@pithy-sh/cloudflare 0.5.0 → 0.6.0

package/dist/artifacts/artifactsManager.js

@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { CloudflareInvalidResponseError, cloudflareApiErrors, cloudflareRefusal, cloudflareRequest, decodeResponse, messageOf } from "../client/errors.js";
+import { CloudflareManager } from "../client/manager.js";
+import { ValidationError } from "@pithy-sh/core/src/error/pithyError";
+import { z } from "zod";
+//#region src/artifacts/artifactsManager.ts
+/** The Cloudflare REST API v4 base URL. Artifacts lives under `/accounts/{id}/artifacts`. */
+const CF_API_BASE = "https://api.cloudflare.com/client/v4";
+/** The most repos one page of `GET …/repos` returns. Cloudflare's own maximum. */
+const PAGE_LIMIT = 200;
+/**
+* A namespace or repo name, as Cloudflare's limits page states it: a letter or digit, then letters, digits, `.`,
+* `_` and `-`. Asserted before either reaches a path, because a `/` or a `..` there addresses another endpoint.
+*/
+const ARTIFACTS_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/** What {@link CloudflareArtifactsManager.deleteNamespace} is told by a `409`: a repo is still in the namespace. */
+const OCCUPIED = Symbol("occupied");
+/** The standard `{ result, success, errors, result_info }` envelope, as far as this reads it. */
+const Envelope = z.object({
+	result: z.unknown().describe("The payload."),
+	success: z.boolean().optional().describe("Whether Cloudflare reports the call succeeded."),
+	errors: z.array(z.unknown()).optional().describe("Cloudflare's own error entries."),
+	result_info: z.object({ cursor: z.string().nullable().optional().describe("The next page's cursor, when there is one.") }).loose().optional().describe("Pagination, for a listing.")
+}).describe("A Cloudflare REST envelope.");
+/** One page of `GET …/repos`: only the name of each repo is read. */
+const RepoPage = z.array(z.object({ name: z.string().describe("The repo's name in the namespace.") }).loose()).describe("One page of an Artifacts namespace's repos.");
+/**
+* Account-level Artifacts control plane: **list and delete the repos in a namespace, then the namespace** (#673).
+*
+* Inside a Worker a repo is reached through the `artifacts` binding. This is the other side of that: `pithy feature
+* destroy` reaps every repo in a feature's namespace, because repos cost storage and nothing else ever deletes one.
+* There is no create here, because Cloudflare creates a namespace the first time a repo is created in it and the kit
+* creates repos only from the Worker. There is a namespace delete, because nothing else removes one.
+*
+* The SDK this package targets exposes no Artifacts resource, so this uses the documented escape hatch — the raw
+* token and `fetch` — against the paths [the REST API](https://developers.cloudflare.com/artifacts/api/rest-api/)
+* publishes, and validates what comes back.
+*/
+var CloudflareArtifactsManager = class extends CloudflareManager {
+	getServiceType() {
+		return "Cloudflare Artifacts (control plane)";
+	}
+	/** Prove access by listing namespaces — a read, never a write. Never throws. */
+	async validateServiceAccess() {
+		try {
+			return (await this.send("GET", `/accounts/${this.getAccountId()}/artifacts/namespaces?limit=1`)).ok;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Every repo name in a namespace, across every page. **A namespace that does not exist has none**: Cloudflare
+	* makes one on its first repo, so a feature that never created a repo has no namespace, and teardown of it is a
+	* clean no-op rather than a failure.
+	*/
+	async listRepos(namespace) {
+		assertName(namespace, "namespace");
+		return cloudflareRequest(`list Artifacts repos in ${namespace}`, async () => {
+			const names = /* @__PURE__ */ new Set();
+			const followed = /* @__PURE__ */ new Set();
+			let cursor;
+			for (;;) {
+				const query = `limit=${PAGE_LIMIT}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`;
+				const page = await this.call("GET", `${this.namespacePath(namespace)}/repos?${query}`);
+				if (page === null) return [...names];
+				for (const repo of decodeResponse(RepoPage, page.result, "Artifacts repo list")) names.add(repo.name);
+				const next = page.result_info?.cursor ?? void 0;
+				if (!next || followed.has(next)) return [...names];
+				followed.add(next);
+				cursor = next;
+			}
+		});
+	}
+	/**
+	* Delete one repo and every token on it. **Resolves whether one was there**, so teardown re-runs safely: a repo
+	* already gone is `false`, not an error. Cloudflare answers `202 Accepted`, so the storage may take a moment to
+	* be released after this returns.
+	*/
+	async deleteRepo(namespace, name) {
+		assertName(namespace, "namespace");
+		assertName(name, "repo");
+		return cloudflareRequest(`delete Artifacts repo ${namespace}/${name}`, async () => {
+			return await this.call("DELETE", `${this.namespacePath(namespace)}/repos/${name}`) !== null;
+		});
+	}
+	/**
+	* Delete a namespace, once it is empty. Cloudflare makes one on the first repo and nothing else ever deletes it,
+	* so a feature's would outlive the feature. `DELETE /accounts/{id}/artifacts/namespaces/{namespace}` is in
+	* Cloudflare's published API schema, not on the Artifacts REST page: it deletes an empty namespace, answers `204`,
+	* and answers `409` while a repo remains.
+	*
+	* **Three answers, none of them a failure of teardown.** `deleted` it was there; `absent` it is already gone or was
+	* never created, so a re-run is a clean no-op; `occupied` a repo is still in it — a repo delete is `202 Accepted`,
+	* so one just reaped can hold the namespace a moment longer, and the caller decides how long to wait.
+	*/
+	async deleteNamespace(namespace) {
+		assertName(namespace, "namespace");
+		return cloudflareRequest(`delete Artifacts namespace ${namespace}`, async () => {
+			const result = await this.call("DELETE", this.namespacePath(namespace), { occupied: true });
+			if (result === OCCUPIED) return "occupied";
+			return result === null ? "absent" : "deleted";
+		});
+	}
+	namespacePath(namespace) {
+		return `/accounts/${this.getAccountId()}/artifacts/namespaces/${namespace}`;
+	}
+	send(method, path) {
+		return fetch(`${CF_API_BASE}${path}`, {
+			method,
+			headers: { authorization: `Bearer ${this.getApiToken()}` }
+		});
+	}
+	async call(method, path, options = {}) {
+		const response = await this.send(method, path);
+		if (response.status === 404) return null;
+		if (response.status === 409 && options.occupied) return OCCUPIED;
+		const text = await response.text();
+		if (response.ok && text.length === 0) return { result: null };
+		let parsed = {};
+		if (text.length > 0) try {
+			parsed = JSON.parse(text);
+		} catch (error) {
+			throw new CloudflareInvalidResponseError({
+				message: "A Cloudflare Artifacts response was not valid JSON.",
+				detail: `${method} ${path}: ${messageOf(error)}`
+			});
+		}
+		const envelope = Envelope.safeParse(parsed);
+		if (!response.ok || envelope.success && envelope.data.success === false) throw cloudflareRefusal({
+			problem: `Cloudflare Artifacts returned ${response.status}.`,
+			apiErrors: cloudflareApiErrors(envelope.success ? envelope.data.errors : []),
+			status: response.status,
+			permission: "Artifacts Write",
+			detail: `${method} ${path} → ${response.status}: ${text}`.slice(0, 2e3)
+		});
+		return decodeResponse(Envelope, parsed, `Artifacts ${method}`);
+	}
+};
+/** Refuse a name outside Cloudflare's charset before it is put in a path. */
+function assertName(value, what) {
+	if (ARTIFACTS_NAME.test(value)) return;
+	throw new ValidationError({
+		message: `"${value}" is not an Artifacts ${what} name.`,
+		action: "Use a letter or digit, then letters, digits, `.`, `_` and `-`.",
+		detail: `An Artifacts ${what} name is interpolated into a REST path, so anything outside the charset is refused.`
+	});
+}
+//#endregion
+export { CloudflareArtifactsManager };

package/dist/client/clients.d.ts

@@ -3,6 +3,8 @@
 import { CloudflareAIManager } from "../ai/aiManager";
 import { CloudflareVectorizeManager } from "../ai/vectorizeManager";
 import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner";
+import { CloudflareAnalyticsManager } from "../analytics/analyticsManager";
+import { CloudflareArtifactsManager } from "../artifacts/artifactsManager";
 import { CloudflareD1Manager } from "../d1/d1Manager";
 import { CloudflareD1Provisioner } from "../d1/d1Provisioner";
 import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager";
@@ -13,6 +15,7 @@ import { CloudflareKVProvisioner } from "../kv/kvProvisioner";
 import { CloudflareImageManager } from "../media/imageManager";
 import { CloudflareStreamManager } from "../media/streamManager";
 import { CloudflareQueueManager } from "../queue/queueManager";
+import { CloudflareQueueProvisioner } from "../queue/queueProvisioner";
 import type { R2Credentials } from "../r2/r2Credentials";
 import { CloudflareR2Manager } from "../r2/r2Manager";
 import { CloudflareR2Provisioner } from "../r2/r2Provisioner";
@@ -33,7 +36,7 @@ import type { CloudflareManagerConfig } from "./manager";
  *
  * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
  * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
- * instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+ * instance. Account-scoped managers (AI, Images, Stream, Analytics, Workers, Builds, Turnstile) are singletons.
  */
 export declare class CloudflareClients {
     private readonly config;
@@ -49,6 +52,7 @@ export declare class CloudflareClients {
     private emailRoutingManager?;
     private imageManager?;
     private streamManager?;
+    private analyticsManager?;
     private workersManager?;
     private buildsManager?;
     private turnstileManager?;
@@ -59,6 +63,8 @@ export declare class CloudflareClients {
     private d1ProvisionerManager?;
     private kvProvisionerManager?;
     private r2ProvisionerManager?;
+    private queueProvisionerManager?;
+    private artifactsManager?;
     private vectorizeProvisionerManager?;
     constructor(config: CloudflareManagerConfig);
     /** The KV manager for a namespace id. */
@@ -98,6 +104,8 @@ export declare class CloudflareClients {
     images(): CloudflareImageManager;
     /** The account-scoped Stream manager. */
     stream(): CloudflareStreamManager;
+    /** The account-scoped GraphQL Analytics manager. */
+    analytics(): CloudflareAnalyticsManager;
     /** The account-scoped Workers (scripts/deployments) manager. */
     workers(): CloudflareWorkersManager;
     /** The account-scoped Workers Builds manager. */
@@ -112,6 +120,10 @@ export declare class CloudflareClients {
     kvProvisioner(): CloudflareKVProvisioner;
     /** The account-scoped R2 control plane — create, find, list, and delete buckets. */
     r2Provisioner(): CloudflareR2Provisioner;
+    /** The account-scoped Queues control plane — create, find, and delete queues. */
+    queueProvisioner(): CloudflareQueueProvisioner;
+    /** The account-scoped Artifacts control plane — list and delete the repos in a namespace (#673). */
+    artifacts(): CloudflareArtifactsManager;
     /** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
     vectorizeProvisioner(): CloudflareVectorizeProvisioner;
     /** The account-scoped API-token control plane — mint, find, and delete account-owned tokens. */

package/dist/client/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/client/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IAEzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoD;IAEnF,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuD;IAEvF,OAAO,CAAC,SAAS,CAAC,CAAsB;IAExC,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAAgC;IAC5D,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,2BAA2B,CAAC,CAAiC;IAErE,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED,yCAAyC;IACzC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3C;IAED,6EAA6E;IAC7E,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE/C;IAED,+CAA+C;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAEvD;IAED,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,6BAA6B,CAEtD;IAED;;;;;OAKG;IACH,aAAa,IAAI,8BAA8B,CAG9C;IAED,kDAAkD;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAE1D;IAED;;;;OAIG;IACH,EAAE,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,mBAAmB,CAEtE;IAED,6CAA6C;IAC7C,EAAE,IAAI,mBAAmB,CAGxB;IAED,0GAA0G;IAC1G,KAAK,IAAI,0BAA0B,CAGlC;IAED,0EAA0E;IAC1E,YAAY,IAAI,6BAA6B,CAG5C;IAED,yCAAyC;IACzC,MAAM,IAAI,sBAAsB,CAG/B;IAED,yCAAyC;IACzC,MAAM,IAAI,uBAAuB,CAGhC;IAED,gEAAgE;IAChE,OAAO,IAAI,wBAAwB,CAGlC;IAED,iDAAiD;IACjD,MAAM,IAAI,uBAAuB,CAGhC;IAED,4CAA4C;IAC5C,SAAS,IAAI,0BAA0B,CAGtC;IAED,4EAA4E;IAC5E,WAAW,IAAI,kBAAkB,CAGhC;IAED,yEAAyE;IACzE,aAAa,IAAI,uBAAuB,CAGvC;IAED,uFAAuF;IACvF,aAAa,IAAI,uBAAuB,CAGvC;IAED,oFAAoF;IACpF,aAAa,IAAI,uBAAuB,CAGvC;IAED,sHAAsH;IACtH,oBAAoB,IAAI,8BAA8B,CAGrD;IAED,gGAAgG;IAChG,aAAa,IAAI,8BAA8B,CAG9C;IAED,4GAA4G;IAC5G,IAAI,IAAI,qBAAqB,CAG5B;IAED,mGAAmG;IACnG,KAAK,IAAI,sBAAsB,CAG9B;CACF"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/client/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IAExE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IAEzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoD;IAEnF,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuD;IAEvF,OAAO,CAAC,SAAS,CAAC,CAAsB;IAExC,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IACtD,OAAO,CAAC,mBAAmB,CAAC,CAAgC;IAC5D,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAElD,OAAO,CAAC,aAAa,CAAC,CAA0B;IAEhD,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,oBAAoB,CAAC,CAAiC;IAE9D,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAE9C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IAEvD,OAAO,CAAC,uBAAuB,CAAC,CAA6B;IAE7D,OAAO,CAAC,gBAAgB,CAAC,CAA6B;IAEtD,OAAO,CAAC,2BAA2B,CAAC,CAAiC;IAErE,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED,yCAAyC;IACzC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3C;IAED,6EAA6E;IAC7E,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAE1C;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE/C;IAED,+CAA+C;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAEvD;IAED,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,6BAA6B,CAEtD;IAED;;;;;OAKG;IACH,aAAa,IAAI,8BAA8B,CAG9C;IAED,kDAAkD;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAE1D;IAED;;;;OAIG;IACH,EAAE,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,mBAAmB,CAEtE;IAED,6CAA6C;IAC7C,EAAE,IAAI,mBAAmB,CAGxB;IAED,0GAA0G;IAC1G,KAAK,IAAI,0BAA0B,CAGlC;IAED,0EAA0E;IAC1E,YAAY,IAAI,6BAA6B,CAG5C;IAED,yCAAyC;IACzC,MAAM,IAAI,sBAAsB,CAG/B;IAED,yCAAyC;IACzC,MAAM,IAAI,uBAAuB,CAGhC;IAED,oDAAoD;IACpD,SAAS,IAAI,0BAA0B,CAGtC;IAED,gEAAgE;IAChE,OAAO,IAAI,wBAAwB,CAGlC;IAED,iDAAiD;IACjD,MAAM,IAAI,uBAAuB,CAGhC;IAED,4CAA4C;IAC5C,SAAS,IAAI,0BAA0B,CAGtC;IAED,4EAA4E;IAC5E,WAAW,IAAI,kBAAkB,CAGhC;IAED,yEAAyE;IACzE,aAAa,IAAI,uBAAuB,CAGvC;IAED,uFAAuF;IACvF,aAAa,IAAI,uBAAuB,CAGvC;IAED,oFAAoF;IACpF,aAAa,IAAI,uBAAuB,CAGvC;IAED,iFAAiF;IACjF,gBAAgB,IAAI,0BAA0B,CAG7C;IAED,oGAAoG;IACpG,SAAS,IAAI,0BAA0B,CAGtC;IAED,sHAAsH;IACtH,oBAAoB,IAAI,8BAA8B,CAGrD;IAED,gGAAgG;IAChG,aAAa,IAAI,8BAA8B,CAG9C;IAED,4GAA4G;IAC5G,IAAI,IAAI,qBAAqB,CAG5B;IAED,mGAAmG;IACnG,KAAK,IAAI,sBAAsB,CAG9B;CACF"}

package/dist/client/clients.js

@@ -3,6 +3,8 @@
 import { CloudflareAIManager } from "../ai/aiManager.js";
 import { CloudflareVectorizeManager } from "../ai/vectorizeManager.js";
 import { CloudflareVectorizeProvisioner } from "../ai/vectorizeProvisioner.js";
+import { CloudflareAnalyticsManager } from "../analytics/analyticsManager.js";
+import { CloudflareArtifactsManager } from "../artifacts/artifactsManager.js";
 import { CloudflareD1Manager } from "../d1/d1Manager.js";
 import { CloudflareD1Provisioner } from "../d1/d1Provisioner.js";
 import { CloudflareEmailRoutingManager } from "../email/emailRoutingManager.js";
@@ -13,6 +15,7 @@ import { CloudflareKVProvisioner } from "../kv/kvProvisioner.js";
 import { CloudflareImageManager } from "../media/imageManager.js";
 import { CloudflareStreamManager } from "../media/streamManager.js";
 import { CloudflareQueueManager } from "../queue/queueManager.js";
+import { CloudflareQueueProvisioner } from "../queue/queueProvisioner.js";
 import { CloudflareR2Manager } from "../r2/r2Manager.js";
 import { CloudflareR2Provisioner } from "../r2/r2Provisioner.js";
 import { CloudflareSecretsStoreManager } from "../secrets/secretsStoreManager.js";
@@ -32,7 +35,7 @@ import { CloudflareZonesManager } from "../zones/zonesManager.js";
 *
 * Resource-scoped managers (KV, D1, queues, Vectorize indexes, secret stores, hostname zones, R2
 * buckets) are keyed by their resource id, so repeated calls for the same id return one shared
-* instance. Account-scoped managers (AI, Images, Stream, Workers, Builds, Turnstile) are singletons.
+* instance. Account-scoped managers (AI, Images, Stream, Analytics, Workers, Builds, Turnstile) are singletons.
 */
 var CloudflareClients = class {
 	config;
@@ -48,6 +51,7 @@ var CloudflareClients = class {
 	emailRoutingManager;
 	imageManager;
 	streamManager;
+	analyticsManager;
 	workersManager;
 	buildsManager;
 	turnstileManager;
@@ -58,6 +62,8 @@ var CloudflareClients = class {
 	d1ProvisionerManager;
 	kvProvisionerManager;
 	r2ProvisionerManager;
+	queueProvisionerManager;
+	artifactsManager;
 	vectorizeProvisionerManager;
 	constructor(config) {
 		this.config = config;
@@ -150,6 +156,11 @@ var CloudflareClients = class {
 		this.streamManager ??= new CloudflareStreamManager(this.config);
 		return this.streamManager;
 	}
+	/** The account-scoped GraphQL Analytics manager. */
+	analytics() {
+		this.analyticsManager ??= new CloudflareAnalyticsManager(this.config);
+		return this.analyticsManager;
+	}
 	/** The account-scoped Workers (scripts/deployments) manager. */
 	workers() {
 		this.workersManager ??= new CloudflareWorkersManager(this.config);
@@ -185,6 +196,16 @@ var CloudflareClients = class {
 		this.r2ProvisionerManager ??= new CloudflareR2Provisioner(this.config);
 		return this.r2ProvisionerManager;
 	}
+	/** The account-scoped Queues control plane — create, find, and delete queues. */
+	queueProvisioner() {
+		this.queueProvisionerManager ??= new CloudflareQueueProvisioner(this.config);
+		return this.queueProvisionerManager;
+	}
+	/** The account-scoped Artifacts control plane — list and delete the repos in a namespace (#673). */
+	artifacts() {
+		this.artifactsManager ??= new CloudflareArtifactsManager(this.config);
+		return this.artifactsManager;
+	}
 	/** The account-scoped Vectorize control plane — create, find, list, and delete indexes and their metadata indexes. */
 	vectorizeProvisioner() {
 		this.vectorizeProvisionerManager ??= new CloudflareVectorizeProvisioner(this.config);

package/dist/media/imageManager.d.ts

@@ -3,7 +3,20 @@
 import type { Image, V1CreateParams, V1EditParams } from "cloudflare/resources/images/v1/v1";
 import type { DirectUploadCreateParams, DirectUploadCreateResponse } from "cloudflare/resources/images/v2/direct-uploads";
 import type { V2ListParams } from "cloudflare/resources/images/v2/v2";
+import { z } from "zod";
 import { CloudflareManager } from "../client/manager";
+/** One of the account's Images URL-signing keys. The value is the HMAC secret signed URLs are minted with. */
+export declare const ImagesSigningKey: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>;
+export type ImagesSigningKey = z.infer<typeof ImagesSigningKey>;
+/** One Images variant, and whether it serves an image without a signature whatever the image requires. */
+export declare const ImagesVariant: z.ZodObject<{
+    id: z.ZodString;
+    neverRequireSignedURLs: z.ZodBoolean;
+}, z.core.$strip>;
+export type ImagesVariant = z.infer<typeof ImagesVariant>;
 /**
  * Out-of-Worker Cloudflare Images access over the REST API: upload, fetch, edit, delete, list, and
  * direct-upload URLs from a CLI/CI/provisioning context. Image metadata is an arbitrary
@@ -29,6 +42,18 @@ export declare class CloudflareImageManager extends CloudflareManager {
     listImages(params?: Omit<V2ListParams, "account_id">): Promise<Image[]>;
     /** List all images across every page, following the V2 continuation token. */
     listAllImages(params?: Omit<V2ListParams, "account_id">): Promise<Image[]>;
+    /**
+     * The account's URL-signing keys — what a signed delivery URL for an image uploaded with
+     * `requireSignedURLs` is minted with. Cloudflare provisions a `default` key per account.
+     */
+    signingKeys(): Promise<ImagesSigningKey[]>;
+    /** Create a named signing key, or roll it if it exists. Answers with every key the account then holds. */
+    createSigningKey(name: string): Promise<ImagesSigningKey[]>;
+    /**
+     * Every variant, with whether it serves unsigned. A variant set to `neverRequireSignedURLs` delivers a
+     * private image to anyone holding its URL, which is why media's provisioning reads this.
+     */
+    listVariants(): Promise<ImagesVariant[]>;
     getServiceType(): string;
     /** Prove access by listing images. Never throws. */
     validateServiceAccess(): Promise<boolean>;

package/dist/media/imageManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imageManager.d.ts","sourceRoot":"","sources":["../../src/media/imageManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoBtD;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,qFAAqF;IAC/E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAO5E;IAED,yCAAyC;IACnC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIlD;IAED,+CAA+C;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI3F;IAED,6BAA6B;IACvB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,oEAAoE;IAC9D,qBAAqB,CACzB,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED,oFAAoF;IAC9E,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAK5E;IAED,8EAA8E;IACxE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAe/E;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"imageManager.d.ts","sourceRoot":"","sources":["../../src/media/imageManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoBtD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB;;;iBAKwB,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMhE,0GAA0G;AAC1G,eAAO,MAAM,aAAa;;;iBAOqC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AA+B1D;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,qFAAqF;IAC/E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAO5E;IAED,yCAAyC;IACnC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIlD;IAED,+CAA+C;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI3F;IAED,6BAA6B;IACvB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,oEAAoE;IAC9D,qBAAqB,CACzB,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED,oFAAoF;IAC9E,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAK5E;IAED,8EAA8E;IACxE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAe/E;IAED;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK/C;IAED,0GAA0G;IACpG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAShE;IAED;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAS7C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}

package/dist/media/imageManager.js

@@ -1,7 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { cloudflareRequest } from "../client/errors.js";
+import { CloudflareInvalidResponseError, cloudflareRequest } from "../client/errors.js";
 import { CloudflareManager } from "../client/manager.js";
+import { z } from "zod";
 //#region src/media/imageManager.ts
 /**
 * Per-request CF SDK options for every Images call: a 10s timeout and up to 3 retries. Uploads and
@@ -19,6 +20,30 @@ const requestOptions = {
 function encodeMetadata(metadata) {
 	return metadata === void 0 || metadata === null ? metadata : JSON.stringify(metadata);
 }
+/** One of the account's Images URL-signing keys. The value is the HMAC secret signed URLs are minted with. */
+const ImagesSigningKey = z.object({
+	name: z.string().min(1).describe("The key's name. Cloudflare provisions one named `default`."),
+	value: z.string().min(1).describe("The key itself — the HMAC-SHA256 secret a signed delivery URL is minted with.")
+}).describe("One Cloudflare Images URL-signing key.");
+const SigningKeysResponse = z.object({ keys: z.array(ImagesSigningKey).optional().describe("The account's signing keys.") }).describe("The Images signing-keys response.");
+/** One Images variant, and whether it serves an image without a signature whatever the image requires. */
+const ImagesVariant = z.object({
+	id: z.string().describe("The variant's name, as it appears in a delivery URL."),
+	neverRequireSignedURLs: z.boolean().describe("Whether this variant serves every image unsigned, even one uploaded with requireSignedURLs.")
+}).describe("One Cloudflare Images variant's signing posture.");
+const VariantsResponse = z.object({ variants: z.record(z.string(), z.object({
+	id: z.string().describe("The variant name."),
+	neverRequireSignedURLs: z.boolean().optional().describe("Whether it ignores signing.")
+}).describe("One variant as the API returns it.")).optional().describe("Every variant, keyed by name.") }).describe("The Images variants response.");
+/** Parse an Images response the SDK types loosely, refusing a shape we cannot read. */
+function parseResponse(schema, response, what) {
+	const result = schema.safeParse(response);
+	if (!result.success) throw new CloudflareInvalidResponseError({
+		message: `An Images ${what} response had an unexpected shape.`,
+		detail: result.error.message
+	});
+	return result.data;
+}
 /**
 * Out-of-Worker Cloudflare Images access over the REST API: upload, fetch, edit, delete, list, and
 * direct-upload URLs from a CLI/CI/provisioning context. Image metadata is an arbitrary
@@ -88,6 +113,37 @@ var CloudflareImageManager = class extends CloudflareManager {
 			return allImages;
 		});
 	}
+	/**
+	* The account's URL-signing keys — what a signed delivery URL for an image uploaded with
+	* `requireSignedURLs` is minted with. Cloudflare provisions a `default` key per account.
+	*/
+	async signingKeys() {
+		return cloudflareRequest("Images list signing keys", async () => {
+			const response = await this.getClient().images.v1.keys.list({ account_id: this.accountId }, requestOptions);
+			return parseResponse(SigningKeysResponse, response, "signing keys").keys ?? [];
+		});
+	}
+	/** Create a named signing key, or roll it if it exists. Answers with every key the account then holds. */
+	async createSigningKey(name) {
+		return cloudflareRequest(`Images create signing key '${name}'`, async () => {
+			const response = await this.getClient().images.v1.keys.update(name, { account_id: this.accountId }, requestOptions);
+			return parseResponse(SigningKeysResponse, response, "signing keys").keys ?? [];
+		});
+	}
+	/**
+	* Every variant, with whether it serves unsigned. A variant set to `neverRequireSignedURLs` delivers a
+	* private image to anyone holding its URL, which is why media's provisioning reads this.
+	*/
+	async listVariants() {
+		return cloudflareRequest("Images list variants", async () => {
+			const response = await this.getClient().images.v1.variants.list({ account_id: this.accountId }, requestOptions);
+			const variants = parseResponse(VariantsResponse, response, "variants").variants ?? {};
+			return Object.values(variants).map((variant) => ({
+				id: variant.id,
+				neverRequireSignedURLs: variant.neverRequireSignedURLs === true
+			}));
+		});
+	}
 	getServiceType() {
 		return "Cloudflare Images";
 	}
@@ -102,4 +158,4 @@ var CloudflareImageManager = class extends CloudflareManager {
 	}
 };
 //#endregion
-export { CloudflareImageManager };
+export { CloudflareImageManager, ImagesSigningKey, ImagesVariant };

package/dist/media/streamManager.d.ts

@@ -44,6 +44,16 @@ export declare const StreamDownloadStatus: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type StreamDownloadStatus = z.infer<typeof StreamDownloadStatus>;
+/**
+ * A Stream signing key: what a signed playback token for a video uploaded with `requireSignedURLs` is
+ * signed with. The JWK is base64 of the key's JSON, as Cloudflare returns it — a single line, so it is
+ * the form stored, where the PEM is not.
+ */
+export declare const StreamSigningKey: z.ZodObject<{
+    id: z.ZodString;
+    jwk: z.ZodString;
+}, z.core.$strip>;
+export type StreamSigningKey = z.infer<typeof StreamSigningKey>;
 /**
  * Out-of-Worker Cloudflare Stream access over the REST API: delete, fetch, edit, direct uploads,
  * and download (MP4 + audio-only) management from a CLI/CI/provisioning context. Video metadata is
@@ -78,6 +88,11 @@ export declare class CloudflareStreamManager extends CloudflareManager {
     audioDownloadStatus(videoId: string): Promise<DownloadEntry>;
     /** Create a direct-upload URL for a client-side video upload. */
     createDirectUpload(params: Omit<DirectUploadCreateParams, "account_id">): Promise<DirectUploadCreateResponse>;
+    /**
+     * Create a signing key. Cloudflare returns the private half once, on creation, and never again — so the
+     * caller stores it, and a lost key is replaced by creating another.
+     */
+    createSigningKey(): Promise<StreamSigningKey>;
     getServiceType(): string;
     /** Prove access by listing videos. Never throws. */
     validateServiceAccess(): Promise<boolean>;

package/dist/media/streamManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streamManager.d.ts","sourceRoot":"","sources":["../../src/media/streamManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACtH,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAWtD;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;iBAM8C,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;iBAKwD,CAAC;AAC1F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AA2BxE;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D,wCAAwC;IAClC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,sCAAsC;IAChC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIrD;IAED,8CAA8C;IACxC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI/F;IAED,iEAAiE;IAC3D,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CASxE;IAED,qEAAqE;IAC/D,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CASxE;IAED;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4BjE;IAED;;;OAGG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAUjE;IAED,iEAAiE;IAC3D,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAIlH;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"streamManager.d.ts","sourceRoot":"","sources":["../../src/media/streamManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACtH,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAWtD;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;iBAM8C,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;iBAKwD,CAAC;AAC1F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AA2BxE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;iBAKoB,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D,wCAAwC;IAClC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,sCAAsC;IAChC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAIrD;IAED,8CAA8C;IACxC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAI/F;IAED,iEAAiE;IAC3D,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CASxE;IAED,qEAAqE;IAC/D,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CASxE;IAED;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4BjE;IAED;;;OAGG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAUjE;IAED,iEAAiE;IAC3D,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAIlH;IAED;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAelD;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oDAAoD;IAC9C,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}

package/dist/media/streamManager.js

@@ -50,6 +50,15 @@ function parseDownloadStatus(response) {
 	return result.data;
 }
 /**
+* A Stream signing key: what a signed playback token for a video uploaded with `requireSignedURLs` is
+* signed with. The JWK is base64 of the key's JSON, as Cloudflare returns it — a single line, so it is
+* the form stored, where the PEM is not.
+*/
+const StreamSigningKey = z.object({
+	id: z.string().min(1).describe("The key id — the `kid` a signed token names."),
+	jwk: z.string().min(1).describe("The RSA private key as base64-encoded JWK, as Cloudflare returns it.")
+}).describe("One Cloudflare Stream signing key.");
+/**
 * Out-of-Worker Cloudflare Stream access over the REST API: delete, fetch, edit, direct uploads,
 * and download (MP4 + audio-only) management from a CLI/CI/provisioning context. Video metadata is
 * the SDK's own `Video` shape — this class imposes none of its own.
@@ -130,6 +139,24 @@ var CloudflareStreamManager = class extends CloudflareManager {
 			...params
 		}, requestOptions));
 	}
+	/**
+	* Create a signing key. Cloudflare returns the private half once, on creation, and never again — so the
+	* caller stores it, and a lost key is replaced by creating another.
+	*/
+	async createSigningKey() {
+		return cloudflareRequest("Stream create signing key", async () => {
+			const response = await this.getClient().stream.keys.create({
+				account_id: this.accountId,
+				body: {}
+			}, requestOptions);
+			const parsed = StreamSigningKey.safeParse(response);
+			if (!parsed.success) throw new CloudflareInvalidResponseError({
+				message: "A Stream signing-key response had an unexpected shape.",
+				detail: parsed.error.message
+			});
+			return parsed.data;
+		});
+	}
 	getServiceType() {
 		return "Cloudflare Stream";
 	}
@@ -144,4 +171,4 @@ var CloudflareStreamManager = class extends CloudflareManager {
 	}
 };
 //#endregion
-export { CloudflareStreamManager, DownloadEntry, StreamDownloadStatus };
+export { CloudflareStreamManager, DownloadEntry, StreamDownloadStatus, StreamSigningKey };

package/dist/oauth/scopes.d.ts

@@ -7,8 +7,8 @@
  *   the person who signed in.
  * - `offline_access` — the only way Cloudflare issues a refresh token. Without it a session dies at the
  *   hour and every command after it opens a browser (measured 2026-10-15).
- * - `account-api-tokens.write` — the mint. A session mints `ci-system` and every worker-consumer token
- *   the project declares, so the hand-made bootstrap token stops being a setup step.
+ * - `account-api-tokens.write` — the mint. A session mints `ci-system` and `runtime` as the project
+ *   composes them, so the hand-made bootstrap token stops being a setup step.
  * - `account-settings.read` — `GET /accounts`, so the account is discovered rather than stored. On its own
  *   it lists the account; `d1.write` alone listed nothing (both measured 2026-10-15), so discovery must not
  *   lean on whichever other scope a project happens to request.

package/dist/oauth/scopes.js

@@ -9,8 +9,8 @@ import { oauthScopesFor } from "../tokens/permissions.js";
 *   the person who signed in.
 * - `offline_access` — the only way Cloudflare issues a refresh token. Without it a session dies at the
 *   hour and every command after it opens a browser (measured 2026-10-15).
-* - `account-api-tokens.write` — the mint. A session mints `ci-system` and every worker-consumer token
-*   the project declares, so the hand-made bootstrap token stops being a setup step.
+* - `account-api-tokens.write` — the mint. A session mints `ci-system` and `runtime` as the project
+*   composes them, so the hand-made bootstrap token stops being a setup step.
 * - `account-settings.read` — `GET /accounts`, so the account is discovered rather than stored. On its own
 *   it lists the account; `d1.write` alone listed nothing (both measured 2026-10-15), so discovery must not
 *   lean on whichever other scope a project happens to request.

package/dist/queue/queueProvisioner.d.ts

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+import { CloudflareManager } from "../client/manager";
+/** A queue's identity, decoded from the Queues API's `queue_id` and `queue_name`. */
+export declare const QueueInfo: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type QueueInfo = z.output<typeof QueueInfo>;
+/**
+ * Account-level Queues control plane: **find, create and delete queues** (#662).
+ *
+ * `pithy provision` creates the queue behind every `queue` binding a composition declares, and `pithy feature
+ * destroy` deletes a feature's. A `queues.producers` entry names a queue, and `wrangler deploy` refuses one that
+ * does not exist, so the entry is only honest because this stands the queue up. Addressed by account — unlike
+ * {@link CloudflareQueueManager}, which targets one queue to send into.
+ */
+export declare class CloudflareQueueProvisioner extends CloudflareManager {
+    getServiceType(): string;
+    /** Prove access by listing queues — a read, never a create or a delete. Never throws. */
+    validateServiceAccess(): Promise<boolean>;
+    /** Find a queue by exact name in the account, or `null` — for idempotent provisioning. */
+    findQueueByName(name: string): Promise<QueueInfo | null>;
+    /** Create a queue by name; returns its id and name. */
+    createQueue(name: string): Promise<QueueInfo>;
+    /** Delete a queue by id. Idempotent — a missing queue is not an error, so teardown can re-run safely. */
+    deleteQueue(queueId: string): Promise<void>;
+}
+//# sourceMappingURL=queueProvisioner.d.ts.map

package/dist/queue/queueProvisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queueProvisioner.d.ts","sourceRoot":"","sources":["../../src/queue/queueProvisioner.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,SAAS;;;iBAKqD,CAAC;AAC5E,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAWnD;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,cAAc,IAAI,MAAM,CAEvB;IAED,yFAAyF;IACnF,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED,0FAA0F;IACpF,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAQ7D;IAED,uDAAuD;IACjD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAKlD;IAED,yGAAyG;IACnG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShD;CACF"}