@microagi/alchemy-gcp 0.2.1 → 0.5.0

package/lib/ArtifactRegistry/Repository.js

@@ -0,0 +1,257 @@
+import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { reshapeBadRequest, validateModeConfig, validateRepositoryName, } from "./Validation.js";
+export const ArtifactRegistryRepository = Resource("GCP.ArtifactRegistryRepository");
+const fqName = (project, location, name) => `projects/${project}/locations/${location}/repositories/${name}`;
+const parent = (project, location) => `projects/${project}/locations/${location}`;
+const toDockerRepositoryBody = (upstream) => {
+    if (upstream.publicRepository !== undefined) {
+        return { publicRepository: upstream.publicRepository };
+    }
+    if (upstream.customRepository !== undefined) {
+        return { customRepository: { uri: upstream.customRepository.uri } };
+    }
+    // Unreachable per the discriminated union, but validation also
+    // rejects an empty dockerRepository at plan time.
+    return {};
+};
+const toRemoteRepositoryConfigBody = (cfg) => ({
+    ...(cfg.description !== undefined ? { description: cfg.description } : {}),
+    ...(cfg.dockerRepository
+        ? { dockerRepository: toDockerRepositoryBody(cfg.dockerRepository) }
+        : {}),
+    ...(cfg.disableUpstreamValidation !== undefined
+        ? { disableUpstreamValidation: cfg.disableUpstreamValidation }
+        : {}),
+    ...(cfg.upstreamCredentials
+        ? {
+            upstreamCredentials: {
+                ...(cfg.upstreamCredentials.usernamePasswordCredentials
+                    ? {
+                        usernamePasswordCredentials: {
+                            ...(cfg.upstreamCredentials.usernamePasswordCredentials
+                                .username !== undefined
+                                ? {
+                                    username: cfg.upstreamCredentials.usernamePasswordCredentials
+                                        .username,
+                                }
+                                : {}),
+                            ...(cfg.upstreamCredentials.usernamePasswordCredentials
+                                .passwordSecretVersion !== undefined
+                                ? {
+                                    passwordSecretVersion: cfg.upstreamCredentials.usernamePasswordCredentials
+                                        .passwordSecretVersion,
+                                }
+                                : {}),
+                        },
+                    }
+                    : {}),
+            },
+        }
+        : {}),
+});
+const toRepositoryBody = (props, desiredLabels) => ({
+    format: props.format,
+    ...(props.mode ? { mode: props.mode } : {}),
+    ...(props.description !== undefined
+        ? { description: props.description }
+        : {}),
+    labels: desiredLabels,
+    ...(props.kmsKeyName ? { kmsKeyName: props.kmsKeyName } : {}),
+    ...(props.dockerConfig
+        ? {
+            dockerConfig: {
+                ...(props.dockerConfig.immutableTags !== undefined
+                    ? { immutableTags: props.dockerConfig.immutableTags }
+                    : {}),
+            },
+        }
+        : {}),
+    ...(props.remoteRepositoryConfig
+        ? {
+            remoteRepositoryConfig: toRemoteRepositoryConfigBody(props.remoteRepositoryConfig),
+        }
+        : {}),
+    ...(props.cleanupPolicies
+        ? { cleanupPolicies: props.cleanupPolicies }
+        : {}),
+    ...(props.cleanupPolicyDryRun !== undefined
+        ? { cleanupPolicyDryRun: props.cleanupPolicyDryRun }
+        : {}),
+});
+const toAttributes = (r, parentArgs) => ({
+    name: parentArgs.name,
+    fullyQualifiedName: fqName(parentArgs.project, parentArgs.location, parentArgs.name),
+    project: parentArgs.project,
+    location: parentArgs.location,
+    format: r.format ?? "",
+    mode: r.mode ?? "STANDARD_REPOSITORY",
+    registryUri: r.registryUri,
+    sizeBytes: r.sizeBytes,
+    satisfiesPzs: r.satisfiesPzs,
+    satisfiesPzi: r.satisfiesPzi,
+    labels: { ...(r.labels ?? {}) },
+    createTime: r.createTime ?? "",
+    updateTime: r.updateTime ?? "",
+});
+export const ArtifactRegistryRepositoryProvider = () => Provider.effect(ArtifactRegistryRepository, Effect.gen(function* () {
+    const getRepository = yield* ar.getProjectsLocationsRepositories;
+    const createRepository = yield* ar.createProjectsLocationsRepositories;
+    const patchRepository = yield* ar.patchProjectsLocationsRepositories;
+    const deleteRepository = yield* ar.deleteProjectsLocationsRepositories;
+    const getOperations = yield* ar.getProjectsLocationsOperations;
+    const awaitOperation = makeAwaitOperation(getOperations);
+    const observe = (project, location, name) => getRepository({ name: fqName(project, location, name) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncMutable = Effect.fn(function* (args) {
+        const fields = [];
+        const body = {};
+        if ((args.observed.description ?? "") !== (args.news.description ?? "")) {
+            fields.push("description");
+            body.description = args.news.description ?? "";
+        }
+        const labelDiff = diffTags({ ...(args.observed.labels ?? {}) }, args.desiredLabels);
+        if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0) {
+            fields.push("labels");
+            body.labels = args.desiredLabels;
+        }
+        const desiredDockerConfig = args.news.dockerConfig
+            ? {
+                ...(args.news.dockerConfig.immutableTags !== undefined
+                    ? { immutableTags: args.news.dockerConfig.immutableTags }
+                    : {}),
+            }
+            : undefined;
+        if (!deepEqual(args.observed.dockerConfig, desiredDockerConfig)) {
+            fields.push("dockerConfig");
+            if (desiredDockerConfig)
+                body.dockerConfig = desiredDockerConfig;
+        }
+        if (!deepEqual(args.observed.cleanupPolicies ?? {}, args.news.cleanupPolicies ?? {})) {
+            fields.push("cleanupPolicies");
+            if (args.news.cleanupPolicies)
+                body.cleanupPolicies = args.news.cleanupPolicies;
+        }
+        if ((args.observed.cleanupPolicyDryRun ?? false) !==
+            (args.news.cleanupPolicyDryRun ?? false)) {
+            fields.push("cleanupPolicyDryRun");
+            body.cleanupPolicyDryRun = args.news.cleanupPolicyDryRun ?? false;
+        }
+        if (fields.length === 0)
+            return;
+        // Patch returns the Repository synchronously (NOT an LRO per
+        // `PatchProjectsLocationsRepositoriesResponse = Repository`).
+        // No operation to await.
+        yield* patchRepository({
+            name: args.name,
+            updateMask: fields.join(","),
+            body,
+        }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("patch")));
+    });
+    return {
+        stables: [
+            "name",
+            "fullyQualifiedName",
+            "project",
+            "location",
+            "format",
+            "mode",
+        ],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "location",
+                "name",
+                "format",
+                "mode",
+                "kmsKeyName",
+                "remoteRepositoryConfig",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            yield* validateRepositoryName(desiredName);
+            yield* validateModeConfig(news);
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            const name = fqName(news.project, news.location, desiredName);
+            // 1. Observe — collapse 403 to "missing" alongside 404.
+            let observed = yield* observe(news.project, news.location, desiredName);
+            // 2. Ensure — create LRO. Same API-enable race as Cloud Run /
+            //    Cloud SQL: a create can fire before ApiEnable's effect
+            //    propagates and the server returns 403 with "If you
+            //    enabled this API recently, wait …". Retry that specific
+            //    403 for ~5 min; other Forbiddens propagate.
+            if (!observed) {
+                const op = yield* createRepository({
+                    parent: parent(news.project, news.location),
+                    repositoryId: desiredName,
+                    body: toRepositoryBody(news, desiredLabels),
+                }).pipe(Effect.retry({
+                    while: (e) => e?._tag === "Forbidden" &&
+                        /enabled this API recently|has not been used/i.test(e.message ?? ""),
+                    schedule: Schedule.spaced(Duration.seconds(15)).pipe(Schedule.both(Schedule.recurs(20)), Schedule.tapOutput(() => session.note("Waiting for Artifact Registry API enablement to propagate…"))),
+                }), Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("create")));
+                if (op?.name)
+                    yield* awaitOperation(op.name, session);
+                observed = yield* getRepository({ name });
+            }
+            // 3. Sync — single patch with an updateMask of changed
+            //    top-level fields. `remoteRepositoryConfig` is NOT
+            //    patched here: GCP refuses updates to it, so changes
+            //    trigger a replace via `diff` above.
+            yield* syncMutable({
+                name,
+                observed,
+                news,
+                desiredLabels,
+                session,
+            });
+            const final = yield* getRepository({ name });
+            return toAttributes(final, {
+                project: news.project,
+                location: news.location,
+                name: desiredName,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            const name = fqName(output.project, output.location, output.name);
+            yield* deleteRepository({ name }).pipe(Effect.flatMap((op) => op.name ? awaitOperation(op.name, session) : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("BadRequest", reshapeBadRequest("delete")));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const location = output?.location ?? olds?.location;
+            if (!project || !location)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+            const observed = yield* observe(project, location, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, { project, location, name });
+            return (yield* hasAlchemyLabels(id, observed.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Repository.js.map

package/lib/ArtifactRegistry/Repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Repository.js","sourceRoot":"","sources":["../../src/ArtifactRegistry/Repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,0CAA0C,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AA0QzB,MAAM,CAAC,MAAM,0BAA0B,GACrC,QAAQ,CAA6B,gCAAgC,CAAC,CAAC;AAEzE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAU,EAAE,CACzE,YAAY,OAAO,cAAc,QAAQ,iBAAiB,IAAI,EAAE,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAU,EAAE,CAC3D,YAAY,OAAO,cAAc,QAAQ,EAAE,CAAC;AAE9C,MAAM,sBAAsB,GAAG,CAC7B,QAAwC,EACnB,EAAE;IACvB,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,+DAA+D;IAC/D,kDAAkD;IAClD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,GAA2E,EAChD,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,gBAAgB;QACtB,CAAC,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,GAAG,CAAC,yBAAyB,KAAK,SAAS;QAC7C,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,yBAAyB,EAAE;QAC9D,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,GAAG,CAAC,mBAAmB;QACzB,CAAC,CAAC;YACE,mBAAmB,EAAE;gBACnB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,2BAA2B;oBACrD,CAAC,CAAC;wBACE,2BAA2B,EAAE;4BAC3B,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,2BAA2B;iCACpD,QAAQ,KAAK,SAAS;gCACvB,CAAC,CAAC;oCACE,QAAQ,EACN,GAAG,CAAC,mBAAmB,CAAC,2BAA2B;yCAChD,QAAQ;iCACd;gCACH,CAAC,CAAC,EAAE,CAAC;4BACP,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,2BAA2B;iCACpD,qBAAqB,KAAK,SAAS;gCACpC,CAAC,CAAC;oCACE,qBAAqB,EACnB,GAAG,CAAC,mBAAmB,CAAC,2BAA2B;yCAChD,qBAAqB;iCAC3B;gCACH,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CACvB,KAAsC,EACtC,aAAqC,EACtB,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;QACjC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;QACpC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,EAAE,aAAa;IACrB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC;YACE,YAAY,EAAE;gBACZ,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS;oBAChD,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,KAAK,CAAC,sBAAsB;QAC9B,CAAC,CAAC;YACE,sBAAsB,EAAE,4BAA4B,CAClD,KAAK,CAAC,sBAAsB,CAC7B;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;QACpD,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAAgB,EAChB,UAA+D,EACzB,EAAE,CAAC,CAAC;IAC1C,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,kBAAkB,EAAE,MAAM,CACxB,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,IAAI,CAChB;IACD,OAAO,EAAE,UAAU,CAAC,OAAO;IAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,qBAAqB;IACrC,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,EAAE,CACrD,QAAQ,CAAC,MAAM,CACb,0BAA0B,EAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,gCAAgC,CAAC;IACjE,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,mCAAmC,CAAC;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,mCAAmC,CAAC;IACvE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC;IAC/D,MAAM,cAAc,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClE,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAsC,CAAC,CACvD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAsC,CAAC,CACvD,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAMxC;QACC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAkB,EAAE,CAAC;QAE/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CACxB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;YAChD,CAAC,CAAC;gBACE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;oBACzD,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC5B,IAAI,mBAAmB;gBAAE,IAAI,CAAC,YAAY,GAAG,mBAAmB,CAAC;QACnE,CAAC;QAED,IACE,CAAC,SAAS,CACR,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EACnC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAChC,EACD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC;QAED,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,IAAI,KAAK,CAAC;YAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,EACxC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC;QACpE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEhC,6DAA6D;QAC7D,8DAA8D;QAC9D,yBAAyB;QACzB,KAAK,CAAC,CAAC,eAAe,CAAC;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5B,IAAI;SACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,MAAM;YACN,oBAAoB;YACpB,SAAS;YACT,UAAU;YACV,QAAQ;YACR,MAAM;SACP;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CACnB,IAAuC,EACvC,IAAI,EACJ;gBACE,SAAS;gBACT,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,MAAM;gBACN,YAAY;gBACZ,wBAAwB;aACzB,CACF,EACD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAEnE,KAAK,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC3C,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEhC,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE9D,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAExE,8DAA8D;YAC9D,4DAA4D;YAC5D,wDAAwD;YACxD,6DAA6D;YAC7D,iDAAiD;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;oBAC3C,YAAY,EAAE,WAAW;oBACzB,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC;iBAC5C,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,EAAE,CAAC,CAAsC,EAAE,EAAE,CAChD,CAAC,EAAE,IAAI,KAAK,WAAW;wBACvB,8CAA8C,CAAC,IAAI,CACjD,CAAC,CAAC,OAAO,IAAI,EAAE,CAChB;oBACH,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CACV,4DAA4D,CAC7D,CACF,CACF;iBACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAqC,CAAC,CACtD,EACD,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAC3D,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACtD,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,uDAAuD;YACvD,uDAAuD;YACvD,yDAAyD;YACzD,yCAAyC;YACzC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,IAAI;gBACJ,QAAQ;gBACR,IAAI;gBACJ,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAChE,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/ArtifactRegistry/Types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Branded literal-union types for Artifact Registry repository props.
+ *
+ * Distilled's generated `format` and `mode` fields are open-tailed
+ * unions (`"DOCKER" | … | (string & {})`) so the GCP server can ship
+ * new variants without breaking SDK consumers. We mirror that shape
+ * here so consumers get autocomplete for the values we expect to use
+ * while still leaving the tail open for forward compatibility.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories#Repository
+ */
+/**
+ * Repository package format. Artifact Registry supports many formats
+ * (Maven, NPM, APT, …); we keep the full enum-tail open but only
+ * exercise `DOCKER` in this provider today. Other formats are still
+ * reachable via the `(string & {})` tail.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories#Format
+ */
+export type ArtifactRegistryFormat = "DOCKER" | "MAVEN" | "NPM" | "APT" | "YUM" | "GOOGET" | "PYTHON" | "KFP" | "GO" | "GENERIC" | "RUBY" | (string & {});
+/**
+ * Repository mode. `STANDARD_REPOSITORY` hosts artifacts uploaded by
+ * the user; `REMOTE_REPOSITORY` is a pull-through cache for an
+ * upstream registry; `VIRTUAL_REPOSITORY` aggregates multiple upstreams
+ * behind one URL. The provider does not type-check `VIRTUAL_REPOSITORY`
+ * config today — pass it through via the `remoteRepositoryConfig`
+ * field with a mode override, or wait for explicit support.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories#Mode
+ */
+export type ArtifactRegistryMode = "STANDARD_REPOSITORY" | "REMOTE_REPOSITORY" | "VIRTUAL_REPOSITORY" | (string & {});
+//# sourceMappingURL=Types.d.ts.map

package/lib/ArtifactRegistry/Types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Types.d.ts","sourceRoot":"","sources":["../../src/ArtifactRegistry/Types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,GACR,OAAO,GACP,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,IAAI,GACJ,SAAS,GACT,MAAM,GACN,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC"}

package/lib/ArtifactRegistry/Types.js

@@ -0,0 +1,12 @@
+/**
+ * Branded literal-union types for Artifact Registry repository props.
+ *
+ * Distilled's generated `format` and `mode` fields are open-tailed
+ * unions (`"DOCKER" | … | (string & {})`) so the GCP server can ship
+ * new variants without breaking SDK consumers. We mirror that shape
+ * here so consumers get autocomplete for the values we expect to use
+ * while still leaving the tail open for forward compatibility.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories#Repository
+ */
+//# sourceMappingURL=Types.js.map

package/lib/ArtifactRegistry/Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Types.js","sourceRoot":"","sources":["../../src/ArtifactRegistry/Types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/lib/ArtifactRegistry/Validation.d.ts

@@ -0,0 +1,43 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+import type { ArtifactRegistryRepositoryProps } from "./Repository.ts";
+/**
+ * Validate an Artifact Registry repository ID.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/repositories/create-repos#create
+ */
+export declare const validateRepositoryName: (name: string) => Effect.Effect<void, ConfigError>;
+/**
+ * Validate the `mode` ↔ `remoteRepositoryConfig` invariant. Artifact
+ * Registry rejects (with an opaque 400) any combination where:
+ *
+ * - `mode === "REMOTE_REPOSITORY"` but no `remoteRepositoryConfig`
+ *   is supplied — the server has no upstream to point at.
+ * - `mode === "STANDARD_REPOSITORY"` but a `remoteRepositoryConfig`
+ *   IS supplied — standard repositories don't have an upstream.
+ *
+ * `VIRTUAL_REPOSITORY` is not validated here; pass-through for now.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/repositories/remote-repo
+ */
+export declare const validateModeConfig: (props: ArtifactRegistryRepositoryProps) => Effect.Effect<void, ConfigError>;
+/**
+ * Reshape a `BadRequest` from an Artifact Registry create/patch/delete
+ * into a `ConfigError` with a remediation hint for the top failure
+ * modes:
+ *
+ * 1. **Upstream validation failure** — `disableUpstreamValidation` is
+ *    `false` (default) and AR's pre-flight HEAD request against the
+ *    remote upstream failed. Surface the underlying message; the user
+ *    can retry with `disableUpstreamValidation: true` if the upstream
+ *    is intentionally gated.
+ * 2. **KMS key not accessible** — the AR service agent does not have
+ *    `cloudkms.cryptoKeyEncrypterDecrypter` on the supplied key.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear enough.
+ */
+export declare const reshapeBadRequest: (op: "create" | "patch" | "delete") => (e: {
+    message?: string;
+}) => Effect.Effect<never, ConfigError>;
+//# sourceMappingURL=Validation.d.ts.map

package/lib/ArtifactRegistry/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/ArtifactRegistry/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAsBvE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,+BAA+B,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAqBjC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC3B,IAAI,QAAQ,GAAG,OAAO,GAAG,QAAQ,MACjC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAe1D,CAAC"}

package/lib/ArtifactRegistry/Validation.js

@@ -0,0 +1,95 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+/**
+ * Plan-time validation for Artifact Registry resource props. Failing
+ * fast with a typed `ConfigError` is friendlier than letting the user
+ * wait for the API to reject the request, and unlike server-side
+ * errors these surface before any state mutation happens.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories
+ */
+/**
+ * Repository ID regex per
+ * <https://cloud.google.com/artifact-registry/docs/repositories/create-repos#create>:
+ * lowercase letters, digits and hyphens; must start with a letter or
+ * digit; 1–63 chars total. The REST API documents up to 63; we cap at
+ * 63 to match.
+ *
+ * @internal
+ */
+const REPOSITORY_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+/**
+ * Validate an Artifact Registry repository ID.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/repositories/create-repos#create
+ */
+export const validateRepositoryName = (name) => {
+    if (REPOSITORY_NAME_RE.test(name))
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Artifact Registry repository name ${JSON.stringify(name)} is invalid: must match /^[a-z0-9][a-z0-9-]{0,62}$/ (1–63 lowercase letters/digits/hyphens, starting with a letter or digit).`,
+    }));
+};
+/**
+ * Validate the `mode` ↔ `remoteRepositoryConfig` invariant. Artifact
+ * Registry rejects (with an opaque 400) any combination where:
+ *
+ * - `mode === "REMOTE_REPOSITORY"` but no `remoteRepositoryConfig`
+ *   is supplied — the server has no upstream to point at.
+ * - `mode === "STANDARD_REPOSITORY"` but a `remoteRepositoryConfig`
+ *   IS supplied — standard repositories don't have an upstream.
+ *
+ * `VIRTUAL_REPOSITORY` is not validated here; pass-through for now.
+ *
+ * @see https://cloud.google.com/artifact-registry/docs/repositories/remote-repo
+ */
+export const validateModeConfig = (props) => {
+    const mode = props.mode ?? "STANDARD_REPOSITORY";
+    if (mode === "REMOTE_REPOSITORY") {
+        const docker = props.remoteRepositoryConfig?.dockerRepository;
+        if (!docker) {
+            return Effect.fail(new ConfigError({
+                message: `Artifact Registry repository has mode "REMOTE_REPOSITORY" but no \`remoteRepositoryConfig.dockerRepository\` was provided. Pass either \`{ publicRepository: "DOCKER_HUB" }\` or \`{ customRepository: { uri: "https://nvcr.io" } }\`.`,
+            }));
+        }
+        return Effect.void;
+    }
+    if (mode === "STANDARD_REPOSITORY" && props.remoteRepositoryConfig) {
+        return Effect.fail(new ConfigError({
+            message: `Artifact Registry repository has mode "STANDARD_REPOSITORY" but \`remoteRepositoryConfig\` was supplied. Drop \`remoteRepositoryConfig\` or set \`mode: "REMOTE_REPOSITORY"\`.`,
+        }));
+    }
+    return Effect.void;
+};
+/**
+ * Reshape a `BadRequest` from an Artifact Registry create/patch/delete
+ * into a `ConfigError` with a remediation hint for the top failure
+ * modes:
+ *
+ * 1. **Upstream validation failure** — `disableUpstreamValidation` is
+ *    `false` (default) and AR's pre-flight HEAD request against the
+ *    remote upstream failed. Surface the underlying message; the user
+ *    can retry with `disableUpstreamValidation: true` if the upstream
+ *    is intentionally gated.
+ * 2. **KMS key not accessible** — the AR service agent does not have
+ *    `cloudkms.cryptoKeyEncrypterDecrypter` on the supplied key.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear enough.
+ */
+export const reshapeBadRequest = (op) => (e) => {
+    const underlying = e.message ?? `unknown 400 from Repository ${op}`;
+    let hint = "";
+    if (/upstream|remote.*validation|HEAD/i.test(underlying)) {
+        hint =
+            " Artifact Registry validates the upstream remote on create. If the upstream rejects unauthenticated HEAD requests (private nvcr.io paths, etc.), supply `remoteRepositoryConfig.disableUpstreamValidation: true` or attach credentials via `upstreamCredentials`.";
+    }
+    else if (/kms|crypto.*key|encrypt/i.test(underlying)) {
+        hint =
+            " Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the supplied `kmsKeyName` to the Artifact Registry service agent (`service-{projectNumber}@gcp-sa-artifactregistry.iam.gserviceaccount.com`).";
+    }
+    return Effect.fail(new ConfigError({
+        message: `Artifact Registry Repository ${op} rejected: ${underlying}.${hint}`,
+    }));
+};
+//# sourceMappingURL=Validation.js.map

package/lib/ArtifactRegistry/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../src/ArtifactRegistry/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;;;;;GAOG;AAEH;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,IAAY,EACsB,EAAE;IACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,qCAAqC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+HAA+H;KAClM,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAsC,EACJ,EAAE;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,qBAAqB,CAAC;IACjD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,EAAE,gBAAgB,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;gBACd,OAAO,EAAE,wOAAwO;aAClP,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,gLAAgL;SAC1L,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,EAAiC,EAAE,EAAE,CACtC,CAAC,CAAuB,EAAqC,EAAE;IAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,+BAA+B,EAAE,EAAE,CAAC;IACpE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,IAAI;YACF,mQAAmQ,CAAC;IACxQ,CAAC;SAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI;YACF,sMAAsM,CAAC;IAC3M,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,gCAAgC,EAAE,cAAc,UAAU,IAAI,IAAI,EAAE;KAC9E,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/lib/ArtifactRegistry/index.d.ts

@@ -0,0 +1,4 @@
+export { ArtifactRegistryRepository, ArtifactRegistryRepositoryProvider, } from "./Repository.ts";
+export type { ArtifactRegistryDockerUpstream, ArtifactRegistryRepositoryAttributes, ArtifactRegistryRepositoryProps, } from "./Repository.ts";
+export type { ArtifactRegistryFormat, ArtifactRegistryMode } from "./Types.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/ArtifactRegistry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ArtifactRegistry/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,8BAA8B,EAC9B,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/lib/ArtifactRegistry/index.js

@@ -0,0 +1,2 @@
+export { ArtifactRegistryRepository, ArtifactRegistryRepositoryProvider, } from "./Repository.js";
+//# sourceMappingURL=index.js.map

package/lib/ArtifactRegistry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ArtifactRegistry/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,iBAAiB,CAAC"}

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAwBtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,uQAuCnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAiCtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,uQAmDnB,CAAC"}

package/lib/Providers.js

@@ -1,5 +1,6 @@
 import * as Provider from "alchemy/Provider";
 import * as Layer from "effect/Layer";
+import { ArtifactRegistryRepository, ArtifactRegistryRepositoryProvider, } from "./ArtifactRegistry/Repository.js";
 import { GCPAuth } from "./Auth/AuthProvider.js";
 import { fromAuthProvider } from "./Auth/Credentials.js";
 import { Project, ProjectProvider } from "./CloudResourceManager/Project.js";
@@ -11,8 +12,13 @@ import { Subnetwork, SubnetworkProvider } from "./Compute/Subnetwork.js";
 import { Cluster, ClusterProvider } from "./Container/Cluster.js";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.js";
 import { ManagedLustreInstance, ManagedLustreInstanceProvider, } from "./ManagedLustre/Instance.js";
+import { Job, JobProvider } from "./Run/Job.js";
+import { Service, ServiceProvider } from "./Run/Service.js";
 import { PsaConnection, PsaConnectionProvider, } from "./ServiceNetworking/PsaConnection.js";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.js";
+import { SqlDatabase, SqlDatabaseProvider } from "./Sqladmin/Database.js";
+import { SqlInstance, SqlInstanceProvider } from "./Sqladmin/Instance.js";
+import { SqlUser, SqlUserProvider } from "./Sqladmin/User.js";
 export class Providers extends Provider.ProviderCollection()("GCP") {
 }
 /**
@@ -42,7 +48,13 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     SharedVpcServiceProject,
     PsaConnection,
     ManagedLustreInstance,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+    Service,
+    Job,
+    SqlInstance,
+    SqlDatabase,
+    SqlUser,
+    ArtifactRegistryRepository,
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;CACtB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,CAChC,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;CAC3B,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,CACrC,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/Run/IamMember.d.ts

@@ -0,0 +1,70 @@
+import * as Effect from "effect/Effect";
+import type { Job } from "./Job.ts";
+import type { Service } from "./Service.ts";
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run
+ * {@link Service}.
+ *
+ * Target-side binding — see
+ * {@link import("../Compute/SubnetworkIamMember.ts").subnetworkIamMember}
+ * for the pattern, the SID-collision pitfall, and why `key` exists.
+ * Service's `reconcile` merges all bindings into a single
+ * `setIamPolicy` call against the service, preserving foreign roles
+ * and members on the policy. To remove a binding, drop the call and
+ * re-deploy — the provider is additive within the bindings we
+ * declared, but does NOT prune.
+ *
+ * The most common usage:
+ *
+ * - **Public invoker:** `{ role: "roles/run.invoker", member: "allUsers" }`
+ *   makes the service publicly reachable. Prefer this over
+ *   `invokerIamDisabled: true` on the {@link Service} props — declarative
+ *   IAM is auditable in `setIamPolicy` history; `invokerIamDisabled`
+ *   is a flag with no audit trail.
+ * - **Service-to-service:** a downstream service's runtime SA bound
+ *   to `roles/run.invoker` on the upstream service.
+ *
+ * @example Public Cloud Run service
+ * ```typescript
+ * const api = yield* GCP.Service("PublicApi", { ... });
+ * yield* GCP.serviceIamMember(api, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ *
+ * @example Service-to-service auth
+ * ```typescript
+ * const upstream = yield* GCP.Service("Upstream", { ... });
+ * yield* GCP.serviceIamMember(upstream, "DownstreamCaller", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${downstreamSa.email}`,
+ * });
+ * ```
+ */
+export declare const serviceIamMember: (service: Service, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run {@link Job}.
+ *
+ * Same target-side pattern as {@link serviceIamMember}. The most
+ * common Job binding is `roles/run.invoker` on the service account
+ * that triggers the job (Cloud Scheduler, Eventarc, Workflows, or a
+ * developer's user identity).
+ *
+ * @example Letting a Cloud Scheduler SA trigger the job
+ * ```typescript
+ * const nightly = yield* GCP.Job("Nightly", { ... });
+ * yield* GCP.jobIamMember(nightly, "SchedulerInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${schedulerSa.email}`,
+ * });
+ * ```
+ */
+export declare const jobIamMember: (job: Job, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+//# sourceMappingURL=IamMember.d.ts.map

package/lib/Run/IamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamMember.d.ts","sourceRoot":"","sources":["../../src/Run/IamMember.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,OAAO,EAChB,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGiB,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,GAAG,EACR,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGiB,CAAC"}