devflare 1.0.0-next.15 → 1.0.0-next.17

package/dist/index-myxfx52v.js

@@ -0,0 +1,385 @@
+import {
+  ensureGeneratedDirectory,
+  getGeneratedArtifactPaths
+} from "./index-aabgympv.js";
+import {
+  getDependencies
+} from "./index-z9gy8w6b.js";
+import {
+  bundleWorkerEntry
+} from "./index-khbmdrn2.js";
+import {
+  detectViteProject
+} from "./index-gn5wy09x.js";
+import {
+  logLine
+} from "./index-stgn34cr.js";
+import {
+  resolvePackageSpecifier
+} from "./index-t4fhcx1n.js";
+import {
+  prepareComposedWorkerEntrypoint,
+  resolveEffectiveViteProject,
+  writeGeneratedViteConfig
+} from "./index-newpq2zf.js";
+import {
+  compileBuildConfig,
+  isolateViteBuildOutputPaths,
+  rebaseWranglerConfigPaths,
+  writeWranglerConfig
+} from "./index-8jkf4nsd.js";
+import {
+  loadConfig,
+  resolveConfigForEnvironment
+} from "./index-v78xbj6n.js";
+import {
+  __require
+} from "./index-37x76zdn.js";
+
+// src/cli/deploy-strategy.ts
+function normalizeBranchScope(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function shouldIncludePreviewCrons(config) {
+  return config.previews?.includeCrons === true;
+}
+function omitQueueConsumers(config) {
+  if (!config.bindings?.queues?.consumers?.length) {
+    return config;
+  }
+  const nextBindings = {
+    ...config.bindings
+  };
+  const nextQueues = {
+    ...nextBindings.queues
+  };
+  delete nextQueues.consumers;
+  if (!nextQueues.producers || Object.keys(nextQueues.producers).length === 0) {
+    delete nextBindings.queues;
+  } else {
+    nextBindings.queues = nextQueues;
+  }
+  return {
+    ...config,
+    bindings: nextBindings
+  };
+}
+function omitCronTriggers(config) {
+  if (!config.triggers?.crons?.length) {
+    return config;
+  }
+  const nextTriggers = {
+    ...config.triggers
+  };
+  delete nextTriggers.crons;
+  if (Object.keys(nextTriggers).length === 0) {
+    const { triggers: _triggers, ...rest } = config;
+    return rest;
+  }
+  return {
+    ...config,
+    triggers: nextTriggers
+  };
+}
+function applyDeploymentStrategy(config, options = {}) {
+  const branchScope = normalizeBranchScope(options.previewBranch) ?? normalizeBranchScope(options.branchName);
+  const isBranchScopedPreviewDeploy = !options.preview && options.environment === "preview" && Boolean(branchScope);
+  if (!isBranchScopedPreviewDeploy) {
+    return {
+      config,
+      strategy: "default",
+      omittedResources: []
+    };
+  }
+  const omittedResources = [];
+  let nextConfig = config;
+  if (nextConfig.bindings?.queues?.consumers?.length) {
+    nextConfig = omitQueueConsumers(nextConfig);
+    omittedResources.push("queue-consumers");
+  }
+  if (!shouldIncludePreviewCrons(nextConfig) && nextConfig.triggers?.crons?.length) {
+    nextConfig = omitCronTriggers(nextConfig);
+    omittedResources.push("cron-triggers");
+  }
+  return {
+    config: nextConfig,
+    strategy: "preview-scope",
+    branchScope,
+    omittedResources
+  };
+}
+function describeDeploymentStrategy(result) {
+  if (result.strategy !== "preview-scope" || result.omittedResources.length === 0) {
+    return;
+  }
+  const labels = result.omittedResources.map((resource) => {
+    return resource === "queue-consumers" ? "queue consumers" : "cron triggers";
+  });
+  const formattedLabels = labels.length === 2 ? `${labels[0]} and ${labels[1]}` : labels[0];
+  const scopeSuffix = result.branchScope ? ` (${result.branchScope})` : "";
+  return `Named preview-scope deploy detected${scopeSuffix}; omitting shared ${formattedLabels} from the deployed Wrangler config to avoid singleton Cloudflare resource conflicts.`;
+}
+
+// src/cli/commands/build-artifacts.ts
+import { dirname, relative, resolve } from "pathe";
+function getBuildArtifactPaths(cwd) {
+  return getGeneratedArtifactPaths(cwd);
+}
+function isNestedPath(parentPath, candidatePath) {
+  const normalizedParentPath = parentPath.replace(/\\/g, "/");
+  const normalizedCandidatePath = candidatePath.replace(/\\/g, "/");
+  return normalizedCandidatePath.startsWith(`${normalizedParentPath}/`);
+}
+function isolateViteBuildOutputPaths2(cwd, wranglerConfig) {
+  return isolateViteBuildOutputPaths(cwd, wranglerConfig);
+}
+function getViteBuildCleanupTargets(cwd, wranglerConfig) {
+  const targets = [];
+  const assetsDirectory = wranglerConfig.assets?.directory;
+  const mainEntry = wranglerConfig.main;
+  if (assetsDirectory) {
+    targets.push(resolve(cwd, assetsDirectory));
+  }
+  if (mainEntry) {
+    const mainEntryPath = resolve(cwd, mainEntry);
+    const isCoveredByAssetsDirectory = targets.some((targetPath) => {
+      return mainEntryPath === targetPath || isNestedPath(targetPath, mainEntryPath);
+    });
+    if (!isCoveredByAssetsDirectory) {
+      targets.push(mainEntryPath);
+    }
+  }
+  return targets;
+}
+function shouldRetryCleanup(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const errorCode = error.code;
+  return errorCode === "EBUSY" || errorCode === "EPERM" || errorCode === "ENOTEMPTY";
+}
+async function getCleanupFileSystem() {
+  return await import("node:fs/promises");
+}
+async function pathExists(cleanupFs, targetPath) {
+  try {
+    await cleanupFs.access(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDeferredCleanupPath(targetPath, uniqueSuffix) {
+  const suffix = uniqueSuffix ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  return `${targetPath}.devflare-stale-${suffix}`;
+}
+async function tryMoveLockedPathAside(targetPath, logger, cleanupFs) {
+  if (!await pathExists(cleanupFs, targetPath)) {
+    return true;
+  }
+  const deferredCleanupPath = createDeferredCleanupPath(targetPath);
+  try {
+    await cleanupFs.rename(targetPath, deferredCleanupPath);
+  } catch {
+    return false;
+  }
+  logger.warn(`Moved locked build output aside to ${deferredCleanupPath} after repeated cleanup failures; continuing build`);
+  try {
+    await cleanupFs.rm(deferredCleanupPath, {
+      recursive: true,
+      force: true
+    });
+  } catch (error) {
+    const cleanupErrorCode = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "an unknown error";
+    logger.warn(`Deferred cleanup for ${deferredCleanupPath} is still blocked by ${cleanupErrorCode}; you can remove it manually later`);
+  }
+  return true;
+}
+async function removePathWithRetries(targetPath, logger, attempts = 5, cleanupFs) {
+  const fs = cleanupFs ?? await getCleanupFileSystem();
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt++) {
+    try {
+      await fs.rm(targetPath, {
+        recursive: true,
+        force: true
+      });
+      return;
+    } catch (error) {
+      lastError = error;
+      if (!shouldRetryCleanup(error) || attempt === attempts) {
+        break;
+      }
+      logger.warn(`Retrying cleanup for ${targetPath} after ${error.code} (${attempt}/${attempts})`);
+      await new Promise((resolveRetry) => setTimeout(resolveRetry, attempt * 100));
+    }
+  }
+  if (shouldRetryCleanup(lastError) && await tryMoveLockedPathAside(targetPath, logger, fs)) {
+    return;
+  }
+  if (shouldRetryCleanup(lastError)) {
+    const cleanupErrorCode = lastError instanceof Error && "code" in lastError && typeof lastError.code === "string" ? lastError.code : "an unknown error";
+    logger.warn(`Continuing build without pre-clean for ${targetPath} because cleanup is still blocked by ${cleanupErrorCode}`);
+    return;
+  }
+  throw lastError;
+}
+async function cleanupViteBuildOutputs(cwd, wranglerConfig, logger) {
+  const cleanupTargets = getViteBuildCleanupTargets(cwd, wranglerConfig);
+  for (const cleanupTarget of cleanupTargets) {
+    await removePathWithRetries(cleanupTarget, logger);
+  }
+}
+async function writeDeployRedirect(cwd, generatedConfigPath) {
+  const fs = await import("node:fs/promises");
+  const paths = getBuildArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.deployDir);
+  const configPath = relative(paths.deployDir, generatedConfigPath).replace(/\\/g, "/");
+  await fs.writeFile(paths.deployRedirectPath, `${JSON.stringify({ configPath }, null, "\t")}
+`, "utf-8");
+}
+async function readDeployRedirect(cwd) {
+  const fs = await import("node:fs/promises");
+  const paths = getBuildArtifactPaths(cwd);
+  try {
+    const rawConfig = await fs.readFile(paths.deployRedirectPath, "utf-8");
+    const parsed = JSON.parse(rawConfig);
+    if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) {
+      return null;
+    }
+    return resolve(dirname(paths.deployRedirectPath), parsed.configPath);
+  } catch {
+    return null;
+  }
+}
+async function writeGeneratedDeployWranglerConfig(cwd, wranglerConfig, options = {}) {
+  const paths = getBuildArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.buildDir, true);
+  const buildConfig = rebaseWranglerConfigPaths(cwd, paths.buildDir, wranglerConfig);
+  if (options.main) {
+    buildConfig.main = options.main;
+  }
+  await writeWranglerConfig(paths.buildDir, buildConfig, "wrangler.jsonc");
+  return paths.buildWranglerConfigPath;
+}
+async function writeGeneratedDevWranglerConfig(cwd, wranglerConfig) {
+  const paths = getGeneratedArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.devflareDir, true);
+  const devConfig = rebaseWranglerConfigPaths(cwd, paths.devflareDir, wranglerConfig);
+  await writeWranglerConfig(paths.devflareDir, devConfig, "wrangler.jsonc");
+  return paths.devWranglerConfigPath;
+}
+async function buildWorkerOnlyDeployArtifact(cwd, wranglerConfig, config, logger) {
+  if (!wranglerConfig.main) {
+    return await writeGeneratedDeployWranglerConfig(cwd, wranglerConfig);
+  }
+  const paths = getBuildArtifactPaths(cwd);
+  const bundledMainEntryPath = await bundleWorkerEntry({
+    cwd,
+    inputFile: resolve(cwd, wranglerConfig.main),
+    outFile: paths.buildWorkerPath,
+    rolldownOptions: config.rolldown?.options,
+    sourcemap: config.rolldown?.sourcemap,
+    minify: config.rolldown?.minify,
+    logger
+  });
+  logLine(logger, `Generated deploy artifact: ${relative(cwd, bundledMainEntryPath).replace(/\\/g, "/")}`);
+  return await writeGeneratedDeployWranglerConfig(cwd, wranglerConfig, {
+    main: "./worker.js"
+  });
+}
+async function resolveLocalViteExecutable(cwd, fs) {
+  const viteExecutablePath = resolvePackageSpecifier("vite/bin/vite.js", cwd);
+  try {
+    await fs.access(viteExecutablePath);
+  } catch {
+    throw new Error(`Could not resolve a local Vite CLI entrypoint from ${cwd}. Install vite in this package before running a Vite-backed Devflare build.`);
+  }
+  return viteExecutablePath;
+}
+async function prepareBuildArtifacts(parsed, logger, options) {
+  const cwd = options.cwd || process.cwd();
+  const configPath = parsed.options.config;
+  const environment = parsed.options.env;
+  const rawConfig = await loadConfig({ cwd, configFile: configPath });
+  const config = resolveConfigForEnvironment(rawConfig, environment);
+  logLine(logger, `Building: ${config.name}`);
+  const composedMainEntry = await prepareComposedWorkerEntrypoint(cwd, config, environment);
+  const deps = await getDependencies();
+  const viteProject = resolveEffectiveViteProject(await detectViteProject(cwd, deps.fs), config, environment);
+  const deploymentStrategy = applyDeploymentStrategy(config, {
+    environment,
+    preview: parsed.options.preview === true,
+    branchName: parsed.options["branch-name"],
+    previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+  });
+  const deploymentStrategyMessage = describeDeploymentStrategy(deploymentStrategy);
+  if (deploymentStrategyMessage) {
+    logLine(logger, deploymentStrategyMessage);
+  }
+  const devWranglerConfig = viteProject.shouldStartVite ? isolateViteBuildOutputPaths2(cwd, compileBuildConfig(config)) : compileBuildConfig(config);
+  const deployWranglerConfig = viteProject.shouldStartVite ? isolateViteBuildOutputPaths2(cwd, compileBuildConfig(deploymentStrategy.config)) : compileBuildConfig(deploymentStrategy.config);
+  if (viteProject.shouldStartVite) {
+    if (composedMainEntry) {
+      deployWranglerConfig.main = composedMainEntry;
+      logLine(logger, `Generated composed worker entry: ${composedMainEntry}`);
+    }
+  } else if (composedMainEntry) {
+    const bundledMainEntryPath = await bundleWorkerEntry({
+      cwd,
+      inputFile: resolve(cwd, composedMainEntry),
+      outFile: resolve(cwd, ".devflare", "worker-entrypoints", "main.js"),
+      rolldownOptions: config.rolldown?.options,
+      sourcemap: config.rolldown?.sourcemap,
+      minify: config.rolldown?.minify,
+      logger
+    });
+    const bundledMainPath = relative(cwd, bundledMainEntryPath).replace(/\\/g, "/");
+    devWranglerConfig.main = bundledMainPath;
+    deployWranglerConfig.main = bundledMainPath;
+    logLine(logger, `Generated bundled worker entry: ${bundledMainPath}`);
+  }
+  let deployConfigPath;
+  if (viteProject.shouldStartVite) {
+    const generatedViteConfigPath = await writeGeneratedViteConfig({
+      cwd,
+      configPath,
+      environment,
+      localConfigPath: viteProject.viteConfigPath
+    });
+    const viteExecutablePath = await resolveLocalViteExecutable(cwd, deps.fs);
+    await cleanupViteBuildOutputs(cwd, devWranglerConfig, logger);
+    logLine(logger, "Running vite build...");
+    const buildProc = await deps.exec.exec(viteExecutablePath, ["build", "--config", generatedViteConfigPath], {
+      cwd,
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        DEVFLARE_BUILD: "true"
+      }
+    });
+    if (buildProc.exitCode !== 0) {
+      throw new Error("Build failed");
+    }
+    const existingDeployConfigPath = await readDeployRedirect(cwd);
+    const generatedDeployConfigPath = deployWranglerConfig.main && deployWranglerConfig.main !== devWranglerConfig.main ? await buildWorkerOnlyDeployArtifact(cwd, deployWranglerConfig, config, logger) : await writeGeneratedDeployWranglerConfig(cwd, deployWranglerConfig);
+    deployConfigPath = existingDeployConfigPath && existingDeployConfigPath !== generatedDeployConfigPath ? existingDeployConfigPath : generatedDeployConfigPath;
+  } else {
+    logLine(logger, "Skipping Vite build (no effective Vite config found for this package)");
+    deployConfigPath = await buildWorkerOnlyDeployArtifact(cwd, deployWranglerConfig, config, logger);
+  }
+  const generatedDevConfigPath = await writeGeneratedDevWranglerConfig(cwd, devWranglerConfig);
+  logger.debug(`Generated dev Wrangler config: ${relative(cwd, generatedDevConfigPath).replace(/\\/g, "/")}`);
+  await writeDeployRedirect(cwd, deployConfigPath);
+  logLine(logger, `Generated deploy Wrangler config: ${relative(cwd, deployConfigPath).replace(/\\/g, "/")}`);
+  logLine(logger, `Generated deploy redirect: ${relative(cwd, getBuildArtifactPaths(cwd).deployRedirectPath).replace(/\\/g, "/")}`);
+  return {
+    config,
+    wranglerConfig: deployWranglerConfig,
+    deployConfigPath,
+    viteProject
+  };
+}
+
+export { applyDeploymentStrategy, describeDeploymentStrategy, prepareBuildArtifacts };

package/dist/index-mzw7732t.js

@@ -0,0 +1,74 @@
+import {
+  loadConfig,
+  resolveConfigPath
+} from "./index-v9w1bbfe.js";
+import {
+  getEffectiveAccountId,
+  getPrimaryAccount,
+  getWorkspaceAccountId
+} from "./index-gba371j7.js";
+
+// src/cli/command-utils.ts
+function asOptionalString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function resolveNamedSelection(options) {
+  if (options.explicitValue) {
+    return {
+      value: options.explicitValue,
+      source: "option"
+    };
+  }
+  if (options.fallbackValue) {
+    return {
+      value: options.fallbackValue,
+      source: "arg"
+    };
+  }
+  if (options.configuredValue) {
+    return {
+      value: options.configuredValue,
+      source: "config"
+    };
+  }
+  return {
+    value: undefined,
+    source: "none"
+  };
+}
+async function getConfiguredAccountId(cwd) {
+  const workspaceAccountId = getWorkspaceAccountId();
+  if (workspaceAccountId) {
+    return workspaceAccountId;
+  }
+  const envAccountId = process.env.CLOUDFLARE_ACCOUNT_ID?.trim();
+  if (envAccountId) {
+    return envAccountId;
+  }
+  const configPath = await resolveConfigPath(cwd);
+  if (!configPath) {
+    return;
+  }
+  try {
+    const config = await loadConfig({ cwd });
+    return config.accountId;
+  } catch {
+    return;
+  }
+}
+async function resolveCloudflareAccountId(options) {
+  if (options.explicitAccountId) {
+    return options.explicitAccountId;
+  }
+  if (options.configuredAccountId) {
+    return options.configuredAccountId;
+  }
+  const primaryAccount = await getPrimaryAccount(options.apiOptions);
+  if (!primaryAccount) {
+    return;
+  }
+  const effective = await getEffectiveAccountId(primaryAccount.id);
+  return effective.accountId;
+}
+
+export { asOptionalString, resolveNamedSelection, getConfiguredAccountId, resolveCloudflareAccountId };

package/dist/index-n3mjwz22.js

@@ -0,0 +1,188 @@
+import {
+  apiDelete,
+  apiGetAll,
+  apiPost,
+  apiPut
+} from "./index-hjz2x9nq.js";
+
+// src/cloudflare/known-permission-group-ids.generated.ts
+var KNOWN_PERMISSION_GROUP_IDS_DATA = {
+  WORKERS_SCRIPTS_WRITE: null,
+  WORKERS_SCRIPTS_READ: null,
+  ACCOUNT_SETTINGS_READ: null,
+  WORKERS_KV_STORAGE_WRITE: null,
+  WORKERS_KV_STORAGE_READ: null,
+  ACCOUNT_API_TOKENS_WRITE: null,
+  ACCOUNT_API_TOKENS_READ: null
+};
+
+// src/cloudflare/tokens.ts
+var MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
+var DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
+var ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+var ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
+var DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
+var DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
+  /^Account Analytics Read$/i,
+  /^Account Settings Read$/i,
+  /^Analytics Read$/i,
+  /^AI /i,
+  /^Browser Rendering /i,
+  /^D1 (Metadata Read|Read|Write)$/i,
+  /^Email (Routing|Sending) /i,
+  /^Hyperdrive /i,
+  /^Queues /i,
+  /^Vectorize /i,
+  /^Workers /i
+];
+function deriveKnownPermissionGroupIds(data) {
+  const result = {};
+  for (const key of Object.keys(data)) {
+    const value = data[key];
+    result[key] = value === null ? undefined : value;
+  }
+  return result;
+}
+var KNOWN_PERMISSION_GROUP_IDS = deriveKnownPermissionGroupIds(KNOWN_PERMISSION_GROUP_IDS_DATA);
+function dedupePermissionGroups(permissionGroups) {
+  const seenIds = new Set;
+  return permissionGroups.filter((permissionGroup) => {
+    if (seenIds.has(permissionGroup.id)) {
+      return false;
+    }
+    seenIds.add(permissionGroup.id);
+    return true;
+  });
+}
+function dedupePermissionGroupIds(permissionGroupIds) {
+  return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
+}
+function excludeAccountApiTokensPermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
+  });
+}
+function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return permissionGroup.scopes.some((scope) => scope.trim() === ACCOUNT_OWNED_TOKEN_SCOPE);
+  });
+}
+function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
+  return dedupePermissionGroups(excludeAccountApiTokensPermissionGroups(keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups)));
+}
+function parseOptionalDate(value) {
+  if (!value) {
+    return;
+  }
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+function mapAccountOwnedAPITokenPolicy(policy) {
+  return {
+    id: policy.id,
+    effect: policy.effect,
+    permissionGroups: policy.permission_groups?.map((permissionGroup) => ({
+      id: permissionGroup.id,
+      name: permissionGroup.name
+    }))
+  };
+}
+function mapAccountOwnedAPIToken(token) {
+  return {
+    id: token.id,
+    name: token.name ?? token.id,
+    status: token.status,
+    value: token.value,
+    issuedOn: parseOptionalDate(token.issued_on),
+    modifiedOn: parseOptionalDate(token.modified_on),
+    lastUsedOn: parseOptionalDate(token.last_used_on),
+    policies: token.policies?.map(mapAccountOwnedAPITokenPolicy)
+  };
+}
+function isDevflareManagedTokenName(name) {
+  return DEVFLARE_MANAGED_TOKEN_NAME_PATTERN.test(name.trim());
+}
+function normalizeDevflareTokenName(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  const suffix = isDevflareManagedTokenName(trimmedName) ? trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") : trimmedName;
+  if (!suffix) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  return `${DEVFLARE_MANAGED_TOKEN_PREFIX}${suffix}`;
+}
+function stripDevflareTokenNamePrefix(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    return trimmedName;
+  }
+  const strippedName = trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "");
+  return strippedName || trimmedName;
+}
+function filterDevflareManagedTokens(tokens) {
+  return tokens.filter((token) => isDevflareManagedTokenName(token.name));
+}
+function selectDevflarePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = dedupePermissionGroups(selectReusableAccountOwnedTokenPermissionGroups(permissionGroups).filter((permissionGroup) => {
+    return DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS.some((pattern) => {
+      return pattern.test(permissionGroup.name);
+    });
+  }));
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not map the available Cloudflare permission groups to a Devflare token policy.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+function selectAllReusablePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not find any reusable account-scoped Cloudflare permission groups for this Devflare token.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+async function listAccountTokenPermissionGroups(accountId, options) {
+  const permissionGroups = await apiGetAll(`/accounts/${accountId}/tokens/permission_groups`, options);
+  return dedupePermissionGroups(permissionGroups);
+}
+async function listAccountOwnedAPITokens(accountId, options) {
+  const tokens = await apiGetAll(`/accounts/${accountId}/tokens`, options);
+  return tokens.map(mapAccountOwnedAPIToken);
+}
+async function deleteAccountOwnedAPIToken(accountId, tokenId, options) {
+  return apiDelete(`/accounts/${accountId}/tokens/${tokenId}`, options);
+}
+async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
+  return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
+}
+async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
+  const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroupIds);
+  if (permissionGroupIds.length === 0) {
+    throw new Error("Cannot create a Devflare token without any permission groups");
+  }
+  if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
+  }
+  const createdToken = await apiPost(`/accounts/${accountId}/tokens`, {
+    name: options.name,
+    policies: [
+      {
+        effect: "allow",
+        resources: {
+          [`com.cloudflare.api.account.${accountId}`]: "*"
+        },
+        permission_groups: permissionGroupIds.map((id) => ({ id }))
+      }
+    ]
+  }, clientOptions);
+  return mapAccountOwnedAPIToken(createdToken);
+}
+
+export { normalizeDevflareTokenName, stripDevflareTokenNamePrefix, filterDevflareManagedTokens, selectDevflarePermissionGroups, selectAllReusablePermissionGroups, listAccountTokenPermissionGroups, listAccountOwnedAPITokens, deleteAccountOwnedAPIToken, rollAccountOwnedAPITokenValue, createAccountOwnedAPIToken };