@microagi/alchemy-gcp 0.2.1 → 0.5.0

package/lib/Sqladmin/Instance.js

@@ -0,0 +1,251 @@
+import * as sql from "@distilled.cloud/gcp/sqladmin-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { diffTags } from "alchemy/Tags";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { reshapeBadRequest, validateInstanceName } from "./Validation.js";
+export const SqlInstance = Resource("GCP.SqlInstance");
+const toAddress = (m) => ({
+    type: m.type,
+    ipAddress: m.ipAddress,
+});
+const toAttributes = (i, parent) => {
+    const ipAddresses = (i.ipAddresses ?? []).map(toAddress);
+    return {
+        name: parent.name,
+        selfLink: i.selfLink ?? "",
+        project: parent.project,
+        region: parent.region,
+        connectionName: i.connectionName ?? `${parent.project}:${parent.region}:${parent.name}`,
+        databaseVersion: i.databaseVersion ?? "",
+        state: i.state ?? "",
+        ipAddresses,
+        privateIpAddress: ipAddresses.find((a) => a.type === "PRIVATE")?.ipAddress,
+        publicIpAddress: ipAddresses.find((a) => a.type === "PRIMARY")?.ipAddress,
+        serverCaCert: i.serverCaCert
+            ? {
+                cert: i.serverCaCert.cert,
+                commonName: i.serverCaCert.commonName,
+                expirationTime: i.serverCaCert.expirationTime,
+                sha1Fingerprint: i.serverCaCert.sha1Fingerprint,
+            }
+            : undefined,
+        settingsVersion: i.settings?.settingsVersion,
+        labels: { ...(i.settings?.userLabels ?? {}) },
+    };
+};
+/**
+ * Build the `Settings` body sent to the API.
+ *
+ * Only sets fields the user has populated, so distinct from a settings
+ * stanza diff: server-injected defaults aren't overwritten by an
+ * `undefined` from us.
+ */
+const toSettingsBody = (s, userLabels, settingsVersion) => ({
+    tier: s.tier,
+    userLabels,
+    ...(s.edition ? { edition: s.edition } : {}),
+    ...(s.dataDiskSizeGb !== undefined
+        ? { dataDiskSizeGb: String(s.dataDiskSizeGb) }
+        : {}),
+    ...(s.dataDiskType ? { dataDiskType: s.dataDiskType } : {}),
+    ...(s.diskAutoresize !== undefined
+        ? { storageAutoResize: s.diskAutoresize }
+        : {}),
+    ...(s.diskAutoresizeLimit !== undefined
+        ? { storageAutoResizeLimit: String(s.diskAutoresizeLimit) }
+        : {}),
+    ...(s.ipConfiguration
+        ? {
+            ipConfiguration: {
+                ...(s.ipConfiguration.ipv4Enabled !== undefined
+                    ? { ipv4Enabled: s.ipConfiguration.ipv4Enabled }
+                    : {}),
+                ...(s.ipConfiguration.privateNetwork
+                    ? { privateNetwork: s.ipConfiguration.privateNetwork }
+                    : {}),
+                ...(s.ipConfiguration.enablePrivatePathForGoogleCloudServices !==
+                    undefined
+                    ? {
+                        enablePrivatePathForGoogleCloudServices: s.ipConfiguration.enablePrivatePathForGoogleCloudServices,
+                    }
+                    : {}),
+                ...(s.ipConfiguration.requireSsl !== undefined
+                    ? { requireSsl: s.ipConfiguration.requireSsl }
+                    : {}),
+            },
+        }
+        : {}),
+    ...(s.backupConfiguration ? { backupConfiguration: s.backupConfiguration } : {}),
+    ...(s.databaseFlags ? { databaseFlags: s.databaseFlags } : {}),
+    ...(s.deletionProtectionEnabled !== undefined
+        ? { deletionProtectionEnabled: s.deletionProtectionEnabled }
+        : {}),
+    ...(s.activationPolicy ? { activationPolicy: s.activationPolicy } : {}),
+    ...(s.availabilityType ? { availabilityType: s.availabilityType } : {}),
+    ...(settingsVersion !== undefined ? { settingsVersion } : {}),
+});
+export const SqlInstanceProvider = () => Provider.effect(SqlInstance, Effect.gen(function* () {
+    const getInstances = yield* sql.getInstances;
+    const insertInstances = yield* sql.insertInstances;
+    const patchInstances = yield* sql.patchInstances;
+    const deleteInstances = yield* sql.deleteInstances;
+    const getOperations = yield* sql.getOperations;
+    const awaitOperation = makeAwaitOperation(getOperations);
+    const observe = (project, name) => getInstances({ project, instance: name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const syncMutable = Effect.fn(function* (args) {
+        const obsSettings = args.observed.settings ?? {};
+        const desiredSettingsForCompare = toSettingsBody(args.news.settings, args.desiredLabels);
+        // Per-field diff — settingsVersion is added below only if we
+        // actually need to patch, so it's not part of the no-op check.
+        let needPatch = false;
+        const reasons = [];
+        const compare = (key, a, b) => {
+            if (!deepEqual(a, b)) {
+                needPatch = true;
+                reasons.push(key);
+            }
+        };
+        compare("tier", obsSettings.tier, desiredSettingsForCompare.tier);
+        compare("edition", obsSettings.edition, desiredSettingsForCompare.edition);
+        compare("dataDiskSizeGb", obsSettings.dataDiskSizeGb, desiredSettingsForCompare.dataDiskSizeGb);
+        compare("dataDiskType", obsSettings.dataDiskType, desiredSettingsForCompare.dataDiskType);
+        compare("storageAutoResize", obsSettings.storageAutoResize, desiredSettingsForCompare.storageAutoResize);
+        compare("storageAutoResizeLimit", obsSettings.storageAutoResizeLimit, desiredSettingsForCompare.storageAutoResizeLimit);
+        compare("ipConfiguration", obsSettings.ipConfiguration, desiredSettingsForCompare.ipConfiguration);
+        compare("backupConfiguration", obsSettings.backupConfiguration, desiredSettingsForCompare.backupConfiguration);
+        compare("databaseFlags", obsSettings.databaseFlags ?? [], desiredSettingsForCompare.databaseFlags ?? []);
+        compare("deletionProtectionEnabled", obsSettings.deletionProtectionEnabled, desiredSettingsForCompare.deletionProtectionEnabled);
+        compare("activationPolicy", obsSettings.activationPolicy, desiredSettingsForCompare.activationPolicy);
+        compare("availabilityType", obsSettings.availabilityType, desiredSettingsForCompare.availabilityType);
+        const labelDiff = diffTags({ ...(obsSettings.userLabels ?? {}) }, args.desiredLabels);
+        if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0) {
+            needPatch = true;
+            reasons.push("userLabels");
+        }
+        if (!needPatch)
+            return;
+        // Thread the observed settingsVersion through the patch body
+        // — Cloud SQL uses it as the optimistic-concurrency token
+        // (etag is deprecated on this resource).
+        const body = {
+            settings: toSettingsBody(args.news.settings, args.desiredLabels, obsSettings.settingsVersion),
+        };
+        const op = yield* patchInstances({
+            project: args.project,
+            instance: args.name,
+            body,
+        }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("Instance", "patch")));
+        if (op.name)
+            yield* awaitOperation(args.project, op.name, args.session);
+    });
+    return {
+        stables: ["name", "selfLink", "project", "region", "connectionName"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "region",
+                "name",
+                "databaseVersion",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const internalLabels = yield* gcpInternalLabels(id);
+            const desiredName = news.name ??
+                (yield* createPhysicalName({ id, maxLength: 98 })).toLowerCase();
+            yield* validateInstanceName(desiredName);
+            const desiredLabels = {
+                ...(news.labels ?? {}),
+                ...internalLabels,
+            };
+            // 1. Observe — collapse 403 to "missing" alongside 404.
+            let observed = yield* observe(news.project, desiredName);
+            // 2. Ensure — insert. Like Cloud Run / GKE, sqladmin can 403
+            //    with "Cloud SQL Admin API has not been used in project
+            //    ... If you enabled this API recently, wait …" for ~1–2
+            //    minutes after ApiEnable lands. Retry the insert on that
+            //    specific 403; other Forbidden cases propagate.
+            if (!observed) {
+                const op = yield* insertInstances({
+                    project: news.project,
+                    body: {
+                        name: desiredName,
+                        region: news.region,
+                        databaseVersion: news.databaseVersion,
+                        ...(news.rootPassword
+                            ? { rootPassword: Redacted.value(news.rootPassword) }
+                            : {}),
+                        settings: toSettingsBody(news.settings, desiredLabels),
+                    },
+                }).pipe(Effect.retry({
+                    while: (e) => e?._tag === "Forbidden" &&
+                        /enabled this API recently|has not been used/i.test(e.message ?? ""),
+                    schedule: Schedule.spaced(Duration.seconds(15)).pipe(Schedule.both(Schedule.recurs(20)), Schedule.tapOutput(() => session.note("Waiting for Cloud SQL Admin API enablement to propagate…"))),
+                }), Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("Instance", "insert")));
+                if (op?.name)
+                    yield* awaitOperation(news.project, op.name, session);
+                observed = yield* getInstances({
+                    project: news.project,
+                    instance: desiredName,
+                });
+            }
+            // 3. Sync — single patch with the full settings body when any
+            //    field drifts. settingsVersion threaded through for OCC.
+            yield* syncMutable({
+                project: news.project,
+                name: desiredName,
+                observed,
+                news,
+                desiredLabels,
+                session,
+            });
+            const final = yield* getInstances({
+                project: news.project,
+                instance: desiredName,
+            });
+            return toAttributes(final, {
+                project: news.project,
+                region: news.region,
+                name: desiredName,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteInstances({
+                project: output.project,
+                instance: output.name,
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOperation(output.project, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("BadRequest", reshapeBadRequest("Instance", "delete")));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const region = output?.region ?? olds?.region;
+            if (!project || !region)
+                return undefined;
+            const name = output?.name ??
+                olds?.name ??
+                (yield* createPhysicalName({ id, maxLength: 98 })).toLowerCase();
+            const observed = yield* observe(project, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, { project, region, name });
+            return (yield* hasAlchemyLabels(id, observed.settings?.userLabels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=Instance.js.map

package/lib/Sqladmin/Instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Instance.js","sourceRoot":"","sources":["../../src/Sqladmin/Instance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,kCAAkC,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAQrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AA4O1E,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAc,iBAAiB,CAAC,CAAC;AAEpE,MAAM,SAAS,GAAG,CAAC,CAAgB,EAAwB,EAAE,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,SAAS,EAAE,CAAC,CAAC,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAAuB,EACvB,MAAyD,EAClC,EAAE;IACzB,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EACZ,CAAC,CAAC,cAAc,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QACzE,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACxC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW;QACX,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS;QAC1E,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS;QACzE,YAAY,EAAE,CAAC,CAAC,YAAY;YAC1B,CAAC,CAAC;gBACE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;gBACzB,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,UAAU;gBACrC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,cAAc;gBAC7C,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,eAAe;aAChD;YACH,CAAC,CAAC,SAAS;QACb,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe;QAC5C,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE;KAC9C,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CACrB,CAA+B,EAC/B,UAAkC,EAClC,eAAwB,EACV,EAAE,CAAC,CAAC;IAClB,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,UAAU;IACV,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,cAAc,EAAE;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,CAAC,CAAC,mBAAmB,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,CAAC,CAAC,eAAe;QACnB,CAAC,CAAC;YACE,eAAe,EAAE;gBACf,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS;oBAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,cAAc;oBAClC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,eAAe,CAAC,cAAc,EAAE;oBACtD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,uCAAuC;oBAC7D,SAAS;oBACP,CAAC,CAAC;wBACE,uCAAuC,EACrC,CAAC,CAAC,eAAe,CAAC,uCAAuC;qBAC5D;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,GAAG,CAAC,CAAC,CAAC,yBAAyB,KAAK,SAAS;QAC3C,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,EAAE;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,MAAM,CACb,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;IACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;IACnD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,cAAc,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE,CAChD,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAA6C,CAAC,CAC9D,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAA6C,CAAC,CAC9D,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAOxC;QACC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjD,MAAM,yBAAyB,GAAG,cAAc,CAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,6DAA6D;QAC7D,+DAA+D;QAC/D,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,CAAU,EAAE,CAAU,EAAE,EAAE;YACtD,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACrB,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,CACL,SAAS,EACT,WAAW,CAAC,OAAO,EACnB,yBAAyB,CAAC,OAAO,CAClC,CAAC;QACF,OAAO,CACL,gBAAgB,EAChB,WAAW,CAAC,cAAc,EAC1B,yBAAyB,CAAC,cAAc,CACzC,CAAC;QACF,OAAO,CACL,cAAc,EACd,WAAW,CAAC,YAAY,EACxB,yBAAyB,CAAC,YAAY,CACvC,CAAC;QACF,OAAO,CACL,mBAAmB,EACnB,WAAW,CAAC,iBAAiB,EAC7B,yBAAyB,CAAC,iBAAiB,CAC5C,CAAC;QACF,OAAO,CACL,wBAAwB,EACxB,WAAW,CAAC,sBAAsB,EAClC,yBAAyB,CAAC,sBAAsB,CACjD,CAAC;QACF,OAAO,CACL,iBAAiB,EACjB,WAAW,CAAC,eAAe,EAC3B,yBAAyB,CAAC,eAAe,CAC1C,CAAC;QACF,OAAO,CACL,qBAAqB,EACrB,WAAW,CAAC,mBAAmB,EAC/B,yBAAyB,CAAC,mBAAmB,CAC9C,CAAC;QACF,OAAO,CACL,eAAe,EACf,WAAW,CAAC,aAAa,IAAI,EAAE,EAC/B,yBAAyB,CAAC,aAAa,IAAI,EAAE,CAC9C,CAAC;QACF,OAAO,CACL,2BAA2B,EAC3B,WAAW,CAAC,yBAAyB,EACrC,yBAAyB,CAAC,yBAAyB,CACpD,CAAC;QACF,OAAO,CACL,kBAAkB,EAClB,WAAW,CAAC,gBAAgB,EAC5B,yBAAyB,CAAC,gBAAgB,CAC3C,CAAC;QACF,OAAO,CACL,kBAAkB,EAClB,WAAW,CAAC,gBAAgB,EAC5B,yBAAyB,CAAC,gBAAgB,CAC3C,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CACxB,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EACrC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,6DAA6D;QAC7D,0DAA0D;QAC1D,yCAAyC;QACzC,MAAM,IAAI,GAAyB;YACjC,QAAQ,EAAE,cAAc,CACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,aAAa,EAClB,WAAW,CAAC,eAAe,CAC5B;SACF,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI;SACL,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC;QACF,IAAI,EAAE,CAAC,IAAI;YAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QACpE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAwB,EAAE,IAAI,EAAE;gBACpD,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,iBAAiB;aAClB,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,KAAK,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAEzC,MAAM,aAAa,GAA2B;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,cAAc;aAClB,CAAC;YAEF,wDAAwD;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEzD,6DAA6D;YAC7D,4DAA4D;YAC5D,4DAA4D;YAC5D,6DAA6D;YAC7D,oDAAoD;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE;wBACJ,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,eAAe,EAAE,IAAI,CAAC,eAAe;wBACrC,GAAG,CAAC,IAAI,CAAC,YAAY;4BACnB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;4BACrD,CAAC,CAAC,EAAE,CAAC;wBACP,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;qBACvD;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,EAAE,CAAC,CAAsC,EAAE,EAAE,CAChD,CAAC,EAAE,IAAI,KAAK,WAAW;wBACvB,8CAA8C,CAAC,IAAI,CACjD,CAAC,CAAC,OAAO,IAAI,EAAE,CAChB;oBACH,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CACV,0DAA0D,CAC3D,CACF,CACF;iBACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAsC,CAAC,CACvD,EACD,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CACxC,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACpE,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,8DAA8D;YAC9D,6DAA6D;YAC7D,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,WAAW;gBACjB,QAAQ;gBACR,IAAI;gBACJ,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,eAAe,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAClD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CACxC,CACF,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACjE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Sqladmin/Operations.d.ts

@@ -0,0 +1,41 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as sql from "@distilled.cloud/gcp/sqladmin-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Effect from "effect/Effect";
+/**
+ * Resolved callable signature of `sql.getOperations`.
+ *
+ * `sql.getOperations` is itself an `Effect<callable, never, Credentials |
+ * HttpClient>`, so `Effect.Success` extracts the callable. Using a
+ * derived alias keeps the helper aligned with the SDK without us
+ * hand-writing the input/output/error union, which would drift if the
+ * patch set changes.
+ */
+type GetOperations = Effect.Success<typeof sql.getOperations>;
+/**
+ * Build the Cloud SQL Admin long-running-operation polling helper.
+ *
+ * Sqladmin `Operation`s carry `.status: "PENDING" | "RUNNING" | "DONE"`
+ * (NOT `.done: boolean` like Cloud Resource Manager / Cloud Run, and
+ * NOT `.status === "DONE"` against a different enum). Verified at
+ * `vendor/distilled/packages/gcp/src/services/sqladmin-v1.ts:606–612`.
+ *
+ * Unlike Cloud Run, Sqladmin operations are NOT fully-qualified path
+ * names — the API returns a bare operation id (e.g. `e9e88dca-...`),
+ * and `getOperations` takes `{ project, operation }`. Callers therefore
+ * pass the bare id alongside the parent project context.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped via the count cap of
+ * 60 retries → roughly a few minutes wall ceiling. Most Cloud SQL
+ * operations (CREATE_USER, CREATE_DATABASE, UPDATE settings) finish
+ * in 1–30 s; instance CREATE / patch involving a restart are the long
+ * pole at 4–10 min, so callers running those should be aware that
+ * recurs(60) may bottom out and surface as a retry budget exhaustion.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/operations
+ */
+export declare const makeAwaitOperation: (getOperations: GetOperations) => (project: string, operationName: string, session: ScopedPlanStatusSession) => Effect.Effect<sql.Operation, ConfigError | sql.GetOperationsError | {
+    _tag: "OperationPending";
+}, never>;
+export {};
+//# sourceMappingURL=Operations.d.ts.map

package/lib/Sqladmin/Operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Operations.d.ts","sourceRoot":"","sources":["../../src/Sqladmin/Operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,kCAAkC,CAAC;AACxD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;;;;;;GAQG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kBAAkB,GAAI,eAAe,aAAa;;SAgC3D,CAAC"}

package/lib/Sqladmin/Operations.js

@@ -0,0 +1,42 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+/**
+ * Build the Cloud SQL Admin long-running-operation polling helper.
+ *
+ * Sqladmin `Operation`s carry `.status: "PENDING" | "RUNNING" | "DONE"`
+ * (NOT `.done: boolean` like Cloud Resource Manager / Cloud Run, and
+ * NOT `.status === "DONE"` against a different enum). Verified at
+ * `vendor/distilled/packages/gcp/src/services/sqladmin-v1.ts:606–612`.
+ *
+ * Unlike Cloud Run, Sqladmin operations are NOT fully-qualified path
+ * names — the API returns a bare operation id (e.g. `e9e88dca-...`),
+ * and `getOperations` takes `{ project, operation }`. Callers therefore
+ * pass the bare id alongside the parent project context.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped via the count cap of
+ * 60 retries → roughly a few minutes wall ceiling. Most Cloud SQL
+ * operations (CREATE_USER, CREATE_DATABASE, UPDATE settings) finish
+ * in 1–30 s; instance CREATE / patch involving a restart are the long
+ * pole at 4–10 min, so callers running those should be aware that
+ * recurs(60) may bottom out and surface as a retry budget exhaustion.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/operations
+ */
+export const makeAwaitOperation = (getOperations) => Effect.fn(function* (project, operationName, session) {
+    const op = yield* getOperations({ project, operation: operationName }).pipe(Effect.flatMap((current) => current.status === "DONE"
+        ? Effect.succeed(current)
+        : Effect.fail({ _tag: "OperationPending" })), Effect.retry({
+        while: (e) => e?._tag === "OperationPending",
+        schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(Schedule.either(Schedule.spaced(Duration.seconds(10))), Schedule.both(Schedule.recurs(60)), Schedule.tapOutput(() => session.note(`Waiting for Cloud SQL operation ${operationName}…`))),
+    }));
+    if (op.error) {
+        const firstErr = op.error.errors?.[0];
+        return yield* new ConfigError({
+            message: `Cloud SQL operation ${operationName} failed: ${firstErr?.message ?? JSON.stringify(op.error)}`,
+        });
+    }
+    return op;
+});
+//# sourceMappingURL=Operations.js.map

package/lib/Sqladmin/Operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Operations.js","sourceRoot":"","sources":["../../src/Sqladmin/Operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAa5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAA4B,EAAE,EAAE,CACjE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACjB,OAAe,EACf,aAAqB,EACrB,OAAgC;IAEhC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAA2B,EAAE,CAAC,CACvD,EACD,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,kBAAkB;QAC/D,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAC3D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CACtB,OAAO,CAAC,IAAI,CAAC,mCAAmC,aAAa,GAAG,CAAC,CAClE,CACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;YAC5B,OAAO,EAAE,uBAAuB,aAAa,YAC3C,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAC9C,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC"}

package/lib/Sqladmin/Types.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Branded literal-union types for Cloud SQL props.
+ *
+ * Distilled's generated `databaseVersion` field is an open-tailed union
+ * (`"POSTGRES_15" | … | (string & {})`) so the GCP server can ship new
+ * versions without breaking SDK consumers. For our props we narrow to
+ * the subset we actually support — at the moment, the supported
+ * Postgres versions for greenfield instances. This gives consumers
+ * compile-time autocomplete and rejects typos like `"POSTGES_15"`.
+ *
+ * MySQL / SQL Server enum members are intentionally omitted — we only
+ * provision Postgres. Add a sibling `MySqlVersion` / `SqlServerVersion`
+ * type if/when those land as targets.
+ */
+/**
+ * Supported Postgres major versions for new Cloud SQL instances.
+ *
+ * Cloud SQL only allows creating instances on currently-supported
+ * majors. As of 2026-06, that's 13–17 for greenfield; we expose 15+
+ * since that's what new MicroAGI stacks target. Older versions can be
+ * read/managed but should be migrated.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/db-versions
+ */
+export type PostgresVersion = "POSTGRES_15" | "POSTGRES_16" | "POSTGRES_17";
+/**
+ * Cloud SQL edition. `ENTERPRISE_PLUS` unlocks Data Cache, near-zero
+ * downtime planned maintenance, and longer log retention; `ENTERPRISE`
+ * is the standard tier.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/editions-intro
+ */
+export type SqlEdition = "ENTERPRISE" | "ENTERPRISE_PLUS";
+/**
+ * Data-disk type. PD_SSD is the default and what any new workload
+ * should pick. PD_HDD is legacy and slower; only useful for archival
+ * read replicas.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/instance-settings#storage-type-2ndgen
+ */
+export type SqlDataDiskType = "PD_SSD" | "PD_HDD";
+/**
+ * Availability type. `ZONAL` runs in one zone; `REGIONAL` runs a
+ * standby in a second zone for HA at ~2× the cost.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/high-availability
+ */
+export type SqlAvailabilityType = "ZONAL" | "REGIONAL";
+/**
+ * Activation policy. `ALWAYS` keeps the instance on; `NEVER` parks
+ * it (useful for occasional dev databases).
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/start-stop-restart-instance
+ */
+export type SqlActivationPolicy = "ALWAYS" | "NEVER";
+/**
+ * Cloud SQL user auth type.
+ *
+ * - `BUILT_IN` — classic username + password Postgres role. The
+ *   provider requires a `password` Redacted for this type.
+ * - `CLOUD_IAM_USER` — a human IAM principal authenticated via the
+ *   Cloud SQL Auth Proxy / IAM database authn token exchange.
+ * - `CLOUD_IAM_SERVICE_ACCOUNT` — a GCP service-account principal,
+ *   same auth mechanism as `CLOUD_IAM_USER`. The Postgres role name
+ *   is the SA email **with the trailing `.gserviceaccount.com`
+ *   stripped** (Cloud SQL caps role names at 63 chars; SA emails are
+ *   longer than that).
+ * - Open tail `(string & {})` keeps forward compatibility for
+ *   `CLOUD_IAM_GROUP`, `CLOUD_IAM_GROUP_SERVICE_ACCOUNT`, etc.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/iam-authentication
+ */
+export type SqlUserType = "BUILT_IN" | "CLOUD_IAM_USER" | "CLOUD_IAM_SERVICE_ACCOUNT" | "CLOUD_IAM_GROUP" | (string & {});
+/**
+ * Convenience predicate: `true` for any IAM-backed user type, where
+ * passwords are forbidden and the principal is a GCP identity.
+ *
+ * Used by `Validation.ts` and `User.ts` to fan out between the
+ * built-in password path and the IAM token-exchange path.
+ */
+export declare const isIamUserType: (type: SqlUserType | undefined) => boolean;
+//# sourceMappingURL=Types.d.ts.map

package/lib/Sqladmin/Types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Types.d.ts","sourceRoot":"","sources":["../../src/Sqladmin/Types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,gBAAgB,GAChB,2BAA2B,GAC3B,iBAAiB,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,GAAG,SAAS,KAC5B,OAMsB,CAAC"}

package/lib/Sqladmin/Types.js

@@ -0,0 +1,28 @@
+/**
+ * Branded literal-union types for Cloud SQL props.
+ *
+ * Distilled's generated `databaseVersion` field is an open-tailed union
+ * (`"POSTGRES_15" | … | (string & {})`) so the GCP server can ship new
+ * versions without breaking SDK consumers. For our props we narrow to
+ * the subset we actually support — at the moment, the supported
+ * Postgres versions for greenfield instances. This gives consumers
+ * compile-time autocomplete and rejects typos like `"POSTGES_15"`.
+ *
+ * MySQL / SQL Server enum members are intentionally omitted — we only
+ * provision Postgres. Add a sibling `MySqlVersion` / `SqlServerVersion`
+ * type if/when those land as targets.
+ */
+/**
+ * Convenience predicate: `true` for any IAM-backed user type, where
+ * passwords are forbidden and the principal is a GCP identity.
+ *
+ * Used by `Validation.ts` and `User.ts` to fan out between the
+ * built-in password path and the IAM token-exchange path.
+ */
+export const isIamUserType = (type) => type === "CLOUD_IAM_USER" ||
+    type === "CLOUD_IAM_SERVICE_ACCOUNT" ||
+    type === "CLOUD_IAM_GROUP" ||
+    type === "CLOUD_IAM_GROUP_USER" ||
+    type === "CLOUD_IAM_GROUP_SERVICE_ACCOUNT" ||
+    type === "ENTRAID_USER";
+//# sourceMappingURL=Types.js.map

package/lib/Sqladmin/Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Types.js","sourceRoot":"","sources":["../../src/Sqladmin/Types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAA6B,EACpB,EAAE,CACX,IAAI,KAAK,gBAAgB;IACzB,IAAI,KAAK,2BAA2B;IACpC,IAAI,KAAK,iBAAiB;IAC1B,IAAI,KAAK,sBAAsB;IAC/B,IAAI,KAAK,iCAAiC;IAC1C,IAAI,KAAK,cAAc,CAAC"}

package/lib/Sqladmin/User.d.ts

@@ -0,0 +1,110 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import * as Redacted from "effect/Redacted";
+import type * as GCP from "../Providers.ts";
+import { type SqlUserType } from "./Types.ts";
+/**
+ * A Cloud SQL user (database role + auth binding).
+ *
+ * **Three auth modes:**
+ *
+ * - `BUILT_IN` — classic Postgres username/password. Requires
+ *   `password`. The role exists only inside Postgres.
+ * - `CLOUD_IAM_USER` — a human IAM principal. `name` is the user's
+ *   email. Authenticates via the Cloud SQL Auth Proxy / IAM token
+ *   exchange; no password.
+ * - `CLOUD_IAM_SERVICE_ACCOUNT` — a GCP service account principal.
+ *   `name` is the SA email with the trailing `.gserviceaccount.com`
+ *   stripped (Postgres role names cap at 63 chars; full SA emails
+ *   often exceed that). No password.
+ *
+ * The Postgres role itself is granted no privileges by default — wire
+ * up grants via SQL (psql / migrations) once the user exists. Cloud
+ * SQL IAM authn is independent of grant management.
+ *
+ * **Adoption.** Users carry no labels and no useful comparable shape
+ * beyond `(name, host, type)`. `read` returns the observed user if it
+ * exists at this address, `undefined` otherwise. No `Unowned` wrapper
+ * — adoption is implicit; the worst case is alchemy issuing a no-op
+ * patch / a delete on what it thinks is its own.
+ *
+ * **Replace triggers.** `project`, `instance`, `name`, `host`, `type`.
+ * Type changes need a drop/recreate because Cloud SQL stores the auth
+ * shape immutably; we surface that via replace.
+ *
+ * @example IAM service-account user (workload identity → DB role)
+ * ```typescript
+ * yield* GCP.SqlUser("AppSaUser", {
+ *   project: instance.project,
+ *   instance: instance.name,
+ *   // App SA email is `app@my-project.iam.gserviceaccount.com` — strip
+ *   // `.gserviceaccount.com` so the Postgres role name fits in 63 chars.
+ *   name: "app@my-project.iam",
+ *   type: "CLOUD_IAM_SERVICE_ACCOUNT",
+ * });
+ * ```
+ *
+ * @example Built-in user with a Redacted password
+ * ```typescript
+ * yield* GCP.SqlUser("MigratorUser", {
+ *   project: instance.project,
+ *   instance: instance.name,
+ *   name: "migrator",
+ *   password: Redacted.make(process.env.MIGRATOR_PASSWORD!),
+ * });
+ * ```
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/users
+ * @see https://cloud.google.com/sql/docs/postgres/iam-authentication
+ */
+export type SqlUserProps = {
+    /**
+     * GCP project ID hosting the parent instance. Immutable — replace.
+     * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/users#User
+     */
+    project: string;
+    /**
+     * Parent Cloud SQL instance name. Immutable — replace.
+     */
+    instance: string;
+    /**
+     * User/role name. For `BUILT_IN`, any valid Postgres identifier.
+     * For `CLOUD_IAM_USER`, the principal's email. For
+     * `CLOUD_IAM_SERVICE_ACCOUNT`, the SA email **with the trailing
+     * `.gserviceaccount.com` stripped** — Postgres role names cap at
+     * 63 chars; full SA emails are typically 70+. Immutable — replace.
+     */
+    name: string;
+    /**
+     * Host the user can connect from. PostgreSQL ignores this and
+     * defaults to `%` (any host). For MySQL it's load-bearing.
+     * Immutable — replace.
+     */
+    host?: string;
+    /**
+     * Auth backend. Defaults to `BUILT_IN` if unset.
+     * @see https://cloud.google.com/sql/docs/postgres/iam-authentication
+     */
+    type?: SqlUserType;
+    /**
+     * Password for `BUILT_IN` users. Required for that type; forbidden
+     * for any IAM type (validated at plan time).
+     */
+    password?: Redacted.Redacted<string>;
+};
+export type SqlUserAttributes = {
+    /** User name. */
+    name: string;
+    /** Parent instance name. */
+    instance: string;
+    /** Project ID. */
+    project: string;
+    /** Connecting host (defaults to `%` for Postgres). */
+    host: string;
+    /** Auth backend in effect. */
+    type: string;
+};
+export type SqlUser = Resource<"GCP.SqlUser", SqlUserProps, SqlUserAttributes, never, GCP.Providers>;
+export declare const SqlUser: import("alchemy").ResourceClass<SqlUser>;
+export declare const SqlUserProvider: () => import("effect/Layer").Layer<Provider.Provider<SqlUser>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/gcp").Credentials>;
+//# sourceMappingURL=User.d.ts.map

package/lib/Sqladmin/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/Sqladmin/User.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,OAAO,0CAAmC,CAAC;AAaxD,eAAO,MAAM,eAAe,0KAsMzB,CAAC"}