@microagi/alchemy-gcp 0.2.1 → 0.3.0

package/lib/Run/Service.js

@@ -0,0 +1,247 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeSyncIam } from "./IamSync.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { reshapeBadRequest, validateAnnotations, validateContainers, validateLabels, validateRunName, } from "./Validation.js";
+export const Service = Resource("GCP.Service");
+const fqName = (project, location, name) => `projects/${project}/locations/${location}/services/${name}`;
+const toServiceBody = (news, desiredLabels) => ({
+    ...(news.description !== undefined ? { description: news.description } : {}),
+    labels: desiredLabels,
+    ...(news.annotations ? { annotations: news.annotations } : {}),
+    ...(news.launchStage ? { launchStage: news.launchStage } : {}),
+    ...(news.ingress ? { ingress: news.ingress } : {}),
+    ...(news.invokerIamDisabled !== undefined
+        ? { invokerIamDisabled: news.invokerIamDisabled }
+        : {}),
+    ...(news.defaultUriDisabled !== undefined
+        ? { defaultUriDisabled: news.defaultUriDisabled }
+        : {}),
+    ...(news.scaling ? { scaling: news.scaling } : {}),
+    ...(news.traffic ? { traffic: news.traffic } : {}),
+    ...(news.customAudiences ? { customAudiences: news.customAudiences } : {}),
+    ...(news.binaryAuthorization
+        ? { binaryAuthorization: news.binaryAuthorization }
+        : {}),
+    template: news.template,
+});
+const toAttributes = (s, parent) => ({
+    name: parent.name,
+    uid: s.uid ?? "",
+    resourceName: s.name ?? fqName(parent.project, parent.location, parent.name),
+    project: parent.project,
+    location: parent.location,
+    uri: s.uri ?? "",
+    urls: s.urls ?? [],
+    generation: s.generation,
+    observedGeneration: s.observedGeneration,
+    latestReadyRevision: s.latestReadyRevision,
+    latestCreatedRevision: s.latestCreatedRevision,
+    terminalCondition: s.terminalCondition,
+    trafficStatuses: s.trafficStatuses ?? [],
+    etag: s.etag,
+    labels: { ...(s.labels ?? {}) },
+    createTime: s.createTime,
+    updateTime: s.updateTime,
+});
+export const ServiceProvider = () => Provider.effect(Service, Effect.gen(function* () {
+    const getService = yield* run.getProjectsLocationsServices;
+    const createService = yield* run.createProjectsLocationsServices;
+    const patchService = yield* run.patchProjectsLocationsServices;
+    const deleteService = yield* run.deleteProjectsLocationsServices;
+    const getOperation = yield* run.getProjectsLocationsOperations;
+    const getIamPolicy = yield* run.getIamPolicyProjectsLocationsServices;
+    const setIamPolicy = yield* run.setIamPolicyProjectsLocationsServices;
+    const awaitOperation = makeAwaitOperation(getOperation);
+    const syncIam = makeSyncIam({ getIamPolicy, setIamPolicy });
+    const observe = (project, location, name) => getService({ name: fqName(project, location, name) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncMutable = Effect.fn(function* (args) {
+        const desiredBody = toServiceBody(args.news, args.desiredLabels);
+        const updateMaskFields = [];
+        if ((args.observed.description ?? undefined) !== args.news.description) {
+            updateMaskFields.push("description");
+        }
+        const labelDiff = diffTags({ ...(args.observed.labels ?? {}) }, args.desiredLabels);
+        if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0) {
+            updateMaskFields.push("labels");
+        }
+        if (!deepEqual(args.observed.annotations ?? {}, args.news.annotations ?? {})) {
+            updateMaskFields.push("annotations");
+        }
+        if (args.news.launchStage !== undefined &&
+            args.observed.launchStage !== args.news.launchStage) {
+            updateMaskFields.push("launchStage");
+        }
+        if (args.news.ingress !== undefined &&
+            args.observed.ingress !== args.news.ingress) {
+            updateMaskFields.push("ingress");
+        }
+        if (args.news.invokerIamDisabled !== undefined &&
+            (args.observed.invokerIamDisabled ?? false) !==
+                args.news.invokerIamDisabled) {
+            updateMaskFields.push("invokerIamDisabled");
+        }
+        if (args.news.defaultUriDisabled !== undefined &&
+            (args.observed.defaultUriDisabled ?? false) !==
+                args.news.defaultUriDisabled) {
+            updateMaskFields.push("defaultUriDisabled");
+        }
+        if (args.news.scaling && !deepEqual(args.observed.scaling, args.news.scaling)) {
+            updateMaskFields.push("scaling");
+        }
+        if (args.news.traffic && !deepEqual(args.observed.traffic ?? [], args.news.traffic)) {
+            updateMaskFields.push("traffic");
+        }
+        if (args.news.customAudiences &&
+            !deepEqual(args.observed.customAudiences ?? [], args.news.customAudiences)) {
+            updateMaskFields.push("customAudiences");
+        }
+        if (args.news.binaryAuthorization &&
+            !deepEqual(args.observed.binaryAuthorization, args.news.binaryAuthorization)) {
+            updateMaskFields.push("binaryAuthorization");
+        }
+        // The Revision template is a deeply nested struct; diffing field
+        // by field would be miles of code with no payoff. Deep-equal at
+        // the top — patch sends the whole desired template if anything
+        // inside differs. Cloud Run spawns a new Revision on patch only
+        // when the template's content (modulo server-injected defaults)
+        // actually changes, so resending an equivalent template after a
+        // no-op reconcile is cheap.
+        if (!deepEqual(args.observed.template, args.news.template)) {
+            updateMaskFields.push("template");
+        }
+        if (updateMaskFields.length === 0)
+            return;
+        // Pass the observed etag through the body so a concurrent edit
+        // racing us surfaces as Conflict instead of silently
+        // overwriting. Cloud Run reads etag from the body (it's a
+        // field on GoogleCloudRunV2Service, not a request-level param).
+        const bodyWithEtag = {
+            ...desiredBody,
+            ...(args.observed.etag ? { etag: args.observed.etag } : {}),
+        };
+        const op = yield* patchService({
+            name: args.name,
+            updateMask: updateMaskFields.join(","),
+            body: bodyWithEtag,
+        }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("Service", "patch")));
+        if (op.name)
+            yield* awaitOperation(op.name, args.session);
+    });
+    return {
+        stables: ["name", "uid", "resourceName", "project", "location"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "location",
+                "name",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session, bindings }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            // Cloud Run service IDs must be <50 chars (server hard cap).
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            // Plan-time validation: surface common footguns as typed
+            // ConfigErrors before any state mutation. The server would
+            // reject these too, but a 30 s wait + half-built state is a
+            // worse experience than failing immediately.
+            yield* validateRunName("Service", desiredName);
+            yield* validateLabels(news.labels);
+            yield* validateAnnotations(news.annotations);
+            yield* validateContainers("Service", news.template.containers);
+            const parent = `projects/${news.project}/locations/${news.location}`;
+            const name = fqName(news.project, news.location, desiredName);
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            // 1. Observe — collapse 403 to "missing" alongside 404 (GCP
+            //    surfaces 403 for resources/projects we can't see).
+            let observed = yield* observe(news.project, news.location, desiredName);
+            // 2. Ensure — same API-enable race as Cluster: a create can
+            //    fire faster than ApiEnable's effect propagates and the
+            //    server returns 403 with "If you enabled this API
+            //    recently, wait a few minutes …". Retry the create call
+            //    on that specific 403 for ~5 min; other Forbiddens
+            //    propagate.
+            if (!observed) {
+                const op = yield* createService({
+                    parent,
+                    serviceId: desiredName,
+                    body: toServiceBody(news, desiredLabels),
+                }).pipe(Effect.retry({
+                    while: (e) => e?._tag === "Forbidden" &&
+                        /enabled this API recently|has not been used/i.test(e.message ?? ""),
+                    schedule: Schedule.spaced(Duration.seconds(15)).pipe(Schedule.both(Schedule.recurs(20)), Schedule.tapOutput(() => session.note("Waiting for Cloud Run API enablement to propagate…"))),
+                }), Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("Service", "create")));
+                if (op?.name)
+                    yield* awaitOperation(op.name, session);
+                observed = yield* getService({ name });
+            }
+            // 3. Sync — single patch with an updateMask of changed
+            //    top-level fields. Template is diff'd shallowly (deep
+            //    equality on the whole struct).
+            yield* syncMutable({
+                name,
+                observed,
+                news,
+                desiredLabels,
+                session,
+            });
+            // 4. Apply IAM bindings AFTER the service exists. Single
+            //    setIamPolicy call covers all bindings for this service;
+            //    foreign bindings are preserved verbatim. Etag round-trip
+            //    handles concurrent edits.
+            yield* syncIam({ resource: name, bindings });
+            const final = yield* getService({ name });
+            return toAttributes(final, {
+                project: news.project,
+                location: news.location,
+                name: desiredName,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            const name = fqName(output.project, output.location, output.name);
+            // Pass the etag we stored at last reconcile so a concurrent
+            // edit racing this delete surfaces as Conflict. If we never
+            // captured one (legacy state, adoption path), omit the
+            // parameter — Cloud Run treats it as "don't check".
+            yield* deleteService({
+                name,
+                ...(output.etag ? { etag: output.etag } : {}),
+            }).pipe(Effect.flatMap((op) => op.name ? awaitOperation(op.name, session) : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const location = output?.location ?? olds?.location;
+            if (!project || !location)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 49 })).toLowerCase();
+            const observed = yield* observe(project, location, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, { project, location, name });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Service.js.map

package/lib/Run/Service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Service.js","sourceRoot":"","sources":["../../src/Run/Service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAC;AA6MzB,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CACjE,YAAY,OAAO,cAAc,QAAQ,aAAa,IAAI,EAAE,CAAC;AAE/D,MAAM,aAAa,GAAG,CACpB,IAAkB,EAClB,aAAqC,EACR,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,EAAE,aAAa;IACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,mBAAmB;QAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;CACxB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAA8B,EAC9B,MAA2D,EACxC,EAAE,CAAC,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;IACxC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;IAC1C,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;IAC9C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAoD,CAAC,CACrE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAoD,CAAC,CACrE,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMxC;QACC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvE,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CACxB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YACnC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EACnD,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;YAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAC3C,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,KAAK,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAC9B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,KAAK,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAC9B,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,eAAe;YACzB,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAC1E,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC7B,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAC5E,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,4BAA4B;QAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE1C,+DAA+D;QAC/D,qDAAqD;QACrD,0DAA0D;QAC1D,gEAAgE;QAChE,MAAM,YAAY,GAAgC;YAChD,GAAG,WAAW;YACd,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YACtC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,EAAE,CAAC,IAAI;YAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAoB,EAAE,IAAI,EAAE;gBAChD,SAAS;gBACT,UAAU;gBACV,MAAM;aACP,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;YAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,6DAA6D;YAC7D,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAEnE,yDAAyD;YACzD,2DAA2D;YAC3D,4DAA4D;YAC5D,6CAA6C;YAC7C,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAE/D,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC9D,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,4DAA4D;YAC5D,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAExE,4DAA4D;YAC5D,4DAA4D;YAC5D,sDAAsD;YACtD,4DAA4D;YAC5D,uDAAuD;YACvD,gBAAgB;YAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;oBAC9B,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC;iBACzC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,EAAE,CAAC,CAAsC,EAAE,EAAE,CAChD,CAAC,EAAE,IAAI,KAAK,WAAW;wBACvB,8CAA8C,CAAC,IAAI,CACjD,CAAC,CAAC,OAAO,IAAI,EAAE,CAChB;oBACH,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CACV,oDAAoD,CACrD,CACF,CACF;iBACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CACZ,SAAuD,CACxD,CACF,EACD,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CACvC,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACtD,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YAED,uDAAuD;YACvD,0DAA0D;YAC1D,oCAAoC;YACpC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,IAAI;gBACJ,QAAQ;gBACR,IAAI;gBACJ,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YAEH,yDAAyD;YACzD,6DAA6D;YAC7D,8DAA8D;YAC9D,+BAA+B;YAC/B,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,4DAA4D;YAC5D,4DAA4D;YAC5D,uDAAuD;YACvD,oDAAoD;YACpD,KAAK,CAAC,CAAC,aAAa,CAAC;gBACnB,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAChE,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Run/Validation.d.ts

@@ -0,0 +1,54 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+/**
+ * Validate a Cloud Run resource name (Service or Job). Returns a
+ * `ConfigError` Effect on the failure channel if the name is invalid,
+ * otherwise succeeds.
+ *
+ * The name comes from `props.name` (when the user supplied one) or
+ * `createPhysicalName({ id, maxLength: 49 })` (when defaulted). The
+ * defaulted path is already capped at 49; this guard mostly protects
+ * the user-supplied path against a server-side reject after a long
+ * deploy.
+ */
+export declare const validateRunName: (kind: "Service" | "Job", name: string) => Effect.Effect<void, ConfigError>;
+/**
+ * Reject user labels in any of the Cloud Run reserved namespaces — the
+ * server's 400 message ("Labels with run.googleapis.com namespace are
+ * not allowed") is clear enough, but failing at plan time means the
+ * stack never starts a deploy that's guaranteed to fail.
+ *
+ * Alchemy internals are merged *on top* of user labels and are NOT
+ * subject to this check — they use the un-namespaced `alchemy_*` keys.
+ */
+export declare const validateLabels: (labels: Record<string, string> | undefined) => Effect.Effect<void, ConfigError>;
+/** Same check, applied to annotations (server has the same reservation). */
+export declare const validateAnnotations: (annotations: Record<string, string> | undefined) => Effect.Effect<void, ConfigError>;
+/**
+ * Cloud Run requires every Service template and Job task template to
+ * declare at least one container. A `containers: []` body sails through
+ * client-side type checks but the server rejects with a generic 400.
+ */
+export declare const validateContainers: (kind: "Service" | "Job", containers: ReadonlyArray<unknown> | undefined) => Effect.Effect<void, ConfigError>;
+/**
+ * Reshape a `BadRequest` from a Cloud Run create or patch into a
+ * `ConfigError` with a remediation hint for the top failure modes:
+ *
+ * 1. **Billing not enabled** — the project's billing-account attach
+ *    was missing or detached. Common after a fresh project + ApiEnable
+ *    before billing reconciles.
+ * 2. **Image not in an approved registry** — Cloud Run defaults reject
+ *    Docker Hub and most non-Google registries when Binary Authorization
+ *    is on. Surface the registry-allow-list pointer.
+ * 3. **Reserved label/annotation namespace** — we catch user-supplied
+ *    cases in `validateLabels`, but server-side checks also fire for
+ *    fields nested inside `template` (we don't recurse) so leave this
+ *    as a passthrough hint.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear ("invalid image reference", "memory limit too low").
+ */
+export declare const reshapeBadRequest: (kind: "Service" | "Job", op: "create" | "patch") => (e: {
+    message?: string;
+}) => Effect.Effect<never, ConfigError>;
+//# sourceMappingURL=Validation.d.ts.map

package/lib/Run/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/Run/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA0CxC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,SAAS,GAAG,KAAK,EACvB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,KACzC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAajC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,GAC9B,aAAa,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,KAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAgC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,SAAS,GAAG,KAAK,EACvB,YAAY,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,KAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,GAC3B,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,QAAQ,GAAG,OAAO,MAC/C,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAkB1D,CAAC"}

package/lib/Run/Validation.js

@@ -0,0 +1,129 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+/**
+ * Plan-time validation for Cloud Run resource props. Failing fast with
+ * a typed `ConfigError` is much friendlier than letting the user wait
+ * 30 s for the server to reject the request — and unlike server-side
+ * errors, these surface before any state mutation happens.
+ *
+ * Used by both `Service` and `Job` since the constraints are shared:
+ * resource naming, label namespacing, and the "at least one container"
+ * rule on the template.
+ */
+/**
+ * Cloud Run resource names must match the
+ * [RFC 1123](https://datatracker.ietf.org/doc/html/rfc1123) label
+ * subset:
+ * - lowercase letters, digits, and hyphens
+ * - begin with a letter, not end with a hyphen
+ * - <50 chars (server hard cap, distinct from the wider 63-char label
+ *   limit other GCP resources use)
+ *
+ * @internal
+ */
+const RUN_NAME_RE = /^[a-z]([-a-z0-9]{0,47}[a-z0-9])?$/;
+/**
+ * Cloud Run rejects labels and annotations with keys in any of these
+ * namespaces. Listed in `vendor/distilled/packages/gcp/src/services/run-v2.ts`
+ * doc comments next to every `labels` / `annotations` field. Failing
+ * fast here saves a 400 round-trip from the server.
+ */
+const RESERVED_LABEL_NAMESPACES = [
+    "run.googleapis.com/",
+    "cloud.googleapis.com/",
+    "serving.knative.dev/",
+    "autoscaling.knative.dev/",
+];
+const reservedNamespaceFor = (key) => RESERVED_LABEL_NAMESPACES.find((ns) => key.startsWith(ns));
+/**
+ * Validate a Cloud Run resource name (Service or Job). Returns a
+ * `ConfigError` Effect on the failure channel if the name is invalid,
+ * otherwise succeeds.
+ *
+ * The name comes from `props.name` (when the user supplied one) or
+ * `createPhysicalName({ id, maxLength: 49 })` (when defaulted). The
+ * defaulted path is already capped at 49; this guard mostly protects
+ * the user-supplied path against a server-side reject after a long
+ * deploy.
+ */
+export const validateRunName = (kind, name) => {
+    if (RUN_NAME_RE.test(name) && name.length < 50)
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} name ${JSON.stringify(name)} is invalid: must match /^[a-z]([-a-z0-9]{0,47}[a-z0-9])?$/ (lowercase letters/digits/hyphens, starts with letter, no trailing hyphen, <50 chars).`,
+    }));
+};
+/**
+ * Reject user labels in any of the Cloud Run reserved namespaces — the
+ * server's 400 message ("Labels with run.googleapis.com namespace are
+ * not allowed") is clear enough, but failing at plan time means the
+ * stack never starts a deploy that's guaranteed to fail.
+ *
+ * Alchemy internals are merged *on top* of user labels and are NOT
+ * subject to this check — they use the un-namespaced `alchemy_*` keys.
+ */
+export const validateLabels = (labels) => {
+    if (!labels)
+        return Effect.void;
+    for (const key of Object.keys(labels)) {
+        const ns = reservedNamespaceFor(key);
+        if (ns) {
+            return Effect.fail(new ConfigError({
+                message: `Label key ${JSON.stringify(key)} uses reserved namespace ${JSON.stringify(ns)} — Cloud Run will reject this on create/patch. Strip the prefix or pick a different key.`,
+            }));
+        }
+    }
+    return Effect.void;
+};
+/** Same check, applied to annotations (server has the same reservation). */
+export const validateAnnotations = (annotations) => validateLabels(annotations);
+/**
+ * Cloud Run requires every Service template and Job task template to
+ * declare at least one container. A `containers: []` body sails through
+ * client-side type checks but the server rejects with a generic 400.
+ */
+export const validateContainers = (kind, containers) => {
+    if (containers && containers.length > 0)
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} template must declare at least one container. Did you forget \`template.containers: [{ image: "…" }]\`?`,
+    }));
+};
+/**
+ * Reshape a `BadRequest` from a Cloud Run create or patch into a
+ * `ConfigError` with a remediation hint for the top failure modes:
+ *
+ * 1. **Billing not enabled** — the project's billing-account attach
+ *    was missing or detached. Common after a fresh project + ApiEnable
+ *    before billing reconciles.
+ * 2. **Image not in an approved registry** — Cloud Run defaults reject
+ *    Docker Hub and most non-Google registries when Binary Authorization
+ *    is on. Surface the registry-allow-list pointer.
+ * 3. **Reserved label/annotation namespace** — we catch user-supplied
+ *    cases in `validateLabels`, but server-side checks also fire for
+ *    fields nested inside `template` (we don't recurse) so leave this
+ *    as a passthrough hint.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear ("invalid image reference", "memory limit too low").
+ */
+export const reshapeBadRequest = (kind, op) => (e) => {
+    const underlying = e.message ?? `unknown 400 from ${kind} ${op}`;
+    let hint = "";
+    if (/billing/i.test(underlying)) {
+        hint =
+            " Cloud Run requires billing to be enabled on the project. Attach a billing account (see `GCP.Project({ billingAccount })`) and retry.";
+    }
+    else if (/registry|image.*not.*allowed|disallowed.*image/i.test(underlying)) {
+        hint =
+            " Cloud Run rejects images from non-Google registries when Binary Authorization is on. Push to Artifact Registry (`*-docker.pkg.dev`) or relax the binary-auth policy.";
+    }
+    else if (/run\.googleapis\.com|knative\.dev|cloud\.googleapis\.com/i.test(underlying)) {
+        hint =
+            " A reserved label/annotation namespace is in use. Cloud Run forbids `run.googleapis.com/*`, `cloud.googleapis.com/*`, `serving.knative.dev/*`, and `autoscaling.knative.dev/*` on user fields.";
+    }
+    return Effect.fail(new ConfigError({
+        message: `Cloud Run ${kind} ${op} rejected: ${underlying}.${hint}`,
+    }));
+};
+//# sourceMappingURL=Validation.js.map

package/lib/Run/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../src/Run/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;;;;;GASG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,sBAAsB;IACtB,0BAA0B;CAC3B,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAsB,EAAE,CAC/D,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,IAAuB,EACvB,IAAY,EACsB,EAAE;IACpC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,aAAa,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oJAAoJ;KAC5M,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAA0C,EACR,EAAE;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;gBACd,OAAO,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,0FAA0F;aAClL,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,WAA+C,EACb,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,IAAuB,EACvB,UAA8C,EACZ,EAAE;IACpC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,aAAa,IAAI,0GAA0G;KACrI,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,IAAuB,EAAE,EAAsB,EAAE,EAAE,CACpD,CAAC,CAAuB,EAAqC,EAAE;IAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC;IACjE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,IAAI;YACF,uIAAuI,CAAC;IAC5I,CAAC;SAAM,IAAI,iDAAiD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,IAAI;YACF,uKAAuK,CAAC;IAC5K,CAAC;SAAM,IAAI,2DAA2D,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxF,IAAI;YACF,gMAAgM,CAAC;IACrM,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,aAAa,IAAI,IAAI,EAAE,cAAc,UAAU,IAAI,IAAI,EAAE;KACnE,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/lib/Run/index.d.ts

@@ -0,0 +1,51 @@
+import type * as run from "@distilled.cloud/gcp/run-v2";
+export { Job, JobProvider } from "./Job.ts";
+export type { JobAttributes, JobProps } from "./Job.ts";
+export { jobIamMember, serviceIamMember } from "./IamMember.ts";
+export type { RunIamBinding, RunIamBindingContract } from "./IamSync.ts";
+export { Service, ServiceProvider } from "./Service.ts";
+export type { ServiceAttributes, ServiceProps } from "./Service.ts";
+/**
+ * Clean aliases for the most commonly-used Cloud Run v2 SDK types,
+ * re-exported from `@distilled.cloud/gcp/run-v2` so consumers don't
+ * need to import from the underlying SDK directly. The aliases are
+ * type-only — they share identity with the distilled types, so values
+ * are interchangeable.
+ *
+ * The `GoogleCloudRunV2*` prefix on the SDK types is generated from
+ * the GCP Discovery Document and is awkward to consume; these aliases
+ * mirror the casing the GCP REST docs use ("RevisionTemplate",
+ * "Container", "TrafficTarget"), which is what most users will
+ * already have in their heads.
+ *
+ * @example
+ * ```typescript
+ * import * as GCP from "@microagi/alchemy-gcp";
+ *
+ * const template: GCP.RevisionTemplate = {
+ *   containers: [{ image: "..." }],
+ * };
+ * ```
+ */
+export type RevisionTemplate = run.GoogleCloudRunV2RevisionTemplate;
+export type ExecutionTemplate = run.GoogleCloudRunV2ExecutionTemplate;
+export type TaskTemplate = run.GoogleCloudRunV2TaskTemplate;
+export type Container = run.GoogleCloudRunV2Container;
+export type ContainerPort = run.GoogleCloudRunV2ContainerPort;
+export type EnvVar = run.GoogleCloudRunV2EnvVar;
+export type EnvVarSource = run.GoogleCloudRunV2EnvVarSource;
+export type ResourceRequirements = run.GoogleCloudRunV2ResourceRequirements;
+export type Probe = run.GoogleCloudRunV2Probe;
+export type VpcAccess = run.GoogleCloudRunV2VpcAccess;
+export type NetworkInterface = run.GoogleCloudRunV2NetworkInterface;
+export type NodeSelector = run.GoogleCloudRunV2NodeSelector;
+export type TrafficTarget = run.GoogleCloudRunV2TrafficTarget;
+export type TrafficTargetStatus = run.GoogleCloudRunV2TrafficTargetStatus;
+export type ServiceScaling = run.GoogleCloudRunV2ServiceScaling;
+export type BinaryAuthorization = run.GoogleCloudRunV2BinaryAuthorization;
+export type Volume = run.GoogleCloudRunV2Volume;
+export type VolumeMount = run.GoogleCloudRunV2VolumeMount;
+export type Condition = run.GoogleCloudRunV2Condition;
+export type ExecutionReference = run.GoogleCloudRunV2ExecutionReference;
+export type SecretKeySelector = run.GoogleCloudRunV2SecretKeySelector;
+//# sourceMappingURL=index.d.ts.map

package/lib/Run/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Run/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,4BAA4B,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,yBAAyB,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,6BAA6B,CAAC;AAC9D,MAAM,MAAM,MAAM,GAAG,GAAG,CAAC,sBAAsB,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,4BAA4B,CAAC;AAC5D,MAAM,MAAM,oBAAoB,GAAG,GAAG,CAAC,oCAAoC,CAAC;AAC5E,MAAM,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAAC;AAC9C,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,yBAAyB,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,CAAC;AACpE,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,4BAA4B,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,6BAA6B,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,GAAG,CAAC,mCAAmC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,8BAA8B,CAAC;AAChE,MAAM,MAAM,mBAAmB,GAAG,GAAG,CAAC,mCAAmC,CAAC;AAC1E,MAAM,MAAM,MAAM,GAAG,GAAG,CAAC,sBAAsB,CAAC;AAChD,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,2BAA2B,CAAC;AAC1D,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,yBAAyB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,GAAG,CAAC,kCAAkC,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,CAAC"}

package/lib/Run/index.js

@@ -0,0 +1,4 @@
+export { Job, JobProvider } from "./Job.js";
+export { jobIamMember, serviceIamMember } from "./IamMember.js";
+export { Service, ServiceProvider } from "./Service.js";
+//# sourceMappingURL=index.js.map

package/lib/Run/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Run/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/lib/index.d.ts

@@ -5,6 +5,7 @@ export * from "./CloudResourceManager/index.ts";
 export * from "./Compute/index.ts";
 export * from "./Container/index.ts";
 export * from "./ManagedLustre/index.ts";
+export * from "./Run/index.ts";
 export * from "./ServiceNetworking/index.ts";
 export * from "./ServiceUsage/index.ts";
 export * from "./Providers.ts";

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/lib/index.js

@@ -4,6 +4,7 @@ export * from "./CloudResourceManager/index.js";
 export * from "./Compute/index.js";
 export * from "./Container/index.js";
 export * from "./ManagedLustre/index.js";
+export * from "./Run/index.js";
 export * from "./ServiceNetworking/index.js";
 export * from "./ServiceUsage/index.js";
 export * from "./Providers.js";

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.2.1",
-  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, with ADC-backed credentials and target-side IAM bindings.",
+  "version": "0.3.0",
+  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
     "alchemy-effect",
@@ -31,6 +31,7 @@
   "files": [
     "lib",
     "src",
+    "CHANGELOG.md",
     "README.md",
     "LICENSE"
   ],
@@ -57,10 +58,10 @@
     "effect": ">=4.0.0-beta.60 || >=4.0.0"
   },
   "devDependencies": {
-    "@distilled.cloud/gcp": "0.19.0",
+    "@distilled.cloud/gcp": "workspace:*",
     "@types/bun": "latest",
     "@types/node": "latest",
-    "alchemy": "2.0.0-beta.34",
+    "alchemy": "workspace:*",
     "effect": ">=4.0.0-beta.60 || >=4.0.0",
     "typescript": "^6.0.3"
   },

package/src/Providers.ts

@@ -17,6 +17,8 @@ import {
   ManagedLustreInstance,
   ManagedLustreInstanceProvider,
 } from "./ManagedLustre/Instance.ts";
+import { Job, JobProvider } from "./Run/Job.ts";
+import { Service, ServiceProvider } from "./Run/Service.ts";
 import {
   PsaConnection,
   PsaConnectionProvider,
@@ -57,6 +59,8 @@ export const providers = () =>
       SharedVpcServiceProject,
       PsaConnection,
       ManagedLustreInstance,
+      Service,
+      Job,
     ]),
   ).pipe(
     Layer.provide(
@@ -72,6 +76,8 @@ export const providers = () =>
         SharedVpcServiceProjectProvider(),
         PsaConnectionProvider(),
         ManagedLustreInstanceProvider(),
+        ServiceProvider(),
+        JobProvider(),
       ),
     ),
     Layer.provideMerge(fromAuthProvider()),