clover's git

the-knife

1	/** Scopes enabled on Alchemy's public Cloudflare OAuth client. */
2	export const OAUTH_SCOPE_GROUPS = [
3	{
4	id: "developer-platform",
5	label: "Developer Platform",
6	scopes: [
7	"agent-memory.write",
8	"browser-rendering.read",
9	"browser-rendering.write",
10	"cf-agents.read",
11	"cf-agents.write",
12	"cloud-connector.read",
13	"cloud-connector.write",
14	"cloudchamber.read",
15	"cloudchamber.write",
16	"constellation.read",
17	"constellation.write",
18	"d1.read",
19	"d1.write",
20	"flagship.evaluate",
21	"flagship.read",
22	"flagship.write",
23	"query-cache.read",
24	"query-cache.write",
25	"mcp-portals.read",
26	"mcp-portals.write",
27	"messaging.edit",
28	"messaging.read",
29	"page.read",
30	"page.write",
31	"pipelines.read",
32	"pipelines.send",
33	"pipelines.write",
34	"pubsub.read",
35	"pubsub.write",
36	"queues.read",
37	"queues.write",
38	"realtime.admin",
39	"realtime.read",
40	"realtime.write",
41	"secrets-store.read",
42	"secrets-store.write",
43	"vectorize.read",
44	"vectorize.write",
45	"workers-ci.read",
46	"workers-ci.write",
47	"containers.read",
48	"containers.write",
49	"workers-scripts.edit",
50	"workers-kv-storage.read",
51	"workers-kv-storage.write",
52	"workers-observability.read",
53	"workers-observability-telemetry.write",
54	"workers-observability.write",
55	"r2-catalog.read",
56	"r2-catalog.write",
57	"r2-catalog-sql.read",
58	"workers-r2-bucket-item.read",
59	"workers-r2-bucket-item.write",
60	"workers-r2.read",
61	"workers-r2.write",
62	"workers-routes.read",
63	"workers-routes.write",
64	"workers-scripts.bind",
65	"workers-scripts.read",
66	"workers-scripts.write",
67	"workers-tail.read",
68	],
69	},
70	{
71	id: "ai-machine-learning",
72	label: "AI & Machine Learning",
73	scopes: [
74	"aiaudit.read",
75	"aiaudit.write",
76	"aig.read",
77	"aig.run",
78	"aig.write",
79	"ai-search.index",
80	"ai-search.read",
81	"ai-search.run",
82	"ai-search.write",
83	"agw.read",
84	"agw.run",
85	"agw.write",
86	"rag.read",
87	"rag.run",
88	"rag.write",
89	"firewall-for-ai.read",
90	"firewall-for-ai.write",
91	"websearch.read",
92	"websearch.run",
93	"websearch.write",
94	"ai.read",
95	"ai.write",
96	],
97	},
98	{
99	id: "dns-zones",
100	label: "DNS & Zones",
101	scopes: [
102	"account-dns-settings.read",
103	"account-dns-settings.write",
104	"dns-firewall.read",
105	"dns-firewall.write",
106	"dns.read",
107	"dns-view.read",
108	"dns-view.write",
109	"dns.write",
110	"registrar-domains.admin",
111	"registrar-domains.read",
112	"registrar-sandbox-domains.admin",
113	"registrar-sandbox-domains.read",
114	"zone-custom-asset.read",
115	"zone-custom-asset.write",
116	"zone-dns-settings.read",
117	"zone-dns-settings.write",
118	"zone.read",
119	"zone-settings.read",
120	"zone-settings.write",
121	"zone-versioning.read",
122	"zone-versioning.write",
123	"zone.write",
124	],
125	},
126	{
127	id: "app-security",
128	label: "App Security",
129	scopes: [
130	"fraud-detection-pii.read",
131	"account-firewall-access-rules.read",
132	"account-firewall-access-rules.write",
133	"account-security-center-insights.read",
134	"account-security-center-insights.write",
135	"account-waf.read",
136	"account-waf.write",
137	"request-tracer.read",
138	"reports-application-security-report.read",
139	"bot-management-feedback.read",
140	"bot-management-feedback.write",
141	"bot-management.read",
142	"bot-management.write",
143	"cloudforce-one.read",
144	"cloudforce-one.write",
145	"ddos-botnet-feed.read",
146	"ddos-botnet-feed.write",
147	"ddos-protection.read",
148	"ddos-protection.write",
149	"api-gateway.read",
150	"api-gateway.write",
151	"domain-page.shield",
152	"domain-page-shield.read",
153	"field-extractor.read",
154	"field-extractor.write",
155	"firewall-services.read",
156	"firewall-services.write",
157	"fraud-detection.read",
158	"fraud-detection.write",
159	"fraud-events.write",
160	"fraud-feedback.read",
161	"fraud-feedback.write",
162	"http-applications.read",
163	"http-applications.write",
164	"http-ddos-managed-ruleset.read",
165	"http-ddos-managed-ruleset.write",
166	"iot.read",
167	"iot.write",
168	"l4-ddos-managed-ruleset.read",
169	"l4-ddos-managed-ruleset.write",
170	"page-rules.read",
171	"page-rules.write",
172	"page.shield",
173	"page-shield.read",
174	"precursor.read",
175	"precursor.write",
176	"sanitize.read",
177	"sanitize.write",
178	"tag.read",
179	"tag.write",
180	"trust-and-safety.read",
181	"trust-and-safety.write",
182	"challenge-widgets.read",
183	"challenge-widgets.write",
184	"url-scanner.read",
185	"url-scanner.write",
186	"zaraz.edit",
187	"zaraz.read",
188	"zaraz.write",
189	"zone-security-center-insights.read",
190	"zone-security-center-insights.write",
191	"zone-waf.read",
192	"zone-waf.write",
193	],
194	},
195	{
196	id: "rules-configuration",
197	label: "Rules & Configuration",
198	scopes: [
199	"account-custom-error-rules.read",
200	"account-custom-error-rules.write",
201	"account-custom-pages.read",
202	"account-custom-pages.write",
203	"account-rule-lists.read",
204	"account-rule-lists.write",
205	"account-rulesets.read",
206	"account-rulesets.write",
207	"config-settings.read",
208	"config-settings.write",
209	"custom-errors.read",
210	"custom-errors.write",
211	"custom-pages.read",
212	"custom-pages.write",
213	"dynamic-redirect.read",
214	"dynamic-redirect.write",
215	"managed-headers.read",
216	"managed-headers.write",
217	"mass-url-redirects.read",
218	"mass-url-redirects.write",
219	"origin.read",
220	"origin.write",
221	"payments-gateway.read",
222	"payments-gateway.write",
223	"response-compression.read",
224	"response-compression.write",
225	"select-configuration.read",
226	"select-configuration.write",
227	"snippets.read",
228	"snippets.write",
229	"transform-rules.read",
230	"transform-rules.write",
231	"zone-transform-rules.read",
232	"zone-transform-rules.write",
233	],
234	},
235	{
236	id: "zero-trust",
237	label: "Cloudflare One / Zero Trust",
238	scopes: [
239	"access-app.read",
240	"access-app.revoke",
241	"access-app.write",
242	"access.read",
243	"zone-access.read",
244	"access.revoke",
245	"zone-access.revoke",
246	"access.write",
247	"zone-access.write",
248	"access-audit-log.read",
249	"access-custom-page.read",
250	"access-custom-page.write",
251	"access-device-posture.read",
252	"access-device-posture.write",
253	"access-group.read",
254	"access-group.write",
255	"access-idp.read",
256	"access-idp.write",
257	"access-key.read",
258	"access-key.write",
259	"access-certificate.read",
260	"access-certificate.write",
261	"access-org.read",
262	"access-org.revoke",
263	"access-org.write",
264	"access-acct.read",
265	"access-acct.revoke",
266	"access-acct.write",
267	"access-policy.read",
268	"access-policy.write",
269	"access-policy-test.read",
270	"access-policy-test.write",
271	"access-population.read",
272	"access-population.write",
273	"access-saml-certificate.read",
274	"access-saml-certificate.write",
275	"access-scim-log.read",
276	"access-ssh-auditing.read",
277	"access-ssh-auditing.write",
278	"access-service-token.read",
279	"access-service-token.write",
280	"access-tag.read",
281	"access-tag.write",
282	"access-users.read",
283	"access-users.write",
284	"casb.read",
285	"casb.write",
286	"teams-cds-compute-account.read",
287	"teams-cds-compute-account.write",
288	"teams-dex.read",
289	"teams-dex.write",
290	"teams-connector-cloudflared.monitoring",
291	"teams-connector-warp.read",
292	"teams-connector-warp.write",
293	"teams-connector-cloudflared.read",
294	"teams-connector-cloudflared.write",
295	"teams-connectors.read",
296	"teams-connectors.write",
297	"teams-networks.read",
298	"teams-networks.write",
299	"argotunnel.read",
300	"argotunnel.write",
301	"teams-secure.location",
302	"dls.read",
303	"dls.write",
304	"teams.read",
305	"teams.report",
306	"teams-resilience.read",
307	"teams-resilience.write",
308	"teams.write",
309	"teams-pii.read",
310	"access-seats.write",
311	],
312	},
313	{
314	id: "analytics-logs",
315	label: "Analytics & Logs",
316	scopes: [
317	"account-analytics.read",
318	"analytics.read",
319	"intel.read",
320	"intel.write",
321	"account-logs.read",
322	"account-logs.write",
323	"logs.read",
324	"logs.write",
325	"radar.read",
326	],
327	},
328	{
329	id: "network-services",
330	label: "Network Services",
331	scopes: [
332	"account-waiting-rooms.read",
333	"address-maps.read",
334	"address-maps.write",
335	"chinanetwork-steering.read",
336	"chinanetwork-steering.write",
337	"connectivity-directory.admin",
338	"connectivity-directory.bind",
339	"connectivity-directory.read",
340	"healthcheck.read",
341	"healthcheck.write",
342	"ip-prefix-bgp-on-demand.read",
343	"ip-prefix-bgp-on-demand.write",
344	"ip-prefix.read",
345	"ip-prefix.write",
346	"load-balancers-account.read",
347	"load-balancers-account.write",
348	"load-balancers.read",
349	"load-balancers.write",
350	"load-balancing-monitors-and-pools.read",
351	"load-balancing-monitors-and-pools.write",
352	"pcaps-api.read",
353	"pcaps-api.write",
354	"magic-firewall.read",
355	"magic-firewall.write",
356	"fbm.admin",
357	"fbm.read",
358	"fbm.write",
359	"magic-transit.read",
360	"magic-transit.write",
361	"magic-wan.read",
362	"magic-wan.write",
363	"waiting-rooms.read",
364	"waiting-rooms.write",
365	"web3-hostnames.read",
366	"web3-hostnames.write",
367	],
368	},
369	{
370	id: "media",
371	label: "Media",
372	scopes: [
373	"calls.read",
374	"calls.write",
375	"images.read",
376	"images.write",
377	"moq.read",
378	"moq.write",
379	"stream.read",
380	"stream.write",
381	],
382	},
383	{
384	id: "email-messaging",
385	label: "Email & Messaging",
386	scopes: [
387	"cloud-email-security.read",
388	"cloud-email-security.write",
389	"email-routing-account-rule.read",
390	"email-routing-address.read",
391	"email-routing-address.write",
392	"email-routing-rule.read",
393	"email-routing-rule.write",
394	"email-routing-suppression.read",
395	"email-routing-suppression.write",
396	"email-security-dmarcreports.read",
397	"email-security-dmarcreports.write",
398	"email-sending.read",
399	"email-sending.write",
400	],
401	},
402	{
403	id: "cache-performance",
404	label: "Cache & Performance",
405	scopes: [
406	"account-ssl-and-certificates.read",
407	"account-ssl-and-certificates.write",
408	"cache.purge",
409	"cache-settings.read",
410	"cache-settings.write",
411	"account-disable-esc.read",
412	"account-disable-esc.write",
413	"zone-disable-esc.read",
414	"zone-disable-esc.write",
415	"ssl-and-certificates.read",
416	"ssl-and-certificates.write",
417	],
418	},
419	{
420	id: "account-billing",
421	label: "Account & Billing",
422	scopes: [
423	"account-api-gateway.read",
424	"account-api-gateway.write",
425	"account-custom-asset.read",
426	"account-custom-asset.write",
427	"account-settings.read",
428	"account-settings.write",
429	"apps.write",
430	"integration.write",
431	"memberships.read",
432	"memberships.write",
433	"notifications.read",
434	"notifications.write",
435	"scim-provisioning.write",
436	"user-details.read",
437	"user-details.write",
438	],
439	},
440	{
441	id: "other",
442	label: "Other",
443	scopes: [
444	"artifacts.read",
445	"artifacts.write",
446	"resource-library.read",
447	"resource-library.write",
448	"resource-sharing.read",
449	],
450	},
451	] as const;
452
453	export type OAuthScopeId =
454	(typeof OAUTH_SCOPE_GROUPS)[number]["scopes"][number];
455
456	/** Human-readable names from Cloudflare's OAuth scope catalog. */
457	export const OAUTH_SCOPE_NAMES: Readonly<Record<OAuthScopeId, string>> = {
458	"agent-memory.write": "Agent Memory Write",
459	"browser-rendering.read": "Browser Run Read",
460	"browser-rendering.write": "Browser Run Write",
461	"cf-agents.read": "CF Agents Read",
462	"cf-agents.write": "CF Agents Write",
463	"cloud-connector.read": "Cloud Connector Read",
464	"cloud-connector.write": "Cloud Connector Write",
465	"cloudchamber.read": "Cloudchamber Read",
466	"cloudchamber.write": "Cloudchamber Write",
467	"constellation.read": "Constellation Read",
468	"constellation.write": "Constellation Write",
469	"d1.read": "D1 Read",
470	"d1.write": "D1 Write",
471	"flagship.evaluate": "Flagship Evaluate",
472	"flagship.read": "Flagship Read",
473	"flagship.write": "Flagship Write",
474	"query-cache.read": "Hyperdrive Read",
475	"query-cache.write": "Hyperdrive Write",
476	"mcp-portals.read": "MCP Portals Read",
477	"mcp-portals.write": "MCP Portals Write",
478	"messaging.edit": "Messaging Edit",
479	"messaging.read": "Messaging Read",
480	"page.read": "Pages Read",
481	"page.write": "Pages Write",
482	"pipelines.read": "Pipelines Read",
483	"pipelines.send": "Pipelines Send",
484	"pipelines.write": "Pipelines Write",
485	"pubsub.read": "Pubsub Configuration Read",
486	"pubsub.write": "Pubsub Configuration Write",
487	"queues.read": "Queues Read",
488	"queues.write": "Queues Write",
489	"realtime.write": "Realtime",
490	"realtime.admin": "Realtime Admin",
491	"realtime.read": "Realtime Read",
492	"secrets-store.read": "Secrets Store Read",
493	"secrets-store.write": "Secrets Store Write",
494	"vectorize.read": "Vectorize Read",
495	"vectorize.write": "Vectorize Write",
496	"workers-ci.read": "Workers CI Read",
497	"workers-ci.write": "Workers CI Write",
498	"containers.read": "Workers Containers Read",
499	"containers.write": "Workers Containers Write",
500	"workers-scripts.edit": "Workers Editor",
501	"workers-kv-storage.read": "Workers KV Storage Read",
502	"workers-kv-storage.write": "Workers KV Storage Write",
503	"workers-observability.read": "Workers Observability Read",
504	"workers-observability-telemetry.write":
505	"Workers Observability Telemetry Write",
506	"workers-observability.write": "Workers Observability Write",
507	"r2-catalog.read": "Workers R2 Data Catalog Read",
508	"r2-catalog.write": "Workers R2 Data Catalog Write",
509	"r2-catalog-sql.read": "Workers R2 SQL Read",
510	"workers-r2-bucket-item.read": "Workers R2 Storage Bucket Item Read",
511	"workers-r2-bucket-item.write": "Workers R2 Storage Bucket Item Write",
512	"workers-r2.read": "Workers R2 Storage Read",
513	"workers-r2.write": "Workers R2 Storage Write",
514	"workers-routes.read": "Workers Routes Read",
515	"workers-routes.write": "Workers Routes Write",
516	"workers-scripts.bind": "Workers Scripts Bind",
517	"workers-scripts.read": "Workers Scripts Read",
518	"workers-scripts.write": "Workers Scripts Write",
519	"workers-tail.read": "Workers Tail Read",
520	"aiaudit.read": "AI Audit Read",
521	"aiaudit.write": "AI Audit Write",
522	"aig.read": "AI Gateway Read",
523	"aig.run": "AI Gateway Run",
524	"aig.write": "AI Gateway Write",
525	"ai-search.index": "AI Search Index Engine",
526	"ai-search.read": "AI Search Read",
527	"ai-search.run": "AI Search Run",
528	"ai-search.write": "AI Search Write",
529	"agw.read": "Agents Gateway Read",
530	"agw.run": "Agents Gateway Run",
531	"agw.write": "Agents Gateway Write",
532	"rag.read": "Auto Rag Read",
533	"rag.write": "Auto Rag Write",
534	"rag.run": "Auto Rag Write Run Engine",
535	"firewall-for-ai.read": "Firewall for AI Read",
536	"firewall-for-ai.write": "Firewall for AI Write",
537	"websearch.read": "Websearch Read",
538	"websearch.run": "Websearch Run",
539	"websearch.write": "Websearch Write",
540	"ai.read": "Workers AI Read",
541	"ai.write": "Workers AI Write",
542	"account-dns-settings.read": "Account DNS Settings Read",
543	"account-dns-settings.write": "Account DNS Settings Write",
544	"dns-firewall.read": "DNS Firewall Read",
545	"dns-firewall.write": "DNS Firewall Write",
546	"dns.read": "DNS Read",
547	"dns-view.read": "DNS View Read",
548	"dns-view.write": "DNS View Write",
549	"dns.write": "DNS Write",
550	"registrar-domains.admin": "Registrar Domains Admin",
551	"registrar-domains.read": "Registrar Domains Read",
552	"registrar-sandbox-domains.admin": "Registrar Sandbox Domains Admin",
553	"registrar-sandbox-domains.read": "Registrar Sandbox Domains Read",
554	"zone-custom-asset.read": "Zone Custom Asset Read",
555	"zone-custom-asset.write": "Zone Custom Asset Write",
556	"zone-dns-settings.read": "Zone DNS Settings Read",
557	"zone-dns-settings.write": "Zone DNS Settings Write",
558	"zone.read": "Zone Read",
559	"zone-settings.read": "Zone Settings Read",
560	"zone-settings.write": "Zone Settings Write",
561	"zone-versioning.read": "Zone Versioning Read",
562	"zone-versioning.write": "Zone Versioning Write",
563	"zone.write": "Zone Write",
564	"fraud-detection-pii.read": "Account Abuse Protection PII Read",
565	"account-firewall-access-rules.read": "Account Firewall Access Rules Read",
566	"account-firewall-access-rules.write": "Account Firewall Access Rules Write",
567	"account-security-center-insights.read":
568	"Account Security Center Insights Read",
569	"account-security-center-insights.write":
570	"Account Security Center Insights Write",
571	"account-waf.read": "Account WAF Read",
572	"account-waf.write": "Account WAF Write",
573	"request-tracer.read": "Allow Request Tracer Read",
574	"reports-application-security-report.read":
575	"Application Security Reports Read",
576	"bot-management-feedback.read": "Bot Management Feedback Report Read",
577	"bot-management-feedback.write": "Bot Management Feedback Report Write",
578	"bot-management.read": "Bot Management Read",
579	"bot-management.write": "Bot Management Write",
580	"cloudforce-one.read": "Cloudforce One Read",
581	"cloudforce-one.write": "Cloudforce One Write",
582	"ddos-botnet-feed.read": "DDoS Botnet Feed Read",
583	"ddos-botnet-feed.write": "DDoS Botnet Feed Write",
584	"ddos-protection.read": "DDoS Protection Read",
585	"ddos-protection.write": "DDoS Protection Write",
586	"api-gateway.write": "Domain API Gateway",
587	"api-gateway.read": "Domain API Gateway Read",
588	"domain-page.shield": "Domain Page Shield",
589	"domain-page-shield.read": "Domain Page Shield Read",
590	"field-extractor.read": "Field Extractors Read",
591	"field-extractor.write": "Field Extractors Write",
592	"firewall-services.read": "Firewall Services Read",
593	"firewall-services.write": "Firewall Services Write",
594	"fraud-detection.read": "Fraud Detection Read",
595	"fraud-detection.write": "Fraud Detection Write",
596	"fraud-events.write": "Fraud Events Write",
597	"fraud-feedback.read": "Fraud Feedback Read",
598	"fraud-feedback.write": "Fraud Feedback Write",
599	"http-applications.read": "HTTP Applications Read",
600	"http-applications.write": "HTTP Applications Write",
601	"http-ddos-managed-ruleset.read": "HTTP DDoS Managed Ruleset Read",
602	"http-ddos-managed-ruleset.write": "HTTP DDoS Managed Ruleset Write",
603	"iot.read": "IOT Read",
604	"iot.write": "IOT Write",
605	"l4-ddos-managed-ruleset.read": "L4 DDoS Managed Ruleset Read",
606	"l4-ddos-managed-ruleset.write": "L4 DDoS Managed Ruleset Write",
607	"page-rules.read": "Page Rules Read",
608	"page-rules.write": "Page Rules Write",
609	"page.shield": "Page Shield",
610	"page-shield.read": "Page Shield Read",
611	"precursor.read": "Precursor Read",
612	"precursor.write": "Precursor Write",
613	"sanitize.read": "Sanitize Read",
614	"sanitize.write": "Sanitize Write",
615	"tag.read": "Tag Read",
616	"tag.write": "Tag Write",
617	"trust-and-safety.read": "Trust and Safety Read",
618	"trust-and-safety.write": "Trust and Safety Write",
619	"challenge-widgets.read": "Turnstile Sites Read",
620	"challenge-widgets.write": "Turnstile Sites Write",
621	"url-scanner.read": "URL Scanner Read",
622	"url-scanner.write": "URL Scanner Write",
623	"zaraz.write": "Zaraz Admin",
624	"zaraz.edit": "Zaraz Edit",
625	"zaraz.read": "Zaraz Read",
626	"zone-security-center-insights.read": "Zone Security Center Insights Read",
627	"zone-security-center-insights.write": "Zone Security Center Insights Write",
628	"zone-waf.read": "Zone WAF Read",
629	"zone-waf.write": "Zone WAF Write",
630	"account-custom-error-rules.read": "Account Custom Error Rules Read",
631	"account-custom-error-rules.write": "Account Custom Error Rules Write",
632	"account-custom-pages.read": "Account Custom Pages Read",
633	"account-custom-pages.write": "Account Custom Pages Write",
634	"account-rule-lists.read": "Account Rule Lists Read",
635	"account-rule-lists.write": "Account Rule Lists Write",
636	"account-rulesets.read": "Account Rulesets Read",
637	"account-rulesets.write": "Account Rulesets Write",
638	"config-settings.read": "Config Settings Read",
639	"config-settings.write": "Config Settings Write",
640	"custom-errors.read": "Custom Errors Read",
641	"custom-errors.write": "Custom Errors Write",
642	"custom-pages.read": "Custom Pages Read",
643	"custom-pages.write": "Custom Pages Write",
644	"dynamic-redirect.read": "Dynamic URL Redirects Read",
645	"dynamic-redirect.write": "Dynamic URL Redirects Write",
646	"managed-headers.read": "Managed headers Read",
647	"managed-headers.write": "Managed headers Write",
648	"mass-url-redirects.read": "Mass URL Redirects Read",
649	"mass-url-redirects.write": "Mass URL Redirects Write",
650	"origin.read": "Origin Read",
651	"origin.write": "Origin Write",
652	"payments-gateway.read": "Payments Gateway Read",
653	"payments-gateway.write": "Payments Gateway Write",
654	"response-compression.read": "Response Compression Read",
655	"response-compression.write": "Response Compression Write",
656	"select-configuration.read": "Select Configuration Read",
657	"select-configuration.write": "Select Configuration Write",
658	"snippets.read": "Snippets Read",
659	"snippets.write": "Snippets Write",
660	"transform-rules.read": "Transform Rules Read",
661	"transform-rules.write": "Transform Rules Write",
662	"zone-transform-rules.read": "Zone Transform Rules Read",
663	"zone-transform-rules.write": "Zone Transform Rules Write",
664	"access-app.read": "Access: Apps Read",
665	"access-app.revoke": "Access: Apps Revoke",
666	"access-app.write": "Access: Apps Write",
667	"access.read": "Access: Apps and Policies Read",
668	"zone-access.read": "Access: Apps and Policies Read",
669	"access.revoke": "Access: Apps and Policies Revoke",
670	"zone-access.revoke": "Access: Apps and Policies Revoke",
671	"access.write": "Access: Apps and Policies Write",
672	"zone-access.write": "Access: Apps and Policies Write",
673	"access-audit-log.read": "Access: Audit Logs Read",
674	"access-custom-page.read": "Access: Custom Pages Read",
675	"access-custom-page.write": "Access: Custom Pages Write",
676	"access-device-posture.read": "Access: Device Posture Read",
677	"access-device-posture.write": "Access: Device Posture Write",
678	"access-group.read": "Access: Groups Read",
679	"access-group.write": "Access: Groups Write",
680	"access-idp.read": "Access: Identity Providers Read",
681	"access-idp.write": "Access: Identity Providers Write",
682	"access-key.read": "Access: Keys Read",
683	"access-key.write": "Access: Keys Write",
684	"access-certificate.read": "Access: Mutual TLS Certificates Read",
685	"access-certificate.write": "Access: Mutual TLS Certificates Write",
686	"access-org.read": "Access: Organizations Read",
687	"access-org.revoke": "Access: Organizations Revoke",
688	"access-org.write": "Access: Organizations Write",
689	"access-acct.read":
690	"Access: Organizations, Identity Providers, and Groups Read",
691	"access-acct.revoke":
692	"Access: Organizations, Identity Providers, and Groups Revoke",
693	"access-acct.write":
694	"Access: Organizations, Identity Providers, and Groups Write",
695	"access-policy.read": "Access: Policies Read",
696	"access-policy.write": "Access: Policies Write",
697	"access-policy-test.read": "Access: Policy Test Read",
698	"access-policy-test.write": "Access: Policy Test Write",
699	"access-population.read": "Access: Population Read",
700	"access-population.write": "Access: Population Write",
701	"access-saml-certificate.read": "Access: SAML Certificates Read",
702	"access-saml-certificate.write": "Access: SAML Certificates Write",
703	"access-scim-log.read": "Access: SCIM Logs Read",
704	"access-ssh-auditing.read": "Access: SSH Auditing Read",
705	"access-ssh-auditing.write": "Access: SSH Auditing Write",
706	"access-service-token.read": "Access: Service Tokens Read",
707	"access-service-token.write": "Access: Service Tokens Write",
708	"access-tag.read": "Access: Tags Read",
709	"access-tag.write": "Access: Tags Write",
710	"access-users.read": "Access: Users Read",
711	"access-users.write": "Access: Users Write",
712	"casb.read": "CASB Read",
713	"casb.write": "CASB Write",
714	"teams-cds-compute-account.read": "Cloudflare CDS Compute Account Read",
715	"teams-cds-compute-account.write": "Cloudflare CDS Compute Account Write",
716	"teams-dex.read": "Cloudflare DEX Read",
717	"teams-dex.write": "Cloudflare DEX Write",
718	"teams-connector-cloudflared.monitoring":
719	"Cloudflare One Connector Monitoring: cloudflared",
720	"teams-connector-warp.read": "Cloudflare One Connector: WARP Read",
721	"teams-connector-warp.write": "Cloudflare One Connector: WARP Write",
722	"teams-connector-cloudflared.read":
723	"Cloudflare One Connector: cloudflared Read",
724	"teams-connector-cloudflared.write":
725	"Cloudflare One Connector: cloudflared Write",
726	"teams-connectors.read": "Cloudflare One Connectors Read",
727	"teams-connectors.write": "Cloudflare One Connectors Write",
728	"teams-networks.read": "Cloudflare One Networks Read",
729	"teams-networks.write": "Cloudflare One Networks Write",
730	"argotunnel.read": "Cloudflare Tunnel Read",
731	"argotunnel.write": "Cloudflare Tunnel Write",
732	"teams-secure.location": "Cloudflare Zero Trust Secure DNS Locations Write",
733	"dls.read": "DLS: Read",
734	"dls.write": "DLS: Write",
735	"teams.read": "Zero Trust Read",
736	"teams.report": "Zero Trust Report",
737	"teams-resilience.read": "Zero Trust Resilience Read",
738	"teams-resilience.write": "Zero Trust Resilience Write",
739	"teams.write": "Zero Trust Write",
740	"teams-pii.read": "Zero Trust: PII Read",
741	"access-seats.write": "Zero Trust: Seats Write",
742	"account-analytics.read": "Account Analytics Read",
743	"analytics.read": "Analytics Read",
744	"intel.read": "Intel Read",
745	"intel.write": "Intel Write",
746	"account-logs.read": "Logs Read",
747	"logs.read": "Logs Read",
748	"account-logs.write": "Logs Write",
749	"logs.write": "Logs Write",
750	"radar.read": "Radar Read",
751	"account-waiting-rooms.read": "Account Waiting Rooms Read",
752	"address-maps.read": "Address Maps Read",
753	"address-maps.write": "Address Maps Write",
754	"chinanetwork-steering.read": "China Network Steering Read",
755	"chinanetwork-steering.write": "China Network Steering Write",
756	"connectivity-directory.admin": "Connectivity Directory Admin",
757	"connectivity-directory.bind": "Connectivity Directory Bind",
758	"connectivity-directory.read": "Connectivity Directory Read",
759	"healthcheck.read": "Health Checks Read",
760	"healthcheck.write": "Health Checks Write",
761	"ip-prefix-bgp-on-demand.read": "IP Prefixes: BGP On Demand Read",
762	"ip-prefix-bgp-on-demand.write": "IP Prefixes: BGP On Demand Write",
763	"ip-prefix.read": "IP Prefixes: Read",
764	"ip-prefix.write": "IP Prefixes: Write",
765	"load-balancers-account.read": "Load Balancers Account Read",
766	"load-balancers-account.write": "Load Balancers Account Write",
767	"load-balancers.read": "Load Balancers Read",
768	"load-balancers.write": "Load Balancers Write",
769	"load-balancing-monitors-and-pools.read":
770	"Load Balancing: Monitors and Pools Read",
771	"load-balancing-monitors-and-pools.write":
772	"Load Balancing: Monitors and Pools Write",
773	"pcaps-api.read": "Magic Firewall Packet Captures - Read PCAPs API",
774	"pcaps-api.write": "Magic Firewall Packet Captures - Write PCAPs API",
775	"magic-firewall.read": "Magic Firewall Read",
776	"magic-firewall.write": "Magic Firewall Write",
777	"fbm.admin": "Magic Network Monitoring Admin",
778	"fbm.read": "Magic Network Monitoring Config Read",
779	"fbm.write": "Magic Network Monitoring Config Write",
780	"magic-transit.read": "Magic Transit Read",
781	"magic-transit.write": "Magic Transit Write",
782	"magic-wan.read": "Magic WAN Read",
783	"magic-wan.write": "Magic WAN Write",
784	"waiting-rooms.read": "Waiting Rooms Read",
785	"waiting-rooms.write": "Waiting Rooms Write",
786	"web3-hostnames.read": "Web3 Hostnames Read",
787	"web3-hostnames.write": "Web3 Hostnames Write",
788	"calls.read": "Calls Read",
789	"calls.write": "Calls Write",
790	"images.read": "Images Read",
791	"images.write": "Images Write",
792	"moq.read": "MoQ Read",
793	"moq.write": "MoQ Write",
794	"stream.read": "Stream Read",
795	"stream.write": "Stream Write",
796	"cloud-email-security.read": "Cloud Email Security: Read",
797	"cloud-email-security.write": "Cloud Email Security: Write",
798	"email-routing-account-rule.read": "Email Routing Account Rules Read",
799	"email-routing-address.read": "Email Routing Addresses Read",
800	"email-routing-address.write": "Email Routing Addresses Write",
801	"email-routing-rule.read": "Email Routing Rules Read",
802	"email-routing-rule.write": "Email Routing Rules Write",
803	"email-routing-suppression.read": "Email Routing Suppressions Read",
804	"email-routing-suppression.write": "Email Routing Suppressions Write",
805	"email-security-dmarcreports.read": "Email Security DMARC Reports Read",
806	"email-security-dmarcreports.write": "Email Security DMARC Reports Write",
807	"email-sending.read": "Email Sending Read",
808	"email-sending.write": "Email Sending Write",
809	"account-ssl-and-certificates.read": "Account: SSL and Certificates Read",
810	"account-ssl-and-certificates.write": "Account: SSL and Certificates Write",
811	"cache.purge": "Cache Purge",
812	"cache-settings.read": "Cache Settings Read",
813	"cache-settings.write": "Cache Settings Write",
814	"account-disable-esc.read": "Disable ESC Read",
815	"zone-disable-esc.read": "Disable ESC Read",
816	"account-disable-esc.write": "Disable ESC Write",
817	"zone-disable-esc.write": "Disable ESC Write",
818	"ssl-and-certificates.read": "SSL and Certificates Read",
819	"ssl-and-certificates.write": "SSL and Certificates Write",
820	"account-api-gateway.write": "Account API Gateway",
821	"account-api-gateway.read": "Account API Gateway Read",
822	"account-custom-asset.read": "Account Custom Asset Read",
823	"account-custom-asset.write": "Account Custom Asset Write",
824	"account-settings.read": "Account Settings Read",
825	"account-settings.write": "Account Settings Write",
826	"apps.write": "Apps Write",
827	"integration.write": "Integration Write",
828	"memberships.read": "Memberships Read",
829	"memberships.write": "Memberships Write",
830	"notifications.read": "Notifications Read",
831	"notifications.write": "Notifications Write",
832	"scim-provisioning.write": "SCIM Provisioning",
833	"user-details.read": "User Details Read",
834	"user-details.write": "User Details Write",
835	"artifacts.read": "Artifacts Read",
836	"artifacts.write": "Artifacts Write",
837	"resource-library.read": "Resource Library Read",
838	"resource-library.write": "Resource Library Write",
839	"resource-sharing.read": "Resource Sharing Read",
840	};
841
842	/** Flat lookup retained for consumers that do not need grouping metadata. */
843	export const ALL_SCOPES = Object.fromEntries(
844	OAUTH_SCOPE_GROUPS.flatMap((group) =>
845	group.scopes.map((scope) => [scope, group.label]),
846	),
847	) as Readonly<Record<OAuthScopeId, string>>;
848
849	/** Every scope available to the public Alchemy OAuth client. */
850	export const ALL_SCOPE_IDS: ReadonlyArray<OAuthScopeId> =
851	OAUTH_SCOPE_GROUPS.flatMap((group) => group.scopes);
852
853	/**
854	* Split stored scopes into those the current OAuth client offers and those
855	* it does not. Profiles configured against an older client (or scope
856	* catalog) can hold scopes the current client rejects, and a single unknown
857	* scope invalidates the entire authorize URL — sanitize with this before
858	* building one.
859	*/
860	export const partitionOAuthScopes = (
861	scopes: ReadonlyArray<string>,
862	): { valid: string[]; dropped: string[] } => {
863	const known = new Set<string>(ALL_SCOPE_IDS);
864	return {
865	valid: scopes.filter((scope) => known.has(scope)),
866	dropped: scopes.filter((scope) => !known.has(scope)),
867	};
868	};
869
870	/**
871	* Initial selections for the custom-scope prompt. Reconfiguration restores
872	* the existing OAuth grant while dropping scopes no longer offered by the
873	* current client; first-time and stored-credential setup select every scope.
874	*/
875	export const customOAuthScopeDefaults = (currentConfig?: {
876	readonly method: string;
877	readonly scopes?: ReadonlyArray<string>;
878	readonly [key: string]: unknown;
879	}): string[] =>
880	currentConfig?.method === "oauth" && currentConfig.scopes !== undefined
881	? partitionOAuthScopes(currentConfig.scopes).valid
882	: [...ALL_SCOPE_IDS];
883
884	/** Reusable scope bundles for common OAuth authorization flows. */
885	export const OAUTH_SCOPE_TEMPLATES = {
886	basic: [
887	"memberships.read",
888	"user-details.read",
889	"account-settings.read",
890	"ai-search.run",
891	"ai-search.write",
892	"ai.write",
893	"aig.read",
894	"aig.run",
895	"aig.write",
896	"cloudchamber.write",
897	"connectivity-directory.admin",
898	"containers.write",
899	"d1.write",
900	"page.write",
901	"pipelines.send",
902	"pipelines.write",
903	"queues.write",
904	"secrets-store.write",
905	"account-ssl-and-certificates.write",
906	"ssl-and-certificates.write",
907	"vectorize.write",
908	"workers-kv-storage.write",
909	"workers-observability.read",
910	"workers-observability.write",
911	"workers-observability-telemetry.write",
912	"workers-r2.write",
913	"workers-routes.write",
914	"workers-scripts.write",
915	"workers-tail.read",
916	"zone.read",
917	],
918	} as const satisfies Readonly<Record<string, ReadonlyArray<OAuthScopeId>>>;
919
920	export const BASIC_SCOPES: ReadonlyArray<OAuthScopeId> =
921	OAUTH_SCOPE_TEMPLATES.basic;