@microagi/alchemy-gcp 0.11.2 → 0.11.4

package/src/ArtifactRegistry/RepositoryIamMember.ts

@@ -0,0 +1,205 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as GCP from "../Providers.ts";
+
+/**
+ * A single unconditional `(role, member)` IAM grant on an Artifact Registry
+ * repository. The repository is referenced by its fully-qualified resource
+ * name and is not created or deleted by this resource.
+ *
+ * Reconciliation is an additive read-modify-write: foreign bindings,
+ * conditional bindings, members, policy version, and etag are preserved.
+ * Deletion revokes only this exact member and removes an emptied binding.
+ * The whole cycle retries boundedly on stale-etag conflicts so concurrent
+ * policy writers compose safely.
+ *
+ * @example Read access to one Docker repository
+ * ```typescript
+ * yield* GCP.ArtifactRegistryRepositoryIamMember("EvalsAppsReader", {
+ *   repository: apps.fullyQualifiedName,
+ *   role: "roles/artifactregistry.reader",
+ *   member: "serviceAccount:evals@example-project.iam.gserviceaccount.com",
+ * });
+ * ```
+ */
+export type ArtifactRegistryRepositoryIamMemberProps = {
+  /**
+   * Fully-qualified repository resource name:
+   * `projects/{project}/locations/{location}/repositories/{repository}`.
+   * Immutable — changing it replaces the grant.
+   */
+  repository: string;
+  /** IAM role, e.g. `roles/artifactregistry.reader`. Immutable. */
+  role: string;
+  /** IAM member string, e.g. `serviceAccount:name@project.iam.gserviceaccount.com`. Immutable. */
+  member: string;
+};
+
+export type ArtifactRegistryRepositoryIamMemberAttributes =
+  ArtifactRegistryRepositoryIamMemberProps;
+
+export type ArtifactRegistryRepositoryIamMember = Resource<
+  "GCP.ArtifactRegistryRepositoryIamMember",
+  ArtifactRegistryRepositoryIamMemberProps,
+  ArtifactRegistryRepositoryIamMemberAttributes,
+  never,
+  GCP.Providers
+>;
+
+export const ArtifactRegistryRepositoryIamMember =
+  Resource<ArtifactRegistryRepositoryIamMember>(
+    "GCP.ArtifactRegistryRepositoryIamMember",
+  );
+
+export const ArtifactRegistryRepositoryIamMemberProvider = () =>
+  Provider.effect(
+    ArtifactRegistryRepositoryIamMember,
+    Effect.gen(function* () {
+      const getIamPolicy = yield* ar.getIamPolicyProjectsLocationsRepositories;
+      const setIamPolicy = yield* ar.setIamPolicyProjectsLocationsRepositories;
+
+      const hasMember = (policy: ar.Policy, role: string, member: string) =>
+        (policy.bindings ?? []).some(
+          (binding) =>
+            binding.role === role &&
+            !binding.condition &&
+            (binding.members ?? []).includes(member),
+        );
+
+      const conflictRetry = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+        effect.pipe(
+          Effect.retry({
+            while: (error) => (error as { _tag?: string })?._tag === "Conflict",
+            schedule: Schedule.exponential(Duration.millis(250)).pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+
+      const readPolicy = (repository: string) =>
+        getIamPolicy({
+          resource: repository,
+          "options.requestedPolicyVersion": 3,
+        });
+
+      return {
+        stables: ["repository", "role", "member"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const priorRepository = output?.repository || olds.repository;
+          const priorRole = output?.role || olds.role;
+          const priorMember = output?.member || olds.member;
+          if (
+            (priorRepository && priorRepository !== news.repository) ||
+            (priorRole && priorRole !== news.role) ||
+            (priorMember && priorMember !== news.member)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+          yield* conflictRetry(
+            Effect.gen(function* () {
+              const current = yield* readPolicy(news.repository).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.fail(
+                    new ConfigError({
+                      message: `Artifact Registry repository ${news.repository} does not exist — RepositoryIamMember grants on existing repositories only.`,
+                    }),
+                  ),
+                ),
+              );
+              if (hasMember(current, news.role, news.member)) return;
+
+              const bindings = (current.bindings ?? []).map((binding) => ({
+                ...binding,
+                members: [...(binding.members ?? [])],
+              }));
+              const existing = bindings.find(
+                (binding) => binding.role === news.role && !binding.condition,
+              );
+              if (existing) {
+                existing.members = [...(existing.members ?? []), news.member];
+              } else {
+                bindings.push({ role: news.role, members: [news.member] });
+              }
+
+              yield* setIamPolicy({
+                resource: news.repository,
+                body: {
+                  policy: { ...current, bindings, version: 3 },
+                },
+              });
+            }),
+          );
+          return {
+            repository: news.repository,
+            role: news.role,
+            member: news.member,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!output.repository || !output.role || !output.member) return;
+          yield* conflictRetry(
+            Effect.gen(function* () {
+              const current = yield* readPolicy(output.repository).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.succeed(undefined as ar.Policy | undefined),
+                ),
+              );
+              if (!current || !hasMember(current, output.role, output.member)) {
+                return;
+              }
+
+              const bindings = (current.bindings ?? [])
+                .map((binding) =>
+                  binding.role === output.role && !binding.condition
+                    ? {
+                        ...binding,
+                        members: (binding.members ?? []).filter(
+                          (member) => member !== output.member,
+                        ),
+                      }
+                    : {
+                        ...binding,
+                        members: [...(binding.members ?? [])],
+                      },
+                )
+                .filter((binding) => (binding.members?.length ?? 0) > 0);
+
+              yield* setIamPolicy({
+                resource: output.repository,
+                body: {
+                  policy: { ...current, bindings, version: 3 },
+                },
+              }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const repository = output?.repository ?? olds?.repository;
+          const role = output?.role ?? olds?.role;
+          const member = output?.member ?? olds?.member;
+          if (!repository || !role || !member) return undefined;
+
+          const current = yield* readPolicy(repository).pipe(
+            Effect.catchTag("NotFound", () =>
+              Effect.succeed(undefined as ar.Policy | undefined),
+            ),
+            Effect.catchTag("Forbidden", () =>
+              Effect.succeed(undefined as ar.Policy | undefined),
+            ),
+          );
+          if (!current || !hasMember(current, role, member)) return undefined;
+          return { repository, role, member };
+        }),
+      };
+    }),
+  );

package/src/ArtifactRegistry/index.ts

@@ -7,4 +7,12 @@ export type {
   ArtifactRegistryRepositoryAttributes,
   ArtifactRegistryRepositoryProps,
 } from "./Repository.ts";
+export {
+  ArtifactRegistryRepositoryIamMember,
+  ArtifactRegistryRepositoryIamMemberProvider,
+} from "./RepositoryIamMember.ts";
+export type {
+  ArtifactRegistryRepositoryIamMemberAttributes,
+  ArtifactRegistryRepositoryIamMemberProps,
+} from "./RepositoryIamMember.ts";
 export type { ArtifactRegistryFormat, ArtifactRegistryMode } from "./Types.ts";

package/src/Compute/ProjectDefaultNetworkTier.ts

@@ -0,0 +1,101 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitGlobalOperation } from "./Operations.ts";
+
+export type ProjectDefaultNetworkTierProps = {
+  /** GCP project whose default network tier is managed. Immutable. */
+  project: string;
+  /** Default tier applied to newly created Compute resources. */
+  networkTier: "PREMIUM" | "STANDARD";
+};
+
+export type ProjectDefaultNetworkTierAttributes = {
+  project: string;
+  networkTier: "PREMIUM" | "STANDARD";
+};
+
+export type ProjectDefaultNetworkTier = Resource<
+  "GCP.ProjectDefaultNetworkTier",
+  ProjectDefaultNetworkTierProps,
+  ProjectDefaultNetworkTierAttributes,
+  never,
+  GCP.Providers
+>;
+export const ProjectDefaultNetworkTier = Resource<ProjectDefaultNetworkTier>(
+  "GCP.ProjectDefaultNetworkTier",
+);
+
+const isProjectNetworkTier = (
+  value: string | undefined,
+): value is ProjectDefaultNetworkTierAttributes["networkTier"] =>
+  value === "PREMIUM" || value === "STANDARD";
+
+/** Manage the Compute Engine project-wide default network service tier. */
+export const ProjectDefaultNetworkTierProvider = () =>
+  Provider.effect(
+    ProjectDefaultNetworkTier,
+    Effect.gen(function* () {
+      const getProjects = yield* compute.getProjects;
+      const setDefaultNetworkTier = yield* compute.setDefaultNetworkTierProjects;
+      const getGlobalOperations = yield* compute.getGlobalOperations;
+      const awaitOp = makeAwaitGlobalOperation(getGlobalOperations);
+
+      const observe = (project: string) =>
+        getProjects({ project }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Project | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Project | undefined),
+          ),
+        );
+
+      return {
+        stables: ["project"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (olds.project !== undefined && olds.project !== news.project) {
+            return { action: "replace" } as const;
+          }
+
+          // This project-scoped setting can drift independently of Alchemy's
+          // persisted props (for example through the Cloud Console or gcloud).
+          // Existing resources do not pass through `read`, so consult the live
+          // project here and force reconcile whenever reality differs.
+          const observed = yield* observe(news.project);
+          if (observed?.defaultNetworkTier !== news.networkTier) {
+            return { action: "update" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const observed = yield* observe(news.project);
+          if (observed?.defaultNetworkTier !== news.networkTier) {
+            const op = yield* setDefaultNetworkTier({
+              project: news.project,
+              body: { networkTier: news.networkTier },
+            });
+            if (op.name) yield* awaitOp(news.project, op.name, session);
+          }
+          return { project: news.project, networkTier: news.networkTier };
+        }),
+        // Project defaults are shared project-level policy. Removing this
+        // declaration must not silently revert the project's selected tier.
+        delete: Effect.fn(function* () {
+          return yield* Effect.void;
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const project = output?.project ?? olds?.project;
+          if (!project) return undefined;
+          const observed = yield* observe(project);
+          const networkTier = observed?.defaultNetworkTier;
+          if (!isProjectNetworkTier(networkTier)) return undefined;
+          return { project, networkTier };
+        }),
+      };
+    }),
+  );

package/src/Compute/index.ts

@@ -3,6 +3,7 @@ export * from "./Firewall.ts";
 export * from "./ForwardingRule.ts";
 export * from "./GlobalAddress.ts";
 export * from "./Network.ts";
+export * from "./ProjectDefaultNetworkTier.ts";
 export * from "./SharedVpcHost.ts";
 export * from "./SharedVpcServiceProject.ts";
 export * from "./Subnetwork.ts";

package/src/Container/Cluster.ts

@@ -73,6 +73,8 @@ export type ClusterProps = {
     servicesIpv4CidrBlock?: string;
     clusterSecondaryRangeName?: string;
     servicesSecondaryRangeName?: string;
+    /** Cluster egress network service tier. Mutable via `update`. */
+    networkTierConfig?: cont.NetworkTierConfig;
   };
   /**
    * Cluster-level network settings. `datapathProvider:
@@ -251,6 +253,32 @@ export type Cluster = Resource<
 >;
 export const Cluster = Resource<Cluster>("GCP.Cluster");
 
+/** @internal Pure replacement decision, exported for focused unit tests. */
+export const diffClusterProps = (
+  olds: Partial<ClusterProps>,
+  news: ClusterProps,
+): { action: "replace" } | undefined => {
+  if (
+    somePropsAreDifferent(olds as ClusterProps, news, [
+      "project",
+      "location",
+      "name",
+      "network",
+      "subnetwork",
+    ])
+  ) {
+    return { action: "replace" };
+  }
+  const { networkTierConfig: _oldTier, ...oldIpAllocationPolicy } =
+    olds.ipAllocationPolicy ?? {};
+  const { networkTierConfig: _newTier, ...newIpAllocationPolicy } =
+    news.ipAllocationPolicy ?? {};
+  if (!deepEqual(oldIpAllocationPolicy, newIpAllocationPolicy)) {
+    return { action: "replace" };
+  }
+  return undefined;
+};
+
 /**
  * Build the inline `NodePool` entry for the cluster create body.
  *
@@ -435,7 +463,8 @@ export const ClusterProvider = () =>
       });
 
       // Catch-all generic update for fields without dedicated setters:
-      // currently `releaseChannel` and `workloadIdentityConfig`. The
+      // currently `releaseChannel`, `workloadIdentityConfig`, and the
+      // cluster network tier. The
       // API auto-derives the field mask from which `desired*` keys are
       // populated — no `updateMask` parameter needed.
       const syncClusterUpdate = Effect.fn(function* (args: {
@@ -457,6 +486,16 @@ export const ClusterProvider = () =>
         ) {
           update.desiredWorkloadIdentityConfig = args.news.workloadIdentityConfig;
         }
+        if (
+          args.news.ipAllocationPolicy?.networkTierConfig &&
+          !deepEqual(
+            args.observed.ipAllocationPolicy?.networkTierConfig,
+            args.news.ipAllocationPolicy.networkTierConfig,
+          )
+        ) {
+          update.desiredNetworkTierConfig =
+            args.news.ipAllocationPolicy.networkTierConfig;
+        }
         if (Object.keys(update).length === 0) return;
         const op = yield* updateClusters({
           name: args.fqName,
@@ -476,25 +515,11 @@ export const ClusterProvider = () =>
         ],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
-          if (
-            somePropsAreDifferent(olds as ClusterProps, news, [
-              "project",
-              "location",
-              "name",
-              "network",
-              "subnetwork",
-            ])
-          ) {
-            return { action: "replace" } as const;
-          }
-          if (!deepEqual(olds.ipAllocationPolicy, news.ipAllocationPolicy)) {
-            return { action: "replace" } as const;
-          }
           // `initialNodePool` and `networkConfig` are intentionally NOT
           // part of diff — both are consumed only on create. See the
           // ClusterProps JSDoc (networkConfig explains why a same-name
           // replace would be destructive).
-          return undefined;
+          return diffClusterProps(olds, news);
         }),
         reconcile: Effect.fn(function* ({ id, news, session }) {
           const internalLabels = yield* gcpInternalLabels(id);

package/src/Providers.ts

@@ -4,6 +4,10 @@ import {
   ArtifactRegistryRepository,
   ArtifactRegistryRepositoryProvider,
 } from "./ArtifactRegistry/Repository.ts";
+import {
+  ArtifactRegistryRepositoryIamMember,
+  ArtifactRegistryRepositoryIamMemberProvider,
+} from "./ArtifactRegistry/RepositoryIamMember.ts";
 import { GCPAuth } from "./Auth/AuthProvider.ts";
 import { fromAuthProvider } from "./Auth/Credentials.ts";
 import { Project, ProjectProvider } from "./CloudResourceManager/Project.ts";
@@ -15,6 +19,10 @@ import {
 } from "./Compute/ForwardingRule.ts";
 import { GlobalAddress, GlobalAddressProvider } from "./Compute/GlobalAddress.ts";
 import { Network, NetworkProvider } from "./Compute/Network.ts";
+import {
+  ProjectDefaultNetworkTier,
+  ProjectDefaultNetworkTierProvider,
+} from "./Compute/ProjectDefaultNetworkTier.ts";
 import { SharedVpcHost, SharedVpcHostProvider } from "./Compute/SharedVpcHost.ts";
 import {
   SharedVpcServiceProject,
@@ -94,6 +102,7 @@ export const providers = () =>
       NodePool,
       ApiEnable,
       Network,
+      ProjectDefaultNetworkTier,
       Subnetwork,
       Firewall,
       Address,
@@ -111,6 +120,7 @@ export const providers = () =>
       SqlDatabase,
       SqlUser,
       ArtifactRegistryRepository,
+      ArtifactRegistryRepositoryIamMember,
       ServiceAccount,
       ServiceAccountKey,
       KubernetesSecret,
@@ -125,6 +135,7 @@ export const providers = () =>
         NodePoolProvider(),
         ApiEnableProvider(),
         NetworkProvider(),
+        ProjectDefaultNetworkTierProvider(),
         SubnetworkProvider(),
         FirewallProvider(),
         AddressProvider(),
@@ -142,6 +153,7 @@ export const providers = () =>
         SqlDatabaseProvider(),
         SqlUserProvider(),
         ArtifactRegistryRepositoryProvider(),
+        ArtifactRegistryRepositoryIamMemberProvider(),
         ServiceAccountProvider(),
         ServiceAccountKeyProvider(),
         KubernetesSecretProvider(),