devflare 1.0.0-next.5 → 1.0.0-next.50

package/dist/_chunks/secrets-DIpJGe6C.js

@@ -0,0 +1,95 @@
+import { i as listLocalSecrets, o as writeLocalSecret, r as deleteLocalSecret } from "./local-secrets-DMPkmOn3.js";
+//#region src/cli/commands/secrets.ts
+function getStringOption(options, key) {
+	const value = options[key];
+	return typeof value === "string" ? value : void 0;
+}
+function getCwd(options) {
+	return options.cwd ?? process.cwd();
+}
+function requireLocalFlag(parsed, logger) {
+	if (parsed.options.local === true) return true;
+	logger.error("Local Secrets Store commands require --local.");
+	return false;
+}
+function requireStoreAndName(parsed, logger) {
+	const storeId = getStringOption(parsed.options, "store");
+	const name = getStringOption(parsed.options, "name");
+	if (!storeId || !name) {
+		logger.error("Pass --store <id> and --name <name>.");
+		return;
+	}
+	return {
+		storeId,
+		name
+	};
+}
+function formatSecretRef(storeId, name) {
+	return `${storeId}/${name}`;
+}
+function usage() {
+	return [
+		"devflare secrets --local --store <id> --name <name> --value <value>",
+		"devflare secrets --local --store <id> --list",
+		"devflare secrets --local --store <id> --name <name> --delete"
+	].join("\n");
+}
+function runSecretsCommand(parsed, logger, options) {
+	if (!requireLocalFlag(parsed, logger)) return {
+		exitCode: 1,
+		output: usage()
+	};
+	const cwd = getCwd(options);
+	const storeId = getStringOption(parsed.options, "store");
+	if (parsed.options.list === true) {
+		const output = listLocalSecrets({
+			cwd,
+			storeId
+		}).map((row) => formatSecretRef(row.storeId, row.name)).join("\n");
+		if (output) logger.info(output);
+		return {
+			exitCode: 0,
+			output
+		};
+	}
+	const required = requireStoreAndName(parsed, logger);
+	if (!required) return {
+		exitCode: 1,
+		output: usage()
+	};
+	if (parsed.options.delete === true) {
+		deleteLocalSecret({
+			cwd,
+			storeId: required.storeId,
+			name: required.name
+		});
+		const output = formatSecretRef(required.storeId, required.name);
+		logger.success(`Deleted local secret ${output}`);
+		return {
+			exitCode: 0,
+			output
+		};
+	}
+	const value = getStringOption(parsed.options, "value");
+	if (value === void 0) {
+		logger.error("Pass --value <value>, --list, or --delete.");
+		return {
+			exitCode: 1,
+			output: usage()
+		};
+	}
+	writeLocalSecret({
+		cwd,
+		storeId: required.storeId,
+		name: required.name,
+		value
+	});
+	const output = formatSecretRef(required.storeId, required.name);
+	logger.success(`Stored local secret ${output}`);
+	return {
+		exitCode: 0,
+		output
+	};
+}
+//#endregion
+export { runSecretsCommand };

package/dist/_chunks/tail-IY-ijYmv.js

@@ -0,0 +1,239 @@
+import { r as loadConfig } from "./loader-Cr0_OWPy.js";
+import { p as getApiToken } from "./api-TzdliH-6.js";
+import { d as green, f as logLine, g as yellow, h as whiteDim, m as red, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
+import { r as resolveCloudflareAccountId, t as asOptionalString } from "./command-utils-DA0Qx9_K.js";
+//#region src/cli/commands/tail.ts
+const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+const TAIL_SUBPROTOCOL = "trace-v1";
+function parseTailFormat(value) {
+	const normalized = asOptionalString(value)?.toLowerCase();
+	if (normalized === void 0 || normalized === "pretty") return "pretty";
+	if (normalized === "json") return "json";
+	throw new Error(`--format must be "pretty" or "json", received "${String(value)}".`);
+}
+function formatTimestamp(timestamp) {
+	if (typeof timestamp !== "number" || !Number.isFinite(timestamp)) return (/* @__PURE__ */ new Date()).toISOString();
+	return new Date(timestamp).toISOString();
+}
+function describeTriggerEvent(event) {
+	if (!event) return "event";
+	if (event.request?.url) return `${event.request.method ?? "GET"} ${event.request.url}`;
+	if (event.cron) return `cron ${event.cron}`;
+	if (event.queue) return `queue ${event.queue}`;
+	if (event.mailFrom) return `email from ${event.mailFrom}`;
+	if (event.rpcMethod) return `rpc ${event.rpcMethod}`;
+	return "event";
+}
+function stringifyLogMessage(message) {
+	if (typeof message === "string") return message;
+	if (Array.isArray(message)) return message.map((part) => stringifyLogMessage(part)).join(" ");
+	if (message === void 0) return "";
+	try {
+		return JSON.stringify(message);
+	} catch {
+		return String(message);
+	}
+}
+/**
+* Render one trace event as the lines `devflare tail` prints in pretty mode.
+* Returns an ordered list of `{ level, text }` so the caller can route each
+* line to the matching logger method (and tests can assert content without
+* ANSI noise).
+*/
+function formatTailEventLines(event) {
+	const lines = [];
+	const timestamp = formatTimestamp(event.eventTimestamp);
+	const outcome = event.outcome ?? "unknown";
+	const trigger = describeTriggerEvent(event.event);
+	const scriptName = event.scriptName ? ` ${event.scriptName}` : "";
+	lines.push({
+		level: outcome === "ok" ? "info" : "error",
+		text: `[${timestamp}]${scriptName} ${trigger} — ${outcome}`
+	});
+	for (const log of event.logs ?? []) {
+		const level = log.level ?? "log";
+		const text = stringifyLogMessage(log.message);
+		lines.push({
+			level: level === "error" || level === "warn" ? level : "info",
+			text: `  ${level}: ${text}`
+		});
+	}
+	for (const exception of event.exceptions ?? []) {
+		const name = exception.name ?? "Error";
+		const message = exception.message ?? "";
+		lines.push({
+			level: "error",
+			text: `  exception ${name}: ${message}`
+		});
+	}
+	return lines;
+}
+async function readEnvelope(response, endpoint) {
+	const text = await response.text();
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error(`Cloudflare ${endpoint} returned an invalid response (status ${response.status}).`);
+	}
+	if (!parsed.success) {
+		const first = parsed.errors?.[0];
+		throw new Error(first ? `Cloudflare ${endpoint} failed (${first.code}): ${first.message}` : `Cloudflare ${endpoint} failed (status ${response.status}).`);
+	}
+	return parsed.result;
+}
+async function createTail(accountId, workerName, token) {
+	const result = await readEnvelope(await fetch(`${CLOUDFLARE_API_BASE}/accounts/${accountId}/workers/scripts/${encodeURIComponent(workerName)}/tails`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		}
+	}), `create tail for ${workerName}`);
+	return {
+		id: result.id,
+		url: result.url,
+		expiresAt: result.expires_at
+	};
+}
+async function deleteTail(accountId, workerName, tailId, token) {
+	const response = await fetch(`${CLOUDFLARE_API_BASE}/accounts/${accountId}/workers/scripts/${encodeURIComponent(workerName)}/tails/${encodeURIComponent(tailId)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${token}` }
+	});
+	if (!response.ok) await readEnvelope(response, `delete tail ${tailId}`);
+}
+function parseTailMessage(raw) {
+	const parsed = JSON.parse(raw);
+	if (Array.isArray(parsed)) return parsed;
+	return [parsed];
+}
+async function resolveWorkerName(parsed, cwd, configFile, fallbackArg) {
+	const explicit = asOptionalString(parsed.options.worker) ?? fallbackArg;
+	if (explicit) return explicit;
+	try {
+		return (await loadConfig({
+			cwd,
+			configFile
+		})).name;
+	} catch {
+		return;
+	}
+}
+async function runTailCommand(parsed, logger, options) {
+	const theme = createCliTheme(parsed.options);
+	const cwd = options.cwd ?? process.cwd();
+	const configFile = asOptionalString(parsed.options.config);
+	let format;
+	try {
+		format = parseTailFormat(parsed.options.format);
+	} catch (error) {
+		logger.error(error instanceof Error ? error.message : String(error));
+		return { exitCode: 1 };
+	}
+	const fallbackArg = parsed.args[0];
+	const workerName = await resolveWorkerName(parsed, cwd, configFile, fallbackArg);
+	if (!workerName) {
+		logger.error("No Worker name could be resolved.");
+		logLine(logger, dim("Pass a Worker name (`devflare tail <worker>`), --worker <name>, or run inside a configured package.", theme));
+		return { exitCode: 1 };
+	}
+	const token = await getApiToken();
+	if (!token) {
+		logger.error("Not authenticated with Cloudflare.");
+		logLine(logger, dim("Run `devflare login` first, or set CLOUDFLARE_API_TOKEN.", theme));
+		return { exitCode: 1 };
+	}
+	let configuredAccountId;
+	try {
+		configuredAccountId = (await loadConfig({
+			cwd,
+			configFile
+		})).accountId;
+	} catch {
+		configuredAccountId = void 0;
+	}
+	const accountId = await resolveCloudflareAccountId({
+		explicitAccountId: asOptionalString(parsed.options.account),
+		configuredAccountId
+	});
+	if (!accountId) {
+		logger.error("No Cloudflare account could be resolved.");
+		logLine(logger, dim("Use --account <id> or set accountId in devflare.config.* / CLOUDFLARE_ACCOUNT_ID.", theme));
+		return { exitCode: 1 };
+	}
+	logLine(logger);
+	logLine(logger, `${yellow("tail", theme)} ${dim("Streaming live logs from Cloudflare", theme)}`);
+	logLine(logger, `${dim("worker", theme)} ${green(workerName, theme)}`);
+	logLine(logger, `${dim("account", theme)} ${whiteDim(accountId, theme)}`);
+	let createdTail;
+	try {
+		createdTail = await createTail(accountId, workerName, token);
+	} catch (error) {
+		logger.error(error instanceof Error ? error.message : String(error));
+		return { exitCode: 1 };
+	}
+	logLine(logger, dim(`Connected to tail ${createdTail.id}${createdTail.expiresAt ? ` (expires ${createdTail.expiresAt})` : ""}. Press Ctrl-C to stop.`, theme));
+	const { WebSocket: WsWebSocket } = await import("ws");
+	return new Promise((resolve) => {
+		let settled = false;
+		const socket = new WsWebSocket(createdTail.url, TAIL_SUBPROTOCOL, { headers: {
+			Authorization: `Bearer ${token}`,
+			"User-Agent": "devflare"
+		} });
+		const cleanup = async (exitCode) => {
+			if (settled) return;
+			settled = true;
+			try {
+				socket.close();
+			} catch {}
+			process.off("SIGINT", onSigint);
+			try {
+				await deleteTail(accountId, workerName, createdTail.id, token);
+			} catch (error) {
+				logger.warn(`Could not delete the tail session ${createdTail.id}; it will expire on its own. ${error instanceof Error ? error.message : String(error)}`);
+			}
+			resolve({ exitCode });
+		};
+		const onSigint = () => {
+			logLine(logger);
+			logLine(logger, dim("Stopping tail…", theme));
+			cleanup(0);
+		};
+		process.on("SIGINT", onSigint);
+		socket.on("open", () => {
+			logger.success("Tail stream open");
+		});
+		socket.on("message", (data) => {
+			const raw = typeof data === "string" ? data : String(data);
+			let events;
+			try {
+				events = parseTailMessage(raw);
+			} catch {
+				logger.warn(`Received a non-JSON tail message: ${raw.slice(0, 200)}`);
+				return;
+			}
+			for (const event of events) {
+				if (format === "json") {
+					logger.log(JSON.stringify(event));
+					continue;
+				}
+				for (const line of formatTailEventLines(event)) if (line.level === "error") logLine(logger, red(line.text, theme));
+				else if (line.level === "warn") logLine(logger, yellow(line.text, theme));
+				else logLine(logger, line.text);
+			}
+		});
+		socket.on("error", (error) => {
+			logger.error(`Tail stream error: ${error.message}`);
+			cleanup(1);
+		});
+		socket.on("close", () => {
+			if (!settled) {
+				logLine(logger, dim("Tail stream closed.", theme));
+				cleanup(0);
+			}
+		});
+	});
+}
+//#endregion
+export { runTailCommand };

package/dist/_chunks/token-Dmi0KXyX.js

@@ -0,0 +1,333 @@
+import { n as CloudflareAPIError, t as AuthenticationError } from "./api-TzdliH-6.js";
+import { d as getPrimaryAccount, i as getWorkspaceAccountId } from "./preferences-BKp_7XJx.js";
+import { d as green, f as logLine, g as yellow, h as whiteDim, o as dim, p as logTable, r as createCliTheme } from "./ui-BUoZApvE.js";
+import { a as listAccountTokenPermissionGroups, c as selectAllReusablePermissionGroups, i as listAccountOwnedAPITokens, l as selectDevflarePermissionGroups, n as deleteAccountOwnedAPIToken, o as normalizeDevflareTokenName, r as filterDevflareManagedTokens, s as rollAccountOwnedAPITokenValue, t as createAccountOwnedAPIToken, u as stripDevflareTokenNamePrefix } from "./tokens-iVcgNXi-.js";
+//#region src/cli/commands/token.ts
+const CLI_API_OPTIONS = { timeout: 1e4 };
+const TOKENS_USAGE = "devflare tokens <bootstrap-token> (--list | --new [token-name] | --roll [token-name] | --delete [token-name] | --delete-all) [--account <id>] [--all-flags]";
+const TOKEN_OPERATION_SUMMARY_LINES = [
+	"--list             List Devflare-managed account-owned tokens",
+	"--new [name]       Create a Devflare-managed account-owned token",
+	"--roll [name]      Roll a Devflare-managed account-owned token secret",
+	"--delete [name]    Delete a Devflare-managed account-owned token",
+	"--delete-all       Delete every Devflare-managed account-owned token",
+	"--all-flags        With --new, include every reusable account/zone-scoped permission group"
+];
+function getTrimmedStringOption(options, key) {
+	const value = options[key];
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
+}
+function formatTokenTimestamp(value) {
+	if (!value) return "—";
+	return value.toISOString().replace(/:\d{2}\.\d{3}Z$/, "Z").replace("T", " ");
+}
+function sortTokens(tokens) {
+	return [...tokens].sort((left, right) => {
+		const nameComparison = left.name.localeCompare(right.name);
+		if (nameComparison !== 0) return nameComparison;
+		return (right.modifiedOn?.getTime() ?? 0) - (left.modifiedOn?.getTime() ?? 0);
+	});
+}
+function logUsage(logger, theme) {
+	logLine(logger);
+	logLine(logger, `${dim("Usage:", theme)} ${TOKENS_USAGE}`);
+	logLine(logger, dim("Operations:", theme));
+	for (const line of TOKEN_OPERATION_SUMMARY_LINES) logLine(logger, `  ${line}`);
+	logLine(logger, dim("Token names are normalized to the devflare- prefix automatically.", theme));
+	logLine(logger, dim("The bootstrap token must include Cloudflare API token management permissions.", theme));
+	logLine(logger);
+}
+function resolveTokenOperation(parsed) {
+	const newOption = parsed.options.new;
+	const rollOption = parsed.options.roll;
+	const deleteOption = parsed.options.delete;
+	const requestedOperations = [
+		newOption !== void 0 ? "new" : null,
+		rollOption !== void 0 ? "roll" : null,
+		deleteOption !== void 0 ? "delete" : null,
+		parsed.options.list === true ? "list" : null,
+		parsed.options["delete-all"] === true ? "delete-all" : null
+	].filter(Boolean);
+	if (parsed.options["all-flags"] && !requestedOperations.includes("new")) return "--all-flags can only be used together with --new.";
+	if (requestedOperations.length === 0) return "Choose one token operation: --list, --new, --roll, --delete, or --delete-all.";
+	if (requestedOperations.length > 1) return "Choose only one token operation at a time.";
+	switch (requestedOperations[0]) {
+		case "new": return {
+			kind: "new",
+			requestedName: typeof newOption === "string" ? newOption.trim() || void 0 : void 0
+		};
+		case "roll": return {
+			kind: "roll",
+			requestedName: typeof rollOption === "string" ? rollOption.trim() || void 0 : void 0
+		};
+		case "delete": return {
+			kind: "delete",
+			requestedName: typeof deleteOption === "string" ? deleteOption.trim() || void 0 : void 0
+		};
+		case "list": return { kind: "list" };
+		case "delete-all": return { kind: "delete-all" };
+	}
+}
+function formatManagedTokenDisplayName(name) {
+	return stripDevflareTokenNamePrefix(name);
+}
+async function promptForTokenName(logger, theme, message) {
+	while (true) {
+		const selected = await logger.prompt(message, {
+			type: "text",
+			placeholder: "preview",
+			cancel: "symbol"
+		});
+		if (typeof selected === "symbol") {
+			logLine(logger, dim("Cancelled", theme));
+			return null;
+		}
+		const trimmedValue = selected.trim();
+		if (trimmedValue) return trimmedValue;
+		logger.error("Token name is required.");
+	}
+}
+async function resolveTokenName(requestedName, logger, theme, promptMessage) {
+	const rawName = requestedName ?? await promptForTokenName(logger, theme, promptMessage);
+	if (!rawName) return null;
+	return normalizeDevflareTokenName(rawName);
+}
+async function resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, options) {
+	const tokenName = await resolveTokenName(requestedName, logger, theme, options.promptMessage);
+	if (!tokenName) return { exitCode: 0 };
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim(`${options.actionLabel} a Devflare-managed account-owned token…`, theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	logLine(logger, `${dim("Name:", theme)} ${green(tokenName, theme)}`);
+	const matchingTokens = filterDevflareManagedTokens(await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	})).filter((token) => token.name === tokenName);
+	if (matchingTokens.length === 0) {
+		logger.error(`No Devflare-managed token named ${tokenName} was found.`);
+		return { exitCode: 1 };
+	}
+	if (matchingTokens.length > 1) logLine(logger, dim(`Found ${matchingTokens.length} tokens with that name. ${options.multipleMatchMessage}.`, theme));
+	return {
+		tokenName,
+		matchingTokens
+	};
+}
+async function resolveRequestedAccountId(requestedAccountId, bootstrapToken) {
+	if (requestedAccountId) return {
+		accountId: requestedAccountId,
+		source: "flag"
+	};
+	const workspaceAccountId = getWorkspaceAccountId();
+	if (workspaceAccountId) return {
+		accountId: workspaceAccountId,
+		source: "workspace"
+	};
+	const primaryAccount = await getPrimaryAccount({
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (!primaryAccount) throw new Error("No Cloudflare accounts found for this bootstrap token");
+	return {
+		accountId: primaryAccount.id,
+		source: "primary"
+	};
+}
+async function createManagedToken(accountId, accountSource, bootstrapToken, requestedName, includeAllFlags, logger, theme) {
+	const tokenName = await resolveTokenName(requestedName, logger, theme, "Enter a Devflare token name:");
+	if (!tokenName) return { exitCode: 0 };
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Creating an account-owned Devflare token…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	logLine(logger, `${dim("Name:", theme)} ${green(tokenName, theme)}`);
+	const permissionGroups = await listAccountTokenPermissionGroups(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (permissionGroups.length === 0) {
+		logger.error("Cloudflare returned zero account token permission groups for this account.");
+		return { exitCode: 1 };
+	}
+	const selectedPermissionGroups = includeAllFlags ? selectAllReusablePermissionGroups(permissionGroups) : selectDevflarePermissionGroups(permissionGroups);
+	const createdToken = await createAccountOwnedAPIToken(accountId, {
+		name: tokenName,
+		permissionGroups: selectedPermissionGroups
+	}, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	if (!createdToken.value) {
+		logger.error("Cloudflare created the token but did not return a token value.");
+		return { exitCode: 1 };
+	}
+	logger.success(`Created ${createdToken.name || tokenName}`);
+	logLine(logger, `${dim("Permission groups:", theme)} ${selectedPermissionGroups.length} ${includeAllFlags ? "reusable account/zone-scoped" : "Devflare-relevant account/zone-scoped"} selected from ${permissionGroups.length} available`);
+	if (includeAllFlags) {
+		logLine(logger, dim("Account-owned Devflare tokens include account resources plus all zones in the account; user-scoped groups are skipped automatically.", theme));
+		logLine(logger, dim("Account API Tokens permissions are still excluded because Cloudflare does not allow sub-tokens to manage other tokens.", theme));
+	}
+	logger.warn("Cloudflare only returns the token secret once. Store it safely now.");
+	logger.log(createdToken.value);
+	return {
+		exitCode: 0,
+		output: createdToken.value
+	};
+}
+async function listManagedTokens(accountId, accountSource, bootstrapToken, logger, theme) {
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Listing Devflare-managed account-owned tokens…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	const accountTokens = await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	const managedTokens = sortTokens(filterDevflareManagedTokens(accountTokens));
+	if (managedTokens.length === 0) {
+		logLine(logger, dim("No Devflare-managed account-owned tokens found for this account.", theme));
+		return {
+			exitCode: 0,
+			output: ""
+		};
+	}
+	logTable(logger, {
+		title: "Devflare-managed tokens",
+		rows: managedTokens,
+		columns: [
+			{
+				label: "Name",
+				value: (token) => formatManagedTokenDisplayName(token.name),
+				width: 46
+			},
+			{
+				label: "Status",
+				value: (token) => token.status ?? "unknown",
+				width: 10
+			},
+			{
+				label: "Token ID",
+				value: (token) => token.id.slice(0, 12),
+				width: 12
+			},
+			{
+				label: "Modified",
+				value: (token) => formatTokenTimestamp(token.modifiedOn)
+			}
+		],
+		theme
+	});
+	const untouchedTokenCount = accountTokens.length - managedTokens.length;
+	if (untouchedTokenCount > 0) logLine(logger, dim(`Left ${untouchedTokenCount} non-Devflare token(s) out of this list.`, theme));
+	return {
+		exitCode: 0,
+		output: managedTokens.map((token) => formatManagedTokenDisplayName(token.name)).join("\n")
+	};
+}
+async function rollManagedTokensByName(accountId, accountSource, bootstrapToken, requestedName, logger, theme) {
+	const selectedTokens = await resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, {
+		promptMessage: "Enter the Devflare token name to roll:",
+		actionLabel: "Rolling",
+		multipleMatchMessage: "Rolling all exact matches"
+	});
+	if ("exitCode" in selectedTokens) return selectedTokens;
+	const { tokenName, matchingTokens } = selectedTokens;
+	const rolledValues = [];
+	for (const token of matchingTokens) {
+		const rolledValue = await rollAccountOwnedAPITokenValue(accountId, token.id, {
+			...CLI_API_OPTIONS,
+			token: bootstrapToken
+		});
+		rolledValues.push(rolledValue);
+	}
+	logger.success(`Rolled ${matchingTokens.length} Devflare-managed token(s) named ${tokenName}`);
+	logger.warn("Cloudflare only returns the new token secret once. Store it safely now.");
+	if (rolledValues.length === 1) logger.log(rolledValues[0]);
+	else for (const [index, value] of rolledValues.entries()) logLine(logger, `${dim(`${matchingTokens[index].id.slice(0, 12)}:`, theme)} ${value}`);
+	return {
+		exitCode: 0,
+		output: rolledValues.join("\n")
+	};
+}
+async function deleteManagedTokensByName(accountId, accountSource, bootstrapToken, requestedName, logger, theme) {
+	const selectedTokens = await resolveNamedManagedTokens(accountId, accountSource, bootstrapToken, requestedName, logger, theme, {
+		promptMessage: "Enter the Devflare token name to delete:",
+		actionLabel: "Deleting",
+		multipleMatchMessage: "Deleting all exact matches"
+	});
+	if ("exitCode" in selectedTokens) return selectedTokens;
+	const { tokenName, matchingTokens } = selectedTokens;
+	for (const token of matchingTokens) await deleteAccountOwnedAPIToken(accountId, token.id, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	logger.success(`Deleted ${matchingTokens.length} Devflare-managed token(s) named ${tokenName}`);
+	return {
+		exitCode: 0,
+		output: matchingTokens.map((token) => token.id).join("\n")
+	};
+}
+async function deleteAllManagedTokens(accountId, accountSource, bootstrapToken, logger, theme) {
+	logLine(logger);
+	logLine(logger, `${yellow("tokens", theme)} ${dim("Deleting all Devflare-managed account-owned tokens…", theme)}`);
+	logLine(logger, `${dim("Account:", theme)} ${green(accountId, theme)} ${whiteDim(`(${accountSource})`, theme)}`);
+	const accountTokens = await listAccountOwnedAPITokens(accountId, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	const managedTokens = filterDevflareManagedTokens(accountTokens);
+	if (managedTokens.length === 0) {
+		logger.success("No Devflare-managed tokens were found, so nothing was deleted.");
+		return { exitCode: 0 };
+	}
+	for (const token of managedTokens) await deleteAccountOwnedAPIToken(accountId, token.id, {
+		...CLI_API_OPTIONS,
+		token: bootstrapToken
+	});
+	logger.success(`Deleted ${managedTokens.length} Devflare-managed token(s)`);
+	const untouchedTokenCount = accountTokens.length - managedTokens.length;
+	if (untouchedTokenCount > 0) logLine(logger, dim(`Left ${untouchedTokenCount} non-Devflare token(s) untouched.`, theme));
+	return {
+		exitCode: 0,
+		output: managedTokens.map((token) => token.id).join("\n")
+	};
+}
+async function runTokenCommand(parsed, logger, _options) {
+	const bootstrapToken = parsed.args[0]?.trim();
+	const theme = createCliTheme(parsed.options);
+	if (!bootstrapToken) {
+		logUsage(logger, theme);
+		return { exitCode: 1 };
+	}
+	const tokenOperation = resolveTokenOperation(parsed);
+	if (typeof tokenOperation === "string") {
+		logUsage(logger, theme);
+		return { exitCode: 1 };
+	}
+	const requestedAccountId = getTrimmedStringOption(parsed.options, "account");
+	try {
+		const { accountId, source } = await resolveRequestedAccountId(requestedAccountId, bootstrapToken);
+		switch (tokenOperation.kind) {
+			case "new": return createManagedToken(accountId, source, bootstrapToken, tokenOperation.requestedName, parsed.options["all-flags"] === true, logger, theme);
+			case "roll": return rollManagedTokensByName(accountId, source, bootstrapToken, tokenOperation.requestedName, logger, theme);
+			case "list": return listManagedTokens(accountId, source, bootstrapToken, logger, theme);
+			case "delete": return deleteManagedTokensByName(accountId, source, bootstrapToken, tokenOperation.requestedName, logger, theme);
+			case "delete-all": return deleteAllManagedTokens(accountId, source, bootstrapToken, logger, theme);
+		}
+	} catch (error) {
+		if (error instanceof AuthenticationError) {
+			logger.error(error.message);
+			return { exitCode: 1 };
+		}
+		if (error instanceof CloudflareAPIError) {
+			logger.error(`API Error: ${error.message}`);
+			return { exitCode: 1 };
+		}
+		if (error instanceof Error) {
+			logger.error(error.message);
+			return { exitCode: 1 };
+		}
+		throw error;
+	}
+}
+//#endregion
+export { runTokenCommand };