@cloudflare/workers-auth 0.16.0 → 0.18.0

package/dist/cf/index.d.mts

@@ -1,7 +1,7 @@
 import { b as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, g as OAuthFlowContext, h as ProfileStore } from '../authentication-error-DcqALFv6.mjs';
 export { a as AuthenticationError } from '../authentication-error-DcqALFv6.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DGkctqNO.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-DGkctqNO.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-BUyxOJDK.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-BUyxOJDK.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-YWQXTXOY.mjs';
-export { AuthenticationError } from '../chunk-SOBRPAPT.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-PCKGSFVR.mjs';
+export { AuthenticationError } from '../chunk-Q5KVZMHK.mjs';
 import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -597,9 +597,8 @@ var CF_CLI = {
   // cf gets its own cache dir (`.cache/cloudflare` / `.cloudflare/cache`) so
   // `cf auth login`/`logout` never purges wrangler's shared cache.
   cacheNamespace: "cloudflare",
-  // cf persists its default account in `config.json` (`defaults.accountId`);
-  // this label is surfaced in the "set account_id in your <file>" hint.
-  getConfigFileLabel: /* @__PURE__ */ __name(() => "cf config", "getConfigFileLabel"),
+  // This label is surfaced in shared account configuration hints.
+  getConfigFileLabel: /* @__PURE__ */ __name(() => "cloudflare.config.ts", "getConfigFileLabel"),
   getDefaultScopeKeys: /* @__PURE__ */ __name(() => DefaultScopeKeys, "getDefaultScopeKeys")
 };
 var cfPreferences = createPreferences(getCfConfigPath);

package/dist/{chunk-YWQXTXOY.mjs → chunk-PCKGSFVR.mjs}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { stringifyFile, parseFile, dedent, DEFAULT_TEMPORARY_ACCOUNT_FLAG, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, AuthenticationError, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-SOBRPAPT.mjs';
+import { stringifyFile, parseFile, dedent, DEFAULT_TEMPORARY_ACCOUNT_FLAG, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, AuthenticationError, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-Q5KVZMHK.mjs';
 import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -793,10 +793,22 @@ function createCloudflareAuth(descriptor, ctx) {
   const NOT_LOGGED_IN_WHOAMI_TIP = `
 Run \`${descriptor.commands.whoami}\` to check your current authentication status.`;
   const preferences = createPreferences(descriptor.getConfigPath);
+  const persistAccountSelection = descriptor.persistAccountSelection ?? false;
   const configCache = createConfigCache(
     logger,
     descriptor.cacheNamespace ? { namespace: descriptor.cacheNamespace } : void 0
   );
+  let accountSelection;
+  let accountSelectionPromise;
+  function clearAccountSelection() {
+    accountSelection = void 0;
+  }
+  __name(clearAccountSelection, "clearAccountSelection");
+  function purgeAccountCaches() {
+    clearAccountSelection();
+    configCache.purgeConfigCaches();
+  }
+  __name(purgeAccountCaches, "purgeAccountCaches");
   const credentialStorage = createCredentialStorageContext({
     serviceName: descriptor.keyringServiceName,
     getConfigPath: descriptor.getConfigPath,
@@ -812,7 +824,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     isNonInteractiveOrCI: isNonInteractiveOrCI,
     openInBrowser: /* @__PURE__ */ __name((url) => openInBrowser(url, logger), "openInBrowser"),
     hasEnvCredentials: /* @__PURE__ */ __name(() => getAuthFromEnv({ allowGlobalAuthKey }) !== void 0, "hasEnvCredentials"),
-    purgeOnLoginOrLogout: configCache.purgeConfigCaches,
+    purgeOnLoginOrLogout: purgeAccountCaches,
     clientId: descriptor.clientId,
     consent: descriptor.consent,
     cliDisplayName: descriptor.displayName,
@@ -904,6 +916,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
   }
   __name(readAuthCredentials, "readAuthCredentials");
   function writeAuthCredentials(config) {
+    clearAccountSelection();
     credentialStorage.storageFactory(getActiveProfile()).write(config);
   }
   __name(writeAuthCredentials, "writeAuthCredentials");
@@ -915,14 +928,34 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     return `${descriptor.accountCachePrefix}-${profile}.json`;
   }
   __name(getAccountCacheFileName, "getAccountCacheFileName");
-  function saveAccountToCache(account) {
-    configCache.saveToConfigCache(
-      getAccountCacheFileName(),
-      { account }
-    );
+  function retainAccountSelection(account) {
+    accountSelection = {
+      account,
+      profile: getActiveProfile()
+    };
+    if (persistAccountSelection) {
+      configCache.saveToConfigCache(
+        getAccountCacheFileName(),
+        { account }
+      );
+    }
   }
-  __name(saveAccountToCache, "saveAccountToCache");
+  __name(retainAccountSelection, "retainAccountSelection");
+  function resolveAccountSelection() {
+    const profile = getActiveProfile();
+    if (persistAccountSelection) {
+      const account = getAccountFromCache();
+      accountSelection = account ? { account, profile } : void 0;
+    } else if (accountSelection?.profile !== profile) {
+      clearAccountSelection();
+    }
+    return accountSelection?.account;
+  }
+  __name(resolveAccountSelection, "resolveAccountSelection");
   function getAccountFromCache() {
+    if (!persistAccountSelection) {
+      return void 0;
+    }
     return configCache.getConfigCache(
       getAccountCacheFileName()
     ).account;
@@ -993,13 +1026,13 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
             `Failed to automatically retrieve account IDs for the logged in user.
 You may have incorrect permissions on your API token, or an environment variable such as CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL may be set to an invalid value.
 Check your environment and unset or correct any Cloudflare credential variables, or run \`${descriptor.commands.login}\` to re-authenticate.
-You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+You can also skip this account check by adding an account ID to your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
             { telemetryMessage: "user account fetch permission denied" }
           );
         }
         throw new UserError(
           `Failed to automatically retrieve account IDs for the logged in user.
-You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${descriptor.commands.login}\` to re-authenticate. You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${descriptor.commands.login}\` to re-authenticate. You can also skip this account check by adding an account ID to your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
           { telemetryMessage: "user account fetch permission denied" }
         );
       } else {
@@ -1015,7 +1048,7 @@ You may have incorrect permissions on your API token, or your authentication may
     if (usableAccounts.length === 0 && throwOnEmpty) {
       throw new UserError(
         `Failed to automatically retrieve account IDs for the logged in user.
-In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or as \`account_id\` in your ${descriptor.getConfigFileLabel()} file.
+In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or in your ${descriptor.getConfigFileLabel()} file.
 Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`,
         { telemetryMessage: "user account fetch empty" }
       );
@@ -1031,24 +1064,20 @@ Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`
     if (config.account_id) {
       return validateAccountId(
         config.account_id,
-        `set as \`account_id\` in your ${descriptor.getConfigFileLabel()} file`
+        `set in your ${descriptor.getConfigFileLabel()} file`
       );
     }
     const envAccountId = getCloudflareAccountIdFromEnv();
     if (envAccountId) {
       return envAccountId;
     }
-    return getAccountFromCache()?.id;
+    return resolveAccountSelection()?.id;
   }
   __name(getActiveAccountId, "getActiveAccountId");
-  async function getOrSelectAccountId(config) {
-    const activeAccountId = getActiveAccountId(config);
-    if (activeAccountId) {
-      return activeAccountId;
-    }
+  async function selectAccountId(config) {
     const accounts = await fetchAllAccounts(config);
     if (accounts.length === 1) {
-      saveAccountToCache({ id: accounts[0].id, name: accounts[0].name });
+      retainAccountSelection({ id: accounts[0].id, name: accounts[0].name });
       return accounts[0].id;
     }
     try {
@@ -1062,14 +1091,14 @@ Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`
       if (!account) {
         throw new Error("Selected account not found in accounts list");
       }
-      saveAccountToCache({ id: account.id, name: account.name });
+      retainAccountSelection({ id: account.id, name: account.name });
       return accountID;
     } catch (e) {
       if (ctx.isNoDefaultValueProvidedError(e)) {
         const redactAccountName = isCI();
         throw new UserError(
           `More than one account available but unable to select one in non-interactive mode.
-Please set the appropriate \`account_id\` in your ${descriptor.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
+Please set the appropriate account ID in your ${descriptor.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
 Available accounts are (\`<name>\`: \`<account_id>\`):
 ${accounts.map(
             (account) => `  \`${redactAccountName ? "(redacted)" : account.name}\`: \`${account.id}\``
@@ -1080,6 +1109,17 @@ ${accounts.map(
       throw e;
     }
   }
+  __name(selectAccountId, "selectAccountId");
+  async function getOrSelectAccountId(config) {
+    const activeAccountId = getActiveAccountId(config);
+    if (activeAccountId) {
+      return activeAccountId;
+    }
+    accountSelectionPromise ??= selectAccountId(config).finally(() => {
+      accountSelectionPromise = void 0;
+    });
+    return accountSelectionPromise;
+  }
   __name(getOrSelectAccountId, "getOrSelectAccountId");
   async function requireAuth(config) {
     if (oauthFlow.isTemporaryAllowed()) {

package/dist/{chunk-SOBRPAPT.mjs → chunk-Q5KVZMHK.mjs}

@@ -1,8 +1,8 @@
 import { createRequire } from 'node:module';
 import { __name } from './chunk-VAZEJK55.mjs';
-import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, FatalError, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, FatalError, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, addCustomApiHeaders, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
 import { spawn, spawnSync } from 'node:child_process';
-import { fetch } from 'undici';
+import { fetch, Headers } from 'undici';
 import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
 import { TextEncoder } from 'node:util';
 import assert2 from 'node:assert';
@@ -114,6 +114,9 @@ function validateAccountId(accountId, source) {
 __name(validateAccountId, "validateAccountId");
 
 // src/env-vars.ts
+var getCloudflareAuthProfileFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_AUTH_PROFILE"
+});
 var getAuthDomainFromEnv = getEnvironmentVariableFactory({
   variableName: "WRANGLER_AUTH_DOMAIN",
   defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "dash.staging.cloudflare.com" : "dash.cloudflare.com", "defaultValue")
@@ -542,9 +545,11 @@ function getCachedTemporaryPreviewAccount(storage) {
 }
 __name(getCachedTemporaryPreviewAccount, "getCachedTemporaryPreviewAccount");
 async function requestPowSolution(temporaryAccountLogger, cliDisplayName) {
+  const headers = new Headers({ "Content-Type": "application/json" });
+  addCustomApiHeaders(headers);
   const response = await fetch(getTemporaryPreviewChallengeUrl(), {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers,
     body: "{}"
   });
   if (!response.ok) {
@@ -585,9 +590,11 @@ async function requestPowSolution(temporaryAccountLogger, cliDisplayName) {
 __name(requestPowSolution, "requestPowSolution");
 async function createTemporaryPreviewAccount(temporaryAccountLogger, request, cliDisplayName = "Wrangler") {
   const pow = await requestPowSolution(temporaryAccountLogger, cliDisplayName);
+  const headers = new Headers({ "Content-Type": "application/json" });
+  addCustomApiHeaders(headers);
   const response = await fetch(getTemporaryPreviewUrl(), {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers,
     body: JSON.stringify({
       termsOfService: TEMPORARY_TERMS_URLS.termsOfService,
       privacyPolicy: TEMPORARY_TERMS_URLS.privacyPolicy,
@@ -2140,12 +2147,13 @@ function createProfileStore(args) {
     configs: args.configs,
     bindings,
     resolve(resolveArgs) {
-      if (resolveArgs.profile) {
-        if (resolveArgs.profile === "default") {
+      const profile = resolveArgs.profile || getCloudflareAuthProfileFromEnv();
+      if (profile) {
+        if (profile === "default") {
           return "default";
         }
-        validateProfileName(resolveArgs.profile);
-        return resolveArgs.profile;
+        validateProfileName(profile);
+        return profile;
       }
       const dirProfile = bindings.getProfileForDirectory(resolveArgs.cwd);
       if (dirProfile) {
@@ -3670,4 +3678,4 @@ smol-toml/dist/index.js:
    *)
 */
 
-export { AuthenticationError, DEFAULT_TEMPORARY_ACCOUNT_FLAG, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };
+export { AuthenticationError, DEFAULT_TEMPORARY_ACCOUNT_FLAG, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };

package/dist/index.d.mts

@@ -80,6 +80,11 @@ declare function getAccessHeaders(domain: string, options: {
     previewToken?: string;
 }): Promise<Record<string, string>>;
 
+/**
+ * Select a named auth profile for this process and its children.
+ * Explicit profile arguments take precedence; directory bindings are the fallback.
+ */
+declare const getCloudflareAuthProfileFromEnv: () => string | undefined;
 /**
  * `WRANGLER_AUTH_URL` is the path that is used to access OAuth
  * for the Cloudflare APIs.
@@ -833,4 +838,4 @@ declare function decryptString(envelope: EncryptedEnvelope, key: Uint8Array): st
  */
 declare function parseEncryptedEnvelope(raw: unknown): EncryptedEnvelope | undefined;
 
-export { AuthConfigStorage, type CredentialStorageBundle, type CredentialStorageContext, CredentialStore, type EncryptedEnvelope, EncryptedFileCredentialStore, FileCredentialStore, type KeyProvider, type KeyProviderResolution, type KeyringEntry, type KeyringEntryFactory, LinuxSecretToolKeyProvider, type LinuxSecretToolRunner, type MacSecurityCommandRunner, MacSecurityKeyProvider, NapiKeyringKeyProvider, type NpmRunner, OAuthFlowLogger, PINNED_KEYRING_VERSION, PKCE_CHARSET, type ScrubEncryptedCredentialsResult, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, UserAuthConfig, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateKey, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner };
+export { AuthConfigStorage, type CredentialStorageBundle, type CredentialStorageContext, CredentialStore, type EncryptedEnvelope, EncryptedFileCredentialStore, FileCredentialStore, type KeyProvider, type KeyProviderResolution, type KeyringEntry, type KeyringEntryFactory, LinuxSecretToolKeyProvider, type LinuxSecretToolRunner, type MacSecurityCommandRunner, MacSecurityKeyProvider, NapiKeyringKeyProvider, type NpmRunner, OAuthFlowLogger, PINNED_KEYRING_VERSION, PKCE_CHARSET, type ScrubEncryptedCredentialsResult, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, UserAuthConfig, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateKey, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-export { AuthenticationError, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-SOBRPAPT.mjs';
+export { AuthenticationError, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthProfileFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-Q5KVZMHK.mjs';
 import './chunk-VAZEJK55.mjs';
 
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-DGkctqNO.d.mts → keyring-preference-BUyxOJDK.d.mts}

@@ -105,6 +105,12 @@ interface CliDescriptor {
     getTemporaryAccountConfigPath: () => string;
     /** On-disk file format for credentials / temporary-account / profile files. */
     fileFormat: FileFormat;
+    /**
+     * Whether an account selected from the current credentials is persisted in
+     * the config cache for later invocations. When disabled, the selection is
+     * retained only for the lifetime of the auth instance. Defaults to `false`.
+     */
+    persistAccountSelection?: boolean;
     /**
      * Filename prefix for the cached account selection in the config cache
      * (e.g. `"wrangler-account"` → `wrangler-account.json`). Always JSON.
@@ -117,9 +123,9 @@ interface CliDescriptor {
      */
     cacheNamespace?: string;
     /**
-     * Label for the CLI's config file, used in "set `account_id` in your <file>"
-     * hints. A getter so it can reflect runtime config state (wrangler resolves
-     * this from `configFileName(undefined)`).
+     * Label for the CLI's account config file, used in account ID guidance. A
+     * getter so it can reflect runtime config state (wrangler resolves this from
+     * `configFileName(undefined)`).
      */
     getConfigFileLabel: () => string;
     /** The live default OAuth scope keys (a getter so any reassignment of the mutable `DefaultScopeKeys` binding is observed). */
@@ -127,14 +133,14 @@ interface CliDescriptor {
 }
 
 /** Details for one of the user's accounts. */
-type Account = {
+interface Account {
     id: string;
     name: string;
-};
+}
 /** The config surface {@link CloudflareAuth.requireAuth} needs: compliance settings plus an optional `account_id`. */
-type RequireAuthConfig = ComplianceConfig & {
+interface RequireAuthConfig extends ComplianceConfig {
     account_id?: string;
-};
+}
 /** Overrides accepted by {@link CloudflareAuth.login} / {@link CloudflareAuth.loginOrRefreshIfRequired}. */
 interface CloudflareLoginProps {
     scopes?: string[];
@@ -178,7 +184,7 @@ interface CloudflareAuth {
     readAuthCredentials: () => UserAuthConfig | undefined;
     /** Persist OAuth credentials via the active credential store. */
     writeAuthCredentials: (config: UserAuthConfig) => void;
-    /** Returns the active account ID without side effects (config → env → cache). */
+    /** Returns the active account ID without fetching accounts or prompting. */
     getActiveAccountId: (config: {
         account_id?: string;
     }) => string | undefined;