@alchemy.run/daytona 0.0.0 → 2.0.0-beta.86

package/src/OrganizationSettings.ts

@@ -0,0 +1,187 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { declarable } from "./internal/Declared.ts";
+import {
+  currentOrganizationId,
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import type { Ref } from "./internal/Ref.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface OrganizationSettingsProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /** Region new sandboxes go to when they don't name one. */
+  defaultRegionId?: string;
+  /**
+   * How long a sandbox create may wait in the queue for capacity before it
+   * fails. `null` waits indefinitely.
+   */
+  defaultQueueTimeout?: Duration.Input | null;
+  /** Experimental feature flags, as Daytona names them. */
+  experimentalConfig?: Record<string, unknown>;
+}
+
+interface Captured {
+  defaultRegionId: string | undefined;
+  defaultQueueTimeout: number | null;
+  experimentalConfig: unknown;
+}
+
+export interface OrganizationSettingsAttributes {
+  /** Organization ID. */
+  organizationId: string;
+  /** Organization name. */
+  name: string;
+  /** Default region. */
+  defaultRegionId: string | undefined;
+  /** Default queue timeout in seconds, or `null`. */
+  defaultQueueTimeout: number | null;
+  /** Experimental flags. */
+  experimentalConfig: unknown;
+  /** The settings before alchemy first changed them; restored on destroy. */
+  original: Captured;
+}
+
+export type OrganizationSettings = Resource<
+  "Daytona.OrganizationSettings",
+  OrganizationSettingsProps,
+  OrganizationSettingsAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * Settings of the Daytona organization the credentials belong to: the
+ * default region, the queue timeout for creates waiting on capacity, and
+ * experimental flags. Only the settings you declare are changed.
+ *
+ * The organization always exists, so this resource captures the settings
+ * it finds on first deploy and puts them back on destroy.
+ *
+ * ### Configuring the Organization
+ * **Example:** Default region and a one-minute queue timeout
+ * ```typescript
+ * export const Settings = Daytona.OrganizationSettings("Settings", {
+ *   defaultRegionId: "eu",
+ *   defaultQueueTimeout: "1 minute",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const OrganizationSettings = declarable<OrganizationSettings>()(
+  Resource<OrganizationSettings>("Daytona.OrganizationSettings"),
+);
+
+const seconds = (d: Duration.Input | null) =>
+  d === null ? null : Math.round(Duration.toSeconds(d));
+
+const toAttributes = (
+  org: organizations.Organization,
+  original: Captured,
+): OrganizationSettingsAttributes => ({
+  organizationId: org.id,
+  name: org.name,
+  defaultRegionId: org.defaultRegionId,
+  defaultQueueTimeout: org.defaultQueueTimeout,
+  experimentalConfig: org.experimentalConfig,
+  original,
+});
+
+const apply = Effect.fn(function* (
+  org: organizations.Organization,
+  want: {
+    defaultRegionId?: string | undefined;
+    defaultQueueTimeout?: number | null | undefined;
+    experimentalConfig?: unknown;
+  },
+) {
+  if (want.defaultRegionId !== undefined && want.defaultRegionId !== org.defaultRegionId) {
+    yield* organizations.setOrganizationDefaultRegion({
+      organizationId: org.id,
+      defaultRegionId: want.defaultRegionId,
+    });
+  }
+  if (
+    want.defaultQueueTimeout !== undefined &&
+    want.defaultQueueTimeout !== org.defaultQueueTimeout
+  ) {
+    yield* organizations.updateOrganizationDefaultQueueTimeout({
+      organizationId: org.id,
+      defaultQueueTimeout: want.defaultQueueTimeout,
+    });
+  }
+  if (
+    want.experimentalConfig !== undefined &&
+    !deepEqual(want.experimentalConfig, org.experimentalConfig)
+  ) {
+    yield* organizations.updateExperimentalConfig({
+      organizationId: org.id,
+      body: want.experimentalConfig as organizations.UpdateExperimentalConfigRequest["body"],
+    });
+  }
+});
+
+export const OrganizationSettingsProvider = () =>
+  Provider.effect(
+    OrganizationSettings,
+    Effect.succeed({
+      stables: ["organizationId", "original"],
+      nuke: { singleton: true },
+      list: () => Effect.succeed([]),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ output }) {
+        const org = yield* organizations.getOrganization({
+          organizationId: output?.organizationId ?? (yield* currentOrganizationId),
+        });
+        return toAttributes(
+          org,
+          output?.original ?? {
+            defaultRegionId: org.defaultRegionId,
+            defaultQueueTimeout: org.defaultQueueTimeout,
+            experimentalConfig: org.experimentalConfig,
+          },
+        );
+      }),
+      reconcile: Effect.fn(function* ({ news, output }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        // Observe
+        const org = yield* organizations.getOrganization({ organizationId });
+        const original = output?.original ?? {
+          defaultRegionId: org.defaultRegionId,
+          defaultQueueTimeout: org.defaultQueueTimeout,
+          experimentalConfig: org.experimentalConfig,
+        };
+        // Sync only what is declared, against observed settings.
+        yield* apply(org, {
+          defaultRegionId: news.defaultRegionId,
+          defaultQueueTimeout:
+            news.defaultQueueTimeout === undefined ? undefined : seconds(news.defaultQueueTimeout),
+          experimentalConfig: news.experimentalConfig,
+        });
+        return toAttributes(yield* organizations.getOrganization({ organizationId }), original);
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        const org = yield* organizations
+          .getOrganization({ organizationId: output.organizationId })
+          .pipe(Effect.catchTag("OrganizationNotFound", () => Effect.undefined));
+        if (org === undefined) return;
+        yield* apply(org, output.original);
+      }),
+    }),
+  );

package/src/Providers.ts

@@ -0,0 +1,93 @@
+import { DockerLive } from "@alchemy.run/docker/Docker";
+import { CredentialsStoreLive } from "alchemy/Auth/Credentials";
+import { ProfileStoreLive } from "alchemy/Auth/Profile";
+import * as Provider from "alchemy/Provider";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { ApiKey, ApiKeyProvider } from "./ApiKey.ts";
+import { DaytonaAuth } from "./AuthProvider.ts";
+import * as Credentials from "./Credentials.ts";
+import { IdentityProvider, IdentityProviderProvider } from "./IdentityProvider.ts";
+import { Organization, OrganizationProvider } from "./Organization.ts";
+import {
+  OrganizationInvitation,
+  OrganizationInvitationProvider,
+} from "./OrganizationInvitation.ts";
+import { OrganizationMember, OrganizationMemberProvider } from "./OrganizationMember.ts";
+import {
+  OrganizationOtelConfig,
+  OrganizationOtelConfigProvider,
+} from "./OrganizationOtelConfig.ts";
+import { OrganizationRole, OrganizationRoleProvider } from "./OrganizationRole.ts";
+import { OrganizationSettings, OrganizationSettingsProvider } from "./OrganizationSettings.ts";
+import { Region, RegionProvider } from "./Region.ts";
+import { Registry, RegistryProvider } from "./Registry.ts";
+import { Runner, RunnerProvider } from "./Runner.ts";
+import { Sandbox, SandboxProvider } from "./Sandbox.ts";
+import { Secret, SecretProvider } from "./Secret.ts";
+import { Snapshot, SnapshotProvider } from "./Snapshot.ts";
+import { Volume, VolumeProvider } from "./Volume.ts";
+import { WarmPool, WarmPoolProvider } from "./WarmPool.ts";
+import { Webhooks, WebhooksProvider } from "./Webhooks.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()("Daytona") {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Daytona providers and credentials: every Daytona resource, and the
+ * Daytona AuthProvider so `alchemy profile edit` can configure it.
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      ApiKey,
+      IdentityProvider,
+      Organization,
+      OrganizationInvitation,
+      OrganizationMember,
+      OrganizationOtelConfig,
+      OrganizationRole,
+      OrganizationSettings,
+      Region,
+      Registry,
+      Runner,
+      Sandbox,
+      Secret,
+      Snapshot,
+      Volume,
+      WarmPool,
+      Webhooks,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        ApiKeyProvider(),
+        IdentityProviderProvider(),
+        OrganizationProvider(),
+        OrganizationInvitationProvider(),
+        OrganizationMemberProvider(),
+        OrganizationOtelConfigProvider(),
+        OrganizationRoleProvider(),
+        OrganizationSettingsProvider(),
+        RegionProvider(),
+        RegistryProvider(),
+        RunnerProvider(),
+        SandboxProvider(),
+        SecretProvider(),
+        SnapshotProvider(),
+        VolumeProvider(),
+        WarmPoolProvider(),
+        WebhooksProvider(),
+      ),
+    ),
+    // Snapshots Daytona can't build are built with local Docker.
+    Layer.provideMerge(DockerLive),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(DaytonaAuth),
+    Layer.provideMerge(ProfileStoreLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  );

package/src/ReadAuditLogs.ts

@@ -0,0 +1,50 @@
+import * as audit from "@distilled.cloud/daytona/audit";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeAccess } from "./DaytonaBindings.ts";
+import { scopeModule, type OrganizationFixed, type ScopedModule } from "./internal/Scoped.ts";
+import { lazyScoped } from "./ReadOrganization.ts";
+
+/** The organization's audit log. */
+export interface ReadAuditLogsClient extends ScopedModule<typeof audit, OrganizationFixed> {}
+
+/**
+ * Read the organization's audit log at runtime: who created, started,
+ * deleted or changed what, and with which API key.
+ *
+ * The host gets its own Daytona API key with `read:audit_logs`.
+ *
+ * ### Reading the Audit Log
+ * **Example:** The latest entries
+ * ```typescript
+ * const audit = yield* Daytona.ReadAuditLogs();
+ * const page = yield* audit.getOrganizationAuditLogs({ limit: 50 });
+ * ```
+ *
+ * @binding
+ * @product Organization
+ */
+export interface ReadAuditLogs extends Binding.Service<
+  ReadAuditLogs,
+  "Daytona.ReadAuditLogs",
+  () => Effect.Effect<ReadAuditLogsClient>
+> {}
+
+export const ReadAuditLogs = Binding.Service<ReadAuditLogs>("Daytona.ReadAuditLogs");
+
+/** {@link ReadAuditLogs} over Daytona's HTTP API; works on any host. */
+export const ReadAuditLogsHttp = Layer.effect(
+  ReadAuditLogs,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* () {
+      const { authorize, organizationId } = yield* access("AuditLogs", ["read:audit_logs"]);
+      return lazyScoped(organizationId, (id) =>
+        scopeModule<typeof audit, OrganizationFixed>(audit, { organizationId: id }, (effect) =>
+          authorize(effect),
+        ),
+      );
+    });
+  }),
+);

package/src/ReadOrganization.ts

@@ -0,0 +1,83 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import * as regions from "@distilled.cloud/daytona/regions";
+import * as webhooks from "@distilled.cloud/daytona/webhooks";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeAccess } from "./DaytonaBindings.ts";
+import { pick, scopeModule, type ScopedModule } from "./internal/Scoped.ts";
+
+const ORGANIZATION_READS = [
+  "getGpuCapacity",
+  "listAvailableSandboxClasses",
+  "getOrganizationUsageOverview",
+] as const;
+
+const WEBHOOK_READS = [
+  "getWebhookControllerAppPortalAccess",
+  "getWebhookControllerInitializationStatus",
+] as const;
+
+/** Read-only views of the organization: quotas, usage, GPU capacity, regions and the webhook portal. */
+export interface ReadOrganizationClient
+  extends
+    ScopedModule<Pick<typeof organizations, (typeof ORGANIZATION_READS)[number]>>,
+    ScopedModule<typeof regions>,
+    ScopedModule<Pick<typeof webhooks, (typeof WEBHOOK_READS)[number]>> {}
+
+/**
+ * Read the organization's limits and usage at runtime: current usage
+ * against quotas, which sandbox classes and GPUs are available, and the
+ * shared regions. Use it to pick a region or refuse work before hitting a
+ * quota.
+ *
+ * The host gets its own Daytona API key with `read:limits`.
+ *
+ * ### Checking Capacity
+ * **Example:** Refuse a GPU job when no GPUs are free
+ * ```typescript
+ * const org = yield* Daytona.ReadOrganization();
+ * const capacity = yield* org.getGpuCapacity();
+ * ```
+ *
+ * @binding
+ * @product Organization
+ */
+export interface ReadOrganization extends Binding.Service<
+  ReadOrganization,
+  "Daytona.ReadOrganization",
+  () => Effect.Effect<ReadOrganizationClient>
+> {}
+
+export const ReadOrganization = Binding.Service<ReadOrganization>("Daytona.ReadOrganization");
+
+/** {@link ReadOrganization} over Daytona's HTTP API; works on any host. */
+export const ReadOrganizationHttp = Layer.effect(
+  ReadOrganization,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* () {
+      const { authorize, organizationId } = yield* access("Organization", ["read:limits"]);
+      const run = <A, E, R>(effect: Effect.Effect<A, E, R>) => authorize(effect);
+      return lazyScoped(organizationId, (id) => ({
+        ...scopeModule(pick(organizations, ORGANIZATION_READS), { organizationId: id }, run),
+        ...scopeModule(regions, {}, run),
+        ...scopeModule(pick(webhooks, WEBHOOK_READS), { organizationId: id }, run),
+      }));
+    });
+  }),
+);
+
+/** Build a scoped client whose organization id resolves at runtime. */
+export const lazyScoped = <C extends object>(
+  organizationId: Effect.Effect<string, never, any>,
+  make: (organizationId: string) => C,
+): C =>
+  new Proxy({} as C, {
+    get:
+      (_t, key: string) =>
+      (...args: unknown[]) =>
+        // `key` is a property of C (the Proxy only sees C's members), but a
+        // Proxy trap types it as string, so the lookup is untyped here.
+        Effect.flatMap(organizationId, (id) => (make(id) as any)[key](...args)),
+  });

package/src/ReadUsage.ts

@@ -0,0 +1,51 @@
+import * as usage from "@distilled.cloud/daytona/usage";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeAccess } from "./DaytonaBindings.ts";
+import { scopeModule, type OrganizationFixed, type ScopedModule } from "./internal/Scoped.ts";
+import { lazyScoped } from "./ReadOrganization.ts";
+
+/** Usage from Daytona's analytics API: totals, charts and per-sandbox usage. */
+export interface ReadUsageClient extends ScopedModule<typeof usage, OrganizationFixed> {}
+
+/**
+ * Read the organization's compute usage at runtime: aggregated totals, a
+ * chart over time, and usage per sandbox. Use it to bill your own users
+ * for the sandboxes you run for them.
+ *
+ * The host gets its own Daytona API key with `read:billing`.
+ *
+ * ### Usage per Sandbox
+ * **Example:** Usage over the last day
+ * ```typescript
+ * const usage = yield* Daytona.ReadUsage();
+ * const rows = yield* usage.listOrganizationUsageSandbox({ from, to });
+ * ```
+ *
+ * @binding
+ * @product Organization
+ */
+export interface ReadUsage extends Binding.Service<
+  ReadUsage,
+  "Daytona.ReadUsage",
+  () => Effect.Effect<ReadUsageClient>
+> {}
+
+export const ReadUsage = Binding.Service<ReadUsage>("Daytona.ReadUsage");
+
+/** {@link ReadUsage} over Daytona's analytics API; works on any host. */
+export const ReadUsageHttp = Layer.effect(
+  ReadUsage,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* () {
+      const { authorize, organizationId } = yield* access("Usage", ["read:billing"]);
+      return lazyScoped(organizationId, (id) =>
+        scopeModule<typeof usage, OrganizationFixed>(usage, { organizationId: id }, (effect) =>
+          authorize(effect),
+        ),
+      );
+    });
+  }),
+);

package/src/Region.ts

@@ -0,0 +1,226 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isOwnedName, resolveName } from "./internal/Names.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface RegionProps {
+  /** Region name. If omitted, generated from the stack, stage and logical ID. Changing it replaces the region. */
+  name?: string;
+  /** URL of the region's sandbox proxy. */
+  proxyUrl?: string;
+  /** URL of the region's SSH gateway. */
+  sshGatewayUrl?: string;
+  /** URL of the region's snapshot manager (image registry). */
+  snapshotManagerUrl?: string;
+  /** OTLP endpoint the region's runners export to. */
+  otelEndpoint?: string;
+  /** S3 bucket for Dockerfile build contexts. */
+  buildContextBucket?: string;
+  /** Region of that bucket. */
+  buildContextBucketRegion?: string;
+  /** IAM role Daytona assumes to use the bucket. */
+  buildContextRoleArn?: string;
+  /**
+   * Bump a counter to rotate that credential on the next deploy.
+   */
+  rotate?: { proxyApiKey?: number; sshGatewayApiKey?: number; snapshotManagerCredentials?: number };
+}
+
+export interface RegionAttributes {
+  /** Region ID; what runners, snapshots and sandboxes take. */
+  regionId: string;
+  /** Region name. */
+  name: string;
+  /** API key the region's proxy authenticates with. */
+  proxyApiKey: Redacted.Redacted<string> | undefined;
+  /** API key the region's SSH gateway authenticates with. */
+  sshGatewayApiKey: Redacted.Redacted<string> | undefined;
+  /** Snapshot manager user name. */
+  snapshotManagerUsername: string | undefined;
+  /** Snapshot manager password. */
+  snapshotManagerPassword: Redacted.Redacted<string> | undefined;
+  /** Rotation counters applied. */
+  rotated: { proxyApiKey: number; sshGatewayApiKey: number; snapshotManagerCredentials: number };
+}
+
+export type Region = Resource<"Daytona.Region", RegionProps, RegionAttributes, never, Providers>;
+
+/**
+ * A custom region: your own compute (see {@link Runner}) registered with
+ * Daytona, so sandboxes run on machines you operate while Daytona runs
+ * the control plane. Needs an organization allowed to bring its own
+ * compute.
+ *
+ * Daytona shows the region's API keys only when they are created or
+ * rotated, so alchemy keeps them in state as `Redacted` values. Bump a
+ * `rotate` counter to rotate one.
+ * @see https://www.daytona.io/docs/en/regions/
+ *
+ * ### Bringing Your Own Compute
+ * **Example:** A region with its own proxy and SSH gateway
+ * ```typescript
+ * export const Home = Daytona.Region("Home", {
+ *   proxyUrl: "https://proxy.daytona.example.com",
+ *   sshGatewayUrl: "ssh.daytona.example.com:2222",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Region
+ */
+export const Region = Resource<Region>("Daytona.Region");
+
+const redact = (value: string | Redacted.Redacted<string> | null | undefined) =>
+  value === null || value === undefined
+    ? undefined
+    : Redacted.isRedacted(value)
+      ? value
+      : Redacted.make(value);
+
+const getById = (id: string) =>
+  organizations.getRegion({ id }).pipe(Effect.catchTag("RegionNotFound", () => Effect.undefined));
+
+const findByName = (name: string) =>
+  organizations
+    .listAvailableRegions({})
+    .pipe(Effect.map((all) => all.find((r) => r.name === name)));
+
+export const RegionProvider = () =>
+  Provider.effect(
+    Region,
+    Effect.succeed({
+      stables: ["regionId"],
+      list: Effect.fn(function* () {
+        const all = yield* organizations.listAvailableRegions({});
+        return all
+          .filter((r) => r.organizationId)
+          .map((r) => ({
+            regionId: r.id,
+            name: r.name,
+            proxyApiKey: undefined,
+            sshGatewayApiKey: undefined,
+            snapshotManagerUsername: undefined,
+            snapshotManagerPassword: undefined,
+            rotated: { proxyApiKey: 0, sshGatewayApiKey: 0, snapshotManagerCredentials: 0 },
+          }));
+      }),
+      diff: Effect.fn(function* ({ id, news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        const name = yield* resolveName(
+          id,
+          news.name,
+          news.name === undefined ? output.name : undefined,
+        );
+        if (name !== output.name) return { action: "replace", deleteFirst: true } as const;
+      }),
+      read: Effect.fn(function* ({ id, olds, output }) {
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const found =
+          (output ? yield* getById(output.regionId) : undefined) ?? (yield* findByName(name));
+        if (found === undefined) return undefined;
+        const attrs: RegionAttributes = output ?? {
+          regionId: found.id,
+          name: found.name,
+          proxyApiKey: undefined,
+          sshGatewayApiKey: undefined,
+          snapshotManagerUsername: undefined,
+          snapshotManagerPassword: undefined,
+          rotated: { proxyApiKey: 0, sshGatewayApiKey: 0, snapshotManagerCredentials: 0 },
+        };
+        return (yield* isOwnedName(id, found.name, output !== undefined)) ? attrs : Unowned(attrs);
+      }),
+      reconcile: Effect.fn(function* ({ id, news, output }) {
+        const name = yield* resolveName(id, news.name, output?.name);
+        const settings = {
+          proxyUrl: news.proxyUrl ?? null,
+          sshGatewayUrl: news.sshGatewayUrl ?? null,
+          snapshotManagerUrl: news.snapshotManagerUrl ?? null,
+          otelEndpoint: news.otelEndpoint ?? null,
+          buildContextBucket: news.buildContextBucket ?? null,
+          buildContextBucketRegion: news.buildContextBucketRegion ?? null,
+          buildContextRoleArn: news.buildContextRoleArn ?? null,
+        };
+        // Observe
+        const current =
+          (output ? yield* getById(output.regionId) : undefined) ?? (yield* findByName(name));
+        let attrs: RegionAttributes;
+        // Ensure
+        if (current === undefined) {
+          const created = yield* organizations.createRegion({ name, ...settings });
+          attrs = {
+            regionId: created.id,
+            name,
+            proxyApiKey: redact(created.proxyApiKey),
+            sshGatewayApiKey: redact(created.sshGatewayApiKey),
+            snapshotManagerUsername: created.snapshotManagerUsername ?? undefined,
+            snapshotManagerPassword: redact(created.snapshotManagerPassword),
+            rotated: {
+              proxyApiKey: news.rotate?.proxyApiKey ?? 0,
+              sshGatewayApiKey: news.rotate?.sshGatewayApiKey ?? 0,
+              snapshotManagerCredentials: news.rotate?.snapshotManagerCredentials ?? 0,
+            },
+          };
+        } else {
+          attrs = output ?? {
+            regionId: current.id,
+            name,
+            proxyApiKey: undefined,
+            sshGatewayApiKey: undefined,
+            snapshotManagerUsername: undefined,
+            snapshotManagerPassword: undefined,
+            rotated: { proxyApiKey: 0, sshGatewayApiKey: 0, snapshotManagerCredentials: 0 },
+          };
+          // Sync settings against the observed region.
+          const drift = (Object.keys(settings) as (keyof typeof settings)[]).some(
+            (k) => (current[k] ?? null) !== settings[k],
+          );
+          if (drift) yield* organizations.updateRegion({ id: current.id, ...settings });
+        }
+        // Sync rotations.
+        const want = news.rotate ?? {};
+        if ((want.proxyApiKey ?? 0) !== attrs.rotated.proxyApiKey) {
+          const { apiKey } = yield* organizations.regenerateProxyApiKey({ id: attrs.regionId });
+          attrs = {
+            ...attrs,
+            proxyApiKey: redact(apiKey),
+            rotated: { ...attrs.rotated, proxyApiKey: want.proxyApiKey ?? 0 },
+          };
+        }
+        if ((want.sshGatewayApiKey ?? 0) !== attrs.rotated.sshGatewayApiKey) {
+          const { apiKey } = yield* organizations.regenerateSshGatewayApiKey({
+            id: attrs.regionId,
+          });
+          attrs = {
+            ...attrs,
+            sshGatewayApiKey: redact(apiKey),
+            rotated: { ...attrs.rotated, sshGatewayApiKey: want.sshGatewayApiKey ?? 0 },
+          };
+        }
+        if ((want.snapshotManagerCredentials ?? 0) !== attrs.rotated.snapshotManagerCredentials) {
+          const creds = yield* organizations.regenerateSnapshotManagerCredentials({
+            id: attrs.regionId,
+          });
+          attrs = {
+            ...attrs,
+            snapshotManagerUsername: creds.username,
+            snapshotManagerPassword: redact(creds.password),
+            rotated: {
+              ...attrs.rotated,
+              snapshotManagerCredentials: want.snapshotManagerCredentials ?? 0,
+            },
+          };
+        }
+        return attrs;
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        yield* organizations
+          .deleteRegion({ id: output.regionId })
+          .pipe(Effect.catchTag("RegionNotFound", () => Effect.void));
+      }),
+    }),
+  );