@alchemy.run/modal 0.0.0 → 2.0.0-beta.86

package/src/VolumeClient.ts

@@ -0,0 +1,108 @@
+import type {
+  VolumeGetFile2Error,
+  VolumeListFiles2Error,
+  VolumeRemoveFile2Error,
+  VolumeCopyFiles2Error,
+  VolumePutFiles2Error,
+} from "@distilled.cloud/modal/volume";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import type { HttpClientError } from "effect/http/HttpClientError";
+import {
+  copyVolumeFiles,
+  listVolumeFiles,
+  readVolumeFile,
+  removeVolumeFile,
+  writeVolumeFile,
+  type VolumeFileEntry,
+  type VolumeFileOps,
+  type VolumeTransferError,
+} from "./VolumeFiles.ts";
+
+/** Errors reading a volume file: `VolumeFileNotFound` when the path is missing. */
+export type ReadVolumeFileError = VolumeGetFile2Error | VolumeTransferError | HttpClientError;
+/** Errors listing a volume directory. */
+export type ListVolumeFilesError = VolumeListFiles2Error;
+/** Errors removing or copying volume files. */
+export type ChangeVolumeFilesError = VolumeRemoveFile2Error | VolumeCopyFiles2Error;
+/** Errors writing a volume file. */
+export type WriteVolumeFileError = VolumePutFiles2Error | VolumeTransferError | HttpClientError;
+
+/** Read access to one volume's files. */
+export interface ReadVolumeClient {
+  /** The volume's id. */
+  readonly volumeId: Effect.Effect<string>;
+  /** Read a file. */
+  readFile(path: string): Effect.Effect<Uint8Array, ReadVolumeFileError, RuntimeContext>;
+  /** Read a UTF-8 file. */
+  readFileString(path: string): Effect.Effect<string, ReadVolumeFileError, RuntimeContext>;
+  /** List a directory (`recursive` walks it). */
+  listFiles(
+    path: string,
+    options?: { readonly recursive?: boolean },
+  ): Effect.Effect<ReadonlyArray<VolumeFileEntry>, ListVolumeFilesError, RuntimeContext>;
+}
+
+/** Write access to one volume's files. */
+export interface WriteVolumeClient {
+  /** The volume's id. */
+  readonly volumeId: Effect.Effect<string>;
+  /** Write (create or replace) a file. */
+  writeFile(
+    path: string,
+    data: string | Uint8Array,
+    options?: { readonly mode?: number },
+  ): Effect.Effect<void, WriteVolumeFileError, RuntimeContext>;
+  /** Remove a file, or a directory with `recursive`. */
+  removeFile(
+    path: string,
+    options?: { readonly recursive?: boolean },
+  ): Effect.Effect<void, ChangeVolumeFilesError, RuntimeContext>;
+  /** Copy files to `destination` inside the volume. */
+  copyFiles(
+    sources: ReadonlyArray<string>,
+    destination: string,
+    options?: { readonly recursive?: boolean },
+  ): Effect.Effect<void, ChangeVolumeFilesError, RuntimeContext>;
+}
+
+/** Read and write access to one volume's files. */
+export interface ReadWriteVolumeClient extends ReadVolumeClient, WriteVolumeClient {}
+
+/** The read half of a volume client over `volumeId`. */
+export const makeReadVolumeClient = (
+  volumeId: Effect.Effect<string>,
+  ops: VolumeFileOps,
+): ReadVolumeClient => ({
+  volumeId,
+  readFile: (path) => Effect.flatMap(volumeId, (id) => readVolumeFile(ops, id, path)),
+  readFileString: (path) =>
+    Effect.flatMap(volumeId, (id) => readVolumeFile(ops, id, path)).pipe(
+      Effect.map((bytes) => new TextDecoder().decode(bytes)),
+    ),
+  listFiles: (path, options) =>
+    Effect.flatMap(volumeId, (id) => listVolumeFiles(ops, id, path, options)),
+});
+
+/** The write half of a volume client over `volumeId`. */
+export const makeWriteVolumeClient = (
+  volumeId: Effect.Effect<string>,
+  ops: VolumeFileOps,
+): WriteVolumeClient => ({
+  volumeId,
+  writeFile: (path, data, options) =>
+    Effect.flatMap(volumeId, (id) => writeVolumeFile(ops, id, path, data, options)),
+  removeFile: (path, options) =>
+    Effect.flatMap(volumeId, (id) => removeVolumeFile(ops, id, path, options)),
+  copyFiles: (sources, destination, options) =>
+    Effect.flatMap(volumeId, (id) => copyVolumeFiles(ops, id, sources, destination, options)),
+});
+
+/** A read-write volume client over `volumeId`. */
+export const makeReadWriteVolumeClient = (
+  volumeId: Effect.Effect<string>,
+  ops: VolumeFileOps,
+): ReadWriteVolumeClient => ({
+  ...makeReadVolumeClient(volumeId, ops),
+  ...makeWriteVolumeClient(volumeId, ops),
+});

package/src/VolumeFiles.ts

@@ -0,0 +1,194 @@
+import { createHash } from "node:crypto";
+import * as volume from "@distilled.cloud/modal/volume";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import { operations } from "./internal.ts";
+
+/** A block upload or download to a URL Modal handed out failed. */
+export class VolumeTransferError extends Data.TaggedError("Modal.VolumeTransferError")<{
+  readonly path: string;
+  readonly message: string;
+}> {}
+
+/** One entry of a volume directory listing. */
+export interface VolumeFileEntry {
+  /** Path relative to the volume root. */
+  readonly path: string;
+  readonly type: "file" | "directory" | "symlink" | "other";
+  /** Size in bytes (files). */
+  readonly size: number;
+  /** Modification time, seconds since the epoch. */
+  readonly mtime: number;
+}
+
+const BLOCK_SIZE = 8 * 1024 * 1024;
+
+/** The operations a volume's files need, resolved by `ModalBindings.withCredentials`. */
+export const VolumeFileOps = operations({
+  getFile: volume.volumeGetFile2,
+  listFiles: volume.volumeListFiles2,
+  putFiles: volume.volumePutFiles2,
+  removeFile: volume.volumeRemoveFile2,
+  copyFiles: volume.volumeCopyFiles2,
+  http: HttpClient.HttpClient,
+});
+
+export type VolumeFileOps = Effect.Success<typeof VolumeFileOps>;
+
+const typeOf = (type: string | undefined): VolumeFileEntry["type"] =>
+  type === "FILE"
+    ? "file"
+    : type === "DIRECTORY"
+      ? "directory"
+      : type === "SYMLINK"
+        ? "symlink"
+        : "other";
+
+const toBytes = (data: string | Uint8Array) =>
+  Effect.sync(() => (typeof data === "string" ? new TextEncoder().encode(data) : data));
+
+/**
+ * Read a file from a (v2) volume: Modal returns presigned URLs for the
+ * file's blocks, which are fetched and concatenated.
+ */
+export const readVolumeFile = Effect.fn(function* (
+  ops: VolumeFileOps,
+  volumeId: string,
+  path: string,
+) {
+  const { getUrls, size } = yield* ops.getFile({ volumeId, path });
+  const total = Number(size ?? 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const url of getUrls ?? []) {
+    // A presigned block URL returned by VolumeGetFile2 (allowed raw HTTP).
+    const response = yield* ops.http.execute(HttpClientRequest.get(url));
+    if (response.status >= 300) {
+      return yield* new VolumeTransferError({
+        path,
+        message: `Downloading a block of ${path} failed with HTTP ${response.status}`,
+      });
+    }
+    const buffer = yield* response.arrayBuffer;
+    const block = new Uint8Array(buffer);
+    out.set(block.subarray(0, Math.max(0, total - offset)), offset);
+    offset += Math.min(block.length, BLOCK_SIZE);
+  }
+  return out;
+});
+
+/** List a directory of a (v2) volume. */
+export const listVolumeFiles = Effect.fn(function* (
+  ops: VolumeFileOps,
+  volumeId: string,
+  path: string,
+  options: { readonly recursive?: boolean } = {},
+) {
+  const { items } = yield* ops.listFiles({
+    volumeId,
+    path,
+    recursive: options.recursive ?? false,
+  });
+  return items.flatMap((batch) =>
+    (batch.entries ?? []).map((entry): VolumeFileEntry => ({
+      path: entry.path ?? "",
+      type: typeOf(entry.type),
+      size: Number(entry.size ?? 0),
+      mtime: Number(entry.mtime ?? 0),
+    })),
+  );
+});
+
+/**
+ * Write a file to a (v2) volume: send each 8 MiB block's SHA-256, upload
+ * the blocks Modal reports missing to the URLs it returns, then commit with
+ * the upload responses.
+ */
+export const writeVolumeFile = Effect.fn(function* (
+  ops: VolumeFileOps,
+  volumeId: string,
+  path: string,
+  data: string | Uint8Array,
+  options: { readonly mode?: number } = {},
+) {
+  const bytes = yield* toBytes(data);
+  const blocks = yield* Effect.sync(() => {
+    const out: { readonly data: Uint8Array; readonly sha256: string }[] = [];
+    for (let offset = 0; offset === 0 || offset < bytes.length; offset += BLOCK_SIZE) {
+      const block = bytes.subarray(offset, offset + BLOCK_SIZE);
+      out.push({ data: block, sha256: createHash("sha256").update(block).digest("base64") });
+      if (bytes.length === 0) break;
+    }
+    return out;
+  });
+  const putResponses = new Map<number, string>();
+  for (let round = 0; round < 3; round++) {
+    const { missingBlocks } = yield* ops.putFiles({
+      volumeId,
+      files: [
+        {
+          path,
+          size: String(bytes.length),
+          mode: options.mode ?? 0o644,
+          blocks: blocks.map((block, index) => ({
+            contentsSha256: block.sha256,
+            putResponse: putResponses.get(index),
+          })),
+        },
+      ],
+    });
+    if (!missingBlocks || missingBlocks.length === 0) return;
+    for (const missing of missingBlocks) {
+      const index = Number(missing.blockIndex ?? 0);
+      const block = blocks[index];
+      if (!block || !missing.putUrl) continue;
+      // A presigned block URL returned by VolumePutFiles2 (allowed raw HTTP).
+      const response = yield* ops.http.execute(
+        HttpClientRequest.put(missing.putUrl).pipe(
+          HttpClientRequest.bodyUint8Array(block.data, "application/octet-stream"),
+        ),
+      );
+      if (response.status >= 300) {
+        return yield* new VolumeTransferError({
+          path,
+          message: `Uploading block ${index} of ${path} failed with HTTP ${response.status}`,
+        });
+      }
+      const body = yield* response.arrayBuffer;
+      const encoded = yield* Effect.sync(() => Buffer.from(body).toString("base64"));
+      putResponses.set(index, encoded);
+    }
+  }
+  return yield* new VolumeTransferError({
+    path,
+    message: `Modal kept reporting blocks of ${path} missing after upload`,
+  });
+});
+
+/** Remove a file (or, with `recursive`, a directory) from a (v2) volume. */
+export const removeVolumeFile = Effect.fn(function* (
+  ops: VolumeFileOps,
+  volumeId: string,
+  path: string,
+  options: { readonly recursive?: boolean } = {},
+) {
+  yield* ops.removeFile({ volumeId, path, recursive: options.recursive ?? false });
+});
+
+/** Copy files inside a (v2) volume. */
+export const copyVolumeFiles = Effect.fn(function* (
+  ops: VolumeFileOps,
+  volumeId: string,
+  sources: ReadonlyArray<string>,
+  destination: string,
+  options: { readonly recursive?: boolean } = {},
+) {
+  yield* ops.copyFiles({
+    volumeId,
+    srcPaths: [...sources],
+    dstPath: destination,
+    recursive: options.recursive ?? false,
+  });
+});

package/src/WebhookToken.ts

@@ -0,0 +1,230 @@
+import * as environment from "@distilled.cloud/modal/environment";
+import * as webhook from "@distilled.cloud/modal/webhook";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { objectName } from "./internal.ts";
+import { declarable } from "./internal/Declared.ts";
+import type { Providers } from "./Providers.ts";
+
+export class WebhookTokenUnexpectedResponse extends Data.TaggedError(
+  "Modal.WebhookTokenUnexpectedResponse",
+)<{
+  readonly message: string;
+}> {}
+
+export interface WebhookTokenProps {
+  /**
+   * Display name of the token. If omitted, one is generated from the stack,
+   * stage and logical ID. Changing it renames the token in place.
+   */
+  name?: string;
+  /**
+   * Limit the token to the environments in {@link environments}. Changing it
+   * replaces the token (and its secret).
+   * @default false
+   */
+  scoped?: boolean;
+  /**
+   * Environments a scoped token works in: environment IDs, or yielded
+   * `Modal.Environment`s. Ignored unless {@link scoped} is set.
+   */
+  environments?: Array<string | { readonly environmentId: string }>;
+}
+
+export interface WebhookTokenAttributes {
+  /** Token ID (`wk-…`), sent as the `Modal-Key` header. */
+  tokenId: string;
+  /** Token secret (`ws-…`), sent as the `Modal-Secret` header. */
+  tokenSecret: Redacted.Redacted<string>;
+  /** Display name. */
+  name: string;
+  /** Whether the token is limited to {@link WebhookTokenProps.environments}. */
+  scoped: boolean;
+  /** Environment IDs a scoped token works in. */
+  environments: string[];
+}
+
+/**
+ * A Modal proxy auth token: the `Modal-Key` / `Modal-Secret` header pair
+ * that web endpoints and sandbox tunnels created with proxy authentication
+ * require. A scoped token works only in the environments it lists.
+ *
+ * Modal shows a token's secret once, at creation, so a token deleted outside
+ * Alchemy is recreated with a new secret on the next deploy. Tokens have no
+ * unique names, so they can't be adopted and aren't listed for
+ * `alchemy nuke`.
+ *
+ * ### Creating a token
+ * **Example:** A workspace-wide token
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ *
+ * export const Caller = Modal.WebhookToken("Caller", {});
+ * ```
+ *
+ * **Example:** A token scoped to one environment
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ *
+ * export const Agents = Modal.Environment("Agents", {});
+ * export const AgentsCaller = Modal.WebhookToken("AgentsCaller", {
+ *   scoped: true,
+ *   environments: [Agents],
+ * });
+ * ```
+ *
+ * ### Calling a protected endpoint
+ * **Example:** Send the header pair
+ * ```typescript
+ * const token = yield* AgentsCaller;
+ * const response = yield* HttpClient.get(url, {
+ *   headers: {
+ *     "Modal-Key": token.tokenId,
+ *     "Modal-Secret": Redacted.value(token.tokenSecret),
+ *   },
+ * });
+ * ```
+ *
+ * @resource
+ * @product WebhookToken
+ */
+export const WebhookToken = declarable<WebhookToken>()(
+  Resource<WebhookToken>("Modal.WebhookToken"),
+);
+
+export type WebhookToken = Resource<
+  "Modal.WebhookToken",
+  WebhookTokenProps,
+  WebhookTokenAttributes,
+  never,
+  Providers
+>;
+
+export const WebhookTokenProvider = () =>
+  Provider.effect(
+    WebhookToken,
+    Effect.gen(function* () {
+      const observe = Effect.fn(function* (tokenId: string) {
+        const { tokens } = yield* webhook.listWebhookToken({});
+        return (tokens ?? []).find((token) => token.tokenId === tokenId);
+      });
+
+      return {
+        stables: ["tokenId", "tokenSecret", "scoped"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if ((news.scoped ?? false) !== (olds?.scoped ?? false)) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (output === undefined) return undefined;
+          const found = yield* observe(output.tokenId);
+          if (!found) return undefined;
+          return { ...output, name: found.name ?? output.name, scoped: found.scoped ?? false };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* objectName(id, news.name);
+          const scoped = news.scoped ?? false;
+
+          // Observe: only a token we created (its secret is in state) can be kept.
+          const found = output !== undefined ? yield* observe(output.tokenId) : undefined;
+          let current: WebhookTokenAttributes;
+          if (found && output) {
+            current = { ...output, name: found.name ?? output.name };
+          } else {
+            // A token under our generated name that state doesn't hold is
+            // left from a create that failed before state was saved; its
+            // secret is lost, so replace it.
+            if (news.name === undefined) {
+              const { tokens } = yield* webhook.listWebhookToken({});
+              for (const stale of (tokens ?? []).filter((t) => t.name === name)) {
+                if (!stale.tokenId) continue;
+                yield* webhook
+                  .deleteWebhookToken({ tokenId: stale.tokenId })
+                  .pipe(Effect.catchTag("WebhookTokenNotFound", () => Effect.void));
+              }
+            }
+            // Ensure
+            yield* session.note(`Creating webhook token ${name}...`);
+            const created = yield* webhook.createWebhookToken({ name, scoped });
+            if (!created.tokenId || created.tokenSecret === undefined) {
+              return yield* new WebhookTokenUnexpectedResponse({
+                message: `Modal returned no token for ${name}`,
+              });
+            }
+            current = {
+              tokenId: created.tokenId,
+              tokenSecret: Redacted.isRedacted(created.tokenSecret)
+                ? created.tokenSecret
+                : Redacted.make(created.tokenSecret),
+              name,
+              scoped,
+              environments: [],
+            };
+          }
+
+          // Sync the name.
+          if (current.name !== name) {
+            yield* webhook.updateWebhookToken({ tokenId: current.tokenId, name });
+            current = { ...current, name };
+          }
+
+          // Sync environments against the observed set.
+          if (scoped) {
+            // Modal doesn't serve `WebhookTokenEnvironmentList`, so read the
+            // token's environments from each environment's token list.
+            const { items } = yield* environment.listEnvironment({});
+            const observed = new Set<string>();
+            for (const env of items ?? []) {
+              if (!env.environmentId || !env.name) continue;
+              // An environment deleted since the list holds no tokens.
+              const { tokens } = yield* webhook
+                .webhookTokenListForEnvironment({ environmentName: env.name })
+                .pipe(Effect.catchTag("EnvironmentNotFound", () => Effect.succeed({ tokens: [] })));
+              if ((tokens ?? []).some((token) => token.tokenId === current.tokenId)) {
+                observed.add(env.environmentId);
+              }
+            }
+            const desired = new Set(
+              (news.environments ?? []).flatMap((env) =>
+                typeof env === "string"
+                  ? [env]
+                  : typeof env === "object" && env !== null && "environmentId" in env
+                    ? [env.environmentId]
+                    : [],
+              ),
+            );
+            for (const environmentId of desired) {
+              if (!observed.has(environmentId)) {
+                yield* webhook.addWebhookTokenEnvironment({
+                  tokenId: current.tokenId,
+                  environmentId,
+                });
+              }
+            }
+            for (const environmentId of observed) {
+              if (!desired.has(environmentId)) {
+                yield* webhook.removeWebhookTokenEnvironment({
+                  tokenId: current.tokenId,
+                  environmentId,
+                });
+              }
+            }
+            current = { ...current, environments: [...desired] };
+          }
+          return current;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* webhook
+            .deleteWebhookToken({ tokenId: output.tokenId })
+            .pipe(Effect.catchTag("WebhookTokenNotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );

package/src/WorkspaceSettings.ts

@@ -0,0 +1,160 @@
+import * as workspace from "@distilled.cloud/modal/workspace";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { envNameOf, type EnvironmentInput } from "./internal.ts";
+import { declarable } from "./internal/Declared.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface WorkspaceSettingsProps {
+  /**
+   * Environment that Modal clients use when none is named (the `modal` CLI,
+   * `environmentName: ""` on the API).
+   */
+  defaultEnvironment?: EnvironmentInput;
+  /**
+   * Image builder version for new image builds in the workspace (e.g.
+   * `"2025.06"`). Changing it rebuilds images on their next use.
+   */
+  imageBuilderVersion?: string;
+  /**
+   * Require authentication on web endpoints and tunnels in environments
+   * that inherit the workspace default.
+   */
+  blockUnauthenticatedResources?: boolean;
+}
+
+export interface WorkspaceSettingsAttributes {
+  /** The workspace's default environment. */
+  defaultEnvironment: string | undefined;
+  /** The workspace's image builder version. */
+  imageBuilderVersion: string | undefined;
+  /** Settings found before the first deploy, restored on destroy. */
+  original: {
+    defaultEnvironment: string | undefined;
+    imageBuilderVersion: string | undefined;
+  };
+}
+
+/**
+ * Workspace-wide Modal settings: the default environment, the image builder
+ * version, and whether endpoints in inheriting environments require
+ * authentication.
+ *
+ * A workspace has one set of settings, so declare this resource once. It
+ * captures the settings it finds on first deploy and restores them when
+ * destroyed.
+ *
+ * ### Configuring the workspace
+ * **Example:** Pin the image builder and default environment
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ *
+ * export const Agents = Modal.Environment("Agents", {});
+ * export const Settings = Modal.WorkspaceSettings("Settings", {
+ *   defaultEnvironment: Agents,
+ *   imageBuilderVersion: "2025.06",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Workspace
+ */
+export const WorkspaceSettings = declarable<WorkspaceSettings>()(
+  Resource<WorkspaceSettings>("Modal.WorkspaceSettings"),
+);
+
+export type WorkspaceSettings = Resource<
+  "Modal.WorkspaceSettings",
+  WorkspaceSettingsProps,
+  WorkspaceSettingsAttributes,
+  never,
+  Providers
+>;
+
+export const WorkspaceSettingsProvider = () =>
+  Provider.effect(
+    WorkspaceSettings,
+    Effect.gen(function* () {
+      const observe = workspace.workspaceSettings({});
+
+      return {
+        read: Effect.fn(function* ({ output }) {
+          if (output === undefined) return undefined;
+          const current = yield* observe;
+          return {
+            ...output,
+            defaultEnvironment: current.defaultEnvironmentName || undefined,
+            imageBuilderVersion: current.imageBuilderVersion || undefined,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe
+          const current = yield* observe;
+          const original = output?.original ?? {
+            defaultEnvironment: current.defaultEnvironmentName || undefined,
+            imageBuilderVersion: current.imageBuilderVersion || undefined,
+          };
+          // Sync each setting against the observed value.
+          const defaultEnvironment = envNameOf(news.defaultEnvironment);
+          if (
+            defaultEnvironment !== undefined &&
+            defaultEnvironment !== current.defaultEnvironmentName
+          ) {
+            yield* workspace.workspaceSetDefaultEnvironment({
+              environmentName: defaultEnvironment,
+            });
+          }
+          if (
+            news.imageBuilderVersion !== undefined &&
+            news.imageBuilderVersion !== current.imageBuilderVersion
+          ) {
+            yield* workspace.workspaceSetImageBuilderVersion({
+              newImageBuilderVersion: news.imageBuilderVersion,
+            });
+          }
+          if (news.blockUnauthenticatedResources !== undefined) {
+            yield* workspace.workspaceSetDefaultEnvironmentSettings({
+              blockUnauthenticatedResources: news.blockUnauthenticatedResources
+                ? "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK"
+                : "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW",
+            });
+          }
+          const final = yield* observe;
+          return {
+            defaultEnvironment: final.defaultEnvironmentName || undefined,
+            imageBuilderVersion: final.imageBuilderVersion || undefined,
+            original,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, olds }) {
+          // Restore what was there before Alchemy managed the settings.
+          const current = yield* observe;
+          if (
+            olds.defaultEnvironment !== undefined &&
+            output.original.defaultEnvironment !== undefined &&
+            current.defaultEnvironmentName !== output.original.defaultEnvironment
+          ) {
+            yield* workspace.workspaceSetDefaultEnvironment({
+              environmentName: output.original.defaultEnvironment,
+            });
+          }
+          if (
+            olds.imageBuilderVersion !== undefined &&
+            output.original.imageBuilderVersion !== undefined &&
+            current.imageBuilderVersion !== output.original.imageBuilderVersion
+          ) {
+            yield* workspace.workspaceSetImageBuilderVersion({
+              newImageBuilderVersion: output.original.imageBuilderVersion,
+            });
+          }
+          if (olds.blockUnauthenticatedResources !== undefined) {
+            yield* workspace.workspaceSetDefaultEnvironmentSettings({
+              blockUnauthenticatedResources:
+                "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED",
+            });
+          }
+        }),
+      };
+    }),
+  );