@microagi/alchemy-gcp 0.1.2

package/src/Compute/SharedVpcHost.ts

@@ -0,0 +1,141 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitGlobalOperation } from "./Operations.ts";
+
+/**
+ * Mark a GCP project as a Shared VPC **host**. Service projects can
+ * then attach to this host via `GCP.SharedVpcServiceProject` and use
+ * its VPC for clusters, VMs, etc.
+ *
+ * Identity: `(project)` — there's at most one host-status flag per
+ * project, so the resource is keyed by project ID alone. State is
+ * binary (host or not host), so there's no ownership concept; `read`
+ * returns plain attrs whenever the project's
+ * `xpnProjectStatus === "HOST"`.
+ *
+ * The `compute.googleapis.com` API must be enabled on the project
+ * before this resource succeeds — wire `project` through an
+ * `ApiEnable("compute.googleapis.com")` output to make alchemy
+ * sequence this resource after the API enable.
+ *
+ * @example
+ * ```typescript
+ * const computeApi = yield* GCP.ApiEnable("HostComputeApi", {
+ *   project: hostProject.projectId,
+ *   service: "compute.googleapis.com",
+ * });
+ * const host = yield* GCP.SharedVpcHost("ResearchHost", {
+ *   project: computeApi.project,
+ * });
+ * ```
+ */
+export type SharedVpcHostProps = {
+  /** GCP project ID to mark as a Shared VPC host. Immutable — replace. */
+  project: string;
+};
+
+export type SharedVpcHostAttributes = {
+  /** Project ID. */
+  project: string;
+  /** `"HOST"` once the enable completes. */
+  xpnProjectStatus: string;
+};
+
+export type SharedVpcHost = Resource<
+  "GCP.SharedVpcHost",
+  SharedVpcHostProps,
+  SharedVpcHostAttributes,
+  never,
+  GCP.Providers
+>;
+export const SharedVpcHost = Resource<SharedVpcHost>("GCP.SharedVpcHost");
+
+export const SharedVpcHostProvider = () =>
+  Provider.effect(
+    SharedVpcHost,
+    Effect.gen(function* () {
+      const getProjects = yield* compute.getProjects;
+      const enableXpnHostProjects = yield* compute.enableXpnHostProjects;
+      const disableXpnHostProjects = yield* compute.disableXpnHostProjects;
+      const getGlobalOperations = yield* compute.getGlobalOperations;
+      const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+
+      const observe = (project: string) =>
+        getProjects({ project }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Project | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Project | undefined),
+          ),
+        );
+
+      return {
+        stables: ["project"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (olds.project !== undefined && olds.project !== news.project) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const observed = yield* observe(news.project);
+          if (observed?.xpnProjectStatus === "HOST") {
+            return { project: news.project, xpnProjectStatus: "HOST" };
+          }
+          // `enableXpnHost` is idempotent on the GCP side when the
+          // project is already a host (returns a no-op operation), but
+          // we still tolerate `Conflict` defensively to cover the
+          // narrow window where state-persistence races with another
+          // reconciler.
+          const op = yield* enableXpnHostProjects({
+            project: news.project,
+          }).pipe(
+            Effect.catchTag("Conflict", () =>
+              Effect.succeed(undefined as compute.Operation | undefined),
+            ),
+          );
+          if (op?.name) yield* awaitOp(news.project, op.name, session);
+          return { project: news.project, xpnProjectStatus: "HOST" };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* disableXpnHostProjects({ project: output.project }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.project, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+            // `BadRequest` is returned when:
+            //   1. The project isn't a host (idempotent disable — fine).
+            //   2. Service projects are still attached. The user has
+            //      to detach them first; surface that error so they
+            //      can act. Only swallow case 1.
+            Effect.catchTag("BadRequest", (e) =>
+              /not.*host|not.*xpn|UNSPECIFIED_XPN_PROJECT_STATUS/i.test(
+                e.message ?? "",
+              )
+                ? Effect.void
+                : Effect.fail(e),
+            ),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const project = output?.project ?? olds?.project;
+          if (!project) return undefined;
+          const observed = yield* observe(project);
+          if (!observed) return undefined;
+          if (observed.xpnProjectStatus !== "HOST") return undefined;
+          // No labels-based ownership: host status is project-scoped
+          // state. Any host project we can see we treat as adopted —
+          // mirrors `ApiEnable`'s stance.
+          return { project, xpnProjectStatus: "HOST" };
+        }),
+      };
+    }),
+  );

package/src/Compute/SharedVpcServiceProject.ts

@@ -0,0 +1,185 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitGlobalOperation } from "./Operations.ts";
+
+/**
+ * Attach a service project to a Shared VPC **host**. Once attached,
+ * resources in the service project (clusters, VMs) can use VPCs and
+ * subnets owned by the host project.
+ *
+ * Identity: `(hostProject, serviceProject)`. Both are immutable —
+ * changing either replaces. Read uses
+ * `compute.projects.getXpnHost({ project: serviceProject })`, which
+ * returns the host the service project is attached to (or 4xx if
+ * unattached). When the returned host name matches `hostProject`, the
+ * attachment is present.
+ *
+ * The host project must already be enabled (`GCP.SharedVpcHost`), and
+ * the IAM principal running the deploy needs `compute.xpnAdmin` at the
+ * organisation or folder level — that role is what authorises both
+ * sides of the attach (the host, owned by infra; the service project,
+ * owned by the team consuming the VPC).
+ *
+ * @example
+ * ```typescript
+ * const host = yield* GCP.SharedVpcHost("ResearchHost", { project: hostProject.projectId });
+ * yield* GCP.SharedVpcServiceProject("AttachGkeProj", {
+ *   hostProject: host.project,
+ *   serviceProject: gkeProject.projectId,
+ * });
+ * ```
+ */
+export type SharedVpcServiceProjectProps = {
+  /** Shared VPC host project ID. Immutable — replace. */
+  hostProject: string;
+  /** Service project ID to attach. Immutable — replace. */
+  serviceProject: string;
+};
+
+export type SharedVpcServiceProjectAttributes = {
+  /** Host project ID. */
+  hostProject: string;
+  /** Service project ID. */
+  serviceProject: string;
+};
+
+export type SharedVpcServiceProject = Resource<
+  "GCP.SharedVpcServiceProject",
+  SharedVpcServiceProjectProps,
+  SharedVpcServiceProjectAttributes,
+  never,
+  GCP.Providers
+>;
+export const SharedVpcServiceProject = Resource<SharedVpcServiceProject>(
+  "GCP.SharedVpcServiceProject",
+);
+
+export const SharedVpcServiceProjectProvider = () =>
+  Provider.effect(
+    SharedVpcServiceProject,
+    Effect.gen(function* () {
+      const getXpnHostProjects = yield* compute.getXpnHostProjects;
+      const enableXpnResource = yield* compute.enableXpnResourceProjects;
+      const disableXpnResource = yield* compute.disableXpnResourceProjects;
+      const getGlobalOperations = yield* compute.getGlobalOperations;
+      const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+
+      // Observed-host name from a service project's perspective.
+      // Returns the host project's `name`/`projectId` — or undefined
+      // if the service project isn't attached anywhere. GCP returns
+      // 404 in that case; some SDK paths return a `Project` with
+      // empty fields instead, so we coalesce both.
+      const observeHost = (serviceProject: string) =>
+        getXpnHostProjects({ project: serviceProject }).pipe(
+          Effect.map((p) => p.name ?? p.id ?? undefined),
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as string | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as string | undefined),
+          ),
+        );
+
+      const isAttached = Effect.fn(function* (
+        hostProject: string,
+        serviceProject: string,
+      ) {
+        const observed = yield* observeHost(serviceProject);
+        if (!observed) return false;
+        // Host references can come back as the bare project ID, the
+        // numeric ID, or `projects/{id}` — match suffix to avoid
+        // missing on format drift.
+        return (
+          observed === hostProject ||
+          observed.endsWith(`/${hostProject}`) ||
+          observed.endsWith(`projects/${hostProject}`)
+        );
+      });
+
+      const enable = Effect.fn(function* (args: {
+        hostProject: string;
+        serviceProject: string;
+        session: ScopedPlanStatusSession;
+      }) {
+        const op = yield* enableXpnResource({
+          project: args.hostProject,
+          body: {
+            xpnResource: { type: "PROJECT", id: args.serviceProject },
+          },
+        }).pipe(
+          Effect.catchTag("Conflict", () =>
+            Effect.succeed(undefined as compute.Operation | undefined),
+          ),
+        );
+        if (op?.name) yield* awaitOp(args.hostProject, op.name, args.session);
+      });
+
+      return {
+        stables: ["hostProject", "serviceProject"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (olds.hostProject !== undefined &&
+              olds.hostProject !== news.hostProject) ||
+            (olds.serviceProject !== undefined &&
+              olds.serviceProject !== news.serviceProject)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const attached = yield* isAttached(news.hostProject, news.serviceProject);
+          if (!attached) {
+            yield* enable({
+              hostProject: news.hostProject,
+              serviceProject: news.serviceProject,
+              session,
+            });
+          }
+          return {
+            hostProject: news.hostProject,
+            serviceProject: news.serviceProject,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* disableXpnResource({
+            project: output.hostProject,
+            body: {
+              xpnResource: { type: "PROJECT", id: output.serviceProject },
+            },
+          }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.hostProject, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+            // `BadRequest` covers "not attached to this host" (idempotent
+            // detach); other 400s (resources still using shared subnets)
+            // propagate so the user sees the real precondition.
+            Effect.catchTag("BadRequest", (e) =>
+              /not.*service.*project|not.*xpn|UNSPECIFIED_XPN_PROJECT_STATUS|not.*attached/i.test(
+                e.message ?? "",
+              )
+                ? Effect.void
+                : Effect.fail(e),
+            ),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const hostProject = output?.hostProject ?? olds?.hostProject;
+          const serviceProject = output?.serviceProject ?? olds?.serviceProject;
+          if (!hostProject || !serviceProject) return undefined;
+          const attached = yield* isAttached(hostProject, serviceProject);
+          if (!attached) return undefined;
+          return { hostProject, serviceProject };
+        }),
+      };
+    }),
+  );

package/src/Compute/Subnetwork.ts

@@ -0,0 +1,375 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import {
+  descriptionHasAlchemyMarker,
+  gcpAlchemyDescription,
+  stripAlchemyMarker,
+} from "../Tags.ts";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitRegionOperation } from "./Operations.ts";
+
+export type SubnetworkSecondaryRange = {
+  /** Name used by alias-IP ranges on VMs in this subnet. */
+  rangeName: string;
+  /** Secondary CIDR. Must be unique and non-overlapping. */
+  ipCidrRange: string;
+};
+
+/**
+ * A regional VPC subnet. Carries a primary CIDR plus zero or more
+ * named secondary ranges (used by GKE VPC-native pods/services).
+ *
+ * Like Networks, Subnetworks have no `labels` field, so adoption uses
+ * the alchemy marker embedded in `description`. Description is set on
+ * create and treated as immutable.
+ *
+ * @section Creating a subnet
+ * @example GKE-ready subnet with pods + services secondary ranges
+ * ```typescript
+ * const sub = yield* GCP.Subnetwork("ResearchSubnet", {
+ *   project: hostProject.projectId,
+ *   region: "us-central1",
+ *   network: vpc.selfLink,
+ *   ipCidrRange: "10.0.0.0/20",
+ *   secondaryIpRanges: [
+ *     { rangeName: "pods", ipCidrRange: "10.4.0.0/14" },
+ *     { rangeName: "services", ipCidrRange: "10.8.0.0/20" },
+ *   ],
+ *   privateIpGoogleAccess: true,
+ * });
+ * ```
+ */
+export type SubnetworkProps = {
+  /** GCP project ID hosting the subnet. Immutable — replace if changed. */
+  project: string;
+  /**
+   * GCP region. Subnets are regional — a different region requires
+   * replace.
+   */
+  region: string;
+  /**
+   * Subnet name. Defaults to `createPhysicalName({ id, lowercase: true,
+   * maxLength: 63 })`. Immutable — replace if changed.
+   */
+  name?: string;
+  /**
+   * URL or short name of the parent VPC. Pass `network.selfLink` from a
+   * `GCP.Network` to make alchemy sequence the subnet after the VPC.
+   * Immutable — replace.
+   */
+  network: string;
+  /** User-visible description. Stored after the alchemy marker. Immutable. */
+  description?: string;
+  /**
+   * Primary CIDR for the subnet. Mutable via `expandIpCidrRange` *only*
+   * to a strictly-larger range; we surface that as a sync (treats
+   * shrinks as "no-op"). For changes that aren't an expansion, this is
+   * effectively replace-only.
+   */
+  ipCidrRange: string;
+  /**
+   * Secondary CIDR ranges used by alias IPs (e.g. GKE pods/services
+   * ranges). Mutable via `patchSubnetworks`.
+   */
+  secondaryIpRanges?: ReadonlyArray<SubnetworkSecondaryRange>;
+  /**
+   * Whether VMs in this subnet can reach Google services without an
+   * external IP. Defaults to `false`. Mutable via `patchSubnetworks`.
+   */
+  privateIpGoogleAccess?: boolean;
+  /**
+   * Stack type for the subnet. Defaults to `IPV4_ONLY`.
+   */
+  stackType?: "IPV4_ONLY" | "IPV4_IPV6" | "IPV6_ONLY";
+};
+
+export type SubnetworkAttributes = {
+  /** Subnet name. */
+  name: string;
+  /** GCP project ID, threaded through from props for delete/read. */
+  project: string;
+  /** GCP region, threaded through from props for delete/read. */
+  region: string;
+  /** Server-defined URL. */
+  selfLink: string;
+  /** Server-assigned numeric id. */
+  id: string;
+  /** URL of the parent VPC. */
+  network: string;
+  /** User-visible description (with the alchemy marker stripped). */
+  description: string | undefined;
+  /** Primary CIDR. */
+  ipCidrRange: string;
+  /** Secondary ranges currently set. */
+  secondaryIpRanges: ReadonlyArray<SubnetworkSecondaryRange>;
+  /** Private Google Access setting. */
+  privateIpGoogleAccess: boolean;
+  /** Stack type. */
+  stackType: string | undefined;
+  /** Lifecycle state. */
+  state: string | undefined;
+  /** Default IPv4 gateway in the primary range. */
+  gatewayAddress: string | undefined;
+};
+
+export type Subnetwork = Resource<
+  "GCP.Subnetwork",
+  SubnetworkProps,
+  SubnetworkAttributes,
+  never,
+  GCP.Providers
+>;
+export const Subnetwork = Resource<Subnetwork>("GCP.Subnetwork");
+
+const toSubnetworkAttributes = (
+  s: compute.Subnetwork,
+  parent: { project: string; region: string },
+): SubnetworkAttributes => ({
+  name: s.name ?? "",
+  project: parent.project,
+  region: parent.region,
+  selfLink: s.selfLink ?? "",
+  id: s.id ?? "",
+  network: s.network ?? "",
+  description: stripAlchemyMarker(s.description),
+  ipCidrRange: s.ipCidrRange ?? "",
+  secondaryIpRanges: (s.secondaryIpRanges ?? []).map((r) => ({
+    rangeName: r.rangeName ?? "",
+    ipCidrRange: r.ipCidrRange ?? "",
+  })),
+  privateIpGoogleAccess: s.privateIpGoogleAccess ?? false,
+  stackType: s.stackType,
+  state: s.state,
+  gatewayAddress: s.gatewayAddress,
+});
+
+const sortedSecondaryRanges = (
+  rs: ReadonlyArray<SubnetworkSecondaryRange> | undefined,
+): ReadonlyArray<SubnetworkSecondaryRange> =>
+  [...(rs ?? [])].sort((a, b) => a.rangeName.localeCompare(b.rangeName));
+
+export const SubnetworkProvider = () =>
+  Provider.effect(
+    Subnetwork,
+    Effect.gen(function* () {
+      const getSubnetworks = yield* compute.getSubnetworks;
+      const insertSubnetworks = yield* compute.insertSubnetworks;
+      const patchSubnetworks = yield* compute.patchSubnetworks;
+      const deleteSubnetworks = yield* compute.deleteSubnetworks;
+      const expandIpCidrRange = yield* compute.expandIpCidrRangeSubnetworks;
+      const getRegionOperations = yield* compute.getRegionOperations;
+      const awaitOp = makeAwaitRegionOperation(getRegionOperations);
+
+      const observe = (project: string, region: string, name: string) =>
+        getSubnetworks({ project, region, subnetwork: name }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Subnetwork | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Subnetwork | undefined),
+          ),
+        );
+
+      // patchSubnetworks requires an up-to-date `fingerprint` for
+      // optimistic concurrency control. Re-read just before patching to
+      // minimize the chance of `412 conditionNotMet`.
+      const patchAspects = Effect.fn(function* (args: {
+        project: string;
+        region: string;
+        name: string;
+        observed: compute.Subnetwork;
+        news: SubnetworkProps;
+        session: ScopedPlanStatusSession;
+      }) {
+        const body: compute.Subnetwork = {};
+        const obsRanges = sortedSecondaryRanges(
+          (args.observed.secondaryIpRanges ?? []).map((r) => ({
+            rangeName: r.rangeName ?? "",
+            ipCidrRange: r.ipCidrRange ?? "",
+          })),
+        );
+        const desiredRanges = sortedSecondaryRanges(args.news.secondaryIpRanges);
+        if (!deepEqual(obsRanges, desiredRanges)) {
+          body.secondaryIpRanges = desiredRanges as ReadonlyArray<compute.SubnetworkSecondaryRange>;
+        }
+        if (
+          args.news.privateIpGoogleAccess !== undefined &&
+          (args.observed.privateIpGoogleAccess ?? false) !==
+            args.news.privateIpGoogleAccess
+        ) {
+          body.privateIpGoogleAccess = args.news.privateIpGoogleAccess;
+        }
+        if (
+          args.news.stackType !== undefined &&
+          args.observed.stackType !== args.news.stackType
+        ) {
+          body.stackType = args.news.stackType;
+        }
+        if (Object.keys(body).length === 0) return;
+
+        body.fingerprint = args.observed.fingerprint;
+        const op = yield* patchSubnetworks({
+          project: args.project,
+          region: args.region,
+          subnetwork: args.name,
+          body,
+        });
+        if (op.name) yield* awaitOp(args.project, args.region, op.name, args.session);
+      });
+
+      // Primary CIDR can only be *expanded*. We treat shrinks as no-ops
+      // (the diff path doesn't trigger replace on ipCidrRange to keep
+      // adoption flexible — if the user passes a smaller range, the
+      // observed range stays).
+      const expandPrimary = Effect.fn(function* (args: {
+        project: string;
+        region: string;
+        name: string;
+        observed: compute.Subnetwork;
+        desired: string;
+        session: ScopedPlanStatusSession;
+      }) {
+        if (!args.observed.ipCidrRange) return;
+        if (args.observed.ipCidrRange === args.desired) return;
+        // Cheap guard: only attempt expand if the desired range is
+        // syntactically different. The API will reject shrinks/jumps;
+        // surface that error to the user.
+        const op = yield* expandIpCidrRange({
+          project: args.project,
+          region: args.region,
+          subnetwork: args.name,
+          body: { ipCidrRange: args.desired },
+        });
+        if (op.name) yield* awaitOp(args.project, args.region, op.name, args.session);
+      });
+
+      return {
+        stables: ["name", "project", "region", "selfLink", "id"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            somePropsAreDifferent(olds as SubnetworkProps, news, [
+              "project",
+              "region",
+              "name",
+              "network",
+            ])
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const desiredName =
+            news.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const desiredDescription = yield* gcpAlchemyDescription(
+            id,
+            news.description,
+          );
+
+          let observed = yield* observe(news.project, news.region, desiredName);
+
+          if (!observed) {
+            const body: compute.Subnetwork = {
+              name: desiredName,
+              description: desiredDescription,
+              network: news.network,
+              ipCidrRange: news.ipCidrRange,
+              ...(news.privateIpGoogleAccess !== undefined
+                ? { privateIpGoogleAccess: news.privateIpGoogleAccess }
+                : {}),
+              ...(news.stackType ? { stackType: news.stackType } : {}),
+              ...(news.secondaryIpRanges
+                ? {
+                    secondaryIpRanges: news.secondaryIpRanges.map((r) => ({
+                      rangeName: r.rangeName,
+                      ipCidrRange: r.ipCidrRange,
+                    })),
+                  }
+                : {}),
+            };
+            const op = yield* insertSubnetworks({
+              project: news.project,
+              region: news.region,
+              body,
+            }).pipe(
+              Effect.catchTag("Conflict", () =>
+                Effect.succeed(undefined as compute.Operation | undefined),
+              ),
+            );
+            if (op?.name) yield* awaitOp(news.project, news.region, op.name, session);
+            observed = yield* getSubnetworks({
+              project: news.project,
+              region: news.region,
+              subnetwork: desiredName,
+            });
+          }
+
+          // Sync mutables: secondary ranges, privateIpGoogleAccess,
+          // stackType (via patch), then primary range (via expand).
+          yield* patchAspects({
+            project: news.project,
+            region: news.region,
+            name: desiredName,
+            observed,
+            news,
+            session,
+          });
+          yield* expandPrimary({
+            project: news.project,
+            region: news.region,
+            name: desiredName,
+            observed,
+            desired: news.ipCidrRange,
+            session,
+          });
+
+          const final = yield* getSubnetworks({
+            project: news.project,
+            region: news.region,
+            subnetwork: desiredName,
+          });
+          return toSubnetworkAttributes(final, {
+            project: news.project,
+            region: news.region,
+          });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* deleteSubnetworks({
+            project: output.project,
+            region: output.region,
+            subnetwork: output.name,
+          }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.project, output.region, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const project = output?.project ?? olds?.project;
+          const region = output?.region ?? olds?.region;
+          if (!project || !region) return undefined;
+          const name =
+            output?.name ??
+            olds?.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const observed = yield* observe(project, region, name);
+          if (!observed) return undefined;
+          const attrs = toSubnetworkAttributes(observed, { project, region });
+          return (yield* descriptionHasAlchemyMarker(id, observed.description))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );