@cloudflare/workers-auth 0.9.4 → 0.10.0

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Dlt3H3sW.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-B8dU564W.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-B8dU564W.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-hS8cJZA7.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-dD49DWOI.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-dD49DWOI.mjs';
 import '@cloudflare/workers-utils';
 
 /**
@@ -14,7 +14,7 @@ declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
 declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
 declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
 
-declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
+declare const CF_CLIENT_REGISTERED_SCOPES: readonly ["access:read", "access:write", "account:read", "account_api_tokens:create", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "billing:read", "billing:write", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "email_routing:read", "email_routing:write", "email_sending:read", "email_sending:write", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notebook-managed:read", "notification:read", "notification:write", "oauth_account_ssl_and_certificates_write", "offline", "openid", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "user:read", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read", "account-analytics.read", "account-ssl-and-certificates.write", "ssl-and-certificates.read", "ssl-and-certificates.write", "registrar-domains.read", "registrar-domains.admin", "logs.read", "logs.write", "websearch.run", "snippets.read", "snippets.write", "access-acct.read", "access-acct.revoke", "access-acct.write", "access-app.read", "access-app.revoke", "access-app.write", "access-audit-log.read", "access-certificate.read", "access-certificate.write", "access-custom-page.read", "access-custom-page.write", "access-device-posture.read", "access-device-posture.write", "access-group.read", "access-group.write", "access-idp.read", "access-idp.write", "access-key.read", "access-key.write", "access-org.read", "access-org.revoke", "access-org.write", "access-policy-test.read", "access-policy-test.write", "access-policy.read", "access-policy.write", "access-population.read", "access-population.write", "access-saml-certificate.read", "access-saml-certificate.write", "access-scim-log.read", "access-seats.write", "access-service-token.read", "access-service-token.write", "access-ssh-auditing.read", "access-ssh-auditing.write", "access-tag.read", "access-tag.write", "access-users.read", "access-users.write", "access.read", "access.revoke", "access.write", "account-api-gateway.read", "account-api-gateway.write", "account-custom-asset.read", "account-custom-asset.write", "account-custom-error-rules.read", "account-custom-error-rules.write", "account-custom-pages.read", "account-custom-pages.write", "account-disable-esc.read", "account-disable-esc.write", "account-dns-settings.read", "account-dns-settings.write", "account-firewall-access-rules.read", "account-firewall-access-rules.write", "account-logs.read", "account-logs.write", "account-rule-lists.read", "account-rule-lists.write", "account-rulesets.read", "account-rulesets.write", "account-security-center-insights.read", "account-security-center-insights.write", "account-settings.read", "account-settings.write", "account-ssl-and-certificates.read", "account-waf.read", "account-waf.write", "account-waiting-rooms.read", "address-maps.read", "address-maps.write", "agent-memory.write", "agw.read", "agw.run", "agw.write", "ai-search.index", "ai-search.metadata_read", "ai-search.read", "ai-search.run", "ai-search.write", "ai.read", "ai.write", "aiaudit.read", "aiaudit.write", "aig.metadata_read", "aig.read", "aig.run", "aig.write", "analytics.read", "api-gateway.read", "api-gateway.write", "apps.write", "argotunnel.read", "argotunnel.write", "artifacts.read", "artifacts.write", "bot-management-feedback.read", "bot-management-feedback.write", "bot-management.read", "bot-management.write", "browser-rendering.read", "browser-rendering.write", "cache-settings.read", "cache-settings.write", "cache.purge", "calls.read", "calls.write", "casb.read", "casb.write", "cf-agents.read", "cf-agents.write", "challenge-widgets.read", "challenge-widgets.write", "chinanetwork-steering.read", "chinanetwork-steering.write", "cloud-connector.read", "cloud-connector.write", "cloud-email-security.read", "cloud-email-security.write", "cloudchamber.read", "cloudchamber.write", "cloudforce-one.read", "cloudforce-one.write", "config-settings.read", "config-settings.write", "connectivity-directory.admin", "connectivity-directory.bind", "connectivity-directory.read", "constellation.read", "constellation.write", "containers.read", "containers.write", "custom-errors.read", "custom-errors.write", "custom-pages.read", "custom-pages.write", "d1.metadata_read", "d1.read", "d1.write", "ddos-botnet-feed.read", "ddos-botnet-feed.write", "ddos-protection.read", "ddos-protection.write", "dls.read", "dls.write", "dns-firewall.read", "dns-firewall.write", "dns-view.read", "dns-view.write", "dns.read", "dns.write", "domain-page-shield.read", "domain-page.shield", "dynamic-redirect.read", "dynamic-redirect.write", "email-routing-account-rule.read", "email-routing-address.read", "email-routing-address.write", "email-routing-rule.read", "email-routing-rule.write", "email-routing-suppression.read", "email-routing-suppression.write", "email-security-dmarcreports.read", "email-security-dmarcreports.write", "email-sending.read", "email-sending.write", "fbm.admin", "fbm.read", "fbm.write", "field-extractor.read", "field-extractor.write", "firewall-for-ai.read", "firewall-for-ai.write", "firewall-services.read", "firewall-services.write", "flagship.evaluate", "flagship.read", "flagship.write", "fraud-detection-pii.read", "fraud-detection.read", "fraud-detection.write", "fraud-events.write", "fraud-feedback.read", "fraud-feedback.write", "healthcheck.read", "healthcheck.write", "http-applications.read", "http-applications.write", "http-ddos-managed-ruleset.read", "http-ddos-managed-ruleset.write", "images.metadata_read", "images.read", "images.write", "integration.write", "intel.read", "intel.write", "iot.read", "iot.write", "ip-prefix-bgp-on-demand.read", "ip-prefix-bgp-on-demand.write", "ip-prefix.read", "ip-prefix.write", "l4-ddos-managed-ruleset.read", "l4-ddos-managed-ruleset.write", "load-balancers-account.read", "load-balancers-account.write", "load-balancers.read", "load-balancers.write", "load-balancing-monitors-and-pools.read", "load-balancing-monitors-and-pools.write", "magic-firewall.read", "magic-firewall.write", "magic-transit.read", "magic-transit.write", "magic-wan.read", "magic-wan.write", "managed-headers.read", "managed-headers.write", "mass-url-redirects.read", "mass-url-redirects.write", "mcp-portals.read", "mcp-portals.write", "memberships.read", "memberships.write", "messaging.edit", "messaging.metadata_read", "messaging.read", "moq.read", "moq.write", "notifications.read", "notifications.write", "origin.read", "origin.write", "page-rules.read", "page-rules.write", "page-shield.read", "page.read", "page.shield", "page.write", "pages.metadata_read", "payments-gateway.read", "payments-gateway.write", "pcaps-api.read", "pcaps-api.write", "pipelines.read", "pipelines.send", "pipelines.write", "precursor.read", "precursor.write", "pubsub.read", "pubsub.write", "query-cache.read", "query-cache.write", "queues.metadata_read", "queues.read", "queues.write", "r2-catalog-sql.read", "r2-catalog.read", "r2-catalog.write", "radar.read", "rag.read", "rag.run", "rag.write", "realtime.admin", "realtime.read", "realtime.write", "registrar-sandbox-domains.admin", "registrar-sandbox-domains.read", "reports-application-security-report.read", "request-tracer.read", "resource-library.read", "resource-library.write", "resource-sharing.read", "response-compression.read", "response-compression.write", "sanitize.read", "sanitize.write", "secrets-store.read", "secrets-store.write", "select-configuration.read", "select-configuration.write", "stream.metadata_read", "stream.read", "stream.write", "tag.read", "tag.write", "teams-cds-compute-account.read", "teams-cds-compute-account.write", "teams-connector-cloudflared.monitoring", "teams-connector-cloudflared.read", "teams-connector-cloudflared.write", "teams-connector-warp.read", "teams-connector-warp.write", "teams-connectors.read", "teams-connectors.write", "teams-dex.read", "teams-dex.write", "teams-networks.read", "teams-networks.write", "teams-pii.read", "teams-resilience.read", "teams-resilience.write", "teams-secure.location", "teams.read", "teams.report", "teams.write", "transform-rules.read", "transform-rules.write", "trust-and-safety.read", "trust-and-safety.write", "url-scanner.read", "url-scanner.write", "user-details.read", "user-details.write", "vectorize.read", "vectorize.write", "waiting-rooms.read", "waiting-rooms.write", "web3-hostnames.read", "web3-hostnames.write", "websearch.metadata_read", "websearch.read", "websearch.write", "workers-ci.read", "workers-ci.write", "workers-kv-storage.metadata_read", "workers-kv-storage.read", "workers-kv-storage.write", "workers-observability-telemetry.write", "workers-observability.read", "workers-observability.write", "workers-r2-bucket-item.read", "workers-r2-bucket-item.write", "workers-r2.metadata_read", "workers-r2.read", "workers-r2.write", "workers-routes.read", "workers-routes.write", "workers-scripts.bind", "workers-scripts.read", "workers-scripts.write", "workers-tail.read", "workers_ai.metadata_read", "zaraz.edit", "zaraz.read", "zaraz.write", "zone-access.read", "zone-access.revoke", "zone-access.write", "zone-custom-asset.read", "zone-custom-asset.write", "zone-disable-esc.read", "zone-disable-esc.write", "zone-dns-settings.read", "zone-dns-settings.write", "zone-security-center-insights.read", "zone-security-center-insights.write", "zone-settings.read", "zone-settings.write", "zone-transform-rules.read", "zone-transform-rules.write", "zone-versioning.read", "zone-versioning.write", "zone-waf.read", "zone-waf.write", "zone.read", "zone.write"];
 type ClientRegisteredScope = (typeof CF_CLIENT_REGISTERED_SCOPES)[number];
 declare const CF_REGISTERED_BUT_UNGRANTABLE_SCOPES: readonly ["billing:read", "billing:write", "email_routing:read", "email_sending:read", "notebook-managed:read", "oauth_account_ssl_and_certificates_write"];
 type UngrantableScope = (typeof CF_REGISTERED_BUT_UNGRANTABLE_SCOPES)[number];

package/dist/cf/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-2JQZNT7W.mjs';
-import '../chunk-RV27PEH3.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-VVLCNASF.mjs';
+import '../chunk-FT2NMTJB.mjs';
 import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -39,6 +39,7 @@ var CF_CLIENT_REGISTERED_SCOPES = [
   "access:read",
   "access:write",
   "account:read",
+  "account_api_tokens:create",
   "agw:read",
   "agw:run",
   "agw:write",

package/dist/{chunk-RV27PEH3.mjs → chunk-FT2NMTJB.mjs}

@@ -164,6 +164,14 @@ var getCloudflareAuthUseKeyringFromEnv = getBooleanEnvironmentVariableFactory({
 });
 var headersCache = {};
 var usesAccessCache = /* @__PURE__ */ new Map();
+function buildProbeUrl(domain, previewToken) {
+  const url2 = new URL(`https://${domain}`);
+  if (previewToken) {
+    url2.searchParams.set("cf_workers_preview_token", previewToken);
+  }
+  return url2.toString();
+}
+__name(buildProbeUrl, "buildProbeUrl");
 function clearAccessCaches() {
   for (const key of Object.keys(headersCache)) {
     delete headersCache[key];
@@ -171,15 +179,16 @@ function clearAccessCaches() {
   usesAccessCache.clear();
 }
 __name(clearAccessCaches, "clearAccessCaches");
-async function domainUsesAccess(domain, logger) {
+async function domainUsesAccess(domain, logger, previewToken) {
   logger.debug("Checking if domain has Access enabled:", domain);
-  if (usesAccessCache.has(domain)) {
+  const cacheKey = JSON.stringify([domain, Boolean(previewToken)]);
+  if (usesAccessCache.has(cacheKey)) {
     logger.debug(
       "Using cached Access switch for:",
       domain,
-      usesAccessCache.get(domain)
+      usesAccessCache.get(cacheKey)
     );
-    return usesAccessCache.get(domain) ?? false;
+    return usesAccessCache.get(cacheKey) ?? false;
   }
   logger.debug("Access switch not cached for:", domain);
   try {
@@ -187,17 +196,19 @@ async function domainUsesAccess(domain, logger) {
     const cancel = setTimeout(() => {
       controller.abort();
     }, 1e3);
-    const output = await fetch(`https://${domain}`, {
+    const output = await fetch(buildProbeUrl(domain, previewToken), {
       redirect: "manual",
       signal: controller.signal
     });
     clearTimeout(cancel);
     const usesAccess = !!(output.status === 302 && output.headers.get("location")?.includes("cloudflareaccess.com"));
-    logger.debug("Caching access switch for:", domain);
-    usesAccessCache.set(domain, usesAccess);
+    if (usesAccess || !previewToken) {
+      logger.debug("Caching access switch for:", domain);
+      usesAccessCache.set(cacheKey, usesAccess);
+    }
     return usesAccess;
   } catch {
-    usesAccessCache.set(domain, false);
+    logger.debug("Access probe failed for:", domain);
     return false;
   }
 }
@@ -218,7 +229,7 @@ async function getAccessHeaders(domain, options) {
       `Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${clientId !== void 0 ? "CLOUDFLARE_ACCESS_CLIENT_ID" : "CLOUDFLARE_ACCESS_CLIENT_SECRET"} was found.`
     );
   }
-  if (!await domainUsesAccess(domain, logger)) {
+  if (!await domainUsesAccess(domain, logger, options.previewToken)) {
     return {};
   }
   logger.debug("Getting Access headers for domain:", domain);
@@ -237,7 +248,10 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
     );
   }
   logger.debug("Spawning cloudflared to get Access token for domain:");
-  const output = await spawnCloudflaredAccessLogin(domain, options.signal);
+  const output = await spawnCloudflaredAccessLogin(
+    buildProbeUrl(domain, options.previewToken),
+    options.signal
+  );
   if (output.error) {
     throw new UserError(
       "To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
@@ -256,9 +270,11 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
   throw new Error("Failed to authenticate with Cloudflare Access");
 }
 __name(getAccessHeaders, "getAccessHeaders");
-function spawnCloudflaredAccessLogin(domain, signal) {
+function spawnCloudflaredAccessLogin(loginTarget, signal) {
   return new Promise((resolve, reject) => {
-    const child = spawn("cloudflared", ["access", "login", domain], { signal });
+    const child = spawn("cloudflared", ["access", "login", loginTarget], {
+      signal
+    });
     const stdoutChunks = [];
     child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
     child.stderr.resume();
@@ -734,6 +750,14 @@ var ErrorUnknown = class extends ErrorOAuth2 {
     return "ErrorUnknown";
   }
 };
+var ErrorAuthServerUnreachable = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorAuthServerUnreachable");
+  }
+  toString() {
+    return "ErrorAuthServerUnreachable";
+  }
+};
 var ErrorNoAuthCode = class extends ErrorOAuth2 {
   static {
     __name(this, "ErrorNoAuthCode");
@@ -1134,7 +1158,12 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
     return response;
   } catch (e) {
     logger.debug("Failed to fetch auth token:", e);
-    throw e;
+    const cause = e?.cause;
+    const code = typeof cause?.code === "string" ? ` (${cause.code})` : "";
+    throw new ErrorAuthServerUnreachable(
+      `Could not reach the Cloudflare auth server at ${getTokenUrlFromEnv()}${code}.`,
+      { cause: e, telemetryMessage: "user oauth token endpoint unreachable" }
+    );
   }
 }
 __name(fetchAuthToken, "fetchAuthToken");
@@ -1780,12 +1809,12 @@ function createOAuthFlow(ctx) {
         refresh_token,
         scopes
       });
-      return true;
+      return "refreshed";
     } catch (e) {
       ctx.logger.debug(
         `Token refresh failed: ${e instanceof Error ? e.message : String(e)}`
       );
-      return false;
+      return e instanceof ErrorAuthServerUnreachable ? "unreachable" : "rejected";
     }
   }
   __name(refreshToken, "refreshToken");
@@ -1809,10 +1838,13 @@ function createOAuthFlow(ctx) {
       }
       return { loggedIn: false, reason: "no-credentials-login-failed" };
     } else if (isRefreshNeeded(props.profile)) {
-      const didRefresh = await refreshToken(props.profile);
-      if (didRefresh) {
+      const refreshed = await refreshToken(props.profile);
+      if (refreshed === "refreshed") {
         return { loggedIn: true };
       }
+      if (refreshed === "unreachable") {
+        return { loggedIn: false, reason: "token-refresh-unreachable" };
+      }
       if (ctx.isNonInteractiveOrCI()) {
         return {
           loggedIn: false,
@@ -1870,8 +1902,7 @@ function createOAuthFlow(ctx) {
     }
     const expired = stored.accessToken && /* @__PURE__ */ new Date() >= new Date(stored.accessToken.expiry);
     if (expired) {
-      const didRefresh = await refreshToken();
-      if (!didRefresh) {
+      if (await refreshToken() !== "refreshed") {
         return void 0;
       }
       stored = readStoredAuthState({

package/dist/{chunk-2JQZNT7W.mjs → chunk-VVLCNASF.mjs}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-RV27PEH3.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-FT2NMTJB.mjs';
 import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -765,7 +765,8 @@ function notLoggedInErrorBodies(loginCommand) {
     "no-credentials-non-interactive": `Could not authenticate because no credentials were found and the environment is non-interactive. Set a CLOUDFLARE_API_TOKEN environment variable or run \`${loginCommand}\` in an interactive terminal first.`,
     "no-credentials-login-failed": `No credentials were found and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`,
     "token-expired-non-interactive": `Your auth token has expired and could not be refreshed, and the environment is non-interactive. Run \`${loginCommand}\` in an interactive terminal or set a CLOUDFLARE_API_TOKEN.`,
-    "token-expired-login-failed": `Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`
+    "token-expired-login-failed": `Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`,
+    "token-refresh-unreachable": `Your auth token has expired and could not be refreshed because the Cloudflare auth server could not be reached. This is usually a network problem (connectivity, proxy, or IPv6), not an invalid login: your stored credentials were left unchanged. Check your connection and try again.`
   };
 }
 __name(notLoggedInErrorBodies, "notLoggedInErrorBodies");
@@ -1103,6 +1104,10 @@ ${accounts.map(
           `In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for ${cliName} to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN.`,
           { telemetryMessage: "user auth missing api token non interactive" }
         );
+      } else if (result.reason === "token-refresh-unreachable") {
+        throw new UserError(NOT_LOGGED_IN_ERROR_BODIES[result.reason], {
+          telemetryMessage: "user auth token refresh unreachable"
+        });
       } else {
         throw new UserError("Did not login, quitting...", {
           telemetryMessage: "user login cancelled"

package/dist/{file-format-Dlt3H3sW.d.mts → file-format-hS8cJZA7.d.mts}

@@ -248,7 +248,9 @@ type LoginOrRefreshFailureReason =
 /** the stored token has expired, refresh failed, and the environment is non-interactive so a browser login cannot be started. */
  | "token-expired-non-interactive"
 /** the stored token has expired, refresh failed, and the interactive login attempt was unsuccessful. */
- | "token-expired-login-failed";
+ | "token-expired-login-failed"
+/** the stored token has expired and the auth server could not be reached to refresh it; the stored credentials were left untouched and no login was attempted. */
+ | "token-refresh-unreachable";
 /**
  * Discriminated union returned by {@link OAuthFlowAPI.loginOrRefreshIfRequired}.
  *

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Dlt3H3sW.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-Dlt3H3sW.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-hS8cJZA7.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-hS8cJZA7.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 
@@ -42,14 +42,23 @@ declare function clearAccessCaches(): void;
  * A 302 to `cloudflareaccess.com` is the canonical signal. Service-auth-only
  * Access applications return a hard 403 instead and are therefore not detected
  * here — see {@link getAccessHeaders} for how this is handled.
+ *
+ * When `previewToken` is supplied it is added as the `cf_workers_preview_token`
+ * query parameter so the probe activates an unpublished worker's edge-preview
+ * route (otherwise the anonymous probe 404s and Access is never triggered). The
+ * cache is keyed on whether a token was supplied so token-authenticated and
+ * anonymous probes of the same host don't poison each other.
  */
-declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger): Promise<boolean>;
+declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger, previewToken?: string): Promise<boolean>;
 /**
  * Get the headers needed to authenticate with an Access-protected domain.
  *
  * @param domain The hostname of the Access-protected domain (e.g. `"example.com"`).
  * @param options logger + an `isNonInteractiveOrCI` predicate used to
- *   produce an actionable error in CI; both default to no-op / `false`.
+ *   produce an actionable error in CI (both default to no-op / `false`), plus an
+ *   optional `previewToken` that is added as the `cf_workers_preview_token`
+ *   query parameter when probing for Access and when invoking `cloudflared
+ *   access login`, so detection works on unpublished `<name>.workers.dev` hosts.
  * @returns
  * - Service token headers (`CF-Access-Client-Id` + `CF-Access-Client-Secret`) if env vars are set
  * - A `Cookie: CF_Authorization=...` header if obtained via `cloudflared` (interactive only)
@@ -64,6 +73,12 @@ declare function getAccessHeaders(domain: string, options: {
     isNonInteractiveOrCI?: () => boolean;
     /** Aborts a pending `cloudflared` authorization and kills its process. */
     signal?: AbortSignal;
+    /**
+     * Workers preview token forwarded to the Access probe and to
+     * `cloudflared access login` so detection works on unpublished
+     * `<name>.workers.dev` hosts.
+     */
+    previewToken?: string;
 }): Promise<Record<string, string>>;
 
 /**

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-RV27PEH3.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-FT2NMTJB.mjs';
 import './chunk-VAZEJK55.mjs';
 
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-B8dU564W.d.mts → keyring-preference-dD49DWOI.d.mts}

@@ -1,4 +1,4 @@
-import { f as OAuthFlowContext, m as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Dlt3H3sW.mjs';
+import { f as OAuthFlowContext, m as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-hS8cJZA7.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */