alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Planetscale/AuthProvider.d.ts

@@ -1,41 +1,32 @@
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-import { CredentialsStore } from "../Auth/Credentials.ts";
+import * as Schema from "effect/Schema";
 /**
  * Canonical name registered in {@link AuthProviders}. Use this key to look
  * up the PlanetScale {@link AuthProvider} from inside provider Layers.
  */
 export declare const PLANETSCALE_AUTH_PROVIDER_NAME = "Planetscale";
 /**
- * Auth configuration persisted in `~/.alchemy/profiles.json` for the
- * PlanetScale provider.
- *
- * - `env`: read credentials from environment variables at resolution time.
- * - `stored`: read service-token credentials from
- *   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
- * - `oauth`: browser-based login; the access/refresh tokens are stored at
- *   `~/.alchemy/credentials/<profile>/planetscale-oauth.json` and refreshed
- *   on demand. PlanetScale has no PKCE flow, so the OAuth application's
+ * Typed values stored in a PlanetScale provider profile document. Both
+ * service-token and OAuth values are inline. PlanetScale has no PKCE flow,
+ * so the OAuth application's
  *   `client_secret` ships in the CLI — see {@link OAuthClient}.
  */
-export type PlanetscaleAuthConfig = {
-    method: "env";
-} | {
-    method: "stored";
-} | {
-    method: "oauth";
-    organization: string;
-};
-/**
- * apiToken credentials persisted to disk for `method: "stored"`.
- * Stored under the file key `"planetscale-stored"`.
- */
-export interface PlanetscaleStoredCredentials {
-    type: "apiToken";
-    tokenId: string;
-    token: string;
-    organization: string;
-}
+export declare const PlanetscaleAuthConfigSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly method: Schema.Literal<"stored">;
+    readonly tokenId: Schema.String;
+    readonly token: Schema.String;
+    readonly organization: Schema.String;
+}>, Schema.Struct<{
+    readonly method: Schema.Literal<"oauth">;
+    readonly organization: Schema.String;
+    readonly clientId: Schema.optional<Schema.String>;
+    readonly access: Schema.String;
+    readonly refresh: Schema.String;
+    readonly expires: Schema.Number;
+    readonly scopes: Schema.mutable<Schema.$Array<Schema.String>>;
+}>]>;
+export type PlanetscaleAuthConfig = typeof PlanetscaleAuthConfigSchema.Type;
 /**
  * Resolved in-memory PlanetScale credentials returned by
  * {@link AuthProviderImpl.read}. Either a service token (`tokenId`/`token`)
@@ -47,7 +38,7 @@ export type PlanetscaleResolvedCredentials = {
     token: Redacted.Redacted<string>;
     organization: string;
     source: {
-        type: PlanetscaleAuthConfig["method"];
+        type: PlanetscaleAuthConfig["method"] | "env";
         details?: string;
     };
 } | {
@@ -56,21 +47,18 @@ export type PlanetscaleResolvedCredentials = {
     expires: number;
     organization: string;
     source: {
-        type: PlanetscaleAuthConfig["method"];
+        type: PlanetscaleAuthConfig["method"] | "env";
         details?: string;
     };
 };
 /**
  * Layer that registers the PlanetScale {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the
- * PlanetScale `providers()` layer so `alchemy login` can discover it.
+ * PlanetScale `providers()` layer so the alchemy CLI can discover it.
  *
  * Supported methods:
- * - `env`: reads `PLANETSCALE_API_TOKEN_ID`/`PLANETSCALE_API_TOKEN`/`PLANETSCALE_ORGANIZATION`.
- * - `stored`: prompts for a service token interactively and writes it to
- *   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
- * - `oauth`: browser-based login storing access/refresh tokens at
- *   `~/.alchemy/credentials/<profile>/planetscale-oauth.json`.
+ * - `stored`: prompts for a service token and stores it inline.
+ * - `oauth`: browser-based login storing access/refresh values inline.
  */
-export declare const PlanetscaleAuth: Layer.Layer<never, never, import("../index.ts").AuthProviders | CredentialsStore>;
+export declare const PlanetscaleAuth: Layer.Layer<never, never, import("../index.ts").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
 //# sourceMappingURL=AuthProvider.d.ts.map

package/lib/Planetscale/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Planetscale/AuthProvider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAQ5C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AAS3E;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gBAAgB,CAAC;AAoF5D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QACN,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QACN,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEN;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,mFAsW3B,CAAC"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Planetscale/AuthProvider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA4BxC;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gBAAgB,CAAC;AAyF5D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;IAgBtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAC;AAE5E;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QACN,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QACN,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEN;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,mPAoa3B,CAAC"}

package/lib/Planetscale/AuthProvider.js

@@ -1,17 +1,21 @@
 import { listOrganizations } from "@distilled.cloud/planetscale";
 import * as PsCredentialsModule from "@distilled.cloud/planetscale/Credentials";
-import * as Console from "effect/Console";
+import * as Clock from "effect/Clock";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as HttpClient from "effect/unstable/http/HttpClient";
-import { AuthError, AuthProviderLayer, } from "../Auth/AuthProvider.js";
-import { CredentialsStore, displayRedacted } from "../Auth/Credentials.js";
-import { getEnvRedactedRequired, getEnvRequired, retryOnce, } from "../Auth/Env.js";
-import * as Clank from "../Util/Clank.js";
+import { AuthError, AuthProviderLayer, refreshHint, NeedsReauth, } from "../Auth/AuthProvider.js";
+import { storedSecret, storedValueText, validateFieldValues, } from "../Auth/StoredAuthProvider.js";
+import { displayRedacted } from "../Auth/Credentials.js";
+import { withProfileCredentialsLock } from "../Auth/Lock.js";
+import { getEnvRedactedRequired, getEnvRequired, mapPromptCancellation, } from "../Auth/Env.js";
+import { browserOAuth } from "../Auth/BrowserOAuth.js";
+import * as Interaction from "../Interaction.js";
 import * as OAuthClient from "./OAuthClient.js";
 /**
  * Canonical name registered in {@link AuthProviders}. Use this key to look
@@ -37,6 +41,7 @@ const withOAuthCredentials = (accessToken, effect) => Effect.provide(effect, Lay
  * (`name` field, used as `{organization}` in API paths).
  */
 const selectOrganization = (accessToken) => Effect.gen(function* () {
+    const interaction = Interaction.accessors;
     const list = yield* listOrganizations;
     const response = yield* list({});
     const orgs = response.data;
@@ -47,62 +52,80 @@ const selectOrganization = (accessToken) => Effect.gen(function* () {
     }
     if (orgs.length === 1) {
         const org = orgs[0];
-        yield* Clank.info(`Planetscale: using organization: ${org.name} (${org.id})`);
+        if (org === undefined) {
+            return yield* new AuthError({
+                message: "Planetscale: organization response was unexpectedly empty.",
+            });
+        }
+        yield* interaction.output.info(`Planetscale: using organization: ${org.name} (${org.id})`);
         return org.name;
     }
-    return yield* Clank.select({
+    return yield* interaction.prompt
+        .select({
         message: "Select a Planetscale organization",
         options: orgs.map((o) => ({
             value: o.name,
             label: o.name,
-            hint: o.id,
+            description: o.id,
         })),
-    }).pipe(retryOnce);
+    })
+        .pipe(mapPromptCancellation);
 }).pipe((e) => withOAuthCredentials(accessToken, e));
 const options = [
-    {
-        value: "env",
-        label: "Environment Variables",
-        hint: "PLANETSCALE_API_TOKEN_ID + PLANETSCALE_API_TOKEN + PLANETSCALE_ORGANIZATION",
-    },
     {
         value: "oauth",
         label: "OAuth",
-        hint: "recommended — browser-based login with automatic token refresh",
+        description: "recommended — browser-based login with automatic token refresh",
     },
     {
         value: "stored",
         label: "Service Token",
-        hint: "enter service token interactively, stored in ~/.alchemy/credentials",
+        description: "enter a service token and store it inline in the provider file",
     },
 ];
+/**
+ * Typed values stored in a PlanetScale provider profile document. Both
+ * service-token and OAuth values are inline. PlanetScale has no PKCE flow,
+ * so the OAuth application's
+ *   `client_secret` ships in the CLI — see {@link OAuthClient}.
+ */
+export const PlanetscaleAuthConfigSchema = Schema.Union([
+    Schema.Struct({
+        method: Schema.Literal("stored"),
+        tokenId: Schema.String,
+        token: Schema.String,
+        organization: Schema.String,
+    }),
+    Schema.Struct({
+        method: Schema.Literal("oauth"),
+        organization: Schema.String,
+        clientId: Schema.optional(Schema.String),
+        access: Schema.String,
+        refresh: Schema.String,
+        expires: Schema.Number,
+        scopes: Schema.mutable(Schema.Array(Schema.String)),
+    }),
+]);
 /**
  * Layer that registers the PlanetScale {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the
- * PlanetScale `providers()` layer so `alchemy login` can discover it.
+ * PlanetScale `providers()` layer so the alchemy CLI can discover it.
  *
  * Supported methods:
- * - `env`: reads `PLANETSCALE_API_TOKEN_ID`/`PLANETSCALE_API_TOKEN`/`PLANETSCALE_ORGANIZATION`.
- * - `stored`: prompts for a service token interactively and writes it to
- *   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
- * - `oauth`: browser-based login storing access/refresh tokens at
- *   `~/.alchemy/credentials/<profile>/planetscale-oauth.json`.
+ * - `stored`: prompts for a service token and stores it inline.
+ * - `oauth`: browser-based login storing access/refresh values inline.
  */
 export const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
-    const store = yield* CredentialsStore;
-    const oauthLogin = (profileName) => Effect.gen(function* () {
-        const authorization = OAuthClient.authorize();
-        yield* Clank.info("Planetscale: opening browser for OAuth login...");
-        yield* Clank.info(authorization.url);
-        yield* Clank.openUrl(authorization.url).pipe(Effect.catch(() => Clank.warn("Planetscale: could not open browser automatically. Please open the URL above manually.")));
-        yield* Clank.info("Planetscale: waiting for authorization (up to 5 minutes).");
-        const credentials = yield* Effect.raceFirst(OAuthClient.callback(authorization), Clank.text({
-            message: "Paste the authorization code or callback URL",
-            placeholder: "The browser will complete this automatically when local",
-            validate: (value) => value.trim().length > 0 ? undefined : "Paste a code or URL",
-        }).pipe(Effect.flatMap((input) => OAuthClient.exchangeCallbackInput(input, authorization))));
-        yield* store.write(profileName, "planetscale-oauth", credentials);
-        yield* Clank.success("Planetscale: OAuth credentials saved.");
+    const interaction = Interaction.accessors;
+    const oauthLogin = (_profileName) => Effect.gen(function* () {
+        const authorization = yield* OAuthClient.authorize();
+        const credentials = yield* browserOAuth({
+            provider: "Planetscale",
+            url: authorization.url,
+            callback: OAuthClient.callback(authorization),
+            exchange: (input) => OAuthClient.exchangeCallbackInput(input, authorization),
+        });
+        yield* interaction.output.success("Planetscale: OAuth credentials saved.");
         return credentials;
     });
     const configureOAuth = Effect.fn(function* (profileName) {
@@ -112,155 +135,249 @@ export const PlanetscaleAuth = AuthProviderLayer()(PLANETSCALE_AUTH_PROVIDER_NAM
         // `user:read_organizations` scope. If the call fails for any
         // reason — missing scope, network, off-spec response — fall back
         // to a manual prompt so login still completes.
-        const organization = yield* selectOrganization(oauthCreds.access).pipe(Effect.catch((e) => Effect.gen(function* () {
-            yield* Clank.warn(`Planetscale: could not auto-list organizations (${String(e)}). Falling back to manual entry.`);
-            return yield* Clank.text({
+        const organization = yield* selectOrganization(Redacted.value(oauthCreds.access)).pipe(Effect.catch((e) => Effect.gen(function* () {
+            yield* interaction.output.warning(`Planetscale: could not auto-list organizations (${String(e)}). Falling back to manual entry.`);
+            return yield* interaction.prompt
+                .text({
                 message: "Planetscale Organization (URL slug)",
                 validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
+            })
+                .pipe(mapPromptCancellation);
         })));
-        return { method: "oauth", organization };
+        return {
+            method: "oauth",
+            organization,
+            clientId: oauthCreds.clientId,
+            access: Redacted.value(oauthCreds.access),
+            refresh: Redacted.value(oauthCreds.refresh),
+            expires: oauthCreds.expires,
+            scopes: oauthCreds.scopes,
+        };
     });
-    const loginStored = Effect.fn(function* (profileName) {
-        const tokenId = yield* Clank.text({
+    const loginStored = Effect.fn(function* (_profileName) {
+        const tokenId = yield* interaction.prompt
+            .text({
             message: "Planetscale Service Token ID",
             validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const token = yield* Clank.password({
+        })
+            .pipe(mapPromptCancellation);
+        const token = yield* interaction.prompt
+            .password({
             message: "Planetscale Service Token",
             validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const organization = yield* Clank.text({
+        })
+            .pipe(mapPromptCancellation);
+        const organization = yield* interaction.prompt
+            .text({
             message: "Planetscale Organization (URL slug)",
             validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        yield* store.write(profileName, "planetscale-stored", {
-            type: "apiToken",
-            tokenId,
-            token,
-            organization,
-        });
-        yield* Clank.success("Planetscale: credentials saved.");
-        return { method: "stored" };
+        })
+            .pipe(mapPromptCancellation);
+        yield* interaction.output.success("Planetscale: credentials saved.");
+        return { method: "stored", tokenId, token, organization };
     });
-    const configureInteractive = (profileName) => Clank.select({
+    const configureInteractive = (profileName) => interaction.prompt
+        .select({
         message: "Planetscale authentication method",
         options,
-    }).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
-    const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
-        if (ctx.ci) {
-            return { method: "env" };
-        }
-        return yield* configureInteractive(profileName);
-    }).pipe(Effect.mapError((e) => new AuthError({
+    })
+        .pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+    const configureCredentials = (profileName) => configureInteractive(profileName).pipe(Effect.mapError((e) => new AuthError({
         message: "failed to configure credentials",
         cause: e,
     })));
-    const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
-        const tokenId = yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN_ID");
-        const token = yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN");
-        const organization = yield* getEnvRequired("PLANETSCALE_ORGANIZATION");
-        return {
+    /**
+     * Flag-driven (`--method stored --set ...`) fields, mirroring the
+     * interactive service-token prompts. OAuth requires a browser and stays
+     * interactive-only, so it is deliberately absent from
+     * {@link configureMethods}.
+     */
+    const serviceTokenFields = [
+        { name: "tokenId", label: "Planetscale Service Token ID" },
+        { name: "token", label: "Planetscale Service Token", secret: true },
+        { name: "organization", label: "Planetscale Organization (URL slug)" },
+    ];
+    const configureMethods = [
+        { method: "stored", fields: serviceTokenFields },
+    ];
+    const configureWith = (_profileName, input) => input.method === "stored"
+        ? validateFieldValues(PLANETSCALE_AUTH_PROVIDER_NAME, serviceTokenFields, input.values).pipe(Effect.map((values) => ({
+            method: "stored",
+            tokenId: Redacted.value(storedSecret(values.tokenId) ?? Redacted.make("")),
+            token: Redacted.value(storedSecret(values.token) ?? Redacted.make("")),
+            organization: storedValueText(values.organization) ?? "",
+        })), Effect.tap(() => interaction.output.success("Planetscale: credentials saved.")))
+        : Effect.fail(new AuthError({
+            message: `Planetscale: unknown method '${input.method}'. Valid methods: stored. (OAuth is interactive-only.)`,
+        }));
+    const resolveCredentials = (profileName, config, updateConfig) => Effect.gen(function* () {
+        const reauth = refreshHint(PLANETSCALE_AUTH_PROVIDER_NAME, profileName);
+        return yield* Match.value(config).pipe(Match.when({ method: "stored" }, (stored) => Effect.succeed({
             type: "apiToken",
-            tokenId,
-            token,
-            organization,
-            source: {
-                type: "env",
-                details: "PLANETSCALE_API_TOKEN_ID/PLANETSCALE_API_TOKEN",
-            },
-        };
-    })), Match.when({ method: "stored" }, () => store
-        .read(profileName, "planetscale-stored")
-        .pipe(Effect.flatMap((creds) => creds == null
-        ? Effect.fail(new AuthError({
-            message: "Planetscale stored credentials not found. Run: alchemy login --configure",
-        }))
-        : Effect.succeed({
-            type: "apiToken",
-            tokenId: Redacted.make(creds.tokenId),
-            token: Redacted.make(creds.token),
-            organization: creds.organization,
-            source: {
-                type: "stored",
-                details: undefined,
-            },
-        })))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
-        const creds = yield* store.read(profileName, "planetscale-oauth");
-        if (creds == null || creds.type !== "oauth") {
-            return yield* Effect.fail(new AuthError({
-                message: "Planetscale OAuth credentials not found. Run: alchemy login",
-            }));
-        }
-        // Refresh proactively if the token has expired (or is within
-        // 10s of expiring). Persist the refreshed creds so subsequent
-        // resolves don't repeat the round-trip.
-        const fresh = creds.expires > Date.now() + 10_000
-            ? creds
-            : yield* OAuthClient.refresh(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "planetscale-oauth", refreshed)), Effect.mapError((e) => new AuthError({
-                message: "Planetscale OAuth refresh failed. Run: alchemy login",
-                cause: e,
-            })));
-        return {
+            tokenId: Redacted.make(stored.tokenId),
+            token: Redacted.make(stored.token),
+            organization: stored.organization,
+            source: { type: "stored", details: undefined },
+        })), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
+            const creds = {
+                type: "oauth",
+                clientId: cfg.clientId,
+                access: Redacted.make(cfg.access),
+                refresh: Redacted.make(cfg.refresh),
+                expires: cfg.expires,
+                scopes: cfg.scopes,
+            };
+            if (!OAuthClient.usesCurrentClient(creds)) {
+                return yield* Effect.fail(new NeedsReauth({
+                    provider: PLANETSCALE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Planetscale OAuth credentials for profile '${profileName}' were issued to an incompatible OAuth client and have been removed. ${reauth}`,
+                }));
+            }
+            // Refresh proactively if the token has expired (or is within
+            // 10s of expiring). Persist the refreshed creds so subsequent
+            // resolves don't repeat the round-trip.
+            const now = yield* Clock.currentTimeMillis;
+            const fresh = creds.expires > now + 10_000
+                ? creds
+                : yield* OAuthClient.refresh(creds).pipe(
+                // Only the refresh round-trip maps to NeedsReauth — a
+                // failed persist afterwards is a local I/O AuthError and
+                // passes through untouched.
+                Effect.mapError((e) => new NeedsReauth({
+                    provider: PLANETSCALE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Planetscale OAuth refresh failed. ${reauth}`,
+                    cause: e,
+                })));
+            if (fresh !== creds) {
+                yield* (updateConfig?.({
+                    method: "oauth",
+                    organization: cfg.organization,
+                    clientId: fresh.clientId,
+                    access: Redacted.value(fresh.access),
+                    refresh: Redacted.value(fresh.refresh),
+                    expires: fresh.expires,
+                    scopes: fresh.scopes,
+                }) ?? Effect.void);
+            }
+            return {
+                type: "oauth",
+                accessToken: fresh.access,
+                expires: fresh.expires,
+                organization: cfg.organization,
+                source: { type: "oauth" },
+            };
+        })), Match.exhaustive);
+    });
+    const logout = (_profileName, config) => Match.value(config).pipe(Match.when({ method: "stored" }, () => Effect.void), Match.when({ method: "oauth" }, () => Effect.void), Match.exhaustive);
+    const login = (profileName, config, updateConfig) => Match.value(config)
+        .pipe(Match.when({ method: "stored" }, (stored) => Effect.succeed(stored)), Match.when({ method: "oauth" }, (oauth) => Effect.gen(function* () {
+        const credentials = {
             type: "oauth",
-            accessToken: Redacted.make(fresh.access),
-            expires: fresh.expires,
-            organization: cfg.organization,
-            source: { type: "oauth" },
+            clientId: oauth.clientId,
+            access: Redacted.make(oauth.access),
+            refresh: Redacted.make(oauth.refresh),
+            expires: oauth.expires,
+            scopes: oauth.scopes,
         };
-    })), Match.exhaustive);
-    const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
-        .delete(profileName, "planetscale-stored")
-        .pipe(Effect.andThen(Clank.success("Planetscale: stored credentials removed")))), 
-    // PlanetScale publishes no token-revocation endpoint, so logout just
-    // drops the locally stored tokens.
-    Match.when({ method: "oauth" }, () => store
-        .delete(profileName, "planetscale-oauth")
-        .pipe(Effect.andThen(Clank.success("Planetscale: OAuth credentials removed.")))), Match.exhaustive);
-    const login = (profileName, config) => Match.value(config)
-        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
-        .read(profileName, "planetscale-stored")
-        .pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c) => Effect.gen(function* () {
-        const creds = yield* store.read(profileName, "planetscale-oauth");
-        if (creds?.type === "oauth") {
-            yield* Clank.info("Planetscale: refreshing OAuth credentials...");
-            yield* OAuthClient.refresh(creds).pipe(Effect.flatMap((refreshed) => store
-                .write(profileName, "planetscale-oauth", refreshed)
-                .pipe(Effect.andThen(Clank.success("Planetscale: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName).pipe(Effect.asVoid)));
-            return;
+        if (!OAuthClient.usesCurrentClient(credentials)) {
+            return yield* configureOAuth(profileName);
         }
-        yield* oauthLogin(profileName);
+        const refreshed = yield* withProfileCredentialsLock(profileName, interaction.output
+            .info("Planetscale: refreshing OAuth credentials...")
+            .pipe(Effect.andThen(OAuthClient.refresh(credentials)), Effect.flatMap((credentials) => {
+            const config = {
+                ...oauth,
+                clientId: credentials.clientId,
+                access: Redacted.value(credentials.access),
+                refresh: Redacted.value(credentials.refresh),
+                expires: credentials.expires,
+                scopes: credentials.scopes,
+            };
+            return (updateConfig?.(config) ?? Effect.void).pipe(Effect.as(config));
+        }), Effect.tap(() => interaction.output.success("Planetscale: OAuth credentials refreshed.")))).pipe(Effect.catchTag("OAuthError", () => configureOAuth(profileName)));
+        return refreshed;
     })), Match.exhaustive)
         .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
-    const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
-        const sourceStr = creds.source.details
+    const details = (profileName, config, updateConfig) => Effect.all([
+        resolveCredentials(profileName, config, updateConfig),
+        Clock.currentTimeMillis,
+    ]).pipe(Effect.map(([creds, now]) => {
+        const sourceStr = "details" in creds.source && creds.source.details
             ? `${creds.source.type} - ${creds.source.details}`
             : creds.source.type;
-        return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => Effect.all([
-            Console.log(`  tokenId: ${displayRedacted(c.tokenId, 3)}`),
-            Console.log(`  token: ${displayRedacted(c.token, 6)}`),
-            Console.log(`  organization: ${c.organization}`),
-            Console.log(`  source: ${sourceStr}`),
-        ])), Match.when({ type: "oauth" }, (c) => {
-            const remainingMs = c.expires - Date.now();
+        return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => ({
+            lines: [
+                { key: "tokenId", value: displayRedacted(c.tokenId, 3) },
+                { key: "token", value: displayRedacted(c.token, 6) },
+                { key: "organization", value: c.organization },
+                { key: "source", value: sourceStr },
+            ],
+        })), Match.when({ type: "oauth" }, (c) => {
+            const remainingMs = c.expires - now;
             const expiresAt = new Date(c.expires).toISOString();
             const expiresStr = remainingMs <= 0
                 ? `expired (${expiresAt})`
                 : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
-            return Effect.all([
-                Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
-                Console.log(`  expires: ${expiresStr}`),
-                Console.log(`  organization: ${c.organization}`),
-                Console.log(`  source: ${sourceStr}`),
-            ]);
+            return {
+                lines: [
+                    { key: "accessToken", value: displayRedacted(c.accessToken) },
+                    { key: "expires", value: expiresStr },
+                    { key: "organization", value: c.organization },
+                    { key: "source", value: sourceStr },
+                ],
+            };
         }), Match.exhaustive);
     }));
+    const readEnvironment = Effect.gen(function* () {
+        const tokenId = yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN_ID");
+        const token = yield* getEnvRedactedRequired("PLANETSCALE_API_TOKEN");
+        const organization = yield* getEnvRequired("PLANETSCALE_ORGANIZATION");
+        return {
+            type: "apiToken",
+            tokenId,
+            token,
+            organization,
+            source: {
+                type: "env",
+                details: "PLANETSCALE_API_TOKEN_ID/PLANETSCALE_API_TOKEN",
+            },
+        };
+    });
     return {
+        configSchema: PlanetscaleAuthConfigSchema,
         configure: configureCredentials,
+        configureWith,
+        configureMethods,
         logout,
         login,
-        prettyPrint,
+        details,
         read: resolveCredentials,
+        readEnvironment,
+        environment: [
+            {
+                name: "PLANETSCALE_API_TOKEN_ID",
+                required: true,
+                description: "Service token id.",
+            },
+            {
+                name: "PLANETSCALE_API_TOKEN",
+                required: true,
+                secret: true,
+                description: "Service token secret.",
+            },
+            {
+                name: "PLANETSCALE_ORGANIZATION",
+                required: true,
+                description: "Organization URL slug.",
+            },
+            {
+                name: "PLANETSCALE_API_BASE_URL",
+                required: false,
+                description: "API base URL override.",
+            },
+        ],
     };
 }));
 //# sourceMappingURL=AuthProvider.js.map