@microagi/alchemy-gcp 0.11.4 → 0.11.6

package/src/Container/NodePool.ts

@@ -34,11 +34,19 @@ export type NodePoolProps = {
    * without a positive node count, so when omitted we default to
    * `autoscaling.minNodeCount ?? 1` on the create path.
    *
-   * Subsequent size changes go via `setSize` when `autoscaling` is
-   * disabled, or are GKE-managed when `autoscaling.enabled` is true
-   * (the size sync is skipped to avoid fighting the autoscaler).
+   * Subsequent size changes go via `setSize` unless autoscaling or
+   * `externallyManagedSize` delegates steady-state size ownership.
    */
   initialNodeCount?: number;
+  /**
+   * Treat the pool's live size as externally owned after creation.
+   *
+   * `initialNodeCount` is still used to bootstrap a missing pool, but
+   * subsequent reconciles do not call GKE `setSize`. This is intended for
+   * imperative controllers that resize a pool while Alchemy continues to own
+   * its machine shape, labels, taints, management, and upgrade settings.
+   */
+  externallyManagedSize?: boolean;
   /**
    * Per-pool zones. Override the cluster default. Mutable via
    * `update` — sent in a standalone update body to avoid the SDK's
@@ -235,6 +243,19 @@ export type NodePool = Resource<
 >;
 export const NodePool = Resource<NodePool>("GCP.NodePool");
 
+/** Whether a reconcile should bring a node pool back to its declared size. */
+export const nodePoolSizeNeedsSync = (
+  observedCount: number | undefined,
+  news: Pick<
+    NodePoolProps,
+    "initialNodeCount" | "autoscaling" | "externallyManagedSize"
+  >,
+): boolean =>
+  news.externallyManagedSize !== true &&
+  news.autoscaling?.enabled !== true &&
+  news.initialNodeCount !== undefined &&
+  observedCount !== news.initialNodeCount;
+
 /**
  * Translate a public `accelerators` spec into the SDK's
  * `AcceleratorConfig`. Same shape on both create and update paths.
@@ -449,14 +470,14 @@ export const NodePoolProvider = () =>
         news: NodePoolProps;
         session: ScopedPlanStatusSession;
       }) {
-        // Skip when the autoscaler is enabled; fighting it creates churn.
-        if (args.news.autoscaling?.enabled) return;
-        if (args.news.initialNodeCount === undefined) return;
         const observedCount = args.observed.initialNodeCount;
-        if (observedCount === args.news.initialNodeCount) return;
+        // Skip when either GKE autoscaling or an external controller owns
+        // size; fighting either creates churn. Externally-managed pools still
+        // use initialNodeCount on the create path above.
+        if (!nodePoolSizeNeedsSync(observedCount, args.news)) return;
         const op = yield* setSize({
           name: args.fqName,
-          body: { nodeCount: args.news.initialNodeCount },
+          body: { nodeCount: args.news.initialNodeCount! },
         });
         if (op.name) yield* awaitOperation(qualifyOp(args.fqName, op.name), args.session);
       });
@@ -525,6 +546,8 @@ export const NodePoolProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "selfLink", "project", "location", "clusterName"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Container/Operations.ts

@@ -46,8 +46,8 @@ type GetOperations = Effect.Success<typeof cont.getProjectsLocationsOperations>;
  * The doneness predicate compares `.status === "DONE"` accordingly.
  *
  * Schedule: exponential 2s → 1.5× growth, capped per-poll at 15s via
- * `Schedule.either`, then a hard count cap of 80 retries via
- * `Schedule.both(Schedule.recurs(80))` → ~20 min wall ceiling, well
+ * `Schedule.min`, then a hard count cap of 80 retries via
+ * `Schedule.max` → ~20 min wall ceiling, well
  * above the worst observed GKE op time (cluster create runs 5–10 min).
  *
  * The helper is a factory — the caller resolves
@@ -68,10 +68,14 @@ export const makeAwaitOperation = (getOperations: GetOperations) =>
       ),
       Effect.retry({
         while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-        schedule: Schedule.exponential(Duration.seconds(2), 1.5).pipe(
-          Schedule.either(Schedule.spaced(Duration.seconds(15))),
-          Schedule.both(Schedule.recurs(80)),
-          Schedule.tapOutput(() =>
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(2), 1.5),
+            Schedule.spaced(Duration.seconds(15)),
+          ]),
+          Schedule.recurs(80),
+        ]).pipe(
+          Schedule.tap(() =>
             session.note(`Waiting for GKE operation ${operationName}…`),
           ),
         ),

package/src/Iam/ServiceAccount.ts

@@ -330,9 +330,10 @@ export const ServiceAccountProvider = () =>
           });
         }).pipe(
           Effect.retry({
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
@@ -340,6 +341,8 @@ export const ServiceAccountProvider = () =>
         // Stable identity: accountId + project; both immutable; either
         // change → replace. The server-assigned uniqueId is also stable
         // for the lifetime of the GSA (re-create gets a different one).
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["accountId", "projectId", "uniqueId", "name", "email"],
         diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;

package/src/Iam/ServiceAccountKey.ts

@@ -153,6 +153,8 @@ export const ServiceAccountKeyProvider = () =>
         // privateKeyData is stable: it's set on create and never
         // changes. The engine preserves it across reconciles and
         // does not use it for drift detection.
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "privateKeyData", "keyAlgorithm", "keyType"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Kubernetes/Helm.ts

@@ -329,6 +329,8 @@ export const HelmReleaseProvider = () =>
         // Identity (name/namespace/chart) and endpoint are unchanged by an
         // in-place upgrade. revision increments on every upgrade — it is NOT
         // stable (an update must persist the new revision).
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "namespace", "chart", "endpoint"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Kubernetes/KubernetesManifest.ts

@@ -179,6 +179,8 @@ export const KubernetesManifestProvider = () =>
         // Identity (apiVersion/kind/name/namespace) and the server-assigned uid
         // are unchanged by an in-place apply. endpoint is a replace trigger so
         // it never changes on update; caCertificate is excluded (can rotate).
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: [
           "apiVersion",
           "kind",

package/src/Kubernetes/Secret.ts

@@ -195,6 +195,8 @@ export const KubernetesSecretProvider = () =>
         // uid, and endpoint — which is a replace trigger, so it never changes
         // on update. caCertificate is intentionally excluded: it can rotate on
         // the same cluster.
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "namespace", "endpoint", "uid"],
         diff: Effect.fn(function* ({ id, news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/ManagedLustre/Instance.ts

@@ -247,12 +247,16 @@ export const ManagedLustreInstanceProvider = () =>
           ),
           Effect.retry({
             while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-            schedule: Schedule.exponential(Duration.seconds(5), 1.5).pipe(
-              Schedule.either(Schedule.spaced(Duration.seconds(30))),
+            schedule: Schedule.max([
+              Schedule.min([
+                Schedule.exponential(Duration.seconds(5), 1.5),
+                Schedule.spaced(Duration.seconds(30)),
+              ]),
               // Lustre creates run 10–25 min for multi-TiB instances.
               // 200 × 30s ≈ 100 min wall ceiling.
-              Schedule.both(Schedule.recurs(200)),
-              Schedule.tapOutput(() =>
+              Schedule.recurs(200),
+            ]).pipe(
+              Schedule.tap(() =>
                 session.note(`Waiting for Managed Lustre operation ${operationName}…`),
               ),
             ),
@@ -310,6 +314,8 @@ export const ManagedLustreInstanceProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["instanceId", "project", "location", "name"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Run/IamSync.ts

@@ -127,8 +127,9 @@ export const makeSyncIam =
       });
     }).pipe(
       Effect.retry({
-        schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-          Schedule.both(Schedule.recurs(8)),
-        ),
+        schedule: Schedule.max([
+          Schedule.exponential(Duration.seconds(2)),
+          Schedule.recurs(8),
+        ]),
       }),
     );

package/src/Run/Job.ts

@@ -336,6 +336,8 @@ export const JobProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "uid", "resourceName", "project", "location"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -384,9 +386,11 @@ export const JobProvider = () =>
                   /enabled this API recently|has not been used/i.test(
                     e.message ?? "",
                   ),
-                schedule: Schedule.spaced(Duration.seconds(15)).pipe(
-                  Schedule.both(Schedule.recurs(20)),
-                  Schedule.tapOutput(() =>
+                schedule: Schedule.max([
+                  Schedule.spaced(Duration.seconds(15)),
+                  Schedule.recurs(20),
+                ]).pipe(
+                  Schedule.tap(() =>
                     session.note(
                       "Waiting for Cloud Run API enablement to propagate…",
                     ),

package/src/Run/Operations.ts

@@ -33,8 +33,8 @@ type GetOperations = Effect.Success<typeof run.getProjectsLocationsOperations>;
  * dance needed (unlike Container, which returns bare ids).
  *
  * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
- * `Schedule.either`, then a hard count cap of 60 retries via
- * `Schedule.both(Schedule.recurs(60))` → ~10 min wall ceiling. Cloud
+ * `Schedule.min`, then a hard count cap of 60 retries via `Schedule.max`
+ * → ~10 min wall ceiling. Cloud
  * Run create/patch typically completes in seconds to a couple minutes,
  * with the long pole being container image pulls.
  *
@@ -57,10 +57,14 @@ export const makeAwaitOperation = (getOperations: GetOperations) =>
       ),
       Effect.retry({
         while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-        schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(
-          Schedule.either(Schedule.spaced(Duration.seconds(10))),
-          Schedule.both(Schedule.recurs(60)),
-          Schedule.tapOutput(() =>
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(1), 1.5),
+            Schedule.spaced(Duration.seconds(10)),
+          ]),
+          Schedule.recurs(60),
+        ]).pipe(
+          Schedule.tap(() =>
             session.note(`Waiting for Cloud Run operation ${operationName}…`),
           ),
         ),

package/src/Run/Service.ts

@@ -399,6 +399,8 @@ export const ServiceProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "uid", "resourceName", "project", "location"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -458,9 +460,11 @@ export const ServiceProvider = () =>
                   /enabled this API recently|has not been used/i.test(
                     e.message ?? "",
                   ),
-                schedule: Schedule.spaced(Duration.seconds(15)).pipe(
-                  Schedule.both(Schedule.recurs(20)),
-                  Schedule.tapOutput(() =>
+                schedule: Schedule.max([
+                  Schedule.spaced(Duration.seconds(15)),
+                  Schedule.recurs(20),
+                ]).pipe(
+                  Schedule.tap(() =>
                     session.note(
                       "Waiting for Cloud Run API enablement to propagate…",
                     ),

package/src/ServiceNetworking/PsaConnection.ts

@@ -124,12 +124,16 @@ export const PsaConnectionProvider = () =>
           ),
           Effect.retry({
             while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-            schedule: Schedule.exponential(Duration.seconds(2), 1.5).pipe(
-              Schedule.either(Schedule.spaced(Duration.seconds(15))),
+            schedule: Schedule.max([
+              Schedule.min([
+                Schedule.exponential(Duration.seconds(2), 1.5),
+                Schedule.spaced(Duration.seconds(15)),
+              ]),
               // PSA peering creates can take 5–10 min while the
               // service producer provisions its side. 80 × 15s ≈ 20 min.
-              Schedule.both(Schedule.recurs(80)),
-              Schedule.tapOutput(() =>
+              Schedule.recurs(80),
+            ]).pipe(
+              Schedule.tap(() =>
                 session.note(`Waiting for ServiceNetworking operation ${operationName}…`),
               ),
             ),
@@ -162,6 +166,8 @@ export const PsaConnectionProvider = () =>
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["network", "serviceName", "peering"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/ServiceUsage/ApiEnable.ts

@@ -121,10 +121,14 @@ export const ApiEnableProvider = () =>
           ),
           Effect.retry({
             while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-            schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(
-              Schedule.either(Schedule.spaced(Duration.seconds(15))),
-              Schedule.both(Schedule.recurs(60)),
-              Schedule.tapOutput(() =>
+            schedule: Schedule.max([
+              Schedule.min([
+                Schedule.exponential(Duration.seconds(1), 1.5),
+                Schedule.spaced(Duration.seconds(15)),
+              ]),
+              Schedule.recurs(60),
+            ]).pipe(
+              Schedule.tap(() =>
                 session.note(`Waiting for ServiceUsage operation ${operationName}…`),
               ),
             ),
@@ -143,6 +147,8 @@ export const ApiEnableProvider = () =>
       return {
         // No physical-name generation: identity is `(project, service)`.
         // Both are static strings on `news`/`olds`/`output`.
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["project", "service", "name"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Sqladmin/Database.ts

@@ -126,6 +126,8 @@ export const SqlDatabaseProvider = () =>
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "instance", "project", "selfLink"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Sqladmin/Instance.ts

@@ -485,6 +485,8 @@ export const SqlInstanceProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "selfLink", "project", "region", "connectionName"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -539,9 +541,11 @@ export const SqlInstanceProvider = () =>
                   /enabled this API recently|has not been used/i.test(
                     e.message ?? "",
                   ),
-                schedule: Schedule.spaced(Duration.seconds(15)).pipe(
-                  Schedule.both(Schedule.recurs(20)),
-                  Schedule.tapOutput(() =>
+                schedule: Schedule.max([
+                  Schedule.spaced(Duration.seconds(15)),
+                  Schedule.recurs(20),
+                ]).pipe(
+                  Schedule.tap(() =>
                     session.note(
                       "Waiting for Cloud SQL Admin API enablement to propagate…",
                     ),

package/src/Sqladmin/Operations.ts

@@ -52,10 +52,14 @@ export const makeAwaitOperation = (getOperations: GetOperations) =>
       ),
       Effect.retry({
         while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-        schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(
-          Schedule.either(Schedule.spaced(Duration.seconds(10))),
-          Schedule.both(Schedule.recurs(60)),
-          Schedule.tapOutput(() =>
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(1), 1.5),
+            Schedule.spaced(Duration.seconds(10)),
+          ]),
+          Schedule.recurs(60),
+        ]).pipe(
+          Schedule.tap(() =>
             session.note(`Waiting for Cloud SQL operation ${operationName}…`),
           ),
         ),

package/src/Sqladmin/User.ts

@@ -183,6 +183,8 @@ export const SqlUserProvider = () =>
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "instance", "project", "host", "type"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Storage/Bucket.ts

@@ -303,13 +303,16 @@ export const StorageBucketProvider = () =>
           });
         }).pipe(
           Effect.retry({
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "id", "selfLink", "location", "timeCreated"],
         diff: Effect.fn(function* ({ news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;

package/src/Storage/StorageBucketIamMember.ts

@@ -150,9 +150,10 @@ export const StorageBucketIamMemberProvider = () =>
         eff.pipe(
           Effect.retry({
             while: (e) => (e as { _tag?: string })?._tag !== "ConfigError",
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
@@ -185,6 +186,8 @@ export const StorageBucketIamMemberProvider = () =>
 
       return {
         // Identity IS the tuple; all fields are static values.
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["bucket", "role", "member", "condition"],
         diff: Effect.fn(function* ({ news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;