alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/src/State/PostgresState.ts

@@ -282,11 +282,9 @@ export const makePostgresState = <E = never, R = never>(
             ? client
             : url !== undefined && client === undefined
               ? yield* openPool(url)
-              : yield* Effect.fail(
-                  new StateStoreError({
-                    message: "postgresState requires exactly one of `client` or `url`",
-                  }),
-                );
+              : yield* new StateStoreError({
+                  message: "postgresState requires exactly one of `client` or `url`",
+                });
         // The store reads columns by the exact names written below, so a
         // client configured with name transforms must not rewrite them.
         const sql = resolved.withoutTransforms();
@@ -340,11 +338,9 @@ export const makePostgresState = <E = never, R = never>(
           );
           if (acquired?.acquired !== true) {
             yield* releaseReserved;
-            return yield* Effect.fail(
-              new StateStoreError({
-                message: `another deploy holds the Postgres state lock '${key}'`,
-              }),
-            );
+            return yield* new StateStoreError({
+              message: `another deploy holds the Postgres state lock '${key}'`,
+            });
           }
           const lockPid = Number(acquired.pid);
 

package/src/State/StateEncoding.ts

@@ -80,7 +80,7 @@ export const encodeState = (value: unknown): unknown => {
     return value;
   if (Redacted.isRedacted(value)) {
     return {
-      [REDACTED_MARKER]: encodeState(Redacted.value(value)),
+      [REDACTED_MARKER]: value.pipe(Redacted.value, encodeState),
     };
   }
   if (Duration.isDuration(value)) {

package/src/Stripe/BillingPortalConfiguration.ts

@@ -765,9 +765,14 @@ export const BillingPortalConfigurationProvider = () =>
     }),
 
     list: Effect.fn(function* () {
-      const configurations = yield* listAllConfigurations();
+      // Portal configurations cannot be deleted; delete deactivates them.
+      // Inactive rows are effectively deleted and must not re-enter nuke.
+      // The account default is an account singleton Stripe refuses to
+      // deactivate, so it is never enumerated (even if alchemy created it).
+      const configurations = yield* listByActive(true);
       return configurations
         .filter((configuration) => {
+          if (configuration.is_default) return false;
           const metadata = tagRecord(configuration.metadata);
           return metadata[alchemyMetadataKeys.stack] !== undefined;
         })
@@ -867,6 +872,11 @@ export const BillingPortalConfigurationProvider = () =>
     delete: Effect.fn(function* ({ output }) {
       const existing = yield* getById(output.id);
       if (existing === undefined || !existing.active) return;
+      // Stripe rejects `active: false` on the account default
+      // ("You cannot set active: false on your default PortalConfiguration")
+      // and the API cannot move the default elsewhere. The default is an
+      // account singleton: releasing it leaves it in place.
+      if (existing.is_default) return;
       yield* UpdateBillingPortalConfiguration({
         configuration: existing.id,
         active: false,

package/src/Stripe/Credentials.ts

@@ -46,11 +46,10 @@ export const fromAuthProvider = () =>
               apiKey: creds.apiKey,
               apiBaseUrl: creds.apiBaseUrl,
             })),
-            Effect.mapError(
-              (e) =>
-                new ConfigError({
-                  message: `Failed to resolve Stripe credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${(e as { message?: string }).message ?? String(e)}`,
-                }),
+            Effect.mapError((e) =>
+              ConfigError.make({
+                message: `Failed to resolve Stripe credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${(e as { message?: string }).message ?? String(e)}`,
+              }),
             ),
           ),
         ),

package/src/Stripe/PaymentMethodDomain.ts

@@ -185,6 +185,10 @@ const toAttrs = (domain: StripePaymentMethodDomain): PaymentMethodDomainAttribut
 
 const isMissingDomain = isMissingStripeResource;
 
+/** Stripe-hosted domains (`buy.stripe.com`, …) Stripe registers itself. */
+const isStripeManagedDomain = (domainName: string) =>
+  domainName === "stripe.com" || domainName.endsWith(".stripe.com");
+
 const getById = (paymentMethodDomain: string) =>
   GetPaymentMethodDomain({
     payment_method_domain: paymentMethodDomain,
@@ -269,9 +273,11 @@ export const PaymentMethodDomainProvider = () =>
     list: Effect.fn(function* () {
       // No metadata on this resource. Default list is enabled domains;
       // disabled rows stay in Stripe (domain_name remains reserved) but
-      // must not re-enter nuke.
+      // must not re-enter nuke. Stripe auto-registers its own hosted
+      // domains (e.g. `buy.stripe.com` for Payment Links) on the account;
+      // those are Stripe-managed, never ours, and are skipped.
       const domains = yield* listByEnabled(true);
-      return domains.map(toAttrs);
+      return domains.filter((domain) => !isStripeManagedDomain(domain.domain_name)).map(toAttrs);
     }),
 
     reconcile: Effect.fn(function* ({ id, news, output, instanceId }) {

package/src/Stripe/Plan.ts

@@ -357,7 +357,10 @@ export const PlanProvider = () =>
     }),
 
     list: Effect.fn(function* () {
-      const plans = yield* listAllPlans();
+      // The plans API also enumerates recurring prices, which Price's delete
+      // archives (active: false). Archived rows are effectively deleted and
+      // must not re-enter nuke, so enumerate active plans only.
+      const plans = yield* listByActive(true);
       return plans
         .filter((plan) => {
           const metadata = tagRecord(plan.metadata);

package/src/Stripe/Product.ts

@@ -237,7 +237,10 @@ export const ProductProvider = () =>
     }),
 
     list: Effect.fn(function* () {
-      const products = yield* listAllProducts();
+      // Stripe cannot hard-delete a product that has prices; delete archives
+      // it (active: false). Archived rows are effectively deleted and must
+      // not re-enter nuke, so enumerate active products only.
+      const products = yield* listByActive(true);
       return products
         .filter((product) => {
           const metadata = tagRecord(product.metadata);

package/src/Stripe/PromotionCode.ts

@@ -349,20 +349,6 @@ const listByActive = Effect.fn(function* (active: boolean) {
   return items;
 });
 
-const listAllPromotionCodes = Effect.fn(function* () {
-  const [active, inactive] = yield* Effect.all([listByActive(true), listByActive(false)], {
-    concurrency: 2,
-  });
-  const seen = new Set<string>();
-  const items: StripePromotionCode[] = [];
-  for (const item of [...active, ...inactive]) {
-    if (seen.has(item.id)) continue;
-    seen.add(item.id);
-    items.push(item);
-  }
-  return items;
-});
-
 const observe = Effect.fn(function* (input: { id?: string; code: string }) {
   if (input.id !== undefined) {
     const byId = yield* getById(input.id);
@@ -429,7 +415,9 @@ export const PromotionCodeProvider = () =>
     stables: ["id", "code", "couponId", "created", "livemode"],
 
     list: Effect.fn(function* () {
-      const items = yield* listAllPromotionCodes();
+      // Promotion codes cannot be deleted; delete deactivates them. Inactive
+      // rows are effectively deleted and must not re-enter nuke.
+      const items = yield* listByActive(true);
       return items
         .filter((item) => tagRecord(item.metadata)[alchemyMetadataKeys.stack] !== undefined)
         .map(toAttrs);

package/src/Stripe/RestrictedApiKey.ts

@@ -186,14 +186,13 @@ export const RestrictedApiKeyProvider = () =>
       // key's scopes, persist the returned `rk_…` as `value`, and teach
       // list/delete to enumerate/revoke it. Until then this is a logical
       // token: Dashboard `news.value` or the account secret.
+      const resolveAccountApiKey = Effect.gen(function* () {
+        const resolve = yield* Credentials;
+        const cfg = yield* resolve;
+        return cfg.apiKey.pipe(Redacted.value, Redacted.make);
+      });
       const value =
-        props.value !== undefined
-          ? Redacted.make(props.value)
-          : yield* Effect.gen(function* () {
-              const resolve = yield* Credentials;
-              const cfg = yield* resolve;
-              return Redacted.make(Redacted.value(cfg.apiKey));
-            });
+        props.value !== undefined ? Redacted.make(props.value) : yield* resolveAccountApiKey;
       return {
         id: output?.id ?? name,
         name,

package/src/Stripe/StripeHttp.ts

@@ -115,6 +115,7 @@ export const asStringEffect = (value: unknown): Effect.Effect<Effect.Effect<stri
     return value.asEffect() as Effect.Effect<Effect.Effect<string>>;
   }
   if (Effect.isEffect(value)) {
+    // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- resource id Effects resolve without requirements
     return Effect.succeed(value as Effect.Effect<string>);
   }
   return Effect.die("Stripe binding expected a resolved resource id");

package/src/Stripe/WebhookEndpoint.ts

@@ -185,7 +185,7 @@ const redactSecret = (
   // SDK-wrapped Redacted is not readable via alchemy's WeakMap. Unwrap
   // with distilled first, then wrap with ours so state encoding works.
   try {
-    return Redacted.make(Redacted.value(secret));
+    return secret.pipe(Redacted.value, Redacted.make);
   } catch {
     const unwrapped = unwrapRedactedDeep(secret);
     return typeof unwrapped === "string" ? Redacted.make(unwrapped) : undefined;

package/src/Telemetry/Attributes.ts

@@ -66,7 +66,7 @@ const getOrCreateUserId: Effect.Effect<string> = Effect.gen(function* () {
       await fs.writeFile(idPath(), id);
     },
     catch: () => null as never,
-  }).pipe(Effect.catch(() => Effect.void));
+  }).pipe(Effect.ignore);
   return id;
 });
 

package/src/TelemetryRuntime.ts

@@ -1,4 +1,4 @@
-import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
 import type * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -9,6 +9,7 @@ import * as OtlpLogger from "effect/observability/OtlpLogger";
 import * as OtlpMetrics from "effect/observability/OtlpMetrics";
 import * as OtlpSerialization from "effect/observability/OtlpSerialization";
 import * as OtlpTracer from "effect/observability/OtlpTracer";
+import * as Predicate from "effect/Predicate";
 import * as Redacted from "effect/Redacted";
 import * as Result from "effect/Result";
 import type * as Scope from "effect/Scope";
@@ -31,10 +32,15 @@ export type TelemetryLayer = Layer.Layer<never, any, any>;
  * Redacted marker, and a raw string set directly in the environment).
  */
 const readBoundValue = (key: string): Effect.Effect<unknown> =>
-  Config.String(key).pipe(
-    Config.withDefault(undefined),
-    Effect.orElseSucceed(() => undefined),
-    Effect.map((raw) => {
+  Effect.flatMap(ConfigProvider.ConfigProvider, (provider) => provider.load([key])).pipe(
+    // Missing optional bindings are normal on every event. Read their scalar
+    // directly instead of constructing a Config/Schema error for each absence.
+    Effect.orDie,
+    Effect.catchDefect((defect) =>
+      Predicate.isTagged(defect, "SourceError") ? Effect.succeed(undefined) : Effect.die(defect),
+    ),
+    Effect.map((node) => {
+      const raw = node?.value;
       if (raw === undefined || raw === "") {
         return undefined;
       }
@@ -141,10 +147,9 @@ export const EXPORTERS_KEY = "ALCHEMY_OTEL_EXPORTERS";
  * forms an *implicit extra destination*, so platform-injected OTLP config
  * exports without any layer.
  */
-const signalConfig = (signal: "TRACES" | "LOGS" | "METRICS") =>
+const signalConfig = (signal: "TRACES" | "LOGS" | "METRICS", base: string | undefined) =>
   Effect.gen(function* () {
     const specific = yield* readBound(`OTEL_EXPORTER_OTLP_${signal}_ENDPOINT`);
-    const base = yield* readBound("OTEL_EXPORTER_OTLP_ENDPOINT");
     const url =
       specific !== undefined && specific !== ""
         ? specific
@@ -245,10 +250,13 @@ const makeExporterLayer = (options?: {
           ? yield* Effect.try(() => JSON.parse(rawList) as ResolvedDestination[])
           : [];
       // The standard OTEL_* env vars form an implicit extra destination.
+      // Resolve the shared endpoint once per event; custom providers can change
+      // between events, so no configuration or exporters are cached here.
+      const baseEndpoint = yield* readBound("OTEL_EXPORTER_OTLP_ENDPOINT");
       const [stdTraces, stdLogs, stdMetrics] = yield* Effect.all([
-        signalConfig("TRACES"),
-        signalConfig("LOGS"),
-        signalConfig("METRICS"),
+        signalConfig("TRACES", baseEndpoint),
+        signalConfig("LOGS", baseEndpoint),
+        signalConfig("METRICS", baseEndpoint),
       ]);
       const destinations: ResolvedDestination[] = [
         ...bound,
@@ -300,7 +308,12 @@ const makeExporterLayer = (options?: {
             resource,
             exportInterval: options?.exportInterval,
             shutdownTimeout: options?.shutdownTimeout,
-          }),
+          }).pipe(
+            // Metrics go out as protobuf: OTLP/HTTP receivers must accept
+            // it, while JSON is optional and some reject it on /v1/metrics
+            // (Axiom answers 415 Unsupported Media Type).
+            Layer.provide(OtlpSerialization.layerProtobuf),
+          ),
         );
       }
       return Layer.mergeAll(...(layers as [Layer.Layer<never>])).pipe(
@@ -319,9 +332,10 @@ const makeExporterLayer = (options?: {
 /**
  * The runtime half of the {@link layerOtlp} binding, and the default
  * per-event Layer: reads the bound `OTEL_EXPORTER_OTLP_*` values back and
- * constructs the OTLP JSON exporters. Each signal resolves independently;
+ * constructs the OTLP exporters (JSON for traces and logs, protobuf for
+ * metrics). Each signal resolves independently;
  * only configured signals export; resolves to `Layer.empty` when nothing is
- * bound, so telemetry is free until a layer is provided.
+ * bound, so no exporters are built until a destination is configured.
  *
  * The periodic export intervals are effectively disabled: the exporter is
  * built per event and the request-scope flush delivers everything. An

package/src/Test/Alchemy.ts

@@ -22,6 +22,7 @@ import {
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Scope from "effect/Scope";
+import * as Semaphore from "effect/Semaphore";
 import type { AlchemyContext } from "../AlchemyContext.ts";
 import type { CompiledStack } from "../Stack.ts";
 import type { Stage } from "../Stage.ts";
@@ -170,6 +171,26 @@ export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
   test.only = (name, eff, opts) => addTest(name, eff, opts, "only");
   test.todo = (name, eff, opts) => addTest(name, eff, opts, "todo");
 
+  // One lock per scratch stack. When an attempt times out, the runner fires
+  // an interrupt and ABANDONS the attempt's fiber after a short grace — but
+  // the fiber keeps running its teardown (`scratch.destroy()` below) in the
+  // background, e.g. a CloudFront disable-wait. Without this lock the retry
+  // starts concurrently on the SAME scratch state: the stale teardown then
+  // deletes the state rows the retry just wrote for the same logical ids,
+  // orphaning the retry's cloud resources (observed: two leaked CloudFront
+  // distributions + buckets + OACs from one retried test). Holding the lock
+  // across body + teardown makes a retry wait (on its own timeout clock)
+  // until the previous attempt's teardown has fully settled.
+  const scratchLocks = new Map<string, Semaphore.Semaphore>();
+  const scratchLock = (name: string) => {
+    let lock = scratchLocks.get(name);
+    if (lock === undefined) {
+      lock = Semaphore.makeUnsafe(1);
+      scratchLocks.set(name, lock);
+    }
+    return lock;
+  };
+
   const wrapProvider = (
     name: string,
     fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
@@ -192,6 +213,7 @@ export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
     // runs the finalizer on success, failure, AND interruption.
     const body = Core.withProviders(fn(scratch), options, scratch.name).pipe(
       Effect.ensuring(scratch.destroy().pipe(Effect.ignore)),
+      scratchLock(scratch.name).withPermits(1),
     );
     return Core.toEffect(body, { ...options, state: scratch.state }, sharedScope, sidecar);
   };

package/src/Test/Core.ts

@@ -372,7 +372,7 @@ export const toEffect = <A, ROut = any>(
         : body;
     return yield* locally.pipe(
       provideFreshArtifactStore,
-      Effect.provide(Layer.succeed(ConfigProvider, configProvider)),
+      Effect.provideService(ConfigProvider, configProvider),
       Effect.provideService(StackConfigOverrides, { profile: options.profile }),
     );
   }).pipe(
@@ -420,6 +420,7 @@ export const withProviders = <A, E, R, ROut>(
       ? Effect.provide(effect, flociServices())
       : effect;
   const stage = resolveStage(options);
+  // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- providers layer is typed `any`; requirements are satisfied by it
   return body.pipe(
     Effect.provide(
       (options.providers as Layer.Layer<any, never, any>).pipe(
@@ -628,7 +629,8 @@ export const scratchStack = <ROut>(
   // Effect's closest-layer precedence selects Floci for Action data-plane calls.
   const pinToFloci = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
     Option.getOrElse(alchemyTestDevOverride(), () => false)
-      ? (Effect.provide(effect, flociServices()) as Effect.Effect<A, E, R>)
+      ? // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- flociServices overrides services already present in R
+        (Effect.provide(effect, flociServices()) as Effect.Effect<A, E, R>)
       : effect;
 
   const buildAndApply = (
@@ -644,7 +646,7 @@ export const scratchStack = <ROut>(
           Effect.provide(compiled.services),
         ),
       ),
-      Effect.provide(Layer.succeed(Stage, stage)),
+      Effect.provideService(Stage, stage),
       provideFreshArtifactStore,
     );
 
@@ -657,7 +659,7 @@ export const scratchStack = <ROut>(
       Effect.flatMap((compiled: any) =>
         pinToFloci(Plan.make(compiled, planOptions ?? {})).pipe(Effect.provide(compiled.services)),
       ),
-      Effect.provide(Layer.succeed(Stage, stage)),
+      Effect.provideService(Stage, stage),
       provideFreshArtifactStore,
     );
 

package/src/Test/Vitest.ts

@@ -132,7 +132,7 @@ export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
     }
   };
   test.only = (name, eff, opts) => {
-    it.only(name, () => wrap(eff) as Effect.Effect<any>, timeoutOf(opts));
+    it.live.only(name, () => wrap(eff), timeoutOf(opts));
   };
   test.todo = (name, _eff, _opts) => {
     it.todo(name);

package/src/Turso/ApiToken.ts

@@ -0,0 +1,197 @@
+import * as turso from "@distilled.cloud/turso/turso";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Unowned } from "../AdoptPolicy.ts";
+import { deepEqual, isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { organization } from "./Credentials.ts";
+import type { Providers } from "./Providers.ts";
+
+/**
+ * A permission granted to a group-scoped API token. `read-only` and
+ * `full-access` are presets that expand to individual scopes.
+ */
+export type ApiTokenScope =
+  | "read"
+  | "db:create"
+  | "db:delete"
+  | "db:configure"
+  | "db:mint-token"
+  | "db:rotate-creds"
+  | "group:configure"
+  | "group:mint-token"
+  | "group:rotate-creds"
+  | "read-only"
+  | "full-access";
+
+export interface ApiTokenProps {
+  /**
+   * Token name, unique within your account. If omitted, a unique name is
+   * generated from the stack, stage, and logical ID.
+   */
+  name?: string;
+  /**
+   * Restrict the token to one group of the organization (e.g.
+   * `group.name`). Requires `scopes`. Omit for an organization-scoped token.
+   */
+  group?: string;
+  /**
+   * Permissions of a group-scoped token. Required (and non-empty) when
+   * `group` is set. `db:mint-token` issues new SQL tokens;
+   * `db:rotate-creds` invalidates every SQL token of a database.
+   */
+  scopes?: ApiTokenScope[];
+}
+
+export interface ApiTokenAttributes {
+  /** Token ID. */
+  id: string;
+  /** Token name. */
+  name: string;
+  /** The organization slug the token is restricted to. */
+  organization: string;
+  /** The group the token is restricted to, if group-scoped. */
+  group: string | undefined;
+  /** The expanded scopes of a group-scoped token. */
+  scopes: string[];
+  /** The Platform API token, sent as `Authorization: Bearer <token>`. */
+  token: Redacted.Redacted<string>;
+}
+
+export type ApiToken = Resource<
+  "Turso.ApiToken",
+  ApiTokenProps,
+  ApiTokenAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A Turso API token. It lets an app create and delete groups and databases.
+ * To run SQL, use a {@link DatabaseToken} instead. Limit it to one group
+ * with `group` and `scopes` to give an app only the access it needs.
+ *
+ * Turso only shows the token once, when it's created, so Alchemy stores it
+ * in state as a `Redacted` value. Changing a prop creates a new token, and
+ * destroying it cancels the token.
+ * @see https://docs.turso.tech/api-reference/tokens/create
+ *
+ * ### Creating a Token
+ * **Example:** Token for the whole organization
+ * ```typescript
+ * const token = yield* Turso.ApiToken("Ci", {});
+ * ```
+ *
+ * **Example:** Token that can only create databases in one group
+ * ```typescript
+ * const token = yield* Turso.ApiToken("Tenants", {
+ *   group: group.name,
+ *   scopes: ["read", "db:create", "db:delete", "db:mint-token"],
+ * });
+ * ```
+ *
+ * @resource
+ * @product API Token
+ */
+export const ApiToken = Resource<ApiToken>("Turso.ApiToken");
+
+const tokenName = (id: string, name: string | undefined) =>
+  name ? Effect.succeed(name) : createPhysicalName({ id, maxLength: 64, delimiter: "-" });
+
+export const ApiTokenProvider = () =>
+  Provider.effect(
+    ApiToken,
+    Effect.gen(function* () {
+      const observe = (name: string) =>
+        turso
+          .listAPITokens({})
+          .pipe(Effect.map(({ tokens }) => (tokens ?? []).find((t) => t.name === name)));
+
+      const revoke = (name: string) =>
+        turso.revokeAPIToken({ tokenName: name }).pipe(
+          Effect.asVoid,
+          Effect.catchTag("NotFound", () => Effect.void),
+        );
+
+      return {
+        stables: ["id", "name", "organization", "group", "scopes", "token"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const name = output?.name ?? (yield* tokenName(id, olds?.name));
+          // Turso tokens are immutable: any change mints a new one.
+          if (
+            (news.name !== undefined && news.name !== name) ||
+            news.group !== olds?.group ||
+            !deepEqual(news.scopes ?? [], olds?.scopes ?? [])
+          ) {
+            // A pinned name can't be held by two tokens at once.
+            return {
+              action: "replace",
+              deleteFirst: news.name !== undefined && news.name === name,
+            } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name = output?.name ?? (yield* tokenName(id, olds?.name));
+          const observed = yield* observe(name);
+          if (!observed) return undefined;
+          if (output !== undefined && output.id === observed.id) return output;
+          // The secret is only revealed at creation, so a token we have no
+          // state for can't be adopted with its value — reconcile re-mints.
+          return Unowned({
+            id: observed.id ?? "",
+            name,
+            organization: observed.organization ?? "",
+            group: observed.group,
+            scopes: observed.scopes ?? [],
+            token: Redacted.make(""),
+          });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const org = output?.organization ?? (yield* organization);
+          const name = output?.name ?? (yield* tokenName(id, news.name));
+
+          // Observe
+          const observed = yield* observe(name);
+          if (
+            observed &&
+            output &&
+            Redacted.value(output.token) !== "" &&
+            output.id === observed.id
+          ) {
+            return output;
+          }
+
+          // Ensure — a token we hold no secret for (a lost create, or an
+          // adoption) is revoked and re-minted.
+          if (observed) {
+            yield* session.note(`Re-minting API token ${name}...`);
+            yield* revoke(name);
+          }
+          const created = yield* turso.createAPIToken({
+            tokenName: name,
+            organization: org,
+            group: news.group,
+            scopes: news.scopes,
+          });
+          if (!created.token || !created.id) {
+            return yield* Effect.fail(new Error(`Turso returned no token for ${name}`));
+          }
+          const minted = yield* observe(name);
+          return {
+            id: created.id,
+            name,
+            organization: minted?.organization ?? org,
+            group: minted?.group ?? news.group,
+            scopes: minted?.scopes ?? [],
+            token: created.token,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* revoke(output.name);
+        }),
+      };
+    }),
+  );