@cloudflare/workers-auth 0.15.6 → 0.17.0

package/dist/cf/index.d.mts

@@ -1,7 +1,7 @@
 import { b as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, g as OAuthFlowContext, h as ProfileStore } from '../authentication-error-DcqALFv6.mjs';
 export { a as AuthenticationError } from '../authentication-error-DcqALFv6.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DGkctqNO.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-DGkctqNO.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-BUyxOJDK.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-BUyxOJDK.mjs';
 import '@cloudflare/workers-utils';
 
 /**
@@ -15,12 +15,12 @@ declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
 declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
 declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
 
-declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "account_api_tokens:create", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "hyperdrive-planetscale:setup", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "k2.consume", "k2.produce", "k2.read", "k2.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-api-tokens.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-observability.read", "zone-observability.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
+declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "account_api_tokens:create", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "hyperdrive-planetscale.setup", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "k2.consume", "k2.produce", "k2.read", "k2.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-api-tokens.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-observability.read", "zone-observability.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
 type ClientRegisteredScope = (typeof CF_CLIENT_REGISTERED_SCOPES)[number];
 declare const CF_REGISTERED_BUT_UNGRANTABLE_SCOPES: readonly ["billing:read", "billing:write", "email_routing:read", "email_sending:read", "notebook-managed:read", "oauth_account_ssl_and_certificates_write"];
 type UngrantableScope = (typeof CF_REGISTERED_BUT_UNGRANTABLE_SCOPES)[number];
 /**
- * The possible explicitly requestable keys for a cf Scope.
+ * The possible requestable keys for a cf Scope.
  *
  * "offline_access" is automatically included.
  */

package/dist/cf/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-YWQXTXOY.mjs';
-export { AuthenticationError } from '../chunk-SOBRPAPT.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-MP32ZADQ.mjs';
+export { AuthenticationError } from '../chunk-H5PZ3FJ2.mjs';
 import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -77,7 +77,6 @@ var CF_CLIENT_REGISTERED_SCOPES = [
   "email_sending:read",
   "email_sending:write",
   "firstpartytags:write",
-  "hyperdrive-planetscale:setup",
   "images:read",
   "images:write",
   "lb:edit",
@@ -331,6 +330,7 @@ var CF_CLIENT_REGISTERED_SCOPES = [
   "fraud-feedback.write",
   "healthcheck.read",
   "healthcheck.write",
+  "hyperdrive-planetscale.setup",
   "http-applications.read",
   "http-applications.write",
   "http-ddos-managed-ruleset.read",
@@ -528,21 +528,13 @@ var CF_REGISTERED_BUT_UNGRANTABLE_SCOPES = [
   "notebook-managed:read",
   "oauth_account_ssl_and_certificates_write"
 ];
-var CF_EXPLICIT_ONLY_SCOPES = [
-  "hyperdrive-planetscale:setup"
-];
 var CF_UNGRANTABLE_SCOPE_SET = new Set(
   CF_REGISTERED_BUT_UNGRANTABLE_SCOPES
 );
 var CF_REQUESTABLE_SCOPES = CF_CLIENT_REGISTERED_SCOPES.filter(
   (scope) => !CF_UNGRANTABLE_SCOPE_SET.has(scope)
 );
-var CF_EXPLICIT_ONLY_SCOPE_SET = new Set(
-  CF_EXPLICIT_ONLY_SCOPES
-);
-var DefaultScopeKeys = CF_REQUESTABLE_SCOPES.filter(
-  (scope) => !CF_EXPLICIT_ONLY_SCOPE_SET.has(scope)
-);
+var DefaultScopeKeys = [...CF_REQUESTABLE_SCOPES];
 function setLoginScopeKeys(scopes) {
   DefaultScopeKeys = scopes;
 }
@@ -605,9 +597,8 @@ var CF_CLI = {
   // cf gets its own cache dir (`.cache/cloudflare` / `.cloudflare/cache`) so
   // `cf auth login`/`logout` never purges wrangler's shared cache.
   cacheNamespace: "cloudflare",
-  // cf persists its default account in `config.json` (`defaults.accountId`);
-  // this label is surfaced in the "set account_id in your <file>" hint.
-  getConfigFileLabel: /* @__PURE__ */ __name(() => "cf config", "getConfigFileLabel"),
+  // This label is surfaced in shared account configuration hints.
+  getConfigFileLabel: /* @__PURE__ */ __name(() => "cloudflare.config.ts", "getConfigFileLabel"),
   getDefaultScopeKeys: /* @__PURE__ */ __name(() => DefaultScopeKeys, "getDefaultScopeKeys")
 };
 var cfPreferences = createPreferences(getCfConfigPath);

package/dist/{chunk-SOBRPAPT.mjs → chunk-H5PZ3FJ2.mjs}

@@ -114,6 +114,9 @@ function validateAccountId(accountId, source) {
 __name(validateAccountId, "validateAccountId");
 
 // src/env-vars.ts
+var getCloudflareAuthProfileFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_AUTH_PROFILE"
+});
 var getAuthDomainFromEnv = getEnvironmentVariableFactory({
   variableName: "WRANGLER_AUTH_DOMAIN",
   defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "dash.staging.cloudflare.com" : "dash.cloudflare.com", "defaultValue")
@@ -2140,12 +2143,13 @@ function createProfileStore(args) {
     configs: args.configs,
     bindings,
     resolve(resolveArgs) {
-      if (resolveArgs.profile) {
-        if (resolveArgs.profile === "default") {
+      const profile = resolveArgs.profile || getCloudflareAuthProfileFromEnv();
+      if (profile) {
+        if (profile === "default") {
           return "default";
         }
-        validateProfileName(resolveArgs.profile);
-        return resolveArgs.profile;
+        validateProfileName(profile);
+        return profile;
       }
       const dirProfile = bindings.getProfileForDirectory(resolveArgs.cwd);
       if (dirProfile) {
@@ -3670,4 +3674,4 @@ smol-toml/dist/index.js:
    *)
 */
 
-export { AuthenticationError, DEFAULT_TEMPORARY_ACCOUNT_FLAG, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };
+export { AuthenticationError, DEFAULT_TEMPORARY_ACCOUNT_FLAG, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };

package/dist/{chunk-YWQXTXOY.mjs → chunk-MP32ZADQ.mjs}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { stringifyFile, parseFile, dedent, DEFAULT_TEMPORARY_ACCOUNT_FLAG, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, AuthenticationError, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-SOBRPAPT.mjs';
+import { stringifyFile, parseFile, dedent, DEFAULT_TEMPORARY_ACCOUNT_FLAG, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, AuthenticationError, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-H5PZ3FJ2.mjs';
 import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -793,10 +793,22 @@ function createCloudflareAuth(descriptor, ctx) {
   const NOT_LOGGED_IN_WHOAMI_TIP = `
 Run \`${descriptor.commands.whoami}\` to check your current authentication status.`;
   const preferences = createPreferences(descriptor.getConfigPath);
+  const persistAccountSelection = descriptor.persistAccountSelection ?? false;
   const configCache = createConfigCache(
     logger,
     descriptor.cacheNamespace ? { namespace: descriptor.cacheNamespace } : void 0
   );
+  let accountSelection;
+  let accountSelectionPromise;
+  function clearAccountSelection() {
+    accountSelection = void 0;
+  }
+  __name(clearAccountSelection, "clearAccountSelection");
+  function purgeAccountCaches() {
+    clearAccountSelection();
+    configCache.purgeConfigCaches();
+  }
+  __name(purgeAccountCaches, "purgeAccountCaches");
   const credentialStorage = createCredentialStorageContext({
     serviceName: descriptor.keyringServiceName,
     getConfigPath: descriptor.getConfigPath,
@@ -812,7 +824,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     isNonInteractiveOrCI: isNonInteractiveOrCI,
     openInBrowser: /* @__PURE__ */ __name((url) => openInBrowser(url, logger), "openInBrowser"),
     hasEnvCredentials: /* @__PURE__ */ __name(() => getAuthFromEnv({ allowGlobalAuthKey }) !== void 0, "hasEnvCredentials"),
-    purgeOnLoginOrLogout: configCache.purgeConfigCaches,
+    purgeOnLoginOrLogout: purgeAccountCaches,
     clientId: descriptor.clientId,
     consent: descriptor.consent,
     cliDisplayName: descriptor.displayName,
@@ -904,6 +916,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
   }
   __name(readAuthCredentials, "readAuthCredentials");
   function writeAuthCredentials(config) {
+    clearAccountSelection();
     credentialStorage.storageFactory(getActiveProfile()).write(config);
   }
   __name(writeAuthCredentials, "writeAuthCredentials");
@@ -915,14 +928,34 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     return `${descriptor.accountCachePrefix}-${profile}.json`;
   }
   __name(getAccountCacheFileName, "getAccountCacheFileName");
-  function saveAccountToCache(account) {
-    configCache.saveToConfigCache(
-      getAccountCacheFileName(),
-      { account }
-    );
+  function retainAccountSelection(account) {
+    accountSelection = {
+      account,
+      profile: getActiveProfile()
+    };
+    if (persistAccountSelection) {
+      configCache.saveToConfigCache(
+        getAccountCacheFileName(),
+        { account }
+      );
+    }
   }
-  __name(saveAccountToCache, "saveAccountToCache");
+  __name(retainAccountSelection, "retainAccountSelection");
+  function resolveAccountSelection() {
+    const profile = getActiveProfile();
+    if (persistAccountSelection) {
+      const account = getAccountFromCache();
+      accountSelection = account ? { account, profile } : void 0;
+    } else if (accountSelection?.profile !== profile) {
+      clearAccountSelection();
+    }
+    return accountSelection?.account;
+  }
+  __name(resolveAccountSelection, "resolveAccountSelection");
   function getAccountFromCache() {
+    if (!persistAccountSelection) {
+      return void 0;
+    }
     return configCache.getConfigCache(
       getAccountCacheFileName()
     ).account;
@@ -993,13 +1026,13 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
             `Failed to automatically retrieve account IDs for the logged in user.
 You may have incorrect permissions on your API token, or an environment variable such as CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL may be set to an invalid value.
 Check your environment and unset or correct any Cloudflare credential variables, or run \`${descriptor.commands.login}\` to re-authenticate.
-You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+You can also skip this account check by adding an account ID to your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
             { telemetryMessage: "user account fetch permission denied" }
           );
         }
         throw new UserError(
           `Failed to automatically retrieve account IDs for the logged in user.
-You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${descriptor.commands.login}\` to re-authenticate. You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${descriptor.commands.login}\` to re-authenticate. You can also skip this account check by adding an account ID to your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
           { telemetryMessage: "user account fetch permission denied" }
         );
       } else {
@@ -1015,7 +1048,7 @@ You may have incorrect permissions on your API token, or your authentication may
     if (usableAccounts.length === 0 && throwOnEmpty) {
       throw new UserError(
         `Failed to automatically retrieve account IDs for the logged in user.
-In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or as \`account_id\` in your ${descriptor.getConfigFileLabel()} file.
+In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or in your ${descriptor.getConfigFileLabel()} file.
 Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`,
         { telemetryMessage: "user account fetch empty" }
       );
@@ -1031,24 +1064,20 @@ Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`
     if (config.account_id) {
       return validateAccountId(
         config.account_id,
-        `set as \`account_id\` in your ${descriptor.getConfigFileLabel()} file`
+        `set in your ${descriptor.getConfigFileLabel()} file`
       );
     }
     const envAccountId = getCloudflareAccountIdFromEnv();
     if (envAccountId) {
       return envAccountId;
     }
-    return getAccountFromCache()?.id;
+    return resolveAccountSelection()?.id;
   }
   __name(getActiveAccountId, "getActiveAccountId");
-  async function getOrSelectAccountId(config) {
-    const activeAccountId = getActiveAccountId(config);
-    if (activeAccountId) {
-      return activeAccountId;
-    }
+  async function selectAccountId(config) {
     const accounts = await fetchAllAccounts(config);
     if (accounts.length === 1) {
-      saveAccountToCache({ id: accounts[0].id, name: accounts[0].name });
+      retainAccountSelection({ id: accounts[0].id, name: accounts[0].name });
       return accounts[0].id;
     }
     try {
@@ -1062,14 +1091,14 @@ Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`
       if (!account) {
         throw new Error("Selected account not found in accounts list");
       }
-      saveAccountToCache({ id: account.id, name: account.name });
+      retainAccountSelection({ id: account.id, name: account.name });
       return accountID;
     } catch (e) {
       if (ctx.isNoDefaultValueProvidedError(e)) {
         const redactAccountName = isCI();
         throw new UserError(
           `More than one account available but unable to select one in non-interactive mode.
-Please set the appropriate \`account_id\` in your ${descriptor.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
+Please set the appropriate account ID in your ${descriptor.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
 Available accounts are (\`<name>\`: \`<account_id>\`):
 ${accounts.map(
             (account) => `  \`${redactAccountName ? "(redacted)" : account.name}\`: \`${account.id}\``
@@ -1080,6 +1109,17 @@ ${accounts.map(
       throw e;
     }
   }
+  __name(selectAccountId, "selectAccountId");
+  async function getOrSelectAccountId(config) {
+    const activeAccountId = getActiveAccountId(config);
+    if (activeAccountId) {
+      return activeAccountId;
+    }
+    accountSelectionPromise ??= selectAccountId(config).finally(() => {
+      accountSelectionPromise = void 0;
+    });
+    return accountSelectionPromise;
+  }
   __name(getOrSelectAccountId, "getOrSelectAccountId");
   async function requireAuth(config) {
     if (oauthFlow.isTemporaryAllowed()) {

package/dist/index.d.mts

@@ -80,6 +80,11 @@ declare function getAccessHeaders(domain: string, options: {
     previewToken?: string;
 }): Promise<Record<string, string>>;
 
+/**
+ * Select a named auth profile for this process and its children.
+ * Explicit profile arguments take precedence; directory bindings are the fallback.
+ */
+declare const getCloudflareAuthProfileFromEnv: () => string | undefined;
 /**
  * `WRANGLER_AUTH_URL` is the path that is used to access OAuth
  * for the Cloudflare APIs.
@@ -833,4 +838,4 @@ declare function decryptString(envelope: EncryptedEnvelope, key: Uint8Array): st
  */
 declare function parseEncryptedEnvelope(raw: unknown): EncryptedEnvelope | undefined;
 
-export { AuthConfigStorage, type CredentialStorageBundle, type CredentialStorageContext, CredentialStore, type EncryptedEnvelope, EncryptedFileCredentialStore, FileCredentialStore, type KeyProvider, type KeyProviderResolution, type KeyringEntry, type KeyringEntryFactory, LinuxSecretToolKeyProvider, type LinuxSecretToolRunner, type MacSecurityCommandRunner, MacSecurityKeyProvider, NapiKeyringKeyProvider, type NpmRunner, OAuthFlowLogger, PINNED_KEYRING_VERSION, PKCE_CHARSET, type ScrubEncryptedCredentialsResult, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, UserAuthConfig, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateKey, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner };
+export { AuthConfigStorage, type CredentialStorageBundle, type CredentialStorageContext, CredentialStore, type EncryptedEnvelope, EncryptedFileCredentialStore, FileCredentialStore, type KeyProvider, type KeyProviderResolution, type KeyringEntry, type KeyringEntryFactory, LinuxSecretToolKeyProvider, type LinuxSecretToolRunner, type MacSecurityCommandRunner, MacSecurityKeyProvider, NapiKeyringKeyProvider, type NpmRunner, OAuthFlowLogger, PINNED_KEYRING_VERSION, PKCE_CHARSET, type ScrubEncryptedCredentialsResult, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, UserAuthConfig, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateKey, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-export { AuthenticationError, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-SOBRPAPT.mjs';
+export { AuthenticationError, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-H5PZ3FJ2.mjs';
 import './chunk-VAZEJK55.mjs';
 
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-DGkctqNO.d.mts → keyring-preference-BUyxOJDK.d.mts}

@@ -105,6 +105,12 @@ interface CliDescriptor {
     getTemporaryAccountConfigPath: () => string;
     /** On-disk file format for credentials / temporary-account / profile files. */
     fileFormat: FileFormat;
+    /**
+     * Whether an account selected from the current credentials is persisted in
+     * the config cache for later invocations. When disabled, the selection is
+     * retained only for the lifetime of the auth instance. Defaults to `false`.
+     */
+    persistAccountSelection?: boolean;
     /**
      * Filename prefix for the cached account selection in the config cache
      * (e.g. `"wrangler-account"` → `wrangler-account.json`). Always JSON.
@@ -117,9 +123,9 @@ interface CliDescriptor {
      */
     cacheNamespace?: string;
     /**
-     * Label for the CLI's config file, used in "set `account_id` in your <file>"
-     * hints. A getter so it can reflect runtime config state (wrangler resolves
-     * this from `configFileName(undefined)`).
+     * Label for the CLI's account config file, used in account ID guidance. A
+     * getter so it can reflect runtime config state (wrangler resolves this from
+     * `configFileName(undefined)`).
      */
     getConfigFileLabel: () => string;
     /** The live default OAuth scope keys (a getter so any reassignment of the mutable `DefaultScopeKeys` binding is observed). */
@@ -127,14 +133,14 @@ interface CliDescriptor {
 }
 
 /** Details for one of the user's accounts. */
-type Account = {
+interface Account {
     id: string;
     name: string;
-};
+}
 /** The config surface {@link CloudflareAuth.requireAuth} needs: compliance settings plus an optional `account_id`. */
-type RequireAuthConfig = ComplianceConfig & {
+interface RequireAuthConfig extends ComplianceConfig {
     account_id?: string;
-};
+}
 /** Overrides accepted by {@link CloudflareAuth.login} / {@link CloudflareAuth.loginOrRefreshIfRequired}. */
 interface CloudflareLoginProps {
     scopes?: string[];
@@ -178,7 +184,7 @@ interface CloudflareAuth {
     readAuthCredentials: () => UserAuthConfig | undefined;
     /** Persist OAuth credentials via the active credential store. */
     writeAuthCredentials: (config: UserAuthConfig) => void;
-    /** Returns the active account ID without side effects (config → env → cache). */
+    /** Returns the active account ID without fetching accounts or prompting. */
     getActiveAccountId: (config: {
         account_id?: string;
     }) => string | undefined;