@davidvornholt/standards 0.13.0 → 0.14.0

package/README.md

@@ -13,6 +13,12 @@ standards dependabot --write
 standards dev-env
 standards github --check
 standards github --apply
+standards creds login github
+standards creds login cloudflare
+standards creds add cloudflare --dest ci:ci.cloudflare_workers_token --permissions "Workers Scripts Write"
+standards creds add github --dest ci:ci.broker_app
+standards creds plan
+standards creds apply
 standards poller --config <path>
 standards poller --print-units --config <path>
 ```
@@ -29,6 +35,8 @@ standards poller --print-units --config <path>
 
 `poller` runs one tick of the fix poller: host-level automation that turns maintainer-approved GitHub issues into verified draft PRs and maintainer-approved draft PRs into completed review-fix cycles, using headless Codex runs. All workflow state lives in GitHub labels, comments, and draft PRs (the labels are canonical declared settings — see `github --apply`), so ticks are stateless, re-runnable, and safe to schedule from any host. A tick claims work by label (`fix-in-progress` / `review-in-progress`), releases claims stale for longer than `staleClaimHours`, and fails loudly — a red tick means jobs stalled, never silence. Trust is verified per event, not per configuration: the approval labels (`approved-for-fix`, `approved-for-review`) only count when the applying user holds the `admin` or `maintain` role, bind to the exact approved issue revision or PR head, and are revalidated before publication; only admin/maintain comments are treated as answers to agent questions. The poller removes its direct GitHub token variables before launching Codex, but the approved run shares the host service identity and can read its other ambient credentials and logged-in tool state; that accepted visibility must not be treated as credential isolation. The run works in a throwaway git worktree, hands results back through a structured outcome file, and the poller verifies effects (commits exist, no protected paths touched) before pushing, opening the draft PR, or posting the review — the required CI checks on the resulting PR remain the quality gate. Host mutation is declarative-only: `--print-units` emits a correctly escaped systemd service and timer for the polling host's infrastructure repository to adapt and deploy. That repository owns the service identity, writable HOME, PATH, GitHub token environment, lingering, and deployment. The service's tick budget (`TimeoutStartSec`) is derived from `maxJobsPerTick` × `runTimeoutMinutes` plus overhead, so re-render and redeploy the units after changing either value.
 
+`creds` is the credential broker: it mints scoped Cloudflare tokens, rotates and revokes those tokens, and places GitHub App credentials into SOPS-encrypted targets — secret values never touch stdout, argv, or an agent's context; commands print only metadata (token name, scopes, expiry, destination). Cloudflare reconciliation has exactly two sources of truth: the plaintext key structure of the SOPS files and the provider token list under the deterministic naming scheme `standards/<owner>/<repo>/<sops-target>/<dotted.key>`; there is no separate credential manifest. `plan` and `apply` reconcile Cloudflare only: each run uses the stored bootstrap credential to verify its current provider token ID, excludes that ID from reconciliation regardless of its current name, and aborts if the identity cannot be correlated with the complete account token list; a brokered token whose SOPS key was deleted is revoked, while one nearing expiry (30 days) is renewed by creating a fresh-expiry replacement with the live token's policy, durably writing and verifying the new value, and only then revoking the old token; secrets the broker did not mint are never touched. Without a manifest there is no desired-policy record, so live policy drift is not detected, and a repository rename or transfer changes the deterministic namespace and requires the visible old token to be re-minted under the new name and revoked. `add cloudflare` mints an account-owned API token (default TTL 90 days) scoped to the named permission groups (`permissions` lists the valid names) and writes it to `--dest <target>:<dotted.key>`, where `<target>` resolves like the canonical `just secrets` targets (`ci` → `secrets/ci.yaml`, `prod-1` → `infra/hosts/prod-1/secrets.yaml`); zone-scoped groups such as DNS Write are rejected because the current command supplies an account resource, not a zone resource. `add github` writes the broker GitHub App's `app_id` and `private_key` under the destination key; durable GitHub tokens cannot be created via API (PAT and OAuth-app creation are UI-only), so workflows mint short-lived installation tokens from the App at runtime (`actions/create-github-app-token`), scoped per repository and permission. Bootstrap is once per machine: `login github` runs the App manifest flow (a localhost page posts the pre-filled manifest; one "Create GitHub App" click; credentials return through the conversion endpoint — nothing is copied by hand) and opens the installation page, where the App must be bound to selected repositories rather than all repositories; `login cloudflare` guides the one dashboard paste Cloudflare requires for the first account token (named `standards-broker` to match the App, created from the "Create additional tokens" token template because its "Account API Tokens: Edit" permission is unavailable in the custom token builder, and holding that permission only), verifies that it is active, correlates its verified ID with the complete account token list and an active list record, and stores it; a bootstrap token named inside the minted `standards/` namespace is rejected before storage to keep its role unambiguous, while any other divergence from the recommended name only warns. `plan` and `apply` do not rotate GitHub App keys; create a replacement key on the App's settings page, atomically replace `github.private_key` in the protected machine-global broker store while preserving its `0600` mode, then update every intended SOPS destination, verify workflows can mint installation tokens, and revoke the old key manually. Root credentials live in the machine-global broker store (see Configuration); SOPS writes go through `sops edit` with a non-interactive editor, preserving comments and reusing the file's data key.
+
 `structure --profile source` validates the standards source repository itself, which is deliberately not a consumer. The profile pins its intentional exceptions so they cannot drift silently: exact, ordered root gate scripts that run this CLI from the local checkout (`structure --profile source`, `dependabot --check` or `dependabot --write`, `github --check`, and the Turbo gate) instead of a recursive `standards check`, and a non-private published bin-only CLI workspace that carries a stable release SemVer and exactly maps the `standards` bin to `src/cli.ts` without `exports`. Every other consumer rule still applies.
 
 ## Configuration
@@ -36,7 +44,8 @@ standards poller --print-units --config <path>
 - **`.github/dependabot.local.yml`** (optional) — repo-owned Dependabot extension composed with the canonical `.github/dependabot.base.yml` into the generated `.github/dependabot.yml`. May define `updates` and top-level `registries`; a block matching a canonical normalized target may only add `ignore` and/or `registries` entries. Other matching-block policy is rejected deliberately. A missing or comments-only file means no additions. CLI 0.10.1 requires the selected content ref to contain the canonical base and rejects older refs before mutation.
 - **`sync-standards.local.json`** (optional) — consumer-owned sync policy at the repo root, validated by `doctor`/`check` and every `init`/`sync` even when an explicit ref or local source makes its `"ref"` irrelevant. All fields optional; a missing file means the defaults. `"ref"` is a non-empty single-line string that pins a tag, branch, or full commit sha to sync from instead of `main` (an explicit `--ref` overrides it; a local-path `--from` source is used as-is and ignores only the validated pin). `"autoSync": false` is read by the standards-sync workflow, not the CLI, and skips the weekly scheduled run; deliberate syncs then run locally because the secret-bearing workflow is schedule-only. Version 0.7.0 removes the legacy `STANDARDS_AUTO_SYNC` and `STANDARDS_SYNC_REF` variable behavior; consumers must upgrade the package and lockfile before adopting a policy file.
 - **`.github/settings.local.json` `"rulesetEnforcement": "unavailable-on-plan"`** (optional) — declares that the repository's GitHub plan cannot enforce rulesets (private repositories on GitHub Free, both personal accounts and organizations). `github --check` and `--apply` then skip rulesets instead of comparing them, because a comparison cannot be trusted there: personal accounts answer ruleset reads with HTTP 403, and free-plan organizations report declared rulesets as active while silently not enforcing them. Plan-gated repository settings that only function alongside branch protection (`allow_auto_merge`) are skipped for the same reason — GitHub accepts a PATCH for them with HTTP 200 and silently keeps the old value. The remaining repository merge settings are still checked and converged, and both commands print an unprotected-branch notice on every run. The only accepted value is `"unavailable-on-plan"` (enforcement is the default; omit the key on paid plans), and combining the opt-out with additional local rulesets is rejected. After upgrading the plan, remove the declaration and run `bun standards github --apply` to restore enforcement.
-- **Poller config file** (required for `poller`, passed via `--config`) — host-level JSON, deliberately not repository state. Required: `"repos"` (unique `owner/repo` strings — one poller watches any number of repositories), `"model"` and `"reasoningEffort"` (passed to `codex exec`; the model choice is deliberate and has no default). Optional: `"maxJobsPerTick"` (default 1 — the concurrency and rate-limit guard; subscription-authenticated Codex runs share the interactive rate window), `"staleClaimHours"` (default 6; must exceed `runTimeoutMinutes` so a sweep can never release the claim of a job that is still running), `"runTimeoutMinutes"` (default 240 — the timeout catches wedged agents, not honest multi-hour review runs), `"cacheDir"` (default `~/.cache/standards-poller`; holds bare mirrors and job worktrees; relative paths resolve against the config file), `"extraCodexArgs"` (extra `codex exec` arguments, e.g. enabling the collaboration feature for subagent fan-out). Unknown keys are rejected. The poller needs `git`, `codex` (authenticated — its rotating auth state must live in a writable location), and a GitHub token per the bullet below; the token needs issues, pull-requests, and contents write on the watched repos, and nothing else.
+- **Poller config file** (required for `poller`, passed via `--config`) — host-level JSON, deliberately not repository state. Required: `"repos"` (1–12 unique `owner/repo` strings), `"model"` and `"reasoningEffort"` (passed to `codex exec`; the model choice is deliberate and has no default). The 12-repository maximum keeps the one-minute idle tick's baseline GitHub reads within a 5,000-request/hour API budget while retaining headroom for pagination, active jobs, writes, and other token users. Existing configs above the limit must be reduced or split across pollers with independent GitHub API budgets before upgrading. Optional: `"maxJobsPerTick"` (default 1 — the concurrency and rate-limit guard; subscription-authenticated Codex runs share the interactive rate window), `"staleClaimHours"` (default 6; must exceed `runTimeoutMinutes` so a sweep can never release the claim of a job that is still running), `"runTimeoutMinutes"` (default 240 — the timeout catches wedged agents, not honest multi-hour review runs), `"cacheDir"` (default `~/.cache/standards-poller`; holds bare mirrors and job worktrees; relative paths resolve against the config file), `"extraCodexArgs"` (extra `codex exec` arguments, e.g. enabling the collaboration feature for subagent fan-out). Unknown keys are rejected. The poller needs `git`, `codex` (authenticated — its rotating auth state must live in a writable location), and a GitHub token per the bullet below; the token needs issues, pull-requests, and contents write on the watched repos, and nothing else.
+- **Broker store** (created by `creds login`) — machine-global root credentials at `$XDG_CONFIG_HOME/standards/broker.yaml` (default `~/.config/standards/broker.yaml`; override with `STANDARDS_BROKER_FILE`), holding the GitHub App identity (id, slug, client id, private key) and one bootstrap token per Cloudflare account. The file is plaintext with `0600` permissions — deliberately the same local-account trust boundary as the plaintext personal age identity at `~/.config/sops/age/keys.txt`, which unlocks the same secrets; SOPS-encrypting the store to that adjacent identity would not improve custody. Writes use an owner-only temporary file and atomic replacement, and simultaneous provider logins merge rather than overwrite each other; `creds status` warns when the final mode is broader. The store lives outside every repository, is never synced or backed up, and losing it is cheap: re-run the two login commands and revoke the old App key and bootstrap token. On an additional machine, do not create a second App: generate an additional private key from the existing App's settings page (GitHub Apps support several active keys; key generation has no API) and add it to that machine's store, so retiring a machine revokes one key, not the setup.
 - **`GH_TOKEN` / `GITHUB_TOKEN`** (optional) — GitHub API token for the `github` command and the GitHub portion of `check`. When neither is set, the token from the local `gh` CLI is used; with no token at all, reads still work on public repositories. `--apply` needs an admin token. GitHub's REST API reveals repo merge settings only to write-capable viewers — `check` retries REST-hidden keys over GraphQL, which serves them to read-only tokens — ruleset `bypass_actors` requires repository Administration read, and private-repository labels require Issues read (or Pull requests read); a token that still cannot see declared state fails the check rather than passing unverified. In CI, the canonical workflow decrypts `ci.github_settings_read_token` from the SOPS-encrypted `secrets/ci.yaml`: a repository-scoped fine-grained PAT with read-only "Administration" and "Issues" access.
 
 See the standards repository README for the ownership model and adoption workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -20,6 +20,30 @@
     "LICENSE",
     "README.md",
     "src/cli.ts",
+    "src/creds-add.ts",
+    "src/creds-add-cloudflare-commit.ts",
+    "src/creds-add-github.ts",
+    "src/creds-browser.ts",
+    "src/creds-cloudflare-account.ts",
+    "src/creds-cloudflare.ts",
+    "src/creds-cloudflare-api.ts",
+    "src/creds-cloudflare-condition.ts",
+    "src/creds-cloudflare-pagination.ts",
+    "src/creds-commands.ts",
+    "src/creds-dest.ts",
+    "src/creds-login-cloudflare.ts",
+    "src/creds-login-github.ts",
+    "src/creds-login-github-manifest.ts",
+    "src/creds-naming.ts",
+    "src/creds-plan.ts",
+    "src/creds-plan-run.ts",
+    "src/creds-plan-revoke.ts",
+    "src/creds-prompt.ts",
+    "src/creds-sops.ts",
+    "src/creds-sops-editor.ts",
+    "src/creds-sops-structure.ts",
+    "src/creds-store.ts",
+    "src/creds-store-lock.ts",
     "src/dependabot-compose-input.ts",
     "src/dependabot-compose.ts",
     "src/dependabot-inspect.ts",
@@ -77,6 +101,7 @@
     "src/poller-trust.ts",
     "src/poller-units.ts",
     "src/poller-workspace.ts",
+    "src/sops-exec.ts",
     "src/structure-check.ts",
     "src/structure-profile.ts",
     "src/structure-script.ts",
@@ -93,6 +118,7 @@
   "devDependencies": {
     "@davidvornholt/typescript-config": "0.0.0",
     "@types/bun": "^1.3.14",
+    "sigstore": "5.0.0",
     "typescript": "7.0.2"
   },
   "engines": {

package/src/cli.ts

@@ -17,6 +17,7 @@ import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, posix, resolve } from 'node:path';
 import process from 'node:process';
+import { runCredsCommand } from './creds-commands';
 import {
   composeDependabot,
   DEPENDABOT_BASE_FILE,
@@ -740,6 +741,7 @@ Commands:
   dependabot  Verify (--check) or regenerate (--write) the composed .github/dependabot.yml
   dev-env     Write each workspace's generated .env.local from the SOPS-encrypted secrets/dev.yaml
   github      Compare (--check) or converge (--apply) live GitHub settings
+  creds       Mint, rotate, and revoke brokered credentials (see \`standards creds help\`)
   poller      Run one fix-poller tick over the configured repositories (host automation)
   help        Show this help
 
@@ -1142,6 +1144,15 @@ const runGateCommand = (
 };
 
 const main = async (): Promise<void> => {
+  // The creds family owns its flag vocabulary; route it before the strict
+  // global parser rejects those flags.
+  const rawArgs = process.argv.slice(2);
+  if (rawArgs[0] === 'creds') {
+    if (!(await runCredsCommand(rawArgs.slice(1)))) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   const {
     command,
     consumer,

package/src/creds-add-cloudflare-commit.ts

@@ -0,0 +1,46 @@
+import { deleteAccountToken } from './creds-cloudflare';
+import { type SopsWriteResult, verifySopsStoredValue } from './creds-sops';
+
+export const commitCreatedCloudflareToken = async (input: {
+  readonly consumer: string;
+  readonly rel: string;
+  readonly key: string;
+  readonly value: string;
+  readonly written: SopsWriteResult;
+  readonly accountId: string;
+  readonly bootstrapToken: string;
+  readonly tokenId: string;
+  readonly name: string;
+}): Promise<
+  { readonly ok: true } | { readonly ok: false; readonly problem: string }
+> => {
+  const stored = verifySopsStoredValue(
+    input.consumer,
+    input.rel,
+    input.key,
+    input.value,
+  );
+  if (stored.ok && stored.matches) {
+    return { ok: true };
+  }
+  if (!stored.ok) {
+    return {
+      ok: false,
+      problem: `token ${input.name} was created as ${input.accountId}/${input.tokenId}, but ${input.written.ok ? stored.problem : `${input.written.problem}; ${stored.problem}`}; the token remains active because its stored state is unverifiable`,
+    };
+  }
+  const problem = input.written.ok
+    ? 'the stored SOPS value does not match the replacement'
+    : input.written.problem;
+  const cleanup = await deleteAccountToken(
+    input.accountId,
+    input.bootstrapToken,
+    input.tokenId,
+  );
+  return {
+    ok: false,
+    problem: cleanup.ok
+      ? `token ${input.name} was created, but ${problem}; deleted replacement token ${input.tokenId}`
+      : `token ${input.name} was created, but ${problem}; cleanup of token ${input.tokenId} also failed: ${cleanup.problem}`,
+  };
+};

package/src/creds-add-github.ts

@@ -0,0 +1,66 @@
+// `standards creds add github`: place the broker GitHub App's credentials
+// into a SOPS target. Durable GitHub tokens cannot be minted via API (PAT
+// and OAuth-app creation are UI-only), so the durable secret is the App
+// identity itself; workflows mint short-lived installation tokens from it at
+// runtime, scoped per repository and permission.
+
+import { resolveContext } from './creds-dest';
+import {
+  inspectSopsScalarDestination,
+  setSopsValues,
+  verifySopsScalarLeaf,
+} from './creds-sops';
+
+export const runCredsAddGithub = async (
+  consumer: string,
+  options: { readonly dest: string | undefined },
+): Promise<boolean> => {
+  const context = await resolveContext(consumer, options.dest);
+  if (context === null) {
+    return false;
+  }
+  if (context.store.github === null) {
+    console.error(
+      'standards creds: no broker GitHub App configured; run `standards creds login github`',
+    );
+    return false;
+  }
+  const { appId, privateKey, slug } = context.store.github;
+  const appIdPath = `${context.dest.key}.app_id`;
+  const privateKeyPath = `${context.dest.key}.private_key`;
+  const preflight = await Promise.all(
+    [appIdPath, privateKeyPath].map((path) =>
+      inspectSopsScalarDestination(consumer, context.rel, path),
+    ),
+  );
+  const blocked = preflight.find((result) => !result.ok);
+  if (blocked !== undefined && !blocked.ok) {
+    console.error(`standards creds: ${blocked.problem}`);
+    return false;
+  }
+  const written = setSopsValues(consumer, context.rel, [
+    { path: appIdPath, value: String(appId) },
+    { path: privateKeyPath, value: privateKey },
+  ]);
+  if (!written.ok) {
+    console.error(`standards creds: ${written.problem}`);
+    return false;
+  }
+  const verified = await Promise.all(
+    [appIdPath, privateKeyPath].map((path) =>
+      verifySopsScalarLeaf(consumer, context.rel, path),
+    ),
+  );
+  const failedVerification = verified.find((result) => !result.ok);
+  if (failedVerification !== undefined && !failedVerification.ok) {
+    console.error(`standards creds: ${failedVerification.problem}`);
+    return false;
+  }
+  console.log(
+    `standards creds: wrote App ${slug} credentials to ${context.rel} at ${context.dest.key}.{app_id,private_key}`,
+  );
+  console.log(
+    '  workflows mint short-lived installation tokens from these at runtime (actions/create-github-app-token), scoped per repository and permission',
+  );
+  return true;
+};

package/src/creds-add.ts

@@ -0,0 +1,183 @@
+import { commitCreatedCloudflareToken } from './creds-add-cloudflare-commit';
+import {
+  createAccountToken,
+  listAccountTokens,
+  listPermissionGroups,
+} from './creds-cloudflare';
+import type { PermissionGroup } from './creds-cloudflare-api';
+import { resolveContext, selectAccount } from './creds-dest';
+import { tokenNameOf } from './creds-naming';
+import { inspectSopsScalarDestination, setSopsValue } from './creds-sops';
+
+const DEFAULT_TTL_DAYS = 90;
+const DAY_MS = 86_400_000;
+const ACCOUNT_SCOPE = 'com.cloudflare.api.account';
+
+export const unsupportedAccountScopes = (
+  groups: ReadonlyArray<PermissionGroup>,
+): ReadonlyArray<string> =>
+  groups
+    .filter((group) => !group.scopes.includes(ACCOUNT_SCOPE))
+    .map((group) => group.name);
+
+const resolveWantedGroups = (
+  names: ReadonlyArray<string>,
+  available: ReadonlyArray<PermissionGroup>,
+): {
+  readonly selected: ReadonlyArray<PermissionGroup>;
+  readonly unknown: ReadonlyArray<string>;
+} => {
+  const resolved = names.map((name) => ({
+    name,
+    group: available.find(
+      (group) => group.name.toLowerCase() === name.toLowerCase(),
+    ),
+  }));
+  return {
+    selected: resolved.flatMap(({ group }) =>
+      group === undefined ? [] : [group],
+    ),
+    unknown: resolved.flatMap(({ name, group }) =>
+      group === undefined ? [name] : [],
+    ),
+  };
+};
+
+const printSuccess = (
+  name: string,
+  permissions: ReadonlyArray<string>,
+  expiresOn: string,
+  destination: string,
+): void => {
+  console.log(`standards creds: minted Cloudflare token ${name}`);
+  console.log(`  permissions: ${permissions.join(', ')}`);
+  console.log(`  expires: ${expiresOn} (rotate via \`standards creds apply\`)`);
+  console.log(`  value written to ${destination}`);
+};
+
+export const runCredsAddCloudflare = async (
+  consumer: string,
+  options: {
+    readonly dest: string | undefined;
+    readonly permissions: string | undefined;
+    readonly account: string | undefined;
+    readonly ttlDays: number | undefined;
+  },
+): Promise<boolean> => {
+  const context = await resolveContext(consumer, options.dest);
+  if (context === null) {
+    return false;
+  }
+  if (options.permissions === undefined || options.permissions.length === 0) {
+    console.error(
+      'standards creds: --permissions "<Group Name>[,<Group Name>...]" is required; list names with `standards creds permissions`',
+    );
+    return false;
+  }
+  const account = selectAccount(context.store, options.account);
+  if (account === null) {
+    return false;
+  }
+  const destination = await inspectSopsScalarDestination(
+    consumer,
+    context.rel,
+    context.dest.key,
+  );
+  if (!destination.ok) {
+    console.error(`standards creds: ${destination.problem}`);
+    return false;
+  }
+  const groups = await listPermissionGroups(account.accountId, account.token);
+  if (!groups.ok) {
+    console.error(`standards creds: ${groups.problem}`);
+    return false;
+  }
+  const wanted = options.permissions
+    .split(',')
+    .map((groupName) => groupName.trim());
+  const { selected, unknown } = resolveWantedGroups(wanted, groups.value);
+  if (unknown.length > 0) {
+    console.error(
+      `standards creds: unknown permission group(s): ${unknown.join(', ')}; list names with \`standards creds permissions\``,
+    );
+    return false;
+  }
+  const unsupported = unsupportedAccountScopes(selected);
+  if (unsupported.length > 0) {
+    console.error(
+      `standards creds: permission group(s) ${unsupported.join(', ')} cannot target an account resource; choose account-scoped groups (zone-scoped groups require an explicit zone resource, which this command does not yet support)`,
+    );
+    return false;
+  }
+  const name = tokenNameOf({ ...context.dest, repo: context.repo });
+  const listings = await Promise.all(
+    context.store.cloudflare.map(async (configured) => ({
+      accountId: configured.accountId,
+      listed: await listAccountTokens(configured.accountId, configured.token),
+    })),
+  );
+  const failedListing = listings.find(({ listed }) => !listed.ok);
+  if (failedListing?.listed.ok === false) {
+    console.error(
+      `standards creds: account ${failedListing.accountId}: ${failedListing.listed.problem}; cannot prove the destination is unambiguous`,
+    );
+    return false;
+  }
+  const collisions = listings.flatMap(({ accountId, listed }) =>
+    listed.ok && listed.value.some((token) => token.name === name)
+      ? [accountId]
+      : [],
+  );
+  if (collisions.length > 0) {
+    console.error(
+      `standards creds: token ${name} already exists in Cloudflare account(s) ${collisions.join(', ')}; one SOPS destination may be managed by only one account`,
+    );
+    return false;
+  }
+  const ttlDays = options.ttlDays ?? DEFAULT_TTL_DAYS;
+  const expiresOn = new Date(Date.now() + ttlDays * DAY_MS).toISOString();
+  const created = await createAccountToken(account.accountId, account.token, {
+    name,
+    expiresOn,
+    condition: null,
+    policies: [
+      {
+        effect: 'allow',
+        resources: { [`com.cloudflare.api.account.${account.accountId}`]: '*' },
+        permission_groups: selected.map(({ id }) => ({ id })),
+      },
+    ],
+  });
+  if (!created.ok) {
+    console.error(`standards creds: ${created.problem}`);
+    return false;
+  }
+  const written = setSopsValue(
+    consumer,
+    context.rel,
+    context.dest.key,
+    created.value.value,
+  );
+  const committed = await commitCreatedCloudflareToken({
+    consumer,
+    rel: context.rel,
+    key: context.dest.key,
+    value: created.value.value,
+    written,
+    accountId: account.accountId,
+    bootstrapToken: account.token,
+    tokenId: created.value.id,
+    name,
+  });
+  if (!committed.ok) {
+    console.error(`standards creds: ${committed.problem}`);
+    return false;
+  }
+  printSuccess(
+    name,
+    wanted,
+    expiresOn,
+    `${context.rel} at ${context.dest.key}`,
+  );
+  return true;
+};

package/src/creds-browser.ts

@@ -0,0 +1,28 @@
+// Best-effort browser opener for login flows. The URL is always printed too,
+// so a failure to spawn an opener is never an error.
+
+import { spawn } from 'node:child_process';
+import process from 'node:process';
+
+const openerFor = (platform: string): 'open' | 'start' | 'xdg-open' => {
+  if (platform === 'darwin') {
+    return 'open';
+  }
+  if (platform === 'win32') {
+    return 'start';
+  }
+  return 'xdg-open';
+};
+
+export const openInBrowser = (url: string): void => {
+  try {
+    const child = spawn(openerFor(process.platform), [url], {
+      stdio: 'ignore',
+      detached: true,
+    });
+    child.on('error', () => undefined);
+    child.unref();
+  } catch {
+    // Printed URL remains the fallback.
+  }
+};

package/src/creds-cloudflare-account.ts

@@ -0,0 +1,4 @@
+const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/u;
+
+export const isCloudflareAccountId = (value: unknown): value is string =>
+  typeof value === 'string' && ACCOUNT_ID_PATTERN.test(value);

package/src/creds-cloudflare-api.ts

@@ -0,0 +1,200 @@
+// Cloudflare v4 API plumbing shared by the account-token operations in
+// creds-cloudflare.ts: envelope parsing, error folding, and shared types.
+
+import {
+  type DecodedTokenCondition,
+  decodeTokenCondition,
+} from './creds-cloudflare-condition';
+import { isRecord } from './github-settings-parse';
+
+const API_ROOT = 'https://api.cloudflare.com/client/v4';
+
+export type CfResult<T> =
+  | { readonly ok: true; readonly value: T }
+  | { readonly ok: false; readonly problem: string };
+
+export type CloudflareToken = {
+  readonly id: string;
+  readonly name: string;
+  readonly status: string;
+  readonly expiresOn: string | null;
+  readonly issuedOn: string | null;
+  readonly policies: ReadonlyArray<TokenPolicy> | null;
+  readonly condition: DecodedTokenCondition;
+};
+
+export type PermissionGroup = {
+  readonly id: string;
+  readonly name: string;
+  readonly scopes: ReadonlyArray<string>;
+};
+
+export type TokenPolicy = {
+  readonly effect: 'allow' | 'deny';
+  readonly resources: Readonly<
+    Record<string, string | Readonly<Record<string, string>>>
+  >;
+  readonly permission_groups: ReadonlyArray<{ readonly id: string }>;
+};
+
+export type ResultInfo = {
+  readonly page: number;
+  readonly perPage: number;
+  readonly count: number;
+  readonly totalCount: number;
+};
+
+export type Envelope = {
+  readonly success: boolean;
+  readonly errors: ReadonlyArray<{ readonly message: string }>;
+  readonly result: unknown;
+  readonly resultInfo: ResultInfo | null;
+};
+
+export const cfRequest = async (
+  token: string,
+  method: string,
+  path: string,
+  body?: unknown,
+): Promise<CfResult<Envelope>> => {
+  const response = await fetch(`${API_ROOT}${path}`, {
+    method,
+    headers: {
+      authorization: `Bearer ${token}`,
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  let parsed: unknown = null;
+  try {
+    parsed = (await response.json()) as unknown;
+  } catch {
+    return {
+      ok: false,
+      problem: `${method} ${path}: HTTP ${response.status} with a non-JSON body`,
+    };
+  }
+  if (!isRecord(parsed)) {
+    return { ok: false, problem: `${method} ${path}: unexpected response` };
+  }
+  const errors = Array.isArray(parsed.errors)
+    ? parsed.errors.filter(isRecord).map((error) => ({
+        message:
+          typeof error.message === 'string' ? error.message : 'unknown error',
+      }))
+    : [];
+  const info = isRecord(parsed.result_info) ? parsed.result_info : {};
+  const resultInfo =
+    typeof info.page === 'number' &&
+    Number.isInteger(info.page) &&
+    info.page >= 1 &&
+    typeof info.per_page === 'number' &&
+    Number.isInteger(info.per_page) &&
+    info.per_page >= 1 &&
+    typeof info.count === 'number' &&
+    Number.isInteger(info.count) &&
+    info.count >= 0 &&
+    typeof info.total_count === 'number' &&
+    Number.isInteger(info.total_count) &&
+    info.total_count >= 0
+      ? {
+          page: info.page,
+          perPage: info.per_page,
+          count: info.count,
+          totalCount: info.total_count,
+        }
+      : null;
+  const envelope: Envelope = {
+    success: parsed.success === true,
+    errors,
+    result: parsed.result,
+    resultInfo,
+  };
+  if (!envelope.success) {
+    const detail =
+      errors.length > 0
+        ? errors.map((error) => error.message).join('; ')
+        : `HTTP ${response.status}`;
+    return { ok: false, problem: `${method} ${path}: ${detail}` };
+  }
+  return { ok: true, value: envelope };
+};
+
+const stringRecordOf = (
+  raw: unknown,
+): Readonly<Record<string, string>> | null => {
+  if (!isRecord(raw)) {
+    return null;
+  }
+  return Object.values(raw).every((value) => typeof value === 'string')
+    ? (raw as Readonly<Record<string, string>>)
+    : null;
+};
+
+const resourcesOf = (raw: unknown): TokenPolicy['resources'] | null => {
+  if (!isRecord(raw)) {
+    return null;
+  }
+  const resources: Record<string, string | Readonly<Record<string, string>>> =
+    {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === 'string') {
+      resources[key] = value;
+    } else {
+      const nested = stringRecordOf(value);
+      if (nested === null) {
+        return null;
+      }
+      resources[key] = nested;
+    }
+  }
+  return resources;
+};
+
+const policyOf = (raw: unknown): TokenPolicy | null => {
+  if (
+    !(
+      isRecord(raw) &&
+      (raw.effect === 'allow' || raw.effect === 'deny') &&
+      Array.isArray(raw.permission_groups)
+    )
+  ) {
+    return null;
+  }
+  const resources = resourcesOf(raw.resources);
+  const permissionGroups = raw.permission_groups
+    .filter(isRecord)
+    .filter((group) => typeof group.id === 'string')
+    .map((group) => ({ id: group.id as string }));
+  return resources !== null &&
+    permissionGroups.length === raw.permission_groups.length
+    ? {
+        effect: raw.effect,
+        resources,
+        permission_groups: permissionGroups,
+      }
+    : null;
+};
+
+const policiesOf = (raw: unknown): ReadonlyArray<TokenPolicy> | null => {
+  if (!Array.isArray(raw)) {
+    return null;
+  }
+  const policies = raw.map(policyOf);
+  return policies.every((policy) => policy !== null)
+    ? (policies as ReadonlyArray<TokenPolicy>)
+    : null;
+};
+
+export const tokenOf = (raw: unknown): CloudflareToken | null =>
+  isRecord(raw) && typeof raw.id === 'string' && typeof raw.name === 'string'
+    ? {
+        id: raw.id,
+        name: raw.name,
+        status: typeof raw.status === 'string' ? raw.status : 'unknown',
+        expiresOn: typeof raw.expires_on === 'string' ? raw.expires_on : null,
+        issuedOn: typeof raw.issued_on === 'string' ? raw.issued_on : null,
+        policies: policiesOf(raw.policies),
+        condition: decodeTokenCondition(raw.condition),
+      }
+    : null;