@microagi/alchemy-gcp 0.3.0 → 0.5.1

package/lib/Sqladmin/User.js

@@ -0,0 +1,156 @@
+import * as sql from "@distilled.cloud/gcp/sqladmin-v1";
+import { Resource } from "alchemy";
+import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { makeAwaitOperation } from "./Operations.js";
+import { isIamUserType } from "./Types.js";
+import { reshapeBadRequest, validateUser } from "./Validation.js";
+export const SqlUser = Resource("GCP.SqlUser");
+const toAttributes = (u, parent) => ({
+    name: parent.name,
+    instance: parent.instance,
+    project: parent.project,
+    host: u.host ?? parent.host,
+    type: u.type ?? "BUILT_IN",
+});
+export const SqlUserProvider = () => Provider.effect(SqlUser, Effect.gen(function* () {
+    const getUsers = yield* sql.getUsers;
+    const listUsers = yield* sql.listUsers;
+    const insertUsers = yield* sql.insertUsers;
+    const updateUsers = yield* sql.updateUsers;
+    const deleteUsers = yield* sql.deleteUsers;
+    const getOperations = yield* sql.getOperations;
+    const awaitOperation = makeAwaitOperation(getOperations);
+    /**
+     * Observe a user. Cloud SQL's `getUsers` endpoint returns 404
+     * for IAM-typed users in some Postgres minor versions — those
+     * are listable but not directly addressable by `name`. Fall
+     * back to a list filter on 404 to be safe.
+     */
+    const observe = (project, instance, name, host) => getUsers({
+        project,
+        instance,
+        name,
+        ...(host ? { host } : {}),
+    }).pipe(Effect.catchTag("NotFound", () => listUsers({ project, instance }).pipe(Effect.map((res) => (res.items ?? []).find((u) => u.name === name && (host ? u.host === host : true))), Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)))), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    return {
+        stables: ["name", "instance", "project", "host", "type"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            if (somePropsAreDifferent(olds, news, [
+                "project",
+                "instance",
+                "name",
+                "host",
+                "type",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+            const desiredType = news.type ?? "BUILT_IN";
+            const desiredHost = news.host ?? "%";
+            yield* validateUser({
+                name: news.name,
+                type: desiredType,
+                hasPassword: news.password !== undefined,
+            });
+            let observed = yield* observe(news.project, news.instance, news.name, news.host);
+            if (!observed) {
+                const body = {
+                    name: news.name,
+                    ...(news.host !== undefined ? { host: news.host } : {}),
+                    type: desiredType,
+                    ...(news.password
+                        ? { password: Redacted.value(news.password) }
+                        : {}),
+                };
+                const op = yield* insertUsers({
+                    project: news.project,
+                    instance: news.instance,
+                    body,
+                }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)), Effect.catchTag("BadRequest", reshapeBadRequest("User", "insert")));
+                if (op?.name)
+                    yield* awaitOperation(news.project, op.name, session);
+                observed = yield* observe(news.project, news.instance, news.name, news.host);
+            }
+            else if (
+            // Only BUILT_IN users have a rotatable password. For IAM
+            // users the type is fixed at insert and there's nothing
+            // mutable to sync. We don't store/compare BUILT_IN
+            // passwords (they're write-only on the API side) — if the
+            // user explicitly supplies one we re-issue the update so
+            // a rotated `Redacted` propagates, but we can't detect
+            // drift here so this is a deliberate "user is source of
+            // truth" path.
+            !isIamUserType(desiredType) &&
+                news.password) {
+                const op = yield* updateUsers({
+                    project: news.project,
+                    instance: news.instance,
+                    name: news.name,
+                    ...(news.host !== undefined ? { host: news.host } : {}),
+                    body: {
+                        name: news.name,
+                        ...(news.host !== undefined ? { host: news.host } : {}),
+                        type: desiredType,
+                        password: Redacted.value(news.password),
+                    },
+                }).pipe(Effect.catchTag("BadRequest", reshapeBadRequest("User", "update")));
+                if (op.name)
+                    yield* awaitOperation(news.project, op.name, session);
+            }
+            // observed is non-undefined here: either we just created it
+            // and re-observed, or we found it pre-existing. If somehow
+            // listUsers still returns nothing (eventual consistency
+            // window), synthesise a minimal attribute set from inputs.
+            if (!observed) {
+                return {
+                    name: news.name,
+                    instance: news.instance,
+                    project: news.project,
+                    host: desiredHost,
+                    type: desiredType,
+                };
+            }
+            return toAttributes(observed, {
+                project: news.project,
+                instance: news.instance,
+                name: news.name,
+                host: desiredHost,
+            });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            yield* deleteUsers({
+                project: output.project,
+                instance: output.instance,
+                name: output.name,
+                ...(output.host && output.host !== "%" ? { host: output.host } : {}),
+            }).pipe(Effect.flatMap((op) => op.name
+                ? awaitOperation(output.project, op.name, session)
+                : Effect.succeed(op)), Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag("BadRequest", reshapeBadRequest("User", "delete")));
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+            const project = output?.project ?? olds?.project;
+            const instance = output?.instance ?? olds?.instance;
+            const name = output?.name ?? olds?.name;
+            if (!project || !instance || !name)
+                return undefined;
+            const host = output?.host ?? olds?.host;
+            const observed = yield* observe(project, instance, name, host);
+            if (!observed)
+                return undefined;
+            return toAttributes(observed, {
+                project,
+                instance,
+                name,
+                host: host ?? "%",
+            });
+        }),
+    };
+}));
+//# sourceMappingURL=User.js.map

package/lib/Sqladmin/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../src/Sqladmin/User.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,kCAAkC,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAgHlE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD,MAAM,YAAY,GAAG,CACnB,CAAW,EACX,MAAyE,EACtD,EAAE,CAAC,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,UAAU;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,cAAc,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,MAAM,OAAO,GAAG,CACd,OAAe,EACf,QAAgB,EAChB,IAAY,EACZ,IAAwB,EACxB,EAAE,CACF,QAAQ,CAAC;QACP,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjB,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAC1D,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAiC,CAAC,CAClD,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAiC,CAAC,CAClD,CACF,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAiC,CAAC,CAClD,CACF,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,qBAAqB,CAAC,IAAoB,EAAE,IAAI,EAAE;gBAChD,SAAS;gBACT,UAAU;gBACV,MAAM;gBACN,MAAM;gBACN,MAAM;aACP,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;YAErC,KAAK,CAAC,CAAC,YAAY,CAAC;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS;aACzC,CAAC,CAAC;YAEH,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAC3B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,CACV,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,GAAa;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,IAAI,EAAE,WAAW;oBACjB,GAAG,CAAC,IAAI,CAAC,QAAQ;wBACf,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAC7C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI;iBACL,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAsC,CAAC,CACvD,EACD,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACpC,CACF,CAAC;gBACF,IAAI,EAAE,EAAE,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACpE,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CACvB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,CACV,CAAC;YACJ,CAAC;iBAAM;YACL,yDAAyD;YACzD,wDAAwD;YACxD,mDAAmD;YACnD,0DAA0D;YAC1D,yDAAyD;YACzD,uDAAuD;YACvD,wDAAwD;YACxD,eAAe;YACf,CAAC,aAAa,CAAC,WAAW,CAAC;gBAC3B,IAAI,CAAC,QAAQ,EACb,CAAC;gBACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,IAAI,EAAE,WAAW;wBACjB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACxC;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,YAAY,EACZ,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACpC,CACF,CAAC;gBACF,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YAED,4DAA4D;YAC5D,2DAA2D;YAC3D,wDAAwD;YACxD,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,WAAW;iBACU,CAAC;YAChC,CAAC;YACD,OAAO,YAAY,CAAC,QAAQ,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,IAAI;gBACL,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAClD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACvB,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CACnE,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,OAAO,YAAY,CAAC,QAAQ,EAAE;gBAC5B,OAAO;gBACP,QAAQ;gBACR,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,GAAG;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Sqladmin/Validation.d.ts

@@ -0,0 +1,60 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+import { type SqlUserType } from "./Types.ts";
+/**
+ * Validate a Cloud SQL instance name. Returns a `ConfigError` on the
+ * failure channel if the name is invalid, otherwise succeeds.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#SqlInstance
+ */
+export declare const validateInstanceName: (name: string) => Effect.Effect<void, ConfigError>;
+/**
+ * Validate a Cloud SQL database name (1–64 chars, non-empty).
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/databases#Database
+ */
+export declare const validateDatabaseName: (name: string) => Effect.Effect<void, ConfigError>;
+/**
+ * Validate a Cloud SQL user shape — primarily that the password/type
+ * combination is consistent:
+ *
+ * - `BUILT_IN` users MUST carry a password.
+ * - Any IAM user type (`CLOUD_IAM_USER`, `CLOUD_IAM_SERVICE_ACCOUNT`,
+ *   `CLOUD_IAM_GROUP*`, `ENTRAID_USER`) MUST NOT carry a password —
+ *   the IAM principal is authenticated by token exchange.
+ *
+ * Other types from the open tail of the enum (forward-compat) skip
+ * the password check.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/users
+ * @see https://cloud.google.com/sql/docs/postgres/iam-authentication
+ */
+export declare const validateUser: (args: {
+    name: string;
+    type: SqlUserType | undefined;
+    hasPassword: boolean;
+}) => Effect.Effect<void, ConfigError>;
+/**
+ * Reshape a `BadRequest` from a Cloud SQL Admin create/patch/delete
+ * into a `ConfigError` with a remediation hint for the top failure
+ * modes:
+ *
+ * 1. **Billing not enabled** — Cloud SQL refuses to provision against
+ *    a project without billing. Common right after `ApiEnable` lands
+ *    but before billing reconciles in a fresh project.
+ * 2. **Private network not set up** — `privateNetwork` references a
+ *    VPC that has no PSA peering for `servicenetworking.googleapis.com`.
+ *    Surface the precondition.
+ * 3. **Invalid tier** — typo'd `db-custom-…` or one outside the
+ *    project's allow-list. Pass the underlying message through with
+ *    a pointer to the tier catalogue.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear enough.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/instance-settings
+ */
+export declare const reshapeBadRequest: (kind: "Instance" | "Database" | "User", op: "insert" | "patch" | "update" | "delete") => (e: {
+    message?: string;
+}) => Effect.Effect<never, ConfigError>;
+//# sourceMappingURL=Validation.d.ts.map

package/lib/Sqladmin/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/Sqladmin/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAgC7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CASjC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAOjC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;CACtB,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAiBlC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAC3B,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,EAAE,IAAI,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,MACpF,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAkB1D,CAAC"}

package/lib/Sqladmin/Validation.js

@@ -0,0 +1,125 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Effect from "effect/Effect";
+import { isIamUserType } from "./Types.js";
+/**
+ * Plan-time validation for Cloud SQL resource props. Failing fast with
+ * a typed `ConfigError` is friendlier than letting the user wait for
+ * Cloud SQL to reject the request, and unlike server-side errors these
+ * surface before any state mutation happens.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances
+ */
+/**
+ * Instance name regex per
+ * <https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#SqlInstance>:
+ * 1–98 lowercase letters/digits/hyphens, must begin with a letter and
+ * not end with a hyphen.
+ *
+ * @internal
+ */
+const INSTANCE_NAME_RE = /^[a-z]([-a-z0-9]*[a-z0-9])?$/;
+/**
+ * Database name length cap per
+ * <https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/databases#Database>:
+ * 1–64 chars. Postgres has additional character constraints (no NUL,
+ * no embedded quotes) but the API rejects those, and they'd require
+ * dialect-specific parsing here.
+ *
+ * @internal
+ */
+const DATABASE_NAME_MAX = 64;
+/**
+ * Validate a Cloud SQL instance name. Returns a `ConfigError` on the
+ * failure channel if the name is invalid, otherwise succeeds.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#SqlInstance
+ */
+export const validateInstanceName = (name) => {
+    if (INSTANCE_NAME_RE.test(name) && name.length >= 1 && name.length <= 98) {
+        return Effect.void;
+    }
+    return Effect.fail(new ConfigError({
+        message: `Cloud SQL instance name ${JSON.stringify(name)} is invalid: must match /^[a-z]([-a-z0-9]*[a-z0-9])?$/ (1–98 lowercase letters/digits/hyphens, start with letter, no trailing hyphen).`,
+    }));
+};
+/**
+ * Validate a Cloud SQL database name (1–64 chars, non-empty).
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/databases#Database
+ */
+export const validateDatabaseName = (name) => {
+    if (name.length >= 1 && name.length <= DATABASE_NAME_MAX)
+        return Effect.void;
+    return Effect.fail(new ConfigError({
+        message: `Cloud SQL database name ${JSON.stringify(name)} is invalid: must be 1–${DATABASE_NAME_MAX} characters.`,
+    }));
+};
+/**
+ * Validate a Cloud SQL user shape — primarily that the password/type
+ * combination is consistent:
+ *
+ * - `BUILT_IN` users MUST carry a password.
+ * - Any IAM user type (`CLOUD_IAM_USER`, `CLOUD_IAM_SERVICE_ACCOUNT`,
+ *   `CLOUD_IAM_GROUP*`, `ENTRAID_USER`) MUST NOT carry a password —
+ *   the IAM principal is authenticated by token exchange.
+ *
+ * Other types from the open tail of the enum (forward-compat) skip
+ * the password check.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/users
+ * @see https://cloud.google.com/sql/docs/postgres/iam-authentication
+ */
+export const validateUser = (args) => {
+    const type = args.type ?? "BUILT_IN";
+    if (isIamUserType(type) && args.hasPassword) {
+        return Effect.fail(new ConfigError({
+            message: `Cloud SQL user ${JSON.stringify(args.name)} has type ${JSON.stringify(type)} (IAM-backed) but a password was supplied. IAM users authenticate via the Cloud SQL Auth Proxy / IAM token exchange — drop the \`password\` field.`,
+        }));
+    }
+    if (type === "BUILT_IN" && !args.hasPassword) {
+        return Effect.fail(new ConfigError({
+            message: `Cloud SQL user ${JSON.stringify(args.name)} has type "BUILT_IN" but no password was supplied. BUILT_IN users require a password — pass \`password: Redacted.make("...")\` or switch to an IAM type.`,
+        }));
+    }
+    return Effect.void;
+};
+/**
+ * Reshape a `BadRequest` from a Cloud SQL Admin create/patch/delete
+ * into a `ConfigError` with a remediation hint for the top failure
+ * modes:
+ *
+ * 1. **Billing not enabled** — Cloud SQL refuses to provision against
+ *    a project without billing. Common right after `ApiEnable` lands
+ *    but before billing reconciles in a fresh project.
+ * 2. **Private network not set up** — `privateNetwork` references a
+ *    VPC that has no PSA peering for `servicenetworking.googleapis.com`.
+ *    Surface the precondition.
+ * 3. **Invalid tier** — typo'd `db-custom-…` or one outside the
+ *    project's allow-list. Pass the underlying message through with
+ *    a pointer to the tier catalogue.
+ *
+ * Anything else propagates verbatim — the underlying GCP message is
+ * usually clear enough.
+ *
+ * @see https://cloud.google.com/sql/docs/postgres/instance-settings
+ */
+export const reshapeBadRequest = (kind, op) => (e) => {
+    const underlying = e.message ?? `unknown 400 from ${kind} ${op}`;
+    let hint = "";
+    if (/billing/i.test(underlying)) {
+        hint =
+            " Cloud SQL requires billing to be enabled on the project. Attach a billing account (see `GCP.Project({ billingAccount })`) and retry.";
+    }
+    else if (/private.*service.*access|servicenetworking|peering/i.test(underlying)) {
+        hint =
+            " The host VPC needs a Private Services Access (PSA) peering with `servicenetworking.googleapis.com` before a private-IP Cloud SQL instance can attach. Provision a `GCP.GlobalAddress` (purpose=VPC_PEERING) and a `GCP.PsaConnection` on the VPC first.";
+    }
+    else if (/tier|machine.*type/i.test(underlying)) {
+        hint =
+            " Check the tier identifier against https://cloud.google.com/sql/docs/postgres/instance-settings — and remember that Enterprise Plus tiers (`db-perf-optimized-*`) require `edition: \"ENTERPRISE_PLUS\"`.";
+    }
+    return Effect.fail(new ConfigError({
+        message: `Cloud SQL ${kind} ${op} rejected: ${underlying}.${hint}`,
+    }));
+};
+//# sourceMappingURL=Validation.js.map

package/lib/Sqladmin/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../src/Sqladmin/Validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAE7D;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACsB,EAAE;IACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wIAAwI;KACjM,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACsB,EAAE;IACpC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC7E,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,iBAAiB,cAAc;KAClH,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAI5B,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;IACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oJAAoJ;SAC1O,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;YACd,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,0JAA0J;SAC/M,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,IAAsC,EAAE,EAA4C,EAAE,EAAE,CACzF,CAAC,CAAuB,EAAqC,EAAE;IAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC;IACjE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,IAAI;YACF,uIAAuI,CAAC;IAC5I,CAAC;SAAM,IAAI,qDAAqD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,IAAI;YACF,0PAA0P,CAAC;IAC/P,CAAC;SAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,IAAI;YACF,2MAA2M,CAAC;IAChN,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,WAAW,CAAC;QACd,OAAO,EAAE,aAAa,IAAI,IAAI,EAAE,cAAc,UAAU,IAAI,IAAI,EAAE;KACnE,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/lib/Sqladmin/index.d.ts

@@ -0,0 +1,9 @@
+export { SqlDatabase, SqlDatabaseProvider } from "./Database.ts";
+export type { SqlDatabaseAttributes, SqlDatabaseProps } from "./Database.ts";
+export { SqlInstance, SqlInstanceProvider } from "./Instance.ts";
+export type { SqlInstanceAttributes, SqlInstanceIpAddress, SqlInstanceProps, } from "./Instance.ts";
+export { isIamUserType } from "./Types.ts";
+export type { PostgresVersion, SqlActivationPolicy, SqlAvailabilityType, SqlDataDiskType, SqlEdition, SqlUserType, } from "./Types.ts";
+export { SqlUser, SqlUserProvider } from "./User.ts";
+export type { SqlUserAttributes, SqlUserProps } from "./User.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Sqladmin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Sqladmin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrD,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/lib/Sqladmin/index.js

@@ -0,0 +1,5 @@
+export { SqlDatabase, SqlDatabaseProvider } from "./Database.js";
+export { SqlInstance, SqlInstanceProvider } from "./Instance.js";
+export { isIamUserType } from "./Types.js";
+export { SqlUser, SqlUserProvider } from "./User.js";
+//# sourceMappingURL=index.js.map

package/lib/Sqladmin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Sqladmin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMjE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAS3C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}

package/lib/Tags.d.ts

@@ -28,25 +28,25 @@ export declare const gcpInternalLabels: (id: string) => Effect.Effect<{
     alchemy_app: string;
     alchemy_stage: string;
     alchemy_id: string;
-}, never, Stage | Stack>;
+}, never, Stack | Stage>;
 /**
  * True when `labels` contains all three alchemy-internal keys with
  * values matching this stack/stage/id. Used in `read` to decide
  * adoption ownership.
  */
-export declare const hasAlchemyLabels: (id: string, labels: Record<string, string> | undefined) => Effect.Effect<boolean, never, Stage | Stack>;
+export declare const hasAlchemyLabels: (id: string, labels: Record<string, string> | undefined) => Effect.Effect<boolean, never, Stack | Stage>;
 export { LABEL_KEY_APP as ALCHEMY_LABEL_APP, LABEL_KEY_STAGE as ALCHEMY_LABEL_STAGE, LABEL_KEY_ID as ALCHEMY_LABEL_ID, };
 /**
  * Compose `[alchemy:...] <userDescription?>`. Pass through to the
  * resource's `description` body field at create time.
  */
-export declare const gcpAlchemyDescription: (id: string, userDescription?: string | undefined) => Effect.Effect<string, never, Stage | Stack>;
+export declare const gcpAlchemyDescription: (id: string, userDescription?: string | undefined) => Effect.Effect<string, never, Stack | Stage>;
 /**
  * True when `description` begins with an alchemy marker matching this
  * stack/stage/id. Used in `read` for resources that lack a labels
  * field.
  */
-export declare const descriptionHasAlchemyMarker: (id: string, description: string | undefined) => Effect.Effect<boolean, never, Stage | Stack>;
+export declare const descriptionHasAlchemyMarker: (id: string, description: string | undefined) => Effect.Effect<boolean, never, Stack | Stage>;
 /**
  * Strip the leading alchemy marker (if any) and return what remains —
  * used when surfacing the user-visible description back through

package/lib/index.d.ts

@@ -1,12 +1,14 @@
 export { Credentials, fromADC, fromAuthProvider } from "./Auth/Credentials.ts";
 export { GCP_AUTH_PROVIDER_NAME, GCPAuth, } from "./Auth/AuthProvider.ts";
 export type { GCPAuthConfig, GCPResolvedCredentials, } from "./Auth/AuthProvider.ts";
+export * from "./ArtifactRegistry/index.ts";
 export * from "./CloudResourceManager/index.ts";
 export * from "./Compute/index.ts";
 export * from "./Container/index.ts";
 export * from "./ManagedLustre/index.ts";
 export * from "./Run/index.ts";
 export * from "./ServiceNetworking/index.ts";
+export * from "./Sqladmin/index.ts";
 export * from "./ServiceUsage/index.ts";
 export * from "./Providers.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/lib/index.js

@@ -1,11 +1,13 @@
 export { Credentials, fromADC, fromAuthProvider } from "./Auth/Credentials.js";
 export { GCP_AUTH_PROVIDER_NAME, GCPAuth, } from "./Auth/AuthProvider.js";
+export * from "./ArtifactRegistry/index.js";
 export * from "./CloudResourceManager/index.js";
 export * from "./Compute/index.js";
 export * from "./Container/index.js";
 export * from "./ManagedLustre/index.js";
 export * from "./Run/index.js";
 export * from "./ServiceNetworking/index.js";
+export * from "./Sqladmin/index.js";
 export * from "./ServiceUsage/index.js";
 export * from "./Providers.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAKhC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.3.0",
-  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), with ADC-backed credentials and target-side IAM bindings.",
+  "version": "0.5.1",
+  "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
     "alchemy-effect",

package/src/ArtifactRegistry/Operations.ts

@@ -0,0 +1,79 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Resolved callable signature of `ar.getProjectsLocationsOperations`.
+ *
+ * `ar.getProjectsLocationsOperations` is itself an
+ * `Effect<callable, never, Credentials | HttpClient>`, so
+ * `Effect.Success` extracts the callable type. Using a derived alias
+ * keeps the helper aligned with the SDK without us hand-writing the
+ * input/output/error union, which would drift if the patch set changes.
+ */
+type GetOperations = Effect.Success<typeof ar.getProjectsLocationsOperations>;
+
+/**
+ * Build the Artifact Registry long-running-operation polling helper.
+ *
+ * Artifact Registry `Operation`s use the standard
+ * `GoogleLongrunningOperation` shape — doneness is `.done === true`
+ * (NOT `.status === "DONE"` like the GKE Container API and NOT
+ * Sqladmin's tri-state `.status`). Verified at
+ * `vendor/distilled/packages/gcp/src/services/artifactregistry-v1.ts:308–328`.
+ *
+ * Operation names returned by `artifactregistry-v1`
+ * (`createProjectsLocationsRepositories`,
+ * `patchProjectsLocationsRepositories`,
+ * `deleteProjectsLocationsRepositories`) are already fully qualified
+ * (`projects/{p}/locations/{l}/operations/{id}`), so callers pass them
+ * straight through to `getProjectsLocationsOperations` — no qualify
+ * dance needed (unlike Container, which returns bare ids).
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
+ * `Schedule.either`, then a hard count cap of 60 retries → ~10 min wall
+ * ceiling. Repository CRUD is fast (seconds); the only long-running
+ * case is a delete on a repository with many cached images, where AR
+ * has to GC the underlying blobs.
+ *
+ * The helper is a factory — the caller resolves
+ * `ar.getProjectsLocationsOperations` once at provider construction
+ * and passes the resulting callable here, so we never re-resolve
+ * services on each await.
+ */
+export const makeAwaitOperation = (getOperations: GetOperations) =>
+  Effect.fn(function* (
+    operationName: string,
+    session: ScopedPlanStatusSession,
+  ) {
+    const op = yield* getOperations({ name: operationName }).pipe(
+      Effect.flatMap((current) =>
+        current.done === true
+          ? Effect.succeed(current)
+          : Effect.fail({ _tag: "OperationPending" as const }),
+      ),
+      Effect.retry({
+        while: (e: { _tag?: string }) => e?._tag === "OperationPending",
+        schedule: Schedule.exponential(Duration.seconds(1), 1.5).pipe(
+          Schedule.either(Schedule.spaced(Duration.seconds(10))),
+          Schedule.both(Schedule.recurs(60)),
+          Schedule.tapOutput(() =>
+            session.note(
+              `Waiting for Artifact Registry operation ${operationName}…`,
+            ),
+          ),
+        ),
+      }),
+    );
+    if (op.error) {
+      return yield* new ConfigError({
+        message: `Artifact Registry operation ${operationName} failed: ${
+          op.error.message ?? JSON.stringify(op.error)
+        }`,
+      });
+    }
+    return op;
+  });