@pithy-sh/cloudflare 0.1.0

package/src/ai/vectorizeProvisioner.ts

@@ -0,0 +1,266 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { z } from "zod";
+import { cloudflareRequest, decodeResponse, isNotFoundError } from "../client/errors";
+import { CloudflareManager } from "../client/manager";
+
+/** The distance metric an index scores nearest neighbors with. Fixed at creation — it cannot be changed later. */
+export const VectorizeMetric = z
+  .enum(["cosine", "euclidean", "dot-product"])
+  .describe("The distance metric a Vectorize index scores nearest neighbors with. Fixed at index creation.");
+export type VectorizeMetric = z.infer<typeof VectorizeMetric>;
+
+/**
+ * A Cloudflare-managed embedding preset. Naming one lets Cloudflare pick the dimensions and metric that
+ * match the model, so an index and the model that fills it cannot drift apart.
+ */
+export const VectorizePreset = z
+  .enum([
+    "@cf/baai/bge-small-en-v1.5",
+    "@cf/baai/bge-base-en-v1.5",
+    "@cf/baai/bge-large-en-v1.5",
+    "openai/text-embedding-ada-002",
+    "cohere/embed-multilingual-v2.0",
+  ])
+  .describe("An embedding model preset Cloudflare maps to a fixed dimensions/metric pair at index creation.");
+export type VectorizePreset = z.infer<typeof VectorizePreset>;
+
+/** The shape of the vectors an index holds: how many components each carries, and how they are compared. */
+export const VectorizeIndexConfig = z
+  .object({
+    dimensions: z
+      .number()
+      .int()
+      .positive()
+      .describe("The number of components in every vector the index holds. Cloudflare allows 32 to 1536."),
+    metric: VectorizeMetric,
+  })
+  .describe("A Vectorize index's vector shape: its dimension count and the distance metric it scores with.");
+export type VectorizeIndexConfig = z.output<typeof VectorizeIndexConfig>;
+
+/** A Vectorize index's identity and shape, decoded from the create/get/list responses. */
+export const VectorizeIndexInfo = z
+  .object({
+    name: z.string().min(1).describe("The index name — Vectorize's sole address for an index (no separate uuid id)."),
+    config: VectorizeIndexConfig.describe("The dimensions and metric the index was created with."),
+    description: z.string().optional().describe("The operator-supplied description, when the index carries one."),
+  })
+  .describe("A Cloudflare Vectorize index's identity and vector shape, as returned by the control-plane endpoints.");
+export type VectorizeIndexInfo = z.output<typeof VectorizeIndexInfo>;
+
+/** The type of a metadata property an index can filter on. Chosen per property when the metadata index is created. */
+export const VectorizeMetadataIndexType = z
+  .enum(["string", "number", "boolean"])
+  .describe("The value type of an indexed metadata property, which decides how filters compare against it.");
+export type VectorizeMetadataIndexType = z.infer<typeof VectorizeMetadataIndexType>;
+
+/**
+ * The type as the **list** endpoint reports it, normalized to the casing the **create** endpoint accepts.
+ *
+ * Live Cloudflare answers `metadataIndex.list` with `"String"` while `metadataIndex.create` takes `"string"`
+ * (verified against the account on 2026-07-28). Normalizing on decode is not cosmetic: every consumer compares
+ * a declared type against a live one — `@pithy-sh/vector`'s drift check does exactly that — and `"String" !==
+ * "string"` would report every correctly-provisioned index as mismatched, then send the operator to re-embed a
+ * corpus that was never wrong.
+ */
+const ListedMetadataIndexType = z
+  .string()
+  .transform((value) => value.toLowerCase())
+  .pipe(VectorizeMetadataIndexType)
+  .describe("The value type of an indexed metadata property as the list endpoint reports it, lowercased.");
+
+/** One indexed metadata property on a Vectorize index — the unit that makes a metadata filter possible. */
+export const VectorizeMetadataIndex = z
+  .object({
+    propertyName: z.string().min(1).describe("The metadata property this index covers (e.g. `tenantId`)."),
+    indexType: ListedMetadataIndexType,
+  })
+  .describe("An indexed metadata property on a Vectorize index, as returned by the metadata-index list endpoint.");
+export type VectorizeMetadataIndex = z.output<typeof VectorizeMetadataIndex>;
+
+/**
+ * How a new index is shaped: either an explicit dimensions/metric pair, or a Cloudflare embedding preset
+ * that resolves to one. Both are modeled because a caller that owns its embedding model wants the explicit
+ * pair, while a caller using a stock Cloudflare model is better served by the preset — naming the model once
+ * instead of restating its dimensions and risking a mismatch.
+ */
+export type VectorizeIndexSpec = { dimensions: number; metric: VectorizeMetric } | { preset: VectorizePreset };
+
+/**
+ * Whether an error means "that index is not there".
+ *
+ * Vectorize answers a **deleted** index with `410 Gone` (`vectorize.index.deleted`), not `404` — verified live
+ * on 2026-07-28. For find-then-create provisioning the two are the same answer, and only one of them was being
+ * treated that way: `findIndexByName` threw on a deleted index, so `pithy vector provision` would fail on
+ * precisely the case it exists to repair — an index someone removed.
+ */
+function isAbsentIndexError(error: unknown): boolean {
+  if (isNotFoundError(error)) return true;
+  return typeof error === "object" && error !== null && (error as { status?: unknown }).status === 410;
+}
+
+/** Vectorize's error code for "that metadata index is not there" — verified live on 2026-07-28. */
+const METADATA_INDEX_ABSENT_CODE = 40005;
+
+/**
+ * Whether an error means "that metadata index is not there".
+ *
+ * A third spelling of absence, on top of the 404 and 410 {@link isAbsentIndexError} already covers.
+ * Deleting a metadata index that does not exist answers **`400` with error code 40005** — verified live
+ * on 2026-07-28 against `metadata index with name=tenantId does not exist`. So `deleteMetadataIndex`
+ * documented itself as idempotent while throwing on the one case idempotency is for, and teardown could
+ * not re-run.
+ *
+ * The check is deliberately narrow. A bare `status === 400` would swallow every malformed request this
+ * endpoint rejects — a bad property name, a missing account — and turn an author's mistake into a silent
+ * no-op. Matching the code as well keeps "absent" distinct from "wrong".
+ */
+function isAbsentMetadataIndexError(error: unknown): boolean {
+  if (isAbsentIndexError(error)) return true;
+  if (typeof error !== "object" || error === null) return false;
+  const { status, errors } = error as { status?: unknown; errors?: unknown };
+  if (status !== 400 || !Array.isArray(errors)) return false;
+  return errors.some((entry) => (entry as { code?: unknown } | null)?.code === METADATA_INDEX_ABSENT_CODE);
+}
+
+/** Options a new index accepts beyond its name and shape. */
+export interface CreateVectorizeIndexOptions {
+  /** A human description stored on the index, surfaced in the Cloudflare dashboard. */
+  description?: string;
+}
+
+/**
+ * Account-level Vectorize control plane: **create and delete indexes, and manage their metadata indexes**.
+ * `pithy vector provision` uses this to stand up a per-environment index and declare which metadata
+ * properties are filterable; teardown uses it to remove them. Unlike {@link CloudflareVectorizeManager},
+ * which operates *within* one already-provisioned index (insert/query/delete vectors), this manager is
+ * account-scoped and addresses indexes **by name** — Vectorize indexes carry no separate uuid id.
+ *
+ * Every mutation here is enqueued: Vectorize applies index and metadata-index changes asynchronously, so a
+ * successful call means "accepted", not "visible". Poll {@link listMetadataIndexes} or the data-plane
+ * `describe()` watermarks rather than writing and immediately reading back.
+ */
+export class CloudflareVectorizeProvisioner extends CloudflareManager {
+  getServiceType(): string {
+    return "Vectorize (control plane)";
+  }
+
+  /** Prove access by listing indexes — a read, never a destructive create/delete. Never throws. */
+  async validateServiceAccess(): Promise<boolean> {
+    try {
+      await this.getClient().vectorize.indexes.list({ account_id: this.accountId });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /** Create a Vectorize index by name with an explicit dimensions/metric pair or a Cloudflare preset. */
+  async createIndex(
+    name: string,
+    config: VectorizeIndexSpec,
+    options: CreateVectorizeIndexOptions = {},
+  ): Promise<VectorizeIndexInfo> {
+    const response = await cloudflareRequest(`create Vectorize index ${name}`, () =>
+      this.getClient().vectorize.indexes.create({
+        account_id: this.accountId,
+        name,
+        config,
+        ...(options.description ? { description: options.description } : {}),
+      }),
+    );
+    return decodeResponse(VectorizeIndexInfo, response, "Vectorize index create");
+  }
+
+  /** Delete a Vectorize index by name. Idempotent — a missing index is not an error, so teardown can re-run safely. */
+  async deleteIndex(name: string): Promise<void> {
+    await cloudflareRequest(`delete Vectorize index ${name}`, async () => {
+      try {
+        await this.getClient().vectorize.indexes.delete(name, { account_id: this.accountId });
+      } catch (error) {
+        if (isAbsentIndexError(error)) return;
+        throw error;
+      }
+    });
+  }
+
+  /** List every Vectorize index in the account — for prefix-scan reconcile teardown and drift checks. */
+  async listIndexes(): Promise<VectorizeIndexInfo[]> {
+    return cloudflareRequest("list Vectorize indexes", async () => {
+      const raw: unknown[] = [];
+      for await (const index of this.getClient().vectorize.indexes.list({ account_id: this.accountId })) {
+        raw.push(index);
+      }
+      return decodeResponse(z.array(VectorizeIndexInfo), raw, "Vectorize index list");
+    });
+  }
+
+  /**
+   * Find an index by exact name, or `null` — for idempotent provisioning. Reads the one index rather than
+   * draining the account list, because a Vectorize index's name *is* its address (unlike a KV namespace,
+   * whose title is not addressable). A 404 — or a 410 for a deleted one — means absent, which is an answer,
+   * not a failure.
+   */
+  async findIndexByName(name: string): Promise<VectorizeIndexInfo | null> {
+    return cloudflareRequest(`find Vectorize index ${name}`, async () => {
+      try {
+        const response = await this.getClient().vectorize.indexes.get(name, { account_id: this.accountId });
+        return decodeResponse(VectorizeIndexInfo, response, "Vectorize index get");
+      } catch (error) {
+        if (isAbsentIndexError(error)) return null;
+        throw error;
+      }
+    });
+  }
+
+  /**
+   * Make a metadata property filterable. Cloudflare caps an index at 10 indexed properties, and only vectors
+   * written **after** the metadata index exists are covered — so declare these before the first insert.
+   * The change is enqueued asynchronously; the returned promise resolving means accepted, not live.
+   */
+  async createMetadataIndex(
+    indexName: string,
+    propertyName: string,
+    indexType: VectorizeMetadataIndexType,
+  ): Promise<void> {
+    await cloudflareRequest(`create Vectorize metadata index ${indexName}.${propertyName}`, () =>
+      this.getClient().vectorize.indexes.metadataIndex.create(indexName, {
+        account_id: this.accountId,
+        indexType,
+        propertyName,
+      }),
+    );
+  }
+
+  /** List an index's indexed metadata properties — the read that proves a `createMetadataIndex` has landed. */
+  async listMetadataIndexes(indexName: string): Promise<VectorizeMetadataIndex[]> {
+    const response = await cloudflareRequest(`list Vectorize metadata indexes for ${indexName}`, () =>
+      this.getClient().vectorize.indexes.metadataIndex.list(indexName, { account_id: this.accountId }),
+    );
+    return decodeResponse(
+      z.array(VectorizeMetadataIndex),
+      response?.metadataIndexes ?? [],
+      "Vectorize metadata index list",
+    );
+  }
+
+  /**
+   * Stop filtering on a metadata property. Idempotent — a missing metadata index is not an error, matching
+   * {@link deleteIndex} so teardown can re-run safely. Absence here is `400`/40005, not `404`, which is why
+   * this uses {@link isAbsentMetadataIndexError} rather than the plain not-found check.
+   */
+  async deleteMetadataIndex(indexName: string, propertyName: string): Promise<void> {
+    await cloudflareRequest(`delete Vectorize metadata index ${indexName}.${propertyName}`, async () => {
+      try {
+        await this.getClient().vectorize.indexes.metadataIndex.delete(indexName, {
+          account_id: this.accountId,
+          propertyName,
+        });
+      } catch (error) {
+        if (isAbsentMetadataIndexError(error)) return;
+        throw error;
+      }
+    });
+  }
+}

package/src/client/accounts.ts

@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { Cloudflare } from "cloudflare";
+import { z } from "zod";
+import { cloudflareRequest } from "./errors";
+
+/**
+ * The accounts a bootstrap API token can see — `GET /accounts`.
+ *
+ * **The one Cloudflare read in this package that is not account-scoped**, which is why it is a function
+ * here rather than a manager: {@link CloudflareManager} takes an `accountId` in its config and refuses
+ * without one, and this is the call made *before* an account id exists. `pithy init` collects the token
+ * two prompts before it lists zones, and until now it took the account id on trust — pasted, unverified,
+ * and wrong often enough that "the token is for one account and the id is another" is a documented
+ * failure mode (`CLOUDFLARE_CREDENTIAL_KEYS`). Asking the token what it can see removes that class
+ * outright, and the account's own name is a better nickname than one invented at a prompt (#206).
+ *
+ * Read-only, and never required: a narrowly scoped token that cannot list accounts is a legitimate
+ * token, and every caller falls back to asking.
+ */
+
+/** One Cloudflare account, as `GET /accounts` lists it. Two fields, because two is all anything here uses. */
+export const CfAccount = z
+  .object({
+    id: z
+      .string()
+      .describe("The account id every provisioned resource is created under, and the value a project pins."),
+    name: z
+      .string()
+      .describe("The account's own name, as the operator set it — free text, e.g. `Leed, Inc.`, never a slug."),
+  })
+  .describe("One Cloudflare account a bootstrap API token can see.");
+export type CfAccount = z.output<typeof CfAccount>;
+
+/**
+ * More than this and a picker is not a picker. A token seeing hundreds of accounts is somebody's
+ * reseller credential, and walking every page of it to build a `select` helps nobody — the cap keeps one
+ * unusual token from turning `pithy init` into a paginated crawl.
+ */
+const MAX_ACCOUNTS = 100;
+
+/** What {@link listCloudflareAccounts} needs: a token, and — for a test — somewhere other than Cloudflare. */
+export interface ListCloudflareAccountsOptions {
+  /** The bootstrap API token. Never logged; it is only ever handed to the SDK. */
+  apiToken: string;
+  /**
+   * Seam: the raw account records. Defaults to the SDK's own paginated `accounts.list()`.
+   *
+   * A test passing this never reaches Cloudflare, which matters more here than anywhere else in the
+   * package: the default would list the operator's real accounts using whatever token their shell
+   * exports.
+   */
+  accounts?: (client: Cloudflare) => AsyncIterable<unknown>;
+}
+
+/**
+ * Every account this token can see, name-sorted so a picker is stable between runs.
+ *
+ * **Each record is validated, and one that does not parse is dropped rather than passed on.** This is a
+ * response from outside crossing into a value that becomes `cloudflare.accountId` in a repository and
+ * the account every later resource is created under; a half-record would put an `undefined` id into a
+ * config file and a `[object Object]` into an error message. The same rule `listZones` follows.
+ *
+ * Throws a `cloudflare/request_failed` when the account list could not be read at all — a token without
+ * the permission, or no network. Callers treat that as "no picker" and ask instead.
+ */
+export async function listCloudflareAccounts(options: ListCloudflareAccountsOptions): Promise<CfAccount[]> {
+  return cloudflareRequest("list accounts", async () => {
+    const client = new Cloudflare({ apiToken: options.apiToken });
+    const source = options.accounts ?? ((sdk: Cloudflare) => sdk.accounts.list());
+    const accounts: CfAccount[] = [];
+    for await (const record of source(client)) {
+      const parsed = CfAccount.safeParse(record);
+      if (parsed.success) accounts.push(parsed.data);
+      if (accounts.length >= MAX_ACCOUNTS) break;
+    }
+    return accounts.sort((a, b) => a.name.localeCompare(b.name));
+  });
+}

package/src/client/clients.ts

@@ -0,0 +1,244 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { CloudflareAIManager } from "../ai/aiManager";
+import { CloudflareVectorizeManager } from "../ai/vectorizeManager";
+import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner";
+import { CloudflareD1Manager } from "../d1/d1Manager";
+import { CloudflareD1Provisioner } from "../d1/d1Provisioner";
+import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager";
+import { CloudflareEmailSendManager } from "../email/emailSendManager";
+import { CloudflareCustomHostnamesManager } from "../hostnames/customHostnamesManager";
+import { CloudflareKVManager } from "../kv/kvManager";
+import { CloudflareKVProvisioner } from "../kv/kvProvisioner";
+import { CloudflareImageManager } from "../media/imageManager";
+import { CloudflareStreamManager } from "../media/streamManager";
+import { CloudflareQueueManager } from "../queue/queueManager";
+import type { R2Credentials } from "../r2/r2Credentials";
+import { CloudflareR2Manager } from "../r2/r2Manager";
+import { CloudflareR2Provisioner } from "../r2/r2Provisioner";
+import { CloudflareSecretsStoreManager } from "../secrets/secretsStoreManager";
+import { CloudflareSecretsStoresManager } from "../secrets/secretsStores";
+import { CloudflareAccountTokensManager } from "../tokens/accountTokensManager";
+import { CloudflareTurnstileManager } from "../turnstile/turnstileManager";
+import { CloudflareUserManager } from "../user/userManager";
+import { CloudflareBuildsManager } from "../workers/buildsManager";
+import { CloudflareWorkersManager } from "../workers/workersManager";
+import { WorkersProvisioner } from "../workers/workersProvisioner";
+import { CloudflareZonesManager } from "../zones/zonesManager";
+import type { CloudflareManagerConfig } from "./manager";
+
+/**
+ * One configured entry point to every Cloudflare REST manager. This is a runtime aggregator — it
+ * constructs and memoizes managers from a single `{ apiToken, accountId }` config — **not** a
+ * re-export barrel (CLAUDE.md forbids those); the composition logic is the reason it exists.
+ *
+ * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
+ * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
+ * instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+ */
+export class CloudflareClients {
+  private readonly config: CloudflareManagerConfig;
+
+  private readonly kvByNamespace = new Map<string, CloudflareKVManager>();
+
+  private readonly d1ByDatabase = new Map<string, CloudflareD1Manager>();
+
+  private readonly queueByName = new Map<string, CloudflareQueueManager>();
+
+  private readonly vectorizeByIndex = new Map<string, CloudflareVectorizeManager>();
+
+  private readonly secretsByStore = new Map<string, CloudflareSecretsStoreManager>();
+
+  private secretsStoresManager?: CloudflareSecretsStoresManager;
+
+  private readonly hostnamesByZone = new Map<string, CloudflareCustomHostnamesManager>();
+
+  private aiManager?: CloudflareAIManager;
+
+  private emailSendManager?: CloudflareEmailSendManager;
+  private emailRoutingManager?: CloudflareEmailRoutingManager;
+  private imageManager?: CloudflareImageManager;
+
+  private streamManager?: CloudflareStreamManager;
+
+  private workersManager?: CloudflareWorkersManager;
+
+  private buildsManager?: CloudflareBuildsManager;
+
+  private turnstileManager?: CloudflareTurnstileManager;
+
+  private accountTokensManager?: CloudflareAccountTokensManager;
+
+  private userManager?: CloudflareUserManager;
+  private zonesManager?: CloudflareZonesManager;
+
+  private workersProvisioner?: WorkersProvisioner;
+
+  private d1ProvisionerManager?: CloudflareD1Provisioner;
+
+  private kvProvisionerManager?: CloudflareKVProvisioner;
+
+  private r2ProvisionerManager?: CloudflareR2Provisioner;
+
+  private vectorizeProvisionerManager?: CloudflareVectorizeProvisioner;
+
+  constructor(config: CloudflareManagerConfig) {
+    this.config = config;
+  }
+
+  /** The KV manager for a namespace id. */
+  kv(namespaceId: string): CloudflareKVManager {
+    return memo(this.kvByNamespace, namespaceId, () => new CloudflareKVManager({ ...this.config, namespaceId }));
+  }
+
+  /** The D1 manager for a database id (also a Kysely `D1Dialect` database). */
+  d1(databaseId: string): CloudflareD1Manager {
+    return memo(this.d1ByDatabase, databaseId, () => new CloudflareD1Manager({ ...this.config, databaseId }));
+  }
+
+  /** The Queue manager for a queue name. */
+  queue(queueName: string): CloudflareQueueManager {
+    return memo(this.queueByName, queueName, () => new CloudflareQueueManager({ ...this.config, queueName }));
+  }
+
+  /** The Vectorize manager for an index name. */
+  vectorize(indexName: string): CloudflareVectorizeManager {
+    return memo(this.vectorizeByIndex, indexName, () => new CloudflareVectorizeManager({ ...this.config, indexName }));
+  }
+
+  /** The Secrets Store manager for a store id. */
+  secrets(storeId: string): CloudflareSecretsStoreManager {
+    return memo(this.secretsByStore, storeId, () => new CloudflareSecretsStoreManager({ ...this.config, storeId }));
+  }
+
+  /**
+   * The **account-level** Secrets Store manager — which stores this account has.
+   *
+   * Separate from {@link secrets} because it is asked before any store id exists: `pithy add secrets`
+   * resolves the account's one store and records it, so nothing after that has to ask (#182).
+   */
+  secretsStores(): CloudflareSecretsStoresManager {
+    this.secretsStoresManager ??= new CloudflareSecretsStoresManager(this.config);
+    return this.secretsStoresManager;
+  }
+
+  /** The Custom Hostnames manager for a zone id. */
+  hostnames(zoneId: string): CloudflareCustomHostnamesManager {
+    return memo(this.hostnamesByZone, zoneId, () => new CloudflareCustomHostnamesManager({ ...this.config, zoneId }));
+  }
+
+  /**
+   * The R2 manager for a bucket. R2 needs S3 credentials beyond the API token, so they are supplied
+   * here per call — the manager is **not** memoized: caching by bucket name alone would hand back a
+   * stale instance after a credential rotation. Construction is cheap (the S3 client is lazy).
+   */
+  r2(bucket: R2Credentials & { bucketName: string }): CloudflareR2Manager {
+    return new CloudflareR2Manager({ ...this.config, ...bucket });
+  }
+
+  /** The account-scoped Workers AI manager. */
+  ai(): CloudflareAIManager {
+    this.aiManager ??= new CloudflareAIManager(this.config);
+    return this.aiManager;
+  }
+
+  /** The account-scoped Email Sending (REST) manager — out-of-Worker sends; in a Worker use the binding. */
+  email(): CloudflareEmailSendManager {
+    this.emailSendManager ??= new CloudflareEmailSendManager(this.config);
+    return this.emailSendManager;
+  }
+
+  /** The Email Routing (inbound rules) manager — methods take a zone id. */
+  emailRouting(): CloudflareEmailRoutingManager {
+    this.emailRoutingManager ??= new CloudflareEmailRoutingManager(this.config);
+    return this.emailRoutingManager;
+  }
+
+  /** The account-scoped Images manager. */
+  images(): CloudflareImageManager {
+    this.imageManager ??= new CloudflareImageManager(this.config);
+    return this.imageManager;
+  }
+
+  /** The account-scoped Stream manager. */
+  stream(): CloudflareStreamManager {
+    this.streamManager ??= new CloudflareStreamManager(this.config);
+    return this.streamManager;
+  }
+
+  /** The account-scoped Workers (scripts/deployments) manager. */
+  workers(): CloudflareWorkersManager {
+    this.workersManager ??= new CloudflareWorkersManager(this.config);
+    return this.workersManager;
+  }
+
+  /** The account-scoped Workers Builds manager. */
+  builds(): CloudflareBuildsManager {
+    this.buildsManager ??= new CloudflareBuildsManager(this.config);
+    return this.buildsManager;
+  }
+
+  /** The account-scoped Turnstile manager. */
+  turnstile(): CloudflareTurnstileManager {
+    this.turnstileManager ??= new CloudflareTurnstileManager(this.config);
+    return this.turnstileManager;
+  }
+
+  /** The Workers provisioner (orchestrates the Workers + Builds managers). */
+  provisioner(): WorkersProvisioner {
+    this.workersProvisioner ??= new WorkersProvisioner(this.config);
+    return this.workersProvisioner;
+  }
+
+  /** The account-scoped D1 control plane — create and delete databases. */
+  d1Provisioner(): CloudflareD1Provisioner {
+    this.d1ProvisionerManager ??= new CloudflareD1Provisioner(this.config);
+    return this.d1ProvisionerManager;
+  }
+
+  /** The account-scoped KV control plane — create, find, list, and delete namespaces. */
+  kvProvisioner(): CloudflareKVProvisioner {
+    this.kvProvisionerManager ??= new CloudflareKVProvisioner(this.config);
+    return this.kvProvisionerManager;
+  }
+
+  /** The account-scoped R2 control plane — create, find, list, and delete buckets. */
+  r2Provisioner(): CloudflareR2Provisioner {
+    this.r2ProvisionerManager ??= new CloudflareR2Provisioner(this.config);
+    return this.r2ProvisionerManager;
+  }
+
+  /** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
+  vectorizeProvisioner(): CloudflareVectorizeProvisioner {
+    this.vectorizeProvisionerManager ??= new CloudflareVectorizeProvisioner(this.config);
+    return this.vectorizeProvisionerManager;
+  }
+
+  /** The account-scoped API-token control plane — mint, find, and delete account-owned tokens. */
+  accountTokens(): CloudflareAccountTokensManager {
+    this.accountTokensManager ??= new CloudflareAccountTokensManager(this.config);
+    return this.accountTokensManager;
+  }
+
+  /** The user/token identity reader — resolves the actor behind the calling API token (audit attribution). */
+  user(): CloudflareUserManager {
+    this.userManager ??= new CloudflareUserManager(this.config);
+    return this.userManager;
+  }
+
+  /** The account's zones, read-only — what a custom domain may attach to. Needs only `Zone:Read`. */
+  zones(): CloudflareZonesManager {
+    this.zonesManager ??= new CloudflareZonesManager(this.config);
+    return this.zonesManager;
+  }
+}
+
+/** Return the cached value for `key`, constructing and storing it on first access. */
+function memo<T>(cache: Map<string, T>, key: string, make: () => T): T {
+  const existing = cache.get(key);
+  if (existing !== undefined) return existing;
+  const created = make();
+  cache.set(key, created);
+  return created;
+}