devflare 1.0.0-next.24 → 1.0.0-next.27

package/LLM.md

@@ -6117,7 +6117,7 @@ That split matters because production inspection and production mutation are not
 ##### Highlights
 
 - **`worker rename`** — Renames the remote Worker when needed, updates the matching local config name when it can resolve that config safely, warns about remaining local references, and may leave existing preview URLs showing the old worker name until fresh preview uploads exist.
-- **`tokens`** — Creates, rolls, lists, and deletes Devflare-managed account-owned API tokens using a bootstrap token that already has token-management permissions. Cloudflare returns token secrets only once, so the first output matters.
+- **`tokens`** — Creates, rolls, lists, and deletes Devflare-managed account-owned API tokens using a bootstrap token that already has token-management permissions. Created tokens include the selected account and all zones in that account so deploys can manage Worker route and custom-domain state. Cloudflare returns token secrets only once, so the first output matters.
 - **`ai`** — Prints the built-in Workers AI pricing snapshot bundled with the current Devflare build. It is a reference command, not a live account-state query, so confirm current rates in Cloudflare docs when the numbers matter.
 
 ##### Key points

package/dist/{account-5nm1xn0v.js → account-xdecqqyq.js}

@@ -3,8 +3,8 @@ import {
 } from "./index-ftf7yqhs.js";
 import {
   account
-} from "./index-0m6e4mxz.js";
-import"./index-k7m5f1dg.js";
+} from "./index-qmmqww7h.js";
+import"./index-11p28kxx.js";
 import"./index-3jme4hgw.js";
 import {
   bold,

package/dist/cli/help-pages/pages/misc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../../../src/cli/help-pages/pages/misc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAMxC,eAAO,MAAM,eAAe,EAAE,QAAQ,EA+KrC,CAAA"}
+{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../../../src/cli/help-pages/pages/misc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAMxC,eAAO,MAAM,eAAe,EAAE,QAAQ,EAgLrC,CAAA"}

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 import {
   parseArgs,
   runCli
-} from "../index-rnz879kf.js";
+} from "../index-v1mxy6be.js";
 import"../index-627srx16.js";
 import"../index-stgn34cr.js";
 import"../index-3t6rypgc.js";

package/dist/cloudflare/index.js

@@ -1,7 +1,7 @@
 import {
   account
-} from "../index-0m6e4mxz.js";
-import"../index-k7m5f1dg.js";
+} from "../index-qmmqww7h.js";
+import"../index-11p28kxx.js";
 import {
   DEVFLARE_PREVIEW_REGISTRY_DATABASE,
   cleanupPreviewRegistry,

package/dist/cloudflare/tokens.d.ts

@@ -24,6 +24,7 @@ export declare function matchesKnownPermissionGroup(symbolicName: KnownPermissio
     knownIds?: Record<string, string | undefined>;
     knownDisplayNames?: Record<string, string>;
 }): boolean;
+type ScopedPermissionGroup = Pick<AccountTokenPermissionGroup, 'id' | 'scopes'>;
 export declare function isDevflareManagedTokenName(name: string): boolean;
 export declare function normalizeDevflareTokenName(name: string): string;
 export declare function stripDevflareTokenNamePrefix(name: string): string;
@@ -36,6 +37,8 @@ export declare function deleteAccountOwnedAPIToken(accountId: string, tokenId: s
 export declare function rollAccountOwnedAPITokenValue(accountId: string, tokenId: string, options?: APIClientOptions): Promise<string>;
 export declare function createAccountOwnedAPIToken(accountId: string, options: {
     name: string;
-    permissionGroupIds: string[];
+    permissionGroupIds?: string[];
+    permissionGroups?: ScopedPermissionGroup[];
 }, clientOptions?: APIClientOptions): Promise<AccountOwnedAPIToken>;
+export {};
 //# sourceMappingURL=tokens.d.ts.map

package/dist/cloudflare/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/cloudflare/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAEpF,OAAO,KAAK,EACX,oBAAoB,EACpB,gCAAgC,EAEhC,2BAA2B,EAC3B,MAAM,SAAS,CAAA;AAGhB,eAAO,MAAM,6BAA6B,cAAc,CAAA;AAsExD,eAAO,MAAM,0BAA0B,0NAEO,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAE,MAAM,CACxD,MAAM,OAAO,0BAA0B,EACvC,MAAM,CASN,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,0BAA0B,CAAA;AAE9E;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAC1C,YAAY,EAAE,wBAAwB,EACtC,eAAe,EAAE,IAAI,CAAC,2BAA2B,EAAE,IAAI,GAAG,MAAM,CAAC,EACjE,OAAO,CAAC,EAAE;IACT,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC1C,GACC,OAAO,CAqBT;AA2GD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAe/D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,oBAAoB,EAAE,GAC5B,oBAAoB,EAAE,CAExB;AAED,wBAAgB,8BAA8B,CAC7C,gBAAgB,EAAE,2BAA2B,EAAE,GAC7C,2BAA2B,EAAE,CAoB/B;AAED,wBAAgB,iCAAiC,CAChD,gBAAgB,EAAE,2BAA2B,EAAE,GAC7C,2BAA2B,EAAE,CAgB/B;AAED,wBAAsB,gCAAgC,CACrD,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAOxC;AAED,wBAAsB,yBAAyB,CAC9C,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAGjC;AAED,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,gCAAgC,CAAC,CAE3C;AAED,wBAAsB,6BAA6B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IACR,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC5B,EACD,aAAa,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA+B/B"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/cloudflare/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAEpF,OAAO,KAAK,EACX,oBAAoB,EACpB,gCAAgC,EAEhC,2BAA2B,EAC3B,MAAM,SAAS,CAAA;AAGhB,eAAO,MAAM,6BAA6B,cAAc,CAAA;AAuExD,eAAO,MAAM,0BAA0B,0NAEO,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAE,MAAM,CACxD,MAAM,OAAO,0BAA0B,EACvC,MAAM,CASN,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,0BAA0B,CAAA;AAE9E;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAC1C,YAAY,EAAE,wBAAwB,EACtC,eAAe,EAAE,IAAI,CAAC,2BAA2B,EAAE,IAAI,GAAG,MAAM,CAAC,EACjE,OAAO,CAAC,EAAE;IACT,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC1C,GACC,OAAO,CAqBT;AAiCD,KAAK,qBAAqB,GAAG,IAAI,CAAC,2BAA2B,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAA;AA2K/E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAe/D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,oBAAoB,EAAE,GAC5B,oBAAoB,EAAE,CAExB;AAED,wBAAgB,8BAA8B,CAC7C,gBAAgB,EAAE,2BAA2B,EAAE,GAC7C,2BAA2B,EAAE,CAoB/B;AAED,wBAAgB,iCAAiC,CAChD,gBAAgB,EAAE,2BAA2B,EAAE,GAC7C,2BAA2B,EAAE,CAgB/B;AAED,wBAAsB,gCAAgC,CACrD,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAOxC;AAED,wBAAsB,yBAAyB,CAC9C,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAGjC;AAED,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,gCAAgC,CAAC,CAE3C;AAED,wBAAsB,6BAA6B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IACR,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,gBAAgB,CAAC,EAAE,qBAAqB,EAAE,CAAA;CAC1C,EACD,aAAa,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAmC/B"}

package/dist/{index-k7m5f1dg.js → index-11p28kxx.js}

@@ -20,6 +20,7 @@ var KNOWN_PERMISSION_GROUP_IDS_DATA = {
 var MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
 var DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
 var ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+var ACCOUNT_ZONE_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account.zone";
 var ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
 var DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
 var DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
@@ -69,6 +70,62 @@ function dedupePermissionGroups(permissionGroups) {
 function dedupePermissionGroupIds(permissionGroupIds) {
   return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
 }
+function dedupeScopedPermissionGroups(permissionGroups) {
+  const seenIds = new Set;
+  return permissionGroups.filter((permissionGroup) => {
+    const id = permissionGroup.id.trim();
+    if (!id || seenIds.has(id)) {
+      return false;
+    }
+    seenIds.add(id);
+    return true;
+  });
+}
+function permissionGroupHasScope(permissionGroup, scope) {
+  return permissionGroup.scopes.some((value) => value.trim() === scope);
+}
+function buildCreateTokenPoliciesFromPermissionGroups(accountId, permissionGroups) {
+  const dedupedPermissionGroups = dedupeScopedPermissionGroups(permissionGroups);
+  const accountPermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+  const zonePermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_ZONE_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+  const policies = [];
+  if (accountPermissionGroupIds.length > 0) {
+    policies.push({
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: "*"
+      },
+      permission_groups: accountPermissionGroupIds.map((id) => ({ id }))
+    });
+  }
+  if (zonePermissionGroupIds.length > 0) {
+    policies.push({
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: {
+          [`${ACCOUNT_ZONE_OWNED_TOKEN_SCOPE}.*`]: "*"
+        }
+      },
+      permission_groups: zonePermissionGroupIds.map((id) => ({ id }))
+    });
+  }
+  return policies;
+}
+function buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds) {
+  const dedupedPermissionGroupIds = dedupePermissionGroupIds(permissionGroupIds);
+  if (dedupedPermissionGroupIds.length === 0) {
+    return [];
+  }
+  return [
+    {
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: "*"
+      },
+      permission_groups: dedupedPermissionGroupIds.map((id) => ({ id }))
+    }
+  ];
+}
 function excludeAccountApiTokensPermissionGroups(permissionGroups) {
   return permissionGroups.filter((permissionGroup) => {
     return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
@@ -76,7 +133,10 @@ function excludeAccountApiTokensPermissionGroups(permissionGroups) {
 }
 function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
   return permissionGroups.filter((permissionGroup) => {
-    return permissionGroup.scopes.some((scope) => scope.trim() === ACCOUNT_OWNED_TOKEN_SCOPE);
+    return permissionGroup.scopes.some((scope) => {
+      const normalizedScope = scope.trim();
+      return normalizedScope === ACCOUNT_OWNED_TOKEN_SCOPE || normalizedScope === ACCOUNT_ZONE_OWNED_TOKEN_SCOPE;
+    });
   });
 }
 function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
@@ -153,7 +213,7 @@ function selectDevflarePermissionGroups(permissionGroups) {
 function selectAllReusablePermissionGroups(permissionGroups) {
   const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
   if (selectedPermissionGroups.length === 0) {
-    throw new Error("Could not find any reusable account-scoped Cloudflare permission groups for this Devflare token.");
+    throw new Error("Could not find any reusable account/zone-scoped Cloudflare permission groups for this Devflare token.");
   }
   if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
     throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
@@ -175,24 +235,20 @@ async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
   return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
 }
 async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
-  const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroupIds);
+  const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroups?.map((permissionGroup) => permissionGroup.id) ?? options.permissionGroupIds ?? []);
   if (permissionGroupIds.length === 0) {
     throw new Error("Cannot create a Devflare token without any permission groups");
   }
   if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
     throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
   }
+  const policies = options.permissionGroups ? buildCreateTokenPoliciesFromPermissionGroups(accountId, options.permissionGroups) : buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds);
+  if (policies.length === 0) {
+    throw new Error("Cannot create a Devflare token without any account- or zone-scoped permission groups");
+  }
   const createdToken = await apiPost(`/accounts/${accountId}/tokens`, {
     name: options.name,
-    policies: [
-      {
-        effect: "allow",
-        resources: {
-          [`com.cloudflare.api.account.${accountId}`]: "*"
-        },
-        permission_groups: permissionGroupIds.map((id) => ({ id }))
-      }
-    ]
+    policies
   }, clientOptions);
   return mapAccountOwnedAPIToken(createdToken);
 }

package/dist/{index-0m6e4mxz.js → index-qmmqww7h.js}

@@ -4,7 +4,7 @@ import {
   listAccountOwnedAPITokens,
   listAccountTokenPermissionGroups,
   normalizeDevflareTokenName
-} from "./index-k7m5f1dg.js";
+} from "./index-11p28kxx.js";
 import {
   DEVFLARE_PREVIEW_REGISTRY_DATABASE,
   cleanupPreviewRegistry,

package/dist/{index-rnz879kf.js → index-v1mxy6be.js}

@@ -774,7 +774,7 @@ var MISC_HELP_PAGES = [
       entry("--delete [name]", "Delete a Devflare-managed token by name"),
       entry("--delete-all", "Delete every Devflare-managed token in the selected account"),
       entry("--account <id>", "Use a specific Cloudflare account"),
-      entry("--all-flags", "With `--new`, include every reusable account-scoped permission group")
+      entry("--all-flags", "With `--new`, include every reusable account/zone-scoped permission group")
     ],
     examples: [
       entry("devflare tokens $BOOTSTRAP --list", "List managed tokens"),
@@ -783,6 +783,7 @@ var MISC_HELP_PAGES = [
       entry("devflare tokens $BOOTSTRAP --delete-all", "Delete every Devflare-managed token for the selected account")
     ],
     notes: [
+      "Created tokens include the selected account resource and all zones in that account so deploys can manage Worker routes and custom-domain route state.",
       "Cloudflare only returns token secrets once for create and roll operations, so store them immediately."
     ]
   },
@@ -1387,27 +1388,27 @@ async function runConfig(parsed, logger, options) {
   return runConfigCommand(parsed, logger, options);
 }
 async function runAccount(parsed, logger, options) {
-  const { runAccountCommand } = await import("./account-5nm1xn0v.js");
+  const { runAccountCommand } = await import("./account-xdecqqyq.js");
   return runAccountCommand(parsed, logger, options);
 }
 async function runLogin(parsed, logger, options) {
-  const { runLoginCommand } = await import("./login-g9rb7dj3.js");
+  const { runLoginCommand } = await import("./login-hktzadbg.js");
   return runLoginCommand(parsed, logger, options);
 }
 async function runPreviews(parsed, logger, options) {
-  const { runPreviewsCommand } = await import("./previews-ykamw25e.js");
+  const { runPreviewsCommand } = await import("./previews-cn10r4zc.js");
   return runPreviewsCommand(parsed, logger, options);
 }
 async function runProductions(parsed, logger, options) {
-  const { runProductionsCommand } = await import("./productions-4m1pd6ts.js");
+  const { runProductionsCommand } = await import("./productions-8p2y4hb4.js");
   return runProductionsCommand(parsed, logger, options);
 }
 async function runWorker(parsed, logger, options) {
-  const { runWorkerCommand } = await import("./worker-4fd49jm0.js");
+  const { runWorkerCommand } = await import("./worker-xh4njxfh.js");
   return runWorkerCommand(parsed, logger, options);
 }
 async function runToken(parsed, logger, options) {
-  const { runTokenCommand } = await import("./token-a2b38w0z.js");
+  const { runTokenCommand } = await import("./token-35jcdqq8.js");
   return runTokenCommand(parsed, logger, options);
 }
 async function runSecrets(parsed, logger, options) {

package/dist/index.js

@@ -4,7 +4,7 @@ import {
 import {
   parseArgs,
   runCli
-} from "./index-rnz879kf.js";
+} from "./index-v1mxy6be.js";
 import"./index-627srx16.js";
 import"./index-stgn34cr.js";
 import"./index-3t6rypgc.js";

package/dist/{login-g9rb7dj3.js → login-hktzadbg.js}

@@ -3,8 +3,8 @@ import {
 } from "./index-ftf7yqhs.js";
 import {
   account
-} from "./index-0m6e4mxz.js";
-import"./index-k7m5f1dg.js";
+} from "./index-qmmqww7h.js";
+import"./index-11p28kxx.js";
 import"./index-3jme4hgw.js";
 import {
   getDependencies

package/dist/{previews-ykamw25e.js → previews-cn10r4zc.js}

@@ -18,8 +18,8 @@ import {
 } from "./index-ftf7yqhs.js";
 import {
   account
-} from "./index-0m6e4mxz.js";
-import"./index-k7m5f1dg.js";
+} from "./index-qmmqww7h.js";
+import"./index-11p28kxx.js";
 import"./index-3jme4hgw.js";
 import {
   getDependencies

package/dist/{productions-4m1pd6ts.js → productions-8p2y4hb4.js}

@@ -8,8 +8,8 @@ import {
 } from "./index-ftf7yqhs.js";
 import {
   account
-} from "./index-0m6e4mxz.js";
-import"./index-k7m5f1dg.js";
+} from "./index-qmmqww7h.js";
+import"./index-11p28kxx.js";
 import"./index-3jme4hgw.js";
 import {
   getDependencies

package/dist/{token-sct51r47.js → token-35jcdqq8.js}

@@ -9,7 +9,7 @@ import {
   selectAllReusablePermissionGroups,
   selectDevflarePermissionGroups,
   stripDevflareTokenNamePrefix
-} from "./index-yjhns95b.js";
+} from "./index-11p28kxx.js";
 import {
   createCliTheme,
   dim,
@@ -39,7 +39,7 @@ var TOKEN_OPERATION_SUMMARY_LINES = [
   "--roll [name]      Roll a Devflare-managed account-owned token secret",
   "--delete [name]    Delete a Devflare-managed account-owned token",
   "--delete-all       Delete every Devflare-managed account-owned token",
-  "--all-flags        With --new, include every reusable account-scoped permission group"
+  "--all-flags        With --new, include every reusable account/zone-scoped permission group"
 ];
 function getTrimmedStringOption(options, key) {
   const value = options[key];
@@ -214,7 +214,7 @@ async function createManagedToken(accountId, accountSource, bootstrapToken, requ
   const selectedPermissionGroups = includeAllFlags ? selectAllReusablePermissionGroups(permissionGroups) : selectDevflarePermissionGroups(permissionGroups);
   const createdToken = await createAccountOwnedAPIToken(accountId, {
     name: tokenName,
-    permissionGroupIds: selectedPermissionGroups.map((group) => group.id)
+    permissionGroups: selectedPermissionGroups
   }, {
     ...CLI_API_OPTIONS,
     token: bootstrapToken
@@ -224,9 +224,9 @@ async function createManagedToken(accountId, accountSource, bootstrapToken, requ
     return { exitCode: 1 };
   }
   logger.success(`Created ${createdToken.name || tokenName}`);
-  logLine(logger, `${dim("Permission groups:", theme)} ${selectedPermissionGroups.length} ${includeAllFlags ? "reusable account-scoped" : "Devflare-relevant account-scoped"} selected from ${permissionGroups.length} available`);
+  logLine(logger, `${dim("Permission groups:", theme)} ${selectedPermissionGroups.length} ${includeAllFlags ? "reusable account/zone-scoped" : "Devflare-relevant account/zone-scoped"} selected from ${permissionGroups.length} available`);
   if (includeAllFlags) {
-    logLine(logger, dim("Account-owned tokens only accept account-scoped permission groups, so zone/user-scoped groups are skipped automatically.", theme));
+    logLine(logger, dim("Account-owned Devflare tokens include account resources plus all zones in the account; user-scoped groups are skipped automatically.", theme));
     logLine(logger, dim("Account API Tokens permissions are still excluded because Cloudflare does not allow sub-tokens to manage other tokens.", theme));
   }
   logger.warn("Cloudflare only returns the token secret once. Store it safely now.");

package/dist/{worker-4fd49jm0.js → worker-xh4njxfh.js}

@@ -9,8 +9,8 @@ import {
 } from "./index-ftf7yqhs.js";
 import {
   account
-} from "./index-0m6e4mxz.js";
-import"./index-k7m5f1dg.js";
+} from "./index-qmmqww7h.js";
+import"./index-11p28kxx.js";
 import"./index-3jme4hgw.js";
 import {
   bold,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "devflare",
-	"version": "1.0.0-next.24",
+	"version": "1.0.0-next.27",
 	"description": "Devflare is a developer-first toolkit for Cloudflare Workers that sits on top of Miniflare and Wrangler-compatible config",
 	"type": "module",
 	"main": "./dist/index.js",
@@ -60,7 +60,8 @@
 	"scripts": {
 		"llm:generate": "bun ./scripts/generate-llm.ts",
 		"refresh-permission-groups": "bun ./scripts/refresh-permission-groups.ts",
-		"build": "bun build ./src/index.ts ./src/browser.ts ./src/config-entry.ts ./src/cli/index.ts ./src/runtime/index.ts ./src/test/index.ts ./src/vite/index.ts ./src/sveltekit/index.ts ./src/cloudflare/index.ts ./src/decorators/index.ts ./src/utils/send-email.ts --root ./src --outdir ./dist --splitting --target node --packages=external && tsgo --declaration --emitDeclarationOnly --noEmit false --outDir ./dist",
+		"clean:dist": "bun ./scripts/clean-dist.ts",
+		"build": "bun run clean:dist && bun build ./src/index.ts ./src/browser.ts ./src/config-entry.ts ./src/cli/index.ts ./src/runtime/index.ts ./src/test/index.ts ./src/vite/index.ts ./src/sveltekit/index.ts ./src/cloudflare/index.ts ./src/decorators/index.ts ./src/utils/send-email.ts --root ./src --outdir ./dist --splitting --target node --packages=external && tsgo --declaration --emitDeclarationOnly --noEmit false --outDir ./dist",
 		"dev": "bun --watch ./src/cli/index.ts",
 		"prepack": "bun run llm:generate",
 		"test": "bun run test:unit && bun run test:integration:control && bun run test:integration:bridge && bun run test:integration:test-context && bun run test:integration:dev-server",