@cloudflare/workers-auth 0.13.0 → 0.14.0

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-DDVG6IGi.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DCQufwLw.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-DCQufwLw.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-DLf_MRuS.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DIwv0hwY.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-DIwv0hwY.mjs';
 import '@cloudflare/workers-utils';
 
 /**
@@ -14,7 +14,7 @@ declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
 declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
 declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
 
-declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "account_api_tokens:create", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "k2.consume", "k2.produce", "k2.read", "k2.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-observability.read", "zone-observability.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
+declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "account_api_tokens:create", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "hyperdrive-planetscale:setup", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "k2.consume", "k2.produce", "k2.read", "k2.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-observability.read", "zone-observability.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
 type ClientRegisteredScope = (typeof CF_CLIENT_REGISTERED_SCOPES)[number];
 declare const CF_REGISTERED_BUT_UNGRANTABLE_SCOPES: readonly ["billing:read", "billing:write", "email_routing:read", "email_sending:read", "notebook-managed:read", "oauth_account_ssl_and_certificates_write"];
 type UngrantableScope = (typeof CF_REGISTERED_BUT_UNGRANTABLE_SCOPES)[number];

package/dist/cf/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-PGZZHNWG.mjs';
-import '../chunk-NDZDTP46.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-F2REEYJC.mjs';
+import '../chunk-2K52M2W5.mjs';
 import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -77,6 +77,7 @@ var CF_CLIENT_REGISTERED_SCOPES = [
   "email_sending:read",
   "email_sending:write",
   "firstpartytags:write",
+  "hyperdrive-planetscale:setup",
   "images:read",
   "images:write",
   "lb:edit",
@@ -526,13 +527,21 @@ var CF_REGISTERED_BUT_UNGRANTABLE_SCOPES = [
   "notebook-managed:read",
   "oauth_account_ssl_and_certificates_write"
 ];
+var CF_EXPLICIT_ONLY_SCOPES = [
+  "hyperdrive-planetscale:setup"
+];
 var CF_UNGRANTABLE_SCOPE_SET = new Set(
   CF_REGISTERED_BUT_UNGRANTABLE_SCOPES
 );
 var CF_REQUESTABLE_SCOPES = CF_CLIENT_REGISTERED_SCOPES.filter(
   (scope) => !CF_UNGRANTABLE_SCOPE_SET.has(scope)
 );
-var DefaultScopeKeys = [...CF_REQUESTABLE_SCOPES];
+var CF_EXPLICIT_ONLY_SCOPE_SET = new Set(
+  CF_EXPLICIT_ONLY_SCOPES
+);
+var DefaultScopeKeys = CF_REQUESTABLE_SCOPES.filter(
+  (scope) => !CF_EXPLICIT_ONLY_SCOPE_SET.has(scope)
+);
 function setLoginScopeKeys(scopes) {
   DefaultScopeKeys = scopes;
 }
@@ -574,6 +583,7 @@ var CF_CLI = {
   displayName: CF_DISPLAY_NAME,
   commands: {
     login: "cf auth login",
+    logout: "cf auth logout",
     whoami: "cf auth whoami",
     createProfile: "cf auth create",
     deviceLogin: "cf auth login"

package/dist/{chunk-NDZDTP46.mjs → chunk-2K52M2W5.mjs}

@@ -254,7 +254,7 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
   );
   if (output.error) {
     throw new UserError(
-      "To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
+      `To use ${options.cliDisplayName} with Cloudflare Access, please install \`cloudflared\` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation`,
       { telemetryMessage: "user access missing cloudflared" }
     );
   }
@@ -541,7 +541,7 @@ function getCachedTemporaryPreviewAccount(storage) {
   return temporaryPreviewAccount;
 }
 __name(getCachedTemporaryPreviewAccount, "getCachedTemporaryPreviewAccount");
-async function requestPowSolution(temporaryAccountLogger) {
+async function requestPowSolution(temporaryAccountLogger, cliDisplayName) {
   const response = await fetch(getTemporaryPreviewChallengeUrl(), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -573,7 +573,7 @@ async function requestPowSolution(temporaryAccountLogger) {
   }
   if (!Number.isInteger(k) || !Number.isInteger(g) || k <= 0 || g <= 0 || k * g > POW_MAX_ITERATIONS || Buffer.from(seed, "base64url").length !== 32) {
     throw new FatalError(
-      "The proof-of-work challenge is not supported by this version of Wrangler.",
+      `The proof-of-work challenge is not supported by this version of ${cliDisplayName}.`,
       {
         telemetryMessage: "deploy temporary account challenge difficulty unsupported"
       }
@@ -583,8 +583,8 @@ async function requestPowSolution(temporaryAccountLogger) {
   return solveChallenge({ challengeToken, seed, k, g });
 }
 __name(requestPowSolution, "requestPowSolution");
-async function createTemporaryPreviewAccount(temporaryAccountLogger, request) {
-  const pow = await requestPowSolution(temporaryAccountLogger);
+async function createTemporaryPreviewAccount(temporaryAccountLogger, request, cliDisplayName = "Wrangler") {
+  const pow = await requestPowSolution(temporaryAccountLogger, cliDisplayName);
   const response = await fetch(getTemporaryPreviewUrl(), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -661,7 +661,7 @@ async function getOrCreateTemporaryPreviewAccount(options) {
   if (cachedPreviewAccount) {
     if (options.request?.eventCode) {
       throw new UserError(
-        "A temporary account is already cached. Rerun without --event-code to reuse it, or run `wrangler logout` and retry to create an account for this event.",
+        `A temporary account is already cached. Rerun without --event-code to reuse it, or run \`${options.logoutCommand ?? "wrangler logout"}\` and retry to create an account for this event.`,
         {
           telemetryMessage: "deploy temporary event cache conflict"
         }
@@ -680,7 +680,8 @@ async function getOrCreateTemporaryPreviewAccount(options) {
   }
   const temporaryPreviewAccount = await createTemporaryPreviewAccount(
     options.temporaryAccountLogger,
-    options.request
+    options.request,
+    options.cliDisplayName
   );
   options.storage.write(temporaryPreviewAccount);
   return { account: temporaryPreviewAccount, cached: false };
@@ -975,6 +976,7 @@ function toErrorClass(rawError, description, uri) {
   return error;
 }
 __name(toErrorClass, "toErrorClass");
+var TOKEN_REQUEST_TIMEOUT_MS = 3e4;
 function isReturningFromAuthServer(query, state, logger) {
   if (query.error) {
     const error = Array.isArray(query.error) ? query.error[0] : query.error;
@@ -1021,7 +1023,7 @@ async function getAuthURL(scopes, clientId, redirectUri, state, generators) {
   });
 }
 __name(getAuthURL, "getAuthURL");
-async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI2, clientId, storage) {
+async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI2, clientId, storage, cliDisplayName) {
   const storedRefreshToken = readStoredAuthState({
     warningLogger: logger,
     storage
@@ -1034,7 +1036,12 @@ async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI2,
     refresh_token: storedRefreshToken?.value ?? "",
     client_id: clientId
   });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI2);
+  const response = await fetchAuthToken(
+    params,
+    logger,
+    isNonInteractiveOrCI2,
+    cliDisplayName
+  );
   if (response.status >= 400) {
     let tokenExchangeResErr = void 0;
     try {
@@ -1081,7 +1088,7 @@ async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI2,
   }
 }
 __name(exchangeRefreshTokenForAccessToken, "exchangeRefreshTokenForAccessToken");
-async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI2, clientId, redirectUri) {
+async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI2, clientId, redirectUri, cliDisplayName) {
   const { authorizationCode, codeVerifier = "" } = state;
   if (!codeVerifier) {
     logger.warn("No code verifier is being sent.");
@@ -1095,7 +1102,12 @@ async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrC
     client_id: clientId,
     code_verifier: codeVerifier
   });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI2);
+  const response = await fetchAuthToken(
+    params,
+    logger,
+    isNonInteractiveOrCI2,
+    cliDisplayName
+  );
   if (!response.ok) {
     const { error } = await getJSONFromResponse(response, logger);
     if (error === "invalid_grant") {
@@ -1123,7 +1135,7 @@ async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrC
   return accessContext;
 }
 __name(exchangeAuthCodeForAccessToken, "exchangeAuthCodeForAccessToken");
-async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
+async function fetchAuthToken(body, logger, isNonInteractiveOrCI2, cliDisplayName) {
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded"
   };
@@ -1137,7 +1149,8 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
     );
     const accessHeaders = await getCloudflareAccessHeaders({
       logger,
-      isNonInteractiveOrCI: isNonInteractiveOrCI2
+      isNonInteractiveOrCI: isNonInteractiveOrCI2,
+      cliDisplayName
     });
     Object.assign(headers, accessHeaders);
   }
@@ -1146,7 +1159,8 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
     const response = await fetch(getTokenUrlFromEnv(), {
       method: "POST",
       body: body.toString(),
-      headers
+      headers,
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
     });
     if (!response.ok) {
       logger.debug(
@@ -1159,7 +1173,7 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
   } catch (e) {
     logger.debug("Failed to fetch auth token:", e);
     const cause = e?.cause;
-    const code = typeof cause?.code === "string" ? ` (${cause.code})` : "";
+    const code = e?.name === "TimeoutError" ? ` (timed out after ${TOKEN_REQUEST_TIMEOUT_MS / 1e3} seconds)` : typeof cause?.code === "string" ? ` (${cause.code})` : "";
     throw new ErrorAuthServerUnreachable(
       `Could not reach the Cloudflare auth server at ${getTokenUrlFromEnv()}${code}.`,
       { cause: e, telemetryMessage: "user oauth token endpoint unreachable" }
@@ -1194,6 +1208,44 @@ async function getJSONFromResponse(response, logger) {
 __name(getJSONFromResponse, "getJSONFromResponse");
 
 // src/callback-server.ts
+function renderOauthErrorPage(cliDisplayName, detail) {
+  const escape = /* @__PURE__ */ __name((value) => value.replace(
+    /[&<>"']/g,
+    (character) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    })[character]
+  ), "escape");
+  const codeRow = detail.code ? `<p>Code: <code>${escape(detail.code)}</code></p>` : "";
+  const descriptionRow = detail.description ? `<p class="detail">${escape(detail.description)}</p>` : "";
+  const escapedDisplayName = escape(cliDisplayName);
+  return esm_default`
+		<!doctype html>
+		<html lang="en">
+		<head>
+		  <meta charset="utf-8" />
+		  <title>${escapedDisplayName} login failed</title>
+		  <style>
+		    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
+		    h1 { color: #c12d3f; }
+		    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
+		    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
+		  </style>
+		</head>
+		<body>
+		  <h1>${escapedDisplayName} login failed</h1>
+		  <p>The Cloudflare OAuth provider returned an error.</p>
+		  ${codeRow}
+		  ${descriptionRow}
+		  <p>You can close this tab and return to your terminal for more details.</p>
+		</body>
+		</html>
+	`;
+}
+__name(renderOauthErrorPage, "renderOauthErrorPage");
 async function getOauthToken(options, state, ctx, generators) {
   const urlToOpen = await getAuthURL(
     options.scopes,
@@ -1235,40 +1287,8 @@ async function getOauthToken(options, state, ctx, generators) {
       }
       __name(finish, "finish");
       function renderErrorPage(detail) {
-        const escape = /* @__PURE__ */ __name((s) => s.replace(
-          /[&<>"']/g,
-          (c) => ({
-            "&": "&amp;",
-            "<": "&lt;",
-            ">": "&gt;",
-            '"': "&quot;",
-            "'": "&#39;"
-          })[c]
-        ), "escape");
-        const codeRow = detail.code ? `<p>Code: <code>${escape(detail.code)}</code></p>` : "";
-        const descriptionRow = detail.description ? `<p class="detail">${escape(detail.description)}</p>` : "";
-        const body = `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <title>Wrangler login failed</title>
-  <style>
-    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
-    h1 { color: #c12d3f; }
-    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
-    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
-  </style>
-</head>
-<body>
-  <h1>Wrangler login failed</h1>
-  <p>The Cloudflare OAuth provider returned an error.</p>
-  ${codeRow}
-  ${descriptionRow}
-  <p>You can close this tab and return to your terminal for more details.</p>
-</body>
-</html>`;
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(body);
+        res.end(renderOauthErrorPage(ctx.cliDisplayName, detail));
       }
       __name(renderErrorPage, "renderErrorPage");
       assert2(req.url, "This request doesn't have a URL");
@@ -1321,7 +1341,8 @@ async function getOauthToken(options, state, ctx, generators) {
               ctx.logger,
               ctx.isNonInteractiveOrCI,
               options.clientId,
-              options.redirectUri
+              options.redirectUri,
+              ctx.cliDisplayName
             );
             res.writeHead(307, {
               Location: options.granted.url
@@ -1453,7 +1474,7 @@ async function readJson(response, logger) {
   }
 }
 __name(readJson, "readJson");
-async function buildDeviceAuthHeaders(logger, isNonInteractiveOrCI2) {
+async function buildDeviceAuthHeaders(logger, isNonInteractiveOrCI2, cliDisplayName) {
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded"
   };
@@ -1463,18 +1484,26 @@ async function buildDeviceAuthHeaders(logger, isNonInteractiveOrCI2) {
     );
     Object.assign(
       headers,
-      await getCloudflareAccessHeaders({ logger, isNonInteractiveOrCI: isNonInteractiveOrCI2 })
+      await getCloudflareAccessHeaders({
+        logger,
+        isNonInteractiveOrCI: isNonInteractiveOrCI2,
+        cliDisplayName
+      })
     );
   }
   return headers;
 }
 __name(buildDeviceAuthHeaders, "buildDeviceAuthHeaders");
-async function requestDeviceAuthorization(scopes, clientId, logger, isNonInteractiveOrCI2) {
+async function requestDeviceAuthorization(scopes, clientId, logger, isNonInteractiveOrCI2, cliDisplayName) {
   const params = new URLSearchParams({
     client_id: clientId,
     scope: [...scopes, "offline_access"].join(" ")
   });
-  const headers = await buildDeviceAuthHeaders(logger, isNonInteractiveOrCI2);
+  const headers = await buildDeviceAuthHeaders(
+    logger,
+    isNonInteractiveOrCI2,
+    cliDisplayName
+  );
   const deviceAuthUrl = getDeviceAuthUrl();
   logger.debug("Fetching device authorization from", deviceAuthUrl);
   const response = await fetch(deviceAuthUrl, {
@@ -1502,13 +1531,18 @@ Enable debug logging to see the full response.`,
   return deviceAuth;
 }
 __name(requestDeviceAuthorization, "requestDeviceAuthorization");
-async function pollDeviceToken(deviceCode, clientId, logger, isNonInteractiveOrCI2) {
+async function pollDeviceToken(deviceCode, clientId, logger, isNonInteractiveOrCI2, cliDisplayName) {
   const params = new URLSearchParams({
     grant_type: "urn:ietf:params:oauth:grant-type:device_code",
     device_code: deviceCode,
     client_id: clientId
   });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI2);
+  const response = await fetchAuthToken(
+    params,
+    logger,
+    isNonInteractiveOrCI2,
+    cliDisplayName
+  );
   const body = await readJson(response, logger);
   const error = getStringMember(body, "error");
   if (error !== void 0) {
@@ -1547,7 +1581,8 @@ async function getOauthTokenViaDeviceFlow(options, ctx) {
     options.scopes,
     options.clientId,
     logger,
-    isNonInteractiveOrCI2
+    isNonInteractiveOrCI2,
+    ctx.cliDisplayName
   );
   const authDomain = getAuthDomainFromEnv();
   assertTrustedVerificationUrl(deviceAuth.verification_uri, {
@@ -1570,7 +1605,7 @@ async function getOauthTokenViaDeviceFlow(options, ctx) {
   );
   logger.log(
     esm_default`
-		To authorize ${ctx.displayName}, please visit:
+		To authorize ${ctx.cliDisplayName}, please visit:
 
 		  ${deviceAuth.verification_uri}
 
@@ -1604,7 +1639,8 @@ Opening a link in your default browser: ${verificationUrl}`);
         deviceAuth.device_code,
         options.clientId,
         logger,
-        isNonInteractiveOrCI2
+        isNonInteractiveOrCI2,
+        ctx.cliDisplayName
       );
     } catch (e) {
       logger.debug("Ignoring transient error while polling for token:", e);
@@ -1636,7 +1672,7 @@ Enable debug logging to see the full response.`,
           continue;
         case "access_denied":
           throw new UserError(
-            `Consent denied. You must grant consent to ${ctx.displayName} in order to login.
+            `Consent denied. You must grant consent to ${ctx.cliDisplayName} in order to login.
 If you don't want to do this consider passing an API token via the \`CLOUDFLARE_API_TOKEN\` environment variable.`,
             { telemetryMessage: "user device-flow consent denied" }
           );
@@ -1801,7 +1837,8 @@ function createOAuthFlow(ctx) {
         ctx.logger,
         ctx.isNonInteractiveOrCI,
         getClientId(),
-        storage
+        storage,
+        ctx.cliDisplayName
       );
       storage.write({
         oauth_token,
@@ -1814,7 +1851,7 @@ function createOAuthFlow(ctx) {
       ctx.logger.debug(
         `Token refresh failed: ${e instanceof Error ? e.message : String(e)}`
       );
-      return e instanceof ErrorAuthServerUnreachable ? "unreachable" : "rejected";
+      return e instanceof ErrorAuthServerUnreachable || e instanceof Error && e.name === "TimeoutError" ? "unreachable" : "rejected";
     }
   }
   __name(refreshToken, "refreshToken");
@@ -1951,7 +1988,7 @@ function createOAuthFlow(ctx) {
   async function activateTemporaryAccount() {
     if (!ctx.temporary) {
       throw new UserError(
-        "Temporary preview accounts are not supported by this CLI.",
+        `Temporary preview accounts are not supported by ${ctx.cliDisplayName}.`,
         { telemetryMessage: "user temporary account unsupported" }
       );
     }

package/dist/{chunk-PGZZHNWG.mjs → chunk-F2REEYJC.mjs}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-NDZDTP46.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-2K52M2W5.mjs';
 import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -814,7 +814,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     purgeOnLoginOrLogout: configCache.purgeConfigCaches,
     clientId: descriptor.clientId,
     consent: descriptor.consent,
-    displayName: descriptor.displayName,
+    cliDisplayName: descriptor.displayName,
     deviceLoginCommand: descriptor.commands.deviceLogin,
     redirectUri: descriptor.redirectUri,
     storageFactory: credentialStorage.storageFactory,
@@ -827,6 +827,8 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
         descriptor.fileFormat,
         descriptor.getTemporaryAccountConfigPath
       ),
+      cliDisplayName: descriptor.displayName,
+      logoutCommand: descriptor.commands.logout,
       prompt: createTemporaryTermsPrompt({
         temporaryAccountLogger,
         prompt: ctx.prompt

package/dist/{file-format-DDVG6IGi.d.mts → file-format-DLf_MRuS.d.mts}

@@ -97,6 +97,10 @@ declare function generateRandomState(lengthOfState: number): string;
 interface OAuthFlowTemporaryContext {
     /** Persistence backend for the cached temporary preview account. */
     storage: TemporaryAccountStorage;
+    /** Consumer name used in temporary-account errors. */
+    cliDisplayName?: string;
+    /** Consumer command used to clear a cached temporary account. */
+    logoutCommand?: string;
     /**
      * Hook to customise the terms-acceptance interactive prompt
      *  - question: the question to ask a user in interactive mode.
@@ -195,7 +199,7 @@ interface OAuthFlowContext {
      * into the copy the flow prints to the user — "To authorize <name>, please
      * visit ...". Consumer-specific, so it is required.
      */
-    displayName: string;
+    cliDisplayName: string;
     /**
      * The command that restarts the device authorization flow (e.g.
      * `"wrangler login --device"`), quoted when a device code is denied,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-DDVG6IGi.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-DDVG6IGi.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-DLf_MRuS.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-DLf_MRuS.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 
@@ -54,11 +54,8 @@ declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger, previ
  * Get the headers needed to authenticate with an Access-protected domain.
  *
  * @param domain The hostname of the Access-protected domain (e.g. `"example.com"`).
- * @param options logger + an `isNonInteractiveOrCI` predicate used to
- *   produce an actionable error in CI (both default to no-op / `false`), plus an
- *   optional `previewToken` that is added as the `cf_workers_preview_token`
- *   query parameter when probing for Access and when invoking `cloudflared
- *   access login`, so detection works on unpublished `<name>.workers.dev` hosts.
+ * @param options Logger, interactivity, CLI presentation, cancellation, and
+ *   optional preview-token inputs for Access authentication.
  * @returns
  * - Service token headers (`CF-Access-Client-Id` + `CF-Access-Client-Secret`) if env vars are set
  * - A `Cookie: CF_Authorization=...` header if obtained via `cloudflared` (interactive only)
@@ -71,6 +68,8 @@ declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger, previ
 declare function getAccessHeaders(domain: string, options: {
     logger: OAuthFlowLogger;
     isNonInteractiveOrCI?: () => boolean;
+    /** Consumer name used in actionable error messages. */
+    cliDisplayName: string;
     /** Aborts a pending `cloudflared` authorization and kills its process. */
     signal?: AbortSignal;
     /**

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-NDZDTP46.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-2K52M2W5.mjs';
 import './chunk-VAZEJK55.mjs';
 
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-DCQufwLw.d.mts → keyring-preference-DIwv0hwY.d.mts}

@@ -1,4 +1,4 @@
-import { f as OAuthFlowContext, m as TemporaryAccountLogger, n as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-DDVG6IGi.mjs';
+import { f as OAuthFlowContext, m as TemporaryAccountLogger, n as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-DLf_MRuS.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */
@@ -63,6 +63,8 @@ interface CliDescriptor {
     /** Commands surfaced in auth guidance. */
     commands: {
         login: string;
+        /** Command that clears cached auth state. */
+        logout: string;
         whoami: string;
         createProfile: string;
         /**