@microagi/alchemy-gcp 0.5.0 → 0.6.0

package/src/ArtifactRegistry/Repository.ts

@@ -503,19 +503,23 @@ export const ArtifactRegistryRepositoryProvider = () =>
         ],
         diff: Effect.fn(function* ({ news, olds = {} }) {
           if (!isResolved(news)) return undefined;
+          // String-typed stables are reference-comparable.
           if (
             somePropsAreDifferent(
               olds as ArtifactRegistryRepositoryProps,
               news,
-              [
-                "project",
-                "location",
-                "name",
-                "format",
-                "mode",
-                "kmsKeyName",
-                "remoteRepositoryConfig",
-              ],
+              ["project", "location", "name", "format", "mode", "kmsKeyName"],
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+          // Object-typed stables must use deep equality — JSON-deserialized
+          // state never `===` a freshly-built literal even when content matches.
+          const oldsTyped = olds as ArtifactRegistryRepositoryProps;
+          if (
+            !deepEqual(
+              oldsTyped.remoteRepositoryConfig,
+              news.remoteRepositoryConfig,
             )
           ) {
             return { action: "replace" } as const;

package/src/Auth/Credentials.ts

@@ -1,6 +1,6 @@
 import { ConfigError, Credentials } from "@distilled.cloud/gcp";
 import { getAuthProvider } from "alchemy/Auth/AuthProvider";
-import { ALCHEMY_PROFILE, loadOrConfigure } from "alchemy/Auth/Profile";
+import { ALCHEMY_PROFILE, AlchemyProfile } from "alchemy/Auth/Profile";
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -29,11 +29,17 @@ const toConfigError = (e: { message?: string } | unknown) =>
  *
  * Prefer {@link fromAuthProvider} when the stack runs through
  * `alchemy login` / `ALCHEMY_PROFILE`.
+ *
+ * The `Credentials` service is lazy (its value is an `Effect<Config>`
+ * re-evaluated per SDK call), so minting happens at request time —
+ * `google-auth-library` caches and refreshes underneath. Failures
+ * become defects: the service channel carries no typed error, matching
+ * distilled's own `CredentialsFromEnv`.
  */
 export const fromADC = (project?: string) =>
-  Layer.effect(
+  Layer.succeed(
     Credentials,
-    mintToken({ project }).pipe(Effect.mapError(toConfigError)),
+    mintToken({ project }).pipe(Effect.mapError(toConfigError), Effect.orDie),
   );
 
 /**
@@ -51,6 +57,7 @@ export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
     Effect.gen(function* () {
+      const profile = yield* AlchemyProfile;
       const auth = yield* getAuthProvider<
         GCPAuthConfig,
         GCPResolvedCredentials
@@ -59,11 +66,15 @@ export const fromAuthProvider = () =>
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
       const ctx = yield* Effect.context<never>();
 
-      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+      // The service value is itself an Effect (lazy credentials):
+      // profile/provider wiring resolves once at layer build, while
+      // loadOrConfigure + token read run per SDK call.
+      return profile.loadOrConfigure(auth, profileName, { ci }).pipe(
         Effect.flatMap((cfg) => auth.read(profileName, cfg as GCPAuthConfig)),
         Effect.map(({ accessToken, project }) => ({ accessToken, project })),
         Effect.mapError(toConfigError),
         Effect.provide(ctx),
+        Effect.orDie,
       );
     }),
   );

package/src/Compute/Address.ts

@@ -0,0 +1,288 @@
+import * as compute from "@distilled.cloud/gcp/compute-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import type * as GCP from "../Providers.ts";
+import { makeAwaitRegionOperation } from "./Operations.ts";
+
+/**
+ * A regional compute Address. The intended use here is a **Private
+ * Service Connect consumer endpoint IP** — a single internal address
+ * reserved in a subnet (`addressType=INTERNAL`, `purpose=GCE_ENDPOINT`)
+ * that a `ForwardingRule` then binds to a producer service attachment
+ * (e.g. a Cloud SQL instance in another VPC).
+ *
+ * For global PSA *ranges* (`purpose=VPC_PEERING`) use
+ * {@link GlobalAddress} — that is a different API surface
+ * (`globalAddresses` vs regional `addresses`).
+ *
+ * Adoption uses the labels field (Address carries `labels` +
+ * `labelFingerprint`).
+ *
+ * @section Reserving a PSC endpoint IP
+ * @example Internal address inside a subnet for a PSC forwarding rule
+ * ```typescript
+ * const endpointIp = yield* GCP.Address("DbPscAddress", {
+ *   project: hostProject.projectId,
+ *   region: "europe-west1",
+ *   subnetwork: pscSubnet.selfLink,
+ *   address: "10.0.16.5",
+ * });
+ * ```
+ */
+export type AddressProps = {
+  /** GCP project ID hosting the address. Immutable — replace if changed. */
+  project: string;
+  /** GCP region. Addresses are regional — a different region requires replace. */
+  region: string;
+  /**
+   * Address name. Defaults to `createPhysicalName({ id, lowercase: true,
+   * maxLength: 63 })`. Immutable — replace if changed.
+   */
+  name?: string;
+  /** Description (free-form). Set on create; immutable. */
+  description?: string;
+  /**
+   * Internal vs external. Defaults to `INTERNAL` (the only value that
+   * makes sense for a PSC endpoint IP). Immutable — replace.
+   */
+  addressType?: "INTERNAL" | "EXTERNAL";
+  /**
+   * Address purpose. For a PSC endpoint IP use `GCE_ENDPOINT` (the
+   * default GCP assigns to plain internal addresses). Immutable — replace.
+   */
+  purpose?: "GCE_ENDPOINT" | "SHARED_LOADBALANCER_VIP" | "DNS_RESOLVER";
+  /**
+   * URL of the subnetwork the address is allocated from. Pass
+   * `subnet.selfLink` from a `GCP.Subnetwork` to make alchemy sequence
+   * the address after the subnet. Required for INTERNAL addresses.
+   * Immutable — replace.
+   */
+  subnetwork: string;
+  /**
+   * Explicit IP to reserve inside the subnet's range. If omitted, GCP
+   * picks one. Immutable — replace.
+   */
+  address?: string;
+  /**
+   * Resource labels. Alchemy internal labels (`alchemy_app`,
+   * `alchemy_stage`, `alchemy_id`) are merged on top automatically and
+   * are reserved. Mutable via `setLabels`.
+   */
+  labels?: Record<string, string>;
+};
+
+export type AddressAttributes = {
+  /** Address name. */
+  name: string;
+  /** GCP project ID, threaded through from props for delete/read. */
+  project: string;
+  /** GCP region, threaded through from props for delete/read. */
+  region: string;
+  /** Server-defined URL. */
+  selfLink: string;
+  /** Server-assigned numeric id. */
+  id: string;
+  /** The reserved IP. */
+  address: string;
+  /** Address type. */
+  addressType: string | undefined;
+  /** Purpose. */
+  purpose: string | undefined;
+  /** Subnetwork URL. */
+  subnetwork: string | undefined;
+  /** Status: `RESERVING`, `RESERVED`, `IN_USE`. */
+  status: string | undefined;
+  /** Labels currently set, including the alchemy internals. */
+  labels: Record<string, string>;
+};
+
+export type Address = Resource<
+  "GCP.Address",
+  AddressProps,
+  AddressAttributes,
+  never,
+  GCP.Providers
+>;
+export const Address = Resource<Address>("GCP.Address");
+
+const toAddressAttributes = (
+  a: compute.Address,
+  parent: { project: string; region: string },
+): AddressAttributes => ({
+  name: a.name ?? "",
+  project: parent.project,
+  region: parent.region,
+  selfLink: a.selfLink ?? "",
+  id: a.id ?? "",
+  address: a.address ?? "",
+  addressType: a.addressType,
+  purpose: a.purpose,
+  subnetwork: a.subnetwork,
+  status: a.status,
+  labels: { ...(a.labels ?? {}) },
+});
+
+export const AddressProvider = () =>
+  Provider.effect(
+    Address,
+    Effect.gen(function* () {
+      const getAddresses = yield* compute.getAddresses;
+      const insertAddresses = yield* compute.insertAddresses;
+      const deleteAddresses = yield* compute.deleteAddresses;
+      const setLabelsAddresses = yield* compute.setLabelsAddresses;
+      const getRegionOperations = yield* compute.getRegionOperations;
+      const awaitOp = makeAwaitRegionOperation(getRegionOperations);
+
+      const observe = (project: string, region: string, name: string) =>
+        getAddresses({ project, region, address: name }).pipe(
+          Effect.catchTag("NotFound", () =>
+            Effect.succeed(undefined as compute.Address | undefined),
+          ),
+          Effect.catchTag("Forbidden", () =>
+            Effect.succeed(undefined as compute.Address | undefined),
+          ),
+        );
+
+      const syncLabels = Effect.fn(function* (args: {
+        project: string;
+        region: string;
+        observed: compute.Address;
+        desired: Record<string, string>;
+        session: ScopedPlanStatusSession;
+      }) {
+        if (deepEqual(args.observed.labels ?? {}, args.desired)) return;
+        const op = yield* setLabelsAddresses({
+          project: args.project,
+          region: args.region,
+          resource: args.observed.name ?? "",
+          body: {
+            labels: args.desired,
+            labelFingerprint: args.observed.labelFingerprint,
+          },
+        });
+        if (op.name) {
+          yield* awaitOp(args.project, args.region, op.name, args.session);
+        }
+      });
+
+      return {
+        stables: ["name", "project", "region", "selfLink", "id", "address"],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            somePropsAreDifferent(olds as AddressProps, news, [
+              "project",
+              "region",
+              "name",
+              "addressType",
+              "purpose",
+              "subnetwork",
+              "address",
+            ])
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const internalLabels = yield* gcpInternalLabels(id);
+          const desiredName =
+            news.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const desiredLabels: Record<string, string> = {
+            ...(news.labels ?? {}),
+            ...internalLabels,
+          };
+
+          let observed = yield* observe(news.project, news.region, desiredName);
+
+          if (!observed) {
+            const body: compute.Address = {
+              name: desiredName,
+              ...(news.description ? { description: news.description } : {}),
+              addressType: news.addressType ?? "INTERNAL",
+              ...(news.purpose ? { purpose: news.purpose } : {}),
+              subnetwork: news.subnetwork,
+              ...(news.address ? { address: news.address } : {}),
+              labels: desiredLabels,
+            };
+            const op = yield* insertAddresses({
+              project: news.project,
+              region: news.region,
+              body,
+            }).pipe(
+              Effect.catchTag("Conflict", () =>
+                Effect.succeed(undefined as compute.Operation | undefined),
+              ),
+            );
+            if (op?.name) {
+              yield* awaitOp(news.project, news.region, op.name, session);
+            }
+            observed = yield* getAddresses({
+              project: news.project,
+              region: news.region,
+              address: desiredName,
+            });
+          }
+
+          yield* syncLabels({
+            project: news.project,
+            region: news.region,
+            observed,
+            desired: desiredLabels,
+            session,
+          });
+
+          const final = yield* getAddresses({
+            project: news.project,
+            region: news.region,
+            address: desiredName,
+          });
+          return toAddressAttributes(final, {
+            project: news.project,
+            region: news.region,
+          });
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* deleteAddresses({
+            project: output.project,
+            region: output.region,
+            address: output.name,
+          }).pipe(
+            Effect.flatMap((op) =>
+              op.name
+                ? awaitOp(output.project, output.region, op.name, session)
+                : Effect.succeed(op),
+            ),
+            Effect.catchTag("NotFound", () => Effect.void),
+            // 400 "is being used by ..." comes back while a forwarding
+            // rule still references the address. The rule must be
+            // deleted first (alchemy's dep order handles this when the
+            // rule consumes `address.selfLink`); surface the error
+            // rather than silently swallowing.
+          );
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const project = output?.project ?? olds?.project;
+          const region = output?.region ?? olds?.region;
+          if (!project || !region) return undefined;
+          const name =
+            output?.name ??
+            olds?.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const observed = yield* observe(project, region, name);
+          if (!observed) return undefined;
+          const attrs = toAddressAttributes(observed, { project, region });
+          return (yield* hasAlchemyLabels(id, observed.labels))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );