }),
+            };
+        });
+    });
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+        mock.restoreAll();
+    });
+    describe("GCPServiceAccountBuilder Tests", () => {
+        test("generates email address correctly", () => {
+            const builder = new GCPServiceAccountBuilder("custom-sa");
+            assert.strictEqual(builder.email, "custom-sa@my-gcp-project.iam.gserviceaccount.com");
+        });
+        test("runs in dry-run mode safely without making API calls", async () => {
+            Config.set({
+                dryRun: true,
+                providers: {
+                    gcp: {
+                        projectId: "my-gcp-project",
+                        serviceAccountPath: "/fake/sa.json",
+                    },
+                },
+            });
+            mockResponses["GET /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 404,
+                body: {},
+            };
+            const builder = new GCPServiceAccountBuilder("custom-sa")
+                .displayName("Custom Display Name")
+                .description("Custom Description");
+            const result = await builder.deploy();
+            assert.strictEqual(result.email, "custom-sa@my-gcp-project.iam.gserviceaccount.com");
+            const writeCalls = fetchCalls.filter((c) => c.method !== "GET");
+            assert.strictEqual(writeCalls.length, 0);
+        });
+        test("creates service account when missing", async () => {
+            mockResponses["GET /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 404,
+                body: {},
+            };
+            mockResponses["POST /serviceAccounts"] = {
+                status: 200,
+                body: { name: "projects/my-gcp-project/serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com" },
+            };
+            const builder = new GCPServiceAccountBuilder("custom-sa")
+                .displayName("My Custom Display")
+                .description("My Custom Description");
+            const result = await builder.deploy();
+            assert.strictEqual(result.email, "custom-sa@my-gcp-project.iam.gserviceaccount.com");
+            // Verify POST call
+            const createCall = fetchCalls.find((c) => c.method === "POST" && c.url.includes("/serviceAccounts"));
+            assert.ok(createCall);
+            assert.strictEqual(createCall.body.accountId, "custom-sa");
+            assert.strictEqual(createCall.body.serviceAccount.displayName, "My Custom Display");
+            assert.strictEqual(createCall.body.serviceAccount.description, "My Custom Description");
+        });
+        test("patches existing service account if metadata differs", async () => {
+            mockResponses["GET /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 200,
+                body: {
+                    displayName: "Old Display",
+                    description: "Old Desc",
+                },
+            };
+            mockResponses["PATCH /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 200,
+                body: {},
+            };
+            const builder = new GCPServiceAccountBuilder("custom-sa")
+                .displayName("New Display")
+                .description("New Desc");
+            await builder.deploy();
+            const patchCall = fetchCalls.find((c) => c.method === "PATCH");
+            assert.ok(patchCall);
+            assert.strictEqual(patchCall.body.displayName, "New Display");
+            assert.strictEqual(patchCall.body.description, "New Desc");
+        });
+        test("skips patch if existing service account metadata is identical", async () => {
+            mockResponses["GET /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 200,
+                body: {
+                    displayName: "Same Display",
+                    description: "Same Desc",
+                },
+            };
+            const builder = new GCPServiceAccountBuilder("custom-sa")
+                .displayName("Same Display")
+                .description("Same Desc");
+            await builder.deploy();
+            const writeCalls = fetchCalls.filter((c) => c.method !== "GET");
+            assert.strictEqual(writeCalls.length, 0);
+        });
+        test("destroys service account successfully", async () => {
+            mockResponses["GET /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 200,
+                body: {},
+            };
+            mockResponses["DELETE /serviceAccounts/custom-sa@my-gcp-project.iam.gserviceaccount.com"] = {
+                status: 200,
+                body: {},
+            };
+            const builder = new GCPServiceAccountBuilder("custom-sa");
+            const result = await builder.destroy();
+            assert.deepStrictEqual(result, { destroyed: "custom-sa" });
+            const deleteCall = fetchCalls.find((c) => c.method === "DELETE");
+            assert.ok(deleteCall);
+        });
+    });
+    describe("GCPIAMBindingBuilder Tests", () => {
+        test("resolves member strings, builders, outputs and custom types correctly", async () => {
+            const saBuilder = new GCPServiceAccountBuilder("builder-sa");
+            const plainString = "user:bob@gmail.com";
+            const plainSaEmail = "test-sa@my-gcp-project.iam.gserviceaccount.com";
+            const plainSaId = "other-sa"; // auto-resolves to serviceAccount:other-sa@proj...
+            const outputEmail = new Output();
+            outputEmail.resolve("output-sa"); // auto-resolves to serviceAccount:output-sa
+            const binding = new GCPIAMBindingBuilder("test-binding")
+                .role("roles/viewer")
+                .members(plainString, saBuilder, plainSaEmail, plainSaId, outputEmail);
+            const resolved = await binding.resolveMembers();
+            assert.deepStrictEqual(resolved, [
+                "user:bob@gmail.com",
+                "serviceAccount:builder-sa@my-gcp-project.iam.gserviceaccount.com",
+                "serviceAccount:test-sa@my-gcp-project.iam.gserviceaccount.com",
+                "serviceAccount:other-sa@my-gcp-project.iam.gserviceaccount.com",
+                "serviceAccount:output-sa",
+            ]);
+        });
+        test("appends bound members non-destructively to an existing role binding", async () => {
+            // 1. Mock getIamPolicy returns existing policy
+            mockResponses["POST /projects/my-gcp-project:getIamPolicy"] = {
+                status: 200,
+                body: {
+                    etag: "version1",
+                    bindings: [
+                        {
+                            role: "roles/storage.objectViewer",
+                            members: ["user:alice@example.com"],
+                        },
+                    ],
+                },
+            };
+            // 2. Mock setIamPolicy
+            mockResponses["POST /projects/my-gcp-project:setIamPolicy"] = {
+                status: 200,
+                body: {},
+            };
+            const binding = new GCPIAMBindingBuilder("viewer-binding")
+                .role("roles/storage.objectViewer")
+                .member("user:bob@example.com");
+            await binding.deploy();
+            const setCall = fetchCalls.find((c) => c.method === "POST" && c.url.includes(":setIamPolicy"));
+            assert.ok(setCall);
+            assert.strictEqual(setCall.body.policy.etag, "version1"); // Etag lock!
+            const targetBinding = setCall.body.policy.bindings.find((b) => b.role === "roles/storage.objectViewer");
+            assert.ok(targetBinding);
+            // Non-destructive: both Alice and Bob are bound!
+            assert.deepStrictEqual(targetBinding.members, ["user:alice@example.com", "user:bob@example.com"]);
+        });
+        test("skips deploy if all members are already bound", async () => {
+            mockResponses["POST /projects/my-gcp-project:getIamPolicy"] = {
+                status: 200,
+                body: {
+                    etag: "version1",
+                    bindings: [
+                        {
+                            role: "roles/storage.objectViewer",
+                            members: ["user:alice@example.com", "user:bob@example.com"],
+                        },
+                    ],
+                },
+            };
+            const binding = new GCPIAMBindingBuilder("viewer-binding")
+                .role("roles/storage.objectViewer")
+                .members("user:alice@example.com", "user:bob@example.com");
+            await binding.deploy();
+            // No setIamPolicy should be called
+            const setCall = fetchCalls.find((c) => c.method === "POST" && c.url.includes(":setIamPolicy"));
+            assert.strictEqual(setCall, undefined);
+        });
+        test("destroys binding cleanly by removing only our declared members", async () => {
+            mockResponses["POST /projects/my-gcp-project:getIamPolicy"] = {
+                status: 200,
+                body: {
+                    etag: "version2",
+                    bindings: [
+                        {
+                            role: "roles/storage.admin",
+                            members: ["user:admin@company.com", "serviceAccount:to-prune@my-gcp-project.iam.gserviceaccount.com"],
+                        },
+                    ],
+                },
+            };
+            mockResponses["POST /projects/my-gcp-project:setIamPolicy"] = {
+                status: 200,
+                body: {},
+            };
+            const binding = new GCPIAMBindingBuilder("admin-binding")
+                .role("roles/storage.admin")
+                .member("to-prune"); // maps to serviceAccount:to-prune@my-gcp-project...
+            const result = await binding.destroy();
+            assert.deepStrictEqual(result, { destroyed: "admin-binding" });
+            const setCall = fetchCalls.find((c) => c.method === "POST" && c.url.includes(":setIamPolicy"));
+            assert.ok(setCall);
+            const targetBinding = setCall.body.policy.bindings.find((b) => b.role === "roles/storage.admin");
+            assert.ok(targetBinding);
+            // Pruned our member, left the other admin!
+            assert.deepStrictEqual(targetBinding.members, ["user:admin@company.com"]);
+        });
+        test("removes the entire role binding block if no members remain", async () => {
+            mockResponses["POST /projects/my-gcp-project:getIamPolicy"] = {
+                status: 200,
+                body: {
+                    etag: "version3",
+                    bindings: [
+                        {
+                            role: "roles/pubsub.publisher",
+                            members: ["serviceAccount:to-prune@my-gcp-project.iam.gserviceaccount.com"],
+                        },
+                    ],
+                },
+            };
+            mockResponses["POST /projects/my-gcp-project:setIamPolicy"] = {
+                status: 200,
+                body: {},
+            };
+            const binding = new GCPIAMBindingBuilder("pub-binding")
+                .role("roles/pubsub.publisher")
+                .member("to-prune");
+            await binding.destroy();
+            const setCall = fetchCalls.find((c) => c.method === "POST" && c.url.includes(":setIamPolicy"));
+            assert.ok(setCall);
+            // Entire block is deleted since no members remain
+            const targetBinding = setCall.body.policy.bindings.find((b) => b.role === "roles/pubsub.publisher");
+            assert.strictEqual(targetBinding, undefined);
+        });
+    });
+});

package/dist/providers/gcp/index.d.ts

@@ -0,0 +1,19 @@
+import { GCPCloudRunBuilder } from './cloudrun.js';
+import { GCPCloudSQLBuilder } from './cloudsql.js';
+import { GCPSecretBuilder, resolveGCPEnvVars } from './secrets.js';
+import { GCPPubSubTopicBuilder, GCPPubSubSubscriptionBuilder } from './pubsub.js';
+import { GCPCloudDNSZoneBuilder } from './clouddns.js';
+import { GCPServiceAccountBuilder, GCPIAMBindingBuilder } from './iam.js';
+export { GCPSecretBuilder, resolveGCPEnvVars, GCPPubSubTopicBuilder, GCPPubSubSubscriptionBuilder, GCPCloudDNSZoneBuilder, GCPServiceAccountBuilder, GCPIAMBindingBuilder };
+export declare const GCP: {
+    CloudRun: (serviceId: string) => GCPCloudRunBuilder;
+    CloudSQL: (instanceId: string) => GCPCloudSQLBuilder;
+    Secret: (secretId: string) => GCPSecretBuilder;
+    CloudDNS: (zoneName: string) => GCPCloudDNSZoneBuilder;
+    ServiceAccount: (saId: string) => GCPServiceAccountBuilder;
+    IAMBinding: (name: string) => GCPIAMBindingBuilder;
+    PubSub: {
+        Topic: (topicId: string) => GCPPubSubTopicBuilder;
+        Subscription: (subscriptionId: string) => GCPPubSubSubscriptionBuilder;
+    };
+};

package/dist/providers/gcp/index.js

@@ -0,0 +1,19 @@
+import { GCPCloudRunBuilder } from './cloudrun.js';
+import { GCPCloudSQLBuilder } from './cloudsql.js';
+import { GCPSecretBuilder, resolveGCPEnvVars } from './secrets.js';
+import { GCPPubSubTopicBuilder, GCPPubSubSubscriptionBuilder } from './pubsub.js';
+import { GCPCloudDNSZoneBuilder } from './clouddns.js';
+import { GCPServiceAccountBuilder, GCPIAMBindingBuilder } from './iam.js';
+export { GCPSecretBuilder, resolveGCPEnvVars, GCPPubSubTopicBuilder, GCPPubSubSubscriptionBuilder, GCPCloudDNSZoneBuilder, GCPServiceAccountBuilder, GCPIAMBindingBuilder };
+export const GCP = {
+    CloudRun: (serviceId) => new GCPCloudRunBuilder(serviceId),
+    CloudSQL: (instanceId) => new GCPCloudSQLBuilder(instanceId),
+    Secret: (secretId) => new GCPSecretBuilder(secretId),
+    CloudDNS: (zoneName) => new GCPCloudDNSZoneBuilder(zoneName),
+    ServiceAccount: (saId) => new GCPServiceAccountBuilder(saId),
+    IAMBinding: (name) => new GCPIAMBindingBuilder(name),
+    PubSub: {
+        Topic: (topicId) => new GCPPubSubTopicBuilder(topicId),
+        Subscription: (subscriptionId) => new GCPPubSubSubscriptionBuilder(subscriptionId),
+    },
+};