alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Neon/Role.ts

@@ -0,0 +1,192 @@
+import * as Neon from "@distilled.cloud/neon";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Unowned } from "../AdoptPolicy.ts";
+import { isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { resolveBranchScope, type BranchScope, type ResolvedBranchScope } from "./BranchScope.ts";
+import { waitForOperations } from "./Project.ts";
+import type { Providers } from "./Providers.ts";
+
+export type RoleProps = BranchScope & {
+  /**
+   * Postgres role name, at most 63 bytes. Omit to generate a unique,
+   * lowercase name. Changing an explicit name replaces the role.
+   */
+  name?: string;
+  /**
+   * Create a role that cannot log in, for example a group role that owns
+   * objects and is granted to login roles with SQL. Changes replace the role.
+   * @default false
+   */
+  noLogin?: boolean;
+};
+
+export interface RoleAttributes extends ResolvedBranchScope {
+  /** Postgres role name. */
+  roleName: string;
+  /** Role password; `undefined` for a role created with `noLogin`. */
+  password: Redacted.Redacted<string> | undefined;
+  /** Whether the role cannot log in. */
+  noLogin: boolean;
+  /** Authentication method reported by Neon: `password`, `oauth`, or `no_login`. */
+  authenticationMethod: string | undefined;
+  /** Creation time. */
+  createdAt: string;
+}
+
+export interface Role extends Resource<"Neon.Role", RoleProps, RoleAttributes, never, Providers> {}
+
+/**
+ * A Postgres role on a Neon branch. Neon makes every role it creates a
+ * member of `neon_superuser`: it can read and write all data, create
+ * databases and roles, and bypass row-level security. Use roles for
+ * separate logins and passwords, not to restrict access.
+ *
+ * ### Creating a Role
+ * **Example:** A login role on a branch
+ * ```typescript
+ * const app = yield* Neon.Role("App", { branch });
+ * // app.roleName and app.password (Redacted) connect to branch.origin.host
+ * ```
+ *
+ * **Example:** A role on the project's default branch
+ * ```typescript
+ * const migrator = yield* Neon.Role("Migrator", { project, name: "migrator" });
+ * ```
+ *
+ * ### Group Roles
+ * **Example:** A role that cannot log in
+ * ```typescript
+ * const owner = yield* Neon.Role("Owner", { branch, name: "app_owner", noLogin: true });
+ * ```
+ *
+ * @resource
+ * @product Role
+ */
+export const Role = Resource<Role>("Neon.Role");
+
+const requestScope = (scope: ResolvedBranchScope) => ({
+  project_id: scope.projectId,
+  branch_id: scope.branchId,
+});
+
+const redact = (password: string | Redacted.Redacted<string>) =>
+  Redacted.isRedacted(password) ? password : Redacted.make(password);
+
+// Underscores keep generated names usable unquoted in SQL (`GRANT ... TO app_xyz`).
+const createRoleName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    if (name !== undefined) return name;
+    const generated = yield* createPhysicalName({ id, maxLength: 63, lowercase: true });
+    return generated.replaceAll("-", "_");
+  });
+
+const observeRole = Effect.fn(function* (scope: ResolvedBranchScope, roleName: string) {
+  return yield* Neon.getProjectBranchRole({ ...requestScope(scope), role_name: roleName }).pipe(
+    Effect.map(({ role }) => role),
+    Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+  );
+});
+
+const isNoLogin = (role: Neon.Role) => role.authentication_method === "no_login";
+
+/** Read a login role's stored password, resetting it when Neon no longer has it. */
+const revealPassword = Effect.fn(function* (scope: ResolvedBranchScope, role: Neon.Role) {
+  if (isNoLogin(role)) return undefined;
+  const request = { ...requestScope(scope), role_name: role.name };
+  const stored = yield* Neon.getProjectBranchRolePassword(request).pipe(
+    Effect.map(({ password }) => redact(password)),
+    Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+  );
+  if (stored) return stored;
+  const reset = yield* Neon.resetProjectBranchRolePassword(request);
+  yield* waitForOperations(reset.operations);
+  return reset.role.password === undefined ? undefined : redact(reset.role.password);
+});
+
+const toAttributes = (
+  scope: ResolvedBranchScope,
+  role: Neon.Role,
+  password: Redacted.Redacted<string> | undefined,
+): RoleAttributes => ({
+  ...scope,
+  roleName: role.name,
+  password,
+  noLogin: isNoLogin(role),
+  authenticationMethod: role.authentication_method,
+  createdAt: role.created_at,
+});
+
+export const RoleProvider = () =>
+  Provider.succeed(Role, {
+    stables: ["projectId", "branchId", "roleName"],
+    diff: Effect.fn(function* ({ news, output }) {
+      if (!isResolved(news) || !output) return;
+      const scope = yield* resolveBranchScope(news);
+      const sameScope = scope.projectId === output.projectId && scope.branchId === output.branchId;
+      if (
+        !sameScope ||
+        (news.name !== undefined && news.name !== output.roleName) ||
+        (news.noLogin ?? false) !== output.noLogin
+      ) {
+        return {
+          action: "replace",
+          // A generated name changes with the new instance; only an explicit,
+          // unchanged name must free itself before the replacement is created.
+          deleteFirst: sameScope && news.name !== undefined && news.name === output.roleName,
+        };
+      }
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+      if (!output && !olds?.branch && !olds?.project) return undefined;
+      const scope = output ?? (yield* resolveBranchScope(olds!));
+      const roleName = output?.roleName ?? (yield* createRoleName(id, olds?.name));
+      const role = yield* observeRole(scope, roleName);
+      if (!role) return undefined;
+      if (output) return toAttributes(scope, role, output.password);
+      // Only an explicit name can collide with a role this stack did not create.
+      const attrs = toAttributes(scope, role, yield* revealPassword(scope, role));
+      return olds?.name !== undefined ? Unowned(attrs) : attrs;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+      const scope = yield* resolveBranchScope(news);
+      const roleName = news.name ?? output?.roleName ?? (yield* createRoleName(id, undefined));
+      const existing = yield* observeRole(scope, roleName);
+      if (!existing) {
+        const created = yield* Neon.createProjectBranchRole({
+          ...requestScope(scope),
+          role: { name: roleName, ...(news.noLogin ? { no_login: true } : {}) },
+        }).pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+        if (created) {
+          yield* waitForOperations(created.operations);
+          return toAttributes(
+            scope,
+            created.role,
+            created.role.password === undefined ? undefined : redact(created.role.password),
+          );
+        }
+      }
+      // An existing role: keep the password we already hold, otherwise reveal it.
+      const role =
+        existing ??
+        (yield* Neon.getProjectBranchRole({
+          ...requestScope(scope),
+          role_name: roleName,
+        })).role;
+      const password =
+        output?.roleName === role.name && output.password !== undefined
+          ? output.password
+          : yield* revealPassword(scope, role);
+      return toAttributes(scope, role, password);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      const deleted = yield* Neon.deleteProjectBranchRole({
+        ...requestScope(output),
+        role_name: output.roleName,
+      }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+      if (deleted) yield* waitForOperations(deleted.operations);
+    }),
+  });

package/src/Neon/StorageBinding.ts

@@ -3,7 +3,6 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpClient from "effect/http/HttpClient";
-import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
 import * as Binding from "../Binding.ts";
@@ -94,11 +93,11 @@ export const makeStorageBinding = (scope: "storage:read" | "storage:write") =>
           const validated = Output.all(Output.of(credential), Output.of(bucket)).pipe(
             Output.mapEffect(
               Effect.fn(function* ([credential, target]) {
-                yield* validateCredential(credential, target, scope).pipe(Effect.orDie);
+                yield* validateCredential(credential, target, scope);
                 if (scope === "storage:write")
-                  yield* validateCredential(credential, target, "storage:read").pipe(Effect.orDie);
+                  yield* validateCredential(credential, target, "storage:read");
                 return credential;
-              }),
+              }, Effect.orDie),
             ),
           );
           env[keys.accessKeyId] = validated.tokenId;
@@ -147,7 +146,7 @@ export const makeStorageBinding = (scope: "storage:read" | "storage:write") =>
       });
       const client = Effect.gen(function* () {
         return yield* makeStorageClient(yield* config, yield* required(bucketKey));
-      }).pipe(Effect.provide(Layer.succeed(HttpClient.HttpClient, http)));
+      }).pipe(Effect.provideService(HttpClient.HttpClient, http));
       return {
         get: (key: string) => client.pipe(Effect.flatMap((c) => c.get(key))),
         head: (key: string) => client.pipe(Effect.flatMap((c) => c.head(key))),

package/src/Neon/index.ts

@@ -17,6 +17,7 @@ export * from "./Branch.ts";
 export * from "./Connect.ts";
 export * from "./BranchScope.ts";
 export * from "./Credential.ts";
+export * from "./Role.ts";
 export * from "./Bucket.ts";
 export * from "./Object.ts";
 export * from "./ReadBucket.ts";

package/src/Neon/waitUntil.ts

@@ -15,15 +15,13 @@ export const waitUntil = <A, E, R>(
     const context = yield* Effect.context<Exclude<R, Scope.Scope>>();
     const memoMap = yield* Layer.makeMemoMap;
     yield* Effect.sync(() =>
-      nativeWaitUntil(
-        Effect.runPromiseWith(context)(
-          effect.pipe(
-            Effect.scoped,
-            Effect.provideService(Layer.CurrentMemoMap, memoMap),
-            Effect.timeout("15 minutes"),
-            Effect.tapCause(() => Effect.logError("Neon waitUntil task failed")),
-          ),
-        ),
+      effect.pipe(
+        Effect.scoped,
+        Effect.provideService(Layer.CurrentMemoMap, memoMap),
+        Effect.timeout("15 minutes"),
+        Effect.tapCause(() => Effect.logError("Neon waitUntil task failed")),
+        Effect.runPromiseWith(context),
+        nativeWaitUntil,
       ),
     );
   });

package/src/Output.ts

@@ -572,6 +572,7 @@ export const evaluate: <A, Req = never>(
   InvalidReferenceError | MissingSourceError | Config.ConfigError,
   State.State | Req
 > = (expr, upstream, ancestors = new Set()) =>
+  // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- the declared signature above carries the real error/requirement types
   Effect.gen(function* () {
     if (isResource(expr)) {
       const srcId = expr.FQN;
@@ -624,14 +625,12 @@ export const evaluate: <A, Req = never>(
           fqn: expr.resourceId,
         });
         if (!resource) {
-          return yield* Effect.fail(
-            new InvalidReferenceError({
-              message: `Reference to '${expr.resourceId}' in stack '${stack}' and stage '${stage}' not found. Have you deployed '${stage}' or '${stack}'?`,
-              stack,
-              stage,
-              resourceId: expr.resourceId,
-            }),
-          );
+          return yield* new InvalidReferenceError({
+            message: `Reference to '${expr.resourceId}' in stack '${stack}' and stage '${stage}' not found. Have you deployed '${stage}' or '${stack}'?`,
+            stack,
+            stage,
+            resourceId: expr.resourceId,
+          });
         }
         // RefExpr targets persisted resources; tasks aren't cross-stack
         // referenceable. Return the resource's output attrs, otherwise the
@@ -643,14 +642,12 @@ export const evaluate: <A, Req = never>(
         const stage = expr.stage ?? (yield* Stage);
         const output = yield* state.getOutput({ stack, stage });
         if (output == null) {
-          return yield* Effect.fail(
-            new InvalidReferenceError({
-              message: `Reference to stack '${stack}' at stage '${stage}' not found. Have you deployed stage '${stage}' of '${stack}'?`,
-              stack,
-              stage,
-              resourceId: stack,
-            }),
-          );
+          return yield* new InvalidReferenceError({
+            message: `Reference to stack '${stack}' at stage '${stage}' not found. Have you deployed stage '${stage}' of '${stack}'?`,
+            stack,
+            stage,
+            resourceId: stack,
+          });
         }
         return output;
       }

package/src/PhysicalName.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import * as Effect from "effect/Effect";
 import { base32 } from ".//Util/base32.ts";
-import { InstanceId } from "./InstanceId.ts";
+import { ResourceContext } from "./ResourceContext.ts";
 import { Stack } from "./Stack.ts";
 import { Stage } from "./Stage.ts";
 
@@ -71,12 +71,12 @@ export const createPhysicalName = Effect.fn(function* ({
   ) {
     prefix = `x${delimiter}${prefix}`;
   }
-  const randomId = base32(Buffer.from(instanceId ?? (yield* InstanceId), "hex"));
+  const randomId = base32(Buffer.from(instanceId ?? (yield* ResourceContext).instanceId, "hex"));
   const suffix = randomId.slice(0, suffixLength);
   const name = `${prefix}${suffix}`;
   if (maxLength && name.length > maxLength) {
     // The instance suffix alone cannot disambiguate: every name derived from
-    // the same resource shares one InstanceId, so two prefixes that differ
+    // the same resource shares one instance ID, so two prefixes that differ
     // only in their truncated tail (e.g. `…-task-role-` vs `…-execution-role-`)
     // would collapse to the same string. Keep a stable hash of the full name
     // next to the suffix so truncated names remain unique.

package/src/Plan.ts

@@ -5,6 +5,7 @@ import * as Config from "effect/Config";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Ref from "effect/Ref";
 import { asEffect } from ".//Util/types.ts";
@@ -29,7 +30,7 @@ import {
   type UpdateDiff,
 } from "./Diff.ts";
 import { parseFqn } from "./FQN.ts";
-import { generateInstanceId, InstanceId } from "./InstanceId.ts";
+import { generateInstanceId } from "./InstanceId.ts";
 import * as Output from "./Output.ts";
 import {
   tryFindProviderRegistrationByType,
@@ -52,6 +53,7 @@ import {
   type ResourceBinding,
   type ResourceLike,
 } from "./Resource.ts";
+import { ResourceContext } from "./ResourceContext.ts";
 import {
   InvalidResourceSelection,
   UnsafeSelectionBoundary,
@@ -409,7 +411,7 @@ const makePlan = <A>(
     // already-deployed state), so the check is scoped to platform tags.
     for (const resource of resources) {
       if (resource.RequiresImplementation && resource.Props === undefined) {
-        yield* Effect.die(missingImplementation(resource.Type, resource.LogicalId));
+        return yield* Effect.die(missingImplementation(resource.Type, resource.LogicalId));
       }
     }
 
@@ -801,7 +803,7 @@ const makePlan = <A>(
                     oldBindings,
                     newBindings,
                   })
-                  .pipe(providePlanScope(resource.FQN, oldState.instanceId))
+                  .pipe(providePlanScope(resource, oldState.instanceId))
               : Effect.succeed(undefined);
 
             // A present `diff.stables` is authoritative for this update and
@@ -845,7 +847,11 @@ const makePlan = <A>(
             // keep the stale attrs even though the upstream just
             // re-reconciled. Expose only the stable attributes and let
             // apply re-evaluate the rest against the forced reconcile's
-            // fresh output.
+            // fresh output. A noop diff may carry `stables` for exactly this
+            // case (conditional stables such as a rename-mutable `name`);
+            // without them the forced upstream would only expose
+            // `provider.stables` and identity-sensitive consumers would
+            // falsely plan a replacement (#1832).
             if (options.force) {
               return withStables(oldState?.attr);
             }
@@ -1383,7 +1389,7 @@ const makePlan = <A>(
             olds: news,
             output: undefined,
           })
-          .pipe(providePlanScope(fqn, adoptInstanceId));
+          .pipe(providePlanScope(resource, adoptInstanceId));
         if (readResult !== undefined) {
           const isUnowned = Unowned.is(readResult);
           // A resource-scoped `adopt(...)` (captured on the resource at
@@ -1511,7 +1517,7 @@ const makePlan = <A>(
               output: oldState.attr,
             })
             .pipe(
-              providePlanScope(fqn, oldState.instanceId),
+              providePlanScope(resource, oldState.instanceId),
               // `creating` props pass `isResolved` yet can still carry
               // holes where unresolved Outputs were stripped at commit
               // time (see stripUnresolved) — e.g. a parent reference
@@ -1588,7 +1594,7 @@ const makePlan = <A>(
                 oldBindings,
                 newBindings,
               })
-              .pipe(providePlanScope(fqn, oldState.instanceId)),
+              .pipe(providePlanScope(resource, oldState.instanceId)),
           ).pipe(
             Effect.map(
               (diff) =>
@@ -2296,15 +2302,22 @@ const capturedEnvChanged = (
 };
 
 const providePlanScope =
-  (fqn: string, instanceId: string) =>
+  (resource: ResourceLike, instanceId: string) =>
   <A, E, R>(effect: Effect.Effect<A, E, R>) =>
     Effect.serviceOption(ArtifactStore).pipe(
       Effect.map(Option.getOrElse(createArtifactStore)),
       Effect.flatMap((store) =>
         effect.pipe(
-          failCredentialsRequired(fqn),
-          Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),
-          Effect.provideService(InstanceId, instanceId),
+          failCredentialsRequired(resource.FQN),
+          Effect.provide([
+            Layer.succeed(Artifacts, makeScopedArtifacts(store, resource.FQN)),
+            Layer.succeed(ResourceContext, {
+              logicalId: resource.LogicalId,
+              fqn: resource.FQN,
+              instanceId,
+              type: resource.Type,
+            }),
+          ]),
         ),
       ),
     );

package/src/Planetscale/AuthProvider.ts

@@ -49,7 +49,7 @@ const withOAuthCredentials = <A, E, R>(
     effect,
     Layer.mergeAll(
       PsCredentialsModule.fromOAuth({
-        accessToken,
+        accessToken: Redacted.make(accessToken),
         organization: "",
       }),
       FetchHttpClient.layer,
@@ -68,14 +68,14 @@ const selectOrganization = (accessToken: string) =>
     const response = yield* list({});
     const orgs = response.data;
     if (orgs.length === 0) {
-      return yield* new AuthError({
+      return yield* AuthError.make({
         message: "Planetscale: no organizations found for this credential.",
       });
     }
     if (orgs.length === 1) {
       const org = orgs[0];
       if (org === undefined) {
-        return yield* new AuthError({
+        return yield* AuthError.make({
           message: "Planetscale: organization response was unexpectedly empty.",
         });
       }
@@ -131,7 +131,7 @@ export const PlanetscaleAuthConfigSchema = Schema.Union([
     access: Schema.String,
     refresh: Schema.String,
     expires: Schema.Number,
-    scopes: Schema.mutable(Schema.Array(Schema.String)),
+    scopes: Schema.String.pipe(Schema.Array, Schema.mutable),
   }),
 ]);
 export type PlanetscaleAuthConfig = typeof PlanetscaleAuthConfigSchema.Type;
@@ -201,7 +201,9 @@ export const PlanetscaleAuth = AuthProviderLayer<
       // `user:read_organizations` scope. If the call fails for any
       // reason — missing scope, network, off-spec response — fall back
       // to a manual prompt so login still completes.
-      const organization = yield* selectOrganization(Redacted.value(oauthCreds.access)).pipe(
+      const organization = yield* oauthCreds.access.pipe(
+        Redacted.value,
+        selectOrganization,
         Effect.catch((e) =>
           Effect.gen(function* () {
             yield* interaction.output.warning(
@@ -272,12 +274,11 @@ export const PlanetscaleAuth = AuthProviderLayer<
 
     const configureCredentials = (profileName: string) =>
       configureInteractive(profileName).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "failed to configure credentials",
-              cause: e,
-            }),
+        Effect.mapError((e) =>
+          AuthError.make({
+            message: "failed to configure credentials",
+            cause: e,
+          }),
         ),
       );
 
@@ -319,7 +320,7 @@ export const PlanetscaleAuth = AuthProviderLayer<
             Effect.tap(() => interaction.output.success("Planetscale: credentials saved.")),
           )
         : Effect.fail(
-            new AuthError({
+            AuthError.make({
               message: `Planetscale: unknown method '${input.method}'. Valid methods: stored. (OAuth is interactive-only.)`,
             }),
           );
@@ -352,13 +353,11 @@ export const PlanetscaleAuth = AuthProviderLayer<
                 scopes: cfg.scopes,
               };
               if (!OAuthClient.usesCurrentClient(creds)) {
-                return yield* Effect.fail(
-                  new NeedsReauth({
-                    provider: PLANETSCALE_AUTH_PROVIDER_NAME,
-                    profile: profileName,
-                    message: `Planetscale OAuth credentials for profile '${profileName}' were issued to an incompatible OAuth client and have been removed. ${reauth}`,
-                  }),
-                );
+                return yield* NeedsReauth.make({
+                  provider: PLANETSCALE_AUTH_PROVIDER_NAME,
+                  profile: profileName,
+                  message: `Planetscale OAuth credentials for profile '${profileName}' were issued to an incompatible OAuth client and have been removed. ${reauth}`,
+                });
               }
               // Refresh proactively if the token has expired (or is within
               // 10s of expiring). Persist the refreshed creds so subsequent
@@ -371,14 +370,13 @@ export const PlanetscaleAuth = AuthProviderLayer<
                       // Only the refresh round-trip maps to NeedsReauth — a
                       // failed persist afterwards is a local I/O AuthError and
                       // passes through untouched.
-                      Effect.mapError(
-                        (e) =>
-                          new NeedsReauth({
-                            provider: PLANETSCALE_AUTH_PROVIDER_NAME,
-                            profile: profileName,
-                            message: `Planetscale OAuth refresh failed. ${reauth}`,
-                            cause: e,
-                          }),
+                      Effect.mapError((e) =>
+                        NeedsReauth.make({
+                          provider: PLANETSCALE_AUTH_PROVIDER_NAME,
+                          profile: profileName,
+                          message: `Planetscale OAuth refresh failed. ${reauth}`,
+                          cause: e,
+                        }),
                       ),
                     );
               if (fresh !== creds) {
@@ -419,48 +417,47 @@ export const PlanetscaleAuth = AuthProviderLayer<
       config: PlanetscaleAuthConfig,
       updateConfig?: (config: PlanetscaleAuthConfig) => Effect.Effect<void, AuthError>,
     ) =>
-      Match.value(config)
-        .pipe(
-          Match.when({ method: "stored" }, (stored) => Effect.succeed(stored)),
-          Match.when({ method: "oauth" }, (oauth) =>
-            Effect.gen(function* () {
-              const credentials: OAuthClient.OAuthCredentials = {
-                type: "oauth",
-                clientId: oauth.clientId,
-                access: Redacted.make(oauth.access),
-                refresh: Redacted.make(oauth.refresh),
-                expires: oauth.expires,
-                scopes: oauth.scopes,
-              };
-              if (!OAuthClient.usesCurrentClient(credentials)) {
-                return yield* configureOAuth(profileName);
-              }
-              const refreshed = yield* withProfileCredentialsLock(
-                profileName,
-                interaction.output.info("Planetscale: refreshing OAuth credentials...").pipe(
-                  Effect.andThen(OAuthClient.refresh(credentials)),
-                  Effect.flatMap((credentials) => {
-                    const config = {
-                      ...oauth,
-                      clientId: credentials.clientId,
-                      access: Redacted.value(credentials.access),
-                      refresh: Redacted.value(credentials.refresh),
-                      expires: credentials.expires,
-                      scopes: credentials.scopes,
-                    };
-                    return (updateConfig?.(config) ?? Effect.void).pipe(Effect.as(config));
-                  }),
-                  Effect.tap(() =>
-                    interaction.output.success("Planetscale: OAuth credentials refreshed."),
-                  ),
+      Match.value(config).pipe(
+        Match.when({ method: "stored" }, (stored) => Effect.succeed(stored)),
+        Match.when({ method: "oauth" }, (oauth) =>
+          Effect.gen(function* () {
+            const credentials: OAuthClient.OAuthCredentials = {
+              type: "oauth",
+              clientId: oauth.clientId,
+              access: Redacted.make(oauth.access),
+              refresh: Redacted.make(oauth.refresh),
+              expires: oauth.expires,
+              scopes: oauth.scopes,
+            };
+            if (!OAuthClient.usesCurrentClient(credentials)) {
+              return yield* configureOAuth(profileName);
+            }
+            const refreshed = yield* withProfileCredentialsLock(
+              profileName,
+              interaction.output.info("Planetscale: refreshing OAuth credentials...").pipe(
+                Effect.andThen(OAuthClient.refresh(credentials)),
+                Effect.flatMap((credentials) => {
+                  const config = {
+                    ...oauth,
+                    clientId: credentials.clientId,
+                    access: Redacted.value(credentials.access),
+                    refresh: Redacted.value(credentials.refresh),
+                    expires: credentials.expires,
+                    scopes: credentials.scopes,
+                  };
+                  return (updateConfig?.(config) ?? Effect.void).pipe(Effect.as(config));
+                }),
+                Effect.tap(() =>
+                  interaction.output.success("Planetscale: OAuth credentials refreshed."),
                 ),
-              ).pipe(Effect.catchTag("OAuthError", () => configureOAuth(profileName)));
-              return refreshed;
-            }),
-          ),
-          Match.exhaustive,
-        )
-        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
+              ),
+            ).pipe(Effect.catchTag("OAuthError", () => configureOAuth(profileName)));
+            return refreshed;
+          }),
+        ),
+        Match.exhaustive,
+        Effect.mapError((e) => AuthError.make({ message: "login failed", cause: e })),
+      );
 
     const details = (
       profileName: string,