A scoped, least-privilege Cloudflare API token (this is mint-service-tokens.ts). params.permissionGroups is the
permission-group id list; params.resources defaults to the whole account. The token VALUE is returned only at
creation, so it rides out as the token binding on provision (the framework's noop on re-apply never re-mints).
deprovision revokes it. The minting parent credential is the broker's own CloudflareClient.
A scoped, least-privilege Cloudflare API token (this is
mint-service-tokens.ts).params.permissionGroupsis the permission-group id list;params.resourcesdefaults to the whole account. The token VALUE is returned only at creation, so it rides out as thetokenbinding on provision (the framework's noop on re-apply never re-mints). deprovision revokes it. The minting parent credential is the broker's ownCloudflareClient.