devflare 1.0.0-next.16 → 1.0.0-next.18

package/dist/index-5w77r4w9.js

@@ -0,0 +1,513 @@
+import {
+  ensureGeneratedDirectory,
+  getGeneratedArtifactPaths
+} from "./index-aabgympv.js";
+import {
+  getDependencies
+} from "./index-z9gy8w6b.js";
+import {
+  bundleWorkerEntry
+} from "./index-khbmdrn2.js";
+import {
+  detectViteProject
+} from "./index-gn5wy09x.js";
+import {
+  getPackageVersion
+} from "./index-6h8xbs75.js";
+import {
+  logLine
+} from "./index-stgn34cr.js";
+import {
+  resolvePackageSpecifier
+} from "./index-t4fhcx1n.js";
+import {
+  prepareComposedWorkerEntrypoint,
+  resolveEffectiveViteProject,
+  writeGeneratedViteConfig
+} from "./index-8t5gynct.js";
+import {
+  compileBuildConfig,
+  isolateViteBuildOutputPaths,
+  rebaseWranglerConfigPaths,
+  writeWranglerConfig
+} from "./index-ebwsvf9t.js";
+import {
+  loadConfig,
+  resolveConfigForEnvironment
+} from "./index-wnnbbbkt.js";
+import {
+  __require
+} from "./index-37x76zdn.js";
+
+// src/cli/deploy-strategy.ts
+function normalizeBranchScope(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function shouldIncludePreviewCrons(config) {
+  return config.previews?.includeCrons === true;
+}
+function omitQueueConsumers(config) {
+  if (!config.bindings?.queues?.consumers?.length) {
+    return config;
+  }
+  const nextBindings = {
+    ...config.bindings
+  };
+  const nextQueues = {
+    ...nextBindings.queues
+  };
+  delete nextQueues.consumers;
+  if (!nextQueues.producers || Object.keys(nextQueues.producers).length === 0) {
+    delete nextBindings.queues;
+  } else {
+    nextBindings.queues = nextQueues;
+  }
+  return {
+    ...config,
+    bindings: nextBindings
+  };
+}
+function omitCronTriggers(config) {
+  if (!config.triggers?.crons?.length) {
+    return config;
+  }
+  const nextTriggers = {
+    ...config.triggers
+  };
+  delete nextTriggers.crons;
+  if (Object.keys(nextTriggers).length === 0) {
+    const { triggers: _triggers, ...rest } = config;
+    return rest;
+  }
+  return {
+    ...config,
+    triggers: nextTriggers
+  };
+}
+function applyDeploymentStrategy(config, options = {}) {
+  const branchScope = normalizeBranchScope(options.previewBranch) ?? normalizeBranchScope(options.branchName);
+  const isBranchScopedPreviewDeploy = !options.preview && options.environment === "preview" && Boolean(branchScope);
+  if (!isBranchScopedPreviewDeploy) {
+    return {
+      config,
+      strategy: "default",
+      omittedResources: []
+    };
+  }
+  const omittedResources = [];
+  let nextConfig = config;
+  if (nextConfig.bindings?.queues?.consumers?.length) {
+    nextConfig = omitQueueConsumers(nextConfig);
+    omittedResources.push("queue-consumers");
+  }
+  if (!shouldIncludePreviewCrons(nextConfig) && nextConfig.triggers?.crons?.length) {
+    nextConfig = omitCronTriggers(nextConfig);
+    omittedResources.push("cron-triggers");
+  }
+  return {
+    config: nextConfig,
+    strategy: "preview-scope",
+    branchScope,
+    omittedResources
+  };
+}
+function describeDeploymentStrategy(result) {
+  if (result.strategy !== "preview-scope" || result.omittedResources.length === 0) {
+    return;
+  }
+  const labels = result.omittedResources.map((resource) => {
+    return resource === "queue-consumers" ? "queue consumers" : "cron triggers";
+  });
+  const formattedLabels = labels.length === 2 ? `${labels[0]} and ${labels[1]}` : labels[0];
+  const scopeSuffix = result.branchScope ? ` (${result.branchScope})` : "";
+  return `Named preview-scope deploy detected${scopeSuffix}; omitting shared ${formattedLabels} from the deployed Wrangler config to avoid singleton Cloudflare resource conflicts.`;
+}
+
+// src/cli/build-manifest.ts
+import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "pathe";
+var BUILD_MANIFEST_VERSION = 1;
+var BUILD_MANIFEST_FILENAME = "manifest.json";
+function hashSourceConfig(config) {
+  const normalized = JSON.stringify(config, (key, value) => {
+    if (key === "accountId")
+      return;
+    if (value === null || value === undefined)
+      return;
+    return value;
+  });
+  return createHash("sha256").update(normalized).digest("hex");
+}
+function summarizeBindings(config) {
+  const bindings = config.bindings ?? {};
+  return {
+    kv: Object.keys(bindings.kv ?? {}).sort(),
+    d1: Object.keys(bindings.d1 ?? {}).sort(),
+    r2: Object.keys(bindings.r2 ?? {}).sort(),
+    queues: Object.keys(bindings.queues ?? {}).sort(),
+    hyperdrive: Object.keys(bindings.hyperdrive ?? {}).sort(),
+    vectorize: Object.keys(bindings.vectorize ?? {}).sort(),
+    services: Object.keys(bindings.services ?? {}).sort()
+  };
+}
+function createBuildManifest(config, options) {
+  return {
+    manifestVersion: BUILD_MANIFEST_VERSION,
+    devflareVersion: options.devflareVersion,
+    createdAt: new Date().toISOString(),
+    sourceConfigHash: hashSourceConfig(config),
+    intendedTarget: options.intendedTarget,
+    bindingsSnapshot: summarizeBindings(config)
+  };
+}
+async function writeBuildManifest(buildDir, manifest) {
+  const manifestPath = resolve(buildDir, BUILD_MANIFEST_FILENAME);
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, "\t")}
+`, "utf-8");
+  return manifestPath;
+}
+async function readBuildManifest(buildDir) {
+  const manifestPath = resolve(buildDir, BUILD_MANIFEST_FILENAME);
+  try {
+    const raw = await readFile(manifestPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.manifestVersion !== "number")
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function targetsEqual(a, b) {
+  return a.environment === b.environment && a.preview === b.preview && a.previewScope === b.previewScope && a.branchName === b.branchName;
+}
+function compareManifests(previous, current) {
+  const prevBindings = new Set(Object.entries(previous.bindingsSnapshot).flatMap(([k, v]) => v.map((n) => `${k}:${n}`)));
+  const currBindings = new Set(Object.entries(current.bindingsSnapshot).flatMap(([k, v]) => v.map((n) => `${k}:${n}`)));
+  const bindingsAdded = [...currBindings].filter((b) => !prevBindings.has(b));
+  const bindingsRemoved = [...prevBindings].filter((b) => !currBindings.has(b));
+  return {
+    configChanged: previous.sourceConfigHash !== current.sourceConfigHash,
+    versionChanged: previous.devflareVersion !== current.devflareVersion,
+    targetChanged: !targetsEqual(previous.intendedTarget, current.intendedTarget),
+    previousVersion: previous.devflareVersion,
+    currentVersion: current.devflareVersion,
+    previousTarget: previous.intendedTarget,
+    currentTarget: current.intendedTarget,
+    bindingsAdded,
+    bindingsRemoved
+  };
+}
+function formatDriftWarning(drift) {
+  const lines = [];
+  if (drift.versionChanged) {
+    lines.push(`devflare version differs (built with ${drift.previousVersion}, deploying with ${drift.currentVersion})`);
+  }
+  if (drift.targetChanged) {
+    lines.push(`deployment target differs (built for ${formatTarget(drift.previousTarget)}, ` + `deploying as ${formatTarget(drift.currentTarget)})`);
+  }
+  if (drift.configChanged) {
+    lines.push("source config changed since build (devflare.config.ts hash differs)");
+  }
+  if (drift.bindingsAdded.length > 0) {
+    lines.push(`bindings added since build: ${drift.bindingsAdded.join(", ")}`);
+  }
+  if (drift.bindingsRemoved.length > 0) {
+    lines.push(`bindings removed since build: ${drift.bindingsRemoved.join(", ")}`);
+  }
+  if (lines.length === 0)
+    return null;
+  return [
+    "Build artefact drift detected:",
+    ...lines.map((line) => `  - ${line}`),
+    "Re-run `devflare build` to refresh the artefact, or pass --force to deploy anyway."
+  ].join(`
+`);
+}
+function formatTarget(t) {
+  const parts = [];
+  if (t.environment)
+    parts.push(`env=${t.environment}`);
+  parts.push(t.preview ? "preview" : "production");
+  if (t.previewScope)
+    parts.push(`scope=${t.previewScope}`);
+  if (t.branchName)
+    parts.push(`branch=${t.branchName}`);
+  return parts.join(" ");
+}
+
+// src/cli/commands/build-artifacts.ts
+import { dirname, relative, resolve as resolve2 } from "pathe";
+function getBuildArtifactPaths(cwd) {
+  return getGeneratedArtifactPaths(cwd);
+}
+function isNestedPath(parentPath, candidatePath) {
+  const normalizedParentPath = parentPath.replace(/\\/g, "/");
+  const normalizedCandidatePath = candidatePath.replace(/\\/g, "/");
+  return normalizedCandidatePath.startsWith(`${normalizedParentPath}/`);
+}
+function isolateViteBuildOutputPaths2(cwd, wranglerConfig) {
+  return isolateViteBuildOutputPaths(cwd, wranglerConfig);
+}
+function getViteBuildCleanupTargets(cwd, wranglerConfig) {
+  const targets = [];
+  const assetsDirectory = wranglerConfig.assets?.directory;
+  const mainEntry = wranglerConfig.main;
+  if (assetsDirectory) {
+    targets.push(resolve2(cwd, assetsDirectory));
+  }
+  if (mainEntry) {
+    const mainEntryPath = resolve2(cwd, mainEntry);
+    const isCoveredByAssetsDirectory = targets.some((targetPath) => {
+      return mainEntryPath === targetPath || isNestedPath(targetPath, mainEntryPath);
+    });
+    if (!isCoveredByAssetsDirectory) {
+      targets.push(mainEntryPath);
+    }
+  }
+  return targets;
+}
+function shouldRetryCleanup(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const errorCode = error.code;
+  return errorCode === "EBUSY" || errorCode === "EPERM" || errorCode === "ENOTEMPTY";
+}
+async function getCleanupFileSystem() {
+  return await import("node:fs/promises");
+}
+async function pathExists(cleanupFs, targetPath) {
+  try {
+    await cleanupFs.access(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDeferredCleanupPath(targetPath, uniqueSuffix) {
+  const suffix = uniqueSuffix ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  return `${targetPath}.devflare-stale-${suffix}`;
+}
+async function tryMoveLockedPathAside(targetPath, logger, cleanupFs) {
+  if (!await pathExists(cleanupFs, targetPath)) {
+    return true;
+  }
+  const deferredCleanupPath = createDeferredCleanupPath(targetPath);
+  try {
+    await cleanupFs.rename(targetPath, deferredCleanupPath);
+  } catch {
+    return false;
+  }
+  logger.warn(`Moved locked build output aside to ${deferredCleanupPath} after repeated cleanup failures; continuing build`);
+  try {
+    await cleanupFs.rm(deferredCleanupPath, {
+      recursive: true,
+      force: true
+    });
+  } catch (error) {
+    const cleanupErrorCode = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "an unknown error";
+    logger.warn(`Deferred cleanup for ${deferredCleanupPath} is still blocked by ${cleanupErrorCode}; you can remove it manually later`);
+  }
+  return true;
+}
+async function removePathWithRetries(targetPath, logger, attempts = 5, cleanupFs) {
+  const fs = cleanupFs ?? await getCleanupFileSystem();
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt++) {
+    try {
+      await fs.rm(targetPath, {
+        recursive: true,
+        force: true
+      });
+      return;
+    } catch (error) {
+      lastError = error;
+      if (!shouldRetryCleanup(error) || attempt === attempts) {
+        break;
+      }
+      logger.warn(`Retrying cleanup for ${targetPath} after ${error.code} (${attempt}/${attempts})`);
+      await new Promise((resolveRetry) => setTimeout(resolveRetry, attempt * 100));
+    }
+  }
+  if (shouldRetryCleanup(lastError) && await tryMoveLockedPathAside(targetPath, logger, fs)) {
+    return;
+  }
+  if (shouldRetryCleanup(lastError)) {
+    const cleanupErrorCode = lastError instanceof Error && "code" in lastError && typeof lastError.code === "string" ? lastError.code : "an unknown error";
+    logger.warn(`Continuing build without pre-clean for ${targetPath} because cleanup is still blocked by ${cleanupErrorCode}`);
+    return;
+  }
+  throw lastError;
+}
+async function cleanupViteBuildOutputs(cwd, wranglerConfig, logger) {
+  const cleanupTargets = getViteBuildCleanupTargets(cwd, wranglerConfig);
+  for (const cleanupTarget of cleanupTargets) {
+    await removePathWithRetries(cleanupTarget, logger);
+  }
+}
+async function writeDeployRedirect(cwd, generatedConfigPath) {
+  const fs = await import("node:fs/promises");
+  const paths = getBuildArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.deployDir);
+  const configPath = relative(paths.deployDir, generatedConfigPath).replace(/\\/g, "/");
+  await fs.writeFile(paths.deployRedirectPath, `${JSON.stringify({ configPath }, null, "\t")}
+`, "utf-8");
+}
+async function readDeployRedirect(cwd) {
+  const fs = await import("node:fs/promises");
+  const paths = getBuildArtifactPaths(cwd);
+  try {
+    const rawConfig = await fs.readFile(paths.deployRedirectPath, "utf-8");
+    const parsed = JSON.parse(rawConfig);
+    if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) {
+      return null;
+    }
+    return resolve2(dirname(paths.deployRedirectPath), parsed.configPath);
+  } catch {
+    return null;
+  }
+}
+async function writeGeneratedDeployWranglerConfig(cwd, wranglerConfig, options = {}) {
+  const paths = getBuildArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.buildDir, true);
+  const buildConfig = rebaseWranglerConfigPaths(cwd, paths.buildDir, wranglerConfig);
+  if (options.main) {
+    buildConfig.main = options.main;
+  }
+  await writeWranglerConfig(paths.buildDir, buildConfig, "wrangler.jsonc");
+  return paths.buildWranglerConfigPath;
+}
+async function writeGeneratedDevWranglerConfig(cwd, wranglerConfig) {
+  const paths = getGeneratedArtifactPaths(cwd);
+  await ensureGeneratedDirectory(paths.devflareDir, true);
+  const devConfig = rebaseWranglerConfigPaths(cwd, paths.devflareDir, wranglerConfig);
+  await writeWranglerConfig(paths.devflareDir, devConfig, "wrangler.jsonc");
+  return paths.devWranglerConfigPath;
+}
+async function buildWorkerOnlyDeployArtifact(cwd, wranglerConfig, config, logger) {
+  if (!wranglerConfig.main) {
+    return await writeGeneratedDeployWranglerConfig(cwd, wranglerConfig);
+  }
+  const paths = getBuildArtifactPaths(cwd);
+  const bundledMainEntryPath = await bundleWorkerEntry({
+    cwd,
+    inputFile: resolve2(cwd, wranglerConfig.main),
+    outFile: paths.buildWorkerPath,
+    rolldownOptions: config.rolldown?.options,
+    sourcemap: config.rolldown?.sourcemap,
+    minify: config.rolldown?.minify,
+    logger
+  });
+  logLine(logger, `Generated deploy artifact: ${relative(cwd, bundledMainEntryPath).replace(/\\/g, "/")}`);
+  return await writeGeneratedDeployWranglerConfig(cwd, wranglerConfig, {
+    main: "./worker.js"
+  });
+}
+async function resolveLocalViteExecutable(cwd, fs) {
+  const viteExecutablePath = resolvePackageSpecifier("vite/bin/vite.js", cwd);
+  try {
+    await fs.access(viteExecutablePath);
+  } catch {
+    throw new Error(`Could not resolve a local Vite CLI entrypoint from ${cwd}. Install vite in this package before running a Vite-backed Devflare build.`);
+  }
+  return viteExecutablePath;
+}
+async function prepareBuildArtifacts(parsed, logger, options) {
+  const cwd = options.cwd || process.cwd();
+  const configPath = parsed.options.config;
+  const environment = parsed.options.env;
+  const rawConfig = await loadConfig({ cwd, configFile: configPath });
+  const config = resolveConfigForEnvironment(rawConfig, environment);
+  logLine(logger, `Building: ${config.name}`);
+  const composedMainEntry = await prepareComposedWorkerEntrypoint(cwd, config, environment);
+  const deps = await getDependencies();
+  const viteProject = resolveEffectiveViteProject(await detectViteProject(cwd, deps.fs), config, environment);
+  const deploymentStrategy = applyDeploymentStrategy(config, {
+    environment,
+    preview: parsed.options.preview === true,
+    branchName: parsed.options["branch-name"],
+    previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+  });
+  const deploymentStrategyMessage = describeDeploymentStrategy(deploymentStrategy);
+  if (deploymentStrategyMessage) {
+    logLine(logger, deploymentStrategyMessage);
+  }
+  const devWranglerConfig = viteProject.shouldStartVite ? isolateViteBuildOutputPaths2(cwd, compileBuildConfig(config)) : compileBuildConfig(config);
+  const deployWranglerConfig = viteProject.shouldStartVite ? isolateViteBuildOutputPaths2(cwd, compileBuildConfig(deploymentStrategy.config)) : compileBuildConfig(deploymentStrategy.config);
+  if (viteProject.shouldStartVite) {
+    if (composedMainEntry) {
+      deployWranglerConfig.main = composedMainEntry;
+      logLine(logger, `Generated composed worker entry: ${composedMainEntry}`);
+    }
+  } else if (composedMainEntry) {
+    const bundledMainEntryPath = await bundleWorkerEntry({
+      cwd,
+      inputFile: resolve2(cwd, composedMainEntry),
+      outFile: resolve2(cwd, ".devflare", "worker-entrypoints", "main.js"),
+      rolldownOptions: config.rolldown?.options,
+      sourcemap: config.rolldown?.sourcemap,
+      minify: config.rolldown?.minify,
+      logger
+    });
+    const bundledMainPath = relative(cwd, bundledMainEntryPath).replace(/\\/g, "/");
+    devWranglerConfig.main = bundledMainPath;
+    deployWranglerConfig.main = bundledMainPath;
+    logLine(logger, `Generated bundled worker entry: ${bundledMainPath}`);
+  }
+  let deployConfigPath;
+  if (viteProject.shouldStartVite) {
+    const generatedViteConfigPath = await writeGeneratedViteConfig({
+      cwd,
+      configPath,
+      environment,
+      localConfigPath: viteProject.viteConfigPath
+    });
+    const viteExecutablePath = await resolveLocalViteExecutable(cwd, deps.fs);
+    await cleanupViteBuildOutputs(cwd, devWranglerConfig, logger);
+    logLine(logger, "Running vite build...");
+    const buildProc = await deps.exec.exec(viteExecutablePath, ["build", "--config", generatedViteConfigPath], {
+      cwd,
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        DEVFLARE_BUILD: "true"
+      }
+    });
+    if (buildProc.exitCode !== 0) {
+      throw new Error("Build failed");
+    }
+    const existingDeployConfigPath = await readDeployRedirect(cwd);
+    const generatedDeployConfigPath = deployWranglerConfig.main && deployWranglerConfig.main !== devWranglerConfig.main ? await buildWorkerOnlyDeployArtifact(cwd, deployWranglerConfig, config, logger) : await writeGeneratedDeployWranglerConfig(cwd, deployWranglerConfig);
+    deployConfigPath = existingDeployConfigPath && existingDeployConfigPath !== generatedDeployConfigPath ? existingDeployConfigPath : generatedDeployConfigPath;
+  } else {
+    logLine(logger, "Skipping Vite build (no effective Vite config found for this package)");
+    deployConfigPath = await buildWorkerOnlyDeployArtifact(cwd, deployWranglerConfig, config, logger);
+  }
+  const generatedDevConfigPath = await writeGeneratedDevWranglerConfig(cwd, devWranglerConfig);
+  logger.debug(`Generated dev Wrangler config: ${relative(cwd, generatedDevConfigPath).replace(/\\/g, "/")}`);
+  await writeDeployRedirect(cwd, deployConfigPath);
+  logLine(logger, `Generated deploy Wrangler config: ${relative(cwd, deployConfigPath).replace(/\\/g, "/")}`);
+  logLine(logger, `Generated deploy redirect: ${relative(cwd, getBuildArtifactPaths(cwd).deployRedirectPath).replace(/\\/g, "/")}`);
+  const manifest = createBuildManifest(rawConfig, {
+    devflareVersion: await getPackageVersion(),
+    intendedTarget: {
+      environment,
+      preview: parsed.options.preview === true,
+      previewScope: typeof parsed.options.preview === "string" ? parsed.options.preview : undefined,
+      branchName: parsed.options["branch-name"]
+    }
+  });
+  const manifestPath = await writeBuildManifest(getBuildArtifactPaths(cwd).buildDir, manifest);
+  logger.debug(`Generated build manifest: ${relative(cwd, manifestPath).replace(/\\/g, "/")}`);
+  return {
+    config,
+    wranglerConfig: deployWranglerConfig,
+    deployConfigPath,
+    viteProject
+  };
+}
+
+export { applyDeploymentStrategy, describeDeploymentStrategy, createBuildManifest, readBuildManifest, compareManifests, formatDriftWarning, prepareBuildArtifacts };

package/dist/index-62srkqcm.js

@@ -0,0 +1,168 @@
+import {
+  apiDelete,
+  apiGetAll,
+  apiPost,
+  apiPut
+} from "./index-hjz2x9nq.js";
+
+// src/cloudflare/tokens.ts
+var MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
+var DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
+var ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+var ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
+var DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
+var DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
+  /^Account Analytics Read$/i,
+  /^Account Settings Read$/i,
+  /^Analytics Read$/i,
+  /^AI /i,
+  /^Browser Rendering /i,
+  /^D1 (Metadata Read|Read|Write)$/i,
+  /^Email (Routing|Sending) /i,
+  /^Hyperdrive /i,
+  /^Queues /i,
+  /^Vectorize /i,
+  /^Workers /i
+];
+function dedupePermissionGroups(permissionGroups) {
+  const seenIds = new Set;
+  return permissionGroups.filter((permissionGroup) => {
+    if (seenIds.has(permissionGroup.id)) {
+      return false;
+    }
+    seenIds.add(permissionGroup.id);
+    return true;
+  });
+}
+function dedupePermissionGroupIds(permissionGroupIds) {
+  return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
+}
+function excludeAccountApiTokensPermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
+  });
+}
+function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return permissionGroup.scopes.some((scope) => scope.trim() === ACCOUNT_OWNED_TOKEN_SCOPE);
+  });
+}
+function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
+  return dedupePermissionGroups(excludeAccountApiTokensPermissionGroups(keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups)));
+}
+function parseOptionalDate(value) {
+  if (!value) {
+    return;
+  }
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+function mapAccountOwnedAPITokenPolicy(policy) {
+  return {
+    id: policy.id,
+    effect: policy.effect,
+    permissionGroups: policy.permission_groups?.map((permissionGroup) => ({
+      id: permissionGroup.id,
+      name: permissionGroup.name
+    }))
+  };
+}
+function mapAccountOwnedAPIToken(token) {
+  return {
+    id: token.id,
+    name: token.name ?? token.id,
+    status: token.status,
+    value: token.value,
+    issuedOn: parseOptionalDate(token.issued_on),
+    modifiedOn: parseOptionalDate(token.modified_on),
+    lastUsedOn: parseOptionalDate(token.last_used_on),
+    policies: token.policies?.map(mapAccountOwnedAPITokenPolicy)
+  };
+}
+function isDevflareManagedTokenName(name) {
+  return DEVFLARE_MANAGED_TOKEN_NAME_PATTERN.test(name.trim());
+}
+function normalizeDevflareTokenName(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  const suffix = isDevflareManagedTokenName(trimmedName) ? trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") : trimmedName;
+  if (!suffix) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  return `${DEVFLARE_MANAGED_TOKEN_PREFIX}${suffix}`;
+}
+function stripDevflareTokenNamePrefix(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    return trimmedName;
+  }
+  const strippedName = trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "");
+  return strippedName || trimmedName;
+}
+function filterDevflareManagedTokens(tokens) {
+  return tokens.filter((token) => isDevflareManagedTokenName(token.name));
+}
+function selectDevflarePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = dedupePermissionGroups(selectReusableAccountOwnedTokenPermissionGroups(permissionGroups).filter((permissionGroup) => {
+    return DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS.some((pattern) => {
+      return pattern.test(permissionGroup.name);
+    });
+  }));
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not map the available Cloudflare permission groups to a Devflare token policy.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+function selectAllReusablePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not find any reusable account-scoped Cloudflare permission groups for this Devflare token.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+async function listAccountTokenPermissionGroups(accountId, options) {
+  const permissionGroups = await apiGetAll(`/accounts/${accountId}/tokens/permission_groups`, options);
+  return dedupePermissionGroups(permissionGroups);
+}
+async function listAccountOwnedAPITokens(accountId, options) {
+  const tokens = await apiGetAll(`/accounts/${accountId}/tokens`, options);
+  return tokens.map(mapAccountOwnedAPIToken);
+}
+async function deleteAccountOwnedAPIToken(accountId, tokenId, options) {
+  return apiDelete(`/accounts/${accountId}/tokens/${tokenId}`, options);
+}
+async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
+  return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
+}
+async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
+  const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroupIds);
+  if (permissionGroupIds.length === 0) {
+    throw new Error("Cannot create a Devflare token without any permission groups");
+  }
+  if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
+  }
+  const createdToken = await apiPost(`/accounts/${accountId}/tokens`, {
+    name: options.name,
+    policies: [
+      {
+        effect: "allow",
+        resources: {
+          [`com.cloudflare.api.account.${accountId}`]: "*"
+        },
+        permission_groups: permissionGroupIds.map((id) => ({ id }))
+      }
+    ]
+  }, clientOptions);
+  return mapAccountOwnedAPIToken(createdToken);
+}
+
+export { normalizeDevflareTokenName, stripDevflareTokenNamePrefix, filterDevflareManagedTokens, selectDevflarePermissionGroups, selectAllReusablePermissionGroups, listAccountTokenPermissionGroups, listAccountOwnedAPITokens, deleteAccountOwnedAPIToken, rollAccountOwnedAPITokenValue, createAccountOwnedAPIToken };