@alchemy.run/modal 0.0.0 → 2.0.0-beta.87

package/src/Mounts.ts

@@ -0,0 +1,230 @@
+import type * as sandbox from "@distilled.cloud/modal/sandbox";
+import { checkMountSupport, collectMountCapabilities, type MountCapability } from "alchemy/Mount";
+import * as Output from "alchemy/Output";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import type { Ref } from "./Container.ts";
+
+/** A value known at deploy, or an Effect that reads it at runtime. */
+type Lazy<T> = T | Effect.Effect<T>;
+
+/** A volume entry's options besides the volume: Modal's own volume mount fields. */
+export interface VolumeMountOptions {
+  /** Absolute path the volume is mounted at. */
+  readonly path: string;
+  /** Mount read-only. */
+  readonly readOnly?: boolean;
+  /** Mount this directory of the volume instead of its root. */
+  readonly subPath?: string;
+}
+
+/** A bucket entry's options besides the bucket: Modal's own cloud bucket mount fields. */
+export interface BucketMountOptions {
+  /** Absolute path the bucket is mounted at. */
+  readonly path: string;
+  /**
+   * The bucket's storage API.
+   * @default "r2" for a Cloudflare R2 bucket, "s3" otherwise
+   */
+  readonly type?: "s3" | "r2" | "gcp";
+  /**
+   * S3-compatible endpoint.
+   * @default the account endpoint, for a Cloudflare R2 bucket
+   */
+  readonly endpointUrl?: string;
+  /** Mount only keys under this prefix. */
+  readonly keyPrefix?: string;
+  /** Mount read-only. */
+  readonly readOnly?: boolean;
+  /** Assume this AWS role with Modal's OIDC identity instead of a secret. */
+  readonly oidcAuthRoleArn?: string;
+}
+
+/** The fields of a bucket resource a mount reads: AWS S3, Cloudflare R2, GCS. */
+export interface BucketLike {
+  readonly bucketName: string;
+  /** Cloudflare R2: the account the bucket's endpoint is under. */
+  readonly accountId?: string;
+  /** Cloudflare R2: `"eu"` or `"fedramp"` buckets have their own endpoint. */
+  readonly jurisdiction?: string;
+}
+
+/**
+ * A `Modal.Volume` mounted at `path`. In Stack props the volume is the
+ * declared `Modal.Volume`; at runtime it's a handle (`CreateVolume`) or
+ * the reference `Modal.MountVolume` returns.
+ */
+export interface VolumeMount<V = Ref<{ readonly volumeId: string }>> extends VolumeMountOptions {
+  readonly volume: V;
+}
+
+/**
+ * A cloud bucket mounted at `path` with Modal's cloud bucket mounts: a
+ * bucket name, or a bucket resource of another provider (an AWS S3 Bucket,
+ * a Cloudflare R2 Bucket). Without `oidcAuthRoleArn`, `secret` holds the
+ * bucket's keys (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`, or GCS HMAC
+ * keys).
+ */
+export interface BucketMount<
+  B = string | Ref<BucketLike>,
+  S = Ref<{ readonly secretId: string }>,
+> extends BucketMountOptions {
+  readonly bucket: B;
+  readonly secret?: S;
+}
+
+/** A mount in Stack props (`Modal.Function`, `Server`, `Sandbox`, `PersistentSandbox`). */
+export type Mount = VolumeMount | BucketMount;
+
+/** The volume of a runtime mount entry: a volume handle, or a `MountVolume` reference. */
+export interface MountedVolume {
+  readonly volumeId: Lazy<string>;
+}
+
+/** The bucket of a runtime mount entry, as `MountBucket` resolves it. */
+export interface MountedBucket {
+  readonly bucketName: Lazy<string>;
+  readonly endpointUrl?: Lazy<string | undefined>;
+  readonly type?: "s3" | "r2" | "gcp";
+}
+
+/** A mount for `sandboxes.create`: a plain entry over handles, or a `Mount<Noun>` reference. */
+export type SandboxMount =
+  | VolumeMount<MountedVolume>
+  | BucketMount<string | MountedBucket, { readonly secretId: Lazy<string> }>;
+
+/** A mount entry referenced a resource that isn't bound into this runtime. */
+export class MountNotBound extends Data.TaggedError("Modal.MountNotBound")<{
+  readonly path: string;
+  readonly message: string;
+}> {}
+
+/** Modal's mount fields for a set of entries. */
+export interface ModalMounts {
+  readonly volumeMounts: sandbox.VolumeMount[];
+  readonly cloudBucketMounts: sandbox.CloudBucketMount[];
+}
+
+const BUCKET_TYPE = { s3: "S3", r2: "R2", gcp: "GCP" } as const;
+
+/** Cloudflare R2's S3 endpoint for an account (and jurisdiction). */
+export const r2Endpoint = (accountId: string, jurisdiction?: string): string =>
+  `https://${accountId}${
+    jurisdiction && jurisdiction !== "default" ? `.${jurisdiction}` : ""
+  }.r2.cloudflarestorage.com`;
+
+const value = <T>(input: Lazy<T> | undefined, path: string) =>
+  Output.isOutput(input)
+    ? Effect.fail(
+        new MountNotBound({
+          path,
+          message: `The mount at ${path} references a declared resource; bind it with Modal.MountVolume or Modal.MountBucket`,
+        }),
+      )
+    : Effect.isEffect(input)
+      ? (input as Effect.Effect<T>)
+      : Effect.succeed(input as T);
+
+const field = (record: unknown, key: string): unknown =>
+  typeof record === "object" && record !== null
+    ? (record as Record<string, unknown>)[key]
+    : undefined;
+
+/**
+ * Modal's `volumeMounts` and `cloudBucketMounts` for mount entries whose
+ * resources are resolved: attributes at reconcile, handles or `Mount<Noun>`
+ * references at runtime.
+ */
+export const modalMountsOf = (
+  mounts: ReadonlyArray<Mount | SandboxMount> | undefined,
+): Effect.Effect<ModalMounts, MountNotBound> =>
+  Effect.gen(function* () {
+    const volumeMounts: sandbox.VolumeMount[] = [];
+    const cloudBucketMounts: sandbox.CloudBucketMount[] = [];
+    for (const mount of mounts ?? []) {
+      if ("volume" in mount) {
+        const volumeId = yield* value(field(mount.volume, "volumeId") as Lazy<string>, mount.path);
+        volumeMounts.push({
+          mountPath: mount.path,
+          volumeId,
+          readOnly: mount.readOnly,
+          subPath: mount.subPath,
+          allowBackgroundCommits: true,
+        });
+        continue;
+      }
+      const bucket = mount.bucket;
+      const bucketName =
+        typeof bucket === "string"
+          ? bucket
+          : yield* value(field(bucket, "bucketName") as Lazy<string>, mount.path);
+      const accountId = field(bucket, "accountId");
+      const isR2 = typeof accountId === "string";
+      const endpointUrl =
+        mount.endpointUrl ??
+        (isR2
+          ? r2Endpoint(accountId, field(bucket, "jurisdiction") as string | undefined)
+          : yield* value(field(bucket, "endpointUrl") as Lazy<string | undefined>, mount.path));
+      const type =
+        mount.type ?? (field(bucket, "type") as BucketMount["type"]) ?? (isR2 ? "r2" : undefined);
+      const secretId = mount.secret
+        ? yield* value(field(mount.secret, "secretId") as Lazy<string>, mount.path)
+        : undefined;
+      cloudBucketMounts.push({
+        mountPath: mount.path,
+        bucketName,
+        bucketType: type ? BUCKET_TYPE[type] : undefined,
+        bucketEndpointUrl: endpointUrl,
+        credentialsSecretId: secretId,
+        keyPrefix: mount.keyPrefix,
+        readOnly: mount.readOnly,
+        oidcAuthRoleArn: mount.oidcAuthRoleArn,
+      });
+    }
+    return { volumeMounts, cloudBucketMounts };
+  });
+
+/**
+ * What a Modal runtime's `mounts` binding contract holds: volume and bucket
+ * entries (`Modal.MountVolume`, `Modal.MountBucket`), and the install lines
+ * of other providers' mount clients (`alchemy/Mount`).
+ */
+export type MountContract = ReadonlyArray<Mount | MountCapability>;
+
+/** A host's binding data, for its `mounts` slice. */
+export type MountBindings = ReadonlyArray<{ readonly data: { readonly mounts?: MountContract } }>;
+
+const isCapability = (entry: Mount | MountCapability): entry is MountCapability =>
+  "install" in entry && "id" in entry;
+
+/** The volume and bucket entries a host's bindings contributed, in binding order. */
+export const boundMounts = (bindings: MountBindings): ReadonlyArray<Mount> =>
+  bindings.flatMap((binding) =>
+    (binding.data.mounts ?? []).filter((entry): entry is Mount => !isCapability(entry)),
+  );
+
+/** The mount clients other providers' bindings asked the host's image to install. */
+export const boundCapabilities = (bindings: MountBindings): ReadonlyArray<MountCapability> =>
+  collectMountCapabilities(
+    bindings.map((binding) => ({
+      data: { mounts: (binding.data.mounts ?? []).filter(isCapability) },
+    })),
+  );
+
+/**
+ * What a Modal container provides to mount clients. Modal runs containers
+ * under gVisor without `CAP_SYS_ADMIN`: `/dev/fuse` exists, but `mount`
+ * fails with permission denied, for FUSE and NFS alike.
+ */
+export const MODAL_MOUNT_SUPPORT = { fuse: false, nfs: false } as const;
+
+/** Fail when a mount client needs what a Modal container can't provide. */
+export const checkModalMounts = (host: string, capabilities: ReadonlyArray<MountCapability>) => {
+  const unsupported = checkMountSupport(
+    host,
+    capabilities,
+    MODAL_MOUNT_SUPPORT,
+    "Mount Modal volumes and cloud buckets with Modal.MountVolume and Modal.MountBucket instead.",
+  );
+  return unsupported === undefined ? Effect.void : Effect.fail(unsupported);
+};

package/src/PersistentSandbox.ts

@@ -0,0 +1,142 @@
+import * as persistent from "@distilled.cloud/modal/persistent";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { envNameOf } from "./internal.ts";
+import { declarable } from "./internal/Declared.ts";
+import type { Mount } from "./Mounts.ts";
+import type { Providers } from "./Providers.ts";
+import {
+  createPersistentSandbox,
+  persistentSandboxHandle,
+  SandboxOps,
+  type PersistentSandboxCreateOptions,
+} from "./SandboxClient.ts";
+
+export interface PersistentSandboxProps extends Omit<PersistentSandboxCreateOptions, "mounts"> {
+  /**
+   * Volumes and cloud buckets mounted into every session:
+   * `[{ volume: Home, path: "/home/user" }]`. Changing them replaces the box.
+   */
+  mounts?: Mount[];
+  /** The App the box runs in (`Modal.App`). Changing it replaces the box. */
+  app: { readonly appId: string; readonly name?: string; readonly environment?: unknown };
+}
+
+export interface PersistentSandboxAttributes {
+  /** Persistent sandbox ID; pass it (or this resource) to `sandboxes.persistent(...)`. */
+  persistentSandboxId: string;
+  /** The App the box runs in. */
+  appId: string;
+  /** Name of that App. */
+  appName: string | undefined;
+  /** Environment of that App. */
+  environment: string | undefined;
+}
+
+/**
+ * A Modal persistent sandbox: one box whose filesystem outlives its
+ * sessions. Each session is a regular sandbox that runs up to an hour and
+ * pauses after five idle minutes; the next `session()` resumes it from the
+ * last session's filesystem. Use it for a long-lived workspace, such as a
+ * shared dev box or an agent's home, that the Stack owns.
+ *
+ * Modal's persistent sandboxes are experimental: they don't take a name,
+ * GPUs, `env`, tags or memory snapshots yet. Changing any prop replaces the
+ * box (and its files).
+ *
+ * ### Creating a box
+ * **Example:** A dev box on a warm base image
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ * import { Coder, Warm } from "./Coder.ts";
+ *
+ * export const DevBox = Modal.PersistentSandbox("DevBox", { app: Coder, image: Warm, workdir: "/work" });
+ * ```
+ *
+ * ### Using it at runtime
+ * **Example:** Resume it from a Worker
+ * ```typescript
+ * // construction phase
+ * const sandboxes = yield* Modal.CreateSandbox(Coder);
+ * const devBoxId = yield* (yield* DevBox).persistentSandboxId;
+ * // in fetch:
+ * const session = yield* (yield* sandboxes.persistent(yield* devBoxId)).session();
+ * const result = yield* session.exec(["git", "status"]);
+ * ```
+ *
+ * @resource
+ * @product Sandbox
+ */
+export const PersistentSandbox = declarable<PersistentSandbox>()(
+  Resource<PersistentSandbox>("Modal.PersistentSandbox"),
+);
+
+export type PersistentSandbox = Resource<
+  "Modal.PersistentSandbox",
+  PersistentSandboxProps,
+  PersistentSandboxAttributes,
+  never,
+  Providers
+>;
+
+const appOf = (value: PersistentSandboxProps["app"]) => ({
+  appId: value.appId,
+  appName: value.name,
+  environment: envNameOf(value.environment as never),
+});
+
+export const PersistentSandboxProvider = () =>
+  Provider.effect(
+    PersistentSandbox,
+    Effect.gen(function* () {
+      return {
+        stables: ["persistentSandboxId", "appId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news) || olds === undefined) return undefined;
+          // Modal can't change a persistent sandbox's definition.
+          return deepEqual(news, olds) ? undefined : ({ action: "replace" } as const);
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (output === undefined) return undefined;
+          const found = yield* persistent
+            .getPersistentSandbox({ persistentSandboxId: output.persistentSandboxId })
+            .pipe(Effect.catchTag("PersistentSandboxNotFound", () => Effect.undefined));
+          return found?.persistentSandboxId ? output : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const app = appOf(news.app);
+          // Observe: the box still exists.
+          if (output !== undefined) {
+            const found = yield* persistent
+              .getPersistentSandbox({ persistentSandboxId: output.persistentSandboxId })
+              .pipe(Effect.catchTag("PersistentSandboxNotFound", () => Effect.undefined));
+            if (found?.persistentSandboxId) return output;
+          }
+          // Ensure.
+          yield* session.note("Creating persistent sandbox...");
+          const { app: _app, ...options } = news;
+          // Resolved by the engine: every mount's resource is attributes by now.
+          const handle = yield* createPersistentSandbox(
+            yield* SandboxOps,
+            app,
+            options as PersistentSandboxCreateOptions,
+          );
+          return {
+            persistentSandboxId: handle.persistentSandboxId,
+            appId: app.appId,
+            appName: app.appName,
+            environment: app.environment,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* persistentSandboxHandle(
+            yield* SandboxOps,
+            output.persistentSandboxId,
+            output,
+          ).terminate();
+        }),
+      };
+    }),
+  );

package/src/Providers.ts

@@ -0,0 +1,100 @@
+import { CredentialsStoreLive } from "alchemy/Auth/Credentials";
+import { ProfileStoreLive } from "alchemy/Auth/Profile";
+import * as Provider from "alchemy/Provider";
+import { Random, RandomProvider } from "alchemy/Random";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { App, AppProvider } from "./App.ts";
+import { ModalAuth } from "./AuthProvider.ts";
+import * as Credentials from "./Credentials.ts";
+import { Dict, DictProvider } from "./Dict.ts";
+import { Domain, DomainProvider } from "./Domain.ts";
+import { Endpoint, EndpointProvider } from "./Endpoint.ts";
+import { Environment, EnvironmentProvider } from "./Environment.ts";
+import { Function, FunctionProvider } from "./Function.ts";
+import { FunctionAutoscaler, FunctionAutoscalerProvider } from "./FunctionAutoscaler.ts";
+import { Image, ImageProvider } from "./Image.ts";
+import { PersistentSandbox, PersistentSandboxProvider } from "./PersistentSandbox.ts";
+import { Proxy, ProxyProvider } from "./Proxy.ts";
+import { Queue, QueueProvider } from "./Queue.ts";
+import { Sandbox, SandboxProvider } from "./Sandbox.ts";
+import { Secret, SecretProvider } from "./Secret.ts";
+import { Server, ServerProvider } from "./Server.ts";
+import { ServiceUser, ServiceUserProvider } from "./ServiceUser.ts";
+import { Volume, VolumeProvider } from "./Volume.ts";
+import { WebhookToken, WebhookTokenProvider } from "./WebhookToken.ts";
+import { WorkspaceSettings, WorkspaceSettingsProvider } from "./WorkspaceSettings.ts";
+
+/**
+ * Service tag bundling every Modal provider + auth + credentials. Use
+ * `Modal.providers()` to materialize the full layer.
+ */
+export class Providers extends Provider.ProviderCollection<Providers>()("Modal") {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Every Modal resource provider, the Modal AuthProvider registration (so
+ * `alchemy profile edit` can configure it), and credential resolution.
+ *
+ * @example
+ * ```ts
+ * Alchemy.Stack("App", { providers: Modal.providers() }, ...)
+ * ```
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      App,
+      Dict,
+      Domain,
+      Endpoint,
+      Environment,
+      Function,
+      FunctionAutoscaler,
+      Image,
+      PersistentSandbox,
+      Proxy,
+      Queue,
+      // Each RPC binding mints its caller's key (`Modal.InvokeFunction`, `Modal.FetchServer`).
+      Random,
+      Sandbox,
+      Secret,
+      Server,
+      ServiceUser,
+      Volume,
+      WebhookToken,
+      WorkspaceSettings,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        AppProvider(),
+        DictProvider(),
+        DomainProvider(),
+        EndpointProvider(),
+        EnvironmentProvider(),
+        FunctionProvider(),
+        FunctionAutoscalerProvider(),
+        ImageProvider(),
+        PersistentSandboxProvider(),
+        ProxyProvider(),
+        QueueProvider(),
+        RandomProvider(),
+        SandboxProvider(),
+        SecretProvider(),
+        ServerProvider(),
+        ServiceUserProvider(),
+        VolumeProvider(),
+        WebhookTokenProvider(),
+        WorkspaceSettingsProvider(),
+      ),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(ModalAuth),
+    Layer.provideMerge(ProfileStoreLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  );

package/src/Proxy.ts

@@ -0,0 +1,191 @@
+import * as proxy from "@distilled.cloud/modal/proxy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import {
+  type EnvironmentInput,
+  envNameOf,
+  environmentOf,
+  isGeneratedName,
+  objectName,
+} from "./internal.ts";
+import { declarable } from "./internal/Declared.ts";
+import type { Providers } from "./Providers.ts";
+
+export class ProxyUnexpectedResponse extends Data.TaggedError("Modal.ProxyUnexpectedResponse")<{
+  readonly message: string;
+}> {}
+
+export interface ProxyProps {
+  /**
+   * Proxy name, unique per environment. If omitted, a unique name is
+   * generated from the stack, stage and logical ID. Changing it replaces the
+   * proxy.
+   */
+  name?: string;
+  /**
+   * Environment the proxy lives in. Changing it replaces the proxy.
+   * @default the workspace's default environment
+   */
+  environment?: EnvironmentInput;
+  /**
+   * Region the proxy's IPs come from (e.g. `us-east-1`). Changing it
+   * replaces the proxy.
+   */
+  region?: string;
+  /**
+   * Number of static egress IPs. Traffic through the proxy leaves from one
+   * of them.
+   * @default 1
+   */
+  ips?: number;
+}
+
+export interface ProxyAttributes {
+  /** Proxy ID (`pr-…`). */
+  proxyId: string;
+  /** Proxy name. */
+  name: string;
+  /** Environment name, or `undefined` for the workspace default. */
+  environment: string | undefined;
+  /** Region of the proxy's IPs. */
+  region: string | undefined;
+  /** The static egress IPs, for allowlists on the systems a sandbox calls. */
+  ips: string[];
+}
+
+/**
+ * A Modal Proxy: static egress IPs for Sandboxes and Functions. Traffic from
+ * a sandbox created with `proxy` leaves from these IPs, so a database or API
+ * can allowlist them.
+ *
+ * Proxies are a Modal Team plan feature. Modal proxies have no tags;
+ * ownership is inferred from Alchemy state.
+ *
+ * ### Creating a Proxy
+ * **Example:** One static IP
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ *
+ * export const Egress = Modal.Proxy("Egress", {});
+ * ```
+ *
+ * **Example:** Two IPs in a region
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ *
+ * export const Egress = Modal.Proxy("Egress", { region: "us-east-1", ips: 2 });
+ * ```
+ *
+ * ### Routing a Sandbox through it
+ * **Example:** Pass the proxy when creating a sandbox
+ * ```typescript
+ * const sandbox = yield* sandboxes.create({ proxy: egress });
+ * ```
+ *
+ * @resource
+ * @product Proxy
+ */
+export const Proxy = declarable<Proxy>()(Resource<Proxy>("Modal.Proxy"));
+
+export type Proxy = Resource<"Modal.Proxy", ProxyProps, ProxyAttributes, never, Providers>;
+
+const toAttrs = (p: proxy.Proxy, env: string | undefined): ProxyAttributes => ({
+  proxyId: p.proxyId ?? "",
+  name: p.name ?? "",
+  environment: env,
+  region: p.region || undefined,
+  ips: (p.proxyIps ?? []).flatMap((ip) => (ip.proxyIp ? [ip.proxyIp] : [])),
+});
+
+export const ProxyProvider = () =>
+  Provider.effect(
+    Proxy,
+    Effect.gen(function* () {
+      const observe = Effect.fn(function* (name: string, env: string | undefined) {
+        const found = yield* proxy
+          .getProxy({ name, environmentName: environmentOf(env) })
+          .pipe(Effect.catchTag("ProxyNotFound", () => Effect.undefined));
+        return found?.proxy?.proxyId ? found.proxy : undefined;
+      });
+
+      return {
+        stables: ["proxyId", "name", "environment", "region"],
+        diff: Effect.fn(function* ({ id, news, olds, output }) {
+          if (!isResolved(news)) return undefined;
+          if (envNameOf(news.environment) !== envNameOf(olds?.environment))
+            return { action: "replace" } as const;
+          if (news.region !== olds?.region) return { action: "replace" } as const;
+          const name = yield* objectName(id, news.name);
+          if (output !== undefined && name !== output.name) return { action: "replace" } as const;
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name = output?.name ?? (yield* objectName(id, olds?.name));
+          const env = output?.environment ?? envNameOf(olds?.environment);
+          const found = yield* observe(name, env);
+          if (!found) return undefined;
+          const attrs = toAttrs(found, env);
+          return output !== undefined || olds?.name === undefined ? attrs : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.name ?? (yield* objectName(id, news.name));
+          // Observe
+          let current = yield* observe(name, envNameOf(news.environment));
+          // Ensure
+          if (!current) {
+            yield* session.note(`Creating proxy ${name}...`);
+            const created = yield* proxy
+              .createProxy({
+                name,
+                environmentName: environmentOf(envNameOf(news.environment)),
+                region: news.region,
+              })
+              .pipe(
+                Effect.map((response) => response.proxy),
+                Effect.catchTag("ProxyAlreadyExists", () =>
+                  observe(name, envNameOf(news.environment)),
+                ),
+              );
+            if (!created?.proxyId) {
+              return yield* new ProxyUnexpectedResponse({
+                message: `Modal returned no proxy for ${name}`,
+              });
+            }
+            current = created;
+          }
+          // Sync the IP count against the observed IPs.
+          const desired = news.ips ?? 1;
+          const observed = (current.proxyIps ?? []).flatMap((ip) =>
+            ip.proxyIp ? [ip.proxyIp] : [],
+          );
+          for (let i = observed.length; i < desired; i++) {
+            yield* session.note(`Adding an IP to proxy ${name}...`);
+            yield* proxy.proxyAddIp({ proxyId: current.proxyId });
+          }
+          for (const ip of observed.slice(desired)) {
+            yield* session.note(`Removing IP ${ip} from proxy ${name}...`);
+            yield* proxy
+              .proxyRemoveIp({ proxyIp: ip })
+              .pipe(Effect.catchTag("ProxyNotFound", () => Effect.void));
+          }
+          const final = (yield* observe(name, envNameOf(news.environment))) ?? current;
+          return toAttrs(final, envNameOf(news.environment));
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* proxy
+            .deleteProxy({ proxyId: output.proxyId })
+            .pipe(Effect.catchTag("ProxyNotFound", () => Effect.void));
+        }),
+        list: Effect.fn(function* () {
+          const { proxies } = yield* proxy.listProxy({});
+          return (proxies ?? [])
+            .filter((p) => p.proxyId && isGeneratedName(p.name))
+            .map((p) => toAttrs(p, p.environmentName || undefined));
+        }),
+      };
+    }),
+  );