@microagi/alchemy-gcp 0.11.5 → 0.11.7

package/src/ArtifactRegistry/RepositoryIamMember.ts

@@ -76,9 +76,10 @@ export const ArtifactRegistryRepositoryIamMemberProvider = () =>
         effect.pipe(
           Effect.retry({
             while: (error) => (error as { _tag?: string })?._tag === "Conflict",
-            schedule: Schedule.exponential(Duration.millis(250)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.millis(250)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
@@ -89,6 +90,8 @@ export const ArtifactRegistryRepositoryIamMemberProvider = () =>
         });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["repository", "role", "member"],
         diff: Effect.fn(function* ({ news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;

package/src/CloudResourceManager/Project.ts

@@ -242,9 +242,11 @@ export const ProjectProvider = () =>
           ),
           Effect.retry({
             while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-            schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(
-              Schedule.both(Schedule.recurs(60)),
-              Schedule.tapOutput(() =>
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(1), 1.5),
+              Schedule.recurs(60),
+            ]).pipe(
+              Schedule.tap(() =>
                 session.note(`Waiting for GCP operation ${operationName}…`),
               ),
             ),
@@ -467,13 +469,16 @@ export const ProjectProvider = () =>
           });
         }).pipe(
           Effect.retry({
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["projectId", "projectNumber", "name"],
         diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;

package/src/Compute/Address.ts

@@ -172,6 +172,8 @@ export const AddressProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "region", "selfLink", "id", "address"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -250,7 +252,7 @@ export const AddressProvider = () =>
           });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteAddresses({
+          const deletion = deleteAddresses({
             project: output.project,
             region: output.region,
             address: output.name,
@@ -260,6 +262,8 @@ export const AddressProvider = () =>
                 ? awaitOp(output.project, output.region, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
             // 400 "is being used by ..." comes back while a forwarding
             // rule still references the address. The rule must be

package/src/Compute/Firewall.ts

@@ -199,6 +199,8 @@ export const FirewallProvider = () =>
         );
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "selfLink", "id", "network"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -297,7 +299,7 @@ export const FirewallProvider = () =>
           return toFirewallAttributes(final, { project: news.project });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteFirewalls({
+          const deletion = deleteFirewalls({
             project: output.project,
             firewall: output.name,
           }).pipe(
@@ -306,6 +308,8 @@ export const FirewallProvider = () =>
                 ? awaitOp(output.project, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
           );
         }),

package/src/Compute/ForwardingRule.ts

@@ -182,6 +182,8 @@ export const ForwardingRuleProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "region", "selfLink", "id"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -265,7 +267,7 @@ export const ForwardingRuleProvider = () =>
           });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteForwardingRules({
+          const deletion = deleteForwardingRules({
             project: output.project,
             region: output.region,
             forwardingRule: output.name,
@@ -275,6 +277,8 @@ export const ForwardingRuleProvider = () =>
                 ? awaitOp(output.project, output.region, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
           );
         }),

package/src/Compute/GlobalAddress.ts

@@ -176,6 +176,8 @@ export const GlobalAddressProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "selfLink", "id", "address"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -248,7 +250,7 @@ export const GlobalAddressProvider = () =>
           return toGlobalAddressAttributes(final, { project: news.project });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteGlobalAddresses({
+          const deletion = deleteGlobalAddresses({
             project: output.project,
             address: output.name,
           }).pipe(
@@ -257,6 +259,8 @@ export const GlobalAddressProvider = () =>
                 ? awaitOp(output.project, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
             // 400 with "is being used by ..." comes back when a PSA
             // connection still references the range. The user has to

package/src/Compute/Network.ts

@@ -252,6 +252,8 @@ export const NetworkProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "selfLink", "id"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -326,7 +328,7 @@ export const NetworkProvider = () =>
           return toNetworkAttributes(final, { project: news.project });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteNetworks({
+          const deletion = deleteNetworks({
             project: output.project,
             network: output.name,
           }).pipe(
@@ -335,6 +337,8 @@ export const NetworkProvider = () =>
                 ? awaitOp(output.project, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
           );
         }),

package/src/Compute/Operations.ts

@@ -30,13 +30,17 @@ const formatOperationError = (op: compute.Operation): string => {
 const isDone = (op: compute.Operation): boolean => op.status === "DONE";
 
 const pollSchedule = (label: string, session: ScopedPlanStatusSession) =>
-  Schedule.exponential(Duration.seconds(2), 1.5).pipe(
-    Schedule.either(Schedule.spaced(Duration.seconds(15))),
+  Schedule.max([
+    Schedule.min([
+      Schedule.exponential(Duration.seconds(2), 1.5),
+      Schedule.spaced(Duration.seconds(15)),
+    ]),
     // 80 × ≤15s ≈ 20 min — long enough for a network create (~1 min),
     // a parallelstore-adjacent global op, or a 10-minute parallelstore
     // delete (longest LRO observed in this provider's surface).
-    Schedule.both(Schedule.recurs(80)),
-    Schedule.tapOutput(() =>
+    Schedule.recurs(80),
+  ]).pipe(
+    Schedule.tap(() =>
       session.note(`Waiting for Compute operation ${label}…`),
     ),
   );

package/src/Compute/ProjectDefaultNetworkTier.ts

@@ -55,6 +55,8 @@ export const ProjectDefaultNetworkTierProvider = () =>
         );
 
       return {
+        nuke: { singleton: true },
+        list: () => Effect.succeed([]),
         stables: ["project"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Compute/SharedVpcHost.ts

@@ -75,6 +75,8 @@ export const SharedVpcHostProvider = () =>
         );
 
       return {
+        nuke: { singleton: true },
+        list: () => Effect.succeed([]),
         stables: ["project"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -104,12 +106,16 @@ export const SharedVpcHostProvider = () =>
           return { project: news.project, xpnProjectStatus: "HOST" };
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* disableXpnHostProjects({ project: output.project }).pipe(
+          const disabling = disableXpnHostProjects({
+            project: output.project,
+          }).pipe(
             Effect.flatMap((op) =>
               op.name
                 ? awaitOp(output.project, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* disabling.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
             // `BadRequest` is returned when:
             //   1. The project isn't a host (idempotent disable — fine).

package/src/Compute/SharedVpcServiceProject.ts

@@ -125,6 +125,8 @@ export const SharedVpcServiceProjectProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["hostProject", "serviceProject"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -153,7 +155,7 @@ export const SharedVpcServiceProjectProvider = () =>
           };
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* disableXpnResource({
+          const disabling = disableXpnResource({
             project: output.hostProject,
             body: {
               xpnResource: { type: "PROJECT", id: output.serviceProject },
@@ -164,6 +166,8 @@ export const SharedVpcServiceProjectProvider = () =>
                 ? awaitOp(output.hostProject, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* disabling.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
             // `BadRequest` covers "not attached to this host" (idempotent
             // detach); other 400s (resources still using shared subnets)

package/src/Compute/Subnetwork.ts

@@ -254,9 +254,10 @@ export const SubnetworkProvider = () =>
           // multiple bindings in parallel, races are common. Cap at
           // ~1.5 min total to surface real failures.
           Effect.retry({
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
@@ -344,6 +345,8 @@ export const SubnetworkProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "project", "region", "selfLink", "id"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
@@ -445,7 +448,7 @@ export const SubnetworkProvider = () =>
           });
         }),
         delete: Effect.fn(function* ({ output, session }) {
-          yield* deleteSubnetworks({
+          const deletion = deleteSubnetworks({
             project: output.project,
             region: output.region,
             subnetwork: output.name,
@@ -455,6 +458,8 @@ export const SubnetworkProvider = () =>
                 ? awaitOp(output.project, output.region, op.name, session)
                 : Effect.succeed(op),
             ),
+          );
+          yield* deletion.pipe(
             Effect.catchTag("NotFound", () => Effect.void),
           );
         }),

package/src/Container/Cluster.ts

@@ -505,6 +505,8 @@ export const ClusterProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: [
           "name",
           "selfLink",
@@ -595,9 +597,11 @@ export const ClusterProvider = () =>
                 while: (e: { _tag?: string; message?: string }) =>
                   e?._tag === "Forbidden" &&
                   /enabled this API recently|has not been used/i.test(e.message ?? ""),
-                schedule: Schedule.spaced(Duration.seconds(15)).pipe(
-                  Schedule.both(Schedule.recurs(20)), // 20 × 15s ≈ 5 min
-                  Schedule.tapOutput(() =>
+                schedule: Schedule.max([
+                  Schedule.spaced(Duration.seconds(15)),
+                  Schedule.recurs(20), // 20 × 15s ≈ 5 min
+                ]).pipe(
+                  Schedule.tap(() =>
                     session.note(
                       "Waiting for Container API enablement to propagate…",
                     ),

package/src/Container/NodePool.ts

@@ -546,6 +546,8 @@ export const NodePoolProvider = () =>
       });
 
       return {
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "selfLink", "project", "location", "clusterName"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;

package/src/Container/Operations.ts

@@ -46,8 +46,8 @@ type GetOperations = Effect.Success<typeof cont.getProjectsLocationsOperations>;
  * The doneness predicate compares `.status === "DONE"` accordingly.
  *
  * Schedule: exponential 2s → 1.5× growth, capped per-poll at 15s via
- * `Schedule.either`, then a hard count cap of 80 retries via
- * `Schedule.both(Schedule.recurs(80))` → ~20 min wall ceiling, well
+ * `Schedule.min`, then a hard count cap of 80 retries via
+ * `Schedule.max` → ~20 min wall ceiling, well
  * above the worst observed GKE op time (cluster create runs 5–10 min).
  *
  * The helper is a factory — the caller resolves
@@ -68,10 +68,14 @@ export const makeAwaitOperation = (getOperations: GetOperations) =>
       ),
       Effect.retry({
         while: (e: { _tag?: string }) => e?._tag === "OperationPending",
-        schedule: Schedule.exponential(Duration.seconds(2), 1.5).pipe(
-          Schedule.either(Schedule.spaced(Duration.seconds(15))),
-          Schedule.both(Schedule.recurs(80)),
-          Schedule.tapOutput(() =>
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(2), 1.5),
+            Schedule.spaced(Duration.seconds(15)),
+          ]),
+          Schedule.recurs(80),
+        ]).pipe(
+          Schedule.tap(() =>
             session.note(`Waiting for GKE operation ${operationName}…`),
           ),
         ),

package/src/Iam/Operations.ts

@@ -0,0 +1,81 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import type * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Resolved callable signature of an `iam-v1` operations getter.
+ *
+ * Workload Identity pools and providers each have their own operations
+ * collection (`…WorkloadIdentityPoolsOperations`,
+ * `…WorkloadIdentityPoolsProvidersOperations`) rather than one shared
+ * endpoint, so this is generic over the getter and each resource passes its
+ * own — the same factory shape `ArtifactRegistry/Operations.ts` uses.
+ */
+type GetOperations = Effect.Success<
+  typeof iam.getProjectsLocationsWorkloadIdentityPoolsOperations
+>;
+
+/**
+ * Build the IAM long-running-operation polling helper.
+ *
+ * `iam-v1` operations use the standard `google.longrunning.Operation` shape —
+ * doneness is `.done === true` and failure is a populated `.error` (NOT
+ * Container's `.status === "DONE"`, and NOT Sqladmin's tri-state `.status`).
+ * Verified against the `Operation` interface in
+ * `vendor/distilled/packages/gcp/src/unstable-services/iam-v1.ts`.
+ *
+ * Operation names returned by pool/provider create and delete are already
+ * fully qualified (`projects/{p}/locations/global/workloadIdentityPools/{id}/operations/{op}`),
+ * so callers pass them straight through — no qualify dance.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
+ * `Schedule.min`, then a hard count cap of 60 retries via `Schedule.max`
+ * → ~10 min wall ceiling. Pool and provider CRUD normally settles in
+ * seconds; the ceiling exists so a stuck operation surfaces as an error
+ * rather than hanging a deploy indefinitely.
+ *
+ * The helper is a factory — the caller resolves the operations getter once at
+ * provider construction and passes the resulting callable here, so we never
+ * re-resolve services on each await.
+ */
+export const makeAwaitOperation = (
+  getOperations: GetOperations,
+  label: string,
+) =>
+  Effect.fn(function* (
+    operationName: string,
+    session: ScopedPlanStatusSession,
+  ) {
+    const op = yield* getOperations({ name: operationName }).pipe(
+      Effect.flatMap((current) =>
+        current.done === true
+          ? Effect.succeed(current)
+          : Effect.fail({ _tag: "OperationPending" as const }),
+      ),
+      Effect.retry({
+        while: (e: { _tag?: string }) => e?._tag === "OperationPending",
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(1), 1.5),
+            Schedule.spaced(Duration.seconds(10)),
+          ]),
+          Schedule.recurs(60),
+        ]).pipe(
+          Schedule.tap(() =>
+            session.note(`Waiting for ${label} operation ${operationName}…`),
+          ),
+        ),
+      }),
+    );
+    if (op.error) {
+      return yield* new ConfigError({
+        message: `${label} operation ${operationName} failed: ${
+          op.error.message ?? JSON.stringify(op.error)
+        }`,
+      });
+    }
+    return op;
+  });

package/src/Iam/ServiceAccount.ts

@@ -330,9 +330,10 @@ export const ServiceAccountProvider = () =>
           });
         }).pipe(
           Effect.retry({
-            schedule: Schedule.exponential(Duration.seconds(2)).pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential(Duration.seconds(2)),
+              Schedule.recurs(8),
+            ]),
           }),
         );
 
@@ -340,6 +341,8 @@ export const ServiceAccountProvider = () =>
         // Stable identity: accountId + project; both immutable; either
         // change → replace. The server-assigned uniqueId is also stable
         // for the lifetime of the GSA (re-create gets a different one).
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["accountId", "projectId", "uniqueId", "name", "email"],
         diff: Effect.fn(function* ({ id, news, olds = {}, output }) {
           if (!isResolved(news)) return undefined;

package/src/Iam/ServiceAccountKey.ts

@@ -153,6 +153,8 @@ export const ServiceAccountKeyProvider = () =>
         // privateKeyData is stable: it's set on create and never
         // changes. The engine preserves it across reconciles and
         // does not use it for drift detection.
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "privateKeyData", "keyAlgorithm", "keyType"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;