wrangler 0.0.0-e30d1013 → 0.0.0-e311bbbf

package/src/type-generation.ts

@@ -15,7 +15,7 @@ export async function generateTypes(
 
 	if (configToDTS.kv_namespaces) {
 		for (const kvNamespace of configToDTS.kv_namespaces) {
-			envTypeStructure.push(`	${kvNamespace.binding}: KVNamespace;`);
+			envTypeStructure.push(`${kvNamespace.binding}: KVNamespace;`);
 		}
 	}
 
@@ -27,70 +27,78 @@ export async function generateTypes(
 				typeof varValue === "number" ||
 				typeof varValue === "boolean"
 			) {
-				envTypeStructure.push(`	${varName}: "${varValue}";`);
+				envTypeStructure.push(`${varName}: "${varValue}";`);
 			}
 			if (typeof varValue === "object" && varValue !== null) {
-				envTypeStructure.push(`	${varName}: ${JSON.stringify(varValue)};`);
+				envTypeStructure.push(`${varName}: ${JSON.stringify(varValue)};`);
 			}
 		}
 	}
 
 	if (configToDTS.durable_objects?.bindings) {
 		for (const durableObject of configToDTS.durable_objects.bindings) {
-			envTypeStructure.push(`	${durableObject.name}: DurableObjectNamespace;`);
+			envTypeStructure.push(`${durableObject.name}: DurableObjectNamespace;`);
 		}
 	}
 
 	if (configToDTS.r2_buckets) {
 		for (const R2Bucket of configToDTS.r2_buckets) {
-			envTypeStructure.push(`	${R2Bucket.binding}: R2Bucket;`);
+			envTypeStructure.push(`${R2Bucket.binding}: R2Bucket;`);
 		}
 	}
 
 	if (configToDTS.d1_databases) {
 		for (const d1 of configToDTS.d1_databases) {
-			envTypeStructure.push(`	${d1.binding}: D1Database;`);
+			envTypeStructure.push(`${d1.binding}: D1Database;`);
 		}
 	}
 
 	if (configToDTS.services) {
 		for (const service of configToDTS.services) {
-			envTypeStructure.push(`	${service.binding}: Fetcher;`);
+			envTypeStructure.push(`${service.binding}: Fetcher;`);
+		}
+	}
+
+	if (configToDTS.analytics_engine_datasets) {
+		for (const analyticsEngine of configToDTS.analytics_engine_datasets) {
+			envTypeStructure.push(
+				`${analyticsEngine.binding}: AnalyticsEngineDataset;`
+			);
 		}
 	}
 
 	if (configToDTS.dispatch_namespaces) {
 		for (const namespace of configToDTS.dispatch_namespaces) {
-			envTypeStructure.push(`	${namespace.binding}: any;`);
+			envTypeStructure.push(`${namespace.binding}: any;`);
 		}
 	}
 
 	if (configToDTS.logfwdr?.schema) {
-		envTypeStructure.push(`	LOGFWDR_SCHEMA: any;`);
+		envTypeStructure.push(`LOGFWDR_SCHEMA: any;`);
 	}
 
 	if (configToDTS.data_blobs) {
 		for (const dataBlobs in configToDTS.data_blobs) {
-			envTypeStructure.push(`	${dataBlobs}: ArrayBuffer;`);
+			envTypeStructure.push(`${dataBlobs}: ArrayBuffer;`);
 		}
 	}
 
 	if (configToDTS.text_blobs) {
 		for (const textBlobs in configToDTS.text_blobs) {
-			envTypeStructure.push(`	${textBlobs}: string;`);
+			envTypeStructure.push(`${textBlobs}: string;`);
 		}
 	}
 
-	if (configToDTS.unsafe) {
+	if (configToDTS.unsafe?.bindings) {
 		for (const unsafe of configToDTS.unsafe.bindings) {
-			envTypeStructure.push(`	${unsafe.name}: any;`);
+			envTypeStructure.push(`${unsafe.name}: any;`);
 		}
 	}
 
 	if (configToDTS.queues) {
 		if (configToDTS.queues.producers) {
 			for (const queue of configToDTS.queues.producers) {
-				envTypeStructure.push(`	${queue.binding}: Queue;`);
+				envTypeStructure.push(`${queue.binding}: Queue;`);
 			}
 		}
 	}
@@ -154,13 +162,13 @@ function writeDTSFile({
 
 	let combinedTypeStrings = "";
 	if (formatType === "modules") {
-		combinedTypeStrings += `interface Env {\n${envTypeStructure.join(
-			"\n"
-		)} \n}\n${modulesTypeStructure.join("\n")}`;
+		combinedTypeStrings += `interface Env {\n${envTypeStructure
+			.map((value) => `\t${value}`)
+			.join("\n")}\n}\n${modulesTypeStructure.join("\n")}`;
 	} else {
-		combinedTypeStrings += `declare global {\n${envTypeStructure.join(
-			"\n"
-		)} \n}\n${modulesTypeStructure.join("\n")}`;
+		combinedTypeStrings += `export {};\ndeclare global {\n${envTypeStructure
+			.map((value) => `\tconst ${value}`)
+			.join("\n")}\n}\n${modulesTypeStructure.join("\n")}`;
 	}
 
 	if (envTypeStructure.length || modulesTypeStructure.length) {

package/src/user/access.ts

@@ -21,7 +21,6 @@ export async function domainUsesAccess(domain: string): Promise<boolean> {
 	try {
 		const controller = new AbortController();
 		const cancel = setTimeout(() => {
-			logger.debug("Timed out");
 			controller.abort();
 		}, 1000);
 

package/src/user/auth-variables.ts

@@ -0,0 +1,113 @@
+import { getEnvironmentVariableFactory } from "../environment-variables/factory";
+import { getCloudflareApiEnvironmentFromEnv } from "../environment-variables/misc-variables";
+import { getAccessToken } from "./access";
+
+/**
+ * `CLOUDFLARE_ACCOUNT_ID` overrides the account inferred from the current user.
+ */
+export const getCloudflareAccountIdFromEnv = getEnvironmentVariableFactory({
+	variableName: "CLOUDFLARE_ACCOUNT_ID",
+	deprecatedName: "CF_ACCOUNT_ID",
+});
+
+export const getCloudflareAPITokenFromEnv = getEnvironmentVariableFactory({
+	variableName: "CLOUDFLARE_API_TOKEN",
+	deprecatedName: "CF_API_TOKEN",
+});
+export const getCloudflareGlobalAuthKeyFromEnv = getEnvironmentVariableFactory({
+	variableName: "CLOUDFLARE_API_KEY",
+	deprecatedName: "CF_API_KEY",
+});
+export const getCloudflareGlobalAuthEmailFromEnv =
+	getEnvironmentVariableFactory({
+		variableName: "CLOUDFLARE_EMAIL",
+		deprecatedName: "CF_EMAIL",
+	});
+
+/**
+ * `WRANGLER_CLIENT_ID` is a UUID that is used to identify Wrangler
+ * to the Cloudflare APIs.
+ *
+ * Normally you should not need to set this explicitly.
+ * If you want to switch to the staging environment set the
+ * `WRANGLER_USE_STAGING` environment variable instead.
+ */
+export const getClientIdFromEnv = getEnvironmentVariableFactory({
+	variableName: "WRANGLER_CLIENT_ID",
+	defaultValue: () =>
+		getCloudflareApiEnvironmentFromEnv() === "staging"
+			? "4b2ea6cc-9421-4761-874b-ce550e0e3def"
+			: "54d11594-84e4-41aa-b438-e81b8fa78ee7",
+});
+
+/**
+ * `WRANGLER_AUTH_DOMAIN` is the URL base domain that is used
+ * to access OAuth URLs for the Cloudflare APIs.
+ *
+ * Normally you should not need to set this explicitly.
+ * If you want to switch to the staging environment set the
+ * `WRANGLER_USE_STAGING` environment variable instead.
+ */
+export const getAuthDomainFromEnv = getEnvironmentVariableFactory({
+	variableName: "WRANGLER_AUTH_DOMAIN",
+	defaultValue: () =>
+		getCloudflareApiEnvironmentFromEnv() === "staging"
+			? "dash.staging.cloudflare.com"
+			: "dash.cloudflare.com",
+});
+
+/**
+ * `WRANGLER_AUTH_URL` is the path that is used to access OAuth
+ * for the Cloudflare APIs.
+ *
+ * Normally you should not need to set this explicitly.
+ * If you want to switch to the staging environment set the
+ * `WRANGLER_USE_STAGING` environment variable instead.
+ */
+export const getAuthUrlFromEnv = getEnvironmentVariableFactory({
+	variableName: "WRANGLER_AUTH_URL",
+	defaultValue: () => `https://${getAuthDomainFromEnv()}/oauth2/auth`,
+});
+
+/**
+ * `WRANGLER_TOKEN_URL` is the path that is used to exchange an OAuth
+ * token for an API token.
+ *
+ * Normally you should not need to set this explicitly.
+ * If you want to switch to the staging environment set the
+ * `WRANGLER_USE_STAGING` environment variable instead.
+ */
+export const getTokenUrlFromEnv = getEnvironmentVariableFactory({
+	variableName: "WRANGLER_TOKEN_URL",
+	defaultValue: () => `https://${getAuthDomainFromEnv()}/oauth2/token`,
+});
+
+/**
+ * `WRANGLER_REVOKE_URL` is the path that is used to exchange an OAuth
+ * refresh token for a new OAuth token.
+ *
+ * Normally you should not need to set this explicitly.
+ * If you want to switch to the staging environment set the
+ * `WRANGLER_USE_STAGING` environment variable instead.
+ */
+export const getRevokeUrlFromEnv = getEnvironmentVariableFactory({
+	variableName: "WRANGLER_REVOKE_URL",
+	defaultValue: () => `https://${getAuthDomainFromEnv()}/oauth2/revoke`,
+});
+
+/**
+ * Set the `WRANGLER_CF_AUTHORIZATION_TOKEN` to the CF_Authorization token found at https://dash.staging.cloudflare.com/bypass-limits
+ * if you want to access the staging environment, triggered by `WRANGLER_API_ENVIRONMENT=staging`.
+ */
+export const getCloudflareAccessToken = async () => {
+	const env = getEnvironmentVariableFactory({
+		variableName: "WRANGLER_CF_AUTHORIZATION_TOKEN",
+	})();
+
+	// If the environment variable is defined, go ahead and use it.
+	if (env !== undefined) {
+		return env;
+	}
+
+	return getAccessToken(getAuthDomainFromEnv());
+};

package/src/user/choose-account.tsx

@@ -1,41 +1,11 @@
-import { Text } from "ink";
-import SelectInput from "ink-select-input";
-import React from "react";
 import { fetchListResult } from "../cfetch";
-import { logger } from "../logger";
-import { getCloudflareAccountIdFromEnv } from "./env-vars";
+import { getCloudflareAccountIdFromEnv } from "./auth-variables";
 
 export type ChooseAccountItem = {
 	id: string;
 	name: string;
 };
 
-/**
- * A component that allows the user to select from a list of available accounts.
- */
-export function ChooseAccount(props: {
-	accounts: ChooseAccountItem[];
-	onSelect: (account: { name: string; id: string }) => void;
-	onError: (error: Error) => void;
-}) {
-	return (
-		<>
-			<Text bold>Select an account from below:</Text>
-			<SelectInput
-				items={props.accounts.map((item) => ({
-					key: item.id,
-					label: item.name,
-					value: item,
-				}))}
-				onSelect={(item) => {
-					logger.log(`Using account: "${item.value.name} - ${item.value.id}"`);
-					props.onSelect({ id: item.value.id, name: item.value.name });
-				}}
-			/>
-		</>
-	);
-}
-
 /**
  * Infer a list of available accounts for the current user.
  */

package/src/user/index.ts

@@ -1,3 +1,2 @@
 export * from "./user";
-export * from "./env-vars";
 export * from "./choose-account";

package/src/user/{user.tsx → user.ts}

@@ -214,28 +214,61 @@ import url from "node:url";
 import { TextEncoder } from "node:util";
 import TOML from "@iarna/toml";
 import { HostURL } from "@webcontainer/env";
-import { render } from "ink";
-import Table from "ink-table";
-import React from "react";
 import { fetch } from "undici";
 import {
 	getConfigCache,
 	purgeConfigCaches,
 	saveToConfigCache,
 } from "../config-cache";
+import { NoDefaultValueProvided, select } from "../dialogs";
 import { getGlobalWranglerConfigPath } from "../global-wrangler-config-path";
 import { CI } from "../is-ci";
 import isInteractive from "../is-interactive";
 import { logger } from "../logger";
 import openInBrowser from "../open-in-browser";
 import { parseTOML, readFileSync } from "../parse";
-import { ChooseAccount, getAccountChoices } from "./choose-account";
-import { getAuthFromEnv } from "./env-vars";
+import { domainUsesAccess } from "./access";
+import {
+	getAuthDomainFromEnv,
+	getAuthUrlFromEnv,
+	getClientIdFromEnv,
+	getCloudflareAccessToken,
+	getCloudflareAPITokenFromEnv,
+	getCloudflareGlobalAuthEmailFromEnv,
+	getCloudflareGlobalAuthKeyFromEnv,
+	getRevokeUrlFromEnv,
+	getTokenUrlFromEnv,
+} from "./auth-variables";
+import { getAccountChoices } from "./choose-account";
 import { generateAuthUrl } from "./generate-auth-url";
 import { generateRandomState } from "./generate-random-state";
-import type { ApiCredentials } from "./env-vars";
+import type { ChooseAccountItem } from "./choose-account";
 import type { ParsedUrlQuery } from "node:querystring";
 
+export type ApiCredentials =
+	| {
+			apiToken: string;
+	  }
+	| {
+			authKey: string;
+			authEmail: string;
+	  };
+
+/**
+ * Try to read an API token or Global Auth from the environment.
+ */
+export function getAuthFromEnv(): ApiCredentials | undefined {
+	const globalApiKey = getCloudflareGlobalAuthKeyFromEnv();
+	const globalApiEmail = getCloudflareGlobalAuthEmailFromEnv();
+	const apiToken = getCloudflareAPITokenFromEnv();
+
+	if (globalApiKey && globalApiEmail) {
+		return { authKey: globalApiKey, authEmail: globalApiEmail };
+	} else if (apiToken) {
+		return { apiToken };
+	}
+}
+
 /**
  * An implementation of rfc6749#section-4.1 and rfc7636.
  */
@@ -264,7 +297,7 @@ interface AuthTokens {
 	accessToken?: AccessToken;
 	refreshToken?: RefreshToken;
 	scopes?: Scope[];
-	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+	/** @deprecated - this field was only provided by the deprecated v1 `wrangler config` command. */
 	apiToken?: string;
 }
 
@@ -282,7 +315,7 @@ export interface UserAuthConfig {
 	refresh_token?: string;
 	expiration_time?: string;
 	scopes?: string[];
-	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+	/** @deprecated - this field was only provided by the deprecated v1 `wrangler config` command. */
 	api_token?: string;
 }
 
@@ -313,6 +346,7 @@ const Scopes = {
 	"pages:write":
 		"See and change Cloudflare Pages projects, settings and deployments.",
 	"zone:read": "Grants read level access to account zone.",
+	"ssl_certs:write": "See and manage mTLS certificates for your account",
 } as const;
 
 /**
@@ -330,11 +364,6 @@ export function validateScopeKeys(
 	return scopes.every((scope) => scope in Scopes);
 }
 
-const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
-const AUTH_URL = "https://dash.cloudflare.com/oauth2/auth";
-const TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
-const REVOKE_URL = "https://dash.cloudflare.com/oauth2/revoke";
-
 /**
  * To allow OAuth callbacks in environments such as WebContainer we need to
  * create a host URL which only resolves `localhost` to a WebContainer
@@ -374,7 +403,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 			};
 		} else if (api_token) {
 			logger.warn(
-				"It looks like you have used Wrangler 1's `config` command to login with an API token.\n" +
+				"It looks like you have used Wrangler v1's `config` command to login with an API token.\n" +
 					"This is no longer supported in the current version of Wrangler.\n" +
 					"If you wish to authenticate via an API token then please set the `CLOUDFLARE_API_TOKEN` environment variable."
 			);
@@ -386,7 +415,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 }
 
 /**
- * Run the initialisation of the auth state, in the case that something changed.
+ * Run the initialization of the auth state, in the case that something changed.
  *
  * This runs automatically whenever `writeAuthConfigFile` is run, so generally
  * you won't need to call it yourself.
@@ -625,8 +654,8 @@ export async function getAuthURL(scopes = ScopeKeys): Promise<string> {
 	});
 
 	return generateAuthUrl({
-		authUrl: AUTH_URL,
-		clientId: CLIENT_ID,
+		authUrl: getAuthUrlFromEnv(),
+		clientId: getClientIdFromEnv(),
 		callbackUrl: CALLBACK_URL,
 		scopes,
 		stateQueryParam,
@@ -653,19 +682,14 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
 		logger.warn("No refresh token is present.");
 	}
 
-	const body =
-		`grant_type=refresh_token&` +
-		`refresh_token=${LocalState.refreshToken?.value}&` +
-		`client_id=${CLIENT_ID}`;
-
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		body,
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-		},
+	const params = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: LocalState.refreshToken?.value ?? "",
+		client_id: getClientIdFromEnv(),
 	});
 
+	const response = await fetchAuthToken(params);
+
 	if (response.status >= 400) {
 		let tokenExchangeResErr = undefined;
 
@@ -743,20 +767,15 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
 		logger.warn("No authorization grant code is being passed.");
 	}
 
-	const body =
-		`grant_type=authorization_code&` +
-		`code=${encodeURIComponent(authorizationCode || "")}&` +
-		`redirect_uri=${encodeURIComponent(CALLBACK_URL)}&` +
-		`client_id=${encodeURIComponent(CLIENT_ID)}&` +
-		`code_verifier=${codeVerifier}`;
-
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		body,
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-		},
+	const params = new URLSearchParams({
+		grant_type: `authorization_code`,
+		code: authorizationCode ?? "",
+		redirect_uri: CALLBACK_URL,
+		client_id: getClientIdFromEnv(),
+		code_verifier: codeVerifier,
 	});
+
+	const response = await fetchAuthToken(params);
 	if (!response.ok) {
 		const { error } = (await response.json()) as { error: string };
 		// .catch((_) => ({ error: "invalid_json" }));
@@ -875,6 +894,7 @@ export function readAuthConfigFile(): UserAuthConfig {
 
 type LoginProps = {
 	scopes?: Scope[];
+	browser: boolean;
 };
 
 export async function loginOrRefreshIfRequired(): Promise<boolean> {
@@ -901,7 +921,9 @@ export async function loginOrRefreshIfRequired(): Promise<boolean> {
 	}
 }
 
-export async function login(props?: LoginProps): Promise<boolean> {
+export async function login(
+	props: LoginProps = { browser: true }
+): Promise<boolean> {
 	logger.log("Attempting to login via OAuth...");
 	const urlToOpen = await getAuthURL(props?.scopes);
 	let server: http.Server;
@@ -914,7 +936,7 @@ export async function login(props?: LoginProps): Promise<boolean> {
 			server.close();
 			clearTimeout(loginTimeoutHandle);
 			resolve(false);
-		}, 60000); // wait for 60 seconds for the user to authorize
+		}, 120000); // wait for 120 seconds for the user to authorize
 	});
 
 	const loginPromise = new Promise<boolean>((resolve, reject) => {
@@ -986,9 +1008,12 @@ export async function login(props?: LoginProps): Promise<boolean> {
 
 		server.listen(8976);
 	});
-
-	logger.log(`Opening a link in your default browser: ${urlToOpen}`);
-	await openInBrowser(urlToOpen);
+	if (props?.browser) {
+		logger.log(`Opening a link in your default browser: ${urlToOpen}`);
+		await openInBrowser(urlToOpen);
+	} else {
+		logger.log(`Visit this link to authenticate: ${urlToOpen}`);
+	}
 
 	return Promise.race([timerPromise, loginPromise]);
 }
@@ -1032,11 +1057,11 @@ export async function logout(): Promise<void> {
 		}
 
 		const body =
-			`client_id=${encodeURIComponent(CLIENT_ID)}&` +
+			`client_id=${encodeURIComponent(getClientIdFromEnv())}&` +
 			`token_type_hint=refresh_token&` +
 			`token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
-		const response = await fetch(REVOKE_URL, {
+		const response = await fetch(getRevokeUrlFromEnv(), {
 			method: "POST",
 			body,
 			headers: {
@@ -1049,11 +1074,11 @@ export async function logout(): Promise<void> {
 		);
 	}
 	const body =
-		`client_id=${encodeURIComponent(CLIENT_ID)}&` +
+		`client_id=${encodeURIComponent(getClientIdFromEnv())}&` +
 		`token_type_hint=refresh_token&` +
 		`token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
-	const response = await fetch(REVOKE_URL, {
+	const response = await fetch(getRevokeUrlFromEnv(), {
 		method: "POST",
 		body,
 		headers: {
@@ -1071,8 +1096,7 @@ export function listScopes(message = "💁 Available scopes:"): void {
 		Scope: scope,
 		Description: Scopes[scope],
 	}));
-	const { unmount } = render(<Table data={data} />);
-	unmount();
+	logger.table(data);
 	// TODO: maybe a good idea to show usage here
 }
 
@@ -1091,36 +1115,32 @@ export async function getAccountId(): Promise<string | undefined> {
 		return accounts[0].id;
 	}
 
-	if (isInteractive() && !CI.isCI()) {
-		const account = await new Promise<{ id: string; name: string }>(
-			(resolve, reject) => {
-				const { unmount } = render(
-					<ChooseAccount
-						accounts={accounts}
-						onSelect={async (selected) => {
-							saveAccountToCache(selected);
-							resolve(selected);
-							unmount();
-						}}
-						onError={(err) => {
-							reject(err);
-							unmount();
-						}}
-					/>
-				);
-			}
-		);
-		return account.id;
+	try {
+		const accountID = await select("Select an account", {
+			choices: accounts.map((account) => ({
+				title: account.name,
+				value: account.id,
+			})),
+		});
+		const account = accounts.find(
+			(a) => a.id === accountID
+		) as ChooseAccountItem;
+		saveAccountToCache({ id: account.id, name: account.name });
+		return accountID;
+	} catch (e) {
+		// Did we try to select an account in CI or a non-interactive terminal?
+		if (e instanceof NoDefaultValueProvided) {
+			throw new Error(
+				`More than one account available but unable to select one in non-interactive mode.
+Please set the appropriate \`account_id\` in your \`wrangler.toml\` file.
+Available accounts are (\`<name>\`: \`<account_id>\`):
+${accounts
+	.map((account) => `  \`${account.name}\`: \`${account.id}\``)
+	.join("\n")}`
+			);
+		}
+		throw e;
 	}
-
-	throw new Error(
-		"More than one account available but unable to select one in non-interactive mode.\n" +
-			`Please set the appropriate \`account_id\` in your \`wrangler.toml\` file.\n` +
-			`Available accounts are ("<name>" - "<id>"):\n` +
-			accounts
-				.map((account) => `  "${account.name}" - "${account.id}")`)
-				.join("\n")
-	);
 }
 
 /**
@@ -1133,7 +1153,7 @@ export async function requireAuth(config: {
 	if (!loggedIn) {
 		if (!isInteractive() || CI.isCI()) {
 			throw new Error(
-				"In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work. Please go to https://developers.cloudflare.com/api/tokens/create/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN."
+				"In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN."
 			);
 		} else {
 			// didn't login, let's just quit
@@ -1190,3 +1210,24 @@ export function getAccountFromCache():
 export function getScopes(): Scope[] | undefined {
 	return LocalState.scopes;
 }
+
+/**
+ * Make a request to the Cloudflare OAuth endpoint to get a token.
+ *
+ * Note that the `body` of the POST request is form-urlencoded so
+ * can be represented by a URLSearchParams object.
+ */
+async function fetchAuthToken(body: URLSearchParams) {
+	const headers: Record<string, string> = {
+		"Content-Type": "application/x-www-form-urlencoded",
+	};
+	if (await domainUsesAccess(getAuthDomainFromEnv())) {
+		// We are trying to access the staging API so we need an "access token".
+		headers["Cookie"] = `CF_Authorization=${await getCloudflareAccessToken()}`;
+	}
+	return await fetch(getTokenUrlFromEnv(), {
+		method: "POST",
+		body: body.toString(),
+		headers,
+	});
+}