@pithy-sh/cloudflare 0.5.0 → 0.6.0

package/dist/queue/queueProvisioner.js

@@ -0,0 +1,72 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { cloudflareRequest, decodeResponse, isNotFoundError } from "../client/errors.js";
+import { CloudflareManager } from "../client/manager.js";
+import { z } from "zod";
+//#region src/queue/queueProvisioner.ts
+/** A queue's identity, decoded from the Queues API's `queue_id` and `queue_name`. */
+const QueueInfo = z.object({
+	id: z.string().describe("The CF-assigned queue id, which the REST API addresses a queue by."),
+	name: z.string().describe("The queue name a producer binding names it by.")
+}).describe("A Cloudflare Queue's identity, as the Queues API returns it.");
+/** The Queues API's own spelling of a queue's identity, mapped onto {@link QueueInfo}. */
+const QueueRecord = z.object({
+	queue_id: z.string().describe("The CF-assigned queue id."),
+	queue_name: z.string().describe("The queue name.")
+}).transform(({ queue_id, queue_name }) => ({
+	id: queue_id,
+	name: queue_name
+})).describe("A queue as the Queues API returns it.");
+/**
+* Account-level Queues control plane: **find, create and delete queues** (#662).
+*
+* `pithy provision` creates the queue behind every `queue` binding a composition declares, and `pithy feature
+* destroy` deletes a feature's. A `queues.producers` entry names a queue, and `wrangler deploy` refuses one that
+* does not exist, so the entry is only honest because this stands the queue up. Addressed by account — unlike
+* {@link CloudflareQueueManager}, which targets one queue to send into.
+*/
+var CloudflareQueueProvisioner = class extends CloudflareManager {
+	getServiceType() {
+		return "Cloudflare Queues (control plane)";
+	}
+	/** Prove access by listing queues — a read, never a create or a delete. Never throws. */
+	async validateServiceAccess() {
+		try {
+			await this.getClient().queues.list({ account_id: this.accountId });
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Find a queue by exact name in the account, or `null` — for idempotent provisioning. */
+	async findQueueByName(name) {
+		return cloudflareRequest(`find queue ${name}`, async () => {
+			for await (const queue of this.getClient().queues.list({ account_id: this.accountId })) {
+				const parsed = QueueRecord.safeParse(queue);
+				if (parsed.success && parsed.data.name === name) return parsed.data;
+			}
+			return null;
+		});
+	}
+	/** Create a queue by name; returns its id and name. */
+	async createQueue(name) {
+		const response = await cloudflareRequest(`create queue ${name}`, () => this.getClient().queues.create({
+			account_id: this.accountId,
+			queue_name: name
+		}));
+		return decodeResponse(QueueRecord, response, "queue create");
+	}
+	/** Delete a queue by id. Idempotent — a missing queue is not an error, so teardown can re-run safely. */
+	async deleteQueue(queueId) {
+		await cloudflareRequest(`delete queue ${queueId}`, async () => {
+			try {
+				await this.getClient().queues.delete(queueId, { account_id: this.accountId });
+			} catch (error) {
+				if (isNotFoundError(error)) return;
+				throw error;
+			}
+		});
+	}
+};
+//#endregion
+export { CloudflareQueueProvisioner, QueueInfo };

package/dist/r2/r2Manager.d.ts

@@ -8,9 +8,18 @@ import { R2Credentials } from "./r2Credentials";
  * the bucket it targets. R2 signs presigned URLs with the S3 keys, not the CF API token — both
  * come from config (no environment coupling).
  */
-export interface R2ManagerConfig extends CloudflareManagerConfig, R2Credentials {
+export interface R2ManagerConfig extends Omit<CloudflareManagerConfig, "apiToken">, R2Credentials {
     /** The R2 bucket all object operations target. */
     bucketName: string;
+    /**
+     * A Cloudflare API token, for the one call here that is not S3: {@link CloudflareR2Manager.validateServiceAccess}.
+     *
+     * **Absent in a Worker (#728).** Every object operation is S3, signed with the key pair, so a Worker's
+     * object store holds no API token: the application's one is `runtime`, and R2 needs none of it. Without
+     * one, `validateServiceAccess` answers `false` and nothing calls the Cloudflare API. An empty string is
+     * still refused, because that is an unresolved value rather than a decision.
+     */
+    apiToken?: string;
 }
 /** How long a presigned URL stays valid. Shared by every presign method so the option reads the same. */
 export interface PresignOptions {
@@ -97,6 +106,7 @@ export declare class CloudflareR2Manager extends CloudflareManager {
     private readonly accessKeyId;
     private readonly secretAccessKey;
     private s3Client;
+    private readonly s3Only;
     constructor(config: R2ManagerConfig);
     /** The S3-compatible client for R2, lazily created and cached for the manager's lifetime. */
     private getS3Client;

package/dist/r2/r2Manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2Manager.d.ts","sourceRoot":"","sources":["../../src/r2/r2Manager.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAQhD;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,uBAAuB,EAAE,aAAa;IAC7E,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC7B,+GAA+G;IAC/G,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wEAAwE;AACxE,eAAO,MAAM,YAAY;;;;;iBAWsD,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEzD,uEAAuE;AACvE,eAAO,MAAM,cAAc;;;;iBAMyE,CAAC;AACrG,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,qDAAqD;AACrD,eAAO,MAAM,eAAe;;;iBASiF,CAAC;AAC9G,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;iBAM+E,CAAC;AAC5G,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAkB/D;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,OAAO,CAAC,QAAQ,CAAyB;IAEzC,YAAY,MAAM,EAAE,eAAe,EAgBlC;IAED,6FAA6F;IAC7F,OAAO,CAAC,WAAW;IAWnB;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CACnB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAYjB;IAED,0GAA0G;IACpG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlF;IAED;;;;;;;;OAQG;IACG,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7E;IAED;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAajB;IAED;;;;;;;OAOG;IACG,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3G;IAED;;;OAGG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvE;IAED;;;;;;OAMG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA2BxE;IAED;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmB1D;IAED;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA6BtE;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB5E;IAED;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlE;IAED;;;OAGG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7C;IAED;;;;;;;;;;;;;;OAcG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAmB1C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"r2Manager.d.ts","sourceRoot":"","sources":["../../src/r2/r2Manager.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAQhD;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC,EAAE,aAAa;IAC/F,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAWD,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC7B,+GAA+G;IAC/G,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wEAAwE;AACxE,eAAO,MAAM,YAAY;;;;;iBAWsD,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEzD,uEAAuE;AACvE,eAAO,MAAM,cAAc;;;;iBAMyE,CAAC;AACrG,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,qDAAqD;AACrD,eAAO,MAAM,eAAe;;;iBASiF,CAAC;AAC9G,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;iBAM+E,CAAC;AAC5G,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAkB/D;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,OAAO,CAAC,QAAQ,CAAyB;IAEzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC,YAAY,MAAM,EAAE,eAAe,EAqBlC;IAED,6FAA6F;IAC7F,OAAO,CAAC,WAAW;IAWnB;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CACnB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAYjB;IAED,0GAA0G;IACpG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlF;IAED;;;;;;;;OAQG;IACG,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7E;IAED;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAajB;IAED;;;;;;;OAOG;IACG,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3G;IAED;;;OAGG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvE;IAED;;;;;;OAMG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA2BxE;IAED;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmB1D;IAED;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA6BtE;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB5E;IAED;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlE;IAED;;;OAGG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7C;IAED;;;;;;;;;;;;;;OAcG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAmB1C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAS9C;CACF"}

package/dist/r2/r2Manager.js

@@ -11,6 +11,13 @@ import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 const PRESIGN_EXPIRY_SECONDS = 3600;
 /** How many parts one `ListParts` page returns. S3's own cap; the drain loop below relies on it. */
 const LIST_PARTS_PAGE_SIZE = 1e3;
+/**
+* What the base client is built with when the config carries no API token. Never sent: {@link noApiToken}
+* is the provider, and the base reads the token through it at every call and refuses an empty one.
+*/
+const S3_ONLY = "r2-s3-only";
+/** The token provider of an S3-only manager: no token, so any Cloudflare API call is refused before it is sent. */
+const noApiToken = () => "";
 /** An object's metadata as R2 reports it, without fetching the body. */
 const R2ObjectHead = z.object({
 	size: z.number().int().nonnegative().describe("The object's size in bytes."),
@@ -70,8 +77,17 @@ var CloudflareR2Manager = class extends CloudflareManager {
 	accessKeyId;
 	secretAccessKey;
 	s3Client = null;
+	s3Only;
 	constructor(config) {
-		super(config);
+		super(config.apiToken === void 0 ? {
+			...config,
+			apiToken: S3_ONLY,
+			tokenProvider: noApiToken
+		} : {
+			...config,
+			apiToken: config.apiToken
+		});
+		this.s3Only = config.apiToken === void 0;
 		if (!config.bucketName) throw new CloudflareNotConfiguredError({ detail: "Missing bucketName for R2 access." });
 		const credentials = R2Credentials.safeParse(config);
 		if (!credentials.success) throw new CloudflareNotConfiguredError({ detail: `Invalid R2 credentials: ${credentials.error.message}` });
@@ -395,6 +411,7 @@ var CloudflareR2Manager = class extends CloudflareManager {
 	* not merely that an S3 client could be built. Never throws.
 	*/
 	async validateServiceAccess() {
+		if (this.s3Only) return false;
 		try {
 			await this.getClient().r2.buckets.get(this.bucketName, { account_id: this.accountId });
 			return true;

package/dist/tokens/accountTokensManager.d.ts

@@ -107,6 +107,7 @@ export declare const AccountTokenSummary: z.ZodObject<{
         }, z.core.$strip>>>, unknown>;
         resources: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, z.core.$strip>>>, unknown>>;
+    last_used_on: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
 }, z.core.$strip>;
 export type AccountTokenSummary = z.output<typeof AccountTokenSummary>;
 /**

package/dist/tokens/accountTokensManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountTokensManager.d.ts","sourceRoot":"","sources":["../../src/tokens/accountTokensManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAkB1D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kHAAkH;IAClH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIhF;AAeD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;iBAK8E,CAAC;AAC7G,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAY6D,CAAC;AAC7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAwBkF,CAAC;AAClH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;iBAuBuD,CAAC;AACxF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;IACnE,cAAc,IAAI,MAAM,CAEvB;IAED,qGAAqG;IAC/F,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAKhD;IAED;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe1D;IAED,qGAAqG;IAC/F,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAezD;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAE7E;IAED;;;;;;;OAOG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgDzF;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAqB3B,2GAA2G;IACrG,UAAU,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAajD;IAED,oGAAoG;IAC9F,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAYvE;IAED,qCAAqC;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhD;IAED;;;;OAIG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBtD;IAED;;;;;OAKG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAKzF;CACF"}
+{"version":3,"file":"accountTokensManager.d.ts","sourceRoot":"","sources":["../../src/tokens/accountTokensManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAkB1D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kHAAkH;IAClH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIhF;AAeD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;iBAK8E,CAAC;AAC7G,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAY6D,CAAC;AAC7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAwBkF,CAAC;AAClH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;iBAmCuD,CAAC;AACxF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;IACnE,cAAc,IAAI,MAAM,CAEvB;IAED,qGAAqG;IAC/F,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAKhD;IAED;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe1D;IAED,qGAAqG;IAC/F,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAezD;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAE7E;IAED;;;;;;;OAOG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgDzF;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAqB3B,2GAA2G;IACrG,UAAU,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAajD;IAED,oGAAoG;IAC9F,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAYvE;IAED,qCAAqC;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhD;IAED;;;;OAIG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBtD;IAED;;;;;OAKG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAKzF;CACF"}

package/dist/tokens/accountTokensManager.js

@@ -110,7 +110,8 @@ const AccountTokenSummary = z.object({
 		"disabled",
 		"expired"
 	]).describe("The lifecycle state Cloudflare holds for the token.").optional()).describe("The token's lifecycle status. Reported, because a `disabled` or `expired` token cannot attach a route however its policies read. `nullish` for the reason {@link AccountTokenPolicy} gives."),
-	policies: nullAsAbsent(z.array(AccountTokenPolicy).optional()).catch(void 0).describe("The token's access policies, when the list response carries them. **A live token's own scope is the record of how it was minted** — it is how a `ci-system` token minted before zone-scoped routes (#651) can be told from one minted after, without reading the token record (which needs a grant these least-privilege tokens deliberately lack). Absent and empty are different facts: a response that says nothing means the scope could not be read, never that the token has none.")
+	policies: nullAsAbsent(z.array(AccountTokenPolicy).optional()).catch(void 0).describe("The token's access policies, when the list response carries them. **A live token's own scope is the record of how it was minted** — it is how a `ci-system` token minted before zone-scoped routes (#651) can be told from one minted after, without reading the token record (which needs a grant these least-privilege tokens deliberately lack). Absent and empty are different facts: a response that says nothing means the scope could not be read, never that the token has none."),
+	last_used_on: z.string().nullable().optional().catch(void 0).describe("When something last authenticated with the token, as Cloudflare measures it against the live account. Read because `pithy token forget` acts on it (#762): `null` means never, so a local copy may be its only one. Absent means the response did not say, which is not a claim either way.")
 }).describe("An existing account-owned API token's metadata (never its secret value).");
 /**
 * Out-of-Worker control plane for **account-owned** Cloudflare API tokens: mint scoped, least-privilege

package/dist/tokens/permissions.d.ts

@@ -25,6 +25,11 @@ export declare const PERMISSION_GROUPS: {
     readonly "ai:read": readonly ["Workers AI Read"];
     readonly "zone:read": readonly ["Zone Read"];
     readonly "routes:write": readonly ["Workers Routes Write"];
+    readonly "analytics:read": readonly ["Account Analytics Read"];
+    readonly "images:write": readonly ["Images Write"];
+    readonly "stream:write": readonly ["Stream Write"];
+    readonly "queues:write": readonly ["Queues Write"];
+    readonly "artifacts:write": readonly ["Artifacts Write"];
 };
 /** A known permission key — one of {@link PERMISSION_GROUPS}'s keys. */
 export type PermissionKey = keyof typeof PERMISSION_GROUPS;
@@ -61,6 +66,11 @@ export declare const OAUTH_SCOPES: {
     readonly "ai:read": readonly ["ai.read"];
     readonly "zone:read": readonly ["zone.read"];
     readonly "routes:write": readonly ["workers-routes.write"];
+    readonly "analytics:read": readonly ["account-analytics.read"];
+    readonly "images:write": readonly ["images.write"];
+    readonly "stream:write": readonly ["stream.write"];
+    readonly "queues:write": readonly ["queues.write"];
+    readonly "artifacts:write": readonly ["artifacts.write"];
 };
 /**
  * Resolve permission keys to the OAuth scopes a session needs to act — or mint — with them, de-duped in

package/dist/tokens/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/tokens/permissions.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;aAC5B,SAAS,YAAG,SAAS;aAIrB,UAAU,YAAG,UAAU;aACvB,eAAe,YAAG,uBAAuB;aACzC,cAAc,YAAG,oBAAoB;aACrC,eAAe,YAAG,qBAAqB;aACvC,eAAe,YAAG,2BAA2B;aAC7C,UAAU,YAAG,0BAA0B;aACvC,SAAS,YAAG,yBAAyB;aACrC,UAAU,YAAG,0BAA0B;aACvC,gBAAgB,YAAG,gBAAgB;aACnC,iBAAiB,YAAG,iBAAiB;aACrC,SAAS,YAAG,iBAAiB;aAK7B,WAAW,YAAG,WAAW;aAiBzB,cAAc,YAAG,sBAAsB;CAC/B,CAAC;AAEX,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;CAeoC,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAShE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAAqB,CAAC;AAElF,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,aAAa,CAEjE;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/tokens/permissions.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;aAC5B,SAAS,YAAG,SAAS;aAIrB,UAAU,YAAG,UAAU;aACvB,eAAe,YAAG,uBAAuB;aACzC,cAAc,YAAG,oBAAoB;aACrC,eAAe,YAAG,qBAAqB;aACvC,eAAe,YAAG,2BAA2B;aAC7C,UAAU,YAAG,0BAA0B;aACvC,SAAS,YAAG,yBAAyB;aACrC,UAAU,YAAG,0BAA0B;aACvC,gBAAgB,YAAG,gBAAgB;aACnC,iBAAiB,YAAG,iBAAiB;aACrC,SAAS,YAAG,iBAAiB;aAK7B,WAAW,YAAG,WAAW;aAiBzB,cAAc,YAAG,sBAAsB;aAQvC,gBAAgB,YAAG,wBAAwB;aAK3C,cAAc,YAAG,cAAc;aAC/B,cAAc,YAAG,cAAc;aAI/B,cAAc,YAAG,cAAc;aAI/B,iBAAiB,YAAG,iBAAiB;CAC7B,CAAC;AAEX,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;CAoBoC,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAShE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAAqB,CAAC;AAElF,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,aAAa,CAEjE;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D"}

package/dist/tokens/permissions.js

@@ -26,7 +26,12 @@ const PERMISSION_GROUPS = {
 	"vectorize:write": ["Vectorize Write"],
 	"ai:read": ["Workers AI Read"],
 	"zone:read": ["Zone Read"],
-	"routes:write": ["Workers Routes Write"]
+	"routes:write": ["Workers Routes Write"],
+	"analytics:read": ["Account Analytics Read"],
+	"images:write": ["Images Write"],
+	"stream:write": ["Stream Write"],
+	"queues:write": ["Queues Write"],
+	"artifacts:write": ["Artifacts Write"]
 };
 /**
 * **The third column: the OAuth scope each key needs a signed-in session to hold (#759).**
@@ -60,7 +65,12 @@ const OAUTH_SCOPES = {
 	"vectorize:write": ["vectorize.write"],
 	"ai:read": ["ai.read"],
 	"zone:read": ["zone.read"],
-	"routes:write": ["workers-routes.write"]
+	"routes:write": ["workers-routes.write"],
+	"analytics:read": ["account-analytics.read"],
+	"images:write": ["images.write"],
+	"stream:write": ["stream.write"],
+	"queues:write": ["queues.write"],
+	"artifacts:write": ["artifacts.write"]
 };
 /**
 * Resolve permission keys to the OAuth scopes a session needs to act — or mint — with them, de-duped in

package/dist/tokens/profiles.d.ts

@@ -1,13 +1,13 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import type { Capability, TokenProfileSeam } from "@pithy-sh/core/src/capability/capability";
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
 import { type TokenPermission } from "./accountTokensManager";
 import { type PermissionKey } from "./permissions";
 /**
  * Where a minted token's value is written.
  *
- * - `secrets-store` — the CF Secrets Store; a Worker reads it via its binding. The destination for a
- *   worker-consumer token; resolved from the token's declared secret (its registry backend) unless a
+ * - `secrets-store` — the CF Secrets Store; a Worker reads it via its binding. The destination for the
+ *   `runtime` token; resolved from the token's declared secret (its registry backend) unless a
  *   profile or `--store` names it directly.
  * - `dev-vars` — `<config>/<project>/tokens.json`, keyed by environment and outside every checkout.
  *   **Read by an operator, never by a command** — nothing resolves a credential from it. The store for
@@ -37,21 +37,11 @@ export interface TokenProfile {
     resources?: "account" | Record<string, string>;
     /** The secret-registry name the minted value is stored under; its declared backend is the destination. */
     secret: string;
-    /**
-     * Whether the value behind {@link secret} differs per environment (the default) or is one value every
-     * environment shares. It decides the environment segment of the **CF Secrets Store entry name** the
-     * minted value is written to, and nothing else — never the variable key, which is a variable name
-     * and stays verbatim. A `global` profile writes one entry with the literal `global` in that slot,
-     * matching what provisioning wrote; an `environment` profile writes one entry per environment.
-     */
-    secretScope?: TokenSecretScope;
     /** A built-in destination override (`dev-vars`/`ephemeral`/`secrets-store`); else the secret's backend. */
     defaultStore?: TokenStore;
     /** Why this profile exists / what job consumes it. */
     description: string;
 }
-/** Whether a profile's secret is one value per environment or one value shared by all of them. */
-export type TokenSecretScope = "environment" | "global";
 /** An adopter's override of a profile's defaults (from `pithy.config.ts` or CLI flags). Every field optional. */
 export interface ProfileOverride {
     /** Replace the profile's permission keys. */
@@ -69,23 +59,9 @@ export declare function tokenSecretName(profile: string): string;
  */
 export declare function defineTokenProfile(profile: TokenProfile): TokenProfile;
 /**
- * The seam fields this package reads. Core's {@link TokenProfileSeam} is the structural contract every
- * capability declares against; `secretScope` is additive on top of it, so it is named here rather than
- * in core — a seam value that omits it is still assignable, and one that carries it is read as declared.
- *
- * Exported so a capability can type its `tokenProfiles` entry against it. Declaring `secretScope` as an
- * inline object literal directly in `tokenProfiles` still trips TypeScript's excess-property check
- * against core's narrower `TokenProfileSeam`; declare the entry as its own `const` (with `as const` or
- * `satisfies TokenProfileSeamInput`) and it flows through.
- */
-export interface TokenProfileSeamInput extends TokenProfileSeam {
-    readonly secretScope?: string;
-}
-/**
- * The project's token-profile registry: the aggregating `ci-system` profile plus every composed
- * capability's worker-consumer {@link Capability.tokenProfiles} slice. A capability profile that
- * clashes with `ci-system` (or another capability's name) fails loudly at assembly. This is the one
- * registry `pithy token` reads.
+ * The project's token-profile registry: the aggregating `ci-system` profile and, when any composed
+ * capability declares {@link Capability.runtimePermissions}, the aggregating `runtime` profile. Nothing
+ * else — a capability cannot add a profile. This is the one registry `pithy token` reads.
  */
 export declare function resolveTokenProfiles(capabilities: readonly Capability[]): Record<string, TokenProfile>;
 /**

package/dist/tokens/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/tokens/profiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE7F,OAAO,EAAmB,KAAK,eAAe,EAAiB,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpE,uFAAuF;AACvF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAe7C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,2GAA2G;IAC3G,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kGAAkG;AAClG,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAKxD,iHAAiH;AACjH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,sDAAsD;IACtD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAGtE;AAkCD;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AA6BD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CActG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,eAAe,GACzB,YAAY,CAgBd;AAsBD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAG9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE,CAG9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAK9F"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/tokens/profiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,EAAmB,KAAK,eAAe,EAAiB,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpE,uFAAuF;AACvF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAe7C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iHAAiH;AACjH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,sDAAsD;IACtD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAGtE;AAiFD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAMtG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,eAAe,GACzB,YAAY,CAgBd;AAsBD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAG9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE,CAG9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAK9F"}

package/dist/tokens/profiles.js

@@ -3,6 +3,7 @@
 import { CloudflareNotConfiguredError } from "../client/errors.js";
 import { accountResource, zoneResources } from "./accountTokensManager.js";
 import { PERMISSION_GROUPS, isPermissionKey, isZoneScopedPermission, resolvePermissionKeys } from "./permissions.js";
+import { RUNTIME_PROFILE, RUNTIME_TOKEN_SECRET } from "./runtime.js";
 //#region src/tokens/profiles.ts
 /** The valid stores, for validating a `--store` flag or a profile's `defaultStore`. */
 const TOKEN_STORES = [
@@ -24,8 +25,6 @@ const CI_SYSTEM_BASE = [
 	"secrets:read",
 	"secrets:write"
 ];
-/** The valid secret scopes, for validating a capability's declaration. */
-const TOKEN_SECRET_SCOPES = ["environment", "global"];
 /** The env-var / secret name a profile's token is stored under: `CF_TOKEN_<PROFILE>`. */
 function tokenSecretName(profile) {
 	return `CF_TOKEN_${profile.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`;
@@ -42,14 +41,23 @@ function defineTokenProfile(profile) {
 function assertPermissionKeys(keys, where) {
 	for (const key of keys) if (!isPermissionKey(key)) throw new CloudflareNotConfiguredError({
 		message: `${where} declares an unknown permission key: ${key}.`,
-		action: "Use a known permission key (d1:read, d1:write, workers:write, secrets:read, secrets:write, email:routing, kv:write)."
+		action: `Use a known permission key: ${Object.keys(PERMISSION_GROUPS).join(", ")}.`
 	});
 	return keys;
 }
-/** Build the aggregating `ci-system` profile: the base permissions ∪ every capability's `ciPermissions`. */
+/**
+* Build the aggregating `ci-system` profile: the base permissions ∪ every capability's `ciPermissions` ∪
+* `queues:write` where a composed capability binds a queue ∪ `artifacts:write` where one binds Artifacts.
+*
+* **The queue permission is derived from the binding, not declared (#662).** `pithy provision` creates the queue
+* behind every `queue` binding it composes, the adopter's own app's included, and the app has no `ciPermissions`
+* anyone would think to write. A permission read off the binding cannot be forgotten by whoever declares it.
+*/
 function ciSystemProfile(capabilities) {
 	const permissions = [...CI_SYSTEM_BASE];
 	for (const capability of capabilities) for (const key of assertPermissionKeys(capability.ciPermissions ?? [], `Capability "${capability.name}"`)) if (!permissions.includes(key)) permissions.push(key);
+	if (capabilities.some((capability) => capability.requiredBindings.some((binding) => binding.type === "queue")) && !permissions.includes("queues:write")) permissions.push("queues:write");
+	if (capabilities.some((capability) => capability.requiredBindings.some((binding) => binding.type === "artifacts")) && !permissions.includes("artifacts:write")) permissions.push("artifacts:write");
 	return {
 		name: CI_SYSTEM_PROFILE,
 		permissions,
@@ -58,44 +66,44 @@ function ciSystemProfile(capabilities) {
 		description: "The one CI pipeline credential: deploy Workers, migrate, and every composed capability's CI needs. Set it as CI's CLOUDFLARE_API_TOKEN."
 	};
 }
-/** Build a concrete, validated worker-consumer {@link TokenProfile} from a capability's structural seam entry. */
-function profileFromSeam(name, seam, capability) {
-	const store = seam.defaultStore;
-	if (store !== void 0 && !TOKEN_STORES.includes(store)) throw new CloudflareNotConfiguredError({
-		message: `Token profile "${name}" (capability "${capability}") declares an unknown store: ${store}.`,
-		action: `Use one of: ${TOKEN_STORES.join(", ")}.`
-	});
-	const scope = seam.secretScope;
-	if (scope !== void 0 && !TOKEN_SECRET_SCOPES.includes(scope)) throw new CloudflareNotConfiguredError({
-		message: `Token profile "${name}" (capability "${capability}") declares an unknown secret scope: ${scope}.`,
-		action: `Use one of: ${TOKEN_SECRET_SCOPES.join(", ")}.`
-	});
+/**
+* Build the aggregating `runtime` profile: every composed capability's `runtimePermissions`, each once,
+* in first-declared order — or nothing, when the composition declares none.
+*
+* **One token per deployed application, the way `ci-system` is one per pipeline.** A capability names
+* what its Workers call Cloudflare with and never a token of its own, so a second credential is not
+* something a capability can ask for. The token is minted per environment into the Secrets Store, so
+* revoking staging's leaves production reading. A key whose group is zone-scoped is refused here: a
+* Worker's token is account-scoped, and its zones would have to be chosen by hand.
+*/
+function runtimeProfile(capabilities) {
+	const permissions = [];
+	for (const capability of capabilities) {
+		const where = `Capability "${capability.name}"`;
+		const keys = assertPermissionKeys(capability.runtimePermissions ?? [], where);
+		assertAccountScoped(keys, `${where}'s runtimePermissions`);
+		for (const key of keys) if (!permissions.includes(key)) permissions.push(key);
+	}
+	if (permissions.length === 0) return void 0;
 	return {
-		name,
-		permissions: assertPermissionKeys(seam.permissions, `Token profile "${name}"`),
-		resources: seam.resources,
-		secret: seam.secret ?? tokenSecretName(name),
-		secretScope: scope,
-		defaultStore: store,
-		description: seam.description ?? name
+		name: RUNTIME_PROFILE,
+		permissions,
+		secret: RUNTIME_TOKEN_SECRET,
+		defaultStore: "secrets-store",
+		description: "The one Cloudflare API token a deployed application holds: every composed capability's runtime needs, per environment. Analytics reads are account-wide by Cloudflare's grain."
 	};
 }
 /**
-* The project's token-profile registry: the aggregating `ci-system` profile plus every composed
-* capability's worker-consumer {@link Capability.tokenProfiles} slice. A capability profile that
-* clashes with `ci-system` (or another capability's name) fails loudly at assembly. This is the one
-* registry `pithy token` reads.
+* The project's token-profile registry: the aggregating `ci-system` profile and, when any composed
+* capability declares {@link Capability.runtimePermissions}, the aggregating `runtime` profile. Nothing
+* else — a capability cannot add a profile. This is the one registry `pithy token` reads.
 */
 function resolveTokenProfiles(capabilities) {
-	const profiles = { [CI_SYSTEM_PROFILE]: ciSystemProfile(capabilities) };
-	for (const capability of capabilities) for (const [name, seam] of Object.entries(capability.tokenProfiles ?? {})) {
-		if (profiles[name]) throw new CloudflareNotConfiguredError({
-			message: `Token profile "${name}" is declared more than once (capability "${capability.name}").`,
-			action: "Give each token profile a unique name."
-		});
-		profiles[name] = profileFromSeam(name, seam, capability.name);
-	}
-	return profiles;
+	const runtime = runtimeProfile(capabilities);
+	return {
+		[CI_SYSTEM_PROFILE]: ciSystemProfile(capabilities),
+		...runtime ? { [RUNTIME_PROFILE]: runtime } : {}
+	};
 }
 /**
 * Resolve a profile by name from the aggregated registry, applying an adopter override. An unknown

package/dist/tokens/runtime.d.ts

@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+/**
+ * **The names of the one Cloudflare API token a deployed application holds (#728)**, in a module of their
+ * own. A Worker reads the token by {@link RUNTIME_TOKEN_SECRET}, and importing the profile registry to
+ * learn a string would put the token-minting client on every Worker's bundle. Nothing here imports anything.
+ */
+/** The name of the one runtime token — the single Cloudflare API token a deployed application holds (#728). */
+export declare const RUNTIME_PROFILE = "runtime";
+/**
+ * The secret the runtime token's value is stored under, and the binding every Worker that calls Cloudflare
+ * reads it through. Unscoped, because it is a binding name: the Secrets Store entry it resolves to carries
+ * the project and environment (`<project>-<env>-runtime-cf-api-token`).
+ */
+export declare const RUNTIME_TOKEN_SECRET = "RUNTIME_CF_API_TOKEN";
+//# sourceMappingURL=runtime.d.ts.map

package/dist/tokens/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/tokens/runtime.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,+GAA+G;AAC/G,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC"}

package/dist/tokens/runtime.js

@@ -0,0 +1,18 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/tokens/runtime.ts
+/**
+* **The names of the one Cloudflare API token a deployed application holds (#728)**, in a module of their
+* own. A Worker reads the token by {@link RUNTIME_TOKEN_SECRET}, and importing the profile registry to
+* learn a string would put the token-minting client on every Worker's bundle. Nothing here imports anything.
+*/
+/** The name of the one runtime token — the single Cloudflare API token a deployed application holds (#728). */
+const RUNTIME_PROFILE = "runtime";
+/**
+* The secret the runtime token's value is stored under, and the binding every Worker that calls Cloudflare
+* reads it through. Unscoped, because it is a binding name: the Secrets Store entry it resolves to carries
+* the project and environment (`<project>-<env>-runtime-cf-api-token`).
+*/
+const RUNTIME_TOKEN_SECRET = "RUNTIME_CF_API_TOKEN";
+//#endregion
+export { RUNTIME_PROFILE, RUNTIME_TOKEN_SECRET };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/cloudflare",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   },
   "scripts": {
     "build": "tsdown && tsc -p tsconfig.build.json && bun ../../tooling/build/src/stampDeclarations.ts",
-    "typecheck": "tsc -p tsconfig.json",
+    "typecheck": "bun check -p tsconfig.json",
     "test": "vitest run",
     "test:node": "vitest run --project=node",
     "test:integration": "vitest run --config vitest.integration.config.ts",
@@ -40,7 +40,7 @@
     "js-base64": "^3.9.2"
   },
   "peerDependencies": {
-    "@pithy-sh/core": "^0.10.0",
+    "@pithy-sh/core": "^0.11.0",
     "zod": "^4.4.0"
   },
   "devDependencies": {