alchemy 0.77.5 → 0.78.0

package/bin/alchemy.js

@@ -36823,7 +36823,7 @@ function envPaths(name$1, { suffix = "nodejs" } = {}) {
 //#endregion
 //#region package.json
 var name = "alchemy";
-var version = "0.77.5";
+var version = "0.78.0";
 var license = "Apache-2.0";
 var author = "Sam Goodwin <sam@alchemy.run>";
 var homepage = "https://alchemy.run";
@@ -36980,6 +36980,10 @@ var exports$1 = {
 		"bun": "./src/test/vite.ts",
 		"import": "./lib/test/vite.js"
 	},
+	"./test/bun": {
+		"bun": "./src/test/bun.ts",
+		"import": "./lib/test/bun.js"
+	},
 	"./upstash": {
 		"bun": "./src/upstash/index.ts",
 		"import": "./lib/upstash/index.js"
@@ -38194,6 +38198,51 @@ const ResourceFQN = Symbol.for("alchemy::ResourceFQN");
 const ResourceKind = Symbol.for("alchemy::ResourceKind");
 const ResourceScope = Symbol.for("alchemy::ResourceScope");
 const ResourceSeq = Symbol.for("alchemy::ResourceSeq");
+function Resource(type$1, ...args) {
+	const [options, handler] = args.length === 2 ? args : [void 0, args[0]];
+	if (PROVIDERS.has(type$1)) {
+		if (HANDLERS.get(type$1).toString() !== handler.toString()) throw new Error(`Resource ${type$1} already exists`);
+	}
+	HANDLERS.set(type$1, handler);
+	const provider = (async (resourceID, props) => {
+		const scope = Scope.current;
+		if (resourceID.includes(":")) throw new Error(`ID cannot include colons: ${resourceID}`);
+		if (scope.resources.has(resourceID)) {
+			const otherResource = scope.resources.get(resourceID);
+			if (otherResource?.[ResourceKind] !== type$1) {
+				scope.fail();
+				const error$84 = /* @__PURE__ */ new Error(`Resource ${resourceID} already exists in the stack and is of a different type: '${otherResource?.[ResourceKind]}' !== '${type$1}'`);
+				await createAndSendEvent({
+					event: "resource.error",
+					resource: type$1,
+					phase: scope.phase,
+					status: "unknown",
+					duration: 0,
+					replaced: false
+				}, error$84);
+				throw error$84;
+			}
+		}
+		const seq = scope.seq();
+		const meta = {
+			[ResourceKind]: type$1,
+			[ResourceID]: resourceID,
+			[ResourceFQN]: scope.fqn(resourceID),
+			[ResourceSeq]: seq,
+			[ResourceScope]: scope,
+			[DestroyStrategy]: options?.destroyStrategy ?? "sequential"
+		};
+		const promise$3 = apply$2(meta, props, options);
+		const resource = Object.assign(promise$3, meta);
+		scope.resources.set(resourceID, resource);
+		return resource;
+	});
+	provider.type = type$1;
+	provider.handler = handler;
+	provider.options = options;
+	PROVIDERS.set(type$1, provider);
+	return provider;
+}
 
 //#endregion
 //#region src/destroy.ts
@@ -38412,9 +38461,239 @@ function context({ scope, phase, kind, id, fqn, seq, state, replace, props, isRe
 
 //#endregion
 //#region src/apply.ts
+function apply$2(resource, props, options) {
+	return _apply(resource, props, options);
+}
 function isReplacedSignal(error$84) {
 	return error$84 instanceof Error && error$84.kind === "ReplacedSignal";
 }
+var ReplacedSignal = class extends Error {
+	kind = "ReplacedSignal";
+	force;
+	constructor(force$1) {
+		super();
+		this.force = force$1 ?? false;
+	}
+};
+async function _apply(resource, props, options) {
+	const scope = resource[ResourceScope];
+	const start = performance.now();
+	validateResourceID(resource[ResourceID], "Resource");
+	try {
+		const quiet = props?.quiet ?? scope.quiet;
+		await scope.init();
+		let state = await scope.state.get(resource[ResourceID]);
+		const provider = PROVIDERS.get(resource[ResourceKind]);
+		if (provider === void 0) throw new Error(`Provider "${resource[ResourceKind]}" not found`);
+		if (scope.phase === "read") {
+			if (state === void 0) if (scope.isSelected === false) {
+				if (process.argv.includes("--destroy")) process.exit(0);
+				state = await waitForConsistentState();
+			} else throw new Error(`Resource "${resource[ResourceFQN]}" not found and running in 'read' phase. Selected(${scope.isSelected})`);
+			else if (scope.isSelected === false) state = await waitForConsistentState();
+			await createAndSendEvent({
+				event: "resource.read",
+				phase: scope.phase,
+				duration: performance.now() - start,
+				status: state.status,
+				resource: resource[ResourceKind],
+				replaced: false
+			});
+			return state.output;
+			async function waitForConsistentState() {
+				let startTime = Date.now();
+				while (true) {
+					if (state === void 0) {} else if (state.status === "creating" || state.status === "updating") {} else if (state.status === "deleted" || state.status === "deleting") throw new Error("Resource is being deleted");
+					else if (await inputsAreEqual(state)) return state;
+					else {
+						const elapsed = Date.now() - startTime;
+						if ((state.status === "created" || state.status === "updated") && elapsed > 1e3) logger.warn(`Resource '${resource[ResourceFQN]}' is not in a stable state after ${elapsed}ms, be sure to check if your input props are deterministic:`, state.props);
+					}
+					const jitter = 100 + Math.random() * 200;
+					await new Promise((resolve$1) => setTimeout(resolve$1, jitter));
+					state = await scope.state.get(resource[ResourceID]);
+				}
+			}
+			async function inputsAreEqual(state$1) {
+				const oldProps = await serialize$1(scope, state$1.props, { encrypt: false });
+				const newProps = await serialize$1(scope, props, { encrypt: false });
+				return JSON.stringify(oldProps) === JSON.stringify(newProps);
+			}
+		}
+		if (state === void 0) {
+			state = {
+				kind: resource[ResourceKind],
+				id: resource[ResourceID],
+				fqn: resource[ResourceFQN],
+				seq: resource[ResourceSeq],
+				status: "creating",
+				data: {},
+				output: {
+					[ResourceID]: resource[ResourceID],
+					[ResourceFQN]: resource[ResourceFQN],
+					[ResourceKind]: resource[ResourceKind],
+					[ResourceScope]: scope,
+					[ResourceSeq]: resource[ResourceSeq],
+					[DestroyStrategy]: provider.options?.destroyStrategy ?? "sequential"
+				},
+				props: {}
+			};
+			await scope.state.set(resource[ResourceID], state);
+		}
+		const oldOutput = state.output;
+		const alwaysUpdate = options?.alwaysUpdate ?? provider.options?.alwaysUpdate ?? false;
+		if (state.status === "created" || state.status === "updated") {
+			const oldProps = await serialize$1(scope, state.props, { encrypt: false });
+			const newProps = await serialize$1(scope, props, { encrypt: false });
+			if (JSON.stringify(oldProps) === JSON.stringify(newProps) && alwaysUpdate !== true && !scope.force) {
+				if (!quiet) logger.task(resource[ResourceFQN], {
+					prefix: "skipped",
+					prefixColor: "yellowBright",
+					resource: formatFQN(resource[ResourceFQN]),
+					message: "Skipped Resource (no changes)",
+					status: "success"
+				});
+				createAndSendEvent({
+					event: "resource.skip",
+					resource: resource[ResourceKind],
+					status: state.status,
+					phase: scope.phase,
+					duration: performance.now() - start,
+					replaced: false
+				});
+				return state.output;
+			}
+		}
+		const phase = state.status === "creating" ? "create" : "update";
+		state.status = phase === "create" ? "creating" : "updating";
+		state.oldProps = state.props;
+		state.props = props;
+		if (!quiet) logger.task(resource[ResourceFQN], {
+			prefix: phase === "create" ? "creating" : "updating",
+			prefixColor: "magenta",
+			resource: formatFQN(resource[ResourceFQN]),
+			message: `${phase === "create" ? "Creating" : "Updating"} Resource...`
+		});
+		createAndSendEvent({
+			event: "resource.start",
+			resource: resource[ResourceKind],
+			status: state.status,
+			phase: scope.phase,
+			duration: performance.now() - start,
+			replaced: false
+		});
+		await scope.state.set(resource[ResourceID], state);
+		let isReplaced = false;
+		const ctx = context({
+			scope,
+			phase,
+			kind: resource[ResourceKind],
+			id: resource[ResourceID],
+			fqn: resource[ResourceFQN],
+			seq: resource[ResourceSeq],
+			props: state.oldProps,
+			state,
+			isReplacement: false,
+			replace: (force$1) => {
+				if (phase === "create") throw new Error(`Resource ${resource[ResourceKind]} ${resource[ResourceFQN]} cannot be replaced in create phase.`);
+				if (isReplaced) logger.warn(`Resource ${resource[ResourceKind]} ${resource[ResourceFQN]} is already marked as REPLACE`);
+				isReplaced = true;
+				throw new ReplacedSignal(force$1);
+			}
+		});
+		let output;
+		try {
+			output = await alchemy.run(resource[ResourceID], {
+				isResource: true,
+				parent: scope,
+				destroyStrategy: provider.options?.destroyStrategy ?? "sequential",
+				noop: options?.noop
+			}, async () => ctx(await provider.handler.bind(ctx)(resource[ResourceID], props)));
+		} catch (error$84) {
+			if (error$84 instanceof ReplacedSignal) {
+				if (error$84.force) await destroy$1(resource, {
+					quiet: scope.quiet,
+					strategy: resource[DestroyStrategy] ?? "sequential",
+					replace: {
+						props: state.oldProps,
+						output: oldOutput
+					},
+					noop: options?.noop
+				});
+				else {
+					if ((scope.children.get(resource[ResourceID])?.children.size ?? 0) > 0) throw new Error(`Resource ${resource[ResourceFQN]} has children and cannot be replaced.`);
+					const pendingDeletions = await scope.get("pendingDeletions") ?? [];
+					pendingDeletions.push({
+						resource: oldOutput,
+						oldProps: state.oldProps
+					});
+					await scope.set("pendingDeletions", pendingDeletions);
+				}
+				output = await alchemy.run(resource[ResourceID], {
+					isResource: true,
+					parent: scope,
+					noop: options?.noop
+				}, async () => {
+					const ctx$1 = context({
+						scope,
+						phase: "create",
+						kind: resource[ResourceKind],
+						id: resource[ResourceID],
+						fqn: resource[ResourceFQN],
+						seq: resource[ResourceSeq],
+						props: state.props,
+						state,
+						isReplacement: true,
+						replace: () => {
+							throw new Error(`Resource ${resource[ResourceKind]} ${resource[ResourceFQN]} cannot be replaced in create phase.`);
+						}
+					});
+					return ctx$1(await provider.handler.bind(ctx$1)(resource[ResourceID], props));
+				});
+			} else throw error$84;
+		}
+		if (!quiet) logger.task(resource[ResourceFQN], {
+			prefix: phase === "create" ? "created" : isReplaced ? "replaced" : "updated",
+			prefixColor: "greenBright",
+			resource: formatFQN(resource[ResourceFQN]),
+			message: `${phase === "create" ? "Created" : isReplaced ? "Replaced" : "Updated"} Resource`,
+			status: "success"
+		});
+		const status = phase === "create" ? "created" : "updated";
+		createAndSendEvent({
+			event: "resource.success",
+			resource: resource[ResourceKind],
+			status,
+			phase: scope.phase,
+			duration: performance.now() - start,
+			replaced: isReplaced
+		});
+		state = await scope.state.get(resource[ResourceID]);
+		await scope.state.set(resource[ResourceID], {
+			kind: resource[ResourceKind],
+			id: resource[ResourceID],
+			fqn: resource[ResourceFQN],
+			seq: resource[ResourceSeq],
+			data: state?.data ?? {},
+			status,
+			output,
+			props
+		});
+		return output;
+	} catch (error$84) {
+		let errorToSend = error$84 instanceof Error ? error$84 : new Error(String(error$84));
+		createAndSendEvent({
+			event: "resource.error",
+			resource: resource[ResourceKind],
+			duration: performance.now() - start,
+			phase: scope.phase,
+			status: "unknown",
+			replaced: false
+		}, errorToSend);
+		scope.fail();
+		throw error$84;
+	}
+}
 
 //#endregion
 //#region src/env.ts
@@ -39214,74 +39493,78 @@ let CloudflareAuth;
 		}
 	});
 	_CloudflareAuth.ALL_SCOPES = {
-		"access:read": "Read Cloudflare Access",
-		"access:write": "Write Cloudflare Access",
-		"account:read": "See your account info such as account details, analytics, and memberships.",
-		"agw:read": "Read API Gateway",
-		"agw:run": "Run API Gateway",
-		"ai:read": "Read access to Workers AI catalog and assets",
-		"ai:write": "See and change Workers AI catalog and assets",
-		"aiaudit:read": "Read AI Audit",
-		"aiaudit:write": "Write AI Audit",
-		"aig:read": "Read AI Gateway",
-		"aig:write": "Write AI Gateway",
-		"auditlogs:read": "Read audit logs",
-		"browser:read": "Read Browser",
-		"browser:write": "Write Browser",
-		"cfone:read": "Read Cloudflare One",
-		"cfone:write": "Write Cloudflare One",
-		"cloudchamber:write": "Manage Cloudchamber",
-		"constellation:write": "Write Constellation",
-		"containers:write": "Manage Workers Containers",
-		"d1:write": "See and change D1 Databases.",
-		"dex:read": "Read DEX",
-		"dex:write": "Write DEX",
-		"dns_analytics:read": "Read DNS analytics",
-		"dns_records:edit": "Edit DNS records",
-		"dns_records:read": "Read DNS records",
-		"dns_settings:read": "Read DNS settings",
-		"firstpartytags:write": "Write First Party Tags",
-		"lb:edit": "Edit Load Balancer",
-		"lb:read": "Read Load Balancer",
-		"logpush:read": "Read Logpush",
-		"logpush:write": "Write Logpush",
-		"notification:read": "Read Notifications",
-		"notification:write": "Write Notifications",
-		"pages:read": "Read access to Pages projects, settings, and deployments.",
-		"pages:write": "See and change Pages projects, settings, and deployments.",
-		"pipelines:read": "Read access to Pipelines configurations and data",
-		"pipelines:setup": "Setup access to Pipelines configurations and data",
-		"pipelines:write": "See and change Pipelines configurations and data",
-		"query_cache:write": "Write Query Cache",
-		"queues:write": "See and change Queues settings and data",
-		"r2_catalog:write": "Write R2 Catalog",
-		"radar:read": "Read Radar",
-		"rag:read": "Read RAG",
-		"rag:write": "Write RAG",
-		"secrets_store:read": "Read access to secrets + stores within the Secrets Store",
-		"secrets_store:write": "See and change secrets + stores within the Secrets Store",
-		"sso-connector:read": "Read SSO Connector",
-		"sso-connector:write": "Write SSO Connector",
-		"ssl_certs:write": "See and manage mTLS certificates for your account",
-		"teams:pii": "Read Teams PII",
-		"teams:read": "Read Teams",
-		"teams:secure_location": "Read Secure Location",
-		"teams:write": "Write Teams",
-		"url_scanner:read": "Read URL Scanner",
-		"url_scanner:write": "Write URL Scanner",
-		"user:read": "See your user info such as name, email address, and account memberships.",
-		"vectorize:write": "Write Vectorize",
-		"workers:write": "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
-		"workers_builds:read": "Read Workers Builds",
-		"workers_builds:write": "Write Workers Builds",
-		"workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
-		"workers_observability:read": "Read Workers Observability",
-		"workers_observability:write": "Write Workers Observability",
-		"workers_observability_telemetry:write": "Write Workers Observability Telemetry",
-		"workers_routes:write": "See and change Cloudflare Workers data such as filters and routes.",
-		"workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
-		"workers_tail:read": "See Cloudflare Workers tail and script data.",
-		"zone:read": "Grants read level access to account zone."
+		"access:read": "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+		"access:write": "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+		"account:read": "See your account info such as account details, analytics, and memberships",
+		"agw:read": "Grants read level access to Agents Gateway",
+		"agw:run": "Grants run level access to Agents Gateway",
+		"agw:write": "Grants read and write level access to Agents Gateway",
+		"ai:read": "Grants read level access to Workers AI",
+		"ai:write": "Grants write level access to Workers AI",
+		"aiaudit:read": "Grants read level access to AI Audit",
+		"aiaudit:write": "Grants write level access to AI Audit",
+		"aig:read": "Grants read level access to AI Gateway",
+		"aig:write": "Grants write level access to AI Gateway",
+		"auditlogs:read": "View Cloudflare Account Audit Logs",
+		"browser:read": "Grants read level access to Browser Rendering",
+		"browser:write": "Grants write level access to Browser Rendering",
+		"cfone:read": "Grants read level access to Cloudforce One data",
+		"cfone:write": "Grants write level access to Cloudforce One data",
+		"cloudchamber:write": "See and make changes to Cloudchamber",
+		"connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
+		"connectivity:bind": "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+		"connectivity:read": "See Connectivity Directory services and Cloudflare Tunnels",
+		"constellation:write": "Grants write access to Constellation configuration and models",
+		"containers:write": "See and make changes to Workers Containers",
+		"d1:write": "See and make changes to D1",
+		"dex:read": "Grants read level access to Cloudflare DEX",
+		"dex:write": "Grants write level access to Cloudflare DEX",
+		"dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
+		"dns_records:edit": "Grants edit level access to dns records",
+		"dns_records:read": "Grants read level access to dns records",
+		"dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
+		"firstpartytags:write": "Can see, edit and publish Google tag gateway configuration.",
+		"lb:edit": "Grants edit level access to lb and lb pools",
+		"lb:read": "Grants read level access to lb and lb pools",
+		"logpush:read": "See Cloudflare Logpush data",
+		"logpush:write": "See and change Cloudflare Logpush data",
+		"notification:read": "View Cloudflare Notifications",
+		"notification:write": "View and Modify Cloudflare Notifications",
+		"pages:read": "See Cloudflare Pages projects, settings and deployments",
+		"pages:write": "See and change Cloudflare Pages projects, settings and deployments",
+		"pipelines:read": "Grants read level access to Cloudflare Pipelines",
+		"pipelines:setup": "Grants permission to generate R2 tokens for Workers Pipelines",
+		"pipelines:write": "Grants write level access to Cloudflare Pipelines",
+		"query_cache:write": "See and make changes to Hyperdrive",
+		"queues:write": "See and change Cloudflare Queues settings and data",
+		"r2_catalog:write": "Grants write level access to R2 Data Catalog",
+		"radar:read": "Grants access to read Cloudflare Radar data",
+		"rag:read": "Grants read level access to Auto Rag",
+		"rag:write": "Grants write level access to Auto Rag",
+		"secrets_store:read": "Grants read level access to Secrets Store",
+		"secrets_store:write": "Grants write level access to Secrets Store",
+		"ssl_certs:write": "Grants read and write access to SSL MTLS certificates or Certificate Store",
+		"sso-connector:read": "See Cloudflare SSO connectors",
+		"sso-connector:write": "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
+		"teams:pii": "See personally identifiable Cloudflare Teams data",
+		"teams:read": "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+		"teams:secure_location": "See all DNS Location data but can only change secure DNS Locations",
+		"teams:write": "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+		"url_scanner:read": "Grants read level access to URL Scanner",
+		"url_scanner:write": "Grants write level access to URL Scanner",
+		"user:read": "See your user info such as name, email address, and account memberships",
+		"vectorize:write": "See and make changes to Vectorize",
+		"workers:read": "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+		"workers:write": "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+		"workers_builds:read": "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+		"workers_builds:write": "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+		"workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
+		"workers_observability:read": "Grants read access to Cloudflare Workers Observability",
+		"workers_observability_telemetry:write": "Grants write access to Cloudflare Workers Observability Telemetry API",
+		"workers_routes:write": "See and change Cloudflare Workers data such as filters and routes",
+		"workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
+		"workers_tail:read": "See Cloudflare Workers tail and script data",
+		"zone:read": "Grants read level access to account zone"
 	};
 	_CloudflareAuth.DEFAULT_SCOPES = [
 		"account:read",
@@ -39301,7 +39584,8 @@ let CloudflareAuth;
 		"secrets_store:write",
 		"containers:write",
 		"cloudchamber:write",
-		"vectorize:write"
+		"vectorize:write",
+		"connectivity:admin"
 	];
 	_CloudflareAuth.formatHeadersWithRefresh = async (input) => {
 		if (!Credentials.isOAuthExpired(input.credentials)) return formatHeaders(input.credentials);
@@ -42005,15 +42289,52 @@ async function exists(path$32) {
 	}
 }
 
+//#endregion
+//#region src/util/find-workspace-root.ts
+async function findWorkspaceRoot(directory = process.cwd()) {
+	if ((await Promise.all(Object.entries(predicates).map(async ([file$2, predicate]) => {
+		return await check(path$1.join(directory, file$2), predicate);
+	}))).includes(true)) return directory;
+	const parent = path$1.resolve(directory, "..");
+	if (parent === directory) return directory;
+	return await findWorkspaceRoot(parent);
+}
+async function check(filePath, predicate) {
+	if (!await exists(filePath)) return false;
+	if (typeof predicate === "function") try {
+		const value = await fs$1.readFile(filePath, "utf-8");
+		return predicate(JSON.parse(value));
+	} catch {
+		return false;
+	}
+	else return true;
+}
+const predicates = {
+	"bun.lock": true,
+	"bun.lockb": true,
+	".git": true,
+	"lerna.json": true,
+	"package.json": (value) => "workspaces" in value,
+	"package-lock.json": true,
+	"nx.json": true,
+	"pnpm-lock.yaml": true,
+	"pnpm-workspace.yaml": true,
+	"pnpm-workspace.yml": true,
+	"rush.json": true,
+	"turbo.json": (value) => !("extends" in value),
+	"yarn.lock": true
+};
+
 //#endregion
 //#region src/util/detect-package-manager.ts
-async function detectPackageManager(path$32 = process.cwd()) {
-	if (await exists(`${path$32}/deno.lock`)) return "deno";
-	if (await exists(`${path$32}/deno.json`) || await exists(`${path$32}/deno.jsonc`)) return "deno";
-	if (await exists(`${path$32}/bun.lockb`)) return "bun";
-	if (await exists(`${path$32}/bun.lock`)) return "bun";
-	if (await exists(`${path$32}/pnpm-lock.yaml`)) return "pnpm";
-	if (await exists(`${path$32}/yarn.lock`)) return "yarn";
+async function detectPackageManager(root = process.cwd()) {
+	root = await findWorkspaceRoot(root);
+	if (await exists(path$1.resolve(root, "deno.lock"))) return "deno";
+	if (await exists(path$1.resolve(root, "deno.json")) || await exists(path$1.resolve(root, "deno.jsonc"))) return "deno";
+	if (await exists(path$1.resolve(root, "bun.lockb"))) return "bun";
+	if (await exists(path$1.resolve(root, "bun.lock"))) return "bun";
+	if (await exists(path$1.resolve(root, "pnpm-lock.yaml"))) return "pnpm";
+	if (await exists(path$1.resolve(root, "yarn.lock"))) return "yarn";
 	if (process.env.npm_execpath?.includes("bun")) return "bun";
 	if (process.env.DENO) return "deno";
 	const userAgent = process.env.npm_config_user_agent;
@@ -55215,46 +55536,9 @@ function handleError(error$84) {
 function detectRuntime() {
 	if (typeof Bun !== "undefined" && Bun !== null) return "bun";
 	if (typeof Deno !== "undefined" && Deno !== null) return "deno";
-	if (typeof process !== "undefined" && process.release?.name === "node") return "node";
 	return "node";
 }
 
-//#endregion
-//#region src/util/find-workspace-root.ts
-async function findWorkspaceRoot(directory = process.cwd()) {
-	if ((await Promise.all(Object.entries(predicates).map(async ([file$2, predicate]) => {
-		return await check(path$1.join(directory, file$2), predicate);
-	}))).includes(true)) return directory;
-	const parent = path$1.resolve(directory, "..");
-	if (parent === directory) return directory;
-	return await findWorkspaceRoot(parent);
-}
-async function check(filePath, predicate) {
-	if (!await exists(filePath)) return false;
-	if (typeof predicate === "function") try {
-		const value = await fs$1.readFile(filePath, "utf-8");
-		return predicate(JSON.parse(value));
-	} catch {
-		return false;
-	}
-	else return true;
-}
-const predicates = {
-	"bun.lock": true,
-	"bun.lockb": true,
-	".git": true,
-	"lerna.json": true,
-	"package.json": (value) => "workspaces" in value,
-	"package-lock.json": true,
-	"nx.json": true,
-	"pnpm-lock.yaml": true,
-	"pnpm-workspace.yaml": true,
-	"pnpm-workspace.yml": true,
-	"rush.json": true,
-	"turbo.json": (value) => !("extends" in value),
-	"yarn.lock": true
-};
-
 //#endregion
 //#region src/util/find-open-port.ts
 async function findOpenPort(min = 1337, max = 65535) {
@@ -55509,33 +55793,12 @@ async function execAlchemy(main, { cwd: cwd$1 = process.cwd(), quiet, force: for
 	const runtime$1 = detectRuntime();
 	const argsString = args.join(" ");
 	const execArgsString = execArgs$1.join(" ");
-	let command;
-	const isTypeScript = main.endsWith("ts");
-	switch (packageManager) {
-		case "bun":
-			command = `bun ${execArgsString} ${main} ${argsString}`;
-			break;
-		case "deno":
-			command = `deno run -A ${execArgsString} ${main} ${argsString}`;
-			break;
-		case "pnpm":
-			command = isTypeScript ? `pnpm dlx tsx ${execArgsString} ${main} ${argsString}` : `pnpm node ${execArgsString} ${main} ${argsString}`;
-			break;
-		case "yarn":
-			command = isTypeScript ? `yarn tsx ${execArgsString} ${main} ${argsString}` : `yarn node ${execArgsString} ${main} ${argsString}`;
-			break;
-		default: switch (runtime$1) {
-			case "bun":
-				command = `bun ${execArgsString} ${main} ${argsString}`;
-				break;
-			case "deno":
-				command = `deno run -A ${execArgsString} ${main} ${argsString}`;
-				break;
-			case "node":
-				command = isTypeScript ? `npx tsx ${execArgsString} ${main} ${argsString}` : `node ${execArgsString} ${main} ${argsString}`;
-				break;
-		}
-	}
+	const node = main.endsWith("ts") ? `npx tsx ${execArgsString} ${main} ${argsString}` : `node ${execArgsString} ${main} ${argsString}`;
+	const commands = {
+		bun: `bun ${execArgsString} ${main} ${argsString}`,
+		deno: `deno run -A ${execArgsString} ${main} ${argsString}`
+	};
+	const command = commands[packageManager] ?? commands[runtime$1] ?? node;
 	const childRuntime = command.split(" ")[0];
 	const { promise: inspectorUrlPromise, resolve: resolveInspectorUrl } = promiseWithResolvers();
 	process.on("SIGINT", async () => {
@@ -230730,6 +230993,1839 @@ const telemetry = t.router({
 	})
 });
 
+//#endregion
+//#region src/cloudflare/permission-groups.ts
+Resource("cloudflare::PermissionGroups", async function() {
+	if (this.phase === "delete") return this.destroy();
+	throw new Error("Not implemented");
+});
+const PERMISSION_GROUPS = [
+	{
+		id: "19637fbb73d242c0a92845d8db0b95b1",
+		name: "AI Audit Read",
+		description: "Grants access to reading AI Audit",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1ba6ab4cacdb454b913bbb93e1b8cb8c",
+		name: "AI Audit Write",
+		description: "Grants access to reading and editing AI Audit",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "4dc8917b4b40457d88d3035d5dadb054",
+		name: "AI Gateway Read",
+		description: "Grants access to reading AI Gateways",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "644535f4ed854494a59cb289d634b257",
+		name: "AI Gateway Run",
+		description: "Grants access to run AI Gateways",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6c8a3737f07f46369c1ea1f22138daaf",
+		name: "AI Gateway Write",
+		description: "Grants access to reading and editing AI Gateways",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "eb258a38ea634c86a0c89da6b27cb6b6",
+		name: "Access: Apps and Policies Read",
+		description: "Grants read access to Cloudflare Access zone resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "7ea222f6d5064cfa89ea366d7c1fee89",
+		name: "Access: Apps and Policies Read",
+		description: "Grants read access to Cloudflare Access applications and policies",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6db4e222e21248ac96a3f4c2a81e3b41",
+		name: "Access: Apps and Policies Revoke",
+		description: "Grants ability to revoke all tokens to Cloudflare Access zone resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "6c9d1cfcfc6840a987d1b5bfb880a841",
+		name: "Access: Apps and Policies Revoke",
+		description: "Grants ability to revoke Cloudflare Access application tokens",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "959972745952452f8be2452be8cbb9f2",
+		name: "Access: Apps and Policies Write",
+		description: "Grants write access to Cloudflare Access zone resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1e13c5124ca64b72b1969a67e8829049",
+		name: "Access: Apps and Policies Write",
+		description: "Grants write access to Cloudflare Access applications and policies",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b05b28e839c54467a7d6cba5d3abb5a3",
+		name: "Access: Audit Logs Read",
+		description: "Grants read access to Cloudflare Access audit logs",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "08e61dabe81a422dab0dea6fdef1a98a",
+		name: "Access: Custom Pages Read",
+		description: "Grants read access to Cloudflare Access Custom Pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4e5fd8ac327b4a358e48c66fcbeb856d",
+		name: "Access: Custom Pages Write",
+		description: "Grants write access to Cloudflare Access Custom Pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0f4841f80adb4bada5a09493300e7f8d",
+		name: "Access: Device Posture Read",
+		description: "Grants read access to Cloudflare Access Device Posture",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2fc1072ee6b743828db668fcb3f9dee7",
+		name: "Access: Device Posture Write",
+		description: "Grants write access to Cloudflare Access Device Posture",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4f3196a5c95747b6ad82e34e1d0a694f",
+		name: "Access: Mutual TLS Certificates Read",
+		description: "Grants read access to Cloudflare Access mTLS certificates",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "29d3afbfd4054af9accdd1118815ed05",
+		name: "Access: Mutual TLS Certificates Write",
+		description: "Grants write access to Cloudflare Access mTLS certificates",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "26bc23f853634eb4bff59983b9064fde",
+		name: "Access: Organizations, Identity Providers, and Groups Read",
+		description: "Grants read access to Cloudflare Access account resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7121a0c7e9ed46e3829f9cca2bb572aa",
+		name: "Access: Organizations, Identity Providers, and Groups Revoke",
+		description: "Grants ability to revoke user sessions to Cloudflare Access account resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "bfe0d8686a584fa680f4c53b5eb0de6d",
+		name: "Access: Organizations, Identity Providers, and Groups Write",
+		description: "Grants write access to Cloudflare Access account resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b8b7514ce5364cd8ac0455f3eb16eb5f",
+		name: "Access: Policy Test Read",
+		description: "Grants read access to Cloudflare Access Policy Tests",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6d23f290472f4e6fad5c4398c057c356",
+		name: "Access: Policy Test Write",
+		description: "Grants full access to Cloudflare Access Policy Tests",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "de99c87e48d642ce8c985d027905b475",
+		name: "Access: Population Read",
+		description: "Grants read access to Cloudflare Access Populations",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "bc783549a3a741aaa10556faf8b485bb",
+		name: "Access: Population Write",
+		description: "Grants write access to Cloudflare Access Populations",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e985ca9351db460faebbe8681c48e560",
+		name: "Access: SCIM logs read",
+		description: "Grants read access to SCIM audit logs",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "99ff99e4e30247a99d3777a8c4c18541",
+		name: "Access: SSH Auditing Read",
+		description: "Grants read access to Cloudflare Access SSH certificate authorities (CAs)",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d30c9ad8b5224e7cb8d41bcb4757effc",
+		name: "Access: SSH Auditing Write",
+		description: "Grants write access to Cloudflare Access SSH certificate authorities (CAs)",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "91f7ce32fa614d73b7e1fc8f0e78582b",
+		name: "Access: Service Tokens Read",
+		description: "Grants read access to Cloudflare Access Service Tokens",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a1c0fec57cf94af79479a6d827fa518c",
+		name: "Access: Service Tokens Write",
+		description: "Grants write access to Cloudflare Access Service Tokens",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5e5d3e8efeec49f3afb67bafecbcd511",
+		name: "Account API Gateway",
+		description: "Grants full access to API-Gateway Management (including API Shield) across the whole account",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "05a2a65760a546439ed29762b163cece",
+		name: "Account API Gateway Read",
+		description: "Grants read access to API-Gateway Management (including API Shield) across the whole account",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "eb56a6953c034b9d97dd838155666f06",
+		name: "Account API Tokens Read",
+		description: "Grants read access to account API Tokens",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5bc3f8b21c554832afc660159ab75fa4",
+		name: "Account API Tokens Write",
+		description: "Grants write access to account API Tokens",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b89a480218d04ceb98b4fe57ca29dc1f",
+		name: "Account Analytics Read",
+		description: "Grants read access to analytics",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c57ea647ef654b47bc8944fa739b570d",
+		name: "Account Custom Pages Read",
+		description: "Grants read access to account custom pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8a9d35a7c8504208ad5c3e8d58e6162d",
+		name: "Account Custom Pages Write",
+		description: "Grants write access to account custom pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cfa964bcdafc4ab39704e7476154e41b",
+		name: "Account DNS Settings Read",
+		description: "Grants read access to Account DNS Settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "dc44f27f48ab405392a5f69fe822bd01",
+		name: "Account DNS Settings Write",
+		description: "Grants write access to Account DNS Settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "de7a688cc47d43bd9ea700b467a09c96",
+		name: "Account Firewall Access Rules Read",
+		description: "Grants read access to account firewall access rules",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a416acf9ef5a4af19fb11ed3b96b1fe6",
+		name: "Account Firewall Access Rules Write",
+		description: "Grants write access to account firewall access rules",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4f1071168de8466e9808de86febfc516",
+		name: "Account Rule Lists Read",
+		description: "Grants read access to Rule Lists",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2edbf20661fd4661b0fe10e9e12f485c",
+		name: "Account Rule Lists Write",
+		description: "Grants write access to Rule Lists",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "fb39996ee9044d2a8725921e02744b39",
+		name: "Account Rulesets Read",
+		description: "Grants read access to Account Rulesets",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "56907406c3d548ed902070ec4df0e328",
+		name: "Account Rulesets Write",
+		description: "Grants write access to Account Rulesets",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "ece81d7757ff406cad61f221a4920d55",
+		name: "Account Security Center Insights Read",
+		description: "Grants read access to Security Center Insights",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cfa2e2893226455c9b945914969dff7c",
+		name: "Account Security Center Insights Write",
+		description: "Grants write access to Security Center Insights",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c1fde68c7bcc44588cbb6ddbc16d6480",
+		name: "Account Settings Read",
+		description: "Grants read access to Account resources, account membership, and account level features",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "1af1fa2adc104452b74a9a3364202f20",
+		name: "Account Settings Write",
+		description: "Grants write access to Account resources, account membership, and account level features",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "56b2af4817c84ad99187911dc3986c23",
+		name: "Account WAF Read",
+		description: "Grants read access to Account WAF",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cde8c82463b6414ca06e46b9633f52a6",
+		name: "Account WAF Write",
+		description: "grants write access to account waf",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3e4e20ee40b9475dae22201c468fdb70",
+		name: "Account Waiting Rooms Read",
+		description: "Grants read access to Waiting Rooms\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a7a233f9604845c787d4c8c39ac09c21",
+		name: "Account: SSL and Certificates Read",
+		description: "Grants read access to SSL MTLS certificates or Certificate Store",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "db37e5f1cb1a4e1aabaef8deaea43575",
+		name: "Account: SSL and Certificates Write",
+		description: "Grants read and write access to SSL MTLS certificates or Certificate Store",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d07270cea5484b08ad6440c985af2148",
+		name: "Address Maps Read",
+		description: "Grants read access to Address Maps",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6ffe7f4299db4d4cb54f64e0eb12a456",
+		name: "Address Maps Write",
+		description: "Grants write access to Address Maps",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "151803815e4f47de854c2fb7f8284d57",
+		name: "Agents Gateway Read",
+		description: "Grants access to reading Agents Gateway",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "82748b814dcd46b9b3e66b8151ba5e95",
+		name: "Agents Gateway Run",
+		description: "Grants access to running Agents Gateway",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e84fd345697c4036a14e7810da036e1a",
+		name: "Agents Gateway Write",
+		description: "Grants access to reading and editing Agents Gateway",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f3604047d46144d2a3e9cf4ac99d7f16",
+		name: "Allow Request Tracer Read",
+		description: "Allows read access to request tracer API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "9c88f9c5bce24ce7af9a958ba9c504db",
+		name: "Analytics Read",
+		description: "Grants read access to analytics",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "d79c5e2a405b4516a322432287d40c31",
+		name: "Application Security Reports Read",
+		description: "Can read Application Security Reports",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "094547ab6e77498c8c4dfa87fadd5c51",
+		name: "Apps Write",
+		description: "Grants full access to Cloudflare Apps",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "d7887c7a417e4cf2a69f1d01c1a1dc3b",
+		name: "Auto Rag Read",
+		description: "Grants access to reading data from Auto Rag",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7fb8d27511b34d02994d005b520b679f",
+		name: "Auto Rag Write",
+		description: "Grants access to reading and writing data from Auto Rag",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "234108c786084936a381bb19b7f4ea65",
+		name: "Auto Rag Write Run Engine",
+		description: "Grants access to run Auto RAG engine",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7cf72faf220841aabcfdfab81c43c4f6",
+		name: "Billing Read",
+		description: "Grants read access to billing profile, subscriptions, usage data and access to fetch invoices and entitlements",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6c80e02421494afc9ae14414ed442632",
+		name: "Billing Write",
+		description: "Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "51be404b56244056868226263a44a632",
+		name: "Bot Management Feedback Report Read",
+		description: "Grants read access to BOT Management Feedback Reports",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "2002629aaff0454085bf5a201ed70a72",
+		name: "Bot Management Feedback Report Write",
+		description: "Grants write access to BOT Management Feedback Reports",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "07bea2220b2343fa9fae15656c0d8e88",
+		name: "Bot Management Read",
+		description: "Grants read access to BOT Management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "3b94c49258ec4573b06d51d99b6416c0",
+		name: "Bot Management Write",
+		description: "Grants write access to BOT Management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "374b03fa229f4eb6b011bb1cd7f235ee",
+		name: "Browser Rendering Read",
+		description: "Grants read access to Browser Rendering API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "adddda876faa4a0590f1b23a038976e4",
+		name: "Browser Rendering Write",
+		description: "Grants write access to Browser Rendering API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "da5fe84b9c5446a0a5955b673fafa288",
+		name: "CASB Read",
+		description: "Grants read access to Cloudflare CASB",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b9ed086b20864ad89c5aac24cdd02365",
+		name: "CASB Write",
+		description: "Grants write access to Cloudflare CASB",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "47b936e2027140c0a474cac8887b8c29",
+		name: "CF Agents Read",
+		description: "Grants read access to CF Agents",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cb142f7fbc3540f0bade0cbe75f606dc",
+		name: "CF Agents Write",
+		description: "Grants write access to CF Agents",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e17beae8b8cb423a99b1730f21238bed",
+		name: "Cache Purge",
+		description: "Grants access to purge cache",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "3245da1cf36c45c3847bb9b483c62f97",
+		name: "Cache Settings Read",
+		description: "Grants read access to cache settings phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "9ff81cbbe65c400b97d92c3c1033cab6",
+		name: "Cache Settings Write",
+		description: "Grants write access to cache settings phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "686ab9a8b3854f25a1474f302d14b68d",
+		name: "Calls Read",
+		description: "Grants read access to Calls configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b711942448db4b0aace44d1312f9fdb0",
+		name: "Calls Write",
+		description: "Grants read/write access to Calls configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "9ade9cfc8f8949bcb2371be2f0ec8db1",
+		name: "China Network Steering Read",
+		description: "Grants read access to China Network Steering",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c6f6338ceae545d0b90daaa1fed855e6",
+		name: "China Network Steering Write",
+		description: "Grants write access to China Network Steering",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0661ff47aa3a4786beab3b8128e0cd24",
+		name: "Cloud Connector Read",
+		description: "Grants read access to Cloud Connector",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "eafd71286d0e4fdca404a7b4d203c5c9",
+		name: "Cloud Connector Write",
+		description: "Grants write access to Cloud Connector",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "9e5a9912439940fca5898b5b8dc6d1a5",
+		name: "Cloud Email Security: Read",
+		description: "Grants read access to Cloudflare Cloud Email Security",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a3567c13e074447fb101babac3463566",
+		name: "Cloud Email Security: Write",
+		description: "Grants write access to Cloudflare Cloud Email Security",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "65ec50cbde3d4c838bbe7500024d5745",
+		name: "Cloudchamber Read",
+		description: "Grants read access to Cloudchamber deployments",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "26ce6c7d18a346528e7b905d5e269866",
+		name: "Cloudchamber Write",
+		description: "Grants write access to Cloudchamber deployments",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "00ec19a0d4fa4e4aae23b50bf04c0630",
+		name: "Cloudflare CDS Compute Account Read",
+		description: "Grants read access to Cloudflare CDS compute account resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "9bf884ba0de445dab37ea4a3e1a2c9f1",
+		name: "Cloudflare CDS Compute Account Write",
+		description: "Grants write access to Cloudflare CDS compute account resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3a1e1ef09dd34271bb44fc4c6a419952",
+		name: "Cloudflare DEX",
+		description: "Grants access to Cloudflare DEX",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3b376e0aa52c41cbb6afc9cab945afa8",
+		name: "Cloudflare DEX Read",
+		description: "Grants read access to Cloudflare DEX",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "92c8dcd551cc42a6a57a54e8f8d3f3e3",
+		name: "Cloudflare DEX Write",
+		description: "Grants full access to Cloudflare DEX",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "1cd960c063a0448481343372c963d8c7",
+		name: "Cloudflare One Connector: WARP Read",
+		description: "Grants read access to WARP Connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5b5c774a5d174ca88d046c8889648b3f",
+		name: "Cloudflare One Connector: WARP Write",
+		description: "Grants write access to WARP Connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c1968d31028d4239976ec3bc4750bbf6",
+		name: "Cloudflare One Connector: cloudflared Read",
+		description: "Grants read access to cloudflared connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "037b9e348b3b42d4b46ea2fcb1cfb3e7",
+		name: "Cloudflare One Connector: cloudflared Write",
+		description: "Grants write access to cloudflared connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "07cf1c1952a84b13b2cd542f3d2f29ab",
+		name: "Cloudflare One Connectors Read",
+		description: "Grants read access to Cloudflare One connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a7030c9c98d544e092d8b099fabb1f06",
+		name: "Cloudflare One Connectors Write",
+		description: "Grants write access to Cloudflare One connectors",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4f1276d1e7e34c32a5012bbe02ece86d",
+		name: "Cloudflare One Networks Read",
+		description: "Grants read access to Cloudflare One routes, subnets, and virtual networks",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e2980d9241cf4939bbbd74fdc43b9651",
+		name: "Cloudflare One Networks Write",
+		description: "Grants write access to Cloudflare One routes, subnets, and virtual networks",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "efea2ab8357b47888938f101ae5e053f",
+		name: "Cloudflare Tunnel Read",
+		description: "Grants access to view Cloudflare Tunnels",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c07321b023e944ff818fec44d8203567",
+		name: "Cloudflare Tunnel Write",
+		description: "Grants access to create and delete Cloudflare Tunnels",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e0e0edfbe8834df3b51424ba4fb7bb5f",
+		name: "Cloudflare Zero Trust Secure DNS Locations Write",
+		description: "Grants access to create and edit secure DNS Locations only in teams (Zero Trust)",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cf9353ed7978436e8fb20c03fce26449",
+		name: "Cloudforce One Read",
+		description: "Grants read access to Cloudforce One",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "677767156f294485b497a8f103172e7d",
+		name: "Cloudforce One Write",
+		description: "Grants read access to Cloudforce One",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "20e5ea084b2f491c86b8d8d90abff905",
+		name: "Config Settings Read",
+		description: "Grants read access to config settings phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "06f0526e6e464647bd61b63c54935235",
+		name: "Config Settings Write",
+		description: "Grants write access to config settings phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "77efc2c0724d4c4eb94bfd9656247130",
+		name: "Connectivity Directory Admin",
+		description: "Can view, edit, create, and delete Connectivity Directory Services, including the ability to create Services that bind to Cloudflare Tunnel",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "95fa65ba51fd49c4a6ac4c8c78ebac93",
+		name: "Connectivity Directory Bind",
+		description: "Can read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8764961c1edb4274be129d630b0b2671",
+		name: "Connectivity Directory Read",
+		description: "Can view Connectivity Directory services and Cloudflare Tunnels",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "eeffa4d16812430cb4a0ae9e7f46fc24",
+		name: "Constellation Read",
+		description: "Grants read access to Constellation configuration and models",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7c81856725af47ce89a790d5fb36f362",
+		name: "Constellation Write",
+		description: "Grants write access to Constellation configuration and models",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a2b55cd504d44ef18b7ba6a7f2b8fbb1",
+		name: "Custom Errors Read",
+		description: "Grants read access to custom errors phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "a9dba34cf5814d4ab2007b4ada0045bd",
+		name: "Custom Errors Write",
+		description: "Grants write access to custom errors phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "a2431ca73b7d41f99c53303027392586",
+		name: "Custom Pages Read",
+		description: "Grants read access to custom pages",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "c244ec076974430a88bda1cdd992d0d9",
+		name: "Custom Pages Write",
+		description: "Grants write access to custom pages",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "192192df92ee43ac90f2aeeffce67e35",
+		name: "D1 Read",
+		description: "Grants read access to D1 configuration and SQL queries",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "09b2857d1c31407795e75e3fed8617a1",
+		name: "D1 Write",
+		description: "Grants write access to D1 configuration and SQL queries",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "dee7c22a57674abea8f942110b094717",
+		name: "DDoS Botnet Feed Read",
+		description: "Grants read access to Botnet Feed reports",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0caa90c9b186447397c8b00358d34a76",
+		name: "DDoS Botnet Feed Write",
+		description: "Grants write access to Botnet Feed configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "af1c363c35ba45b9a8c682ae50eb3f99",
+		name: "DDoS Protection Read",
+		description: "Grants read access to DDoS protection",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d44ed14bcc4340b194d3824d60edad3f",
+		name: "DDoS Protection Write",
+		description: "Grants write access to DDoS protection",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5f48a472240a4b489a21d43bd19a06e1",
+		name: "DNS Firewall Read",
+		description: "Grants read access to DNS Firewall",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "da6d2d6f2ec8442eaadda60d13f42bca",
+		name: "DNS Firewall Write",
+		description: "Grants write access to DNS Firewall",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "82e64a83756745bbbb1c9c2701bf816b",
+		name: "DNS Read",
+		description: "Grants read access to DNS",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "95d69e8d6d5144bfb0923667355d9f11",
+		name: "DNS View Read",
+		description: "Grants read access to DNS Views",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5b7aedd821a548b9bf5a2acabbce98c7",
+		name: "DNS View Write",
+		description: "Grants write access to DNS Views",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4755a26eedb94da69e1066d98aa820be",
+		name: "DNS Write",
+		description: "Grants write access to DNS",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "e199d584e69344eba202452019deafe3",
+		name: "Disable ESC Read",
+		description: "Grants read access to Cloudflare Disable ESC",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "29eefa0805f94fdfae2b058b5b52f319",
+		name: "Disable ESC Read",
+		description: "Grants read access to Cloudflare Disable ESC",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "9110d9dd749e464fb9f3961a2064efc5",
+		name: "Disable ESC Write",
+		description: "Grants write access to Cloudflare Disable ESC",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "18555e39c5ba40d284dde87eda845a90",
+		name: "Disable ESC Write",
+		description: "Grants write access to Cloudflare Disable ESC",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f0235726de25444a84f704b7c93afadf",
+		name: "Domain API Gateway",
+		description: "Grants full access to API-Gateway Management (including API Shield)",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "6ced5d0d69b1422396909a62c38ab41b",
+		name: "Domain API Gateway Read",
+		description: "Grants read access to API-Gateway Management (including API Shield)",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "6134079371904d8ebd77931c8ca07e50",
+		name: "Domain Page Shield",
+		description: "Grants write access to Page Shield",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "945315185a8f40518bf3e9e6d0bee126",
+		name: "Domain Page Shield Read",
+		description: "Grants read access to Page Shield",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "d8e12db741544d1586ec1d6f5d3c7786",
+		name: "Dynamic URL Redirects Read",
+		description: "Grants read access to Dynamic URL Redirect",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "74e1036f577a48528b78d2413b40538d",
+		name: "Dynamic URL Redirects Write",
+		description: "Grants write access to Dynamic URL Redirect",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "5272e56105d04b5897466995b9bd4643",
+		name: "Email Routing Addresses Read",
+		description: "Grants read access to Email Routing target addresses\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e4589eb09e63436686cd64252a3aebeb",
+		name: "Email Routing Addresses Write",
+		description: "Grants full access to Email Routing target addresses\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "1b600d9d8062443e986a973f097e728a",
+		name: "Email Routing Rules Read",
+		description: "Grants read access to Email Routing rules\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "79b3ec0d10ce4148a8f8bdc0cc5f97f2",
+		name: "Email Routing Rules Write",
+		description: "Grants full access to Email Routing rules\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1047880d37b649b49db4a504a245896f",
+		name: "Email Security DMARC Reports Read",
+		description: "Grants read access to Email Security dmarc reports\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "2eee71c9364c4cacaf469e8370f09056",
+		name: "Email Security DMARC Reports Write",
+		description: "Grants full access to Email Security dmarc reports\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "2d5b4b1f6c89487bb7184c2c1dcd3bf1",
+		name: "Email Sending Read",
+		description: "Grants access to reading data from Email Sending",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5df633d6b41c42bcaf5b4a62b9d14b64",
+		name: "Email Sending Write",
+		description: "Grants access to reading and writing data from Email Sending",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4ec32dfcb35641c5bb32d5ef1ab963b4",
+		name: "Firewall Services Read",
+		description: "Grants read access to Firewall resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "43137f8d07884d3198dc0ee77ca6e79b",
+		name: "Firewall Services Write",
+		description: "Grants write access to Firewall resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "a2c61201f92a4e06a901f156795388a9",
+		name: "Firewall for AI Read",
+		description: "Grants read access to Firewall for AI settings.",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "5af6a2f284144e95a89840408439adef",
+		name: "Firewall for AI Write",
+		description: "Grants full access to Firewall for AI settings.",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "0d24e472a9654642a97df736e8b0d980",
+		name: "Fraud Detection Read",
+		description: "Grants read access to Fraud Detection",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "685f9605fd4e44ec937b6a0db658e629",
+		name: "Fraud Detection Write",
+		description: "Grants write access to Fraud Detection",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "6b60a5a87cae475da7e76e77e4209dd5",
+		name: "HTTP Applications Read",
+		description: "Grants read-only access to HTTP Applications",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4736c02a9f224c8196ae5b127beae78c",
+		name: "HTTP Applications Write",
+		description: "Grants full access to HTTP Applications",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c49f8d15f9f44885a544d945ef5aa6ae",
+		name: "HTTP DDoS Managed Ruleset Read",
+		description: "Grants read access to HTTP DDoS Managed Ruleset",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "b88a3aa889474524bccea5cf18f122bf",
+		name: "HTTP DDoS Managed Ruleset Write",
+		description: "Grants write access to HTTP DDoS Managed Ruleset",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "fac65912d42144aa86b7dd33281bf79e",
+		name: "Health Checks Read",
+		description: "Grants read access to Health Checks",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "e0dc25a0fbdf4286b1ea100e3256b0e3",
+		name: "Health Checks Write",
+		description: "Grants write access to Health Checks",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "4d62ccf834df44808bc9283d65c4e4e9",
+		name: "Hyperdrive Read",
+		description: "Grants read access to Hyperdrive configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "721b2f51fba74871bd361de65aeb7e03",
+		name: "Hyperdrive Write",
+		description: "Grants write access to Hyperdrive configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "212c9ff247b9406d990c017482afb3a5",
+		name: "IOT Read",
+		description: "Grants read access to IOT devices",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "865ebd55bc6d4b109de6813eccfefd13",
+		name: "IOT Write",
+		description: "Grants full access to IOT devices",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e763fae6ee95443b8f56f19213c5f2a5",
+		name: "IP Prefixes: BGP On Demand Read",
+		description: "Grants access to read ip prefix bgp configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2ae23e4939d54074b7d252d27ce75a77",
+		name: "IP Prefixes: BGP On Demand Write",
+		description: "Grants access to read and change ip prefix bgp configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "27beb7f8333b41e2b946f0e23cd8091e",
+		name: "IP Prefixes: Read",
+		description: "Grants access to read ip prefix settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "92b8234e99f64e05bbbc59e1dc0f76b6",
+		name: "IP Prefixes: Write",
+		description: "Grants access to read/write ip prefix settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0cf6473ad41449e7b7b743d14fc20c60",
+		name: "Images Read",
+		description: "Grants read access to Images",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "618ec6c64a3a42f8b08bdcb147ded4e4",
+		name: "Images Write",
+		description: "Grants write access to upload Images",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c6f97eeee13345db8cc00af0953a42de",
+		name: "Integration Write",
+		description: "Grants write access to integrations",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "df1577df30ee46268f9470952d7b0cdf",
+		name: "Intel Read",
+		description: "Grants read access to Intel API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "92209474242d459690e2cdb1985eaa6c",
+		name: "Intel Write",
+		description: "Grants write access to Intel API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4657621393f94f83b8ef94adba382e48",
+		name: "L4 DDoS Managed Ruleset Read",
+		description: "Grants read access to L4 DDoS Managed Ruleset",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7a4c3574054a4d0ba7c692893ba8bdd4",
+		name: "L4 DDoS Managed Ruleset Write",
+		description: "Grants write access to L4 DDoS Managed Ruleset",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "59059f0c977b44f8b1c18e0aaf91c369",
+		name: "Load Balancers Account Read",
+		description: "Grants read access to account load balancers and associated resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "419ec42810af4659ade77716dbe47bc6",
+		name: "Load Balancers Account Write",
+		description: "Grants write access to account load balancers and associated resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e9a975f628014f1d85b723993116f7d5",
+		name: "Load Balancers Read",
+		description: "Grants read access to load balancers and associated resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
+		name: "Load Balancers Write",
+		description: "Grants write access to load balancers and associated resources",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "9d24387c6e8544e2bc4024a03991339f",
+		name: "Load Balancing: Monitors and Pools Read",
+		description: "Grants read access to account level load balancer resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d2a1802cc9a34e30852f8b33869b2f3c",
+		name: "Load Balancing: Monitors and Pools Write",
+		description: "Grants write access to account level load balancer resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6a315a56f18441e59ed03352369ae956",
+		name: "Logs Read",
+		description: "Grants read access to logs and logpush jobs",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c4a30cd58c5d42619c86a3c36c441e2d",
+		name: "Logs Read",
+		description: "Grants read access to logs and logpush jobs",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "96163bd1b0784f62b3e44ed8c2ab1eb6",
+		name: "Logs Write",
+		description: "Grants write access to logpush jobs",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3e0b5820118e47f3922f7c989e673882",
+		name: "Logs Write",
+		description: "Grants write access to logpush jobs",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "b84a912ebb4a418888fec65f65c8ff3b",
+		name: "MCP Portals Read",
+		description: "Grants access to reading MCP Portals",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "db3d398df73946acb755c05b69edfc30",
+		name: "MCP Portals Write",
+		description: "Grants access to reading and editing MCP Portals",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3a46c728a0a040d5a65cd8e2f3bc6935",
+		name: "Magic Firewall Packet Captures - Read PCAPs API",
+		description: "Grants read access to Packet Captures",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "4ea7d6421801452dbf07cef853a5ef39",
+		name: "Magic Firewall Packet Captures - Write PCAPs API",
+		description: "Grants write access to Packet Captures",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "02b71f12bb0748e9af8126494e181342",
+		name: "Magic Firewall Read",
+		description: "Grants read access to Magic Firewall",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8bd1dac84d3d43e7bfb43145f010a15c",
+		name: "Magic Firewall Write",
+		description: "Grants write access to Magic Firewall",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8e6ed1ef6e864ad0ae477ceffa5aa5eb",
+		name: "Magic Network Monitoring Admin",
+		description: "Grants admin access to MNM settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "3d85e9514f944bb4912c5871d92e5af5",
+		name: "Magic Network Monitoring Config Read",
+		description: "Grants read access to MNM config and rules",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "09c77baecb6341a2b1ca2c62b658d290",
+		name: "Magic Network Monitoring Config Write",
+		description: "Grants write access to MNM rules and update access to account settings",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "967ecf860a244dd1911a0331a0af582a",
+		name: "Magic Transit Read",
+		description: "Grants read access to Magic Transit",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0bc09a3cd4b54605990df4e307f138e1",
+		name: "Magic Transit Write",
+		description: "Grants write access to Magic Transit",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "17fc856c4ebe49d4bb70f8e4744398cf",
+		name: "Magic WAN Read",
+		description: "Grants read access to Magic WAN",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a1a7389ba7e441dba95852e10970fcc3",
+		name: "Magic WAN Write",
+		description: "Grants write access to Magic WAN",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "319f5059d33a410da0fac4d35a716157",
+		name: "Managed headers Read",
+		description: "Grants read access to managed headers phases",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "0fd9d56bc2da43ad8ea22d610dd8cab1",
+		name: "Managed headers Write",
+		description: "Grants write access to managed headers phases",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "429a068902904c5a9ed9fc267c67da9a",
+		name: "Mass URL Redirects Read",
+		description: "Grants read access to Mass URL Redirect",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "abe78e2276664f4db588c1f675a77486",
+		name: "Mass URL Redirects Write",
+		description: "Grants write access to Mass URL Redirect",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "ce18edbdcebf465e9d6d1d2fc80ffd42",
+		name: "Notifications Read",
+		description: "Grants read access to notifications",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "c3c847c5802d4ce3ba00e3e97b3c8555",
+		name: "Notifications Write",
+		description: "Grants write access to Notifications",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7b32a91ece3140d4b3c2c56f23fc8e35",
+		name: "Origin Read",
+		description: "Grants read access to origin phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "a4308c6855c84eb2873e01b6cc85cbb3",
+		name: "Origin Write",
+		description: "Grants write access to origin phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "b415b70a4fd1412886f164451f20405c",
+		name: "Page Rules Read",
+		description: "Grants read access to Page Rules",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "ed07f6c337da4195b4e72a1fb2c6bcae",
+		name: "Page Rules Write",
+		description: "Grants write access to Page Rules",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "440e6958bcc947329f8d56328d7322ce",
+		name: "Page Shield",
+		description: "Grants write access to Page Shield",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "050531528b044d58bbb71666fef7c07c",
+		name: "Page Shield Read",
+		description: "Grants read access to Page Shield across the whole account",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "87065285ab38463481e72815eefd18c3",
+		name: "Page Shield Write",
+		description: "Grants write access to Page Shield",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "e247aedd66bd41cc9193af0213416666",
+		name: "Pages Read",
+		description: "Grants read access to Cloudflare Pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8d28297797f24fb8a0c332fe0866ec89",
+		name: "Pages Write",
+		description: "Grants write access to Cloudflare Pages",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "14b9cf2f410f4c0c9a16bb10a81c0e0b",
+		name: "Pipelines Read",
+		description: "Grants read access to Cloudflare Pipelines",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5606e7405dc542949d949d59993d321f",
+		name: "Pipelines Send",
+		description: "Grants access to Send Events to Cloudflare Pipelines",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e34111af393449539859485aa5ddd5bd",
+		name: "Pipelines Write",
+		description: "Grants write access to Cloudflare Pipelines",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "fd7f886c75a244389e892c4c3c068292",
+		name: "Pubsub Configuration Read",
+		description: "Grants read access to Pubsub Configurations\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "910b6ecca1c5411bb894e787362d1312",
+		name: "Pubsub Configuration Write",
+		description: "Grants full access to Pubsub Configurations\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "84a7755d54c646ca87cd50682a34bf7c",
+		name: "Queues Read",
+		description: "Grants read access to Cloudflare Queues",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "366f57075ffc42689627bcf8242a1b6d",
+		name: "Queues Write",
+		description: "Grants write access to Cloudflare Queues",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "dfe525ec7b07472c827d8d009178b2ac",
+		name: "Radar Read",
+		description: "Grants access to reading Radar",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "de62b15d79cc4d8d9c7b443c656eadbd",
+		name: "Realtime",
+		description: "Grants access to Realtime configuration excluding sensitive data",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "ba6ce7d23a9544ccad0816691ba38e21",
+		name: "Realtime Admin",
+		description: "Grants admin access to Realtime configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "9bb90620717647a39679e1d951f140d6",
+		name: "Registrar Domains Read",
+		description: "Grants read access to Cloudflare Registrar domains",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "93ae59e7a40c4287a57ff6e501186a63",
+		name: "Response Compression Read",
+		description: "Grants read access to the response compression phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "4bd3fb513a23494aa1341a7e1eb6e080",
+		name: "Response Compression Write",
+		description: "Grants write access to the response compression phase",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "58abbad6d2ce40abb2594fbe932a2e0e",
+		name: "Rule Policies Read",
+		description: "Grants read access to Rule Policies",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "61ddc58f1da14f95b33b41213360cbeb",
+		name: "Rule Policies Write",
+		description: "Grants write access to Rule Policies",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d5812c023a5048b4882175a28952362d",
+		name: "SCIM Provisioning",
+		description: "Grants membership permissions needed for SCIM provisioning",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "7b7216b327b04b8fbc8f524e1f9b7531",
+		name: "SSL and Certificates Read",
+		description: "Grants read access to SSL configuration and cert management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "c03055bc037c4ea9afb9a9f104b7b721",
+		name: "SSL and Certificates Write",
+		description: "Grants write access to SSL configuration and cert management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1d80f6f165ea47f2b55d4a393fd697de",
+		name: "SSO Connector Read",
+		description: "Grants read access to Cloudflare SSO connectors\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "901ca5e292584c6aa1b4cdb39248bb07",
+		name: "SSO Connector Write",
+		description: "Grants write access to Cloudflare SSO connectors\n",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "853643ed57244ed1a05a7c024af9ab5a",
+		name: "Sanitize Read",
+		description: "Grants read access to sanitization",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "89bb8c37d46042e98b84560eaaa6379f",
+		name: "Sanitize Write",
+		description: "Grants write access to sanitization",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "5e33b7d77788455c9fdf18cbd38ee5a0",
+		name: "Secrets Store Read",
+		description: "Grants read access to Secrets Store",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "adc8fa2bc6124928a8b3314dc63a1235",
+		name: "Secrets Store Write",
+		description: "Grants write access to Secrets Store",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "595409c54a24444b80a495620b2d614c",
+		name: "Select Configuration Read",
+		description: "Grants read access to select configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "235eac9bb64942b49cb805cc851cb000",
+		name: "Select Configuration Write",
+		description: "Grants write access to select configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "74c654eb4aac40e28d6c6caa4c5aeb3d",
+		name: "Snippets Read",
+		description: "Grants read access to Snippets",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "dadeaf3abdf14126a77a35e0c92fc36e",
+		name: "Snippets Write",
+		description: "Grants write access to Snippets",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "de21485a24744b76a004aa153898f7fe",
+		name: "Stream Read",
+		description: "Grants read access to Cloudflare Stream",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "714f9c13a5684c2885a793f5edb36f59",
+		name: "Stream Write",
+		description: "Grants write access to Cloudflare Stream",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a9a99455bf3245f6a5a244f909d74830",
+		name: "Transform Rules Read",
+		description: "Grants read access to transform rules",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "ae16e88bc7814753a1894c7ce187ab72",
+		name: "Transform Rules Write",
+		description: "Grants write access to transform rules",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f0ba3733e746429182fcd40ec648c066",
+		name: "Trust and Safety Read",
+		description: "Grants access to read abuse reports and abuse actions",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "120f843a9c074f399b830e542e5616b8",
+		name: "Trust and Safety Write",
+		description: "Grants access to interact with abuse reports and abuse actions",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5d78fd7895974fd0bdbbbb079482721b",
+		name: "Turnstile Sites Read",
+		description: "Grants read access to Turnstile",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "755c05aa014b4f9ab263aa80b8167bd8",
+		name: "Turnstile Sites Write",
+		description: "Grants write access to Turnstile",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "5d613a610b294788a29572aaac2f254d",
+		name: "URL Scanner Read",
+		description: "Grants read access to URL Scanner API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2a400bcb29154daab509fe07e3facab0",
+		name: "URL Scanner Write",
+		description: "Grants write access to URL Scanner API",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "1799edaae5db489294430e20d9b519e0",
+		name: "Vectorize Read",
+		description: "Grants read access to Vectorize configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "64156ba5be47441096c83c7fc17c488b",
+		name: "Vectorize Write",
+		description: "Grants write access to Vectorize configuration",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cab5202d07ef47beae788e6bc95cb6fe",
+		name: "Waiting Rooms Read",
+		description: "Grants read access to Waiting Rooms\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "24fc124dc8254e0db468e60bf410c800",
+		name: "Waiting Rooms Write",
+		description: "Grants write access to Waiting Rooms\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "8e31f574901c42e8ad89140b28d42112",
+		name: "Web3 Hostnames Read",
+		description: "Grants read access to Web3 Hostnames\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "5ea6da42edb34811a78d1b007557c0ca",
+		name: "Web3 Hostnames Write",
+		description: "Grants write access to Web3 Hostnames\n",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "a92d2450e05d4e7bb7d0a64968f83d11",
+		name: "Workers AI Read",
+		description: "Grants access to invoke Workers AI models",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "bacc64e0f6c34fc0883a1223f938a104",
+		name: "Workers AI Write",
+		description: "Grants access to invoke Workers AI models and edit assets",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "ad99c5ae555e45c4bef5bdf2678388ba",
+		name: "Workers CI Read",
+		description: "Grants read access to Workers CI",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2e095cf436e2455fa62c9a9c2e18c478",
+		name: "Workers CI Write",
+		description: "Grants write access to Workers CI",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cfd39eebc07c4e3ea849e4b3d2644637",
+		name: "Workers Containers Read",
+		description: "Grants read access to Workers Containers",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "bdbcd690c763475a985e8641dddc09f7",
+		name: "Workers Containers Write",
+		description: "Grants write access to Workers Containers",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "8b47d2786a534c08a1f94ee8f9f599ef",
+		name: "Workers KV Storage Read",
+		description: "Grants read access to Cloudflare Workers KV Storage",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f7f0eda5697f475c90846e879bab8666",
+		name: "Workers KV Storage Write",
+		description: "Grants write access to Cloudflare Workers KV Storage",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "66c1ed49f4ed46098b75696a6d4ee3c9",
+		name: "Workers Observability Read",
+		description: "Grants read access to Cloudflare Workers Observability",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "29c629fb7b5e4c408ca0f7b545724fcc",
+		name: "Workers Observability Telemetry Write",
+		description: "Grants write access for Telemetry to Cloudflare Workers Observability",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "82c075da3f4647a2a03becd0fe240f8a",
+		name: "Workers Observability Write",
+		description: "Grants read and write access to Cloudflare Workers Observability",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "45db74139a62490b9b60eb7c4f34994b",
+		name: "Workers R2 Data Catalog Read",
+		description: "Grants read access to R2 Data Catalog",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "d229766a2f7f4d299f20eaa8c9b1fde9",
+		name: "Workers R2 Data Catalog Write",
+		description: "Grants write access to R2 Data Catalog",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f45430d92e2b4a6cb9f94f2594c141b8",
+		name: "Workers R2 SQL Read",
+		description: "Grants access to read-only SQL queries against R2 Data Catalog",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "6a018a9f2fc74eb6b293b0c548f38b39",
+		name: "Workers R2 Storage Bucket Item Read",
+		description: "Grants read access to Cloudflare R2 Bucket Scoped Storage",
+		scopes: ["com.cloudflare.edge.r2.bucket"]
+	},
+	{
+		id: "2efd5506f9c8494dacb1fa10a3e7d5b6",
+		name: "Workers R2 Storage Bucket Item Write",
+		description: "Grants write access to Cloudflare R2 Bucket Scoped Storage",
+		scopes: ["com.cloudflare.edge.r2.bucket"]
+	},
+	{
+		id: "b4992e1108244f5d8bfbd5744320c2e1",
+		name: "Workers R2 Storage Read",
+		description: "Grants read access to Cloudflare R2 Storage",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "bf7481a1826f439697cb59a20b22293e",
+		name: "Workers R2 Storage Write",
+		description: "Grants write access to Cloudflare R2 Storage",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "2072033d694d415a936eaeb94e6405b8",
+		name: "Workers Routes Read",
+		description: "Grants read access to Cloudflare Workers and Workers KV Storage",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "28f4b596e7d643029c524985477ae49a",
+		name: "Workers Routes Write",
+		description: "Grants write access to Cloudflare Workers and Workers KV Storage",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1a71c399035b4950a1bd1466bbe4f420",
+		name: "Workers Scripts Read",
+		description: "Grants read access to Cloudflare Workers scripts",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "e086da7e2179491d91ee5f35b3ca210a",
+		name: "Workers Scripts Write",
+		description: "Grants write access to Cloudflare Workers scripts",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "05880cd1bdc24d8bae0be2136972816b",
+		name: "Workers Tail Read",
+		description: "Grants `wrangler tail` read permissions",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cdeb15b336e640a2965df8c65052f1e0",
+		name: "Zaraz Admin",
+		description: "Can edit and publish Zaraz settings.",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "89d5bf002389496e9994b8c30608b5d0",
+		name: "Zaraz Edit",
+		description: "Can edit Zaraz settings.",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "5bdbde7e76144204a244274eac3eb0eb",
+		name: "Zaraz Read",
+		description: "Grants read access to Zaraz settings.",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "3f376c8e6f764a938b848bd01c8995c4",
+		name: "Zero Trust Read",
+		description: "Grants read access to Cloudflare Zero Trust resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "efb81b5cd37d49f3be1da9363a6d7a19",
+		name: "Zero Trust Report",
+		description: "Grants reporting access to Cloudflare Zero Trust",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "07f91e3e32b647ffae0178d884f23ee0",
+		name: "Zero Trust Resilience Read",
+		description: "Grants read access to Cloudflare Zero Trust Resilience resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "cc00ebddebca4b8399607562a78df084",
+		name: "Zero Trust Resilience Write",
+		description: "Grants write access to Cloudflare Zero Trust Resilience resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "b33f02c6f7284e05a6f20741c0bb0567",
+		name: "Zero Trust Write",
+		description: "Grants write access to Cloudflare Zero Trust resources",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "f5d857f67f144e3c8bacea88c17d4a13",
+		name: "Zero Trust: PII Read",
+		description: "Grants read access to Cloudflare Zero Trust PII.",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "a1a6298e52584c8fb6313760a30c681e",
+		name: "Zero Trust: Seats Write",
+		description: "Grants write access to the Zero Trust seats your organization can use (and be billed for)",
+		scopes: ["com.cloudflare.api.account"]
+	},
+	{
+		id: "0a6cfe8cd3ed445e918579e2fb13087b",
+		name: "Zone DNS Settings Read",
+		description: "Grants read access to Zone DNS Settings",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "c4df38be41c247b3b4b7702e76eadae0",
+		name: "Zone DNS Settings Write",
+		description: "Grants write access to Zone DNS Settings",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "c8fed203ed3043cba015a93ad1616f1f",
+		name: "Zone Read",
+		description: "Grants read access to zone management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "517b21aee92c4d89936c976ba6e4be55",
+		name: "Zone Settings Read",
+		description: "Grants read access to zone settings",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "3030687196b94b638145a3953da2b699",
+		name: "Zone Settings Write",
+		description: "Grants write access to zone settings",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "211a4c0feb3e43b3a2d41f1443a433e7",
+		name: "Zone Transform Rules Read",
+		description: "Grants read access to transform rules at zone level",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "0ac90a90249747bca6b047d97f0803e9",
+		name: "Zone Transform Rules Write",
+		description: "Grants write access to transform rules at zone level",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "1b1ea24cf0904d33903f0cc7e54e280f",
+		name: "Zone Versioning Read",
+		description: "Grants read-only access to Zone Versioning",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "c9915d86fbff46af9dd945c0a882294b",
+		name: "Zone Versioning Write",
+		description: "Grants full access to Zone Versioning",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "dbc512b354774852af2b5a5f4ba3d470",
+		name: "Zone WAF Read",
+		description: "Grants read access to Zone WAF",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "fb6778dc191143babbfaa57993f1d275",
+		name: "Zone WAF Write",
+		description: "Grants write access to Zone WAF",
+		scopes: ["com.cloudflare.api.account.zone"]
+	},
+	{
+		id: "e6d2666161e84845a636613608cee8d5",
+		name: "Zone Write",
+		description: "Grants write access to zone management",
+		scopes: ["com.cloudflare.api.account.zone"]
+	}
+];
+
 //#endregion
 //#region bin/commands/util.ts
 const createCloudflareToken = loggedProcedure.meta({ description: "Create a Cloudflare god token with API key and account IDs" }).input(zod_default.object({
@@ -230740,24 +232836,32 @@ const createCloudflareToken = loggedProcedure.meta({ description: "Create a Clou
 	else await createCloudflareProfileToken(input);
 });
 const util$1 = t.router({ "create-cloudflare-token": createCloudflareToken });
-async function createToken(keyName, accountIds, permissionGroupIds, credentials) {
-	const permissionGroups = await fetch("https://api.cloudflare.com/client/v4/user/tokens/permission_groups", { headers: {
-		"Content-Type": "application/json",
-		"X-Auth-Key": credentials.apiKey,
-		"X-Auth-Email": credentials.accountEmail
-	} }).then((res) => res.json()).then((data) => data.result).then((data) => {
-		return data.reduce((acc, group) => {
-			if (permissionGroupIds != null && !permissionGroupIds.includes(group.id)) return acc;
-			const scope = group.scopes[0];
-			if (!acc[scope]) acc[scope] = [];
-			acc[scope].push(group);
-			return acc;
-		}, {});
-	}).catch((err) => {
-		M.error(pc.red(`Error fetching permission groups: ${err.message}`));
-		throw new CancelSignal();
-	});
-	return await fetch("https://api.cloudflare.com/client/v4/user/tokens", {
+function formatTokenPolicies(accountIds, predicate = () => true) {
+	const policies = {
+		"com.cloudflare.api.account": {
+			effect: "allow",
+			permission_groups: [],
+			resources: Object.fromEntries(accountIds.map((id) => [`com.cloudflare.api.account.${id}`, "*"]))
+		},
+		"com.cloudflare.api.account.zone": {
+			effect: "allow",
+			permission_groups: [],
+			resources: { "com.cloudflare.api.account.zone.*": "*" }
+		},
+		"com.cloudflare.edge.r2.bucket": {
+			effect: "allow",
+			permission_groups: [],
+			resources: { "com.cloudflare.edge.r2.bucket.*": "*" }
+		}
+	};
+	for (const group of PERMISSION_GROUPS) {
+		if (!predicate(group)) continue;
+		policies[group.scopes[0]].permission_groups.push({ id: group.id });
+	}
+	return Object.values(policies).filter((policy) => policy.permission_groups.length > 0);
+}
+async function createToken(name$1, policies, credentials) {
+	return (await extractCloudflareResult("create cloudflare token", fetch("https://api.cloudflare.com/client/v4/user/tokens", {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
@@ -230765,25 +232869,11 @@ async function createToken(keyName, accountIds, permissionGroupIds, credentials)
 			"X-Auth-Email": credentials.accountEmail
 		},
 		body: JSON.stringify({
-			name: `Alchemy Token - ${keyName}`,
+			name: `Alchemy Token - ${name$1}`,
 			status: "active",
-			policies: [{
-				effect: "allow",
-				resources: accountIds.reduce((acc, id) => {
-					acc[`com.cloudflare.api.account.${id}`] = "*";
-					return acc;
-				}, {}),
-				permission_groups: permissionGroups["com.cloudflare.api.account"].map((group) => ({ id: group.id }))
-			}, {
-				effect: "allow",
-				resources: { "com.cloudflare.api.account.zone.*": "*" },
-				permission_groups: permissionGroups["com.cloudflare.api.account.zone"].map((group) => ({ id: group.id }))
-			}]
+			policies
 		})
-	}).then((res) => res.json()).then((data) => data.result.value).catch((err) => {
-		M.error(pc.red(`Error creating cloudflare token: ${err.message}`));
-		throw new CancelSignal();
-	});
+	}))).value;
 }
 async function createCloudflareGodToken() {
 	Ie(pc.cyan("🧪 Create Cloudflare God Token"));
@@ -230825,12 +232915,9 @@ async function createCloudflareGodToken() {
 		M.info(pc.dim("Token creation cancelled"));
 		throw new CancelSignal();
 	}
-	const apiToken = await createToken("GOD-TOKEN", accountIds, void 0, {
+	const apiToken = await createToken("GOD-TOKEN", formatTokenPolicies(accountIds), {
 		apiKey,
 		accountEmail
-	}).catch((err) => {
-		M.error(pc.red(`Error creating cloudflare god token: ${err.message}`));
-		throw new CancelSignal();
 	});
 	Se(`Cloudflare god token created: ${pc.magenta(apiToken)}`);
 }
@@ -230844,11 +232931,8 @@ async function createCloudflareProfileToken(input) {
 	});
 	if (provider.method !== "oauth") throw new Error(`Profile ${pc.bold(name$1)} is not configured to use Cloudflare via OAuth`);
 	if (provider.scopes == null) throw new Error(`Profile ${pc.bold(name$1)} is not configured with any Cloudflare scopes`);
-	const permissionGroupIds = [];
-	for (const scope of provider.scopes) {
-		const ids = CLOUDFLARE_OAUTH_SCOPES_TO_PERMISSION_GROUP_IDS[scope];
-		if (ids != null) permissionGroupIds.push(...ids);
-	}
+	const groupNames = new Set(provider.scopes.flatMap((scope) => CLOUDFLARE_OAUTH_SCOPES_TO_PERMISSION_GROUP_NAMES[scope] ?? []));
+	const policies = formatTokenPolicies([provider.metadata.id], (group) => groupNames.has(group.name));
 	const apiKey = await ge({ message: "Enter Cloudflare Global API Key. It can be found in the cloudflare dashboard: https://dash.cloudflare.com/profile/api-tokens" });
 	if (pD(apiKey)) throw new CancelSignal();
 	const accountEmail = await he({
@@ -230856,186 +232940,193 @@ async function createCloudflareProfileToken(input) {
 		placeholder: "user@example.com"
 	});
 	if (pD(accountEmail)) throw new CancelSignal();
-	const apiToken = await createToken(name$1, [provider.metadata.id], permissionGroupIds, {
+	const apiToken = await createToken(name$1, policies, {
 		apiKey,
 		accountEmail
 	});
 	Se(`Cloudflare token created for profile ${pc.bold(name$1)}: ${pc.magenta(apiToken)}`);
 }
-const CLOUDFLARE_OAUTH_SCOPES_TO_PERMISSION_GROUP_IDS = {
+const CLOUDFLARE_OAUTH_SCOPES_TO_PERMISSION_GROUP_NAMES = {
 	"access:read": [
-		"eb258a38ea634c86a0c89da6b27cb6b6",
-		"7ea222f6d5064cfa89ea366d7c1fee89",
-		"08e61dabe81a422dab0dea6fdef1a98a",
-		"0f4841f80adb4bada5a09493300e7f8d",
-		"4f3196a5c95747b6ad82e34e1d0a694f",
-		"26bc23f853634eb4bff59983b9064fde",
-		"b8b7514ce5364cd8ac0455f3eb16eb5f",
-		"de99c87e48d642ce8c985d027905b475",
-		"91f7ce32fa614d73b7e1fc8f0e78582b",
-		"99ff99e4e30247a99d3777a8c4c18541",
-		"e985ca9351db460faebbe8681c48e560"
+		"Access: Apps and Policies Read",
+		"Access: Custom Pages Read",
+		"Access: Device Posture Read",
+		"Access: Mutual TLS Certificates Read",
+		"Access: Organizations, Identity Providers, and Groups Read",
+		"Access: Policy Test Read",
+		"Access: Population Read",
+		"Access: Service Tokens Read",
+		"Access: SSH Auditing Read",
+		"Access: SCIM logs read"
 	],
 	"access:write": [
-		"a1c0fec57cf94af79479a6d827fa518c",
-		"d30c9ad8b5224e7cb8d41bcb4757effc",
-		"bc783549a3a741aaa10556faf8b485bb",
-		"6d23f290472f4e6fad5c4398c057c356",
-		"bfe0d8686a584fa680f4c53b5eb0de6d",
-		"7121a0c7e9ed46e3829f9cca2bb572aa",
-		"29d3afbfd4054af9accdd1118815ed05",
-		"2fc1072ee6b743828db668fcb3f9dee7",
-		"4e5fd8ac327b4a358e48c66fcbeb856d",
-		"1e13c5124ca64b72b1969a67e8829049",
-		"959972745952452f8be2452be8cbb9f2",
-		"6c9d1cfcfc6840a987d1b5bfb880a841",
-		"6db4e222e21248ac96a3f4c2a81e3b41",
-		"eb258a38ea634c86a0c89da6b27cb6b6",
-		"7ea222f6d5064cfa89ea366d7c1fee89",
-		"08e61dabe81a422dab0dea6fdef1a98a",
-		"0f4841f80adb4bada5a09493300e7f8d",
-		"4f3196a5c95747b6ad82e34e1d0a694f",
-		"26bc23f853634eb4bff59983b9064fde",
-		"b8b7514ce5364cd8ac0455f3eb16eb5f",
-		"de99c87e48d642ce8c985d027905b475",
-		"91f7ce32fa614d73b7e1fc8f0e78582b",
-		"99ff99e4e30247a99d3777a8c4c18541",
-		"e985ca9351db460faebbe8681c48e560"
+		"Access: Service Tokens Write",
+		"Access: SSH Auditing Write",
+		"Access: Population Write",
+		"Access: Policy Test Write",
+		"Access: Organizations, Identity Providers, and Groups Write",
+		"Access: Organizations, Identity Providers, and Groups Revoke",
+		"Access: Mutual TLS Certificates Write",
+		"Access: Device Posture Write",
+		"Access: Custom Pages Write",
+		"Access: Apps and Policies Write",
+		"Access: Apps and Policies Revoke",
+		"Access: Apps and Policies Read",
+		"Access: Custom Pages Read",
+		"Access: Device Posture Read",
+		"Access: Mutual TLS Certificates Read",
+		"Access: Organizations, Identity Providers, and Groups Read",
+		"Access: Policy Test Read",
+		"Access: Population Read",
+		"Access: Service Tokens Read",
+		"Access: SSH Auditing Read",
+		"Access: SCIM logs read"
 	],
-	"account:read": ["c1fde68c7bcc44588cbb6ddbc16d6480"],
-	"agw:read": ["05a2a65760a546439ed29762b163cece"],
-	"agw:run": ["05a2a65760a546439ed29762b163cece", "5e5d3e8efeec49f3afb67bafecbcd511"],
-	"ai:read": ["a92d2450e05d4e7bb7d0a64968f83d11"],
-	"ai:write": ["a92d2450e05d4e7bb7d0a64968f83d11", "bacc64e0f6c34fc0883a1223f938a104"],
-	"aiaudit:read": ["19637fbb73d242c0a92845d8db0b95b1"],
-	"aiaudit:write": ["19637fbb73d242c0a92845d8db0b95b1", "1ba6ab4cacdb454b913bbb93e1b8cb8c"],
-	"aig:read": ["4dc8917b4b40457d88d3035d5dadb054"],
+	"account:read": ["Account Settings Read"],
+	"agw:read": ["Account API Gateway Read"],
+	"agw:run": ["Account API Gateway Read", "Account API Gateway"],
+	"ai:read": ["Workers AI Read"],
+	"ai:write": ["Workers AI Read", "Workers AI Write"],
+	"aiaudit:read": ["AI Audit Read"],
+	"aiaudit:write": ["AI Audit Read", "AI Audit Write"],
+	"aig:read": ["AI Gateway Read"],
 	"aig:write": [
-		"4dc8917b4b40457d88d3035d5dadb054",
-		"644535f4ed854494a59cb289d634b257",
-		"6c8a3737f07f46369c1ea1f22138daaf"
+		"AI Gateway Read",
+		"AI Gateway Run",
+		"AI Gateway Write"
 	],
-	"auditlogs:read": ["b05b28e839c54467a7d6cba5d3abb5a3"],
-	"browser:read": ["374b03fa229f4eb6b011bb1cd7f235ee"],
-	"browser:write": ["374b03fa229f4eb6b011bb1cd7f235ee", "adddda876faa4a0590f1b23a038976e4"],
+	"auditlogs:read": ["Access: Audit Logs Read"],
+	"browser:read": ["Browser Rendering Read"],
+	"browser:write": ["Browser Rendering Read", "Browser Rendering Write"],
 	"cfone:read": [
-		"1cd960c063a0448481343372c963d8c7",
-		"c1968d31028d4239976ec3bc4750bbf6",
-		"07cf1c1952a84b13b2cd542f3d2f29ab"
+		"Cloudflare One Connector: WARP Read",
+		"Cloudflare One Connector: cloudflared Read",
+		"Cloudflare One Connectors Read"
 	],
 	"cfone:write": [
-		"5b5c774a5d174ca88d046c8889648b3f",
-		"037b9e348b3b42d4b46ea2fcb1cfb3e7",
-		"a7030c9c98d544e092d8b099fabb1f06",
-		"1cd960c063a0448481343372c963d8c7",
-		"c1968d31028d4239976ec3bc4750bbf6",
-		"07cf1c1952a84b13b2cd542f3d2f29ab"
+		"Cloudflare One Connector: WARP Write",
+		"Cloudflare One Connector: cloudflared Write",
+		"Cloudflare One Connectors Write",
+		"Cloudflare One Connector: WARP Read",
+		"Cloudflare One Connector: cloudflared Read",
+		"Cloudflare One Connectors Read"
 	],
-	"cloudchamber:write": ["65ec50cbde3d4c838bbe7500024d5745", "26ce6c7d18a346528e7b905d5e269866"],
-	"constellation:write": ["eeffa4d16812430cb4a0ae9e7f46fc24", "7c81856725af47ce89a790d5fb36f362"],
-	"containers:write": ["cfd39eebc07c4e3ea849e4b3d2644637", "bdbcd690c763475a985e8641dddc09f7"],
-	"d1:write": ["192192df92ee43ac90f2aeeffce67e35", "09b2857d1c31407795e75e3fed8617a1"],
-	"dex:read": ["3b376e0aa52c41cbb6afc9cab945afa8"],
+	"cloudchamber:write": ["Cloudchamber Read", "Cloudchamber Write"],
+	"constellation:write": ["Constellation Read", "Constellation Write"],
+	"containers:write": ["Workers Containers Read", "Workers Containers Write"],
+	"d1:write": ["D1 Read", "D1 Write"],
+	"dex:read": ["Cloudflare DEX Read"],
 	"dex:write": [
-		"3a1e1ef09dd34271bb44fc4c6a419952",
-		"3b376e0aa52c41cbb6afc9cab945afa8",
-		"92c8dcd551cc42a6a57a54e8f8d3f3e3"
+		"Cloudflare DEX",
+		"Cloudflare DEX Read",
+		"Cloudflare DEX Write"
 	],
 	"dns_analytics:read": [],
 	"dns_records:edit": [
-		"82e64a83756745bbbb1c9c2701bf816b",
-		"95d69e8d6d5144bfb0923667355d9f11",
-		"5b7aedd821a548b9bf5a2acabbce98c7",
-		"4755a26eedb94da69e1066d98aa820be"
+		"DNS Read",
+		"DNS View Read",
+		"DNS View Write",
+		"DNS Write"
 	],
-	"dns_records:read": ["82e64a83756745bbbb1c9c2701bf816b", "95d69e8d6d5144bfb0923667355d9f11"],
-	"dns_settings:read": ["cfa964bcdafc4ab39704e7476154e41b"],
-	"firstpartytags:write": [],
+	"dns_records:read": ["DNS Read", "DNS View Read"],
+	"dns_settings:read": ["Account DNS Settings Read"],
+	"firstpartytags:write": ["Zaraz Edit"],
 	"lb:edit": [
-		"59059f0c977b44f8b1c18e0aaf91c369",
-		"419ec42810af4659ade77716dbe47bc6",
-		"6d7f2f5f5b1d4a0e9081fdc98d432fd1",
-		"9d24387c6e8544e2bc4024a03991339f",
-		"d2a1802cc9a34e30852f8b33869b2f3c"
+		"Load Balancers Account Read",
+		"Load Balancers Account Write",
+		"Load Balancers Write",
+		"Load Balancing: Monitors and Pools Read",
+		"Load Balancing: Monitors and Pools Write"
 	],
 	"lb:read": [
-		"59059f0c977b44f8b1c18e0aaf91c369",
-		"9d24387c6e8544e2bc4024a03991339f",
-		"e9a975f628014f1d85b723993116f7d5"
+		"Load Balancers Account Read",
+		"Load Balancing: Monitors and Pools Read",
+		"Load Balancers Read"
 	],
-	"logpush:read": ["6a315a56f18441e59ed03352369ae956", "c4a30cd58c5d42619c86a3c36c441e2d"],
-	"logpush:write": [
-		"6a315a56f18441e59ed03352369ae956",
-		"c4a30cd58c5d42619c86a3c36c441e2d",
-		"96163bd1b0784f62b3e44ed8c2ab1eb6",
-		"3e0b5820118e47f3922f7c989e673882"
-	],
-	"notification:read": ["ce18edbdcebf465e9d6d1d2fc80ffd42"],
-	"notification:write": ["ce18edbdcebf465e9d6d1d2fc80ffd42", "c3c847c5802d4ce3ba00e3e97b3c8555"],
-	"pages:read": ["e247aedd66bd41cc9193af0213416666"],
-	"pages:write": ["e247aedd66bd41cc9193af0213416666", "8d28297797f24fb8a0c332fe0866ec89"],
-	"pipelines:read": ["14b9cf2f410f4c0c9a16bb10a81c0e0b"],
-	"pipelines:setup": ["5606e7405dc542949d949d59993d321f"],
+	"logpush:read": ["Logs Read"],
+	"logpush:write": ["Logs Read", "Logs Write"],
+	"notification:read": ["Notifications Read"],
+	"notification:write": ["Notifications Read", "Notifications Write"],
+	"pages:read": ["Pages Read"],
+	"pages:write": ["Pages Read", "Pages Write"],
+	"pipelines:read": ["Pipelines Read"],
+	"pipelines:setup": ["Pipelines Send"],
 	"pipelines:write": [
-		"14b9cf2f410f4c0c9a16bb10a81c0e0b",
-		"5606e7405dc542949d949d59993d321f",
-		"e34111af393449539859485aa5ddd5bd"
+		"Pipelines Read",
+		"Pipelines Send",
+		"Pipelines Write"
 	],
 	"query_cache:write": [],
-	"queues:write": ["84a7755d54c646ca87cd50682a34bf7c", "366f57075ffc42689627bcf8242a1b6d"],
+	"queues:write": ["Queues Read", "Queues Write"],
 	"r2_catalog:write": [
-		"45db74139a62490b9b60eb7c4f34994b",
-		"d229766a2f7f4d299f20eaa8c9b1fde9",
-		"f45430d92e2b4a6cb9f94f2594c141b8"
+		"Workers R2 Data Catalog Read",
+		"Workers R2 Data Catalog Write",
+		"Workers R2 SQL Read"
 	],
-	"radar:read": ["dfe525ec7b07472c827d8d009178b2ac"],
-	"rag:read": ["d7887c7a417e4cf2a69f1d01c1a1dc3b"],
+	"radar:read": ["Radar Read"],
+	"rag:read": ["Auto Rag Read"],
 	"rag:write": [
-		"d7887c7a417e4cf2a69f1d01c1a1dc3b",
-		"7fb8d27511b34d02994d005b520b679f",
-		"234108c786084936a381bb19b7f4ea65"
+		"Auto Rag Read",
+		"Auto Rag Write",
+		"Auto Rag Write Run Engine"
 	],
-	"secrets_store:read": ["5e33b7d77788455c9fdf18cbd38ee5a0"],
-	"secrets_store:write": ["5e33b7d77788455c9fdf18cbd38ee5a0", "adc8fa2bc6124928a8b3314dc63a1235"],
-	"sso-connector:read": ["1d80f6f165ea47f2b55d4a393fd697de"],
-	"sso-connector:write": ["1d80f6f165ea47f2b55d4a393fd697de", "901ca5e292584c6aa1b4cdb39248bb07"],
+	"secrets_store:read": ["Secrets Store Read"],
+	"secrets_store:write": ["Secrets Store Read", "Secrets Store Write"],
+	"sso-connector:read": ["SSO Connector Read"],
+	"sso-connector:write": ["SSO Connector Read", "SSO Connector Write"],
 	"ssl_certs:write": [
-		"a7a233f9604845c787d4c8c39ac09c21",
-		"db37e5f1cb1a4e1aabaef8deaea43575",
-		"7b7216b327b04b8fbc8f524e1f9b7531",
-		"c03055bc037c4ea9afb9a9f104b7b721"
+		"Account: SSL and Certificates Read",
+		"Account: SSL and Certificates Write",
+		"SSL and Certificates Read",
+		"SSL and Certificates Write"
 	],
 	"teams:pii": [],
 	"teams:read": [],
 	"teams:secure_location": [],
 	"teams:write": [],
-	"url_scanner:read": ["5d613a610b294788a29572aaac2f254d"],
-	"url_scanner:write": ["5d613a610b294788a29572aaac2f254d", "2a400bcb29154daab509fe07e3facab0"],
+	"url_scanner:read": ["URL Scanner Read"],
+	"url_scanner:write": ["URL Scanner Read", "URL Scanner Write"],
 	"user:read": [],
-	"vectorize:write": ["1799edaae5db489294430e20d9b519e0", "64156ba5be47441096c83c7fc17c488b"],
+	"vectorize:write": ["Vectorize Read", "Vectorize Write"],
 	"workers:write": [
-		"2072033d694d415a936eaeb94e6405b8",
-		"28f4b596e7d643029c524985477ae49a",
-		"1a71c399035b4950a1bd1466bbe4f420",
-		"e086da7e2179491d91ee5f35b3ca210a"
+		"Workers Routes Read",
+		"Workers Routes Write",
+		"Workers Scripts Read",
+		"Workers Scripts Write",
+		"Workers KV Storage Read",
+		"Workers KV Storage Write",
+		"Workers R2 Storage Write",
+		"Workers R2 Storage Read"
 	],
-	"workers_builds:read": ["ad99c5ae555e45c4bef5bdf2678388ba"],
-	"workers_builds:write": ["2e095cf436e2455fa62c9a9c2e18c478"],
-	"workers_kv:write": ["8b47d2786a534c08a1f94ee8f9f599ef", "f7f0eda5697f475c90846e879bab8666"],
-	"workers_observability:read": ["66c1ed49f4ed46098b75696a6d4ee3c9"],
-	"workers_observability:write": ["66c1ed49f4ed46098b75696a6d4ee3c9", "82c075da3f4647a2a03becd0fe240f8a"],
-	"workers_observability_telemetry:write": ["29c629fb7b5e4c408ca0f7b545724fcc"],
-	"workers_routes:write": [],
-	"workers_scripts:write": [],
-	"workers_tail:read": ["05880cd1bdc24d8bae0be2136972816b"],
+	"workers_builds:read": ["Workers CI Read"],
+	"workers_builds:write": ["Workers CI Write"],
+	"workers_kv:write": ["Workers KV Storage Read", "Workers KV Storage Write"],
+	"workers_observability:read": ["Workers Observability Read"],
+	"workers_observability_telemetry:write": ["Workers Observability Telemetry Write"],
+	"workers_routes:write": ["Workers Routes Write"],
+	"workers_scripts:write": ["Workers Scripts Write"],
+	"workers_tail:read": ["Workers Tail Read"],
 	"zone:read": [
-		"c8fed203ed3043cba015a93ad1616f1f",
-		"517b21aee92c4d89936c976ba6e4be55",
-		"211a4c0feb3e43b3a2d41f1443a433e7",
-		"1b1ea24cf0904d33903f0cc7e54e280f",
-		"dbc512b354774852af2b5a5f4ba3d470"
+		"Zone Read",
+		"Zone Settings Read",
+		"Zone Transform Rules Read",
+		"Zone Versioning Read",
+		"Zone WAF Read"
+	],
+	"agw:write": [
+		"AI Gateway Read",
+		"AI Gateway Run",
+		"AI Gateway Write"
 	],
-	offline_access: []
+	"connectivity:admin": ["Connectivity Directory Admin"],
+	"connectivity:bind": ["Connectivity Directory Bind"],
+	"connectivity:read": ["Connectivity Directory Read"],
+	"workers:read": [
+		"Workers Scripts Read",
+		"Workers KV Storage Read",
+		"Workers R2 Storage Read",
+		"Workers Routes Read"
+	]
 };
 
 //#endregion