@microagi/alchemy-gcp 0.1.2

package/src/Compute/GlobalAddress.ts

@@ -0,0 +1,283 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitGlobalOperation } from "./Operations.ts";
+
+/**
+ * A global compute Address. The intended use here is **Private Services
+ * Access (PSA)** — reserving an internal IP range that
+ * `servicenetworking.services.connections.create` consumes to peer
+ * Google's service-producer VPC into the host VPC. That requires the
+ * specific shape `addressType=INTERNAL`, `purpose=VPC_PEERING`,
+ * `network=<vpc selfLink>`, plus an explicit `prefixLength`.
+ *
+ * Other purposes (`PRIVATE_SERVICE_CONNECT`, `GCE_ENDPOINT`, regional
+ * external addresses) are not modelled in this resource — add them in
+ * separate resources if/when needed.
+ *
+ * Adoption uses the labels field (Address carries `labels` +
+ * `labelFingerprint`).
+ *
+ * @section Reserving a PSA range
+ * @example /20 reserved for `servicenetworking.googleapis.com`
+ * ```typescript
+ * const psaRange = yield* GCP.GlobalAddress("PsaRange", {
+ *   project: hostProject.projectId,
+ *   network: vpc.selfLink,
+ *   purpose: "VPC_PEERING",
+ *   addressType: "INTERNAL",
+ *   prefixLength: 20,
+ * });
+ * ```
+ */
+export type GlobalAddressProps = {
+  /** GCP project ID hosting the address. Immutable — replace if changed. */
+  project: string;
+  /**
+   * Address name. Defaults to `createPhysicalName({ id, lowercase: true,
+   * maxLength: 63 })`. Immutable — replace if changed.
+   */
+  name?: string;
+  /** Description (free-form). */
+  description?: string;
+  /**
+   * Internal vs external. Defaults to `INTERNAL` (the only value that
+   * makes sense for a PSA reservation). Immutable — replace.
+   */
+  addressType?: "INTERNAL" | "EXTERNAL";
+  /**
+   * Address purpose. For PSA use `VPC_PEERING`. Immutable — replace.
+   */
+  purpose?:
+    | "VPC_PEERING"
+    | "GCE_ENDPOINT"
+    | "PRIVATE_SERVICE_CONNECT"
+    | "DNS_RESOLVER";
+  /**
+   * URL of the VPC the address belongs to (PSA requires this).
+   * Immutable — replace.
+   */
+  network?: string;
+  /**
+   * Prefix length for a range allocation (PSA always allocates a
+   * range, not a single address). Required for `purpose=VPC_PEERING`.
+   * Immutable — replace.
+   */
+  prefixLength?: number;
+  /**
+   * Explicit address (or first address of the range) to reserve. If
+   * omitted, GCP picks one inside the VPC's available space.
+   * Immutable — replace.
+   */
+  address?: string;
+  /**
+   * Resource labels. Alchemy internal labels (`alchemy_app`,
+   * `alchemy_stage`, `alchemy_id`) are merged on top automatically and
+   * are reserved. Mutable via `setLabels`.
+   */
+  labels?: Record<string, string>;
+};
+
+export type GlobalAddressAttributes = {
+  /** Address name. */
+  name: string;
+  /** GCP project ID, threaded through from props for delete/read. */
+  project: string;
+  /** Server-defined URL. */
+  selfLink: string;
+  /** Server-assigned numeric id. */
+  id: string;
+  /** The reserved IP (or first IP of the range). */
+  address: string;
+  /** Prefix length, when reserving a range. */
+  prefixLength: number | undefined;
+  /** Address type. */
+  addressType: string | undefined;
+  /** Purpose. */
+  purpose: string | undefined;
+  /** VPC URL. */
+  network: string | undefined;
+  /** Status: `RESERVING`, `RESERVED`, `IN_USE`. */
+  status: string | undefined;
+  /** Labels currently set, including the alchemy internals. */
+  labels: Record<string, string>;
+};
+
+export type GlobalAddress = Resource<
+  "GCP.GlobalAddress",
+  GlobalAddressProps,
+  GlobalAddressAttributes,
+  never,
+  GCP.Providers
+>;
+export const GlobalAddress = Resource<GlobalAddress>("GCP.GlobalAddress");
+
+const toGlobalAddressAttributes = (
+  a: compute.Address,
+  parent: { project: string },
+): GlobalAddressAttributes => ({
+  name: a.name ?? "",
+  project: parent.project,
+  selfLink: a.selfLink ?? "",
+  id: a.id ?? "",
+  address: a.address ?? "",
+  prefixLength: a.prefixLength,
+  addressType: a.addressType,
+  purpose: a.purpose,
+  network: a.network,
+  status: a.status,
+  labels: { ...(a.labels ?? {}) },
+});
+
+export const GlobalAddressProvider = () =>
+  Provider.effect(
+    GlobalAddress,
+    Effect.gen(function* () {
+      const getGlobalAddresses = yield* compute.getGlobalAddresses;
+      const insertGlobalAddresses = yield* compute.insertGlobalAddresses;
+      const deleteGlobalAddresses = yield* compute.deleteGlobalAddresses;
+      const setLabelsGlobalAddresses = yield* compute.setLabelsGlobalAddresses;
+      const getGlobalOperations = yield* compute.getGlobalOperations;
+      const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+
+      const observe = (project: string, name: string) =>
+        getGlobalAddresses({ project, address: name }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Address | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Address | undefined),
+          ),
+        );
+
+      const syncLabels = Effect.fn(function* (args: {
+        project: string;
+        observed: compute.Address;
+        desired: Record<string, string>;
+        session: ScopedPlanStatusSession;
+      }) {
+        if (deepEqual(args.observed.labels ?? {}, args.desired)) return;
+        const op = yield* setLabelsGlobalAddresses({
+          project: args.project,
+          resource: args.observed.name ?? "",
+          body: {
+            labels: args.desired,
+            labelFingerprint: args.observed.labelFingerprint,
+          },
+        });
+        if (op.name) yield* awaitOp(args.project, op.name, args.session);
+      });
+
+      return {
+        stables: ["name", "project", "selfLink", "id", "address"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            somePropsAreDifferent(olds as GlobalAddressProps, news, [
+              "project",
+              "name",
+              "addressType",
+              "purpose",
+              "network",
+              "prefixLength",
+              "address",
+            ])
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const internalLabels = yield* gcpInternalLabels(id);
+          const desiredName =
+            news.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const desiredLabels: Record<string, string> = {
+            ...(news.labels ?? {}),
+            ...internalLabels,
+          };
+
+          let observed = yield* observe(news.project, desiredName);
+
+          if (!observed) {
+            const body: compute.Address = {
+              name: desiredName,
+              ...(news.description ? { description: news.description } : {}),
+              addressType: news.addressType ?? "INTERNAL",
+              ...(news.purpose ? { purpose: news.purpose } : {}),
+              ...(news.network ? { network: news.network } : {}),
+              ...(news.prefixLength !== undefined
+                ? { prefixLength: news.prefixLength }
+                : {}),
+              ...(news.address ? { address: news.address } : {}),
+              labels: desiredLabels,
+            };
+            const op = yield* insertGlobalAddresses({
+              project: news.project,
+              body,
+            }).pipe(
+              Effect.catchTag("Conflict", () =>
+                Effect.succeed(undefined as compute.Operation | undefined),
+              ),
+            );
+            if (op?.name) yield* awaitOp(news.project, op.name, session);
+            observed = yield* getGlobalAddresses({
+              project: news.project,
+              address: desiredName,
+            });
+          }
+
+          yield* syncLabels({
+            project: news.project,
+            observed,
+            desired: desiredLabels,
+            session,
+          });
+
+          const final = yield* getGlobalAddresses({
+            project: news.project,
+            address: desiredName,
+          });
+          return toGlobalAddressAttributes(final, { project: news.project });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* deleteGlobalAddresses({
+            project: output.project,
+            address: output.name,
+          }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.project, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+            // 400 with "is being used by ..." comes back when a PSA
+            // connection still references the range. The user has to
+            // delete the connection first; surface the error rather
+            // than silently swallowing.
+          );
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const project = output?.project ?? olds?.project;
+          if (!project) return undefined;
+          const name =
+            output?.name ??
+            olds?.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const observed = yield* observe(project, name);
+          if (!observed) return undefined;
+          const attrs = toGlobalAddressAttributes(observed, { project });
+          return (yield* hasAlchemyLabels(id, observed.labels))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );

package/src/Compute/Network.ts

@@ -0,0 +1,306 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Output from "alchemy/Output";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import {
+  descriptionHasAlchemyMarker,
+  gcpAlchemyDescription,
+  stripAlchemyMarker,
+} from "../Tags.ts";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitGlobalOperation } from "./Operations.ts";
+
+/**
+ * Fully-qualified VPC reference in **project-number** form:
+ * `projects/{projectNumber}/global/networks/{name}`.
+ *
+ * Several GCP service-producer APIs (servicenetworking PSA,
+ * Parallelstore) require this exact shape — the *project number*, not
+ * project ID — because they resolve peerings against numeric ids that
+ * are stable across project renames. Compose with `networkRef`:
+ *
+ * ```typescript
+ * const ref = networkRef(project.projectNumber, vpc.name);
+ * // typed as Output<NetworkRef>, accepted by GCP.PsaConnection /
+ * // GCP.ParallelstoreInstance via the Resource constructor's
+ * // InputProps widening.
+ * ```
+ *
+ * `Project.projectNumber` is typed as `` `${number}` `` precisely so
+ * this template literal type composes without a runtime coercion at
+ * the call site.
+ */
+export type NetworkRef = `projects/${number}/global/networks/${string}`;
+
+/**
+ * Build a project-number-form `NetworkRef`. Lifted through `Output`
+ * so it composes with `Project.projectNumber` (an `Output<\`${number}\`>`)
+ * and `Network.name` (an `Output<string>`) coming from other resource
+ * constructors. The `` `${number}` `` argument type prevents
+ * accidentally passing `Project.projectId` here — TS rejects strings
+ * that don't match the numeric shape.
+ *
+ * Plain literal arguments still work: `networkRef("415104041262", "main")`
+ * is wrapped via `Output.asOutput` and resolves immediately at apply
+ * time.
+ */
+export const networkRef = (
+  projectNumber: `${number}` | Output.Output<`${number}`>,
+  networkName: string | Output.Output<string>,
+): Output.Output<NetworkRef> =>
+  Output.all(
+    Output.asOutput(projectNumber),
+    Output.asOutput(networkName),
+  ).pipe(
+    Output.map(
+      ([num, name]) =>
+        `projects/${num}/global/networks/${name}` as NetworkRef,
+    ),
+  );
+
+/**
+ * A VPC Network in custom-mode (`autoCreateSubnetworks=false`). Auto-mode
+ * networks are intentionally not exposed — every cluster/parallelstore
+ * deployment in this provider expects explicit subnets in known regions.
+ *
+ * Compute Networks have no `labels` field, so adoption gating uses an
+ * alchemy marker embedded in the `description` field instead (see
+ * `gcpAlchemyDescription`). Network `description` is set at create time
+ * and is treated as immutable — the marker survives for the resource's
+ * lifetime.
+ *
+ * @section Creating a VPC
+ * @example Custom-mode VPC for a Shared VPC host
+ * ```typescript
+ * const vpc = yield* GCP.Network("ResearchVpc", {
+ *   project: hostProject.projectId,
+ *   routingMode: "GLOBAL",
+ * });
+ * ```
+ */
+export type NetworkProps = {
+  /** GCP project ID hosting the network. Immutable — replace if changed. */
+  project: string;
+  /**
+   * Network name. Defaults to `createPhysicalName({ id, lowercase: true,
+   * maxLength: 63 })`. Must match `[a-z]([-a-z0-9]*[a-z0-9])?`.
+   * Immutable — replace if changed.
+   */
+  name?: string;
+  /**
+   * User-visible description. Stored in the resource's `description`
+   * field after the alchemy ownership marker prefix. Treated as
+   * immutable by GCP after create — changes here do NOT replace.
+   */
+  description?: string;
+  /**
+   * `auto` mode: GCP allocates one subnet per region with predetermined
+   * CIDRs. `custom` mode (default): you create subnetworks explicitly
+   * via `GCP.Subnetwork`. Immutable — switching modes requires replace.
+   */
+  autoCreateSubnetworks?: boolean;
+  /**
+   * Network-wide routing config. Cloud Routers in REGIONAL mode advertise
+   * only same-region subnets; GLOBAL mode advertises across regions.
+   * Mutable via `patchNetworks` (the only field GCP allows mutating
+   * post-create on a VPC).
+   */
+  routingMode?: "REGIONAL" | "GLOBAL";
+  /**
+   * MTU in bytes. Range 1300-8896. Defaults to 1460. Common values:
+   * 1500 (internet default), 8896 (jumbo frames). Immutable — replace.
+   */
+  mtu?: number;
+};
+
+export type NetworkAttributes = {
+  /** Network name. */
+  name: string;
+  /** GCP project ID, threaded through from props for delete/read. */
+  project: string;
+  /** Server-defined URL for the resource. */
+  selfLink: string;
+  /** Server-assigned numeric id. */
+  id: string;
+  /** User-visible description (with the alchemy marker stripped off). */
+  description: string | undefined;
+  /** Custom (false) vs auto (true) subnet mode. */
+  autoCreateSubnetworks: boolean;
+  /** Active routing mode. */
+  routingMode: string | undefined;
+  /** Active MTU in bytes. */
+  mtu: number | undefined;
+};
+
+export type Network = Resource<
+  "GCP.Network",
+  NetworkProps,
+  NetworkAttributes,
+  never,
+  GCP.Providers
+>;
+export const Network = Resource<Network>("GCP.Network");
+
+const toNetworkAttributes = (
+  n: compute.Network,
+  parent: { project: string },
+): NetworkAttributes => ({
+  name: n.name ?? "",
+  project: parent.project,
+  selfLink: n.selfLink ?? "",
+  id: n.id ?? "",
+  description: stripAlchemyMarker(n.description),
+  autoCreateSubnetworks: n.autoCreateSubnetworks ?? false,
+  routingMode: n.routingConfig?.routingMode,
+  mtu: n.mtu,
+});
+
+export const NetworkProvider = () =>
+  Provider.effect(
+    Network,
+    Effect.gen(function* () {
+      const getNetworks = yield* compute.getNetworks;
+      const insertNetworks = yield* compute.insertNetworks;
+      const patchNetworks = yield* compute.patchNetworks;
+      const deleteNetworks = yield* compute.deleteNetworks;
+      const getGlobalOperations = yield* compute.getGlobalOperations;
+      const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+
+      const observe = (project: string, name: string) =>
+        getNetworks({ project, network: name }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Network | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Network | undefined),
+          ),
+        );
+
+      const syncRoutingMode = Effect.fn(function* (args: {
+        project: string;
+        name: string;
+        observed: compute.Network;
+        desired: NetworkProps["routingMode"];
+        session: ScopedPlanStatusSession;
+      }) {
+        if (!args.desired) return;
+        if (args.observed.routingConfig?.routingMode === args.desired) return;
+        const op = yield* patchNetworks({
+          project: args.project,
+          network: args.name,
+          body: { routingConfig: { routingMode: args.desired } },
+        });
+        if (op.name) yield* awaitOp(args.project, op.name, args.session);
+      });
+
+      return {
+        stables: ["name", "project", "selfLink", "id"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            somePropsAreDifferent(olds as NetworkProps, news, [
+              "project",
+              "name",
+              "autoCreateSubnetworks",
+              "mtu",
+            ])
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const desiredName =
+            news.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const desiredDescription = yield* gcpAlchemyDescription(
+            id,
+            news.description,
+          );
+
+          // 1. Observe — collapse 403 to "missing" alongside 404.
+          let observed = yield* observe(news.project, desiredName);
+
+          // 2. Ensure — create if missing. `autoCreateSubnetworks`
+          //    defaults to *true* on the GCP side (auto-mode VPC), but
+          //    we default to false because every consumer in this
+          //    provider creates explicit subnets. `Conflict` covers
+          //    concurrent creates and state-persistence races.
+          if (!observed) {
+            const body: compute.Network = {
+              name: desiredName,
+              description: desiredDescription,
+              autoCreateSubnetworks: news.autoCreateSubnetworks ?? false,
+              ...(news.mtu !== undefined ? { mtu: news.mtu } : {}),
+              ...(news.routingMode
+                ? { routingConfig: { routingMode: news.routingMode } }
+                : {}),
+            };
+            const op = yield* insertNetworks({
+              project: news.project,
+              body,
+            }).pipe(
+              Effect.catchTag("Conflict", () =>
+                Effect.succeed(undefined as compute.Operation | undefined),
+              ),
+            );
+            if (op?.name) yield* awaitOp(news.project, op.name, session);
+            observed = yield* getNetworks({
+              project: news.project,
+              network: desiredName,
+            });
+          }
+
+          // 3. Sync — only routing config can be mutated post-create.
+          //    Description, MTU, autoCreateSubnetworks are all locked.
+          yield* syncRoutingMode({
+            project: news.project,
+            name: desiredName,
+            observed,
+            desired: news.routingMode,
+            session,
+          });
+
+          const final = yield* getNetworks({
+            project: news.project,
+            network: desiredName,
+          });
+          return toNetworkAttributes(final, { project: news.project });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* deleteNetworks({
+            project: output.project,
+            network: output.name,
+          }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.project, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const project = output?.project ?? olds?.project;
+          if (!project) return undefined;
+          const name =
+            output?.name ??
+            olds?.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const observed = yield* observe(project, name);
+          if (!observed) return undefined;
+          const attrs = toNetworkAttributes(observed, { project });
+          // Adoption gate via the description marker — networks have no
+          // labels field (verified against compute-v1 SDK Network type).
+          return (yield* descriptionHasAlchemyMarker(id, observed.description))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );

package/src/Compute/Operations.ts

@@ -0,0 +1,108 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Resolved callable signatures for the compute LRO getters. We hold both
+ * — global resources (networks, addresses with `addressType=INTERNAL`
+ * `purpose=VPC_PEERING`) emit Operations under
+ * `projects/{p}/global/operations/{op}`, while regional resources
+ * (subnetworks) emit Operations under
+ * `projects/{p}/regions/{r}/operations/{op}`. The `Operation.name`
+ * returned by the create/update/delete calls is a *bare* id (e.g.
+ * `operation-1700000000000-...`); callers thread back project (and
+ * region) at the await site.
+ */
+type GetGlobalOperations = Effect.Success<typeof compute.getGlobalOperations>;
+type GetRegionOperations = Effect.Success<typeof compute.getRegionOperations>;
+
+const formatOperationError = (op: compute.Operation): string => {
+  const errors = op.error?.errors ?? [];
+  if (errors.length === 0) return JSON.stringify(op.error ?? {});
+  return errors
+    .map((e) => `${e.code ?? "?"}${e.location ? ` @ ${e.location}` : ""}: ${e.message ?? "?"}`)
+    .join("; ");
+};
+
+const isDone = (op: compute.Operation): boolean => op.status === "DONE";
+
+const pollSchedule = (label: string, session: ScopedPlanStatusSession) =>
+  Schedule.exponential(Duration.seconds(2), 1.5).pipe(
+    Schedule.either(Schedule.spaced(Duration.seconds(15))),
+    // 80 × ≤15s ≈ 20 min — long enough for a network create (~1 min),
+    // a parallelstore-adjacent global op, or a 10-minute parallelstore
+    // delete (longest LRO observed in this provider's surface).
+    Schedule.both(Schedule.recurs(80)),
+    Schedule.tapOutput(() =>
+      session.note(`Waiting for Compute operation ${label}…`),
+    ),
+  );
+
+/**
+ * Build a poller for compute global operations
+ * (`projects/{p}/global/operations/{op}`). Same exponential-then-spaced
+ * schedule as the GKE poller.
+ */
+export const makeAwaitGlobalOperation = (getGlobalOperations: GetGlobalOperations) =>
+  Effect.fn(function* (
+    project: string,
+    operationName: string,
+    session: ScopedPlanStatusSession,
+  ) {
+    const label = `${project}/global/${operationName}`;
+    const op = yield* getGlobalOperations({ project, operation: operationName }).pipe(
+      Effect.flatMap((current) =>
+        isDone(current)
+          ? Effect.succeed(current)
+          : Effect.fail({ _tag: "OperationPending" as const }),
+      ),
+      Effect.retry({
+        while: (e: { _tag?: string }) => e?._tag === "OperationPending",
+        schedule: pollSchedule(label, session),
+      }),
+    );
+    if (op.error) {
+      return yield* new ConfigError({
+        message: `Compute global operation ${operationName} failed: ${formatOperationError(op)}`,
+      });
+    }
+    return op;
+  });
+
+/**
+ * Build a poller for compute regional operations
+ * (`projects/{p}/regions/{r}/operations/{op}`).
+ */
+export const makeAwaitRegionOperation = (getRegionOperations: GetRegionOperations) =>
+  Effect.fn(function* (
+    project: string,
+    region: string,
+    operationName: string,
+    session: ScopedPlanStatusSession,
+  ) {
+    const label = `${project}/${region}/${operationName}`;
+    const op = yield* getRegionOperations({
+      project,
+      region,
+      operation: operationName,
+    }).pipe(
+      Effect.flatMap((current) =>
+        isDone(current)
+          ? Effect.succeed(current)
+          : Effect.fail({ _tag: "OperationPending" as const }),
+      ),
+      Effect.retry({
+        while: (e: { _tag?: string }) => e?._tag === "OperationPending",
+        schedule: pollSchedule(label, session),
+      }),
+    );
+    if (op.error) {
+      return yield* new ConfigError({
+        message: `Compute region operation ${operationName} failed: ${formatOperationError(op)}`,
+      });
+    }
+    return op;
+  });