@microagi/alchemy-gcp 0.2.0 → 0.3.0

package/lib/Run/Service.d.ts

@@ -0,0 +1,193 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+import { type RunIamBindingContract } from "./IamSync.ts";
+/**
+ * A Cloud Run v2 Service — a managed serverless HTTP endpoint. Cloud
+ * Run pulls a container image, scales it from zero up to the
+ * configured maximum based on request rate, and fronts it with a
+ * Google-managed URL (`https://{service}-{hash}-{region}.run.app`).
+ * Per-Service IAM controls who can invoke it.
+ *
+ * **Resource model.** A Service holds a `template` (the desired
+ * `RevisionTemplate`) plus traffic routing. Every change to `template`
+ * server-side spawns a new immutable `Revision`; `traffic` (this resource)
+ * picks which Revisions receive request percentages. Revisions and
+ * Executions are side-effects and are NOT modeled by this resource —
+ * inspect them via `getProjectsLocationsServicesRevisions` if needed.
+ *
+ * **Lifecycle.** observe → ensure (create, retrying on the well-known
+ * "API not yet enabled" 403) → sync (patch with updateMask of changed
+ * top-level fields) → sync IAM bindings → return.
+ *
+ * **Replace triggers.** Only identity fields (project, location, name)
+ * force replacement. Everything else — image, env, scaling, traffic,
+ * ingress, IAM — is in-place via `patch`. New revisions are auto-created
+ * by Cloud Run on any `template.*` change.
+ *
+ * **Optimistic concurrency.** Patch and delete pass through the
+ * observed `etag` so concurrent edits (e.g. from `gcloud run services
+ * update`) surface as `Conflict` instead of silently overwriting.
+ *
+ * **Adoption.** Label-gated: a Service whose `labels` lack our
+ * `alchemy_*` keys is wrapped in `Unowned(attrs)` from `read`, forcing
+ * `--adopt` before takeover.
+ *
+ * **IAM.** Use {@link import("./IamMember.ts").serviceIamMember} to
+ * bind `(role, member)` grants — the provider unions all bindings and
+ * applies them via a single `setIamPolicy` round-trip, preserving
+ * foreign roles + members.
+ *
+ * @section Creating a Cloud Run Service
+ * @example Minimal "hello" service, public via IAM
+ * ```typescript
+ * const helloApi = yield* GCP.Service("HelloApi", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   template: {
+ *     containers: [{ image: "gcr.io/cloudrun/hello" }],
+ *   },
+ * });
+ * yield* GCP.serviceIamMember(helloApi, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * // helloApi.uri → https://hello-api-XXXXX-ew.a.run.app
+ * ```
+ *
+ * @example Internal-only service with explicit service account and scaling
+ * ```typescript
+ * const internal = yield* GCP.Service("Internal", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   ingress: "INGRESS_TRAFFIC_INTERNAL_ONLY",
+ *   scaling: { minInstanceCount: 1, maxInstanceCount: 10 },
+ *   template: {
+ *     serviceAccount: sa.email,
+ *     containers: [{
+ *       image: "europe-west4-docker.pkg.dev/proj/repo/app:latest",
+ *       resources: { limits: { cpu: "1000m", memory: "512Mi" } },
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export type ServiceProps = {
+    /** GCP project ID hosting the Service. Immutable — replace if changed. */
+    project: string;
+    /**
+     * Cloud Run region (e.g. `europe-west4`). Cloud Run is a regional
+     * product — there are no zonal Services. Immutable — replace if changed.
+     */
+    location: string;
+    /**
+     * Service name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 49 })`. Lowercase letters/digits/hyphens; must begin
+     * with a letter and not end with a hyphen; **fewer than 50 characters**.
+     * Immutable — replace if changed.
+     */
+    name?: string;
+    /**
+     * User-visible description (≤512 chars). Mutable via `patch`.
+     */
+    description?: string;
+    /**
+     * Resource labels. Alchemy internal labels (`alchemy_app`,
+     * `alchemy_stage`, `alchemy_id`) are merged on top automatically.
+     * Cloud Run rejects labels in `run.googleapis.com`,
+     * `cloud.googleapis.com`, `serving.knative.dev`, or
+     * `autoscaling.knative.dev` namespaces. Mutable via `patch`.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Free-form annotations for external tools. Cloud Run rejects the
+     * same reserved namespaces as `labels`. Mutable via `patch`.
+     */
+    annotations?: Record<string, string>;
+    /**
+     * Launch stage. `BETA` (or higher) is required to use preview
+     * fields like GPU `nodeSelector` and Direct VPC `networkInterfaces`;
+     * leaving this unset defaults to `GA`, which silently rejects
+     * preview fields in the body. Mutable via `patch`.
+     */
+    launchStage?: "ALPHA" | "BETA" | "GA" | "EARLY_ACCESS" | "PRELAUNCH" | "DEPRECATED";
+    /** Ingress traffic policy. Mutable via `patch`. */
+    ingress?: "INGRESS_TRAFFIC_ALL" | "INGRESS_TRAFFIC_INTERNAL_ONLY" | "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER" | "INGRESS_TRAFFIC_NONE";
+    /**
+     * Disable the IAM permission check for invokers. When `true`, the
+     * Service is publicly reachable regardless of IAM policy — a
+     * deliberate footgun, surface it consciously. Prefer
+     * `serviceIamMember(svc, "Public", { role: "roles/run.invoker", member: "allUsers" })`
+     * for declarative public access. Mutable via `patch`.
+     */
+    invokerIamDisabled?: boolean;
+    /**
+     * Disable public resolution of the default `*.run.app` URI. When
+     * `true`, the service is reachable only via custom domains / load
+     * balancers. Mutable via `patch`.
+     */
+    defaultUriDisabled?: boolean;
+    /** Service-level scaling. Mutable via `patch`. */
+    scaling?: run.GoogleCloudRunV2ServiceScaling;
+    /**
+     * Traffic routing across Revisions. Defaults server-side to 100% to
+     * the latest `Ready` revision. Mutable via `patch`.
+     */
+    traffic?: ReadonlyArray<run.GoogleCloudRunV2TrafficTarget>;
+    /**
+     * Audiences encoded into the auth token, for cross-service auth.
+     * Mutable via `patch`.
+     */
+    customAudiences?: ReadonlyArray<string>;
+    /**
+     * Binary Authorization policy. Mutable via `patch`.
+     */
+    binaryAuthorization?: run.GoogleCloudRunV2BinaryAuthorization;
+    /**
+     * The Revision template — describes the desired Pod-equivalent.
+     * **Required at create.** Mutable via `patch`; any change spawns a
+     * new server-managed Revision.
+     */
+    template: run.GoogleCloudRunV2RevisionTemplate;
+};
+export type ServiceAttributes = {
+    /** Service name (bare, without the `projects/.../services/` prefix). */
+    name: string;
+    /** Server-assigned UID — stable across rename-less mutations. */
+    uid: string;
+    /** Fully-qualified resource name `projects/{p}/locations/{l}/services/{n}`. */
+    resourceName: string;
+    /** GCP project ID, threaded through from props. */
+    project: string;
+    /** Region, threaded through from props. */
+    location: string;
+    /** Primary serving URI (`https://…run.app`). */
+    uri: string;
+    /** All URIs serving traffic (default + any tagged ones). */
+    urls: ReadonlyArray<string>;
+    /** Monotonically increasing generation, bumped on every patch. */
+    generation: string | undefined;
+    /** The generation currently serving traffic. */
+    observedGeneration: string | undefined;
+    /** Name of the latest Ready revision. */
+    latestReadyRevision: string | undefined;
+    /** Name of the latest created revision. */
+    latestCreatedRevision: string | undefined;
+    /** Overall readiness condition. */
+    terminalCondition: run.GoogleCloudRunV2Condition | undefined;
+    /** Per-traffic-target serving status. */
+    trafficStatuses: ReadonlyArray<run.GoogleCloudRunV2TrafficTargetStatus>;
+    /** Optimistic-concurrency etag. */
+    etag: string | undefined;
+    /** Labels currently set, including internals. */
+    labels: Record<string, string>;
+    /** Creation time. */
+    createTime: string | undefined;
+    /** Last-modified time. */
+    updateTime: string | undefined;
+};
+export type Service = Resource<"GCP.Service", ServiceProps, ServiceAttributes, RunIamBindingContract, GCP.Providers>;
+export declare const Service: import("alchemy").ResourceClass<Service>;
+export declare const ServiceProvider: () => import("effect/Layer").Layer<Provider.Provider<Service>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+//# sourceMappingURL=Service.d.ts.map

package/lib/Run/Service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Service.d.ts","sourceRoot":"","sources":["../../src/Run/Service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAUvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EACR,OAAO,GACP,MAAM,GACN,IAAI,GACJ,cAAc,GACd,WAAW,GACX,YAAY,CAAC;IACjB,mDAAmD;IACnD,OAAO,CAAC,EACJ,qBAAqB,GACrB,+BAA+B,GAC/B,wCAAwC,GACxC,sBAAsB,CAAC;IAC3B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kDAAkD;IAClD,OAAO,CAAC,EAAE,GAAG,CAAC,8BAA8B,CAAC;IAC7C;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3D;;;OAGG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;OAEG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,mCAAmC,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,EAAE,GAAG,CAAC,gCAAgC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gDAAgD;IAChD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,yCAAyC;IACzC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,2CAA2C;IAC3C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,mCAAmC;IACnC,iBAAiB,EAAE,GAAG,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAC7D,yCAAyC;IACzC,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACxE,mCAAmC;IACnC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qBAAqB;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AAoDxD,eAAO,MAAM,eAAe,8NAsQzB,CAAC"}

package/lib/Run/Service.js

@@ -0,0 +1,247 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeSyncIam } from "./IamSync.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { reshapeBadRequest, validateAnnotations, validateContainers, validateLabels, validateRunName, } from "./Validation.js";
+export const Service = Resource("GCP.Service");
+const fqName = (project, location, name) => `projects/${project}/locations/${location}/services/${name}`;
+const toServiceBody = (news, desiredLabels) => ({
+    ...(news.description !== undefined ? { description: news.description } : {}),
+    labels: desiredLabels,
+    ...(news.annotations ? { annotations: news.annotations } : {}),
+    ...(news.launchStage ? { launchStage: news.launchStage } : {}),
+    ...(news.ingress ? { ingress: news.ingress } : {}),
+    ...(news.invokerIamDisabled !== undefined
+        ? { invokerIamDisabled: news.invokerIamDisabled }
+        : {}),
+    ...(news.defaultUriDisabled !== undefined
+        ? { defaultUriDisabled: news.defaultUriDisabled }
+        : {}),
+    ...(news.scaling ? { scaling: news.scaling } : {}),
+    ...(news.traffic ? { traffic: news.traffic } : {}),
+    ...(news.customAudiences ? { customAudiences: news.customAudiences } : {}),
+    ...(news.binaryAuthorization
+        ? { binaryAuthorization: news.binaryAuthorization }
+        : {}),
+    template: news.template,
+});
+const toAttributes = (s, parent) => ({
+    name: parent.name,
+    uid: s.uid ?? "",
+    resourceName: s.name ?? fqName(parent.project, parent.location, parent.name),
+    project: parent.project,
+    location: parent.location,
+    uri: s.uri ?? "",
+    urls: s.urls ?? [],
+    generation: s.generation,
+    observedGeneration: s.observedGeneration,
+    latestReadyRevision: s.latestReadyRevision,
+    latestCreatedRevision: s.latestCreatedRevision,
+    terminalCondition: s.terminalCondition,
+    trafficStatuses: s.trafficStatuses ?? [],
+    etag: s.etag,
+    labels: { ...(s.labels ?? {}) },
+    createTime: s.createTime,
+    updateTime: s.updateTime,
+});
+export const ServiceProvider = () => Provider.effect(Service, Effect.gen(function* () {
+    const getService = yield* run.getProjectsLocationsServices;
+    const createService = yield* run.createProjectsLocationsServices;
+    const patchService = yield* run.patchProjectsLocationsServices;
+    const deleteService = yield* run.deleteProjectsLocationsServices;
+    const getOperation = yield* run.getProjectsLocationsOperations;
+    const getIamPolicy = yield* run.getIamPolicyProjectsLocationsServices;
+    const setIamPolicy = yield* run.setIamPolicyProjectsLocationsServices;
+    const awaitOperation = makeAwaitOperation(getOperation);
+    const syncIam = makeSyncIam({ getIamPolicy, setIamPolicy });
+    const observe = (project, location, name) => getService({ name: fqName(project, location, name) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncMutable = Effect.fn(function* (args) {
+        const desiredBody = toServiceBody(args.news, args.desiredLabels);
+        const updateMaskFields = [];
+        if ((args.observed.description ?? undefined) !== args.news.description) {
+            updateMaskFields.push("description");
+        }
+        const labelDiff = diffTags({ ...(args.observed.labels ?? {}) }, args.desiredLabels);
+        if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0) {
+            updateMaskFields.push("labels");
+        }
+        if (!deepEqual(args.observed.annotations ?? {}, args.news.annotations ?? {})) {
+            updateMaskFields.push("annotations");
+        }
+        if (args.news.launchStage !== undefined &&
+            args.observed.launchStage !== args.news.launchStage) {
+            updateMaskFields.push("launchStage");
+        }
+        if (args.news.ingress !== undefined &&
+            args.observed.ingress !== args.news.ingress) {
+            updateMaskFields.push("ingress");
+        }
+        if (args.news.invokerIamDisabled !== undefined &&
+            (args.observed.invokerIamDisabled ?? false) !==
+                args.news.invokerIamDisabled) {
+            updateMaskFields.push("invokerIamDisabled");
+        }
+        if (args.news.defaultUriDisabled !== undefined &&
+            (args.observed.defaultUriDisabled ?? false) !==
+                args.news.defaultUriDisabled) {
+            updateMaskFields.push("defaultUriDisabled");
+        }
+        if (args.news.scaling && !deepEqual(args.observed.scaling, args.news.scaling)) {
+            updateMaskFields.push("scaling");
+        }
+        if (args.news.traffic && !deepEqual(args.observed.traffic ?? [], args.news.traffic)) {
+            updateMaskFields.push("traffic");
+        }
+        if (args.news.customAudiences &&
+            !deepEqual(args.observed.customAudiences ?? [], args.news.customAudiences)) {
+            updateMaskFields.push("customAudiences");
+        }
+        if (args.news.binaryAuthorization &&
+            !deepEqual(args.observed.binaryAuthorization, args.news.binaryAuthorization)) {
+            updateMaskFields.push("binaryAuthorization");
+        }
+        // The Revision template is a deeply nested struct; diffing field
+        // by field would be miles of code with no payoff. Deep-equal at
+        // the top — patch sends the whole desired template if anything
+        // inside differs. Cloud Run spawns a new Revision on patch only
+        // when the template's content (modulo server-injected defaults)
+        // actually changes, so resending an equivalent template after a
+        // no-op reconcile is cheap.
+        if (!deepEqual(args.observed.template, args.news.template)) {
+            updateMaskFields.push("template");
+        }
+        if (updateMaskFields.length === 0)
+            return;
+        // Pass the observed etag through the body so a concurrent edit
+        // racing us surfaces as Conflict instead of silently
+        // overwriting. Cloud Run reads etag from the body (it's a
+        // field on GoogleCloudRunV2Service, not a request-level param).
+        const bodyWithEtag = {
+            ...desiredBody,
+            ...(args.observed.etag ? { etag: args.observed.etag } : {}),
+        };
+        const op = yield* patchService({
+            name: args.name,
+            updateMask: updateMaskFields.join(","),
+            body: bodyWithEtag,
+        }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("Service", "patch")));
+        if (op.name)
+            yield* awaitOperation(op.name, args.session);
+    });
+    return {
+        stables: ["name", "uid", "resourceName", "project", "location"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "location",
+                "name",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session, bindings }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            // Cloud Run service IDs must be <50 chars (server hard cap).
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            // Plan-time validation: surface common footguns as typed
+            // ConfigErrors before any state mutation. The server would
+            // reject these too, but a 30 s wait + half-built state is a
+            // worse experience than failing immediately.
+            yield* validateRunName("Service", desiredName);
+            yield* validateLabels(news.labels);
+            yield* validateAnnotations(news.annotations);
+            yield* validateContainers("Service", news.template.containers);
+            const parent = `projects/${news.project}/locations/${news.location}`;
+            const name = fqName(news.project, news.location, desiredName);
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            // 1. Observe — collapse 403 to "missing" alongside 404 (GCP
+            //    surfaces 403 for resources/projects we can't see).
+            let observed = yield* observe(news.project, news.location, desiredName);
+            // 2. Ensure — same API-enable race as Cluster: a create can
+            //    fire faster than ApiEnable's effect propagates and the
+            //    server returns 403 with "If you enabled this API
+            //    recently, wait a few minutes …". Retry the create call
+            //    on that specific 403 for ~5 min; other Forbiddens
+            //    propagate.
+            if (!observed) {
+                const op = yield* createService({
+                    parent,
+                    serviceId: desiredName,
+                    body: toServiceBody(news, desiredLabels),
+                }).pipe(Effect.retry({
+                    while: (e) => e?._tag === "Forbidden" &&
+                        /enabled this API recently|has not been used/i.test(e.message ?? ""),
+                    schedule: Schedule.spaced(Duration.seconds(15)).pipe(Schedule.both(Schedule.recurs(20)), Schedule.tapOutput(() => session.note("Waiting for Cloud Run API enablement to propagate…"))),
+                }), Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("Service", "create")));
+                if (op?.name)
+                    yield* awaitOperation(op.name, session);
+                observed = yield* getService({ name });
+            }
+            // 3. Sync — single patch with an updateMask of changed
+            //    top-level fields. Template is diff'd shallowly (deep
+            //    equality on the whole struct).
+            yield* syncMutable({
+                name,
+                observed,
+                news,
+                desiredLabels,
+                session,
+            });
+            // 4. Apply IAM bindings AFTER the service exists. Single
+            //    setIamPolicy call covers all bindings for this service;
+            //    foreign bindings are preserved verbatim. Etag round-trip
+            //    handles concurrent edits.
+            yield* syncIam({ resource: name, bindings });
+            const final = yield* getService({ name });
+            return toAttributes(final, {
+                project: news.project,
+                location: news.location,
+                name: desiredName,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            const name = fqName(output.project, output.location, output.name);
+            // Pass the etag we stored at last reconcile so a concurrent
+            // edit racing this delete surfaces as Conflict. If we never
+            // captured one (legacy state, adoption path), omit the
+            // parameter — Cloud Run treats it as "don't check".
+            yield* deleteService({
+                name,
+                ...(output.etag ? { etag: output.etag } : {}),
+            }).pipe(Effect.flatMap((op) => op.name ? awaitOperation(op.name, session) : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const location = output?.location ?? olds?.location;
+            if (!project || !location)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            const observed = yield* observe(project, location, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, { project, location, name });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Service.js.map

package/lib/Run/Service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Service.js","sourceRoot":"","sources":["../../src/Run/Service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAC;AA6MzB,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CACjE,YAAY,OAAO,cAAc,QAAQ,aAAa,IAAI,EAAE,CAAC;AAE/D,MAAM,aAAa,GAAG,CACpB,IAAkB,EAClB,aAAqC,EACR,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,EAAE,aAAa;IACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,mBAAmB;QAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;CACxB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAA8B,EAC9B,MAA2D,EACxC,EAAE,CAAC,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;IACxC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;IAC1C,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;IAC9C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAoD,CAAC,CACrE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAoD,CAAC,CACrE,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMxC;QACC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvE,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CACxB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YACnC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EACnD,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;YAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAC3C,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,KAAK,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAC9B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,KAAK,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAC9B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,eAAe;YACzB,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAC1E,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC7B,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAC5E,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,4BAA4B;QAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE1C,+DAA+D;QAC/D,qDAAqD;QACrD,0DAA0D;QAC1D,gEAAgE;QAChE,MAAM,YAAY,GAAgC;YAChD,GAAG,WAAW;YACd,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YACtC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,EAAE,CAAC,IAAI;YAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAoB,EAAE,IAAI,EAAE;gBAChD,SAAS;gBACT,UAAU;gBACV,MAAM;aACP,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;YAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,6DAA6D;YAC7D,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAEnE,yDAAyD;YACzD,2DAA2D;YAC3D,4DAA4D;YAC5D,6CAA6C;YAC7C,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAE/D,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC9D,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,4DAA4D;YAC5D,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAExE,4DAA4D;YAC5D,4DAA4D;YAC5D,sDAAsD;YACtD,4DAA4D;YAC5D,uDAAuD;YACvD,gBAAgB;YAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;oBAC9B,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC;iBACzC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,EAAE,CAAC,CAAsC,EAAE,EAAE,CAChD,CAAC,EAAE,IAAI,KAAK,WAAW;wBACvB,8CAA8C,CAAC,IAAI,CACjD,CAAC,CAAC,OAAO,IAAI,EAAE,CAChB;oBACH,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CACV,oDAAoD,CACrD,CACF,CACF;iBACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CACZ,SAAuD,CACxD,CACF,EACD,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CACvC,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACtD,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YAED,uDAAuD;YACvD,0DAA0D;YAC1D,oCAAoC;YACpC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,IAAI;gBACJ,QAAQ;gBACR,IAAI;gBACJ,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YAEH,yDAAyD;YACzD,6DAA6D;YAC7D,8DAA8D;YAC9D,+BAA+B;YAC/B,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,4DAA4D;YAC5D,4DAA4D;YAC5D,uDAAuD;YACvD,oDAAoD;YACpD,KAAK,CAAC,CAAC,aAAa,CAAC;gBACnB,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAChE,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Run/Validation.d.ts

@@ -0,0 +1,54 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+/**
+ * Validate a Cloud Run resource name (Service or Job). Returns a
+ * `ConfigError` Effect on the failure channel if the name is invalid,
+ * otherwise succeeds.
+ *
+ * The name comes from `props.name` (when the user supplied one) or
+ * `createPhysicalName({ id, maxLength: 49 })` (when defaulted). The
+ * defaulted path is already capped at 49; this guard mostly protects
+ * the user-supplied path against a server-side reject after a long
+ * deploy.
+ */
+export declare const validateRunName: (kind: "Service" | "Job", name: string) => Effect.Effect<void, ConfigError>;
+/**
+ * Reject user labels in any of the Cloud Run reserved namespaces — the
+ * server's 400 message ("Labels with run.googleapis.com namespace are
+ * not allowed") is clear enough, but failing at plan time means the
+ * stack never starts a deploy that's guaranteed to fail.
+ *
+ * Alchemy internals are merged *on top* of user labels and are NOT
+ * subject to this check — they use the un-namespaced `alchemy_*` keys.
+ */
+export declare const validateLabels: (labels: Record<string, string> | undefined) => Effect.Effect<void, ConfigError>;
+/** Same check, applied to annotations (server has the same reservation). */
+export declare const validateAnnotations: (annotations: Record<string, string> | undefined) => Effect.Effect<void, ConfigError>;
+/**
+ * Cloud Run requires every Service template and Job task template to
+ * declare at least one container. A `containers: []` body sails through
+ * client-side type checks but the server rejects with a generic 400.
+ */
+export declare const validateContainers: (kind: "Service" | "Job", containers: ReadonlyArray<unknown> | undefined) => Effect.Effect<void, ConfigError>;
+/**
+ * Reshape a `BadRequest` from a Cloud Run create or patch into a
+ * `ConfigError` with a remediation hint for the top failure modes:
+ *
+ * 1. **Billing not enabled** — the project's billing-account attach
+ *    was missing or detached. Common after a fresh project + ApiEnable
+ *    before billing reconciles.
+ * 2. **Image not in an approved registry** — Cloud Run defaults reject
+ *    Docker Hub and most non-Google registries when Binary Authorization
+ *    is on. Surface the registry-allow-list pointer.
+ * 3. **Reserved label/annotation namespace** — we catch user-supplied
+ *    cases in `validateLabels`, but server-side checks also fire for
+ *    fields nested inside `template` (we don't recurse) so leave this
+ *    as a passthrough hint.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear ("invalid image reference", "memory limit too low").
+ */
+export declare const reshapeBadRequest: (kind: "Service" | "Job", op: "create" | "patch") => (e: {
+    message?: string;
+}) => Effect.Effect<never, ConfigError>;
+//# sourceMappingURL=Validation.d.ts.map

package/lib/Run/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/Run/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA0CxC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,SAAS,GAAG,KAAK,EACvB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,KACzC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAajC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,GAC9B,aAAa,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,KAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAgC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,SAAS,GAAG,KAAK,EACvB,YAAY,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,KAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,GAC3B,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,QAAQ,GAAG,OAAO,MAC/C,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAkB1D,CAAC"}

package/lib/Run/Validation.js

@@ -0,0 +1,129 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+/**
+ * Plan-time validation for Cloud Run resource props. Failing fast with
+ * a typed `ConfigError` is much friendlier than letting the user wait
+ * 30 s for the server to reject the request — and unlike server-side
+ * errors, these surface before any state mutation happens.
+ *
+ * Used by both `Service` and `Job` since the constraints are shared:
+ * resource naming, label namespacing, and the "at least one container"
+ * rule on the template.
+ */
+/**
+ * Cloud Run resource names must match the
+ * [RFC 1123](https://datatracker.ietf.org/doc/html/rfc1123) label
+ * subset:
+ * - lowercase letters, digits, and hyphens
+ * - begin with a letter, not end with a hyphen
+ * - <50 chars (server hard cap, distinct from the wider 63-char label
+ *   limit other GCP resources use)
+ *
+ * @internal
+ */
+const RUN_NAME_RE = /^[a-z]([-a-z0-9]{0,47}[a-z0-9])?$/;
+/**
+ * Cloud Run rejects labels and annotations with keys in any of these
+ * namespaces. Listed in `vendor/distilled/packages/gcp/src/services/run-v2.ts`
+ * doc comments next to every `labels` / `annotations` field. Failing
+ * fast here saves a 400 round-trip from the server.
+ */
+const RESERVED_LABEL_NAMESPACES = [
+    "run.googleapis.com/",
+    "cloud.googleapis.com/",
+    "serving.knative.dev/",
+    "autoscaling.knative.dev/",
+];
+const reservedNamespaceFor = (key) => RESERVED_LABEL_NAMESPACES.find((ns) => key.startsWith(ns));
+/**
+ * Validate a Cloud Run resource name (Service or Job). Returns a
+ * `ConfigError` Effect on the failure channel if the name is invalid,
+ * otherwise succeeds.
+ *
+ * The name comes from `props.name` (when the user supplied one) or
+ * `createPhysicalName({ id, maxLength: 49 })` (when defaulted). The
+ * defaulted path is already capped at 49; this guard mostly protects
+ * the user-supplied path against a server-side reject after a long
+ * deploy.
+ */
+export const validateRunName = (kind, name) => {
+    if (RUN_NAME_RE.test(name) && name.length < 50)
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} name ${JSON.stringify(name)} is invalid: must match /^[a-z]([-a-z0-9]{0,47}[a-z0-9])?$/ (lowercase letters/digits/hyphens, starts with letter, no trailing hyphen, <50 chars).`,
+    }));
+};
+/**
+ * Reject user labels in any of the Cloud Run reserved namespaces — the
+ * server's 400 message ("Labels with run.googleapis.com namespace are
+ * not allowed") is clear enough, but failing at plan time means the
+ * stack never starts a deploy that's guaranteed to fail.
+ *
+ * Alchemy internals are merged *on top* of user labels and are NOT
+ * subject to this check — they use the un-namespaced `alchemy_*` keys.
+ */
+export const validateLabels = (labels) => {
+    if (!labels)
+        return Effect.void;
+    for (const key of Object.keys(labels)) {
+        const ns = reservedNamespaceFor(key);
+        if (ns) {
+            return Effect.fail(new ConfigError({
+                message: `Label key ${JSON.stringify(key)} uses reserved namespace ${JSON.stringify(ns)} — Cloud Run will reject this on create/patch. Strip the prefix or pick a different key.`,
+            }));
+        }
+    }
+    return Effect.void;
+};
+/** Same check, applied to annotations (server has the same reservation). */
+export const validateAnnotations = (annotations) => validateLabels(annotations);
+/**
+ * Cloud Run requires every Service template and Job task template to
+ * declare at least one container. A `containers: []` body sails through
+ * client-side type checks but the server rejects with a generic 400.
+ */
+export const validateContainers = (kind, containers) => {
+    if (containers && containers.length > 0)
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} template must declare at least one container. Did you forget \`template.containers: [{ image: "…" }]\`?`,
+    }));
+};
+/**
+ * Reshape a `BadRequest` from a Cloud Run create or patch into a
+ * `ConfigError` with a remediation hint for the top failure modes:
+ *
+ * 1. **Billing not enabled** — the project's billing-account attach
+ *    was missing or detached. Common after a fresh project + ApiEnable
+ *    before billing reconciles.
+ * 2. **Image not in an approved registry** — Cloud Run defaults reject
+ *    Docker Hub and most non-Google registries when Binary Authorization
+ *    is on. Surface the registry-allow-list pointer.
+ * 3. **Reserved label/annotation namespace** — we catch user-supplied
+ *    cases in `validateLabels`, but server-side checks also fire for
+ *    fields nested inside `template` (we don't recurse) so leave this
+ *    as a passthrough hint.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear ("invalid image reference", "memory limit too low").
+ */
+export const reshapeBadRequest = (kind, op) => (e) => {
+    const underlying = e.message ?? `unknown 400 from ${kind} ${op}`;
+    let hint = "";
+    if (/billing/i.test(underlying)) {
+        hint =
+            " Cloud Run requires billing to be enabled on the project. Attach a billing account (see `GCP.Project({ billingAccount })`) and retry.";
+    }
+    else if (/registry|image.*not.*allowed|disallowed.*image/i.test(underlying)) {
+        hint =
+            " Cloud Run rejects images from non-Google registries when Binary Authorization is on. Push to Artifact Registry (`*-docker.pkg.dev`) or relax the binary-auth policy.";
+    }
+    else if (/run\.googleapis\.com|knative\.dev|cloud\.googleapis\.com/i.test(underlying)) {
+        hint =
+            " A reserved label/annotation namespace is in use. Cloud Run forbids `run.googleapis.com/*`, `cloud.googleapis.com/*`, `serving.knative.dev/*`, and `autoscaling.knative.dev/*` on user fields.";
+    }
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} ${op} rejected: ${underlying}.${hint}`,
+    }));
+};
+//# sourceMappingURL=Validation.js.map