@pithy-sh/cloudflare 0.9.0 → 0.9.2

package/dist/d1/d1PreparedStatement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"d1PreparedStatement.d.ts","sourceRoot":"","sources":["../../src/d1/d1PreparedStatement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAU,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6B7C;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;aAAK,UAAU,EAAE,CAAC;CAAW,CAAC;AAY3D,qBAAa,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,mBAAmB;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAY;IAExC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAE,OAAO,EAAO,EAM9G;IAED,gGAAgG;IAChG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAErD;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAEK,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IASlC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAmB5D,YAAY;CAgB3B"}
+{"version":3,"file":"d1PreparedStatement.d.ts","sourceRoot":"","sources":["../../src/d1/d1PreparedStatement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAU,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6B7C;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;aAAK,UAAU,EAAE,CAAC;CAAW,CAAC;AAmB3D,qBAAa,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,mBAAmB;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAY;IAExC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAE,OAAO,EAAO,EAM9G;IAED,gGAAgG;IAChG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAErD;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAED,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAEjC;IAEK,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IASlC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAmB5D,YAAY;CAgB3B"}

package/dist/d1/d1PreparedStatement.js

@@ -36,10 +36,15 @@ function mapMeta(restMeta) {
 * surfaces as the timeout it was, and `cloudflareRequest` already tells the operator to check before retrying.
 */
 const D1_QUERY_REQUEST = { maxRetries: 0 };
-/** The REST `params` array is strings; coerce each bound value the way the D1 REST API expects. */
-function toStringParams(params) {
+/**
+* Encode each bound value for the REST `params` array: a string as itself, a number or boolean as its
+* string, and a null as JSON `null`, which D1 binds as SQL NULL. `""` would bind as text, and a nullable
+* column would hold a value no reader takes for absent. Numbers stay strings because a JSON number binds
+* as `real`, and the column's affinity converts the string.
+*/
+function toRestParams(params) {
 	return params.map((value) => {
-		if (value === null || value === void 0) return "";
+		if (value === null || value === void 0) return null;
 		if (typeof value === "string") return value;
 		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
 		return JSON.stringify(value);
@@ -75,7 +80,7 @@ var D1PreparedStatementREST = class D1PreparedStatementREST {
 		return row;
 	}
 	async raw(options) {
-		const params = this.boundParams.length > 0 ? toStringParams(this.boundParams) : void 0;
+		const params = this.boundParams.length > 0 ? toRestParams(this.boundParams) : void 0;
 		const rawResult = (await cloudflareRequest("D1 raw query", () => this.client.d1.database.raw(this.databaseId, {
 			account_id: this.accountId,
 			sql: this.sql,
@@ -86,7 +91,7 @@ var D1PreparedStatementREST = class D1PreparedStatementREST {
 		return rows;
 	}
 	async executeQuery() {
-		const params = this.boundParams.length > 0 ? toStringParams(this.boundParams) : void 0;
+		const params = this.boundParams.length > 0 ? toRestParams(this.boundParams) : void 0;
 		const queryResult = (await cloudflareRequest("D1 query", () => this.client.d1.database.query(this.databaseId, {
 			account_id: this.accountId,
 			sql: this.sql,

package/dist/tokens/bindingPermissions.d.ts

@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { BindingType } from "@pithy-sh/core/src/capability/bindings";
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import type { PermissionKey } from "./permissions";
+/**
+ * **What a binding of each kind needs the `ci-system` token to carry**, so that provisioning, deploying and
+ * tearing down the resource behind it succeed under that token and under a signed-in session.
+ *
+ * Read off the binding rather than declared by a capability, because the adopter's own app binds resources
+ * too and has no `ciPermissions` anyone would think to write. A kind a provision command creates with no
+ * entry here fails `cli/src/provision/bindingPermissions.test.ts`.
+ *
+ * - `d1`, `secret` and `workflow` name what the `ci-system` base already carries.
+ * - `kv`, `r2` and `vectorize` take write alone. Provisioning lists before it creates, and a write scope
+ *   covers its read, as `OAUTH_SCOPES` records.
+ * - `queue` and `artifacts` are reached by the API only, to create or reap; a Worker uses its binding.
+ */
+export declare const BINDING_PERMISSIONS: Readonly<Partial<Record<BindingType, readonly PermissionKey[]>>>;
+/**
+ * The permission keys every binding the capabilities declare needs, each once, in first-seen order. The
+ * adopter's own app is a capability here like any other, so a bucket it declares counts.
+ */
+export declare function bindingPermissions(capabilities: readonly Capability[]): PermissionKey[];
+//# sourceMappingURL=bindingPermissions.d.ts.map

package/dist/tokens/bindingPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindingPermissions.d.ts","sourceRoot":"","sources":["../../src/tokens/bindingPermissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC,CAAC,CAShG,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,aAAa,EAAE,CAUvF"}

package/dist/tokens/bindingPermissions.js

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/tokens/bindingPermissions.ts
+/**
+* **What a binding of each kind needs the `ci-system` token to carry**, so that provisioning, deploying and
+* tearing down the resource behind it succeed under that token and under a signed-in session.
+*
+* Read off the binding rather than declared by a capability, because the adopter's own app binds resources
+* too and has no `ciPermissions` anyone would think to write. A kind a provision command creates with no
+* entry here fails `cli/src/provision/bindingPermissions.test.ts`.
+*
+* - `d1`, `secret` and `workflow` name what the `ci-system` base already carries.
+* - `kv`, `r2` and `vectorize` take write alone. Provisioning lists before it creates, and a write scope
+*   covers its read, as `OAUTH_SCOPES` records.
+* - `queue` and `artifacts` are reached by the API only, to create or reap; a Worker uses its binding.
+*/
+const BINDING_PERMISSIONS = {
+	d1: ["d1:read", "d1:write"],
+	kv: ["kv:write"],
+	r2: ["r2:write"],
+	vectorize: ["vectorize:write"],
+	queue: ["queues:write"],
+	artifacts: ["artifacts:write"],
+	secret: ["secrets:read", "secrets:write"],
+	workflow: ["workers:write"]
+};
+/**
+* The permission keys every binding the capabilities declare needs, each once, in first-seen order. The
+* adopter's own app is a capability here like any other, so a bucket it declares counts.
+*/
+function bindingPermissions(capabilities) {
+	const keys = [];
+	for (const capability of capabilities) for (const binding of capability.requiredBindings) for (const key of BINDING_PERMISSIONS[binding.type] ?? []) if (!keys.includes(key)) keys.push(key);
+	return keys;
+}
+//#endregion
+export { BINDING_PERMISSIONS, bindingPermissions };

package/dist/tokens/profiles.d.ts

@@ -12,8 +12,7 @@ import { type PermissionKey } from "./permissions";
  * - `dev-vars` — `<config>/<project>/tokens.json`, keyed by environment and outside every checkout.
  *   **Read by an operator, never by a command** — nothing resolves a credential from it. The store for
  *   the `ci-system` token: mint it here, read the value
- *   out, and set it as CI's `CLOUDFLARE_API_TOKEN`. It wrote `.dev.vars.<env>` *inside* the project until
- *   #182; the name stays because it is a public `--store` flag value.
+ *   out, and set it as CI's `CLOUDFLARE_API_TOKEN`. The name is a public `--store` flag value.
  * - `ephemeral` — nothing is written; the value is used in-process and discarded. The one-step CI
  *   path — CI can't read the CF Secrets Store, so it mints and uses the token in the same job.
  */
@@ -77,17 +76,16 @@ export declare function permissionsForKeys(keys: PermissionKey[], accountId: str
  *
  * This is the second policy on the `ci-system` token, beside the account-scoped one every profile
  * builds. It exists because `pithy deploy` of an environment with a declared domain calls
- * `POST /zones/<zone>/workers/routes`, the one deploy step the CI credential could not make (#651) — and
+ * `POST /zones/<zone>/workers/routes`, which no account-scoped group reaches — and
  * it is a policy of its own rather than a permission on the profile because its resources are zones,
  * which a profile cannot name: they are resolved from the domains at mint time.
  *
  * **This limits the route, not the token.** The account policy beside it carries Workers Scripts Write,
- * which attaches a custom domain on any zone the account holds (measured, #709; `docs/TOKENS.md`). Only
+ * which attaches a custom domain on any zone the account holds (measured; `docs/TOKENS.md`). Only
  * the route calls are held to the declared zones.
  *
  * **Empty for an empty zone list, deliberately.** A project that declares no domain attaches no route,
- * so it mints exactly the token it minted before this existed. No new permission for a project that
- * needs none.
+ * so it gets no zone permission.
  */
 export declare function routePermissions(zoneIds: readonly string[]): TokenPermission[];
 /**

package/dist/tokens/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/tokens/profiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,EAAmB,KAAK,eAAe,EAAiB,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpE,uFAAuF;AACvF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAe7C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iHAAiH;AACjH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,sDAAsD;IACtD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAGtE;AAiFD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAMtG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,eAAe,GACzB,YAAY,CAgBd;AAsBD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAG9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE,CAG9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAK9F"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/tokens/profiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,EAAmB,KAAK,eAAe,EAAiB,MAAM,wBAAwB,CAAC;AAE9F,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpE,uFAAuF;AACvF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAe7C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iHAAiH;AACjH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,sDAAsD;IACtD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAGtE;AAsED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAMtG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,eAAe,GACzB,YAAY,CAgBd;AAsBD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAG9F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE,CAG9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAK9F"}

package/dist/tokens/profiles.js

@@ -4,6 +4,7 @@ import { CloudflareNotConfiguredError } from "../client/errors.js";
 import { RUNTIME_PROFILE, RUNTIME_TOKEN_SECRET } from "./runtime.js";
 import { accountResource, zoneResources } from "./accountTokensManager.js";
 import { PERMISSION_GROUPS, isPermissionKey, isZoneScopedPermission, resolvePermissionKeys } from "./permissions.js";
+import { bindingPermissions } from "./bindingPermissions.js";
 //#region src/tokens/profiles.ts
 /** The valid stores, for validating a `--store` flag or a profile's `defaultStore`. */
 const TOKEN_STORES = [
@@ -47,17 +48,16 @@ function assertPermissionKeys(keys, where) {
 }
 /**
 * Build the aggregating `ci-system` profile: the base permissions ∪ every capability's `ciPermissions` ∪
-* `queues:write` where a composed capability binds a queue ∪ `artifacts:write` where one binds Artifacts.
-*
-* **The queue permission is derived from the binding, not declared (#662).** `pithy provision` creates the queue
-* behind every `queue` binding it composes, the adopter's own app's included, and the app has no `ciPermissions`
-* anyone would think to write. A permission read off the binding cannot be forgotten by whoever declares it.
+* what every composed binding needs, from `BINDING_PERMISSIONS`. The adopter's own app counts as a
+* capability, so a resource it binds brings its permission with no declaration.
 */
 function ciSystemProfile(capabilities) {
 	const permissions = [...CI_SYSTEM_BASE];
-	for (const capability of capabilities) for (const key of assertPermissionKeys(capability.ciPermissions ?? [], `Capability "${capability.name}"`)) if (!permissions.includes(key)) permissions.push(key);
-	if (capabilities.some((capability) => capability.requiredBindings.some((binding) => binding.type === "queue")) && !permissions.includes("queues:write")) permissions.push("queues:write");
-	if (capabilities.some((capability) => capability.requiredBindings.some((binding) => binding.type === "artifacts")) && !permissions.includes("artifacts:write")) permissions.push("artifacts:write");
+	const add = (key) => {
+		if (!permissions.includes(key)) permissions.push(key);
+	};
+	for (const capability of capabilities) for (const key of assertPermissionKeys(capability.ciPermissions ?? [], `Capability "${capability.name}"`)) add(key);
+	for (const key of bindingPermissions(capabilities)) add(key);
 	return {
 		name: CI_SYSTEM_PROFILE,
 		permissions,
@@ -127,7 +127,7 @@ function resolveProfile(profiles, name, override) {
 /**
 * Refuse a zone-scoped key anywhere a policy is being built **account-scoped**.
 *
-* A zone-level permission group handed the account resource is the quiet failure (#651): Cloudflare
+* A zone-level permission group handed the account resource is the quiet failure: Cloudflare
 * mints the token without complaint and then answers "No access to the specified resource" at the call,
 * which is a CI failure hours later with nothing in it naming the scope. Which zones a token gets is
 * never a typed choice — it is the project's declared `domains`, resolved at mint time — so a key naming
@@ -156,17 +156,16 @@ function permissionsForKeys(keys, accountId) {
 *
 * This is the second policy on the `ci-system` token, beside the account-scoped one every profile
 * builds. It exists because `pithy deploy` of an environment with a declared domain calls
-* `POST /zones/<zone>/workers/routes`, the one deploy step the CI credential could not make (#651) — and
+* `POST /zones/<zone>/workers/routes`, which no account-scoped group reaches — and
 * it is a policy of its own rather than a permission on the profile because its resources are zones,
 * which a profile cannot name: they are resolved from the domains at mint time.
 *
 * **This limits the route, not the token.** The account policy beside it carries Workers Scripts Write,
-* which attaches a custom domain on any zone the account holds (measured, #709; `docs/TOKENS.md`). Only
+* which attaches a custom domain on any zone the account holds (measured; `docs/TOKENS.md`). Only
 * the route calls are held to the declared zones.
 *
 * **Empty for an empty zone list, deliberately.** A project that declares no domain attaches no route,
-* so it mints exactly the token it minted before this existed. No new permission for a project that
-* needs none.
+* so it gets no zone permission.
 */
 function routePermissions(zoneIds) {
 	if (zoneIds.length === 0) return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/cloudflare",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "js-base64": "^3.9.2"
   },
   "peerDependencies": {
-    "@pithy-sh/core": "^0.16.0",
+    "@pithy-sh/core": "^0.16.1",
     "zod": "^4.4.0"
   },
   "devDependencies": {

package/src/d1/d1PreparedStatement.ts

@@ -42,14 +42,21 @@ function mapMeta(restMeta?: QueryResult.Meta): D1Meta & Record<string, unknown>
  */
 export const D1_QUERY_REQUEST = { maxRetries: 0 } as const;
 
-/** The REST `params` array is strings; coerce each bound value the way the D1 REST API expects. */
-function toStringParams(params: unknown[]): string[] {
-  return params.map((value) => {
-    if (value === null || value === undefined) return "";
+/**
+ * Encode each bound value for the REST `params` array: a string as itself, a number or boolean as its
+ * string, and a null as JSON `null`, which D1 binds as SQL NULL. `""` would bind as text, and a nullable
+ * column would hold a value no reader takes for absent. Numbers stay strings because a JSON number binds
+ * as `real`, and the column's affinity converts the string.
+ */
+function toRestParams(params: unknown[]): string[] {
+  const encoded = params.map((value): string | null => {
+    if (value === null || value === undefined) return null;
     if (typeof value === "string") return value;
     if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
     return JSON.stringify(value);
   });
+  // The SDK types `params` as strings only; the API takes a null in the array.
+  return encoded as string[];
 }
 
 export class D1PreparedStatementREST<T = Record<string, unknown>> implements D1PreparedStatement {
@@ -97,7 +104,7 @@ export class D1PreparedStatementREST<T = Record<string, unknown>> implements D1P
   async raw<U = unknown[]>(options: { columnNames: true }): Promise<[string[], ...U[]]>;
   async raw<U = unknown[]>(options?: { columnNames?: false }): Promise<U[]>;
   async raw<U = unknown[]>(options?: { columnNames?: boolean }): Promise<U[] | [string[], ...U[]]> {
-    const params = this.boundParams.length > 0 ? toStringParams(this.boundParams) : undefined;
+    const params = this.boundParams.length > 0 ? toRestParams(this.boundParams) : undefined;
     const response = await cloudflareRequest("D1 raw query", () =>
       this.client.d1.database.raw(
         this.databaseId,
@@ -115,7 +122,7 @@ export class D1PreparedStatementREST<T = Record<string, unknown>> implements D1P
   }
 
   private async executeQuery<U>(): Promise<D1Result<U>> {
-    const params = this.boundParams.length > 0 ? toStringParams(this.boundParams) : undefined;
+    const params = this.boundParams.length > 0 ? toRestParams(this.boundParams) : undefined;
     const response = await cloudflareRequest("D1 query", () =>
       this.client.d1.database.query(
         this.databaseId,

package/src/tokens/bindingPermissions.ts

@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { BindingType } from "@pithy-sh/core/src/capability/bindings";
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import type { PermissionKey } from "./permissions";
+
+/**
+ * **What a binding of each kind needs the `ci-system` token to carry**, so that provisioning, deploying and
+ * tearing down the resource behind it succeed under that token and under a signed-in session.
+ *
+ * Read off the binding rather than declared by a capability, because the adopter's own app binds resources
+ * too and has no `ciPermissions` anyone would think to write. A kind a provision command creates with no
+ * entry here fails `cli/src/provision/bindingPermissions.test.ts`.
+ *
+ * - `d1`, `secret` and `workflow` name what the `ci-system` base already carries.
+ * - `kv`, `r2` and `vectorize` take write alone. Provisioning lists before it creates, and a write scope
+ *   covers its read, as `OAUTH_SCOPES` records.
+ * - `queue` and `artifacts` are reached by the API only, to create or reap; a Worker uses its binding.
+ */
+export const BINDING_PERMISSIONS: Readonly<Partial<Record<BindingType, readonly PermissionKey[]>>> = {
+  d1: ["d1:read", "d1:write"],
+  kv: ["kv:write"],
+  r2: ["r2:write"],
+  vectorize: ["vectorize:write"],
+  queue: ["queues:write"],
+  artifacts: ["artifacts:write"],
+  secret: ["secrets:read", "secrets:write"],
+  workflow: ["workers:write"],
+};
+
+/**
+ * The permission keys every binding the capabilities declare needs, each once, in first-seen order. The
+ * adopter's own app is a capability here like any other, so a bucket it declares counts.
+ */
+export function bindingPermissions(capabilities: readonly Capability[]): PermissionKey[] {
+  const keys: PermissionKey[] = [];
+  for (const capability of capabilities) {
+    for (const binding of capability.requiredBindings) {
+      for (const key of BINDING_PERMISSIONS[binding.type] ?? []) {
+        if (!keys.includes(key)) keys.push(key);
+      }
+    }
+  }
+  return keys;
+}

package/src/tokens/profiles.ts

@@ -4,6 +4,7 @@
 import type { Capability } from "@pithy-sh/core/src/capability/capability";
 import { CloudflareNotConfiguredError } from "../client/errors";
 import { accountResource, type TokenPermission, zoneResources } from "./accountTokensManager";
+import { bindingPermissions } from "./bindingPermissions";
 import {
   isPermissionKey,
   isZoneScopedPermission,
@@ -22,8 +23,7 @@ import { RUNTIME_PROFILE, RUNTIME_TOKEN_SECRET } from "./runtime";
  * - `dev-vars` — `<config>/<project>/tokens.json`, keyed by environment and outside every checkout.
  *   **Read by an operator, never by a command** — nothing resolves a credential from it. The store for
  *   the `ci-system` token: mint it here, read the value
- *   out, and set it as CI's `CLOUDFLARE_API_TOKEN`. It wrote `.dev.vars.<env>` *inside* the project until
- *   #182; the name stays because it is a public `--store` flag value.
+ *   out, and set it as CI's `CLOUDFLARE_API_TOKEN`. The name is a public `--store` flag value.
  * - `ephemeral` — nothing is written; the value is used in-process and discarded. The one-step CI
  *   path — CI can't read the CF Secrets Store, so it mints and uses the token in the same job.
  */
@@ -108,29 +108,18 @@ function assertPermissionKeys(keys: readonly string[], where: string): Permissio
 
 /**
  * Build the aggregating `ci-system` profile: the base permissions ∪ every capability's `ciPermissions` ∪
- * `queues:write` where a composed capability binds a queue ∪ `artifacts:write` where one binds Artifacts.
- *
- * **The queue permission is derived from the binding, not declared (#662).** `pithy provision` creates the queue
- * behind every `queue` binding it composes, the adopter's own app's included, and the app has no `ciPermissions`
- * anyone would think to write. A permission read off the binding cannot be forgotten by whoever declares it.
+ * what every composed binding needs, from `BINDING_PERMISSIONS`. The adopter's own app counts as a
+ * capability, so a resource it binds brings its permission with no declaration.
  */
 function ciSystemProfile(capabilities: readonly Capability[]): TokenProfile {
   const permissions: PermissionKey[] = [...CI_SYSTEM_BASE];
+  const add = (key: PermissionKey) => {
+    if (!permissions.includes(key)) permissions.push(key);
+  };
   for (const capability of capabilities) {
-    for (const key of assertPermissionKeys(capability.ciPermissions ?? [], `Capability "${capability.name}"`)) {
-      if (!permissions.includes(key)) permissions.push(key);
-    }
+    for (const key of assertPermissionKeys(capability.ciPermissions ?? [], `Capability "${capability.name}"`)) add(key);
   }
-  const bindsQueue = capabilities.some((capability) =>
-    capability.requiredBindings.some((binding) => binding.type === "queue"),
-  );
-  if (bindsQueue && !permissions.includes("queues:write")) permissions.push("queues:write");
-  // **And `artifacts:write` where one binds Artifacts (#673)**, for the same reason: `pithy feature destroy` reaps
-  // every repo in the feature's namespace under this token, and the app that binds it declares no `ciPermissions`.
-  const bindsArtifacts = capabilities.some((capability) =>
-    capability.requiredBindings.some((binding) => binding.type === "artifacts"),
-  );
-  if (bindsArtifacts && !permissions.includes("artifacts:write")) permissions.push("artifacts:write");
+  for (const key of bindingPermissions(capabilities)) add(key);
   return {
     name: CI_SYSTEM_PROFILE,
     permissions,
@@ -214,7 +203,7 @@ export function resolveProfile(
 /**
  * Refuse a zone-scoped key anywhere a policy is being built **account-scoped**.
  *
- * A zone-level permission group handed the account resource is the quiet failure (#651): Cloudflare
+ * A zone-level permission group handed the account resource is the quiet failure: Cloudflare
  * mints the token without complaint and then answers "No access to the specified resource" at the call,
  * which is a CI failure hours later with nothing in it naming the scope. Which zones a token gets is
  * never a typed choice — it is the project's declared `domains`, resolved at mint time — so a key naming
@@ -243,17 +232,16 @@ export function permissionsForKeys(keys: PermissionKey[], accountId: string): To
  *
  * This is the second policy on the `ci-system` token, beside the account-scoped one every profile
  * builds. It exists because `pithy deploy` of an environment with a declared domain calls
- * `POST /zones/<zone>/workers/routes`, the one deploy step the CI credential could not make (#651) — and
+ * `POST /zones/<zone>/workers/routes`, which no account-scoped group reaches — and
  * it is a policy of its own rather than a permission on the profile because its resources are zones,
  * which a profile cannot name: they are resolved from the domains at mint time.
  *
  * **This limits the route, not the token.** The account policy beside it carries Workers Scripts Write,
- * which attaches a custom domain on any zone the account holds (measured, #709; `docs/TOKENS.md`). Only
+ * which attaches a custom domain on any zone the account holds (measured; `docs/TOKENS.md`). Only
  * the route calls are held to the declared zones.
  *
  * **Empty for an empty zone list, deliberately.** A project that declares no domain attaches no route,
- * so it mints exactly the token it minted before this existed. No new permission for a project that
- * needs none.
+ * so it gets no zone permission.
  */
 export function routePermissions(zoneIds: readonly string[]): TokenPermission[] {
   if (zoneIds.length === 0) return [];