@pithy-sh/cloudflare 0.1.2 → 0.1.3

package/dist/ai/vectorizeProvisioner.js

@@ -0,0 +1,195 @@
+import { cloudflareRequest, decodeResponse, isNotFoundError } from "../client/errors.js";
+import { CloudflareManager } from "../client/manager.js";
+import { z } from "zod";
+//#region src/ai/vectorizeProvisioner.ts
+/** The distance metric an index scores nearest neighbors with. Fixed at creation — it cannot be changed later. */
+const VectorizeMetric = z.enum([
+	"cosine",
+	"euclidean",
+	"dot-product"
+]).describe("The distance metric a Vectorize index scores nearest neighbors with. Fixed at index creation.");
+/**
+* A Cloudflare-managed embedding preset. Naming one lets Cloudflare pick the dimensions and metric that
+* match the model, so an index and the model that fills it cannot drift apart.
+*/
+const VectorizePreset = z.enum([
+	"@cf/baai/bge-small-en-v1.5",
+	"@cf/baai/bge-base-en-v1.5",
+	"@cf/baai/bge-large-en-v1.5",
+	"openai/text-embedding-ada-002",
+	"cohere/embed-multilingual-v2.0"
+]).describe("An embedding model preset Cloudflare maps to a fixed dimensions/metric pair at index creation.");
+/** The shape of the vectors an index holds: how many components each carries, and how they are compared. */
+const VectorizeIndexConfig = z.object({
+	dimensions: z.number().int().positive().describe("The number of components in every vector the index holds. Cloudflare allows 32 to 1536."),
+	metric: VectorizeMetric
+}).describe("A Vectorize index's vector shape: its dimension count and the distance metric it scores with.");
+/** A Vectorize index's identity and shape, decoded from the create/get/list responses. */
+const VectorizeIndexInfo = z.object({
+	name: z.string().min(1).describe("The index name — Vectorize's sole address for an index (no separate uuid id)."),
+	config: VectorizeIndexConfig.describe("The dimensions and metric the index was created with."),
+	description: z.string().optional().describe("The operator-supplied description, when the index carries one.")
+}).describe("A Cloudflare Vectorize index's identity and vector shape, as returned by the control-plane endpoints.");
+/** The type of a metadata property an index can filter on. Chosen per property when the metadata index is created. */
+const VectorizeMetadataIndexType = z.enum([
+	"string",
+	"number",
+	"boolean"
+]).describe("The value type of an indexed metadata property, which decides how filters compare against it.");
+/**
+* The type as the **list** endpoint reports it, normalized to the casing the **create** endpoint accepts.
+*
+* Live Cloudflare answers `metadataIndex.list` with `"String"` while `metadataIndex.create` takes `"string"`
+* (verified against the account on 2026-07-28). Normalizing on decode is not cosmetic: every consumer compares
+* a declared type against a live one — `@pithy-sh/vector`'s drift check does exactly that — and `"String" !==
+* "string"` would report every correctly-provisioned index as mismatched, then send the operator to re-embed a
+* corpus that was never wrong.
+*/
+const ListedMetadataIndexType = z.string().transform((value) => value.toLowerCase()).pipe(VectorizeMetadataIndexType).describe("The value type of an indexed metadata property as the list endpoint reports it, lowercased.");
+/** One indexed metadata property on a Vectorize index — the unit that makes a metadata filter possible. */
+const VectorizeMetadataIndex = z.object({
+	propertyName: z.string().min(1).describe("The metadata property this index covers (e.g. `tenantId`)."),
+	indexType: ListedMetadataIndexType
+}).describe("An indexed metadata property on a Vectorize index, as returned by the metadata-index list endpoint.");
+/**
+* Whether an error means "that index is not there".
+*
+* Vectorize answers a **deleted** index with `410 Gone` (`vectorize.index.deleted`), not `404` — verified live
+* on 2026-07-28. For find-then-create provisioning the two are the same answer, and only one of them was being
+* treated that way: `findIndexByName` threw on a deleted index, so `pithy vector provision` would fail on
+* precisely the case it exists to repair — an index someone removed.
+*/
+function isAbsentIndexError(error) {
+	if (isNotFoundError(error)) return true;
+	return typeof error === "object" && error !== null && error.status === 410;
+}
+/** Vectorize's error code for "that metadata index is not there" — verified live on 2026-07-28. */
+const METADATA_INDEX_ABSENT_CODE = 40005;
+/**
+* Whether an error means "that metadata index is not there".
+*
+* A third spelling of absence, on top of the 404 and 410 {@link isAbsentIndexError} already covers.
+* Deleting a metadata index that does not exist answers **`400` with error code 40005** — verified live
+* on 2026-07-28 against `metadata index with name=tenantId does not exist`. So `deleteMetadataIndex`
+* documented itself as idempotent while throwing on the one case idempotency is for, and teardown could
+* not re-run.
+*
+* The check is deliberately narrow. A bare `status === 400` would swallow every malformed request this
+* endpoint rejects — a bad property name, a missing account — and turn an author's mistake into a silent
+* no-op. Matching the code as well keeps "absent" distinct from "wrong".
+*/
+function isAbsentMetadataIndexError(error) {
+	if (isAbsentIndexError(error)) return true;
+	if (typeof error !== "object" || error === null) return false;
+	const { status, errors } = error;
+	if (status !== 400 || !Array.isArray(errors)) return false;
+	return errors.some((entry) => entry?.code === METADATA_INDEX_ABSENT_CODE);
+}
+/**
+* Account-level Vectorize control plane: **create and delete indexes, and manage their metadata indexes**.
+* `pithy vector provision` uses this to stand up a per-environment index and declare which metadata
+* properties are filterable; teardown uses it to remove them. Unlike {@link CloudflareVectorizeManager},
+* which operates *within* one already-provisioned index (insert/query/delete vectors), this manager is
+* account-scoped and addresses indexes **by name** — Vectorize indexes carry no separate uuid id.
+*
+* Every mutation here is enqueued: Vectorize applies index and metadata-index changes asynchronously, so a
+* successful call means "accepted", not "visible". Poll {@link listMetadataIndexes} or the data-plane
+* `describe()` watermarks rather than writing and immediately reading back.
+*/
+var CloudflareVectorizeProvisioner = class extends CloudflareManager {
+	getServiceType() {
+		return "Vectorize (control plane)";
+	}
+	/** Prove access by listing indexes — a read, never a destructive create/delete. Never throws. */
+	async validateServiceAccess() {
+		try {
+			await this.getClient().vectorize.indexes.list({ account_id: this.accountId });
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Create a Vectorize index by name with an explicit dimensions/metric pair or a Cloudflare preset. */
+	async createIndex(name, config, options = {}) {
+		const response = await cloudflareRequest(`create Vectorize index ${name}`, () => this.getClient().vectorize.indexes.create({
+			account_id: this.accountId,
+			name,
+			config,
+			...options.description ? { description: options.description } : {}
+		}));
+		return decodeResponse(VectorizeIndexInfo, response, "Vectorize index create");
+	}
+	/** Delete a Vectorize index by name. Idempotent — a missing index is not an error, so teardown can re-run safely. */
+	async deleteIndex(name) {
+		await cloudflareRequest(`delete Vectorize index ${name}`, async () => {
+			try {
+				await this.getClient().vectorize.indexes.delete(name, { account_id: this.accountId });
+			} catch (error) {
+				if (isAbsentIndexError(error)) return;
+				throw error;
+			}
+		});
+	}
+	/** List every Vectorize index in the account — for prefix-scan reconcile teardown and drift checks. */
+	async listIndexes() {
+		return cloudflareRequest("list Vectorize indexes", async () => {
+			const raw = [];
+			for await (const index of this.getClient().vectorize.indexes.list({ account_id: this.accountId })) raw.push(index);
+			return decodeResponse(z.array(VectorizeIndexInfo), raw, "Vectorize index list");
+		});
+	}
+	/**
+	* Find an index by exact name, or `null` — for idempotent provisioning. Reads the one index rather than
+	* draining the account list, because a Vectorize index's name *is* its address (unlike a KV namespace,
+	* whose title is not addressable). A 404 — or a 410 for a deleted one — means absent, which is an answer,
+	* not a failure.
+	*/
+	async findIndexByName(name) {
+		return cloudflareRequest(`find Vectorize index ${name}`, async () => {
+			try {
+				const response = await this.getClient().vectorize.indexes.get(name, { account_id: this.accountId });
+				return decodeResponse(VectorizeIndexInfo, response, "Vectorize index get");
+			} catch (error) {
+				if (isAbsentIndexError(error)) return null;
+				throw error;
+			}
+		});
+	}
+	/**
+	* Make a metadata property filterable. Cloudflare caps an index at 10 indexed properties, and only vectors
+	* written **after** the metadata index exists are covered — so declare these before the first insert.
+	* The change is enqueued asynchronously; the returned promise resolving means accepted, not live.
+	*/
+	async createMetadataIndex(indexName, propertyName, indexType) {
+		await cloudflareRequest(`create Vectorize metadata index ${indexName}.${propertyName}`, () => this.getClient().vectorize.indexes.metadataIndex.create(indexName, {
+			account_id: this.accountId,
+			indexType,
+			propertyName
+		}));
+	}
+	/** List an index's indexed metadata properties — the read that proves a `createMetadataIndex` has landed. */
+	async listMetadataIndexes(indexName) {
+		const response = await cloudflareRequest(`list Vectorize metadata indexes for ${indexName}`, () => this.getClient().vectorize.indexes.metadataIndex.list(indexName, { account_id: this.accountId }));
+		return decodeResponse(z.array(VectorizeMetadataIndex), response?.metadataIndexes ?? [], "Vectorize metadata index list");
+	}
+	/**
+	* Stop filtering on a metadata property. Idempotent — a missing metadata index is not an error, matching
+	* {@link deleteIndex} so teardown can re-run safely. Absence here is `400`/40005, not `404`, which is why
+	* this uses {@link isAbsentMetadataIndexError} rather than the plain not-found check.
+	*/
+	async deleteMetadataIndex(indexName, propertyName) {
+		await cloudflareRequest(`delete Vectorize metadata index ${indexName}.${propertyName}`, async () => {
+			try {
+				await this.getClient().vectorize.indexes.metadataIndex.delete(indexName, {
+					account_id: this.accountId,
+					propertyName
+				});
+			} catch (error) {
+				if (isAbsentMetadataIndexError(error)) return;
+				throw error;
+			}
+		});
+	}
+};
+//#endregion
+export { CloudflareVectorizeProvisioner, VectorizeIndexConfig, VectorizeIndexInfo, VectorizeMetadataIndex, VectorizeMetadataIndexType, VectorizeMetric, VectorizePreset };

package/dist/client/accounts.d.ts

@@ -0,0 +1,48 @@
+import { Cloudflare } from "cloudflare";
+import { z } from "zod";
+/**
+ * The accounts a bootstrap API token can see — `GET /accounts`.
+ *
+ * **The one Cloudflare read in this package that is not account-scoped**, which is why it is a function
+ * here rather than a manager: {@link CloudflareManager} takes an `accountId` in its config and refuses
+ * without one, and this is the call made *before* an account id exists. `pithy init` collects the token
+ * two prompts before it lists zones, and until now it took the account id on trust — pasted, unverified,
+ * and wrong often enough that "the token is for one account and the id is another" is a documented
+ * failure mode (`CLOUDFLARE_CREDENTIAL_KEYS`). Asking the token what it can see removes that class
+ * outright, and the account's own name is a better nickname than one invented at a prompt (#206).
+ *
+ * Read-only, and never required: a narrowly scoped token that cannot list accounts is a legitimate
+ * token, and every caller falls back to asking.
+ */
+/** One Cloudflare account, as `GET /accounts` lists it. Two fields, because two is all anything here uses. */
+export declare const CfAccount: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type CfAccount = z.output<typeof CfAccount>;
+/** What {@link listCloudflareAccounts} needs: a token, and — for a test — somewhere other than Cloudflare. */
+export interface ListCloudflareAccountsOptions {
+    /** The bootstrap API token. Never logged; it is only ever handed to the SDK. */
+    apiToken: string;
+    /**
+     * Seam: the raw account records. Defaults to the SDK's own paginated `accounts.list()`.
+     *
+     * A test passing this never reaches Cloudflare, which matters more here than anywhere else in the
+     * package: the default would list the operator's real accounts using whatever token their shell
+     * exports.
+     */
+    accounts?: (client: Cloudflare) => AsyncIterable<unknown>;
+}
+/**
+ * Every account this token can see, name-sorted so a picker is stable between runs.
+ *
+ * **Each record is validated, and one that does not parse is dropped rather than passed on.** This is a
+ * response from outside crossing into a value that becomes `cloudflare.accountId` in a repository and
+ * the account every later resource is created under; a half-record would put an `undefined` id into a
+ * config file and a `[object Object]` into an error message. The same rule `listZones` follows.
+ *
+ * Throws a `cloudflare/request_failed` when the account list could not be read at all — a token without
+ * the permission, or no network. Callers treat that as "no picker" and ask instead.
+ */
+export declare function listCloudflareAccounts(options: ListCloudflareAccountsOptions): Promise<CfAccount[]>;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/client/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/client/accounts.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;GAaG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,SAAS;;;iBAS8C,CAAC;AACrE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AASnD,8GAA8G;AAC9G,MAAM,WAAW,6BAA6B;IAC5C,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAYzG"}

package/dist/client/accounts.js

@@ -0,0 +1,55 @@
+import { cloudflareRequest } from "./errors.js";
+import { z } from "zod";
+import { Cloudflare } from "cloudflare";
+//#region src/client/accounts.ts
+/**
+* The accounts a bootstrap API token can see — `GET /accounts`.
+*
+* **The one Cloudflare read in this package that is not account-scoped**, which is why it is a function
+* here rather than a manager: {@link CloudflareManager} takes an `accountId` in its config and refuses
+* without one, and this is the call made *before* an account id exists. `pithy init` collects the token
+* two prompts before it lists zones, and until now it took the account id on trust — pasted, unverified,
+* and wrong often enough that "the token is for one account and the id is another" is a documented
+* failure mode (`CLOUDFLARE_CREDENTIAL_KEYS`). Asking the token what it can see removes that class
+* outright, and the account's own name is a better nickname than one invented at a prompt (#206).
+*
+* Read-only, and never required: a narrowly scoped token that cannot list accounts is a legitimate
+* token, and every caller falls back to asking.
+*/
+/** One Cloudflare account, as `GET /accounts` lists it. Two fields, because two is all anything here uses. */
+const CfAccount = z.object({
+	id: z.string().describe("The account id every provisioned resource is created under, and the value a project pins."),
+	name: z.string().describe("The account's own name, as the operator set it — free text, e.g. `Leed, Inc.`, never a slug.")
+}).describe("One Cloudflare account a bootstrap API token can see.");
+/**
+* More than this and a picker is not a picker. A token seeing hundreds of accounts is somebody's
+* reseller credential, and walking every page of it to build a `select` helps nobody — the cap keeps one
+* unusual token from turning `pithy init` into a paginated crawl.
+*/
+const MAX_ACCOUNTS = 100;
+/**
+* Every account this token can see, name-sorted so a picker is stable between runs.
+*
+* **Each record is validated, and one that does not parse is dropped rather than passed on.** This is a
+* response from outside crossing into a value that becomes `cloudflare.accountId` in a repository and
+* the account every later resource is created under; a half-record would put an `undefined` id into a
+* config file and a `[object Object]` into an error message. The same rule `listZones` follows.
+*
+* Throws a `cloudflare/request_failed` when the account list could not be read at all — a token without
+* the permission, or no network. Callers treat that as "no picker" and ask instead.
+*/
+async function listCloudflareAccounts(options) {
+	return cloudflareRequest("list accounts", async () => {
+		const client = new Cloudflare({ apiToken: options.apiToken });
+		const source = options.accounts ?? ((sdk) => sdk.accounts.list());
+		const accounts = [];
+		for await (const record of source(client)) {
+			const parsed = CfAccount.safeParse(record);
+			if (parsed.success) accounts.push(parsed.data);
+			if (accounts.length >= MAX_ACCOUNTS) break;
+		}
+		return accounts.sort((a, b) => a.name.localeCompare(b.name));
+	});
+}
+//#endregion
+export { CfAccount, listCloudflareAccounts };

package/dist/client/clients.d.ts

@@ -0,0 +1,122 @@
+import { CloudflareAIManager } from "../ai/aiManager";
+import { CloudflareVectorizeManager } from "../ai/vectorizeManager";
+import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner";
+import { CloudflareD1Manager } from "../d1/d1Manager";
+import { CloudflareD1Provisioner } from "../d1/d1Provisioner";
+import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager";
+import { CloudflareEmailSendManager } from "../email/emailSendManager";
+import { CloudflareCustomHostnamesManager } from "../hostnames/customHostnamesManager";
+import { CloudflareKVManager } from "../kv/kvManager";
+import { CloudflareKVProvisioner } from "../kv/kvProvisioner";
+import { CloudflareImageManager } from "../media/imageManager";
+import { CloudflareStreamManager } from "../media/streamManager";
+import { CloudflareQueueManager } from "../queue/queueManager";
+import type { R2Credentials } from "../r2/r2Credentials";
+import { CloudflareR2Manager } from "../r2/r2Manager";
+import { CloudflareR2Provisioner } from "../r2/r2Provisioner";
+import { CloudflareSecretsStoreManager } from "../secrets/secretsStoreManager";
+import { CloudflareSecretsStoresManager } from "../secrets/secretsStores";
+import { CloudflareAccountTokensManager } from "../tokens/accountTokensManager";
+import { CloudflareTurnstileManager } from "../turnstile/turnstileManager";
+import { CloudflareUserManager } from "../user/userManager";
+import { CloudflareBuildsManager } from "../workers/buildsManager";
+import { CloudflareWorkersManager } from "../workers/workersManager";
+import { WorkersProvisioner } from "../workers/workersProvisioner";
+import { CloudflareZonesManager } from "../zones/zonesManager";
+import type { CloudflareManagerConfig } from "./manager";
+/**
+ * One configured entry point to every Cloudflare REST manager. This is a runtime aggregator — it
+ * constructs and memoizes managers from a single `{ apiToken, accountId }` config — **not** a
+ * re-export barrel (CLAUDE.md forbids those); the composition logic is the reason it exists.
+ *
+ * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
+ * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
+ * instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+ */
+export declare class CloudflareClients {
+    private readonly config;
+    private readonly kvByNamespace;
+    private readonly d1ByDatabase;
+    private readonly queueByName;
+    private readonly vectorizeByIndex;
+    private readonly secretsByStore;
+    private secretsStoresManager?;
+    private readonly hostnamesByZone;
+    private aiManager?;
+    private emailSendManager?;
+    private emailRoutingManager?;
+    private imageManager?;
+    private streamManager?;
+    private workersManager?;
+    private buildsManager?;
+    private turnstileManager?;
+    private accountTokensManager?;
+    private userManager?;
+    private zonesManager?;
+    private workersProvisioner?;
+    private d1ProvisionerManager?;
+    private kvProvisionerManager?;
+    private r2ProvisionerManager?;
+    private vectorizeProvisionerManager?;
+    constructor(config: CloudflareManagerConfig);
+    /** The KV manager for a namespace id. */
+    kv(namespaceId: string): CloudflareKVManager;
+    /** The D1 manager for a database id (also a Kysely `D1Dialect` database). */
+    d1(databaseId: string): CloudflareD1Manager;
+    /** The Queue manager for a queue name. */
+    queue(queueName: string): CloudflareQueueManager;
+    /** The Vectorize manager for an index name. */
+    vectorize(indexName: string): CloudflareVectorizeManager;
+    /** The Secrets Store manager for a store id. */
+    secrets(storeId: string): CloudflareSecretsStoreManager;
+    /**
+     * The **account-level** Secrets Store manager — which stores this account has.
+     *
+     * Separate from {@link secrets} because it is asked before any store id exists: `pithy add secrets`
+     * resolves the account's one store and records it, so nothing after that has to ask (#182).
+     */
+    secretsStores(): CloudflareSecretsStoresManager;
+    /** The Custom Hostnames manager for a zone id. */
+    hostnames(zoneId: string): CloudflareCustomHostnamesManager;
+    /**
+     * The R2 manager for a bucket. R2 needs S3 credentials beyond the API token, so they are supplied
+     * here per call — the manager is **not** memoized: caching by bucket name alone would hand back a
+     * stale instance after a credential rotation. Construction is cheap (the S3 client is lazy).
+     */
+    r2(bucket: R2Credentials & {
+        bucketName: string;
+    }): CloudflareR2Manager;
+    /** The account-scoped Workers AI manager. */
+    ai(): CloudflareAIManager;
+    /** The account-scoped Email Sending (REST) manager — out-of-Worker sends; in a Worker use the binding. */
+    email(): CloudflareEmailSendManager;
+    /** The Email Routing (inbound rules) manager — methods take a zone id. */
+    emailRouting(): CloudflareEmailRoutingManager;
+    /** The account-scoped Images manager. */
+    images(): CloudflareImageManager;
+    /** The account-scoped Stream manager. */
+    stream(): CloudflareStreamManager;
+    /** The account-scoped Workers (scripts/deployments) manager. */
+    workers(): CloudflareWorkersManager;
+    /** The account-scoped Workers Builds manager. */
+    builds(): CloudflareBuildsManager;
+    /** The account-scoped Turnstile manager. */
+    turnstile(): CloudflareTurnstileManager;
+    /** The Workers provisioner (orchestrates the Workers + Builds managers). */
+    provisioner(): WorkersProvisioner;
+    /** The account-scoped D1 control plane — create and delete databases. */
+    d1Provisioner(): CloudflareD1Provisioner;
+    /** The account-scoped KV control plane — create, find, list, and delete namespaces. */
+    kvProvisioner(): CloudflareKVProvisioner;
+    /** The account-scoped R2 control plane — create, find, list, and delete buckets. */
+    r2Provisioner(): CloudflareR2Provisioner;
+    /** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
+    vectorizeProvisioner(): CloudflareVectorizeProvisioner;
+    /** The account-scoped API-token control plane — mint, find, and delete account-owned tokens. */
+    accountTokens(): CloudflareAccountTokensManager;
+    /** The user/token identity reader — resolves the actor behind the calling API token (audit attribution). */
+    user(): CloudflareUserManager;
+    /** The account's zones, read-only — what a custom domain may attach to. Needs only `Zone:Read`. */
+    zones(): CloudflareZonesManager;
+}
+//# sourceMappingURL=clients.d.ts.map

package/dist/client/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/client/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IAEzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoD;IAEnF,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuD;IAEvF,OAAO,CAAC,SAAS,CAAC,CAAsB;IAExC,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAAgC;IAC5D,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,2BAA2B,CAAC,CAAiC;IAErE,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED,yCAAyC;IACzC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3C;IAED,6EAA6E;IAC7E,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE/C;IAED,+CAA+C;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAEvD;IAED,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,6BAA6B,CAEtD;IAED;;;;;OAKG;IACH,aAAa,IAAI,8BAA8B,CAG9C;IAED,kDAAkD;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAE1D;IAED;;;;OAIG;IACH,EAAE,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,mBAAmB,CAEtE;IAED,6CAA6C;IAC7C,EAAE,IAAI,mBAAmB,CAGxB;IAED,0GAA0G;IAC1G,KAAK,IAAI,0BAA0B,CAGlC;IAED,0EAA0E;IAC1E,YAAY,IAAI,6BAA6B,CAG5C;IAED,yCAAyC;IACzC,MAAM,IAAI,sBAAsB,CAG/B;IAED,yCAAyC;IACzC,MAAM,IAAI,uBAAuB,CAGhC;IAED,gEAAgE;IAChE,OAAO,IAAI,wBAAwB,CAGlC;IAED,iDAAiD;IACjD,MAAM,IAAI,uBAAuB,CAGhC;IAED,4CAA4C;IAC5C,SAAS,IAAI,0BAA0B,CAGtC;IAED,4EAA4E;IAC5E,WAAW,IAAI,kBAAkB,CAGhC;IAED,yEAAyE;IACzE,aAAa,IAAI,uBAAuB,CAGvC;IAED,uFAAuF;IACvF,aAAa,IAAI,uBAAuB,CAGvC;IAED,oFAAoF;IACpF,aAAa,IAAI,uBAAuB,CAGvC;IAED,sHAAsH;IACtH,oBAAoB,IAAI,8BAA8B,CAGrD;IAED,gGAAgG;IAChG,aAAa,IAAI,8BAA8B,CAG9C;IAED,4GAA4G;IAC5G,IAAI,IAAI,qBAAqB,CAG5B;IAED,mGAAmG;IACnG,KAAK,IAAI,sBAAsB,CAG9B;CACF"}

package/dist/client/clients.js

@@ -0,0 +1,216 @@
+import { CloudflareAIManager } from "../ai/aiManager.js";
+import { CloudflareVectorizeManager } from "../ai/vectorizeManager.js";
+import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner.js";
+import { CloudflareD1Manager } from "../d1/d1Manager.js";
+import { CloudflareD1Provisioner } from "../d1/d1Provisioner.js";
+import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager.js";
+import { CloudflareEmailSendManager } from "../email/emailSendManager.js";
+import { CloudflareCustomHostnamesManager } from "../hostnames/customHostnamesManager.js";
+import { CloudflareKVManager } from "../kv/kvManager.js";
+import { CloudflareKVProvisioner } from "../kv/kvProvisioner.js";
+import { CloudflareImageManager } from "../media/imageManager.js";
+import { CloudflareStreamManager } from "../media/streamManager.js";
+import { CloudflareQueueManager } from "../queue/queueManager.js";
+import { CloudflareR2Manager } from "../r2/r2Manager.js";
+import { CloudflareR2Provisioner } from "../r2/r2Provisioner.js";
+import { CloudflareSecretsStoreManager } from "../secrets/secretsStoreManager.js";
+import { CloudflareSecretsStoresManager } from "../secrets/secretsStores.js";
+import { CloudflareUserManager } from "../user/userManager.js";
+import { CloudflareAccountTokensManager } from "../tokens/accountTokensManager.js";
+import { CloudflareTurnstileManager } from "../turnstile/turnstileManager.js";
+import { CloudflareBuildsManager } from "../workers/buildsManager.js";
+import { CloudflareWorkersManager } from "../workers/workersManager.js";
+import { WorkersProvisioner } from "../workers/workersProvisioner.js";
+import { CloudflareZonesManager } from "../zones/zonesManager.js";
+//#region src/client/clients.ts
+/**
+* One configured entry point to every Cloudflare REST manager. This is a runtime aggregator — it
+* constructs and memoizes managers from a single `{ apiToken, accountId }` config — **not** a
+* re-export barrel (CLAUDE.md forbids those); the composition logic is the reason it exists.
+*
+* Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
+* buckets) are keyed by their resource id, so repeated calls for the same id return one shared
+* instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+*/
+var CloudflareClients = class {
+	config;
+	kvByNamespace = /* @__PURE__ */ new Map();
+	d1ByDatabase = /* @__PURE__ */ new Map();
+	queueByName = /* @__PURE__ */ new Map();
+	vectorizeByIndex = /* @__PURE__ */ new Map();
+	secretsByStore = /* @__PURE__ */ new Map();
+	secretsStoresManager;
+	hostnamesByZone = /* @__PURE__ */ new Map();
+	aiManager;
+	emailSendManager;
+	emailRoutingManager;
+	imageManager;
+	streamManager;
+	workersManager;
+	buildsManager;
+	turnstileManager;
+	accountTokensManager;
+	userManager;
+	zonesManager;
+	workersProvisioner;
+	d1ProvisionerManager;
+	kvProvisionerManager;
+	r2ProvisionerManager;
+	vectorizeProvisionerManager;
+	constructor(config) {
+		this.config = config;
+	}
+	/** The KV manager for a namespace id. */
+	kv(namespaceId) {
+		return memo(this.kvByNamespace, namespaceId, () => new CloudflareKVManager({
+			...this.config,
+			namespaceId
+		}));
+	}
+	/** The D1 manager for a database id (also a Kysely `D1Dialect` database). */
+	d1(databaseId) {
+		return memo(this.d1ByDatabase, databaseId, () => new CloudflareD1Manager({
+			...this.config,
+			databaseId
+		}));
+	}
+	/** The Queue manager for a queue name. */
+	queue(queueName) {
+		return memo(this.queueByName, queueName, () => new CloudflareQueueManager({
+			...this.config,
+			queueName
+		}));
+	}
+	/** The Vectorize manager for an index name. */
+	vectorize(indexName) {
+		return memo(this.vectorizeByIndex, indexName, () => new CloudflareVectorizeManager({
+			...this.config,
+			indexName
+		}));
+	}
+	/** The Secrets Store manager for a store id. */
+	secrets(storeId) {
+		return memo(this.secretsByStore, storeId, () => new CloudflareSecretsStoreManager({
+			...this.config,
+			storeId
+		}));
+	}
+	/**
+	* The **account-level** Secrets Store manager — which stores this account has.
+	*
+	* Separate from {@link secrets} because it is asked before any store id exists: `pithy add secrets`
+	* resolves the account's one store and records it, so nothing after that has to ask (#182).
+	*/
+	secretsStores() {
+		this.secretsStoresManager ??= new CloudflareSecretsStoresManager(this.config);
+		return this.secretsStoresManager;
+	}
+	/** The Custom Hostnames manager for a zone id. */
+	hostnames(zoneId) {
+		return memo(this.hostnamesByZone, zoneId, () => new CloudflareCustomHostnamesManager({
+			...this.config,
+			zoneId
+		}));
+	}
+	/**
+	* The R2 manager for a bucket. R2 needs S3 credentials beyond the API token, so they are supplied
+	* here per call — the manager is **not** memoized: caching by bucket name alone would hand back a
+	* stale instance after a credential rotation. Construction is cheap (the S3 client is lazy).
+	*/
+	r2(bucket) {
+		return new CloudflareR2Manager({
+			...this.config,
+			...bucket
+		});
+	}
+	/** The account-scoped Workers AI manager. */
+	ai() {
+		this.aiManager ??= new CloudflareAIManager(this.config);
+		return this.aiManager;
+	}
+	/** The account-scoped Email Sending (REST) manager — out-of-Worker sends; in a Worker use the binding. */
+	email() {
+		this.emailSendManager ??= new CloudflareEmailSendManager(this.config);
+		return this.emailSendManager;
+	}
+	/** The Email Routing (inbound rules) manager — methods take a zone id. */
+	emailRouting() {
+		this.emailRoutingManager ??= new CloudflareEmailRoutingManager(this.config);
+		return this.emailRoutingManager;
+	}
+	/** The account-scoped Images manager. */
+	images() {
+		this.imageManager ??= new CloudflareImageManager(this.config);
+		return this.imageManager;
+	}
+	/** The account-scoped Stream manager. */
+	stream() {
+		this.streamManager ??= new CloudflareStreamManager(this.config);
+		return this.streamManager;
+	}
+	/** The account-scoped Workers (scripts/deployments) manager. */
+	workers() {
+		this.workersManager ??= new CloudflareWorkersManager(this.config);
+		return this.workersManager;
+	}
+	/** The account-scoped Workers Builds manager. */
+	builds() {
+		this.buildsManager ??= new CloudflareBuildsManager(this.config);
+		return this.buildsManager;
+	}
+	/** The account-scoped Turnstile manager. */
+	turnstile() {
+		this.turnstileManager ??= new CloudflareTurnstileManager(this.config);
+		return this.turnstileManager;
+	}
+	/** The Workers provisioner (orchestrates the Workers + Builds managers). */
+	provisioner() {
+		this.workersProvisioner ??= new WorkersProvisioner(this.config);
+		return this.workersProvisioner;
+	}
+	/** The account-scoped D1 control plane — create and delete databases. */
+	d1Provisioner() {
+		this.d1ProvisionerManager ??= new CloudflareD1Provisioner(this.config);
+		return this.d1ProvisionerManager;
+	}
+	/** The account-scoped KV control plane — create, find, list, and delete namespaces. */
+	kvProvisioner() {
+		this.kvProvisionerManager ??= new CloudflareKVProvisioner(this.config);
+		return this.kvProvisionerManager;
+	}
+	/** The account-scoped R2 control plane — create, find, list, and delete buckets. */
+	r2Provisioner() {
+		this.r2ProvisionerManager ??= new CloudflareR2Provisioner(this.config);
+		return this.r2ProvisionerManager;
+	}
+	/** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
+	vectorizeProvisioner() {
+		this.vectorizeProvisionerManager ??= new CloudflareVectorizeProvisioner(this.config);
+		return this.vectorizeProvisionerManager;
+	}
+	/** The account-scoped API-token control plane — mint, find, and delete account-owned tokens. */
+	accountTokens() {
+		this.accountTokensManager ??= new CloudflareAccountTokensManager(this.config);
+		return this.accountTokensManager;
+	}
+	/** The user/token identity reader — resolves the actor behind the calling API token (audit attribution). */
+	user() {
+		this.userManager ??= new CloudflareUserManager(this.config);
+		return this.userManager;
+	}
+	/** The account's zones, read-only — what a custom domain may attach to. Needs only `Zone:Read`. */
+	zones() {
+		this.zonesManager ??= new CloudflareZonesManager(this.config);
+		return this.zonesManager;
+	}
+};
+/** Return the cached value for `key`, constructing and storing it on first access. */
+function memo(cache, key, make) {
+	const existing = cache.get(key);
+	if (existing !== void 0) return existing;
+	const created = make();
+	cache.set(key, created);
+	return created;
+}
+//#endregion
+export { CloudflareClients };