Add Artifacts

pithy add artifacts

Artifacts requires no other capability. Nothing to resolve first, so there is no --with-prerequisites to pass.

Add auth too, if it is not already there. A repository belongs to a signed-in person or their organization, so without auth every route denies. Add organization to let an organization own repositories, and audit to record who did what to them.

What lands in your repo

apps/<worker>/pithy.config.ts gains the registration. Every option has a working default, so the block is usable as written.

artifacts({
  basePath: "/artifacts",
  tokenTtlSeconds: 900,
  acceptRepoName: false,
}),

The one worth reading before you change it is tokenTtlSeconds. It is how long a person keeps pushing after you remove their grant. Leave it short. A git client re-mints per operation, so a short life costs nothing.

With organization composed, name the power that manages an organization’s repositories. The kit reserves no name for it. You name it, the way you name administrativePower, declare it in your role catalog, and give it to a role.

artifacts({ managePower: "repos:manage" }),

The Worker refuses to boot without one, and refuses one your catalog does not declare, naming it.

apps/<worker>/wrangler.jsonc gains two bindings.

The artifacts entry names a namespace, and Pithy names it for you: { "binding": "ARTIFACTS", "namespace": "<project>-dev" } at the top level. pithy provision writes each other environment’s own, <project>-<env>, into its stanza. A feature’s is <project>-f<issue>-<slug>--artifacts, so a branch’s repositories never sit beside production’s.

There is nothing to create. Cloudflare makes a namespace the first time a repository is created in it. With no project name resolved there is no namespace to name, and the entry is skipped with the reason rather than half-written.

What runs

add runs that Worker’s dev migrations, creating four tables:

pithy_artifacts_repos · pithy_artifacts_grants · pithy_artifacts_tokens · pithy_artifacts_revocations

The first is ownership: one row per repository, keyed on its physical name. The second is access: one grant per person per repository. The third is the kit’s record of every token it mints and who it was minted for, never the token itself. The fourth holds each management client’s spent revocation keys, so a retried revoke answers the same and changes nothing.

The config options

repoName is the seam beside them, for your own naming convention. Pass a function of the owner and the display name, and it returns the physical name. Then uniqueness is yours.

Nothing to provision

There is no pithy artifacts provision, because there is no resource to stand up. pithy provision writes each environment’s namespace into its stanza, and that is all an environment needs.

Teardown is the part with work in it. pithy feature destroy deletes every repository in a feature’s namespace, then the namespace, because a repository costs storage and nothing else removes it. That runs under ci-system, which gains Artifacts Write wherever anything binds artifacts. Apply it to a token that already exists with pithy token rotate ci-system. The Worker itself reaches its repositories through the binding, so runtime gains nothing.

Check your plan

Artifacts is Workers Paid only. On a Free plan the binding composes, the Worker deploys, and the first create is refused at runtime, in production. Cloudflare bills it from 14 October 2026. Plan, prices and limits has the numbers.

Check it worked

pithy doctor reports the ARTIFACTS binding under the Worker’s health, like any required binding. A stanza that lacks it is named, because the Worker refuses to boot without it.