@cloudflare/workers-auth 0.6.12 → 0.7.0

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
 import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Bpmgm2Po.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CdaCHp2c.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-CdaCHp2c.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CWjI7ct9.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-CWjI7ct9.mjs';
 import '@cloudflare/workers-utils';
 
 /**
@@ -14,16 +14,16 @@ declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
 declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
 declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
 
-declare const CF_SCOPES: readonly ["openid", "offline", "user:read", "account:read", "access:read", "access:write", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:write", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notification:read", "notification:write", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read"];
+declare const CF_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
 /**
- * The possible keys for a cf Scope.
+ * The possible explicitly requestable keys for a cf Scope.
  *
  * "offline_access" is automatically included.
  */
-type Scope = (typeof CF_SCOPES)[number];
+type Scope = (typeof CF_REGISTERED_SCOPES)[number];
 declare let DefaultScopeKeys: Scope[];
 declare function setLoginScopeKeys(scopes: Scope[]): void;
-declare function validateScopeKeys(scopes: string[]): scopes is typeof DefaultScopeKeys;
+declare function validateScopeKeys(scopes: string[]): scopes is Scope[];
 
 /**
  * `CLOUDFLARE_CLIENT_ID` is the UUID of cf's registered OAuth app, used to

package/dist/cf/index.mjs

@@ -1,4 +1,4 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-YCVYA5LL.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-T63LVVAX.mjs';
 import '../chunk-LQW53VED.mjs';
 import { __name } from '../chunk-O6YSETKJ.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
@@ -32,7 +32,483 @@ function getCfConfigPath() {
 __name(getCfConfigPath, "getCfConfigPath");
 
 // src/cf/scopes.ts
-var CF_SCOPES = [
+var CF_REGISTERED_SCOPES = [
+  "access:read",
+  "access:write",
+  "account:read",
+  "agw:read",
+  "agw:run",
+  "agw:write",
+  "ai:read",
+  "ai:write",
+  "ai-search:read",
+  "ai-search:run",
+  "ai-search:write",
+  "aiaudit:read",
+  "aiaudit:write",
+  "aig:read",
+  "aig:write",
+  "auditlogs:read",
+  "billing:read",
+  "billing:write",
+  "browser:read",
+  "browser:write",
+  "cfone:read",
+  "cfone:write",
+  "cloudchamber:write",
+  "connectivity:admin",
+  "connectivity:bind",
+  "connectivity:read",
+  "constellation:write",
+  "containers:write",
+  "d1:write",
+  "dex:read",
+  "dex:write",
+  "dns_analytics:read",
+  "dns_records:edit",
+  "dns_records:read",
+  "dns_settings:read",
+  "email_routing:read",
+  "email_routing:write",
+  "email_sending:read",
+  "email_sending:write",
+  "firstpartytags:write",
+  "images:read",
+  "images:write",
+  "lb:edit",
+  "lb:read",
+  "logpush:read",
+  "logpush:write",
+  "mcp_portals:read",
+  "mcp_portals:write",
+  "notebook-examples:read",
+  "notebook-managed:read",
+  "notification:read",
+  "notification:write",
+  "oauth_account_ssl_and_certificates_write",
+  "offline",
+  "openid",
+  "pages:read",
+  "pages:write",
+  "pipelines:read",
+  "pipelines:setup",
+  "pipelines:write",
+  "query_cache:write",
+  "queues:write",
+  "r2_catalog:write",
+  "radar:read",
+  "rag:read",
+  "rag:write",
+  "registrar:read",
+  "registrar:write",
+  "secrets_store:read",
+  "secrets_store:write",
+  "sso-connector:read",
+  "sso-connector:write",
+  "ssl_certs:write",
+  "teams:pii",
+  "teams:read",
+  "teams:secure_location",
+  "teams:write",
+  "url_scanner:read",
+  "url_scanner:write",
+  "user:read",
+  "vectorize:write",
+  "workers:read",
+  "workers:write",
+  "workers_builds:read",
+  "workers_builds:write",
+  "workers_deployments:read",
+  "workers_kv:write",
+  "workers_observability:read",
+  "workers_observability:write",
+  "workers_observability_telemetry:write",
+  "workers_routes:write",
+  "workers_scripts:write",
+  "workers_tail:read",
+  "zone:read",
+  "account-analytics.read",
+  "account-ssl-and-certificates.write",
+  "ssl-and-certificates.read",
+  "ssl-and-certificates.write",
+  "registrar-domains.read",
+  "registrar-domains.admin",
+  "logs.read",
+  "logs.write",
+  "websearch.run",
+  "snippets.read",
+  "snippets.write",
+  "access-acct.read",
+  "access-acct.revoke",
+  "access-acct.write",
+  "access-app.read",
+  "access-app.revoke",
+  "access-app.write",
+  "access-audit-log.read",
+  "access-certificate.read",
+  "access-certificate.write",
+  "access-custom-page.read",
+  "access-custom-page.write",
+  "access-device-posture.read",
+  "access-device-posture.write",
+  "access-group.read",
+  "access-group.write",
+  "access-idp.read",
+  "access-idp.write",
+  "access-key.read",
+  "access-key.write",
+  "access-org.read",
+  "access-org.revoke",
+  "access-org.write",
+  "access-policy-test.read",
+  "access-policy-test.write",
+  "access-policy.read",
+  "access-policy.write",
+  "access-population.read",
+  "access-population.write",
+  "access-saml-certificate.read",
+  "access-saml-certificate.write",
+  "access-scim-log.read",
+  "access-seats.write",
+  "access-service-token.read",
+  "access-service-token.write",
+  "access-ssh-auditing.read",
+  "access-ssh-auditing.write",
+  "access-tag.read",
+  "access-tag.write",
+  "access-users.read",
+  "access-users.write",
+  "access.read",
+  "access.revoke",
+  "access.write",
+  "account-api-gateway.read",
+  "account-api-gateway.write",
+  "account-custom-asset.read",
+  "account-custom-asset.write",
+  "account-custom-error-rules.read",
+  "account-custom-error-rules.write",
+  "account-custom-pages.read",
+  "account-custom-pages.write",
+  "account-disable-esc.read",
+  "account-disable-esc.write",
+  "account-dns-settings.read",
+  "account-dns-settings.write",
+  "account-firewall-access-rules.read",
+  "account-firewall-access-rules.write",
+  "account-logs.read",
+  "account-logs.write",
+  "account-rule-lists.read",
+  "account-rule-lists.write",
+  "account-rulesets.read",
+  "account-rulesets.write",
+  "account-security-center-insights.read",
+  "account-security-center-insights.write",
+  "account-settings.read",
+  "account-settings.write",
+  "account-ssl-and-certificates.read",
+  "account-waf.read",
+  "account-waf.write",
+  "account-waiting-rooms.read",
+  "address-maps.read",
+  "address-maps.write",
+  "agent-memory.write",
+  "agw.read",
+  "agw.run",
+  "agw.write",
+  "ai-search.index",
+  "ai-search.metadata_read",
+  "ai-search.read",
+  "ai-search.run",
+  "ai-search.write",
+  "ai.read",
+  "ai.write",
+  "aiaudit.read",
+  "aiaudit.write",
+  "aig.metadata_read",
+  "aig.read",
+  "aig.run",
+  "aig.write",
+  "analytics.read",
+  "api-gateway.read",
+  "api-gateway.write",
+  "apps.write",
+  "argotunnel.read",
+  "argotunnel.write",
+  "artifacts.read",
+  "artifacts.write",
+  "bot-management-feedback.read",
+  "bot-management-feedback.write",
+  "bot-management.read",
+  "bot-management.write",
+  "browser-rendering.read",
+  "browser-rendering.write",
+  "cache-settings.read",
+  "cache-settings.write",
+  "cache.purge",
+  "calls.read",
+  "calls.write",
+  "casb.read",
+  "casb.write",
+  "cf-agents.read",
+  "cf-agents.write",
+  "challenge-widgets.read",
+  "challenge-widgets.write",
+  "chinanetwork-steering.read",
+  "chinanetwork-steering.write",
+  "cloud-connector.read",
+  "cloud-connector.write",
+  "cloud-email-security.read",
+  "cloud-email-security.write",
+  "cloudchamber.read",
+  "cloudchamber.write",
+  "cloudforce-one.read",
+  "cloudforce-one.write",
+  "config-settings.read",
+  "config-settings.write",
+  "connectivity-directory.admin",
+  "connectivity-directory.bind",
+  "connectivity-directory.read",
+  "constellation.read",
+  "constellation.write",
+  "containers.read",
+  "containers.write",
+  "custom-errors.read",
+  "custom-errors.write",
+  "custom-pages.read",
+  "custom-pages.write",
+  "d1.metadata_read",
+  "d1.read",
+  "d1.write",
+  "ddos-botnet-feed.read",
+  "ddos-botnet-feed.write",
+  "ddos-protection.read",
+  "ddos-protection.write",
+  "dls.read",
+  "dls.write",
+  "dns-firewall.read",
+  "dns-firewall.write",
+  "dns-view.read",
+  "dns-view.write",
+  "dns.read",
+  "dns.write",
+  "domain-page-shield.read",
+  "domain-page.shield",
+  "dynamic-redirect.read",
+  "dynamic-redirect.write",
+  "email-routing-account-rule.read",
+  "email-routing-address.read",
+  "email-routing-address.write",
+  "email-routing-rule.read",
+  "email-routing-rule.write",
+  "email-routing-suppression.read",
+  "email-routing-suppression.write",
+  "email-security-dmarcreports.read",
+  "email-security-dmarcreports.write",
+  "email-sending.read",
+  "email-sending.write",
+  "fbm.admin",
+  "fbm.read",
+  "fbm.write",
+  "field-extractor.read",
+  "field-extractor.write",
+  "firewall-for-ai.read",
+  "firewall-for-ai.write",
+  "firewall-services.read",
+  "firewall-services.write",
+  "flagship.evaluate",
+  "flagship.read",
+  "flagship.write",
+  "fraud-detection-pii.read",
+  "fraud-detection.read",
+  "fraud-detection.write",
+  "fraud-events.write",
+  "fraud-feedback.read",
+  "fraud-feedback.write",
+  "healthcheck.read",
+  "healthcheck.write",
+  "http-applications.read",
+  "http-applications.write",
+  "http-ddos-managed-ruleset.read",
+  "http-ddos-managed-ruleset.write",
+  "images.metadata_read",
+  "images.read",
+  "images.write",
+  "integration.write",
+  "intel.read",
+  "intel.write",
+  "iot.read",
+  "iot.write",
+  "ip-prefix-bgp-on-demand.read",
+  "ip-prefix-bgp-on-demand.write",
+  "ip-prefix.read",
+  "ip-prefix.write",
+  "l4-ddos-managed-ruleset.read",
+  "l4-ddos-managed-ruleset.write",
+  "load-balancers-account.read",
+  "load-balancers-account.write",
+  "load-balancers.read",
+  "load-balancers.write",
+  "load-balancing-monitors-and-pools.read",
+  "load-balancing-monitors-and-pools.write",
+  "magic-firewall.read",
+  "magic-firewall.write",
+  "magic-transit.read",
+  "magic-transit.write",
+  "magic-wan.read",
+  "magic-wan.write",
+  "managed-headers.read",
+  "managed-headers.write",
+  "mass-url-redirects.read",
+  "mass-url-redirects.write",
+  "mcp-portals.read",
+  "mcp-portals.write",
+  "memberships.read",
+  "memberships.write",
+  "messaging.edit",
+  "messaging.metadata_read",
+  "messaging.read",
+  "moq.read",
+  "moq.write",
+  "notifications.read",
+  "notifications.write",
+  "origin.read",
+  "origin.write",
+  "page-rules.read",
+  "page-rules.write",
+  "page-shield.read",
+  "page.read",
+  "page.shield",
+  "page.write",
+  "pages.metadata_read",
+  "payments-gateway.read",
+  "payments-gateway.write",
+  "pcaps-api.read",
+  "pcaps-api.write",
+  "pipelines.read",
+  "pipelines.send",
+  "pipelines.write",
+  "precursor.read",
+  "precursor.write",
+  "pubsub.read",
+  "pubsub.write",
+  "query-cache.read",
+  "query-cache.write",
+  "queues.metadata_read",
+  "queues.read",
+  "queues.write",
+  "r2-catalog-sql.read",
+  "r2-catalog.read",
+  "r2-catalog.write",
+  "radar.read",
+  "rag.read",
+  "rag.run",
+  "rag.write",
+  "realtime.admin",
+  "realtime.read",
+  "realtime.write",
+  "registrar-sandbox-domains.admin",
+  "registrar-sandbox-domains.read",
+  "reports-application-security-report.read",
+  "request-tracer.read",
+  "resource-library.read",
+  "resource-library.write",
+  "resource-sharing.read",
+  "response-compression.read",
+  "response-compression.write",
+  "sanitize.read",
+  "sanitize.write",
+  "secrets-store.read",
+  "secrets-store.write",
+  "select-configuration.read",
+  "select-configuration.write",
+  "stream.metadata_read",
+  "stream.read",
+  "stream.write",
+  "tag.read",
+  "tag.write",
+  "teams-cds-compute-account.read",
+  "teams-cds-compute-account.write",
+  "teams-connector-cloudflared.monitoring",
+  "teams-connector-cloudflared.read",
+  "teams-connector-cloudflared.write",
+  "teams-connector-warp.read",
+  "teams-connector-warp.write",
+  "teams-connectors.read",
+  "teams-connectors.write",
+  "teams-dex.read",
+  "teams-dex.write",
+  "teams-networks.read",
+  "teams-networks.write",
+  "teams-pii.read",
+  "teams-resilience.read",
+  "teams-resilience.write",
+  "teams-secure.location",
+  "teams.read",
+  "teams.report",
+  "teams.write",
+  "transform-rules.read",
+  "transform-rules.write",
+  "trust-and-safety.read",
+  "trust-and-safety.write",
+  "url-scanner.read",
+  "url-scanner.write",
+  "user-details.read",
+  "user-details.write",
+  "vectorize.read",
+  "vectorize.write",
+  "waiting-rooms.read",
+  "waiting-rooms.write",
+  "web3-hostnames.read",
+  "web3-hostnames.write",
+  "websearch.metadata_read",
+  "websearch.read",
+  "websearch.write",
+  "workers-ci.read",
+  "workers-ci.write",
+  "workers-kv-storage.metadata_read",
+  "workers-kv-storage.read",
+  "workers-kv-storage.write",
+  "workers-observability-telemetry.write",
+  "workers-observability.read",
+  "workers-observability.write",
+  "workers-r2-bucket-item.read",
+  "workers-r2-bucket-item.write",
+  "workers-r2.metadata_read",
+  "workers-r2.read",
+  "workers-r2.write",
+  "workers-routes.read",
+  "workers-routes.write",
+  "workers-scripts.bind",
+  "workers-scripts.read",
+  "workers-scripts.write",
+  "workers-tail.read",
+  "workers_ai.metadata_read",
+  "zaraz.edit",
+  "zaraz.read",
+  "zaraz.write",
+  "zone-access.read",
+  "zone-access.revoke",
+  "zone-access.write",
+  "zone-custom-asset.read",
+  "zone-custom-asset.write",
+  "zone-disable-esc.read",
+  "zone-disable-esc.write",
+  "zone-dns-settings.read",
+  "zone-dns-settings.write",
+  "zone-security-center-insights.read",
+  "zone-security-center-insights.write",
+  "zone-settings.read",
+  "zone-settings.write",
+  "zone-transform-rules.read",
+  "zone-transform-rules.write",
+  "zone-versioning.read",
+  "zone-versioning.write",
+  "zone-waf.read",
+  "zone-waf.write",
+  "zone.read",
+  "zone.write"
+];
+var CF_DEFAULT_SCOPES = [
   "openid",
   "offline",
   "user:read",
@@ -122,12 +598,12 @@ var CF_SCOPES = [
   "workers_tail:read",
   "zone:read"
 ];
-var DefaultScopeKeys = [...CF_SCOPES];
+var DefaultScopeKeys = [...CF_DEFAULT_SCOPES];
 function setLoginScopeKeys(scopes) {
   DefaultScopeKeys = scopes;
 }
 __name(setLoginScopeKeys, "setLoginScopeKeys");
-var CF_SCOPE_SET = new Set(CF_SCOPES);
+var CF_SCOPE_SET = new Set(CF_REGISTERED_SCOPES);
 function validateScopeKeys(scopes) {
   return scopes.every((scope) => CF_SCOPE_SET.has(scope));
 }
@@ -166,12 +642,13 @@ var CF_CLI = {
     login: "cf auth login",
     whoami: "cf auth whoami",
     createProfile: "cf auth create",
-    deviceLogin: "cf auth login --device"
+    deviceLogin: "cf auth login"
   },
   keyringServiceName: CF_KEYRING_SERVICE_NAME,
   clientId: getClientIdFromEnv,
   consent: CF_CONSENT_PAGES,
   redirectUri: CF_OAUTH_CALLBACK_URL,
+  useDeviceFlowByDefault: true,
   // cf only supports the scoped `CLOUDFLARE_API_TOKEN` env var, not the global
   // API key + email pair, so the global-key resolution is disabled.
   allowGlobalAuthKey: false,

package/dist/{chunk-YCVYA5LL.mjs → chunk-T63LVVAX.mjs}

@@ -3,7 +3,7 @@ import { __name } from './chunk-O6YSETKJ.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
 import { URLSearchParams } from 'node:url';
-import { readFileSync, isNonInteractiveOrCI, createConfigCache, openInBrowser, UserError, fetchInternalBase, hasMorePages, throwFetchError, isCI, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
+import { readFileSync, isNonInteractiveOrCI, createConfigCache, openInBrowser, fetchInternalBase, hasMorePages, throwFetchError, UserError, isCI, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
 
 function createPreferences(getConfigPath) {
   function getUserPreferencesPath() {
@@ -850,7 +850,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     return oauthFlow.requireApiToken();
   }
   __name(requireApiToken, "requireApiToken");
-  function withDefaultScopes(complianceConfig, props) {
+  function withLoginDefaults(complianceConfig, props) {
     return {
       complianceConfig,
       scopes: props?.scopes ?? descriptor.getDefaultScopeKeys(),
@@ -858,12 +858,12 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
       callbackHost: props?.callbackHost,
       callbackPort: props?.callbackPort,
       profile: props?.profile,
-      device: props?.device
+      device: props?.device ?? descriptor.useDeviceFlowByDefault ?? false
     };
   }
-  __name(withDefaultScopes, "withDefaultScopes");
+  __name(withLoginDefaults, "withLoginDefaults");
   async function login(complianceConfig, props) {
-    return oauthFlow.login(withDefaultScopes(complianceConfig, props));
+    return oauthFlow.login(withLoginDefaults(complianceConfig, props));
   }
   __name(login, "login");
   async function logout(profile) {
@@ -875,7 +875,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
       return { loggedIn: true };
     }
     return oauthFlow.loginOrRefreshIfRequired(
-      withDefaultScopes(complianceConfig, props)
+      withLoginDefaults(complianceConfig, props)
     );
   }
   __name(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
@@ -916,15 +916,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     ).account;
   }
   __name(getAccountFromCache, "getAccountFromCache");
-  async function fetchAccountsPaged(complianceConfig, resource) {
-    const result = await loginOrRefreshIfRequired(complianceConfig);
-    if (!result.loggedIn) {
-      throw new UserError(
-        `Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[result.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`,
-        { telemetryMessage: "cfetch auth login required" }
-      );
-    }
-    const credentials = requireApiToken();
+  async function fetchAccountsPaged(complianceConfig, resource, credentials) {
     const results = [];
     let getMoreResults = true;
     let page = 1;
@@ -958,11 +950,20 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
   __name(fetchAccountsPaged, "fetchAccountsPaged");
   async function fetchAllAccounts(complianceConfig, options = {}) {
     const { throwOnEmpty = true } = options;
+    const loginResult = await loginOrRefreshIfRequired(complianceConfig);
+    if (!loginResult.loggedIn) {
+      throw new UserError(
+        `Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[loginResult.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`,
+        { telemetryMessage: "cfetch auth login required" }
+      );
+    }
+    const credentials = requireApiToken();
     const [accountsRes, membershipsRes] = await Promise.allSettled([
-      fetchAccountsPaged(complianceConfig, `/accounts`),
+      fetchAccountsPaged(complianceConfig, `/accounts`, credentials),
       fetchAccountsPaged(
         complianceConfig,
-        `/memberships`
+        `/memberships`,
+        credentials
       )
     ]);
     if (accountsRes.status === "rejected") {

package/dist/{keyring-preference-CdaCHp2c.d.mts → keyring-preference-CWjI7ct9.d.mts}

@@ -78,6 +78,11 @@ interface CliDescriptor {
     consent: OAuthConsentPages;
     /** The `redirect_uri` registered on the CLI's OAuth app; also the local callback URL. */
     redirectUri: string;
+    /**
+     * Whether interactive logins use the OAuth 2.0 Device Authorization Grant
+     * unless the caller explicitly selects a flow. Defaults to `false`.
+     */
+    useDeviceFlowByDefault?: boolean;
     /**
      * Whether Cloudflare Global API Key + email credentials are accepted.
      * Defaults to `true`.