devflare 1.0.0-next.4 → 1.0.0-next.41

package/dist/_chunks/token-kguIDmej.js

@@ -0,0 +1,333 @@
+import { n as CloudflareAPIError, t as AuthenticationError } from "./api-TzdliH-6.js";
+import { d as getPrimaryAccount, i as getWorkspaceAccountId } from "./preferences-BKp_7XJx.js";
+import { d as green, f as logLine, g as yellow, h as whiteDim, o as dim, p as logTable, r as createCliTheme } from "./ui-BUoZApvE.js";
+import { a as listAccountTokenPermissionGroups, c as selectAllReusablePermissionGroups, i as listAccountOwnedAPITokens, l as selectDevflarePermissionGroups, n as deleteAccountOwnedAPIToken, o as normalizeDevflareTokenName, r as filterDevflareManagedTokens, s as rollAccountOwnedAPITokenValue, t as createAccountOwnedAPIToken, u as stripDevflareTokenNamePrefix } from "./tokens-iVcgNXi-.js";
+//#region src/cli/commands/token.ts
+const CLI_API_OPTIONS = { timeout: 1e4 };
+const TOKENS_USAGE = "devflare tokens <bootstrap-token> (--list | --new [token-name] | --roll [token-name] | --delete [token-name] | --delete-all) [--account <id>] [--all-flags]";
+const TOKEN_OPERATION_SUMMARY_LINES = [
+	"--list             List Devflare-managed account-owned tokens",
+	"--new [name]       Create a Devflare-managed account-owned token",
+	"--roll [name]      Roll a Devflare-managed account-owned token secret",
+	"--delete [name]    Delete a Devflare-managed account-owned token",
+	"--delete-all       Delete every Devflare-managed account-owned token",
+	"--all-flags        With --new, include every reusable account/zone-scoped permission group"
+];
+function getTrimmedStringOption(options, key) {
+	const value = options[key];
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
+}
+function formatTokenTimestamp(value) {
+	if (!value) return "—";
+	return value.toISOString().replace(/:\d{2}\.\d{3}Z$/, "Z").replace("T", " ");
+}
+function sortTokens(tokens) {
+	return [...tokens].sort((left, right) => {
+		const nameComparison = left.name.localeCompare(right.name);
+		if (nameComparison !== 0) return nameComparison;
+		return (right.modifiedOn?.getTime() ?? 0) - (left.modifiedOn?.getTime() ?? 0);
+	});
+}
+function logUsage(logger, theme) {
+	logLine(logger);
+	logLine(logger, `${dim("Usage:", theme)} ${TOKENS_USAGE}`);
+	logLine(logger, dim("Operations:", theme));
+	for (const line of TOKEN_OPERATION_SUMMARY_LINES) logLine(logger, `  ${line}`);
+	logLine(logger, dim("Token names are normalized to the devflare- prefix automatically.", theme));
+	logLine(logger, dim("The bootstrap token must include Cloudflare API token management permissions.", theme));
+	logLine(logger);
+}
+function resolveTokenOperation(parsed) {
+	const newOption = parsed.options.new;
+	const rollOption = parsed.options.roll;
+	const deleteOption = parsed.options.delete;
+	const requestedOperations = [
+		newOption !== void 0 ? "new" : null,
+		rollOption !== void 0 ? "roll" : null,
+		deleteOption !== void 0 ? "delete" : null,
+		parsed.options.list === true ? "list" : null,
+		parsed.options["delete-all"] === true ? "delete-all" : null
+	].filter(Boolean);
+	if (parsed.options["all-flags"] && !requestedOperations.includes("new")) return "--all-flags can only be used together with --new.";
+	if (requestedOperations.length === 0) return "Choose one token operation: --list, --new, --roll, --delete, or --delete-all.";
+	if (requestedOperations.length > 1) return "Choose only one token operation at a time.";
+	switch (requestedOperations[0]) {
+		case "new": return {
+			kind: "new",
+			requestedName: typeof newOption === "string" ? newOption.trim() || void 0 : void 0
+		};
+		case "roll": return {
+			kind: "roll",
+			requestedName: typeof rollOption === "string" ? rollOption.trim() || void 0 : void 0
+		};
+		case "delete": return {
+			kind: "delete",
+			requestedName: typeof deleteOption === "string" ? deleteOption.trim() || void 0 : void 0
+		};
+		case "list": return { kind: "list" };
+		case "delete-all": return { kind: "delete-all" };
+	}
+}
+function formatManagedTokenDisplayName(name) {
+	return stripDevflareTokenNamePrefix(name);
+}
+async function promptForTokenName(logger, theme, message) {
+	while (true) {
+		const selected = await logger.prompt(message, {
+			type: "text",
+			placeholder: "preview",
+			cancel: "symbol"
+		});
+		if (typeof selected === "symbol") {
+			logLine(logger, dim("Cancelled", theme));
+			return null;
+		}
+		const trimmedValue = selected.trim();
+		if (trimmedValue) return trimmedValue;
+		logger.error("Token name is required.");
+	}
+}
+async function resolveTokenName(requestedName, logger, theme, promptMessage) {
+	const rawName = requestedName ?? await promptForTokenName(logger, theme, promptMessage);
+	if (!rawName) return null;
+	return normalizeDevflareTokenName(rawName);
+}
+async function resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, options) {
+	const tokenName = await resolveTokenName(requestedName, logger, theme, options.promptMessage);
+	if (!tokenName) return { exitCode: 0 };
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim(`${options.actionLabel} a Devflare-managed account-owned token…`, theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	logLine(logger, `${dim("Name:", theme)} ${green(tokenName, theme)}`);
+	const matchingTokens = filterDevflareManagedTokens(await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	})).filter((token) => token.name === tokenName);
+	if (matchingTokens.length === 0) {
+		logger.error(`No Devflare-managed token named ${tokenName} was found.`);
+		return { exitCode: 1 };
+	}
+	if (matchingTokens.length > 1) logLine(logger, dim(`Found ${matchingTokens.length} tokens with that name. ${options.multipleMatchMessage}.`, theme));
+	return {
+		tokenName,
+		matchingTokens
+	};
+}
+async function resolveRequestedAccountId(requestedAccountId, bootstrapToken) {
+	if (requestedAccountId) return {
+		accountId: requestedAccountId,
+		source: "flag"
+	};
+	const workspaceAccountId = getWorkspaceAccountId();
+	if (workspaceAccountId) return {
+		accountId: workspaceAccountId,
+		source: "workspace"
+	};
+	const primaryAccount = await getPrimaryAccount({
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (!primaryAccount) throw new Error("No Cloudflare accounts found for this bootstrap token");
+	return {
+		accountId: primaryAccount.id,
+		source: "primary"
+	};
+}
+async function createManagedToken(accountId, accountSource, bootstrapToken, requestedName, includeAllFlags, logger, theme) {
+	const tokenName = await resolveTokenName(requestedName, logger, theme, "Enter a Devflare token name:");
+	if (!tokenName) return { exitCode: 0 };
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Creating an account-owned Devflare token…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	logLine(logger, `${dim("Name:", theme)} ${green(tokenName, theme)}`);
+	const permissionGroups = await listAccountTokenPermissionGroups(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (permissionGroups.length === 0) {
+		logger.error("Cloudflare returned zero account token permission groups for this account.");
+		return { exitCode: 1 };
+	}
+	const selectedPermissionGroups = includeAllFlags ? selectAllReusablePermissionGroups(permissionGroups) : selectDevflarePermissionGroups(permissionGroups);
+	const createdToken = await createAccountOwnedAPIToken(accountId, {
+		name: tokenName,
+		permissionGroups: selectedPermissionGroups
+	}, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (!createdToken.value) {
+		logger.error("Cloudflare created the token but did not return a token value.");
+		return { exitCode: 1 };
+	}
+	logger.success(`Created ${createdToken.name || tokenName}`);
+	logLine(logger, `${dim("Permission groups:", theme)} ${selectedPermissionGroups.length} ${includeAllFlags ? "reusable account/zone-scoped" : "Devflare-relevant account/zone-scoped"} selected from ${permissionGroups.length} available`);
+	if (includeAllFlags) {
+		logLine(logger, dim("Account-owned Devflare tokens include account resources plus all zones in the account; user-scoped groups are skipped automatically.", theme));
+		logLine(logger, dim("Account API Tokens permissions are still excluded because Cloudflare does not allow sub-tokens to manage other tokens.", theme));
+	}
+	logger.warn("Cloudflare only returns the token secret once. Store it safely now.");
+	logger.log(createdToken.value);
+	return {
+		exitCode: 0,
+		output: createdToken.value
+	};
+}
+async function listManagedTokens(accountId, accountSource, bootstrapToken, logger, theme) {
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Listing Devflare-managed account-owned tokens…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	const accountTokens = await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	const managedTokens = sortTokens(filterDevflareManagedTokens(accountTokens));
+	if (managedTokens.length === 0) {
+		logLine(logger, dim("No Devflare-managed account-owned tokens found for this account.", theme));
+		return {
+			exitCode: 0,
+			output: ""
+		};
+	}
+	logTable(logger, {
+		title: "Devflare-managed tokens",
+		rows: managedTokens,
+		columns: [
+			{
+				label: "Name",
+				value: (token) => formatManagedTokenDisplayName(token.name),
+				width: 46
+			},
+			{
+				label: "Status",
+				value: (token) => token.status ?? "unknown",
+				width: 10
+			},
+			{
+				label: "Token ID",
+				value: (token) => token.id.slice(0, 12),
+				width: 12
+			},
+			{
+				label: "Modified",
+				value: (token) => formatTokenTimestamp(token.modifiedOn)
+			}
+		],
+		theme
+	});
+	const untouchedTokenCount = accountTokens.length - managedTokens.length;
+	if (untouchedTokenCount > 0) logLine(logger, dim(`Left ${untouchedTokenCount} non-Devflare token(s) out of this list.`, theme));
+	return {
+		exitCode: 0,
+		output: managedTokens.map((token) => formatManagedTokenDisplayName(token.name)).join("\n")
+	};
+}
+async function rollManagedTokensByName(accountId, accountSource, bootstrapToken, requestedName, logger, theme) {
+	const selectedTokens = await resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, {
+		promptMessage: "Enter the Devflare token name to roll:",
+		actionLabel: "Rolling",
+		multipleMatchMessage: "Rolling all exact matches"
+	});
+	if ("exitCode" in selectedTokens) return selectedTokens;
+	const { tokenName, matchingTokens } = selectedTokens;
+	const rolledValues = [];
+	for (const token of matchingTokens) {
+		const rolledValue = await rollAccountOwnedAPITokenValue(accountId, token.id, {
+			...CLI_API_OPTIONS,
+			token: bootstrapToken
+		});
+		rolledValues.push(rolledValue);
+	}
+	logger.success(`Rolled ${matchingTokens.length} Devflare-managed token(s) named ${tokenName}`);
+	logger.warn("Cloudflare only returns the new token secret once. Store it safely now.");
+	if (rolledValues.length === 1) logger.log(rolledValues[0]);
+	else for (const [index, value] of rolledValues.entries()) logLine(logger, `${dim(`${matchingTokens[index].id.slice(0, 12)}:`, theme)} ${value}`);
+	return {
+		exitCode: 0,
+		output: rolledValues.join("\n")
+	};
+}
+async function deleteManagedTokensByName(accountId, accountSource, bootstrapToken, requestedName, logger, theme) {
+	const selectedTokens = await resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, {
+		promptMessage: "Enter the Devflare token name to delete:",
+		actionLabel: "Deleting",
+		multipleMatchMessage: "Deleting all exact matches"
+	});
+	if ("exitCode" in selectedTokens) return selectedTokens;
+	const { tokenName, matchingTokens } = selectedTokens;
+	for (const token of matchingTokens) await deleteAccountOwnedAPIToken(accountId, token.id, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	logger.success(`Deleted ${matchingTokens.length} Devflare-managed token(s) named ${tokenName}`);
+	return {
+		exitCode: 0,
+		output: matchingTokens.map((token) => token.id).join("\n")
+	};
+}
+async function deleteAllManagedTokens(accountId, accountSource, bootstrapToken, logger, theme) {
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Deleting all Devflare-managed account-owned tokens…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	const accountTokens = await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	const managedTokens = filterDevflareManagedTokens(accountTokens);
+	if (managedTokens.length === 0) {
+		logger.success("No Devflare-managed tokens were found, so nothing was deleted.");
+		return { exitCode: 0 };
+	}
+	for (const token of managedTokens) await deleteAccountOwnedAPIToken(accountId, token.id, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	logger.success(`Deleted ${managedTokens.length} Devflare-managed token(s)`);
+	const untouchedTokenCount = accountTokens.length - managedTokens.length;
+	if (untouchedTokenCount > 0) logLine(logger, dim(`Left ${untouchedTokenCount} non-Devflare token(s) untouched.`, theme));
+	return {
+		exitCode: 0,
+		output: managedTokens.map((token) => token.id).join("\n")
+	};
+}
+async function runTokenCommand(parsed, logger, _options) {
+	const bootstrapToken = parsed.args[0]?.trim();
+	const theme = createCliTheme(parsed.options);
+	if (!bootstrapToken) {
+		logUsage(logger, theme);
+		return { exitCode: 1 };
+	}
+	const tokenOperation = resolveTokenOperation(parsed);
+	if (typeof tokenOperation === "string") {
+		logUsage(logger, theme);
+		return { exitCode: 1 };
+	}
+	const requestedAccountId = getTrimmedStringOption(parsed.options, "account");
+	try {
+		const { accountId, source } = await resolveRequestedAccountId(requestedAccountId, bootstrapToken);
+		switch (tokenOperation.kind) {
+			case "new": return createManagedToken(accountId, source, bootstrapToken, tokenOperation.requestedName, parsed.options["all-flags"] === true, logger, theme);
+			case "roll": return rollManagedTokensByName(accountId, source, bootstrapToken, tokenOperation.requestedName, logger, theme);
+			case "list": return listManagedTokens(accountId, source, bootstrapToken, logger, theme);
+			case "delete": return deleteManagedTokensByName(accountId, source, bootstrapToken, tokenOperation.requestedName, logger, theme);
+			case "delete-all": return deleteAllManagedTokens(accountId, source, bootstrapToken, logger, theme);
+		}
+	} catch (error) {
+		if (error instanceof AuthenticationError) {
+			logger.error(error.message);
+			return { exitCode: 1 };
+		}
+		if (error instanceof CloudflareAPIError) {
+			logger.error(`API Error: ${error.message}`);
+			return { exitCode: 1 };
+		}
+		if (error instanceof Error) {
+			logger.error(error.message);
+			return { exitCode: 1 };
+		}
+		throw error;
+	}
+}
+//#endregion
+export { runTokenCommand };

package/dist/_chunks/tokens-iVcgNXi-.js

@@ -0,0 +1,221 @@
+import { a as apiGetAll, c as apiPut, r as apiDelete, s as apiPost } from "./api-TzdliH-6.js";
+//#region src/cloudflare/known-permission-group-ids.generated.ts
+const KNOWN_PERMISSION_GROUP_IDS_DATA = {
+	WORKERS_SCRIPTS_WRITE: null,
+	WORKERS_SCRIPTS_READ: null,
+	ACCOUNT_SETTINGS_READ: null,
+	WORKERS_KV_STORAGE_WRITE: null,
+	WORKERS_KV_STORAGE_READ: null,
+	ACCOUNT_API_TOKENS_WRITE: null,
+	ACCOUNT_API_TOKENS_READ: null
+};
+//#endregion
+//#region src/cloudflare/tokens.ts
+const MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
+const DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
+const ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+const ACCOUNT_ZONE_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account.zone";
+const ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
+const DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
+const DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
+	/^Account Analytics /i,
+	/^Account Settings /i,
+	/^Account Filter Lists /i,
+	/^AI /i,
+	/^Analytics /i,
+	/^Browser Rendering /i,
+	/^Cache Purge\b/i,
+	/^D1 /i,
+	/^DNS /i,
+	/^Email /i,
+	/^Hyperdrive /i,
+	/^Images /i,
+	/^Logs /i,
+	/^Logpush /i,
+	/^Pages /i,
+	/^Queues /i,
+	/^R2 /i,
+	/^SSL and Certificates /i,
+	/^Stream /i,
+	/^Vectorize /i,
+	/^Workers /i,
+	/^Zone Settings /i,
+	/^Zone /i
+];
+/**
+* Symbolic names for individual Cloudflare permission groups we care about
+* when reasoning about a Devflare token policy. Stable ids (when known)
+* should be preferred over display names, which Cloudflare is free to
+* rename or localize at any time.
+*
+* Entries set to `undefined` have not been confidently verified against
+* Cloudflare's `GET /accounts/:id/tokens/permission_groups` endpoint and
+* fall back to exact display-name matching via
+* {@link KNOWN_PERMISSION_GROUP_DISPLAY_NAMES}.
+*
+* The verified UUIDs (or `null` placeholders) live in
+* `known-permission-group-ids.generated.ts`, which is rewritten by
+* `scripts/refresh-permission-groups.ts` against a maintainer's Cloudflare
+* account so this file does not need hand-edits when Cloudflare publishes
+* or rotates permission-group ids.
+*/
+function deriveKnownPermissionGroupIds(data) {
+	const result = {};
+	for (const key of Object.keys(data)) {
+		const value = data[key];
+		result[key] = value === null ? void 0 : value;
+	}
+	return result;
+}
+deriveKnownPermissionGroupIds(KNOWN_PERMISSION_GROUP_IDS_DATA);
+function dedupePermissionGroups(permissionGroups) {
+	const seenIds = /* @__PURE__ */ new Set();
+	return permissionGroups.filter((permissionGroup) => {
+		if (seenIds.has(permissionGroup.id)) return false;
+		seenIds.add(permissionGroup.id);
+		return true;
+	});
+}
+function dedupePermissionGroupIds(permissionGroupIds) {
+	return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
+}
+function dedupeScopedPermissionGroups(permissionGroups) {
+	const seenIds = /* @__PURE__ */ new Set();
+	return permissionGroups.filter((permissionGroup) => {
+		const id = permissionGroup.id.trim();
+		if (!id || seenIds.has(id)) return false;
+		seenIds.add(id);
+		return true;
+	});
+}
+function permissionGroupHasScope(permissionGroup, scope) {
+	return permissionGroup.scopes.some((value) => value.trim() === scope);
+}
+function buildCreateTokenPoliciesFromPermissionGroups(accountId, permissionGroups) {
+	const dedupedPermissionGroups = dedupeScopedPermissionGroups(permissionGroups);
+	const accountPermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+	const zonePermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_ZONE_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+	const policies = [];
+	if (accountPermissionGroupIds.length > 0) policies.push({
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+		permission_groups: accountPermissionGroupIds.map((id) => ({ id }))
+	});
+	if (zonePermissionGroupIds.length > 0) policies.push({
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: { [`${ACCOUNT_ZONE_OWNED_TOKEN_SCOPE}.*`]: "*" } },
+		permission_groups: zonePermissionGroupIds.map((id) => ({ id }))
+	});
+	return policies;
+}
+function buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds) {
+	const dedupedPermissionGroupIds = dedupePermissionGroupIds(permissionGroupIds);
+	if (dedupedPermissionGroupIds.length === 0) return [];
+	return [{
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+		permission_groups: dedupedPermissionGroupIds.map((id) => ({ id }))
+	}];
+}
+function excludeAccountApiTokensPermissionGroups(permissionGroups) {
+	return permissionGroups.filter((permissionGroup) => {
+		return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
+	});
+}
+function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
+	return permissionGroups.filter((permissionGroup) => {
+		return permissionGroup.scopes.some((scope) => {
+			const normalizedScope = scope.trim();
+			return normalizedScope === ACCOUNT_OWNED_TOKEN_SCOPE || normalizedScope === ACCOUNT_ZONE_OWNED_TOKEN_SCOPE;
+		});
+	});
+}
+function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
+	return dedupePermissionGroups(excludeAccountApiTokensPermissionGroups(keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups)));
+}
+function parseOptionalDate(value) {
+	if (!value) return;
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+}
+function mapAccountOwnedAPITokenPolicy(policy) {
+	return {
+		id: policy.id,
+		effect: policy.effect,
+		permissionGroups: policy.permission_groups?.map((permissionGroup) => ({
+			id: permissionGroup.id,
+			name: permissionGroup.name
+		}))
+	};
+}
+function mapAccountOwnedAPIToken(token) {
+	return {
+		id: token.id,
+		name: token.name ?? token.id,
+		status: token.status,
+		value: token.value,
+		issuedOn: parseOptionalDate(token.issued_on),
+		modifiedOn: parseOptionalDate(token.modified_on),
+		lastUsedOn: parseOptionalDate(token.last_used_on),
+		policies: token.policies?.map(mapAccountOwnedAPITokenPolicy)
+	};
+}
+function isDevflareManagedTokenName(name) {
+	return DEVFLARE_MANAGED_TOKEN_NAME_PATTERN.test(name.trim());
+}
+function normalizeDevflareTokenName(name) {
+	const trimmedName = name.trim();
+	if (!trimmedName) throw new Error("Devflare token name cannot be empty");
+	const suffix = isDevflareManagedTokenName(trimmedName) ? trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") : trimmedName;
+	if (!suffix) throw new Error("Devflare token name cannot be empty");
+	return `${DEVFLARE_MANAGED_TOKEN_PREFIX}${suffix}`;
+}
+function stripDevflareTokenNamePrefix(name) {
+	const trimmedName = name.trim();
+	if (!trimmedName) return trimmedName;
+	return trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") || trimmedName;
+}
+function filterDevflareManagedTokens(tokens) {
+	return tokens.filter((token) => isDevflareManagedTokenName(token.name));
+}
+function selectDevflarePermissionGroups(permissionGroups) {
+	const selectedPermissionGroups = dedupePermissionGroups(selectReusableAccountOwnedTokenPermissionGroups(permissionGroups).filter((permissionGroup) => {
+		return DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS.some((pattern) => {
+			return pattern.test(permissionGroup.name);
+		});
+	}));
+	if (selectedPermissionGroups.length === 0) throw new Error("Could not map the available Cloudflare permission groups to a Devflare token policy.");
+	if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+	return selectedPermissionGroups;
+}
+function selectAllReusablePermissionGroups(permissionGroups) {
+	const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
+	if (selectedPermissionGroups.length === 0) throw new Error("Could not find any reusable account/zone-scoped Cloudflare permission groups for this Devflare token.");
+	if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare\'s ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+	return selectedPermissionGroups;
+}
+async function listAccountTokenPermissionGroups(accountId, options) {
+	return dedupePermissionGroups(await apiGetAll(`/accounts/${accountId}/tokens/permission_groups`, options));
+}
+async function listAccountOwnedAPITokens(accountId, options) {
+	return (await apiGetAll(`/accounts/${accountId}/tokens`, options)).map(mapAccountOwnedAPIToken);
+}
+async function deleteAccountOwnedAPIToken(accountId, tokenId, options) {
+	return apiDelete(`/accounts/${accountId}/tokens/${tokenId}`, options);
+}
+async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
+	return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
+}
+async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
+	const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroups?.map((permissionGroup) => permissionGroup.id) ?? options.permissionGroupIds ?? []);
+	if (permissionGroupIds.length === 0) throw new Error("Cannot create a Devflare token without any permission groups");
+	if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
+	const policies = options.permissionGroups ? buildCreateTokenPoliciesFromPermissionGroups(accountId, options.permissionGroups) : buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds);
+	if (policies.length === 0) throw new Error("Cannot create a Devflare token without any account- or zone-scoped permission groups");
+	return mapAccountOwnedAPIToken(await apiPost(`/accounts/${accountId}/tokens`, {
+		name: options.name,
+		policies
+	}, clientOptions));
+}
+//#endregion
+export { listAccountTokenPermissionGroups as a, selectAllReusablePermissionGroups as c, listAccountOwnedAPITokens as i, selectDevflarePermissionGroups as l, deleteAccountOwnedAPIToken as n, normalizeDevflareTokenName as o, filterDevflareManagedTokens as r, rollAccountOwnedAPITokenValue as s, createAccountOwnedAPIToken as t, stripDevflareTokenNamePrefix as u };