@pithy-sh/cloudflare 0.4.2 → 0.6.0

package/dist/artifacts/artifactsManager.d.ts

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { CloudflareManager } from "../client/manager";
+/**
+ * Account-level Artifacts control plane: **list and delete the repos in a namespace, then the namespace** (#673).
+ *
+ * Inside a Worker a repo is reached through the `artifacts` binding. This is the other side of that: `pithy feature
+ * destroy` reaps every repo in a feature's namespace, because repos cost storage and nothing else ever deletes one.
+ * There is no create here, because Cloudflare creates a namespace the first time a repo is created in it and the kit
+ * creates repos only from the Worker. There is a namespace delete, because nothing else removes one.
+ *
+ * The SDK this package targets exposes no Artifacts resource, so this uses the documented escape hatch — the raw
+ * token and `fetch` — against the paths [the REST API](https://developers.cloudflare.com/artifacts/api/rest-api/)
+ * publishes, and validates what comes back.
+ */
+export declare class CloudflareArtifactsManager extends CloudflareManager {
+    getServiceType(): string;
+    /** Prove access by listing namespaces — a read, never a write. Never throws. */
+    validateServiceAccess(): Promise<boolean>;
+    /**
+     * Every repo name in a namespace, across every page. **A namespace that does not exist has none**: Cloudflare
+     * makes one on its first repo, so a feature that never created a repo has no namespace, and teardown of it is a
+     * clean no-op rather than a failure.
+     */
+    listRepos(namespace: string): Promise<string[]>;
+    /**
+     * Delete one repo and every token on it. **Resolves whether one was there**, so teardown re-runs safely: a repo
+     * already gone is `false`, not an error. Cloudflare answers `202 Accepted`, so the storage may take a moment to
+     * be released after this returns.
+     */
+    deleteRepo(namespace: string, name: string): Promise<boolean>;
+    /**
+     * Delete a namespace, once it is empty. Cloudflare makes one on the first repo and nothing else ever deletes it,
+     * so a feature's would outlive the feature. `DELETE /accounts/{id}/artifacts/namespaces/{namespace}` is in
+     * Cloudflare's published API schema, not on the Artifacts REST page: it deletes an empty namespace, answers `204`,
+     * and answers `409` while a repo remains.
+     *
+     * **Three answers, none of them a failure of teardown.** `deleted` it was there; `absent` it is already gone or was
+     * never created, so a re-run is a clean no-op; `occupied` a repo is still in it — a repo delete is `202 Accepted`,
+     * so one just reaped can hold the namespace a moment longer, and the caller decides how long to wait.
+     */
+    deleteNamespace(namespace: string): Promise<"deleted" | "absent" | "occupied">;
+    private namespacePath;
+    private send;
+    /**
+     * One REST call, its envelope unwrapped. `null` for a 404 — the namespace or the repo is not there, which every
+     * caller here reads as nothing to do. {@link OCCUPIED} for a 409 when the caller asks for it — a namespace that
+     * still holds a repo. Any other failure is Cloudflare's refusal, in Cloudflare's words.
+     */
+    private call;
+}
+//# sourceMappingURL=artifactsManager.d.ts.map

package/dist/artifacts/artifactsManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactsManager.d.ts","sourceRoot":"","sources":["../../src/artifacts/artifactsManager.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoCtD;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,cAAc,IAAI,MAAM,CAEvB;IAED,gFAAgF;IAC1E,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;OAIG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBpD;IAED;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlE;IAED;;;;;;;;;OASG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC,CAOnF;IAED,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,IAAI;IAIZ;;;;OAIG;YACW,IAAI;CAwCnB"}

package/dist/artifacts/artifactsManager.js

@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { CloudflareInvalidResponseError, cloudflareApiErrors, cloudflareRefusal, cloudflareRequest, decodeResponse, messageOf } from "../client/errors.js";
+import { CloudflareManager } from "../client/manager.js";
+import { ValidationError } from "@pithy-sh/core/src/error/pithyError";
+import { z } from "zod";
+//#region src/artifacts/artifactsManager.ts
+/** The Cloudflare REST API v4 base URL. Artifacts lives under `/accounts/{id}/artifacts`. */
+const CF_API_BASE = "https://api.cloudflare.com/client/v4";
+/** The most repos one page of `GET …/repos` returns. Cloudflare's own maximum. */
+const PAGE_LIMIT = 200;
+/**
+* A namespace or repo name, as Cloudflare's limits page states it: a letter or digit, then letters, digits, `.`,
+* `_` and `-`. Asserted before either reaches a path, because a `/` or a `..` there addresses another endpoint.
+*/
+const ARTIFACTS_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/** What {@link CloudflareArtifactsManager.deleteNamespace} is told by a `409`: a repo is still in the namespace. */
+const OCCUPIED = Symbol("occupied");
+/** The standard `{ result, success, errors, result_info }` envelope, as far as this reads it. */
+const Envelope = z.object({
+	result: z.unknown().describe("The payload."),
+	success: z.boolean().optional().describe("Whether Cloudflare reports the call succeeded."),
+	errors: z.array(z.unknown()).optional().describe("Cloudflare's own error entries."),
+	result_info: z.object({ cursor: z.string().nullable().optional().describe("The next page's cursor, when there is one.") }).loose().optional().describe("Pagination, for a listing.")
+}).describe("A Cloudflare REST envelope.");
+/** One page of `GET …/repos`: only the name of each repo is read. */
+const RepoPage = z.array(z.object({ name: z.string().describe("The repo's name in the namespace.") }).loose()).describe("One page of an Artifacts namespace's repos.");
+/**
+* Account-level Artifacts control plane: **list and delete the repos in a namespace, then the namespace** (#673).
+*
+* Inside a Worker a repo is reached through the `artifacts` binding. This is the other side of that: `pithy feature
+* destroy` reaps every repo in a feature's namespace, because repos cost storage and nothing else ever deletes one.
+* There is no create here, because Cloudflare creates a namespace the first time a repo is created in it and the kit
+* creates repos only from the Worker. There is a namespace delete, because nothing else removes one.
+*
+* The SDK this package targets exposes no Artifacts resource, so this uses the documented escape hatch — the raw
+* token and `fetch` — against the paths [the REST API](https://developers.cloudflare.com/artifacts/api/rest-api/)
+* publishes, and validates what comes back.
+*/
+var CloudflareArtifactsManager = class extends CloudflareManager {
+	getServiceType() {
+		return "Cloudflare Artifacts (control plane)";
+	}
+	/** Prove access by listing namespaces — a read, never a write. Never throws. */
+	async validateServiceAccess() {
+		try {
+			return (await this.send("GET", `/accounts/${this.getAccountId()}/artifacts/namespaces?limit=1`)).ok;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Every repo name in a namespace, across every page. **A namespace that does not exist has none**: Cloudflare
+	* makes one on its first repo, so a feature that never created a repo has no namespace, and teardown of it is a
+	* clean no-op rather than a failure.
+	*/
+	async listRepos(namespace) {
+		assertName(namespace, "namespace");
+		return cloudflareRequest(`list Artifacts repos in ${namespace}`, async () => {
+			const names = /* @__PURE__ */ new Set();
+			const followed = /* @__PURE__ */ new Set();
+			let cursor;
+			for (;;) {
+				const query = `limit=${PAGE_LIMIT}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`;
+				const page = await this.call("GET", `${this.namespacePath(namespace)}/repos?${query}`);
+				if (page === null) return [...names];
+				for (const repo of decodeResponse(RepoPage, page.result, "Artifacts repo list")) names.add(repo.name);
+				const next = page.result_info?.cursor ?? void 0;
+				if (!next || followed.has(next)) return [...names];
+				followed.add(next);
+				cursor = next;
+			}
+		});
+	}
+	/**
+	* Delete one repo and every token on it. **Resolves whether one was there**, so teardown re-runs safely: a repo
+	* already gone is `false`, not an error. Cloudflare answers `202 Accepted`, so the storage may take a moment to
+	* be released after this returns.
+	*/
+	async deleteRepo(namespace, name) {
+		assertName(namespace, "namespace");
+		assertName(name, "repo");
+		return cloudflareRequest(`delete Artifacts repo ${namespace}/${name}`, async () => {
+			return await this.call("DELETE", `${this.namespacePath(namespace)}/repos/${name}`) !== null;
+		});
+	}
+	/**
+	* Delete a namespace, once it is empty. Cloudflare makes one on the first repo and nothing else ever deletes it,
+	* so a feature's would outlive the feature. `DELETE /accounts/{id}/artifacts/namespaces/{namespace}` is in
+	* Cloudflare's published API schema, not on the Artifacts REST page: it deletes an empty namespace, answers `204`,
+	* and answers `409` while a repo remains.
+	*
+	* **Three answers, none of them a failure of teardown.** `deleted` it was there; `absent` it is already gone or was
+	* never created, so a re-run is a clean no-op; `occupied` a repo is still in it — a repo delete is `202 Accepted`,
+	* so one just reaped can hold the namespace a moment longer, and the caller decides how long to wait.
+	*/
+	async deleteNamespace(namespace) {
+		assertName(namespace, "namespace");
+		return cloudflareRequest(`delete Artifacts namespace ${namespace}`, async () => {
+			const result = await this.call("DELETE", this.namespacePath(namespace), { occupied: true });
+			if (result === OCCUPIED) return "occupied";
+			return result === null ? "absent" : "deleted";
+		});
+	}
+	namespacePath(namespace) {
+		return `/accounts/${this.getAccountId()}/artifacts/namespaces/${namespace}`;
+	}
+	send(method, path) {
+		return fetch(`${CF_API_BASE}${path}`, {
+			method,
+			headers: { authorization: `Bearer ${this.getApiToken()}` }
+		});
+	}
+	async call(method, path, options = {}) {
+		const response = await this.send(method, path);
+		if (response.status === 404) return null;
+		if (response.status === 409 && options.occupied) return OCCUPIED;
+		const text = await response.text();
+		if (response.ok && text.length === 0) return { result: null };
+		let parsed = {};
+		if (text.length > 0) try {
+			parsed = JSON.parse(text);
+		} catch (error) {
+			throw new CloudflareInvalidResponseError({
+				message: "A Cloudflare Artifacts response was not valid JSON.",
+				detail: `${method} ${path}: ${messageOf(error)}`
+			});
+		}
+		const envelope = Envelope.safeParse(parsed);
+		if (!response.ok || envelope.success && envelope.data.success === false) throw cloudflareRefusal({
+			problem: `Cloudflare Artifacts returned ${response.status}.`,
+			apiErrors: cloudflareApiErrors(envelope.success ? envelope.data.errors : []),
+			status: response.status,
+			permission: "Artifacts Write",
+			detail: `${method} ${path} → ${response.status}: ${text}`.slice(0, 2e3)
+		});
+		return decodeResponse(Envelope, parsed, `Artifacts ${method}`);
+	}
+};
+/** Refuse a name outside Cloudflare's charset before it is put in a path. */
+function assertName(value, what) {
+	if (ARTIFACTS_NAME.test(value)) return;
+	throw new ValidationError({
+		message: `"${value}" is not an Artifacts ${what} name.`,
+		action: "Use a letter or digit, then letters, digits, `.`, `_` and `-`.",
+		detail: `An Artifacts ${what} name is interpolated into a REST path, so anything outside the charset is refused.`
+	});
+}
+//#endregion
+export { CloudflareArtifactsManager };

package/dist/client/clients.d.ts

@@ -3,6 +3,8 @@
 import { CloudflareAIManager } from "../ai/aiManager";
 import { CloudflareVectorizeManager } from "../ai/vectorizeManager";
 import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner";
+import { CloudflareAnalyticsManager } from "../analytics/analyticsManager";
+import { CloudflareArtifactsManager } from "../artifacts/artifactsManager";
 import { CloudflareD1Manager } from "../d1/d1Manager";
 import { CloudflareD1Provisioner } from "../d1/d1Provisioner";
 import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager";
@@ -13,6 +15,7 @@ import { CloudflareKVProvisioner } from "../kv/kvProvisioner";
 import { CloudflareImageManager } from "../media/imageManager";
 import { CloudflareStreamManager } from "../media/streamManager";
 import { CloudflareQueueManager } from "../queue/queueManager";
+import { CloudflareQueueProvisioner } from "../queue/queueProvisioner";
 import type { R2Credentials } from "../r2/r2Credentials";
 import { CloudflareR2Manager } from "../r2/r2Manager";
 import { CloudflareR2Provisioner } from "../r2/r2Provisioner";
@@ -33,7 +36,7 @@ import type { CloudflareManagerConfig } from "./manager";
  *
  * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
  * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
- * instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+ * instance. Account-scoped managers (AI, Images, Stream, Analytics, Workers, Builds, Turnstile) are singletons.
  */
 export declare class CloudflareClients {
     private readonly config;
@@ -49,6 +52,7 @@ export declare class CloudflareClients {
     private emailRoutingManager?;
     private imageManager?;
     private streamManager?;
+    private analyticsManager?;
     private workersManager?;
     private buildsManager?;
     private turnstileManager?;
@@ -59,6 +63,8 @@ export declare class CloudflareClients {
     private d1ProvisionerManager?;
     private kvProvisionerManager?;
     private r2ProvisionerManager?;
+    private queueProvisionerManager?;
+    private artifactsManager?;
     private vectorizeProvisionerManager?;
     constructor(config: CloudflareManagerConfig);
     /** The KV manager for a namespace id. */
@@ -98,6 +104,8 @@ export declare class CloudflareClients {
     images(): CloudflareImageManager;
     /** The account-scoped Stream manager. */
     stream(): CloudflareStreamManager;
+    /** The account-scoped GraphQL Analytics manager. */
+    analytics(): CloudflareAnalyticsManager;
     /** The account-scoped Workers (scripts/deployments) manager. */
     workers(): CloudflareWorkersManager;
     /** The account-scoped Workers Builds manager. */
@@ -112,6 +120,10 @@ export declare class CloudflareClients {
     kvProvisioner(): CloudflareKVProvisioner;
     /** The account-scoped R2 control plane — create, find, list, and delete buckets. */
     r2Provisioner(): CloudflareR2Provisioner;
+    /** The account-scoped Queues control plane — create, find, and delete queues. */
+    queueProvisioner(): CloudflareQueueProvisioner;
+    /** The account-scoped Artifacts control plane — list and delete the repos in a namespace (#673). */
+    artifacts(): CloudflareArtifactsManager;
     /** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
     vectorizeProvisioner(): CloudflareVectorizeProvisioner;
     /** The account-scoped API-token control plane — mint, find, and delete account-owned tokens. */

package/dist/client/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/client/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IAEzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoD;IAEnF,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuD;IAEvF,OAAO,CAAC,SAAS,CAAC,CAAsB;IAExC,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAAgC;IAC5D,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,2BAA2B,CAAC,CAAiC;IAErE,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED,yCAAyC;IACzC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3C;IAED,6EAA6E;IAC7E,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE/C;IAED,+CAA+C;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAEvD;IAED,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,6BAA6B,CAEtD;IAED;;;;;OAKG;IACH,aAAa,IAAI,8BAA8B,CAG9C;IAED,kDAAkD;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAE1D;IAED;;;;OAIG;IACH,EAAE,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,mBAAmB,CAEtE;IAED,6CAA6C;IAC7C,EAAE,IAAI,mBAAmB,CAGxB;IAED,0GAA0G;IAC1G,KAAK,IAAI,0BAA0B,CAGlC;IAED,0EAA0E;IAC1E,YAAY,IAAI,6BAA6B,CAG5C;IAED,yCAAyC;IACzC,MAAM,IAAI,sBAAsB,CAG/B;IAED,yCAAyC;IACzC,MAAM,IAAI,uBAAuB,CAGhC;IAED,gEAAgE;IAChE,OAAO,IAAI,wBAAwB,CAGlC;IAED,iDAAiD;IACjD,MAAM,IAAI,uBAAuB,CAGhC;IAED,4CAA4C;IAC5C,SAAS,IAAI,0BAA0B,CAGtC;IAED,4EAA4E;IAC5E,WAAW,IAAI,kBAAkB,CAGhC;IAED,yEAAyE;IACzE,aAAa,IAAI,uBAAuB,CAGvC;IAED,uFAAuF;IACvF,aAAa,IAAI,uBAAuB,CAGvC;IAED,oFAAoF;IACpF,aAAa,IAAI,uBAAuB,CAGvC;IAED,sHAAsH;IACtH,oBAAoB,IAAI,8BAA8B,CAGrD;IAED,gGAAgG;IAChG,aAAa,IAAI,8BAA8B,CAG9C;IAED,4GAA4G;IAC5G,IAAI,IAAI,qBAAqB,CAG5B;IAED,mGAAmG;IACnG,KAAK,IAAI,sBAAsB,CAG9B;CACF"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/client/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IAEzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoD;IAEnF,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuD;IAEvF,OAAO,CAAC,SAAS,CAAC,CAAsB;IAExC,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAAgC;IAC5D,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,uBAAuB,CAAC,CAA6B;IAE7D,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,2BAA2B,CAAC,CAAiC;IAErE,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED,yCAAyC;IACzC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3C;IAED,6EAA6E;IAC7E,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE/C;IAED,+CAA+C;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAEvD;IAED,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,6BAA6B,CAEtD;IAED;;;;;OAKG;IACH,aAAa,IAAI,8BAA8B,CAG9C;IAED,kDAAkD;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAE1D;IAED;;;;OAIG;IACH,EAAE,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,mBAAmB,CAEtE;IAED,6CAA6C;IAC7C,EAAE,IAAI,mBAAmB,CAGxB;IAED,0GAA0G;IAC1G,KAAK,IAAI,0BAA0B,CAGlC;IAED,0EAA0E;IAC1E,YAAY,IAAI,6BAA6B,CAG5C;IAED,yCAAyC;IACzC,MAAM,IAAI,sBAAsB,CAG/B;IAED,yCAAyC;IACzC,MAAM,IAAI,uBAAuB,CAGhC;IAED,oDAAoD;IACpD,SAAS,IAAI,0BAA0B,CAGtC;IAED,gEAAgE;IAChE,OAAO,IAAI,wBAAwB,CAGlC;IAED,iDAAiD;IACjD,MAAM,IAAI,uBAAuB,CAGhC;IAED,4CAA4C;IAC5C,SAAS,IAAI,0BAA0B,CAGtC;IAED,4EAA4E;IAC5E,WAAW,IAAI,kBAAkB,CAGhC;IAED,yEAAyE;IACzE,aAAa,IAAI,uBAAuB,CAGvC;IAED,uFAAuF;IACvF,aAAa,IAAI,uBAAuB,CAGvC;IAED,oFAAoF;IACpF,aAAa,IAAI,uBAAuB,CAGvC;IAED,iFAAiF;IACjF,gBAAgB,IAAI,0BAA0B,CAG7C;IAED,oGAAoG;IACpG,SAAS,IAAI,0BAA0B,CAGtC;IAED,sHAAsH;IACtH,oBAAoB,IAAI,8BAA8B,CAGrD;IAED,gGAAgG;IAChG,aAAa,IAAI,8BAA8B,CAG9C;IAED,4GAA4G;IAC5G,IAAI,IAAI,qBAAqB,CAG5B;IAED,mGAAmG;IACnG,KAAK,IAAI,sBAAsB,CAG9B;CACF"}

package/dist/client/clients.js

@@ -3,6 +3,8 @@
 import { CloudflareAIManager } from "../ai/aiManager.js";
 import { CloudflareVectorizeManager } from "../ai/vectorizeManager.js";
 import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner.js";
+import { CloudflareAnalyticsManager } from "../analytics/analyticsManager.js";
+import { CloudflareArtifactsManager } from "../artifacts/artifactsManager.js";
 import { CloudflareD1Manager } from "../d1/d1Manager.js";
 import { CloudflareD1Provisioner } from "../d1/d1Provisioner.js";
 import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager.js";
@@ -13,6 +15,7 @@ import { CloudflareKVProvisioner } from "../kv/kvProvisioner.js";
 import { CloudflareImageManager } from "../media/imageManager.js";
 import { CloudflareStreamManager } from "../media/streamManager.js";
 import { CloudflareQueueManager } from "../queue/queueManager.js";
+import { CloudflareQueueProvisioner } from "../queue/queueProvisioner.js";
 import { CloudflareR2Manager } from "../r2/r2Manager.js";
 import { CloudflareR2Provisioner } from "../r2/r2Provisioner.js";
 import { CloudflareSecretsStoreManager } from "../secrets/secretsStoreManager.js";
@@ -32,7 +35,7 @@ import { CloudflareZonesManager } from "../zones/zonesManager.js";
 *
 * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
 * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
-* instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+* instance. Account-scoped managers (AI, Images, Stream, Analytics, Workers, Builds, Turnstile) are singletons.
 */
 var CloudflareClients = class {
 	config;
@@ -48,6 +51,7 @@ var CloudflareClients = class {
 	emailRoutingManager;
 	imageManager;
 	streamManager;
+	analyticsManager;
 	workersManager;
 	buildsManager;
 	turnstileManager;
@@ -58,6 +62,8 @@ var CloudflareClients = class {
 	d1ProvisionerManager;
 	kvProvisionerManager;
 	r2ProvisionerManager;
+	queueProvisionerManager;
+	artifactsManager;
 	vectorizeProvisionerManager;
 	constructor(config) {
 		this.config = config;
@@ -150,6 +156,11 @@ var CloudflareClients = class {
 		this.streamManager ??= new CloudflareStreamManager(this.config);
 		return this.streamManager;
 	}
+	/** The account-scoped GraphQL Analytics manager. */
+	analytics() {
+		this.analyticsManager ??= new CloudflareAnalyticsManager(this.config);
+		return this.analyticsManager;
+	}
 	/** The account-scoped Workers (scripts/deployments) manager. */
 	workers() {
 		this.workersManager ??= new CloudflareWorkersManager(this.config);
@@ -185,6 +196,16 @@ var CloudflareClients = class {
 		this.r2ProvisionerManager ??= new CloudflareR2Provisioner(this.config);
 		return this.r2ProvisionerManager;
 	}
+	/** The account-scoped Queues control plane — create, find, and delete queues. */
+	queueProvisioner() {
+		this.queueProvisionerManager ??= new CloudflareQueueProvisioner(this.config);
+		return this.queueProvisionerManager;
+	}
+	/** The account-scoped Artifacts control plane — list and delete the repos in a namespace (#673). */
+	artifacts() {
+		this.artifactsManager ??= new CloudflareArtifactsManager(this.config);
+		return this.artifactsManager;
+	}
 	/** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
 	vectorizeProvisioner() {
 		this.vectorizeProvisionerManager ??= new CloudflareVectorizeProvisioner(this.config);

package/dist/client/manager.d.ts

@@ -14,6 +14,15 @@ export interface CloudflareManagerConfig {
     apiToken: string;
     /** The Cloudflare account id all operations target (`CLOUDFLARE_ACCOUNT_ID`). */
     accountId: string;
+    /**
+     * The token to call with *now*, read at every call, when it can change during the manager's life (#759).
+     *
+     * A signed-in session's access token lasts an hour and is renewed on disk ahead of that, so a manager
+     * built at the start of a long run would otherwise keep sending the token it was constructed with.
+     * Absent, {@link apiToken} is the token for good — which is every command that finishes inside the hour
+     * dispatch guarantees it.
+     */
+    tokenProvider?: () => string;
 }
 /**
  * Base for every Cloudflare resource manager. Holds the configured SDK client and account id, and
@@ -22,8 +31,9 @@ export interface CloudflareManagerConfig {
  * (`validateServiceAccess`).
  */
 export declare abstract class CloudflareManager {
-    private readonly client;
-    private readonly apiToken;
+    /** The SDK client, and the token it was built for — rebuilt when {@link getApiToken} answers another. */
+    private client;
+    private readonly token;
     protected readonly accountId: string;
     constructor(config: CloudflareManagerConfig);
     /** The configured SDK client. Subclasses route typed calls through this. */
@@ -31,6 +41,7 @@ export declare abstract class CloudflareManager {
     /**
      * The raw API token, for subclasses that fall back to direct `fetch()` for endpoints the typed
      * SDK does not cover (e.g. Workers Builds, event subscriptions). The documented escape hatch.
+     * Read through the provider at every call, so it is the current token, never the constructed one.
      */
     protected getApiToken(): string;
     /** The account id all operations target. */

package/dist/client/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/client/manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAGtE;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,8BAAsB,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAErC,YAAY,MAAM,EAAE,uBAAuB,EAU1C;IAED,4EAA4E;IAC5E,SAAS,CAAC,SAAS,IAAI,UAAU,CAEhC;IAED;;;OAGG;IACH,SAAS,CAAC,WAAW,IAAI,MAAM,CAE9B;IAED,4CAA4C;IAC5C,SAAS,CAAC,YAAY,IAAI,MAAM,CAE/B;IAED,wFAAwF;IAClF,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAEvC;IAED,wFAAwF;IAClF,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO5C;IAED,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,IAAI,MAAM,CAAC;IAElC,kGAAkG;IAClG,QAAQ,CAAC,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/client/manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAGtE;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,8BAAsB,iBAAiB;IACrC,yGAAyG;IACzG,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IAErC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAErC,YAAY,MAAM,EAAE,uBAAuB,EAW1C;IAED,4EAA4E;IAC5E,SAAS,CAAC,SAAS,IAAI,UAAU,CAIhC;IAED;;;;OAIG;IACH,SAAS,CAAC,WAAW,IAAI,MAAM,CAM9B;IAED,4CAA4C;IAC5C,SAAS,CAAC,YAAY,IAAI,MAAM,CAE/B;IAED,wFAAwF;IAClF,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAEvC;IAED,wFAAwF;IAClF,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO5C;IAED,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,IAAI,MAAM,CAAC;IAElC,kGAAkG;IAClG,QAAQ,CAAC,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD"}

package/dist/client/manager.js

@@ -10,26 +10,39 @@ import { Cloudflare } from "cloudflare";
 * (`validateServiceAccess`).
 */
 var CloudflareManager = class {
+	/** The SDK client, and the token it was built for — rebuilt when {@link getApiToken} answers another. */
 	client;
-	apiToken;
+	token;
 	accountId;
 	constructor(config) {
 		if (!config.apiToken) throw new CloudflareNotConfiguredError({ detail: "Missing apiToken in CloudflareManagerConfig." });
 		if (!config.accountId) throw new CloudflareNotConfiguredError({ detail: "Missing accountId in CloudflareManagerConfig." });
-		this.client = new Cloudflare({ apiToken: config.apiToken });
-		this.apiToken = config.apiToken;
+		const initial = config.apiToken;
+		this.token = config.tokenProvider ?? (() => initial);
+		this.client = {
+			token: initial,
+			sdk: new Cloudflare({ apiToken: initial })
+		};
 		this.accountId = config.accountId;
 	}
 	/** The configured SDK client. Subclasses route typed calls through this. */
 	getClient() {
-		return this.client;
+		const token = this.getApiToken();
+		if (token !== this.client.token) this.client = {
+			token,
+			sdk: new Cloudflare({ apiToken: token })
+		};
+		return this.client.sdk;
 	}
 	/**
 	* The raw API token, for subclasses that fall back to direct `fetch()` for endpoints the typed
 	* SDK does not cover (e.g. Workers Builds, event subscriptions). The documented escape hatch.
+	* Read through the provider at every call, so it is the current token, never the constructed one.
 	*/
 	getApiToken() {
-		return this.apiToken;
+		const token = this.token();
+		if (!token) throw new CloudflareNotConfiguredError({ detail: "The tokenProvider answered no apiToken." });
+		return token;
 	}
 	/** The account id all operations target. */
 	getAccountId() {

package/dist/d1/d1Manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"d1Manager.d.ts","sourceRoot":"","sources":["../../src/d1/d1Manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE3F,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGpF,wFAAwF;AACxF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,iBAAkB,YAAW,UAAU;IAC9E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,MAAM,EAAE,eAAe,EAMlC;IAID,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED;;;;;;OAMG;IACG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAMlF;IAEK,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAM/C;IAED,6FAA6F;IACvF,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,CAEjC;IAED,8EAA8E;IAC9E,WAAW,IAAI,KAAK,CAEnB;IAID,iEAAiE;IAC3D,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAKzE;IAED;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAW/F;IAED,oCAAoC;IAC9B,eAAe,IAAI,OAAO,CAAC,EAAE,CAAC,CAInC;IAED,4CAA4C;IACtC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAMpC;IAED;;;;OAIG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAS1D;IAED,qEAAqE;IACrE,SAAS,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAErD;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,iEAAiE;IAC3D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"d1Manager.d.ts","sourceRoot":"","sources":["../../src/d1/d1Manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE3F,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGpF,wFAAwF;AACxF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,iBAAkB,YAAW,UAAU;IAC9E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,MAAM,EAAE,eAAe,EAMlC;IAID,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED;;;;;;OAMG;IACG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAMlF;IAEK,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAM/C;IAED,6FAA6F;IACvF,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,CAEjC;IAED,8EAA8E;IAC9E,WAAW,IAAI,KAAK,CAEnB;IAID,iEAAiE;IAC3D,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASzE;IAED;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAW/F;IAED,oCAAoC;IAC9B,eAAe,IAAI,OAAO,CAAC,EAAE,CAAC,CAInC;IAED,4CAA4C;IACtC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAMpC;IAED;;;;OAIG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAS1D;IAED,qEAAqE;IACrE,SAAS,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAErD;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,iEAAiE;IAC3D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}

package/dist/d1/d1Manager.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { CloudflareNotConfiguredError, cloudflareRequest, reasonOf } from "../client/errors.js";
 import { CloudflareManager } from "../client/manager.js";
-import { D1PreparedStatementREST } from "./d1PreparedStatement.js";
+import { D1PreparedStatementREST, D1_QUERY_REQUEST } from "./d1PreparedStatement.js";
 import { InternalError, ValidationError } from "@pithy-sh/core/src/error/pithyError";
 //#region src/d1/d1Manager.ts
 /**
@@ -38,7 +38,7 @@ var CloudflareD1Manager = class extends CloudflareManager {
 		const result = (await cloudflareRequest("D1 exec", () => this.getClient().d1.database.query(this.databaseId, {
 			account_id: this.accountId,
 			sql: query
-		}))).result[0];
+		}, D1_QUERY_REQUEST))).result[0];
 		return {
 			count: result?.results?.length ?? 0,
 			duration: result?.meta?.duration ?? 0
@@ -58,7 +58,7 @@ var CloudflareD1Manager = class extends CloudflareManager {
 			account_id: this.accountId,
 			sql,
 			params
-		}))).result;
+		}, D1_QUERY_REQUEST))).result;
 	}
 	/**
 	* Run many independent queries, collecting a per-query result instead of failing the whole batch

package/dist/d1/d1PreparedStatement.d.ts

@@ -2,6 +2,18 @@
 // SPDX-License-Identifier: MIT
 import type { D1PreparedStatement, D1Result } from "@cloudflare/workers-types";
 import type { Cloudflare } from "cloudflare";
+/**
+ * The request options every D1 query is sent with: **no retries** (#709).
+ *
+ * The SDK retries a request twice by default, on a connection timeout, a 408, a 409, a 429 or a 5xx. That is
+ * safe for a read of a resource and wrong for a query, which is not idempotent: D1 can apply a statement and
+ * answer slowly, and the resent copy then runs against the changed database. A migration's `CREATE TABLE` did
+ * exactly that and failed `table already exists`, on a step that had succeeded. Sent once, a slow answer
+ * surfaces as the timeout it was, and `cloudflareRequest` already tells the operator to check before retrying.
+ */
+export declare const D1_QUERY_REQUEST: {
+    readonly maxRetries: 0;
+};
 export declare class D1PreparedStatementREST<T = Record<string, unknown>> implements D1PreparedStatement {
     private readonly sql;
     private readonly boundParams;

package/dist/d1/d1PreparedStatement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"d1PreparedStatement.d.ts","sourceRoot":"","sources":["../../src/d1/d1PreparedStatement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAU,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuC7C,qBAAa,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,mBAAmB;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAY;IAExC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAE,OAAO,EAAO,EAM9G;IAED,gGAAgG;IAChG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAErD;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAEK,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IASlC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAe5D,YAAY;CAY3B"}
+{"version":3,"file":"d1PreparedStatement.d.ts","sourceRoot":"","sources":["../../src/d1/d1PreparedStatement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAU,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6B7C;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;aAAK,UAAU,EAAE,CAAC;CAAW,CAAC;AAY3D,qBAAa,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,mBAAmB;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAY;IAExC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAE,OAAO,EAAO,EAM9G;IAED,gGAAgG;IAChG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAErD;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAEK,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IASlC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAmB5D,YAAY;CAgB3B"}

package/dist/d1/d1PreparedStatement.js

@@ -26,6 +26,16 @@ function mapMeta(restMeta) {
 		changes: restMeta?.changes ?? 0
 	};
 }
+/**
+* The request options every D1 query is sent with: **no retries** (#709).
+*
+* The SDK retries a request twice by default, on a connection timeout, a 408, a 409, a 429 or a 5xx. That is
+* safe for a read of a resource and wrong for a query, which is not idempotent: D1 can apply a statement and
+* answer slowly, and the resent copy then runs against the changed database. A migration's `CREATE TABLE` did
+* exactly that and failed `table already exists`, on a step that had succeeded. Sent once, a slow answer
+* surfaces as the timeout it was, and `cloudflareRequest` already tells the operator to check before retrying.
+*/
+const D1_QUERY_REQUEST = { maxRetries: 0 };
 /** The REST `params` array is strings; coerce each bound value the way the D1 REST API expects. */
 function toStringParams(params) {
 	return params.map((value) => {
@@ -70,7 +80,7 @@ var D1PreparedStatementREST = class D1PreparedStatementREST {
 			account_id: this.accountId,
 			sql: this.sql,
 			params
-		}))).result[0];
+		}, D1_QUERY_REQUEST))).result[0];
 		const rows = rawResult?.results?.rows ?? [];
 		if (options?.columnNames) return [rawResult?.results?.columns ?? [], ...rows];
 		return rows;
@@ -81,7 +91,7 @@ var D1PreparedStatementREST = class D1PreparedStatementREST {
 			account_id: this.accountId,
 			sql: this.sql,
 			params
-		}))).result[0];
+		}, D1_QUERY_REQUEST))).result[0];
 		return {
 			success: true,
 			meta: mapMeta(queryResult?.meta),
@@ -90,4 +100,4 @@ var D1PreparedStatementREST = class D1PreparedStatementREST {
 	}
 };
 //#endregion
-export { D1PreparedStatementREST };
+export { D1PreparedStatementREST, D1_QUERY_REQUEST };

package/dist/media/imageManager.d.ts

@@ -3,7 +3,20 @@
 import type { Image, V1CreateParams, V1EditParams } from "cloudflare/resources/images/v1/v1";
 import type { DirectUploadCreateParams, DirectUploadCreateResponse } from "cloudflare/resources/images/v2/direct-uploads";
 import type { V2ListParams } from "cloudflare/resources/images/v2/v2";
+import { z } from "zod";
 import { CloudflareManager } from "../client/manager";
+/** One of the account's Images URL-signing keys. The value is the HMAC secret signed URLs are minted with. */
+export declare const ImagesSigningKey: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>;
+export type ImagesSigningKey = z.infer<typeof ImagesSigningKey>;
+/** One Images variant, and whether it serves an image without a signature whatever the image requires. */
+export declare const ImagesVariant: z.ZodObject<{
+    id: z.ZodString;
+    neverRequireSignedURLs: z.ZodBoolean;
+}, z.core.$strip>;
+export type ImagesVariant = z.infer<typeof ImagesVariant>;
 /**
  * Out-of-Worker Cloudflare Images access over the REST API: upload, fetch, edit, delete, list, and
  * direct-upload URLs from a CLI/CI/provisioning context. Image metadata is an arbitrary
@@ -29,6 +42,18 @@ export declare class CloudflareImageManager extends CloudflareManager {
     listImages(params?: Omit<V2ListParams, "account_id">): Promise<Image[]>;
     /** List all images across every page, following the V2 continuation token. */
     listAllImages(params?: Omit<V2ListParams, "account_id">): Promise<Image[]>;
+    /**
+     * The account's URL-signing keys — what a signed delivery URL for an image uploaded with
+     * `requireSignedURLs` is minted with. Cloudflare provisions a `default` key per account.
+     */
+    signingKeys(): Promise<ImagesSigningKey[]>;
+    /** Create a named signing key, or roll it if it exists. Answers with every key the account then holds. */
+    createSigningKey(name: string): Promise<ImagesSigningKey[]>;
+    /**
+     * Every variant, with whether it serves unsigned. A variant set to `neverRequireSignedURLs` delivers a
+     * private image to anyone holding its URL, which is why media's provisioning reads this.
+     */
+    listVariants(): Promise<ImagesVariant[]>;
     getServiceType(): string;
     /** Prove access by listing images. Never throws. */
     validateServiceAccess(): Promise<boolean>;

package/dist/media/imageManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imageManager.d.ts","sourceRoot":"","sources":["../../src/media/imageManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoBtD;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,qFAAqF;IAC/E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAO5E;IAED,yCAAyC;IACnC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIlD;IAED,+CAA+C;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI3F;IAED,6BAA6B;IACvB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,oEAAoE;IAC9D,qBAAqB,CACzB,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED,oFAAoF;IAC9E,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAK5E;IAED,8EAA8E;IACxE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAe/E;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"imageManager.d.ts","sourceRoot":"","sources":["../../src/media/imageManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoBtD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB;;;iBAKwB,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMhE,0GAA0G;AAC1G,eAAO,MAAM,aAAa;;;iBAOqC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AA+B1D;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,qFAAqF;IAC/E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAO5E;IAED,yCAAyC;IACnC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIlD;IAED,+CAA+C;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI3F;IAED,6BAA6B;IACvB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,oEAAoE;IAC9D,qBAAqB,CACzB,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED,oFAAoF;IAC9E,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAK5E;IAED,8EAA8E;IACxE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAe/E;IAED;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK/C;IAED,0GAA0G;IACpG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAShE;IAED;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAS7C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}