alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Cloudflare/Auth/AuthProvider.js

@@ -1,203 +1,276 @@
 import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
+import * as cfMemberships from "@distilled.cloud/cloudflare/memberships";
 import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
-import * as Console from "effect/Console";
+import * as Clock from "effect/Clock";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as HttpClient from "effect/unstable/http/HttpClient";
-import { AuthError, AuthProviderLayer, } from "../../Auth/AuthProvider.js";
+import { AuthError, AuthProviderLayer, NeedsReauth, reconfigureHint, refreshHint, } from "../../Auth/AuthProvider.js";
+import { storedSecret, storedValueText, validateFieldValues, } from "../../Auth/StoredAuthProvider.js";
 import { CredentialsStore, displayRedacted } from "../../Auth/Credentials.js";
-import { getEnv, getEnvRedacted, getEnvRequired, retryOnce, } from "../../Auth/Env.js";
-import * as Clank from "../../Util/Clank.js";
+import { withProfileCredentialsLock } from "../../Auth/Lock.js";
+import { getEnvRedacted, getEnvRequired, mapPromptCancellation, } from "../../Auth/Env.js";
+import { browserOAuth } from "../../Auth/BrowserOAuth.js";
+import * as Interaction from "../../Interaction.js";
 import { CREDENTIALS_FILE as STATE_STORE_CREDENTIALS_FILE } from "../StateStore/CredentialsFile.js";
 import * as OAuthClient from "./OAuthClient.js";
+import { CLOUDFLARE_AUTH_PROVIDER_NAME, CloudflareAuthConfigSchema, validateAccountId, validateAccountIdField, } from "./AuthConfig.js";
+import { ALL_SCOPE_IDS, BASIC_SCOPES, customOAuthScopeDefaults, OAUTH_SCOPE_GROUPS, OAUTH_SCOPE_NAMES, partitionOAuthScopes, } from "./OAuthScopes.js";
 const options = [
     {
         value: "oauth",
         label: "OAuth",
-        hint: "recommended — browser-based login with automatic token refresh",
-    },
-    {
-        value: "env",
-        label: "Environment Variables",
-        hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL",
+        description: "recommended — browser-based login with automatic token refresh",
     },
     {
         value: "stored",
         label: "API Token or API Key",
-        hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
+        description: "use an API token or global API key",
     },
 ];
-export const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
 const withOAuthCredentials = (accessToken, effect) => Effect.provide(effect, Layer.mergeAll(CfCredentialsModule.fromOAuth({
     load: Effect.succeed({ accessToken }),
     refresh: () => Effect.die("refresh not expected during account selection"),
 }), FetchHttpClient.layer));
+/**
+ * Accounts visible to a user-scoped OAuth token. `GET /accounts` returns an
+ * EMPTY list for these tokens (it only lists accounts an account-scoped
+ * credential can read), so memberships are the authoritative account list —
+ * the same endpoint wrangler uses. `GET /accounts` remains as a fallback for
+ * tokens authorized without `memberships.read` (custom scope selections).
+ */
+const listVisibleAccounts = Effect.gen(function* () {
+    const listMemberships = yield* cfMemberships.listMemberships;
+    const membershipAccounts = yield* listMemberships({}).pipe(Effect.map((response) => response.result.flatMap((membership) => membership.account != null &&
+        (membership.status == null || membership.status === "accepted")
+        ? [membership.account]
+        : [])), Effect.catch((error) => Effect.logDebug("Cloudflare: listing memberships failed", error).pipe(Effect.as([]))));
+    if (membershipAccounts.length > 0)
+        return membershipAccounts;
+    const listAccounts = yield* cfAccounts.listAccounts;
+    const response = yield* listAccounts({});
+    yield* Effect.logDebug(`Cloudflare: memberships listed 0 accounts; /accounts listed ${response.result.length}`);
+    return response.result;
+});
 const selectAccount = (accessToken) => Effect.gen(function* () {
-    const list = yield* cfAccounts.listAccounts;
-    const response = yield* list({});
-    const accounts = response.result;
+    const interaction = Interaction.accessors;
+    const accounts = yield* listVisibleAccounts;
     if (accounts.length === 0) {
         return yield* new AuthError({
-            message: "Cloudflare: no accounts found for this credential.",
+            message: "No Cloudflare accounts are visible to this credential. " +
+                "Ensure the authorized OAuth scopes include 'memberships.read'.",
         });
     }
-    if (accounts.length === 1) {
-        const account = accounts[0];
-        yield* Clank.info(`Cloudflare: using account: ${account.name} (${account.id})`);
+    const [account] = accounts;
+    if (accounts.length === 1 && account !== undefined) {
+        yield* interaction.output.info(`Using Cloudflare account ${account.name}.`);
         return account.id;
     }
-    return yield* Clank.select({
+    return yield* interaction.prompt
+        .select({
         message: "Select a Cloudflare account",
+        searchable: true,
         options: accounts.map((a) => ({
             value: a.id,
             label: a.name,
-            hint: a.id,
+            description: a.id,
         })),
-    }).pipe(retryOnce);
+    })
+        .pipe(mapPromptCancellation);
 }).pipe((e) => withOAuthCredentials(accessToken, e));
+const promptAccountId = () => Effect.gen(function* () {
+    const interaction = yield* Interaction.Interaction;
+    return yield* interaction.prompt
+        .text({
+        message: "Cloudflare Account ID",
+        validate: validateAccountIdField,
+    })
+        .pipe(mapPromptCancellation);
+});
+const accountIdField = {
+    name: "accountId",
+    label: "Cloudflare Account ID",
+    validate: validateAccountIdField,
+};
 /**
- * Cloudflare account IDs are 32 lowercase hex characters. Placeholder
- * values ("", "-", "dummy", …) end up interpolated into API paths and
- * surface as baffling `InvalidRoute: Could not route to
- * /accounts/<value>/...` errors, so reject them up front with an
- * actionable message instead.
+ * `--set` fields for `--method stored`. The persisted `credentialType` is
+ * inferred from which secret is supplied: `apiToken` alone, or `apiKey`
+ * together with `email`.
  */
-const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
-export const validateAccountId = (accountId, source) => {
-    const trimmed = accountId?.trim() ?? "";
-    if (trimmed.length === 0) {
-        return Effect.fail(new AuthError({
-            message: `Cloudflare account ID is missing (${source}). ` +
-                "Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID " +
-                "(found in the Cloudflare dashboard under Workers & Pages → Account details).",
-        }));
-    }
-    if (!ACCOUNT_ID_PATTERN.test(trimmed)) {
-        return Effect.fail(new AuthError({
-            message: `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. ` +
-                "Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) " +
-                "into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.",
-        }));
-    }
-    return Effect.succeed(trimmed.toLowerCase());
-};
-const promptAccountId = () => getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((envAccountId) => Clank.text({
-    message: "Cloudflare Account ID (Enter to skip)",
-    placeholder: envAccountId ?? "",
-    defaultValue: envAccountId ?? "",
-    validate: (v) => v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim())
-        ? undefined
-        : "Expected a 32-character hex account ID (Workers & Pages → Account details)",
-}).pipe(retryOnce)));
-const promptOAuthScopes = () => Clank.confirm({
-    message: "Customize OAuth scopes? (default covers typical use cases)",
-    initialValue: false,
-}).pipe(retryOnce, Effect.flatMap((customize) => {
-    if (!customize)
-        return Effect.succeed([...DEFAULT_SCOPES]);
-    return Clank.multiselect({
+const storedFields = [
+    {
+        name: "apiToken",
+        label: "Cloudflare API Token",
+        description: "Pass either apiToken, or apiKey together with email.",
+        secret: true,
+        optional: true,
+    },
+    { name: "apiKey", label: "Cloudflare API Key", secret: true, optional: true },
+    { name: "email", label: "Cloudflare Email", optional: true },
+    accountIdField,
+];
+/**
+ * Flag-driven configuration methods. OAuth is deliberately absent — it is
+ * interactive-only (browser grant).
+ */
+const configureMethods = [
+    { method: "stored", fields: storedFields },
+];
+const promptOAuthScopes = (currentConfig) => Effect.gen(function* () {
+    const interaction = yield* Interaction.Interaction;
+    const mode = yield* interaction.prompt
+        .select({
+        message: "Cloudflare OAuth scopes",
+        initialValue: "all",
+        options: [
+            {
+                value: "all",
+                label: "All Scopes",
+                description: "authorize every available Cloudflare permission",
+            },
+            {
+                value: "basic",
+                label: "Basic Scopes",
+                description: "covers typical Alchemy use cases",
+            },
+            {
+                value: "custom",
+                label: "Custom Scopes",
+                description: "choose individual permissions",
+            },
+        ],
+    })
+        .pipe(mapPromptCancellation);
+    if (mode === "basic")
+        return [...BASIC_SCOPES];
+    if (mode === "all")
+        return [...ALL_SCOPE_IDS];
+    return yield* interaction.prompt
+        .multiSelect({
         message: "Select OAuth scopes",
-        initialValues: DEFAULT_SCOPES,
-        options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
-            value: value,
-            label: value,
-            hint,
-        })),
+        initialValues: customOAuthScopeDefaults(currentConfig),
+        searchable: true,
+        descriptionPlacement: "inline",
+        options: OAUTH_SCOPE_GROUPS.flatMap((group) => group.scopes.map((value) => ({
+            value,
+            label: OAUTH_SCOPE_NAMES[value],
+            description: value,
+            group: group.label,
+        }))),
         required: true,
-    }).pipe(Effect.map((s) => s), retryOnce);
-}));
+    })
+        .pipe(mapPromptCancellation);
+});
 /**
  * Layer that registers the Cloudflare {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Cloudflare
- * `providers()` layer so `alchemy login` can discover it.
+ * `providers()` layer so the alchemy CLI can discover it.
  */
 export const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+    const interaction = Interaction.accessors;
     const store = yield* CredentialsStore;
-    const oauthLogin = (profileName, scopes) => Effect.gen(function* () {
-        const authorization = OAuthClient.authorize([
+    const oauthLogin = (_profileName, scopes) => Effect.gen(function* () {
+        const authorization = yield* OAuthClient.authorize([
             ...scopes,
             "offline_access",
         ]);
-        yield* Clank.info("Cloudflare: opening browser for OAuth login...");
-        yield* Clank.info(authorization.url);
-        yield* Clank.openUrl(authorization.url).pipe(Effect.catch(() => Clank.warn("Cloudflare: could not open browser automatically. Please open the URL above manually.")));
-        yield* Clank.info("Cloudflare: waiting for authorization (up to 5 minutes).");
-        const credentials = yield* Effect.raceFirst(OAuthClient.callback(authorization), Clank.text({
-            message: "Paste the authorization code or callback URL",
-            placeholder: "The browser will complete this automatically when local",
-            validate: (value) => value.trim().length > 0 ? undefined : "Paste a code or URL",
-        }).pipe(Effect.flatMap((input) => OAuthClient.exchangeCallbackInput(input, authorization))));
-        yield* store.write(profileName, "cf-oauth", credentials);
-        yield* Clank.success("Cloudflare: OAuth credentials saved.");
+        const credentials = yield* browserOAuth({
+            provider: "Cloudflare",
+            url: authorization.url,
+            callback: OAuthClient.callback(authorization),
+            exchange: (input) => OAuthClient.exchangeCallbackInput(input, authorization),
+        });
+        yield* interaction.output.success("Connected to Cloudflare with OAuth.");
         return credentials;
     });
     const loginStored = Effect.fn(function* (profileName) {
-        const credentialType = yield* Clank.select({
+        const credentialType = yield* interaction.prompt
+            .select({
             message: "Cloudflare credential type",
             options: [
                 {
                     value: "apiToken",
                     label: "API Token",
-                    hint: "recommended",
+                    description: "recommended",
                 },
                 { value: "apiKey", label: "API Key + Email" },
             ],
-        }).pipe(retryOnce);
+        })
+            .pipe(mapPromptCancellation);
         return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
-            const apiToken = yield* Clank.password({
+            const apiToken = yield* interaction.prompt
+                .password({
                 message: "Cloudflare API Token",
                 validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
+            })
+                .pipe(mapPromptCancellation, Effect.map(Redacted.make));
             const accountId = yield* promptAccountId();
-            yield* store.write(profileName, "cf-stored", { type: "apiToken", apiToken, accountId });
-            yield* Clank.success("Cloudflare: credentials saved.");
+            yield* interaction.output.success("Cloudflare: credentials saved.");
             return {
                 method: "stored",
                 credentialType: "apiToken",
+                apiToken: Redacted.value(apiToken),
+                accountId,
             };
         })), Match.when("apiKey", () => Effect.gen(function* () {
-            const apiKey = yield* Clank.text({
+            const apiKey = yield* interaction.prompt
+                .password({
                 message: "Cloudflare API Key",
                 validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
-            const email = yield* Clank.text({
+            })
+                .pipe(mapPromptCancellation, Effect.map(Redacted.make));
+            const email = yield* interaction.prompt
+                .text({
                 message: "Cloudflare Email",
                 validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
+            })
+                .pipe(mapPromptCancellation, Effect.map(Redacted.make));
             const accountId = yield* promptAccountId();
-            yield* store.write(profileName, "cf-stored", { type: "apiKey", apiKey, email, accountId });
-            yield* Clank.success("Cloudflare: credentials saved.");
+            yield* interaction.output.success("Cloudflare: credentials saved.");
             return {
                 method: "stored",
                 credentialType: "apiKey",
+                apiKey: Redacted.value(apiKey),
+                email: Redacted.value(email),
+                accountId,
             };
         })), Match.exhaustive);
     });
-    const configureOAuth = Effect.fn(function* (profileName) {
-        const scopes = yield* promptOAuthScopes();
-        const oauthCreds = yield* oauthLogin(profileName, scopes);
-        const accountId = yield* selectAccount(oauthCreds.access).pipe(Effect.mapError((e) => new AuthError({
-            message: "Cloudflare: could not list accounts",
-            cause: e,
-        })));
+    const configureOAuth = Effect.fn(function* (profileName, currentConfig) {
+        const scopes = yield* promptOAuthScopes(currentConfig);
+        const oauthCreds = yield* oauthLogin(profileName, [...scopes]);
+        const accountId = yield* selectAccount(Redacted.value(oauthCreds.access)).pipe(
+        // Keep AuthError messages intact — they carry the actionable
+        // diagnosis (e.g. "no accounts visible"); only wrap raw API errors.
+        Effect.mapError((e) => e instanceof AuthError
+            ? e
+            : new AuthError({
+                message: "Cloudflare: could not list accounts",
+                cause: e,
+            })));
         return {
             method: "oauth",
-            scopes,
+            scopes: [...scopes],
             accountId,
+            clientId: oauthCreds.clientId,
+            access: Redacted.value(oauthCreds.access),
+            refresh: Redacted.value(oauthCreds.refresh),
+            expires: oauthCreds.expires,
         };
     });
-    const configureInteractive = (profileName) => Clank.select({
+    const configureInteractive = (profileName, currentConfig) => interaction.prompt
+        .select({
         message: "Cloudflare authentication method",
         options,
-    }).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("oauth", () => configureOAuth(profileName)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
-    const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
-        const config = ctx.ci
-            ? { method: "env" }
-            : yield* configureInteractive(profileName);
+    })
+        .pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("oauth", () => configureOAuth(profileName, currentConfig)), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+    const configureCredentials = (profileName, currentConfig) => Effect.gen(function* () {
+        const config = yield* configureInteractive(profileName, currentConfig);
         // Re-configuring auth may point this profile at a different
         // Cloudflare account. The cached state-store credentials
         // (`~/.alchemy/credentials/{profile}/cloudflare-state-store.json`)
@@ -207,12 +280,87 @@ export const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME,
             .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
             .pipe(Effect.ignore);
         return config;
-    }).pipe(Effect.mapError((e) => new AuthError({
-        message: "failed to configure credentials",
-        cause: e,
-    })));
-    const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fn(function* () {
-        const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((id) => validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var")));
+    }).pipe(
+    // AuthError messages are already user-facing; re-wrapping them in a
+    // generic banner is what hid "no accounts visible" behind
+    // "failed to configure credentials".
+    Effect.mapError((e) => e instanceof AuthError
+        ? e
+        : new AuthError({
+            message: "failed to configure credentials",
+            cause: e,
+        })));
+    const resolveCredentials = (profileName, config, updateConfig) => Effect.gen(function* () {
+        const reauth = refreshHint(CLOUDFLARE_AUTH_PROVIDER_NAME, profileName);
+        return yield* Match.value(config).pipe(Match.when({ method: "stored", credentialType: "apiToken" }, (c) => validateAccountId(c.accountId, `stored for profile '${profileName}'`).pipe(Effect.map((accountId) => ({
+            type: "apiToken",
+            apiToken: Redacted.make(c.apiToken),
+            accountId,
+            source: { type: "stored" },
+        })))), Match.when({ method: "stored", credentialType: "apiKey" }, (c) => validateAccountId(c.accountId, `stored for profile '${profileName}'`).pipe(Effect.map((accountId) => ({
+            type: "apiKey",
+            apiKey: Redacted.make(c.apiKey),
+            email: Redacted.make(c.email),
+            accountId,
+            source: { type: "stored" },
+        })))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
+            if (!("scopes" in cfg)) {
+                return yield* Effect.fail(new NeedsReauth({
+                    provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Cloudflare OAuth scopes need to be selected. ${reauth}`,
+                }));
+            }
+            const accountId = yield* validateAccountId(cfg.accountId, `configured for profile '${profileName}'`);
+            const creds = {
+                type: "oauth",
+                clientId: cfg.clientId,
+                access: Redacted.make(cfg.access),
+                refresh: Redacted.make(cfg.refresh),
+                expires: cfg.expires,
+                scopes: cfg.scopes,
+            };
+            if (!OAuthClient.usesCurrentClient(creds)) {
+                return yield* Effect.fail(new NeedsReauth({
+                    provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Cloudflare OAuth credentials for profile '${profileName}' were issued to an incompatible OAuth client and have been removed. ${reauth}`,
+                }));
+            }
+            // Refresh proactively if the token has expired (or is within
+            // 10s of expiring). Persist the refreshed creds so subsequent
+            // resolves don't repeat the round-trip.
+            const now = yield* Clock.currentTimeMillis;
+            const fresh = creds.expires > now + 10_000
+                ? creds
+                : yield* OAuthClient.refresh(creds).pipe(Effect.mapError((e) => new NeedsReauth({
+                    provider: CLOUDFLARE_AUTH_PROVIDER_NAME,
+                    profile: profileName,
+                    message: `Cloudflare OAuth refresh failed. ${reauth}`,
+                    cause: e,
+                })));
+            if (fresh !== creds) {
+                yield* (updateConfig?.({
+                    method: "oauth",
+                    accountId,
+                    clientId: fresh.clientId,
+                    access: Redacted.value(fresh.access),
+                    refresh: Redacted.value(fresh.refresh),
+                    expires: fresh.expires,
+                    scopes: fresh.scopes,
+                }) ?? Effect.void);
+            }
+            return {
+                type: "oauth",
+                accessToken: fresh.access,
+                expires: fresh.expires,
+                accountId,
+                source: { type: "oauth" },
+            };
+        })), Match.exhaustive);
+    });
+    const readEnvironment = Effect.gen(function* () {
+        const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID").pipe(Effect.flatMap((id) => validateAccountId(id, "from CLOUDFLARE_ACCOUNT_ID")));
         const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
         if (apiToken) {
             return {
@@ -223,7 +371,8 @@ export const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME,
             };
         }
         const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
-        const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
+        const email = (yield* getEnvRedacted("CLOUDFLARE_EMAIL")) ??
+            (yield* getEnvRedacted("CLOUDFLARE_ACCOUNT_EMAIL"));
         if (apiKey && email) {
             return {
                 type: "apiKey",
@@ -234,230 +383,227 @@ export const CloudflareAuth = AuthProviderLayer()(CLOUDFLARE_AUTH_PROVIDER_NAME,
             };
         }
         return yield* new AuthError({
-            message: "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.",
+            message: "Cloudflare CI credentials not found. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY with CLOUDFLARE_EMAIL/CLOUDFLARE_ACCOUNT_EMAIL.",
         });
-    })), Match.when({ method: "stored" }, () => store
-        .read(profileName, "cf-stored")
-        .pipe(Effect.flatMap((creds) => creds == null
-        ? Effect.fail(new AuthError({
-            message: "Cloudflare stored credentials not found. Run: alchemy login --configure",
-        }))
-        : Effect.gen(function* () {
-            // The account ID prompt is skippable, so stored
-            // credentials may carry an empty accountId; fall
-            // back to the env var before validating.
-            const envAccountId = yield* getEnv("CLOUDFLARE_ACCOUNT_ID");
-            const accountId = yield* validateAccountId(creds.accountId?.trim() || envAccountId, `stored for profile '${profileName}'`);
-            return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => ({
-                type: "apiToken",
-                apiToken: Redacted.make(c.apiToken),
-                accountId,
-                source: { type: "stored" },
-            })), Match.when({ type: "apiKey" }, (c) => ({
-                type: "apiKey",
-                apiKey: Redacted.make(c.apiKey),
-                email: Redacted.make(c.email),
-                accountId,
-                source: { type: "stored" },
-            })), Match.exhaustive);
-        })))), Match.when({ method: "oauth" }, (cfg) => Effect.gen(function* () {
-        const accountId = yield* validateAccountId(cfg.accountId, `configured for profile '${profileName}'`);
-        const creds = yield* store.read(profileName, "cf-oauth");
-        if (creds == null || creds.type !== "oauth") {
-            return yield* Effect.fail(new AuthError({
-                message: "Cloudflare OAuth credentials not found. Run: alchemy login",
-            }));
-        }
-        // Refresh proactively if the token has expired (or is within
-        // 10s of expiring). Persist the refreshed creds so subsequent
-        // resolves don't repeat the round-trip.
-        const fresh = creds.expires > Date.now() + 10_000
-            ? creds
-            : yield* OAuthClient.refresh(creds).pipe(Effect.tap((refreshed) => store.write(profileName, "cf-oauth", refreshed)), Effect.mapError((e) => new AuthError({
-                message: "Cloudflare OAuth refresh failed. Run: alchemy login",
-                cause: e,
-            })));
-        return {
+    });
+    const logout = (profileName, config) => Match.value(config)
+        .pipe(Match.when({ method: "stored" }, () => Effect.void), Match.when({ method: "oauth" }, (config) => {
+        if (!("scopes" in config))
+            return Effect.void;
+        const credentials = {
             type: "oauth",
-            accessToken: Redacted.make(fresh.access),
-            expires: fresh.expires,
-            accountId,
-            source: { type: "oauth" },
+            clientId: config.clientId,
+            access: Redacted.make(config.access),
+            refresh: Redacted.make(config.refresh),
+            expires: config.expires,
+            scopes: config.scopes,
         };
-    })), Match.exhaustive);
-    const logout = (profileName, config) => Match.value(config)
-        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
-        .delete(profileName, "cf-stored")
-        .pipe(Effect.andThen(Clank.success("Cloudflare: stored credentials removed")))), Match.when({ method: "oauth" }, () => store
-        .read(profileName, "cf-oauth")
-        .pipe(Effect.tap((creds) => creds?.type === "oauth"
-        ? OAuthClient.revoke(creds).pipe(Effect.catchTag("OAuthError", (err) => Clank.warn(`Cloudflare: could not revoke OAuth token: ${err.errorDescription}`)))
-        : Effect.void), Effect.andThen(store.delete(profileName, "cf-oauth")), Effect.andThen(Clank.success("Cloudflare: OAuth credentials removed.")))), Match.exhaustive)
+        return OAuthClient.usesCurrentClient(credentials)
+            ? OAuthClient.revoke(credentials).pipe(Effect.catchTag("OAuthError", (err) => interaction.output.warning(`Cloudflare: could not revoke OAuth token: ${err.errorDescription}`)))
+            : Effect.void;
+    }), Match.exhaustive)
         // The cached state-store credentials are derived from the account we
         // just logged out of, so drop them regardless of auth method.
         .pipe(Effect.andThen(store
         .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
         .pipe(Effect.ignore)));
-    const login = (profileName, config) => Match.value(config)
-        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
-        .read(profileName, "cf-stored")
-        .pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.when({ method: "oauth" }, (c) => Effect.gen(function* () {
-        const creds = yield* store.read(profileName, "cf-oauth");
-        if (creds?.type === "oauth") {
-            yield* Clank.info("Cloudflare: refreshing OAuth credentials...");
-            yield* OAuthClient.refresh(creds).pipe(Effect.flatMap((refreshed) => store
-                .write(profileName, "cf-oauth", refreshed)
-                .pipe(Effect.andThen(Clank.success("Cloudflare: OAuth credentials refreshed.")))), Effect.catchTag("OAuthError", () => oauthLogin(profileName, c.scopes).pipe(Effect.asVoid)));
-            return;
-        }
-        yield* oauthLogin(profileName, c.scopes);
-    })), Match.exhaustive)
-        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
-    const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
-        const sourceStr = creds.source.details
-            ? `${creds.source.type} - ${creds.source.details}`
-            : creds.source.type;
-        return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => Effect.all([
-            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-            Console.log(`  accountId: ${c.accountId}`),
-            Console.log(`  source: ${sourceStr}`),
-        ])), Match.when({ type: "apiKey" }, (c) => Effect.all([
-            Console.log(`  apiKey: ${displayRedacted(c.apiKey)}`),
-            Console.log(`  email:  ${displayRedacted(c.email)}`),
-            Console.log(`  accountId: ${c.accountId}`),
-            Console.log(`  source: ${sourceStr}`),
-        ])), Match.when({ type: "oauth" }, (c) => {
-            const remainingMs = c.expires - Date.now();
-            const expiresAt = new Date(c.expires).toISOString();
-            const expiresStr = remainingMs <= 0
-                ? `expired (${expiresAt})`
-                : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
-            return Effect.all([
-                Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
-                Console.log(`  expires: ${expiresStr}`),
-                Console.log(`  accountId: ${c.accountId}`),
-                Console.log(`  source: ${sourceStr}`),
-            ]);
-        }), Match.exhaustive);
+    const login = (profileName, config, updateConfig) => Match.value(config)
+        .pipe(Match.when({ method: "stored" }, (config) => Effect.succeed(config)), Match.when({ method: "oauth" }, (c) => "scopes" in c
+        ? Effect.gen(function* () {
+            const creds = {
+                type: "oauth",
+                clientId: c.clientId,
+                access: Redacted.make(c.access),
+                refresh: Redacted.make(c.refresh),
+                expires: c.expires,
+                scopes: c.scopes,
+            };
+            const reconfigure = reconfigureHint(CLOUDFLARE_AUTH_PROVIDER_NAME, profileName);
+            // Any path that falls back to a full browser login rebuilds the
+            // authorize URL from the profile's stored scopes. Those scopes
+            // may predate the current OAuth client (or a catalog change), and
+            // one unknown scope makes the whole authorize URL invalid — so
+            // sanitize before generating a URL, never after it fails.
+            const fullLogin = Effect.gen(function* () {
+                const { valid, dropped } = partitionOAuthScopes(c.scopes);
+                if (valid.length === 0) {
+                    return yield* Effect.fail(new AuthError({
+                        message: `The OAuth scopes stored for profile '${profileName}' are no longer offered by Alchemy's Cloudflare OAuth client. ` +
+                            `Scopes must be picked again. ${reconfigure}`,
+                    }));
+                }
+                const refreshed = yield* (dropped.length === 0
+                    ? Effect.void
+                    : interaction.output.warning(`Cloudflare: dropping ${dropped.length} stored scope${dropped.length === 1 ? "" : "s"} no longer offered by the current OAuth client (${dropped.join(", ")}). ` +
+                        `Scopes must be picked again. ${reconfigure}`)).pipe(Effect.andThen(oauthLogin(profileName, valid)));
+                return {
+                    ...c,
+                    scopes: valid,
+                    clientId: refreshed.clientId,
+                    access: Redacted.value(refreshed.access),
+                    refresh: Redacted.value(refreshed.refresh),
+                    expires: refreshed.expires,
+                };
+            });
+            // The silent refresh rotates a single-use refresh token, so
+            // its read-refresh-persist section runs under the profile
+            // lock — a concurrent `read` refreshing the same token would
+            // double-spend it. The lock is held only for this API
+            // round-trip, never across the browser wait below.
+            const outcome = creds.type === "oauth" &&
+                OAuthClient.usesCurrentClient(creds)
+                ? yield* withProfileCredentialsLock(profileName, interaction.output
+                    .info("Cloudflare: refreshing OAuth credentials...")
+                    .pipe(Effect.andThen(OAuthClient.refresh(creds)), Effect.flatMap((credentials) => {
+                    const config = {
+                        ...c,
+                        clientId: credentials.clientId,
+                        access: Redacted.value(credentials.access),
+                        refresh: Redacted.value(credentials.refresh),
+                        expires: credentials.expires,
+                        scopes: credentials.scopes,
+                    };
+                    return (updateConfig?.(config) ?? Effect.void).pipe(Effect.as({
+                        type: "refreshed",
+                        config,
+                    }));
+                }), Effect.tap(() => interaction.output.success("Cloudflare: OAuth credentials refreshed.")), Effect.catchTag("OAuthError", () => Effect.succeed({ type: "browser" }))))
+                : yield* Effect.gen(function* () {
+                    if (creds.type === "oauth") {
+                        yield* interaction.output.warning("Cloudflare: removed OAuth credentials issued to the previous client.");
+                    }
+                    return { type: "browser" };
+                });
+            if (outcome.type === "browser") {
+                return yield* fullLogin;
+            }
+            return outcome.config;
+        })
+        : configureOAuth(profileName, c)), Match.exhaustive)
+        .pipe(
+    // A blanket mapError must never swallow the NeedsReauth tag —
+    // the profile UI matches on it to render "needs re-login".
+    Effect.mapError((e) => e instanceof NeedsReauth
+        ? e
+        : new AuthError({ message: "login failed", cause: e })));
+    const details = (profileName, config, updateConfig) => Effect.all([
+        resolveCredentials(profileName, config, updateConfig),
+        Clock.currentTimeMillis,
+    ]).pipe(Effect.map(([creds, now]) => {
+        const source = {
+            key: "source",
+            value: "details" in creds.source && creds.source.details
+                ? `${creds.source.type} - ${creds.source.details}`
+                : creds.source.type,
+        };
+        return {
+            lines: Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => [
+                { key: "apiToken", value: displayRedacted(c.apiToken, 9) },
+                { key: "accountId", value: c.accountId },
+                source,
+            ]), Match.when({ type: "apiKey" }, (c) => [
+                { key: "apiKey", value: displayRedacted(c.apiKey) },
+                { key: "email", value: displayRedacted(c.email) },
+                { key: "accountId", value: c.accountId },
+                source,
+            ]), Match.when({ type: "oauth" }, (c) => {
+                const remainingMs = c.expires - now;
+                const expiresAt = new Date(c.expires).toISOString();
+                const expiresStr = remainingMs <= 0
+                    ? `expired (${expiresAt})`
+                    : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+                return [
+                    { key: "accessToken", value: displayRedacted(c.accessToken) },
+                    { key: "expires", value: expiresStr },
+                    { key: "accountId", value: c.accountId },
+                    source,
+                ];
+            }), Match.exhaustive),
+        };
     }));
+    /**
+     * Persist flag-provided stored credentials (`--method stored`). Writes
+     * the same `cloudflare-stored` file the interactive stored path writes;
+     * OAuth is interactive-only and not accepted here.
+     */
+    const configureWith = (profileName, input) => {
+        const persist = (config) => store
+            .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+            .pipe(Effect.ignore, Effect.as(config));
+        if (input.method !== "stored") {
+            return Effect.fail(new AuthError({
+                message: `Cloudflare: unknown method '${input.method}'. Valid methods: stored. (OAuth is interactive-only.)`,
+            }));
+        }
+        return validateFieldValues(CLOUDFLARE_AUTH_PROVIDER_NAME, storedFields, input.values).pipe(Effect.flatMap((values) => {
+            const accountId = (storedValueText(values.accountId) ?? "")
+                .trim()
+                .toLowerCase();
+            const apiToken = storedSecret(values.apiToken);
+            const apiKey = storedSecret(values.apiKey);
+            const email = storedValueText(values.email);
+            if (apiToken !== undefined &&
+                apiKey === undefined &&
+                email === undefined) {
+                return persist({
+                    method: "stored",
+                    credentialType: "apiToken",
+                    apiToken: Redacted.value(apiToken),
+                    accountId,
+                });
+            }
+            if (apiToken === undefined &&
+                apiKey !== undefined &&
+                email !== undefined) {
+                return persist({
+                    method: "stored",
+                    credentialType: "apiKey",
+                    apiKey: Redacted.value(apiKey),
+                    email,
+                    accountId,
+                });
+            }
+            return Effect.fail(new AuthError({
+                message: "Cloudflare: pass either --set apiToken=<token>, or both --set apiKey=<key> and --set email=<email>.",
+            }));
+        }));
+    };
     return {
+        configSchema: CloudflareAuthConfigSchema,
         configure: configureCredentials,
+        configureWith,
+        configureMethods,
         logout,
         login,
-        prettyPrint,
+        details,
         read: resolveCredentials,
+        readEnvironment,
+        environment: [
+            {
+                name: "CLOUDFLARE_ACCOUNT_ID",
+                required: true,
+                description: "Account the stack deploys into.",
+            },
+            {
+                name: "CLOUDFLARE_API_TOKEN",
+                required: true,
+                secret: true,
+                alternatives: ["CLOUDFLARE_API_KEY"],
+                description: "API token (preferred). Not consulted when unset and CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL are provided instead.",
+            },
+            {
+                name: "CLOUDFLARE_API_KEY",
+                required: false,
+                secret: true,
+                description: "Global API key; used with CLOUDFLARE_EMAIL when no API token is set.",
+            },
+            {
+                name: "CLOUDFLARE_EMAIL",
+                required: false,
+                alternatives: ["CLOUDFLARE_ACCOUNT_EMAIL"],
+                description: "Account email paired with CLOUDFLARE_API_KEY.",
+            },
+        ],
     };
 }));
-export const ALL_SCOPES = {
-    "access:read": "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-    "access:write": "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
-    "account:read": "See your account info such as account details, analytics, and memberships",
-    "agw:read": "Grants read level access to Agents Gateway",
-    "agw:run": "Grants run level access to Agents Gateway",
-    "agw:write": "Grants read and write level access to Agents Gateway",
-    "ai:read": "Grants read level access to Workers AI",
-    "ai:write": "Grants write level access to Workers AI",
-    "aiaudit:read": "Grants read level access to AI Audit",
-    "aiaudit:write": "Grants write level access to AI Audit",
-    "aig:read": "Grants read level access to AI Gateway",
-    "aig:write": "Grants write level access to AI Gateway",
-    "auditlogs:read": "View Cloudflare Account Audit Logs",
-    "browser:read": "Grants read level access to Browser Rendering",
-    "browser:write": "Grants write level access to Browser Rendering",
-    "cfone:read": "Grants read level access to Cloudforce One data",
-    "cfone:write": "Grants write level access to Cloudforce One data",
-    "cloudchamber:write": "See and make changes to Cloudchamber",
-    "connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
-    "connectivity:bind": "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
-    "connectivity:read": "See Connectivity Directory services and Cloudflare Tunnels",
-    "constellation:write": "Grants write access to Constellation configuration and models",
-    "containers:write": "See and make changes to Workers Containers",
-    "d1:write": "See and make changes to D1",
-    "dex:read": "Grants read level access to Cloudflare DEX",
-    "dex:write": "Grants write level access to Cloudflare DEX",
-    "dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
-    "dns_records:edit": "Grants edit level access to dns records",
-    "dns_records:read": "Grants read level access to dns records",
-    "dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
-    "firstpartytags:write": "Can see, edit and publish Google tag gateway configuration.",
-    "lb:edit": "Grants edit level access to lb and lb pools",
-    "lb:read": "Grants read level access to lb and lb pools",
-    "logpush:read": "See Cloudflare Logpush data",
-    "logpush:write": "See and change Cloudflare Logpush data",
-    "notification:read": "View Cloudflare Notifications",
-    "notification:write": "View and Modify Cloudflare Notifications",
-    "pages:read": "See Cloudflare Pages projects, settings and deployments",
-    "pages:write": "See and change Cloudflare Pages projects, settings and deployments",
-    "pipelines:read": "Grants read level access to Cloudflare Pipelines",
-    "pipelines:setup": "Grants permission to generate R2 tokens for Workers Pipelines",
-    "pipelines:write": "Grants write level access to Cloudflare Pipelines",
-    "query_cache:write": "See and make changes to Hyperdrive",
-    "queues:write": "See and change Cloudflare Queues settings and data",
-    "r2_catalog:write": "Grants write level access to R2 Data Catalog",
-    "radar:read": "Grants access to read Cloudflare Radar data",
-    "ai-search:read": "Grants read level access to AI Search",
-    "ai-search:write": "Grants write level access to AI Search",
-    "ai-search:run": "Grants run level access to AI Search",
-    "secrets_store:read": "Grants read level access to Secrets Store",
-    "secrets_store:write": "Grants write level access to Secrets Store",
-    "ssl_certs:write": "Grants read and write access to SSL MTLS certificates or Certificate Store",
-    "sso-connector:read": "See Cloudflare SSO connectors",
-    "sso-connector:write": "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
-    "teams:pii": "See personally identifiable Cloudflare Teams data",
-    "teams:read": "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-    "teams:secure_location": "See all DNS Location data but can only change secure DNS Locations",
-    "teams:write": "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
-    "url_scanner:read": "Grants read level access to URL Scanner",
-    "url_scanner:write": "Grants write level access to URL Scanner",
-    "user:read": "See your user info such as name, email address, and account memberships",
-    "vectorize:write": "See and make changes to Vectorize",
-    "workers:read": "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-    "workers:write": "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
-    "workers_builds:read": "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-    "workers_builds:write": "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
-    "workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
-    "workers_observability:read": "Grants read access to Cloudflare Workers Observability",
-    "workers_observability:write": "Grants read and write access to Cloudflare Workers Observability",
-    "workers_observability_telemetry:write": "Grants write access to Cloudflare Workers Observability Telemetry API",
-    "workers_routes:write": "See and change Cloudflare Workers data such as filters and routes",
-    "workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
-    "workers_tail:read": "See Cloudflare Workers tail and script data",
-    "zone:read": "Grants read level access to account zone",
-};
-export const DEFAULT_SCOPES = [
-    "account:read",
-    "ai-search:write",
-    "ai-search:run",
-    "ai:write",
-    "aig:read",
-    "aig:write",
-    "cloudchamber:write",
-    "connectivity:admin",
-    "containers:write",
-    "d1:write",
-    "pages:write",
-    "pipelines:write",
-    "queues:write",
-    "secrets_store:write",
-    "ssl_certs:write",
-    "user:read",
-    "vectorize:write",
-    "workers_kv:write",
-    "workers_observability:read",
-    "workers_observability:write",
-    "workers_observability_telemetry:write",
-    "workers_routes:write",
-    "workers_scripts:write",
-    "workers_tail:read",
-    "workers:write",
-    "zone:read",
-];
-export const OAUTH_CLIENT_ID = "6d8c2255-0773-45f6-b376-2914632e6f91";
-export const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
-export const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
-export const OAUTH_ENDPOINTS = {
-    authorize: "https://dash.cloudflare.com/oauth2/authorize",
-    token: "https://dash.cloudflare.com/oauth2/token",
-    revoke: "https://dash.cloudflare.com/oauth2/revoke",
-};
 //# sourceMappingURL=AuthProvider.js.map