alchemy 2.0.0-beta.75 → 2.0.0-beta.77

package/src/Auth/Demand.ts

@@ -6,17 +6,29 @@
  * out of local emulation via `Alchemy.remote()`, a local Worker binding
  * that proxies to a remote resource (`dev: { remote: true }`), or the
  * deletion of a row that was last reconciled live — credentials are
- * demanded exactly once, up front, in the exec process (which owns the
- * tty), BEFORE apply begins:
+ * validated up front, BEFORE apply begins: the gate resolves each demanded
+ * provider's credentials through the same precedence the run will use. The
+ * seam never starts a login flow: missing credentials fail with the typed
+ * {@link CredentialsRequired} error naming the demanding resources and
+ * pointing at `alchemy profile edit` — the profile command is the only
+ * place logins happen.
  *
- *   - interactive: the provider's existing `configure` flow runs, prefixed
- *     with a human-readable reason naming the demanding resources
- *     (threaded via {@link ConfigureContext}'s `reason`).
- *   - non-interactive: fail with the typed {@link CredentialsRequired}
- *     error naming the demanding resources and pointing at `alchemy login`.
+ * How deep the up-front resolution goes is PROVIDER-DEPENDENT — it runs
+ * the provider's `read`, no more:
  *
- * The RPC sidecar never prompts — its stdio is piped and it only ever
- * reads credentials persisted by this seam (or a prior `alchemy login`).
+ * - Cloudflare's `read` eagerly checks OAuth expiry, silently refreshes,
+ *   and persists under the profile lock — so a dead refresh token fails
+ *   here as a typed `NeedsReauth`, and child processes (which only ever
+ *   read what a parent persisted) start with a warm token.
+ * - AWS's `read` returns a credentials RECIPE whose inner effect stays
+ *   unevaluated (SSO tokens are loaded lazily by consumers), so an
+ *   expired SSO token passes the gate and still surfaces mid-run. Local-mode
+ *   AWS providers carry a floci-scoped environment of their own (see
+ *   `AWS/Local/FlociServices.ts`) and ensure the emulator there.
+ *
+ * The demand scan keys on provider MODE, not plan action — noop live rows
+ * still demand (their runtime proxies need live credentials to serve), so
+ * a watch restart re-runs this resolution even for an unchanged plan.
  *
  * Non-dev runs (`alchemy deploy` / `destroy`) never enter this seam:
  * state-store init and live providers drive the pre-existing lazy
@@ -26,10 +38,23 @@ import * as Config from "effect/Config";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
 import type { BindingNode, Plan } from "../Plan.ts";
-import { isNonInteractive } from "../Util/interactive.ts";
-import { AuthProviders, type ConfigureContext } from "./AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "./Profile.ts";
+import { profileCommandHint } from "../Util/interactive.ts";
+import {
+  AuthError,
+  AuthProviders,
+  NeedsReauth,
+  presentEnvironment,
+} from "./AuthProvider.ts";
+import {
+  ALCHEMY_PROFILE,
+  DEFAULT_PROFILE_NAME,
+  ProfileStore,
+  SuppressMissingProviderConfig,
+} from "./Profile.ts";
+import { resolveProviderConfig } from "./Resolve.ts";
 
 /** Why a plan row demands live (cloud) credentials during a dev run. */
 export type CredentialDemandReason =
@@ -58,9 +83,9 @@ export interface CredentialDemand {
 }
 
 /**
- * A dev-mode plan needs cloud credentials, none are configured for the
- * active profile, and the process is non-interactive so the configure flow
- * cannot run. The message names the demanding resources and the fix.
+ * A dev-mode plan needs cloud credentials and none are configured for the
+ * active profile. The message names the demanding resources and the exact
+ * `alchemy profile edit` invocation that fixes it.
  */
 export class CredentialsRequired extends Data.TaggedError(
   "CredentialsRequired",
@@ -100,28 +125,34 @@ const resourceLines = (demand: CredentialDemand): string =>
 export const credentialsRequired = (
   demand: CredentialDemand,
   profileName: string,
-): CredentialsRequired =>
-  new CredentialsRequired({
-    provider: demand.provider,
-    resources: demand.resources.map((r) => r.fqn),
-    reason: [...new Set(demand.resources.map((r) => r.reason))].join(", "),
-    message:
-      `${demand.provider} credentials are required, but none are configured ` +
-      `for profile '${profileName}' and this process is non-interactive so ` +
-      "they can't be configured now.\n" +
-      `These resources require ${demand.provider} credentials:\n` +
-      `${resourceLines(demand)}\n` +
-      `Run \`alchemy login --profile ${profileName}\` to configure ` +
-      "credentials, or set CI=1 to use environment-variable credentials.",
+): Effect.Effect<never, CredentialsRequired> =>
+  Effect.gen(function* () {
+    const command = yield* profileCommandHint(
+      `alchemy profile edit --profile ${profileName} --add ${demand.provider}`,
+    );
+    return yield* new CredentialsRequired({
+      provider: demand.provider,
+      resources: demand.resources.map((r) => r.fqn),
+      reason: [...new Set(demand.resources.map((r) => r.reason))].join(", "),
+      message:
+        `${demand.provider} credentials are required, but none are configured ` +
+        `for profile '${profileName}'.\n` +
+        `These resources require ${demand.provider} credentials:\n` +
+        `${resourceLines(demand)}\n` +
+        `Run \`${command}\` to configure ` +
+        "credentials, or set CI=1 to use environment-variable credentials.",
+    });
   });
 
 /**
- * The human-readable reason shown at the top of an interactive configure
- * flow triggered by this seam (threaded via {@link ConfigureContext}).
+ * The slice of binding data the demand scan cares about: local runtimes
+ * mark cloud-proxied bindings with a truthy `devRemote` entry.
  */
-const demandBanner = (demand: CredentialDemand): string =>
-  `This dev session requires ${demand.provider} credentials:\n` +
-  resourceLines(demand);
+const RemoteBindingData = Schema.Struct({
+  devRemote: Schema.optional(Schema.Record(Schema.String, Schema.Boolean)),
+});
+
+const decodeRemoteBindingData = Schema.decodeUnknownResult(RemoteBindingData);
 
 const bindingDemandsRemote = (
   bindings: readonly BindingNode[] | undefined,
@@ -130,16 +161,12 @@ const bindingDemandsRemote = (
     // A binding being REMOVED needs no runtime proxy — the restarted
     // local instance simply no longer carries it.
     if (binding.action === "delete") return false;
-    const data = binding.data as
-      | { devRemote?: Record<string, boolean> }
-      | null
-      | undefined;
+    const data = decodeRemoteBindingData(binding.data);
     return (
-      data != null &&
-      typeof data === "object" &&
-      data.devRemote != null &&
-      typeof data.devRemote === "object" &&
-      Object.values(data.devRemote).some((remote) => remote === true)
+      Result.isSuccess(data) &&
+      Object.values(data.success.devRemote ?? {}).some(
+        (remote) => remote === true,
+      )
     );
   });
 
@@ -194,67 +221,165 @@ export const collectCredentialDemands = (plan: Plan): CredentialDemand[] => {
   }));
 };
 
-export interface DemandCredentialsOptions {
-  /**
-   * Overrides {@link isNonInteractive} — a test seam. When `true`, a
-   * missing profile fails with {@link CredentialsRequired} instead of
-   * driving the interactive configure flow.
-   */
-  readonly nonInteractive?: boolean;
-}
+/**
+ * Re-fail a warm-up resolution error with the demand attached, so the user
+ * sees WHY a dev run wanted cloud credentials. Tags are preserved —
+ * consumers match `NeedsReauth`/`AuthError` by tag, never by message.
+ */
+const attachDemandContext =
+  (demand: CredentialDemand) =>
+  <A, R>(
+    self: Effect.Effect<A, AuthError | NeedsReauth, R>,
+  ): Effect.Effect<A, AuthError | NeedsReauth, R> =>
+    self.pipe(
+      Effect.mapError((error) => {
+        const message =
+          `${error.message}\n` +
+          `These resources require ${demand.provider} credentials:\n` +
+          resourceLines(demand);
+        return error._tag === "NeedsReauth"
+          ? new NeedsReauth({
+              provider: error.provider,
+              profile: error.profile,
+              message,
+              cause: error.cause,
+            })
+          : new AuthError({ message, cause: error.cause });
+      }),
+    );
 
 /**
- * Ensure credentials exist for every demand, prompting at most once per
- * provider and only when nothing is configured yet:
+ * Validate credentials for every demand. Never starts a login flow —
+ * logging in belongs to `alchemy profile edit` exclusively:
  *
- *   - already configured for the active profile → no-op (never re-prompts)
- *   - missing + interactive → the provider's `configure` flow runs (via
- *     `AlchemyProfile.loadOrConfigure`), prefixed with a reason naming the
- *     demanding resources
- *   - missing + non-interactive (and not CI) → typed
- *     {@link CredentialsRequired} failure
- *   - CI → `loadOrConfigure` picks the provider's non-interactive default
- *     (env-var credentials), matching every other CI path
+ *   - configured for the active profile → resolve the credentials through
+ *     the exact precedence the run will use ({@link resolveProviderConfig}:
+ *     CI environment, explicit env vars, then the profile). Resolution
+ *     runs the provider's `read` — how much that validates and warms is
+ *     provider-dependent (see the module header): Cloudflare eagerly
+ *     refreshes and persists so a dead refresh token fails HERE as a
+ *     typed {@link NeedsReauth} naming the demanding resources, while
+ *     AWS's lazy credential recipe defers SSO-token failures to mid-run.
+ *   - missing → typed {@link CredentialsRequired} failure with the exact
+ *     `alchemy profile edit` invocation to run
+ *   - CI → validates the provider's environment credentials directly,
+ *     matching every other CI path without creating profile state
  *
  * Demands whose cloud has no registered auth provider are skipped (bare
  * engine runs with test providers demand nothing). All context is
- * resolved optionally, so the effect is safe to run in any environment.
+ * resolved optionally, so the effect is safe to run in any environment —
+ * and a plan with zero demand touches no credentials at all.
  */
 export const demandCredentials = Effect.fn("Alchemy.demandCredentials")(
-  function* (
-    demands: readonly CredentialDemand[],
-    options?: DemandCredentialsOptions,
-  ) {
+  function* (demands: readonly CredentialDemand[]) {
     if (demands.length === 0) return;
     const registry = Option.getOrUndefined(
       yield* Effect.serviceOption(AuthProviders),
     );
     const profile = Option.getOrUndefined(
-      yield* Effect.serviceOption(AlchemyProfile),
+      yield* Effect.serviceOption(ProfileStore),
     );
     if (registry === undefined || profile === undefined) return;
-    const profileName = yield* ALCHEMY_PROFILE;
     const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-    const nonInteractive = options?.nonInteractive ?? isNonInteractive();
-    for (const demand of demands) {
-      const auth = registry[demand.provider];
-      if (auth == null) continue;
-      const existing = yield* profile.getProfile(profileName);
-      if (existing?.[auth.name] != null) continue;
-      if (!ci && nonInteractive) {
-        return yield* credentialsRequired(demand, profileName);
-      }
-      const ctx: ConfigureContext = { ci, reason: demandBanner(demand) };
-      yield* profile.loadOrConfigure(auth, profileName, ctx);
-    }
+    // CI credentials come exclusively from the environment. Do not require
+    // or inspect a local profile first: CI runners intentionally have no
+    // profile manifest, and doing so would also risk consulting a developer's
+    // stored profiles when this path is exercised locally under Doppler.
+    const configuredProfile = yield* Config.option(ALCHEMY_PROFILE);
+    const profileName = Option.getOrElse(
+      configuredProfile,
+      () => DEFAULT_PROFILE_NAME,
+    );
+    yield* Effect.forEach(
+      demands,
+      (demand) =>
+        Effect.gen(function* () {
+          const auth = registry[demand.provider];
+          if (auth == null) return;
+          if (ci) {
+            if (auth.readEnvironment === undefined) {
+              return yield* credentialsRequired(demand, profileName);
+            }
+            return yield* auth.readEnvironment.pipe(
+              attachDemandContext(demand),
+            );
+          }
+          // Read-only precheck of the two non-CI configuration sources the
+          // resolution precedence below consults: environment credentials
+          // (which win regardless of the selected profile), or a profile
+          // entry. "Nothing configured" fails with the actionable
+          // {@link CredentialsRequired} here, WITHOUT entering
+          // `resolveProviderConfig`: its profile path goes through
+          // `ensureProfile`, which fails a nonexistent profile with a
+          // generic ProfileError that would bury which resources demanded
+          // credentials and what command fixes it.
+          const envUsable =
+            auth.readEnvironment !== undefined &&
+            (yield* presentEnvironment(auth.environment)) !== undefined;
+          const existing = yield* profile.getProfile(profileName);
+          if (existing?.providers[auth.name] == null && !envUsable) {
+            return yield* credentialsRequired(demand, profileName);
+          }
+          // Something IS configured — resolve through the same precedence
+          // the run's lazy credential flow uses, so the gate can never
+          // pass something resolution would later reject (or vice versa).
+          // Suppressed missing-config mode turns a check/resolve race into
+          // the typed tag below instead of a generic AuthError; it also
+          // mutes the env-credentials warning here — the run's own
+          // resolution still emits it.
+          const resolved = yield* resolveProviderConfig(demand.provider).pipe(
+            Effect.provideService(AuthProviders, registry),
+            Effect.provideService(ProfileStore, profile),
+            Effect.provideService(SuppressMissingProviderConfig, true),
+            Effect.catchTag("MissingProviderConfig", () =>
+              credentialsRequired(demand, profileName),
+            ),
+            Effect.catchTag(
+              "ProfileError",
+              (error) =>
+                new AuthError({ message: error.message, cause: error }),
+            ),
+          );
+          yield* resolved.resolve.pipe(attachDemandContext(demand));
+        }),
+      { concurrency: 4, discard: true },
+    );
   },
 );
 
+/**
+ * Plan-time seam for `Alchemy.remote()` rows. The planner probes every new
+ * resource with its provider's `read` (engine-level adoption) — for a
+ * live-mode row in a dev run that is a real cloud call, made BEFORE
+ * {@link demandPlanCredentials} could run in apply. Demanding here first
+ * turns "nothing configured" into the typed {@link CredentialsRequired}
+ * (naming the rows and the exact `alchemy profile edit` command) instead
+ * of whatever raw error the first credential-less read produces. Bindings
+ * and live deletions are still gated in apply — nothing reads for them
+ * during plan.
+ */
+export const demandRemoteCredentials = (
+  resources: ReadonlyArray<{ readonly Type: string; readonly FQN: string }>,
+) => {
+  const byProvider = new Map<string, DemandingResource[]>();
+  for (const resource of resources) {
+    const provider = cloudOf(resource.Type);
+    byProvider.set(provider, [
+      ...(byProvider.get(provider) ?? []),
+      { fqn: resource.FQN, reason: "remote" },
+    ]);
+  }
+  return demandCredentials(
+    [...byProvider.entries()].map(([provider, resources]) => ({
+      provider,
+      resources,
+    })),
+  );
+};
+
 /**
  * The one-call seam wired into the dev path: scan the plan for live
  * demand and, if any, run {@link demandCredentials} BEFORE apply begins.
  */
-export const demandPlanCredentials = (
-  plan: Plan,
-  options?: DemandCredentialsOptions,
-) => demandCredentials(collectCredentialDemands(plan), options);
+export const demandPlanCredentials = (plan: Plan) =>
+  demandCredentials(collectCredentialDemands(plan));

package/src/Auth/Env.ts

@@ -1,37 +1,61 @@
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
-import * as Clank from "../Util/Clank.ts";
+import * as Option from "effect/Option";
+import * as Interaction from "../Interaction.ts";
 import { AuthError } from "./AuthProvider.ts";
 
 export const getEnv = (key: string) =>
-  Config.string(key).pipe(Effect.orElseSucceed(() => undefined));
+  Config.option(Config.string(key)).pipe(
+    Effect.map(Option.getOrUndefined),
+    Effect.mapError(
+      (cause) =>
+        new AuthError({
+          message: `Could not read optional env: ${key}`,
+          cause,
+        }),
+    ),
+  );
 
 export const getEnvRequired = (key: string) =>
   Config.string(key).pipe(
-    Effect.catch(() =>
-      Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
+    Effect.mapError(
+      (cause) =>
+        new AuthError({ message: `Missing required env: ${key}`, cause }),
     ),
   );
 
 export const getEnvRedacted = (key: string) =>
-  Config.redacted(key).pipe(Effect.orElseSucceed(() => undefined));
+  Config.option(Config.redacted(key)).pipe(
+    Effect.map(Option.getOrUndefined),
+    Effect.mapError(
+      (cause) =>
+        new AuthError({
+          message: `Could not read optional env: ${key}`,
+          cause,
+        }),
+    ),
+  );
 
 export const getEnvRedactedRequired = (key: string) =>
   Config.redacted(key).pipe(
-    Effect.catch(() =>
-      Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
+    Effect.mapError(
+      (cause) =>
+        new AuthError({ message: `Missing required env: ${key}`, cause }),
     ),
   );
 
-export const retryOnce = <A, R>(
-  self: Effect.Effect<A, Clank.PromptCancelled, R>,
+export const mapPromptCancellation = <A, R>(
+  self: Effect.Effect<A, Interaction.InteractionError, R>,
 ) =>
   self.pipe(
-    Effect.retry({
-      times: 1,
-      while: (e) => e instanceof Clank.PromptCancelled,
-    }),
     Effect.mapError(
-      (e) => new AuthError({ message: "User cancelled prompt", cause: e }),
+      (cause) =>
+        new AuthError({
+          message:
+            cause._tag === "TerminalCancelled"
+              ? "User cancelled prompt"
+              : cause.message,
+          cause,
+        }),
     ),
   );

package/src/Auth/Inspect.ts

@@ -0,0 +1,129 @@
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Result from "effect/Result";
+import {
+  type AuthError,
+  reconfigureHint,
+  type AuthProviders,
+  type ProviderDetailLine,
+} from "./AuthProvider.ts";
+import type { ProviderConfig } from "./Profile.ts";
+
+/**
+ * What a connected provider looks like right now. Establishing this means
+ * decoding the stored config and asking the provider to describe itself,
+ * either of which can fail — which is the point: a profile listing has to
+ * show a broken connection rather than fail because of one.
+ */
+export interface ProviderConnection {
+  readonly name: string;
+  /** How credentials were supplied (`oauth`, `api-token`, …). */
+  readonly method: string;
+  readonly status:
+    | "connected"
+    | "needs-reauth"
+    | "needs-reconfigure"
+    | "invalid"
+    | "unavailable";
+  readonly details: ReadonlyArray<ProviderDetailLine>;
+  /** Present whenever `status` is anything but `connected`. */
+  readonly diagnostic?: {
+    readonly severity: "warning" | "error";
+    readonly code: string;
+    readonly message: string;
+  };
+}
+
+const broken = (
+  name: string,
+  method: string,
+  severity: "warning" | "error",
+  code: string,
+  message: string,
+): ProviderConnection => ({
+  name,
+  method,
+  status: severity === "warning" ? "needs-reauth" : "invalid",
+  details: [],
+  diagnostic: { severity, code, message },
+});
+
+/**
+ * Resolve one stored provider's live connection status. Never fails: every
+ * way this can go wrong is reported as a `status` + `diagnostic` so a listing
+ * can show the whole profile.
+ */
+export const inspectProvider = Effect.fn("inspectProvider")(function* (
+  profile: string,
+  name: string,
+  config: ProviderConfig,
+  registered: AuthProviders["Service"],
+  updateConfig?: (config: ProviderConfig) => Effect.Effect<void, AuthError>,
+) {
+  const method = config.method ?? "unknown";
+  const provider = registered[name];
+  if (provider === undefined) {
+    return {
+      name,
+      method,
+      status: "unavailable",
+      details: [],
+      diagnostic: {
+        severity: "warning",
+        code: "provider.unregistered",
+        message: `Provider '${name}' is not registered.`,
+      },
+    } satisfies ProviderConnection;
+  }
+
+  // A deliberately empty migrated document records that the provider was
+  // connected in v0 while making no claim that its obsolete credentials are
+  // usable. Keep that distinct from malformed provider-owned values.
+  if (config.method === undefined) {
+    return {
+      name,
+      method,
+      status: "needs-reconfigure",
+      details: [],
+      diagnostic: {
+        severity: "warning",
+        code: "provider.needs-reconfigure",
+        message: `Provider '${name}' needs to be reconfigured. ${reconfigureHint(name, profile)}`,
+      },
+    } satisfies ProviderConnection;
+  }
+
+  const decoded = yield* Effect.result(provider.decodeConfig(profile, config));
+  if (Result.isFailure(decoded)) {
+    return broken(
+      name,
+      method,
+      "error",
+      "provider.invalid-config",
+      decoded.failure.message,
+    );
+  }
+
+  const details = yield* Effect.result(
+    provider.details(profile, decoded.success, updateConfig),
+  );
+  if (Result.isSuccess(details)) {
+    return {
+      name,
+      method,
+      status: "connected",
+      details: details.success.lines,
+    } satisfies ProviderConnection;
+  }
+
+  // A provider that can no longer prove who it is has expired credentials,
+  // which the user can fix by re-authenticating — not a broken config.
+  const needsReauth = Predicate.isTagged("NeedsReauth")(details.failure);
+  return broken(
+    name,
+    method,
+    needsReauth ? "warning" : "error",
+    needsReauth ? "provider.needs-reauth" : "provider.details-failed",
+    details.failure.message,
+  );
+});

package/src/Auth/Lock.ts

@@ -8,7 +8,7 @@ import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Schedule from "effect/Schedule";
 import * as Semaphore from "effect/Semaphore";
-import { rootDir } from "./Profile.ts";
+import { rootDir } from "./Paths.ts";
 
 const semaphores = new Map<string, Semaphore.Semaphore>();
 
@@ -153,18 +153,26 @@ const stallNotice = (
   phase: Phase,
   interval: Duration.Input,
 ) =>
-  Effect.suspend(() => {
-    let seconds = 0;
-    return Effect.suspend(() => {
-      seconds += Duration.toSeconds(interval);
-      return Console.error(
+  Effect.gen(function* () {
+    const start = yield* Clock.currentTimeMillis;
+    const notice = Effect.gen(function* () {
+      // Report real elapsed time, not an accumulated interval count — the
+      // notice cadence and the reported wait must not drift apart.
+      const now = yield* Clock.currentTimeMillis;
+      const seconds = Math.round((now - start) / 1000);
+      yield* Console.error(
         phase.current === "waiting"
           ? `alchemy: ${seconds}s waiting for the auth lock '${lockPath}' (${label}). ` +
               `Another alchemy process holds it; if none is running, delete that directory.`
           : `alchemy: ${label} has been running for ${seconds}s while holding the auth lock ` +
               `'${lockPath}'. Re-run with --log-level debug for detail.`,
       );
-    }).pipe(Effect.delay(interval), Effect.repeat(Schedule.spaced(interval)));
+    });
+    // `Effect.schedule` (unlike `Effect.repeat`) consults the schedule
+    // before the first run, and `Schedule.fixed`'s first recurrence comes
+    // after one full interval — so notices fire at interval, 2*interval, …
+    // on true wall-clock boundaries.
+    yield* Effect.schedule(notice, Schedule.fixed(interval));
   });
 
 /**
@@ -215,10 +223,7 @@ export const withLock = <A, E, R>(
   return semaphore.withPermit(
     Effect.gen(function* () {
       const path = yield* Path.Path;
-      // Read `rootDir` here, not at module eval, so the
-      // `Profile -> AuthProvider -> Lock -> Profile` import cycle never
-      // sees it uninitialised.
-      const lockPath = path.join(rootDir, "lock", `${safeKey}.lock`);
+      const lockPath = path.join(rootDir(), "lock", `${safeKey}.lock`);
       const phase: Phase = { current: "waiting" };
       if (options?.watchdog !== false) {
         yield* Effect.forkScoped(
@@ -245,3 +250,13 @@ export const withLock = <A, E, R>(
     }).pipe(Effect.scoped),
   );
 };
+
+/**
+ * Serialize an operation with every credential mutation for a profile. The
+ * lock key is shared by every credential operation for the profile,
+ * including profile-wide rename and delete operations.
+ */
+export const withProfileCredentialsLock = <A, E, R>(
+  profileName: string,
+  effect: Effect.Effect<A, E, R>,
+) => withLock(`profile-credentials-${profileName}`, effect);