devflare 1.0.0-next.3 → 1.0.0-next.30

package/dist/index-11p28kxx.js

@@ -0,0 +1,256 @@
+import {
+  apiDelete,
+  apiGetAll,
+  apiPost,
+  apiPut
+} from "./index-mg8vwqxf.js";
+
+// src/cloudflare/known-permission-group-ids.generated.ts
+var KNOWN_PERMISSION_GROUP_IDS_DATA = {
+  WORKERS_SCRIPTS_WRITE: null,
+  WORKERS_SCRIPTS_READ: null,
+  ACCOUNT_SETTINGS_READ: null,
+  WORKERS_KV_STORAGE_WRITE: null,
+  WORKERS_KV_STORAGE_READ: null,
+  ACCOUNT_API_TOKENS_WRITE: null,
+  ACCOUNT_API_TOKENS_READ: null
+};
+
+// src/cloudflare/tokens.ts
+var MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
+var DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
+var ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+var ACCOUNT_ZONE_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account.zone";
+var ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
+var DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
+var DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
+  /^Account Analytics /i,
+  /^Account Settings /i,
+  /^Account Filter Lists /i,
+  /^AI /i,
+  /^Analytics /i,
+  /^Browser Rendering /i,
+  /^Cache Purge\b/i,
+  /^D1 /i,
+  /^DNS /i,
+  /^Email /i,
+  /^Hyperdrive /i,
+  /^Images /i,
+  /^Logs /i,
+  /^Logpush /i,
+  /^Pages /i,
+  /^Queues /i,
+  /^R2 /i,
+  /^SSL and Certificates /i,
+  /^Stream /i,
+  /^Vectorize /i,
+  /^Workers /i,
+  /^Zone Settings /i,
+  /^Zone /i
+];
+function deriveKnownPermissionGroupIds(data) {
+  const result = {};
+  for (const key of Object.keys(data)) {
+    const value = data[key];
+    result[key] = value === null ? undefined : value;
+  }
+  return result;
+}
+var KNOWN_PERMISSION_GROUP_IDS = deriveKnownPermissionGroupIds(KNOWN_PERMISSION_GROUP_IDS_DATA);
+function dedupePermissionGroups(permissionGroups) {
+  const seenIds = new Set;
+  return permissionGroups.filter((permissionGroup) => {
+    if (seenIds.has(permissionGroup.id)) {
+      return false;
+    }
+    seenIds.add(permissionGroup.id);
+    return true;
+  });
+}
+function dedupePermissionGroupIds(permissionGroupIds) {
+  return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
+}
+function dedupeScopedPermissionGroups(permissionGroups) {
+  const seenIds = new Set;
+  return permissionGroups.filter((permissionGroup) => {
+    const id = permissionGroup.id.trim();
+    if (!id || seenIds.has(id)) {
+      return false;
+    }
+    seenIds.add(id);
+    return true;
+  });
+}
+function permissionGroupHasScope(permissionGroup, scope) {
+  return permissionGroup.scopes.some((value) => value.trim() === scope);
+}
+function buildCreateTokenPoliciesFromPermissionGroups(accountId, permissionGroups) {
+  const dedupedPermissionGroups = dedupeScopedPermissionGroups(permissionGroups);
+  const accountPermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+  const zonePermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_ZONE_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+  const policies = [];
+  if (accountPermissionGroupIds.length > 0) {
+    policies.push({
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: "*"
+      },
+      permission_groups: accountPermissionGroupIds.map((id) => ({ id }))
+    });
+  }
+  if (zonePermissionGroupIds.length > 0) {
+    policies.push({
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: {
+          [`${ACCOUNT_ZONE_OWNED_TOKEN_SCOPE}.*`]: "*"
+        }
+      },
+      permission_groups: zonePermissionGroupIds.map((id) => ({ id }))
+    });
+  }
+  return policies;
+}
+function buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds) {
+  const dedupedPermissionGroupIds = dedupePermissionGroupIds(permissionGroupIds);
+  if (dedupedPermissionGroupIds.length === 0) {
+    return [];
+  }
+  return [
+    {
+      effect: "allow",
+      resources: {
+        [`com.cloudflare.api.account.${accountId}`]: "*"
+      },
+      permission_groups: dedupedPermissionGroupIds.map((id) => ({ id }))
+    }
+  ];
+}
+function excludeAccountApiTokensPermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
+  });
+}
+function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
+  return permissionGroups.filter((permissionGroup) => {
+    return permissionGroup.scopes.some((scope) => {
+      const normalizedScope = scope.trim();
+      return normalizedScope === ACCOUNT_OWNED_TOKEN_SCOPE || normalizedScope === ACCOUNT_ZONE_OWNED_TOKEN_SCOPE;
+    });
+  });
+}
+function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
+  return dedupePermissionGroups(excludeAccountApiTokensPermissionGroups(keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups)));
+}
+function parseOptionalDate(value) {
+  if (!value) {
+    return;
+  }
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+function mapAccountOwnedAPITokenPolicy(policy) {
+  return {
+    id: policy.id,
+    effect: policy.effect,
+    permissionGroups: policy.permission_groups?.map((permissionGroup) => ({
+      id: permissionGroup.id,
+      name: permissionGroup.name
+    }))
+  };
+}
+function mapAccountOwnedAPIToken(token) {
+  return {
+    id: token.id,
+    name: token.name ?? token.id,
+    status: token.status,
+    value: token.value,
+    issuedOn: parseOptionalDate(token.issued_on),
+    modifiedOn: parseOptionalDate(token.modified_on),
+    lastUsedOn: parseOptionalDate(token.last_used_on),
+    policies: token.policies?.map(mapAccountOwnedAPITokenPolicy)
+  };
+}
+function isDevflareManagedTokenName(name) {
+  return DEVFLARE_MANAGED_TOKEN_NAME_PATTERN.test(name.trim());
+}
+function normalizeDevflareTokenName(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  const suffix = isDevflareManagedTokenName(trimmedName) ? trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") : trimmedName;
+  if (!suffix) {
+    throw new Error("Devflare token name cannot be empty");
+  }
+  return `${DEVFLARE_MANAGED_TOKEN_PREFIX}${suffix}`;
+}
+function stripDevflareTokenNamePrefix(name) {
+  const trimmedName = name.trim();
+  if (!trimmedName) {
+    return trimmedName;
+  }
+  const strippedName = trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "");
+  return strippedName || trimmedName;
+}
+function filterDevflareManagedTokens(tokens) {
+  return tokens.filter((token) => isDevflareManagedTokenName(token.name));
+}
+function selectDevflarePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = dedupePermissionGroups(selectReusableAccountOwnedTokenPermissionGroups(permissionGroups).filter((permissionGroup) => {
+    return DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS.some((pattern) => {
+      return pattern.test(permissionGroup.name);
+    });
+  }));
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not map the available Cloudflare permission groups to a Devflare token policy.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+function selectAllReusablePermissionGroups(permissionGroups) {
+  const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
+  if (selectedPermissionGroups.length === 0) {
+    throw new Error("Could not find any reusable account/zone-scoped Cloudflare permission groups for this Devflare token.");
+  }
+  if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+  }
+  return selectedPermissionGroups;
+}
+async function listAccountTokenPermissionGroups(accountId, options) {
+  const permissionGroups = await apiGetAll(`/accounts/${accountId}/tokens/permission_groups`, options);
+  return dedupePermissionGroups(permissionGroups);
+}
+async function listAccountOwnedAPITokens(accountId, options) {
+  const tokens = await apiGetAll(`/accounts/${accountId}/tokens`, options);
+  return tokens.map(mapAccountOwnedAPIToken);
+}
+async function deleteAccountOwnedAPIToken(accountId, tokenId, options) {
+  return apiDelete(`/accounts/${accountId}/tokens/${tokenId}`, options);
+}
+async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
+  return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
+}
+async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
+  const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroups?.map((permissionGroup) => permissionGroup.id) ?? options.permissionGroupIds ?? []);
+  if (permissionGroupIds.length === 0) {
+    throw new Error("Cannot create a Devflare token without any permission groups");
+  }
+  if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) {
+    throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
+  }
+  const policies = options.permissionGroups ? buildCreateTokenPoliciesFromPermissionGroups(accountId, options.permissionGroups) : buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds);
+  if (policies.length === 0) {
+    throw new Error("Cannot create a Devflare token without any account- or zone-scoped permission groups");
+  }
+  const createdToken = await apiPost(`/accounts/${accountId}/tokens`, {
+    name: options.name,
+    policies
+  }, clientOptions);
+  return mapAccountOwnedAPIToken(createdToken);
+}
+
+export { normalizeDevflareTokenName, stripDevflareTokenNamePrefix, filterDevflareManagedTokens, selectDevflarePermissionGroups, selectAllReusablePermissionGroups, listAccountTokenPermissionGroups, listAccountOwnedAPITokens, deleteAccountOwnedAPIToken, rollAccountOwnedAPITokenValue, createAccountOwnedAPIToken };

package/dist/index-15fpa5tx.js

@@ -0,0 +1,232 @@
+import {
+  DEVFLARE_KV_NAMESPACE_TITLE,
+  getEffectiveAccountId,
+  getOrCreateNamedKVNamespace,
+  getPrimaryAccount
+} from "./index-1d4jg11n.js";
+import {
+  isAuthenticated,
+  kvGet,
+  kvPut
+} from "./index-mg8vwqxf.js";
+
+// src/cloudflare/usage.ts
+var USAGE_KEY_PREFIX = "usage:";
+var LIMITS_KEY = "limits";
+var DEFAULT_LIMITS = {
+  aiTokensPerDay: 1e4,
+  aiRequestsPerDay: 100,
+  vectorizeOpsPerDay: 1000,
+  enabled: true
+};
+async function getOrCreateUsageNamespace(accountId) {
+  return getOrCreateNamedKVNamespace(accountId, DEVFLARE_KV_NAMESPACE_TITLE);
+}
+function getTodayDate() {
+  return new Date().toISOString().split("T")[0];
+}
+function buildUsageKey(service, date) {
+  return `${USAGE_KEY_PREFIX}${service}:${date}`;
+}
+async function getUsage(accountId, service, date) {
+  const targetDate = date ?? getTodayDate();
+  const namespaceId = await getOrCreateUsageNamespace(accountId);
+  const key = buildUsageKey(service, targetDate);
+  const value = await kvGet(accountId, namespaceId, key);
+  if (value === null) {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+var MAX_RECORD_USAGE_ATTEMPTS = 5;
+async function recordUsage(accountId, service, count = 1, deps = {}) {
+  const kvGetFn = deps.kvGet ?? kvGet;
+  const kvPutFn = deps.kvPut ?? kvPut;
+  const getNamespaceId = deps.getNamespaceId ?? getOrCreateUsageNamespace;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? (() => new Date);
+  const maxAttempts = deps.maxAttempts ?? MAX_RECORD_USAGE_ATTEMPTS;
+  const warn = deps.warn ?? ((message) => console.warn(message));
+  const today = now().toISOString().split("T")[0];
+  const namespaceId = await getNamespaceId(accountId);
+  const key = buildUsageKey(service, today);
+  let lastWritten = null;
+  let lastObserved = null;
+  for (let attempt = 0;attempt < maxAttempts; attempt++) {
+    const existingRaw = await kvGetFn(accountId, namespaceId, key);
+    let existing = null;
+    if (existingRaw !== null) {
+      try {
+        existing = JSON.parse(existingRaw);
+      } catch {
+        existing = null;
+      }
+    }
+    lastObserved = existing;
+    const record = {
+      service,
+      date: today,
+      count: (existing?.count ?? 0) + count,
+      updatedAt: now().toISOString()
+    };
+    await kvPutFn(accountId, namespaceId, key, JSON.stringify(record));
+    lastWritten = record;
+    const verifyRaw = await kvGetFn(accountId, namespaceId, key);
+    if (verifyRaw !== null) {
+      try {
+        const verify = JSON.parse(verifyRaw);
+        if (verify.updatedAt === record.updatedAt && verify.count === record.count) {
+          return record;
+        }
+      } catch {}
+    }
+    if (attempt < maxAttempts - 1) {
+      const backoffMs = Math.min(25 * 2 ** attempt, 400);
+      await sleep(backoffMs);
+    }
+  }
+  warn(`[devflare] recordUsage: could not confirm usage write for ${service} after ${maxAttempts} attempts ` + "due to concurrent writes; usage counts are best-effort under concurrency.");
+  return lastWritten ?? {
+    service,
+    date: today,
+    count: (lastObserved?.count ?? 0) + count,
+    updatedAt: now().toISOString()
+  };
+}
+async function resetUsage(accountId, service) {
+  const today = getTodayDate();
+  const namespaceId = await getOrCreateUsageNamespace(accountId);
+  const key = buildUsageKey(service, today);
+  const record = {
+    service,
+    date: today,
+    count: 0,
+    updatedAt: new Date().toISOString()
+  };
+  await kvPut(accountId, namespaceId, key, JSON.stringify(record));
+}
+async function getLimits(accountId) {
+  const namespaceId = await getOrCreateUsageNamespace(accountId);
+  const value = await kvGet(accountId, namespaceId, LIMITS_KEY);
+  if (value === null) {
+    return DEFAULT_LIMITS;
+  }
+  try {
+    return { ...DEFAULT_LIMITS, ...JSON.parse(value) };
+  } catch {
+    return DEFAULT_LIMITS;
+  }
+}
+async function setLimits(accountId, limits) {
+  const namespaceId = await getOrCreateUsageNamespace(accountId);
+  const current = await getLimits(accountId);
+  const updated = {
+    ...current,
+    ...limits
+  };
+  await kvPut(accountId, namespaceId, LIMITS_KEY, JSON.stringify(updated));
+  return updated;
+}
+async function setLimitsEnabled(accountId, enabled) {
+  return setLimits(accountId, { enabled });
+}
+async function isWithinLimits(accountId, service) {
+  const limits = await getLimits(accountId);
+  if (!limits.enabled) {
+    return true;
+  }
+  const usage = await getUsage(accountId, service);
+  const currentCount = usage?.count ?? 0;
+  switch (service) {
+    case "ai":
+      if (limits.aiRequestsPerDay && currentCount >= limits.aiRequestsPerDay) {
+        return false;
+      }
+      return true;
+    case "vectorize":
+      if (limits.vectorizeOpsPerDay && currentCount >= limits.vectorizeOpsPerDay) {
+        return false;
+      }
+      return true;
+    default:
+      return true;
+  }
+}
+async function getUsageSummary(accountId, service) {
+  const limits = await getLimits(accountId);
+  const usage = await getUsage(accountId, service);
+  const currentCount = usage?.count ?? 0;
+  let limit;
+  switch (service) {
+    case "ai":
+      limit = limits.aiRequestsPerDay;
+      break;
+    case "vectorize":
+      limit = limits.vectorizeOpsPerDay;
+      break;
+  }
+  const withinLimit = limit === undefined || currentCount < limit;
+  const percentUsed = limit ? currentCount / limit * 100 : undefined;
+  return {
+    service,
+    today: currentCount,
+    limit,
+    withinLimit,
+    percentUsed
+  };
+}
+async function getAllUsageSummaries(accountId) {
+  const trackedServices = ["ai", "vectorize"];
+  return Promise.all(trackedServices.map((s) => getUsageSummary(accountId, s)));
+}
+async function canProceedWithTest(accountId, service) {
+  const limits = await getLimits(accountId);
+  if (!limits.enabled) {
+    return { allowed: true };
+  }
+  const withinLimits = await isWithinLimits(accountId, service);
+  if (!withinLimits) {
+    const summary = await getUsageSummary(accountId, service);
+    return {
+      allowed: false,
+      reason: `Daily limit exceeded for ${service}: ${summary.today}/${summary.limit} (${summary.percentUsed?.toFixed(1)}%)`
+    };
+  }
+  return { allowed: true };
+}
+async function recordTestUsage(accountId, service, count = 1) {
+  await recordUsage(accountId, service, count);
+}
+async function shouldSkip(service) {
+  try {
+    const isAuth = await isAuthenticated();
+    if (!isAuth) {
+      console.log(`⏭️  ${service.toUpperCase()} tests skipped: Not authenticated. Run: bunx wrangler login`);
+      return true;
+    }
+    const primary = await getPrimaryAccount();
+    if (!primary) {
+      console.log(`⏭️  ${service.toUpperCase()} tests skipped: No Cloudflare account found`);
+      return true;
+    }
+    const { accountId } = await getEffectiveAccountId(primary.id);
+    try {
+      const { allowed, reason } = await canProceedWithTest(accountId, service);
+      if (!allowed) {
+        console.log(`⏭️  ${service.toUpperCase()} tests skipped: ${reason}`);
+        return true;
+      }
+    } catch {}
+    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.log(`⏭️  ${service.toUpperCase()} tests skipped: ${message}`);
+    return true;
+  }
+}
+
+export { getUsage, recordUsage, resetUsage, getLimits, setLimits, setLimitsEnabled, isWithinLimits, getUsageSummary, getAllUsageSummaries, canProceedWithTest, recordTestUsage, shouldSkip };