alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -1,93 +1,84 @@
 import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
+import * as cfMemberships from "@distilled.cloud/cloudflare/memberships";
 import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
-import * as Console from "effect/Console";
+import * as Clock from "effect/Clock";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import {
   AuthError,
   AuthProviderLayer,
-  type ConfigureContext,
+  NeedsReauth,
+  reconfigureHint,
+  refreshHint,
+  type ConfigureField,
+  type ConfigureMethod,
+  type ProviderDetails,
 } from "../../Auth/AuthProvider.ts";
+import {
+  storedSecret,
+  storedValueText,
+  validateFieldValues,
+} from "../../Auth/StoredAuthProvider.ts";
 import { CredentialsStore, displayRedacted } from "../../Auth/Credentials.ts";
+import { withProfileCredentialsLock } from "../../Auth/Lock.ts";
 import {
-  getEnv,
   getEnvRedacted,
   getEnvRequired,
-  retryOnce,
+  mapPromptCancellation,
 } from "../../Auth/Env.ts";
-import * as Clank from "../../Util/Clank.ts";
+import { browserOAuth } from "../../Auth/BrowserOAuth.ts";
+import * as Interaction from "../../Interaction.ts";
 import { CREDENTIALS_FILE as STATE_STORE_CREDENTIALS_FILE } from "../StateStore/CredentialsFile.ts";
 import * as OAuthClient from "./OAuthClient.ts";
+import {
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  CloudflareAuthConfigSchema,
+  validateAccountId,
+  validateAccountIdField,
+  type CloudflareAuthConfig,
+  type CloudflareResolvedCredentials,
+} from "./AuthConfig.ts";
+import {
+  ALL_SCOPE_IDS,
+  BASIC_SCOPES,
+  customOAuthScopeDefaults,
+  OAUTH_SCOPE_GROUPS,
+  OAUTH_SCOPE_NAMES,
+  partitionOAuthScopes,
+} from "./OAuthScopes.ts";
 
 const options: Array<{
   value: CloudflareAuthConfig["method"];
   label: string;
-  hint?: string;
+  description?: string;
 }> = [
   {
     value: "oauth",
     label: "OAuth",
-    hint: "recommended — browser-based login with automatic token refresh",
-  },
-  {
-    value: "env",
-    label: "Environment Variables",
-    hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL",
+    description:
+      "recommended — browser-based login with automatic token refresh",
   },
   {
     value: "stored",
     label: "API Token or API Key",
-    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
+    description: "use an API token or global API key",
   },
 ];
 
-export type CloudflareAuthConfig =
-  | { method: "env" }
-  | { method: "stored"; credentialType: "apiToken" }
-  | { method: "stored"; credentialType: "apiKey" }
-  | { method: "oauth"; scopes: string[]; accountId: string };
-
-export type CloudflareStoredCredentials =
-  | { type: "apiToken"; apiToken: string; accountId: string }
-  | { type: "apiKey"; apiKey: string; email: string; accountId: string };
-
-export type CloudflareResolvedCredentials =
-  | {
-      type: "apiToken";
-      apiToken: Redacted.Redacted<string>;
-      accountId: string;
-      source: { type: CloudflareAuthConfig["method"]; details?: string };
-    }
-  | {
-      type: "apiKey";
-      apiKey: Redacted.Redacted<string>;
-      email: Redacted.Redacted<string>;
-      accountId: string;
-      source: { type: CloudflareAuthConfig["method"]; details?: string };
-    }
-  | {
-      type: "oauth";
-      accessToken: Redacted.Redacted<string>;
-      expires: number;
-      accountId: string;
-      source: { type: CloudflareAuthConfig["method"]; details?: string };
-    };
-
-export const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
-
-const withOAuthCredentials = <A, E>(
+const withOAuthCredentials = <A, E, R>(
   accessToken: string,
   effect: Effect.Effect<
     A,
     E,
-    CfCredentialsModule.Credentials | HttpClient.HttpClient
+    R | CfCredentialsModule.Credentials | HttpClient.HttpClient
   >,
-): Effect.Effect<A, E> =>
+): Effect.Effect<A, E, R> =>
   Effect.provide(
     effect,
     Layer.mergeAll(
@@ -100,113 +91,168 @@ const withOAuthCredentials = <A, E>(
     ),
   );
 
+/**
+ * Accounts visible to a user-scoped OAuth token. `GET /accounts` returns an
+ * EMPTY list for these tokens (it only lists accounts an account-scoped
+ * credential can read), so memberships are the authoritative account list —
+ * the same endpoint wrangler uses. `GET /accounts` remains as a fallback for
+ * tokens authorized without `memberships.read` (custom scope selections).
+ */
+const listVisibleAccounts: Effect.Effect<
+  ReadonlyArray<{ id: string; name: string }>,
+  unknown,
+  CfCredentialsModule.Credentials | HttpClient.HttpClient
+> = Effect.gen(function* () {
+  const listMemberships = yield* cfMemberships.listMemberships;
+  const membershipAccounts = yield* listMemberships({}).pipe(
+    Effect.map((response) =>
+      response.result.flatMap((membership) =>
+        membership.account != null &&
+        (membership.status == null || membership.status === "accepted")
+          ? [membership.account]
+          : [],
+      ),
+    ),
+    Effect.catch((error) =>
+      Effect.logDebug("Cloudflare: listing memberships failed", error).pipe(
+        Effect.as([] as Array<{ id: string; name: string }>),
+      ),
+    ),
+  );
+  if (membershipAccounts.length > 0) return membershipAccounts;
+  const listAccounts = yield* cfAccounts.listAccounts;
+  const response = yield* listAccounts({});
+  yield* Effect.logDebug(
+    `Cloudflare: memberships listed 0 accounts; /accounts listed ${response.result.length}`,
+  );
+  return response.result;
+});
+
 const selectAccount = (accessToken: string) =>
   Effect.gen(function* () {
-    const list = yield* cfAccounts.listAccounts;
-    const response = yield* list({});
-    const accounts = response.result;
+    const interaction = Interaction.accessors;
+    const accounts = yield* listVisibleAccounts;
     if (accounts.length === 0) {
       return yield* new AuthError({
-        message: "Cloudflare: no accounts found for this credential.",
+        message:
+          "No Cloudflare accounts are visible to this credential. " +
+          "Ensure the authorized OAuth scopes include 'memberships.read'.",
       });
     }
-    if (accounts.length === 1) {
-      const account = accounts[0]!;
-      yield* Clank.info(
-        `Cloudflare: using account: ${account.name} (${account.id})`,
+    const [account] = accounts;
+    if (accounts.length === 1 && account !== undefined) {
+      yield* interaction.output.info(
+        `Using Cloudflare account ${account.name}.`,
       );
       return account.id;
     }
-    return yield* Clank.select({
-      message: "Select a Cloudflare account",
-      options: accounts.map((a) => ({
-        value: a.id,
-        label: a.name,
-        hint: a.id,
-      })),
-    }).pipe(retryOnce);
+    return yield* interaction.prompt
+      .select({
+        message: "Select a Cloudflare account",
+        searchable: true,
+        options: accounts.map((a) => ({
+          value: a.id,
+          label: a.name,
+          description: a.id,
+        })),
+      })
+      .pipe(mapPromptCancellation);
   }).pipe((e) => withOAuthCredentials(accessToken, e));
 
+const promptAccountId = () =>
+  Effect.gen(function* () {
+    const interaction = yield* Interaction.Interaction;
+    return yield* interaction.prompt
+      .text({
+        message: "Cloudflare Account ID",
+        validate: validateAccountIdField,
+      })
+      .pipe(mapPromptCancellation);
+  });
+
+const accountIdField: ConfigureField = {
+  name: "accountId",
+  label: "Cloudflare Account ID",
+  validate: validateAccountIdField,
+};
+
 /**
- * Cloudflare account IDs are 32 lowercase hex characters. Placeholder
- * values ("", "-", "dummy", …) end up interpolated into API paths and
- * surface as baffling `InvalidRoute: Could not route to
- * /accounts/<value>/...` errors, so reject them up front with an
- * actionable message instead.
+ * `--set` fields for `--method stored`. The persisted `credentialType` is
+ * inferred from which secret is supplied: `apiToken` alone, or `apiKey`
+ * together with `email`.
  */
-const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
-
-export const validateAccountId = (
-  accountId: string | undefined,
-  source: string,
-): Effect.Effect<string, AuthError> => {
-  const trimmed = accountId?.trim() ?? "";
-  if (trimmed.length === 0) {
-    return Effect.fail(
-      new AuthError({
-        message:
-          `Cloudflare account ID is missing (${source}). ` +
-          "Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID " +
-          "(found in the Cloudflare dashboard under Workers & Pages → Account details).",
-      }),
-    );
-  }
-  if (!ACCOUNT_ID_PATTERN.test(trimmed)) {
-    return Effect.fail(
-      new AuthError({
-        message:
-          `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. ` +
-          "Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) " +
-          "into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.",
-      }),
-    );
-  }
-  return Effect.succeed(trimmed.toLowerCase());
-};
+const storedFields: ReadonlyArray<ConfigureField> = [
+  {
+    name: "apiToken",
+    label: "Cloudflare API Token",
+    description: "Pass either apiToken, or apiKey together with email.",
+    secret: true,
+    optional: true,
+  },
+  { name: "apiKey", label: "Cloudflare API Key", secret: true, optional: true },
+  { name: "email", label: "Cloudflare Email", optional: true },
+  accountIdField,
+];
 
-const promptAccountId = () =>
-  getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(
-    Effect.flatMap((envAccountId) =>
-      Clank.text({
-        message: "Cloudflare Account ID (Enter to skip)",
-        placeholder: envAccountId ?? "",
-        defaultValue: envAccountId ?? "",
-        validate: (v) =>
-          v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim())
-            ? undefined
-            : "Expected a 32-character hex account ID (Workers & Pages → Account details)",
-      }).pipe(retryOnce),
-    ),
-  );
+/**
+ * Flag-driven configuration methods. OAuth is deliberately absent — it is
+ * interactive-only (browser grant).
+ */
+const configureMethods: ReadonlyArray<ConfigureMethod> = [
+  { method: "stored", fields: storedFields },
+];
 
-const promptOAuthScopes = () =>
-  Clank.confirm({
-    message: "Customize OAuth scopes? (default covers typical use cases)",
-    initialValue: false,
-  }).pipe(
-    retryOnce,
-    Effect.flatMap((customize) => {
-      if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
-      return Clank.multiselect({
+const promptOAuthScopes = (currentConfig?: CloudflareAuthConfig) =>
+  Effect.gen(function* () {
+    const interaction = yield* Interaction.Interaction;
+    const mode = yield* interaction.prompt
+      .select({
+        message: "Cloudflare OAuth scopes",
+        initialValue: "all" as const,
+        options: [
+          {
+            value: "all" as const,
+            label: "All Scopes",
+            description: "authorize every available Cloudflare permission",
+          },
+          {
+            value: "basic" as const,
+            label: "Basic Scopes",
+            description: "covers typical Alchemy use cases",
+          },
+          {
+            value: "custom" as const,
+            label: "Custom Scopes",
+            description: "choose individual permissions",
+          },
+        ],
+      })
+      .pipe(mapPromptCancellation);
+    if (mode === "basic") return [...BASIC_SCOPES];
+    if (mode === "all") return [...ALL_SCOPE_IDS];
+    return yield* interaction.prompt
+      .multiSelect({
         message: "Select OAuth scopes",
-        initialValues: DEFAULT_SCOPES as string[],
-        options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
-          value: value as string,
-          label: value,
-          hint,
-        })),
+        initialValues: customOAuthScopeDefaults(currentConfig),
+        searchable: true,
+        descriptionPlacement: "inline",
+        options: OAUTH_SCOPE_GROUPS.flatMap((group) =>
+          group.scopes.map((value) => ({
+            value,
+            label: OAUTH_SCOPE_NAMES[value],
+            description: value,
+            group: group.label,
+          })),
+        ),
         required: true,
-      }).pipe(
-        Effect.map((s) => s as string[]),
-        retryOnce,
-      );
-    }),
-  );
+      })
+      .pipe(mapPromptCancellation);
+  });
 
 /**
  * Layer that registers the Cloudflare {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Cloudflare
- * `providers()` layer so `alchemy login` can discover it.
+ * `providers()` layer so the alchemy CLI can discover it.
  */
 export const CloudflareAuth = AuthProviderLayer<
   CloudflareAuthConfig,
@@ -214,103 +260,88 @@ export const CloudflareAuth = AuthProviderLayer<
 >()(
   CLOUDFLARE_AUTH_PROVIDER_NAME,
   Effect.gen(function* () {
+    const interaction = Interaction.accessors;
     const store = yield* CredentialsStore;
 
-    const oauthLogin = (profileName: string, scopes: string[]) =>
+    const oauthLogin = (_profileName: string, scopes: string[]) =>
       Effect.gen(function* () {
-        const authorization = OAuthClient.authorize([
+        const authorization = yield* OAuthClient.authorize([
           ...scopes,
           "offline_access",
         ]);
 
-        yield* Clank.info("Cloudflare: opening browser for OAuth login...");
-        yield* Clank.info(authorization.url);
-        yield* Clank.openUrl(authorization.url).pipe(
-          Effect.catch(() =>
-            Clank.warn(
-              "Cloudflare: could not open browser automatically. Please open the URL above manually.",
-            ),
-          ),
-        );
-        yield* Clank.info(
-          "Cloudflare: waiting for authorization (up to 5 minutes).",
-        );
-
-        const credentials = yield* Effect.raceFirst(
-          OAuthClient.callback(authorization),
-          Clank.text({
-            message: "Paste the authorization code or callback URL",
-            placeholder:
-              "The browser will complete this automatically when local",
-            validate: (value) =>
-              value.trim().length > 0 ? undefined : "Paste a code or URL",
-          }).pipe(
-            Effect.flatMap((input) =>
-              OAuthClient.exchangeCallbackInput(input, authorization),
-            ),
-          ),
+        const credentials = yield* browserOAuth({
+          provider: "Cloudflare",
+          url: authorization.url,
+          callback: OAuthClient.callback(authorization),
+          exchange: (input) =>
+            OAuthClient.exchangeCallbackInput(input, authorization),
+        });
+        yield* interaction.output.success(
+          "Connected to Cloudflare with OAuth.",
         );
-        yield* store.write(profileName, "cf-oauth", credentials);
-        yield* Clank.success("Cloudflare: OAuth credentials saved.");
         return credentials;
       });
 
     const loginStored = Effect.fn(function* (profileName: string) {
-      const credentialType = yield* Clank.select({
-        message: "Cloudflare credential type",
-        options: [
-          {
-            value: "apiToken" as const,
-            label: "API Token",
-            hint: "recommended",
-          },
-          { value: "apiKey" as const, label: "API Key + Email" },
-        ],
-      }).pipe(retryOnce);
+      const credentialType = yield* interaction.prompt
+        .select({
+          message: "Cloudflare credential type",
+          options: [
+            {
+              value: "apiToken" as const,
+              label: "API Token",
+              description: "recommended",
+            },
+            { value: "apiKey" as const, label: "API Key + Email" },
+          ],
+        })
+        .pipe(mapPromptCancellation);
 
       return yield* Match.value(credentialType).pipe(
         Match.when("apiToken", () =>
           Effect.gen(function* () {
-            const apiToken = yield* Clank.password({
-              message: "Cloudflare API Token",
-              validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
+            const apiToken = yield* interaction.prompt
+              .password({
+                message: "Cloudflare API Token",
+                validate: (v) => (v.length === 0 ? "Required" : undefined),
+              })
+              .pipe(mapPromptCancellation, Effect.map(Redacted.make));
             const accountId = yield* promptAccountId();
 
-            yield* store.write<CloudflareStoredCredentials>(
-              profileName,
-              "cf-stored",
-              { type: "apiToken", apiToken, accountId },
-            );
-            yield* Clank.success("Cloudflare: credentials saved.");
+            yield* interaction.output.success("Cloudflare: credentials saved.");
             return {
               method: "stored" as const,
               credentialType: "apiToken" as const,
+              apiToken: Redacted.value(apiToken),
+              accountId,
             };
           }),
         ),
         Match.when("apiKey", () =>
           Effect.gen(function* () {
-            const apiKey = yield* Clank.text({
-              message: "Cloudflare API Key",
-              validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
-
-            const email = yield* Clank.text({
-              message: "Cloudflare Email",
-              validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
+            const apiKey = yield* interaction.prompt
+              .password({
+                message: "Cloudflare API Key",
+                validate: (v) => (v.length === 0 ? "Required" : undefined),
+              })
+              .pipe(mapPromptCancellation, Effect.map(Redacted.make));
+
+            const email = yield* interaction.prompt
+              .text({
+                message: "Cloudflare Email",
+                validate: (v) => (v.length === 0 ? "Required" : undefined),
+              })
+              .pipe(mapPromptCancellation, Effect.map(Redacted.make));
             const accountId = yield* promptAccountId();
 
-            yield* store.write<CloudflareStoredCredentials>(
-              profileName,
-              "cf-stored",
-              { type: "apiKey", apiKey, email, accountId },
-            );
-            yield* Clank.success("Cloudflare: credentials saved.");
+            yield* interaction.output.success("Cloudflare: credentials saved.");
             return {
               method: "stored" as const,
               credentialType: "apiKey" as const,
+              apiKey: Redacted.value(apiKey),
+              email: Redacted.value(email),
+              accountId,
             };
           }),
         ),
@@ -318,48 +349,67 @@ export const CloudflareAuth = AuthProviderLayer<
       );
     });
 
-    const configureOAuth = Effect.fn(function* (profileName: string) {
-      const scopes = yield* promptOAuthScopes();
-
-      const oauthCreds = yield* oauthLogin(profileName, scopes);
-
-      const accountId = yield* selectAccount(oauthCreds.access).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "Cloudflare: could not list accounts",
-              cause: e,
-            }),
+    const configureOAuth = Effect.fn(function* (
+      profileName: string,
+      currentConfig?: CloudflareAuthConfig,
+    ) {
+      const scopes = yield* promptOAuthScopes(currentConfig);
+
+      const oauthCreds = yield* oauthLogin(profileName, [...scopes]);
+
+      const accountId = yield* selectAccount(
+        Redacted.value(oauthCreds.access),
+      ).pipe(
+        // Keep AuthError messages intact — they carry the actionable
+        // diagnosis (e.g. "no accounts visible"); only wrap raw API errors.
+        Effect.mapError((e) =>
+          e instanceof AuthError
+            ? e
+            : new AuthError({
+                message: "Cloudflare: could not list accounts",
+                cause: e,
+              }),
         ),
       );
 
       return {
         method: "oauth" as const,
-        scopes,
+        scopes: [...scopes],
         accountId,
+        clientId: oauthCreds.clientId,
+        access: Redacted.value(oauthCreds.access),
+        refresh: Redacted.value(oauthCreds.refresh),
+        expires: oauthCreds.expires,
       };
     });
 
-    const configureInteractive = (profileName: string) =>
-      Clank.select({
-        message: "Cloudflare authentication method",
-        options,
-      }).pipe(
-        Effect.flatMap((method) =>
-          Match.value(method).pipe(
-            Match.when("env", () => Effect.succeed({ method: "env" as const })),
-            Match.when("oauth", () => configureOAuth(profileName)),
-            Match.when("stored", () => loginStored(profileName)),
-            Match.exhaustive,
+    const configureInteractive = (
+      profileName: string,
+      currentConfig?: CloudflareAuthConfig,
+    ) =>
+      interaction.prompt
+        .select({
+          message: "Cloudflare authentication method",
+          options,
+        })
+        .pipe(
+          Effect.flatMap((method) =>
+            Match.value(method).pipe(
+              Match.when("oauth", () =>
+                configureOAuth(profileName, currentConfig),
+              ),
+              Match.when("stored", () => loginStored(profileName)),
+              Match.exhaustive,
+            ),
           ),
-        ),
-      );
+        );
 
-    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+    const configureCredentials = (
+      profileName: string,
+      currentConfig?: CloudflareAuthConfig,
+    ) =>
       Effect.gen(function* () {
-        const config = ctx.ci
-          ? { method: "env" as const }
-          : yield* configureInteractive(profileName);
+        const config = yield* configureInteractive(profileName, currentConfig);
         // Re-configuring auth may point this profile at a different
         // Cloudflare account. The cached state-store credentials
         // (`~/.alchemy/credentials/{profile}/cloudflare-state-store.json`)
@@ -370,182 +420,190 @@ export const CloudflareAuth = AuthProviderLayer<
           .pipe(Effect.ignore);
         return config;
       }).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "failed to configure credentials",
-              cause: e,
-            }),
+        // AuthError messages are already user-facing; re-wrapping them in a
+        // generic banner is what hid "no accounts visible" behind
+        // "failed to configure credentials".
+        Effect.mapError((e) =>
+          e instanceof AuthError
+            ? e
+            : new AuthError({
+                message: "failed to configure credentials",
+                cause: e,
+              }),
         ),
       );
 
     const resolveCredentials = (
       profileName: string,
       config: CloudflareAuthConfig,
-    ): Effect.Effect<CloudflareResolvedCredentials, AuthError> =>
-      Match.value(config).pipe(
-        Match.when(
-          { method: "env" },
-          Effect.fn(function* () {
-            const accountId = yield* getEnvRequired(
-              "CLOUDFLARE_ACCOUNT_ID",
+      updateConfig?: (
+        config: CloudflareAuthConfig,
+      ) => Effect.Effect<void, AuthError>,
+    ) =>
+      Effect.gen(function* () {
+        const reauth = refreshHint(CLOUDFLARE_AUTH_PROVIDER_NAME, profileName);
+        return yield* Match.value(config).pipe(
+          Match.when({ method: "stored", credentialType: "apiToken" }, (c) =>
+            validateAccountId(
+              c.accountId,
+              `stored for profile '${profileName}'`,
             ).pipe(
-              Effect.flatMap((id) =>
-                validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var"),
-              ),
-            );
-            const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
-            if (apiToken) {
-              return {
+              Effect.map((accountId) => ({
                 type: "apiToken" as const,
-                apiToken,
+                apiToken: Redacted.make(c.apiToken),
                 accountId,
-                source: { type: "env" as const },
-              };
-            }
-            const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
-            const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
-            if (apiKey && email) {
-              return {
+                source: { type: "stored" as const },
+              })),
+            ),
+          ),
+          Match.when({ method: "stored", credentialType: "apiKey" }, (c) =>
+            validateAccountId(
+              c.accountId,
+              `stored for profile '${profileName}'`,
+            ).pipe(
+              Effect.map((accountId) => ({
                 type: "apiKey" as const,
-                apiKey,
-                email,
+                apiKey: Redacted.make(c.apiKey),
+                email: Redacted.make(c.email),
                 accountId,
-                source: { type: "env" as const },
-              };
-            }
-            return yield* new AuthError({
-              message:
-                "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.",
-            });
-          }),
-        ),
-        Match.when({ method: "stored" }, () =>
-          store
-            .read<CloudflareStoredCredentials>(profileName, "cf-stored")
-            .pipe(
-              Effect.flatMap((creds) =>
-                creds == null
-                  ? Effect.fail(
-                      new AuthError({
-                        message:
-                          "Cloudflare stored credentials not found. Run: alchemy login --configure",
-                      }),
-                    )
-                  : Effect.gen(function* () {
-                      // The account ID prompt is skippable, so stored
-                      // credentials may carry an empty accountId; fall
-                      // back to the env var before validating.
-                      const envAccountId = yield* getEnv(
-                        "CLOUDFLARE_ACCOUNT_ID",
-                      );
-                      const accountId = yield* validateAccountId(
-                        creds.accountId?.trim() || envAccountId,
-                        `stored for profile '${profileName}'`,
-                      );
-                      return Match.value(creds).pipe(
-                        Match.when({ type: "apiToken" }, (c) => ({
-                          type: "apiToken" as const,
-                          apiToken: Redacted.make(c.apiToken),
-                          accountId,
-                          source: { type: "stored" as const },
-                        })),
-                        Match.when({ type: "apiKey" }, (c) => ({
-                          type: "apiKey" as const,
-                          apiKey: Redacted.make(c.apiKey),
-                          email: Redacted.make(c.email),
-                          accountId,
-                          source: { type: "stored" as const },
-                        })),
-                        Match.exhaustive,
-                      );
-                    }),
-              ),
+                source: { type: "stored" as const },
+              })),
             ),
-        ),
-        Match.when({ method: "oauth" }, (cfg) =>
-          Effect.gen(function* () {
-            const accountId = yield* validateAccountId(
-              cfg.accountId,
-              `configured for profile '${profileName}'`,
-            );
-            const creds = yield* store.read<OAuthClient.OAuthCredentials>(
-              profileName,
-              "cf-oauth",
-            );
-            if (creds == null || creds.type !== "oauth") {
-              return yield* Effect.fail(
-                new AuthError({
-                  message:
-                    "Cloudflare OAuth credentials not found. Run: alchemy login",
-                }),
+          ),
+          Match.when({ method: "oauth" }, (cfg) =>
+            Effect.gen(function* () {
+              if (!("scopes" in cfg)) {
+                return yield* Effect.fail(
+                  new NeedsReauth({
+                    provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Cloudflare OAuth scopes need to be selected. ${reauth}`,
+                  }),
+                );
+              }
+              const accountId = yield* validateAccountId(
+                cfg.accountId,
+                `configured for profile '${profileName}'`,
               );
-            }
-            // Refresh proactively if the token has expired (or is within
-            // 10s of expiring). Persist the refreshed creds so subsequent
-            // resolves don't repeat the round-trip.
-            const fresh =
-              creds.expires > Date.now() + 10_000
-                ? creds
-                : yield* OAuthClient.refresh(creds).pipe(
-                    Effect.tap((refreshed) =>
-                      store.write(profileName, "cf-oauth", refreshed),
-                    ),
-                    Effect.mapError(
-                      (e) =>
-                        new AuthError({
-                          message:
-                            "Cloudflare OAuth refresh failed. Run: alchemy login",
-                          cause: e,
-                        }),
-                    ),
-                  );
-            return {
-              type: "oauth" as const,
-              accessToken: Redacted.make(fresh.access),
-              expires: fresh.expires,
-              accountId,
-              source: { type: "oauth" as const },
-            };
-          }),
+              const creds: OAuthClient.OAuthCredentials = {
+                type: "oauth",
+                clientId: cfg.clientId,
+                access: Redacted.make(cfg.access),
+                refresh: Redacted.make(cfg.refresh),
+                expires: cfg.expires,
+                scopes: cfg.scopes,
+              };
+              if (!OAuthClient.usesCurrentClient(creds)) {
+                return yield* Effect.fail(
+                  new NeedsReauth({
+                    provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Cloudflare OAuth credentials for profile '${profileName}' were issued to an incompatible OAuth client and have been removed. ${reauth}`,
+                  }),
+                );
+              }
+              // Refresh proactively if the token has expired (or is within
+              // 10s of expiring). Persist the refreshed creds so subsequent
+              // resolves don't repeat the round-trip.
+              const now = yield* Clock.currentTimeMillis;
+              const fresh =
+                creds.expires > now + 10_000
+                  ? creds
+                  : yield* OAuthClient.refresh(creds).pipe(
+                      Effect.mapError(
+                        (e) =>
+                          new NeedsReauth({
+                            provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                            profile: profileName,
+                            message: `Cloudflare OAuth refresh failed. ${reauth}`,
+                            cause: e,
+                          }),
+                      ),
+                    );
+              if (fresh !== creds) {
+                yield* (
+                  updateConfig?.({
+                    method: "oauth",
+                    accountId,
+                    clientId: fresh.clientId,
+                    access: Redacted.value(fresh.access),
+                    refresh: Redacted.value(fresh.refresh),
+                    expires: fresh.expires,
+                    scopes: fresh.scopes,
+                  }) ?? Effect.void
+                );
+              }
+              return {
+                type: "oauth" as const,
+                accessToken: fresh.access,
+                expires: fresh.expires,
+                accountId,
+                source: { type: "oauth" as const },
+              };
+            }),
+          ),
+          Match.exhaustive,
+        );
+      });
+
+    const readEnvironment = Effect.gen(function* () {
+      const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(
+        Effect.flatMap((id) =>
+          validateAccountId(id, "from CLOUDFLARE_ACCOUNT_ID"),
         ),
-        Match.exhaustive,
       );
+      const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
+      if (apiToken) {
+        return {
+          type: "apiToken" as const,
+          apiToken,
+          accountId,
+          source: { type: "env" as const },
+        };
+      }
+      const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
+      const email =
+        (yield* getEnvRedacted("CLOUDFLARE_EMAIL")) ??
+        (yield* getEnvRedacted("CLOUDFLARE_ACCOUNT_EMAIL"));
+      if (apiKey && email) {
+        return {
+          type: "apiKey" as const,
+          apiKey,
+          email,
+          accountId,
+          source: { type: "env" as const },
+        };
+      }
+      return yield* new AuthError({
+        message:
+          "Cloudflare CI credentials not found. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY with CLOUDFLARE_EMAIL/CLOUDFLARE_ACCOUNT_EMAIL.",
+      });
+    });
 
     const logout = (profileName: string, config: CloudflareAuthConfig) =>
       Match.value(config)
         .pipe(
-          Match.when({ method: "env" }, () => Effect.void),
-          Match.when({ method: "stored" }, () =>
-            store
-              .delete(profileName, "cf-stored")
-              .pipe(
-                Effect.andThen(
-                  Clank.success("Cloudflare: stored credentials removed"),
-                ),
-              ),
-          ),
-          Match.when({ method: "oauth" }, () =>
-            store
-              .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
-              .pipe(
-                Effect.tap((creds) =>
-                  creds?.type === "oauth"
-                    ? OAuthClient.revoke(creds).pipe(
-                        Effect.catchTag("OAuthError", (err) =>
-                          Clank.warn(
-                            `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
-                          ),
-                        ),
-                      )
-                    : Effect.void,
-                ),
-                Effect.andThen(store.delete(profileName, "cf-oauth")),
-                Effect.andThen(
-                  Clank.success("Cloudflare: OAuth credentials removed."),
-                ),
-              ),
-          ),
+          Match.when({ method: "stored" }, () => Effect.void),
+          Match.when({ method: "oauth" }, (config) => {
+            if (!("scopes" in config)) return Effect.void;
+            const credentials: OAuthClient.OAuthCredentials = {
+              type: "oauth",
+              clientId: config.clientId,
+              access: Redacted.make(config.access),
+              refresh: Redacted.make(config.refresh),
+              expires: config.expires,
+              scopes: config.scopes,
+            };
+            return OAuthClient.usesCurrentClient(credentials)
+              ? OAuthClient.revoke(credentials).pipe(
+                  Effect.catchTag("OAuthError", (err) =>
+                    interaction.output.warning(
+                      `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                    ),
+                  ),
+                )
+              : Effect.void;
+          }),
           Match.exhaustive,
         )
         // The cached state-store credentials are derived from the account we
@@ -558,248 +616,294 @@ export const CloudflareAuth = AuthProviderLayer<
           ),
         );
 
-    const login = (profileName: string, config: CloudflareAuthConfig) =>
+    const login = (
+      profileName: string,
+      config: CloudflareAuthConfig,
+      updateConfig?: (
+        config: CloudflareAuthConfig,
+      ) => Effect.Effect<void, AuthError>,
+    ) =>
       Match.value(config)
         .pipe(
-          Match.when({ method: "env" }, () => Effect.void),
-          Match.when({ method: "stored" }, () =>
-            store
-              .read<CloudflareStoredCredentials>(profileName, "cf-stored")
-              .pipe(
-                Effect.flatMap((creds) =>
-                  creds == null ? loginStored(profileName) : Effect.void,
-                ),
-              ),
-          ),
+          Match.when({ method: "stored" }, (config) => Effect.succeed(config)),
           Match.when({ method: "oauth" }, (c) =>
-            Effect.gen(function* () {
-              const creds = yield* store.read<OAuthClient.OAuthCredentials>(
-                profileName,
-                "cf-oauth",
-              );
-
-              if (creds?.type === "oauth") {
-                yield* Clank.info(
-                  "Cloudflare: refreshing OAuth credentials...",
-                );
-                yield* OAuthClient.refresh(creds).pipe(
-                  Effect.flatMap((refreshed) =>
-                    store
-                      .write(profileName, "cf-oauth", refreshed)
-                      .pipe(
-                        Effect.andThen(
-                          Clank.success(
-                            "Cloudflare: OAuth credentials refreshed.",
-                          ),
-                        ),
-                      ),
-                  ),
-                  Effect.catchTag("OAuthError", () =>
-                    oauthLogin(profileName, c.scopes).pipe(Effect.asVoid),
-                  ),
-                );
-                return;
-              }
-
-              yield* oauthLogin(profileName, c.scopes);
-            }),
+            "scopes" in c
+              ? Effect.gen(function* () {
+                  const creds: OAuthClient.OAuthCredentials = {
+                    type: "oauth",
+                    clientId: c.clientId,
+                    access: Redacted.make(c.access),
+                    refresh: Redacted.make(c.refresh),
+                    expires: c.expires,
+                    scopes: c.scopes,
+                  };
+                  const reconfigure = reconfigureHint(
+                    CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profileName,
+                  );
+                  // Any path that falls back to a full browser login rebuilds the
+                  // authorize URL from the profile's stored scopes. Those scopes
+                  // may predate the current OAuth client (or a catalog change), and
+                  // one unknown scope makes the whole authorize URL invalid — so
+                  // sanitize before generating a URL, never after it fails.
+                  const fullLogin = Effect.gen(function* () {
+                    const { valid, dropped } = partitionOAuthScopes(c.scopes);
+                    if (valid.length === 0) {
+                      return yield* Effect.fail(
+                        new AuthError({
+                          message:
+                            `The OAuth scopes stored for profile '${profileName}' are no longer offered by Alchemy's Cloudflare OAuth client. ` +
+                            `Scopes must be picked again. ${reconfigure}`,
+                        }),
+                      );
+                    }
+                    const refreshed = yield* (
+                      dropped.length === 0
+                        ? Effect.void
+                        : interaction.output.warning(
+                            `Cloudflare: dropping ${dropped.length} stored scope${dropped.length === 1 ? "" : "s"} no longer offered by the current OAuth client (${dropped.join(", ")}). ` +
+                              `Scopes must be picked again. ${reconfigure}`,
+                          )
+                    ).pipe(Effect.andThen(oauthLogin(profileName, valid)));
+                    return {
+                      ...c,
+                      scopes: valid,
+                      clientId: refreshed.clientId,
+                      access: Redacted.value(refreshed.access),
+                      refresh: Redacted.value(refreshed.refresh),
+                      expires: refreshed.expires,
+                    };
+                  });
+
+                  // The silent refresh rotates a single-use refresh token, so
+                  // its read-refresh-persist section runs under the profile
+                  // lock — a concurrent `read` refreshing the same token would
+                  // double-spend it. The lock is held only for this API
+                  // round-trip, never across the browser wait below.
+                  const outcome =
+                    creds.type === "oauth" &&
+                    OAuthClient.usesCurrentClient(creds)
+                      ? yield* withProfileCredentialsLock(
+                          profileName,
+                          interaction.output
+                            .info("Cloudflare: refreshing OAuth credentials...")
+                            .pipe(
+                              Effect.andThen(OAuthClient.refresh(creds)),
+                              Effect.flatMap((credentials) => {
+                                const config = {
+                                  ...c,
+                                  clientId: credentials.clientId,
+                                  access: Redacted.value(credentials.access),
+                                  refresh: Redacted.value(credentials.refresh),
+                                  expires: credentials.expires,
+                                  scopes: credentials.scopes,
+                                };
+                                return (
+                                  updateConfig?.(config) ?? Effect.void
+                                ).pipe(
+                                  Effect.as({
+                                    type: "refreshed" as const,
+                                    config,
+                                  }),
+                                );
+                              }),
+                              Effect.tap(() =>
+                                interaction.output.success(
+                                  "Cloudflare: OAuth credentials refreshed.",
+                                ),
+                              ),
+                              Effect.catchTag("OAuthError", () =>
+                                Effect.succeed({ type: "browser" as const }),
+                              ),
+                            ),
+                        )
+                      : yield* Effect.gen(function* () {
+                          if (creds.type === "oauth") {
+                            yield* interaction.output.warning(
+                              "Cloudflare: removed OAuth credentials issued to the previous client.",
+                            );
+                          }
+                          return { type: "browser" as const };
+                        });
+                  if (outcome.type === "browser") {
+                    return yield* fullLogin;
+                  }
+                  return outcome.config;
+                })
+              : configureOAuth(profileName, c),
           ),
           Match.exhaustive,
         )
         .pipe(
-          Effect.mapError(
-            (e) => new AuthError({ message: "login failed", cause: e }),
+          // A blanket mapError must never swallow the NeedsReauth tag —
+          // the profile UI matches on it to render "needs re-login".
+          Effect.mapError((e) =>
+            e instanceof NeedsReauth
+              ? e
+              : new AuthError({ message: "login failed", cause: e }),
           ),
         );
 
-    const prettyPrint = (profileName: string, config: CloudflareAuthConfig) =>
-      resolveCredentials(profileName, config).pipe(
-        Effect.tap((creds) => {
-          const sourceStr = creds.source.details
-            ? `${creds.source.type} - ${creds.source.details}`
-            : creds.source.type;
-          return Match.value(creds).pipe(
-            Match.when({ type: "apiToken" }, (c) =>
-              Effect.all([
-                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-                Console.log(`  accountId: ${c.accountId}`),
-                Console.log(`  source: ${sourceStr}`),
+    const details = (
+      profileName: string,
+      config: CloudflareAuthConfig,
+      updateConfig?: (
+        config: CloudflareAuthConfig,
+      ) => Effect.Effect<void, AuthError>,
+    ) =>
+      Effect.all([
+        resolveCredentials(profileName, config, updateConfig),
+        Clock.currentTimeMillis,
+      ]).pipe(
+        Effect.map(([creds, now]) => {
+          const source = {
+            key: "source",
+            value:
+              "details" in creds.source && creds.source.details
+                ? `${creds.source.type} - ${creds.source.details}`
+                : creds.source.type,
+          };
+          return {
+            lines: Match.value(creds).pipe(
+              Match.when({ type: "apiToken" }, (c) => [
+                { key: "apiToken", value: displayRedacted(c.apiToken, 9) },
+                { key: "accountId", value: c.accountId },
+                source,
               ]),
-            ),
-            Match.when({ type: "apiKey" }, (c) =>
-              Effect.all([
-                Console.log(`  apiKey: ${displayRedacted(c.apiKey)}`),
-                Console.log(`  email:  ${displayRedacted(c.email)}`),
-                Console.log(`  accountId: ${c.accountId}`),
-                Console.log(`  source: ${sourceStr}`),
+              Match.when({ type: "apiKey" }, (c) => [
+                { key: "apiKey", value: displayRedacted(c.apiKey) },
+                { key: "email", value: displayRedacted(c.email) },
+                { key: "accountId", value: c.accountId },
+                source,
               ]),
+              Match.when({ type: "oauth" }, (c) => {
+                const remainingMs = c.expires - now;
+                const expiresAt = new Date(c.expires).toISOString();
+                const expiresStr =
+                  remainingMs <= 0
+                    ? `expired (${expiresAt})`
+                    : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+                return [
+                  { key: "accessToken", value: displayRedacted(c.accessToken) },
+                  { key: "expires", value: expiresStr },
+                  { key: "accountId", value: c.accountId },
+                  source,
+                ];
+              }),
+              Match.exhaustive,
             ),
-            Match.when({ type: "oauth" }, (c) => {
-              const remainingMs = c.expires - Date.now();
-              const expiresAt = new Date(c.expires).toISOString();
-              const expiresStr =
-                remainingMs <= 0
-                  ? `expired (${expiresAt})`
-                  : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
-              return Effect.all([
-                Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
-                Console.log(`  expires: ${expiresStr}`),
-                Console.log(`  accountId: ${c.accountId}`),
-                Console.log(`  source: ${sourceStr}`),
-              ]);
+          };
+        }),
+      );
+
+    /**
+     * Persist flag-provided stored credentials (`--method stored`). Writes
+     * the same `cloudflare-stored` file the interactive stored path writes;
+     * OAuth is interactive-only and not accepted here.
+     */
+    const configureWith = (
+      profileName: string,
+      input: {
+        readonly method: string;
+        readonly values: Record<string, string>;
+      },
+    ): Effect.Effect<CloudflareAuthConfig, AuthError> => {
+      const persist = (config: CloudflareAuthConfig) =>
+        store
+          .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+          .pipe(Effect.ignore, Effect.as(config));
+      if (input.method !== "stored") {
+        return Effect.fail(
+          new AuthError({
+            message: `Cloudflare: unknown method '${input.method}'. Valid methods: stored. (OAuth is interactive-only.)`,
+          }),
+        );
+      }
+      return validateFieldValues(
+        CLOUDFLARE_AUTH_PROVIDER_NAME,
+        storedFields,
+        input.values,
+      ).pipe(
+        Effect.flatMap((values) => {
+          const accountId = (storedValueText(values.accountId) ?? "")
+            .trim()
+            .toLowerCase();
+          const apiToken = storedSecret(values.apiToken);
+          const apiKey = storedSecret(values.apiKey);
+          const email = storedValueText(values.email);
+          if (
+            apiToken !== undefined &&
+            apiKey === undefined &&
+            email === undefined
+          ) {
+            return persist({
+              method: "stored",
+              credentialType: "apiToken",
+              apiToken: Redacted.value(apiToken),
+              accountId,
+            });
+          }
+          if (
+            apiToken === undefined &&
+            apiKey !== undefined &&
+            email !== undefined
+          ) {
+            return persist({
+              method: "stored",
+              credentialType: "apiKey",
+              apiKey: Redacted.value(apiKey),
+              email,
+              accountId,
+            });
+          }
+          return Effect.fail(
+            new AuthError({
+              message:
+                "Cloudflare: pass either --set apiToken=<token>, or both --set apiKey=<key> and --set email=<email>.",
             }),
-            Match.exhaustive,
           );
         }),
       );
+    };
 
     return {
+      configSchema: CloudflareAuthConfigSchema,
       configure: configureCredentials,
+      configureWith,
+      configureMethods,
       logout,
       login,
-      prettyPrint,
+      details,
       read: resolveCredentials,
+      readEnvironment,
+      environment: [
+        {
+          name: "CLOUDFLARE_ACCOUNT_ID",
+          required: true,
+          description: "Account the stack deploys into.",
+        },
+        {
+          name: "CLOUDFLARE_API_TOKEN",
+          required: true,
+          secret: true,
+          alternatives: ["CLOUDFLARE_API_KEY"],
+          description:
+            "API token (preferred). Not consulted when unset and CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL are provided instead.",
+        },
+        {
+          name: "CLOUDFLARE_API_KEY",
+          required: false,
+          secret: true,
+          description:
+            "Global API key; used with CLOUDFLARE_EMAIL when no API token is set.",
+        },
+        {
+          name: "CLOUDFLARE_EMAIL",
+          required: false,
+          alternatives: ["CLOUDFLARE_ACCOUNT_EMAIL"],
+          description: "Account email paired with CLOUDFLARE_API_KEY.",
+        },
+      ],
     };
   }),
 );
-
-export const ALL_SCOPES = {
-  "access:read":
-    "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-  "access:write":
-    "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-  "account:read":
-    "See your account info such as account details, analytics, and memberships",
-  "agw:read": "Grants read level access to Agents Gateway",
-  "agw:run": "Grants run level access to Agents Gateway",
-  "agw:write": "Grants read and write level access to Agents Gateway",
-  "ai:read": "Grants read level access to Workers AI",
-  "ai:write": "Grants write level access to Workers AI",
-  "aiaudit:read": "Grants read level access to AI Audit",
-  "aiaudit:write": "Grants write level access to AI Audit",
-  "aig:read": "Grants read level access to AI Gateway",
-  "aig:write": "Grants write level access to AI Gateway",
-  "auditlogs:read": "View Cloudflare Account Audit Logs",
-  "browser:read": "Grants read level access to Browser Rendering",
-  "browser:write": "Grants write level access to Browser Rendering",
-  "cfone:read": "Grants read level access to Cloudforce One data",
-  "cfone:write": "Grants write level access to Cloudforce One data",
-  "cloudchamber:write": "See and make changes to Cloudchamber",
-  "connectivity:admin":
-    "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
-  "connectivity:bind":
-    "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
-  "connectivity:read":
-    "See Connectivity Directory services and Cloudflare Tunnels",
-  "constellation:write":
-    "Grants write access to Constellation configuration and models",
-  "containers:write": "See and make changes to Workers Containers",
-  "d1:write": "See and make changes to D1",
-  "dex:read": "Grants read level access to Cloudflare DEX",
-  "dex:write": "Grants write level access to Cloudflare DEX",
-  "dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
-  "dns_records:edit": "Grants edit level access to dns records",
-  "dns_records:read": "Grants read level access to dns records",
-  "dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
-  "firstpartytags:write":
-    "Can see, edit and publish Google tag gateway configuration.",
-  "lb:edit": "Grants edit level access to lb and lb pools",
-  "lb:read": "Grants read level access to lb and lb pools",
-  "logpush:read": "See Cloudflare Logpush data",
-  "logpush:write": "See and change Cloudflare Logpush data",
-  "notification:read": "View Cloudflare Notifications",
-  "notification:write": "View and Modify Cloudflare Notifications",
-  "pages:read": "See Cloudflare Pages projects, settings and deployments",
-  "pages:write":
-    "See and change Cloudflare Pages projects, settings and deployments",
-  "pipelines:read": "Grants read level access to Cloudflare Pipelines",
-  "pipelines:setup":
-    "Grants permission to generate R2 tokens for Workers Pipelines",
-  "pipelines:write": "Grants write level access to Cloudflare Pipelines",
-  "query_cache:write": "See and make changes to Hyperdrive",
-  "queues:write": "See and change Cloudflare Queues settings and data",
-  "r2_catalog:write": "Grants write level access to R2 Data Catalog",
-  "radar:read": "Grants access to read Cloudflare Radar data",
-  "ai-search:read": "Grants read level access to AI Search",
-  "ai-search:write": "Grants write level access to AI Search",
-  "ai-search:run": "Grants run level access to AI Search",
-  "secrets_store:read": "Grants read level access to Secrets Store",
-  "secrets_store:write": "Grants write level access to Secrets Store",
-  "ssl_certs:write":
-    "Grants read and write access to SSL MTLS certificates or Certificate Store",
-  "sso-connector:read": "See Cloudflare SSO connectors",
-  "sso-connector:write":
-    "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
-  "teams:pii": "See personally identifiable Cloudflare Teams data",
-  "teams:read":
-    "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-  "teams:secure_location":
-    "See all DNS Location data but can only change secure DNS Locations",
-  "teams:write":
-    "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-  "url_scanner:read": "Grants read level access to URL Scanner",
-  "url_scanner:write": "Grants write level access to URL Scanner",
-  "user:read":
-    "See your user info such as name, email address, and account memberships",
-  "vectorize:write": "See and make changes to Vectorize",
-  "workers:read":
-    "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-  "workers:write":
-    "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-  "workers_builds:read":
-    "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-  "workers_builds:write":
-    "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-  "workers_kv:write":
-    "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
-  "workers_observability:read":
-    "Grants read access to Cloudflare Workers Observability",
-  "workers_observability:write":
-    "Grants read and write access to Cloudflare Workers Observability",
-  "workers_observability_telemetry:write":
-    "Grants write access to Cloudflare Workers Observability Telemetry API",
-  "workers_routes:write":
-    "See and change Cloudflare Workers data such as filters and routes",
-  "workers_scripts:write":
-    "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
-  "workers_tail:read": "See Cloudflare Workers tail and script data",
-  "zone:read": "Grants read level access to account zone",
-};
-
-export const DEFAULT_SCOPES = [
-  "account:read",
-  "ai-search:write",
-  "ai-search:run",
-  "ai:write",
-  "aig:read",
-  "aig:write",
-  "cloudchamber:write",
-  "connectivity:admin",
-  "containers:write",
-  "d1:write",
-  "pages:write",
-  "pipelines:write",
-  "queues:write",
-  "secrets_store:write",
-  "ssl_certs:write",
-  "user:read",
-  "vectorize:write",
-  "workers_kv:write",
-  "workers_observability:read",
-  "workers_observability:write",
-  "workers_observability_telemetry:write",
-  "workers_routes:write",
-  "workers_scripts:write",
-  "workers_tail:read",
-  "workers:write",
-  "zone:read",
-];
-
-export const OAUTH_CLIENT_ID = "6d8c2255-0773-45f6-b376-2914632e6f91";
-export const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
-export const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
-export const OAUTH_ENDPOINTS = {
-  authorize: "https://dash.cloudflare.com/oauth2/authorize",
-  token: "https://dash.cloudflare.com/oauth2/token",
-  revoke: "https://dash.cloudflare.com/oauth2/revoke",
-};