@davidvornholt/standards 0.14.0 → 0.15.0

package/README.md

@@ -16,6 +16,8 @@ standards github --apply
 standards creds login github
 standards creds login cloudflare
 standards creds add cloudflare --dest ci:ci.cloudflare_workers_token --permissions "Workers Scripts Write"
+standards creds add cloudflare --dest ci:ci.r2_read --bucket assets --s3 --permissions "Workers R2 Storage Bucket Item Read"
+standards creds add cloudflare --dest ci:ci.eu_r2_read --bucket eu-assets --jurisdiction eu --s3 --permissions "Workers R2 Storage Bucket Item Read"
 standards creds add github --dest ci:ci.broker_app
 standards creds plan
 standards creds apply
@@ -33,9 +35,9 @@ standards poller --print-units --config <path>
 
 `structure` enforces the canonical monorepo structure contract: workspace scripts (`check-types`, `lint`, `lint:fix`, `test`), root gate scripts, filtered Turbo convenience aliases, internal `0.0.0`/`workspace:*` versioning, package `exports`, shared tsconfig inheritance, and browser a11y wiring. Only a workspace containing an explicit `*.a11y.ts` suite must provide a `test:a11y` script and direct `@axe-core/playwright` and `@playwright/test` dependencies. `check` includes `structure`, so these rules gate every consumer PR.
 
-`poller` runs one tick of the fix poller: host-level automation that turns maintainer-approved GitHub issues into verified draft PRs and maintainer-approved draft PRs into completed review-fix cycles, using headless Codex runs. All workflow state lives in GitHub labels, comments, and draft PRs (the labels are canonical declared settings — see `github --apply`), so ticks are stateless, re-runnable, and safe to schedule from any host. A tick claims work by label (`fix-in-progress` / `review-in-progress`), releases claims stale for longer than `staleClaimHours`, and fails loudly — a red tick means jobs stalled, never silence. Trust is verified per event, not per configuration: the approval labels (`approved-for-fix`, `approved-for-review`) only count when the applying user holds the `admin` or `maintain` role, bind to the exact approved issue revision or PR head, and are revalidated before publication; only admin/maintain comments are treated as answers to agent questions. The poller removes its direct GitHub token variables before launching Codex, but the approved run shares the host service identity and can read its other ambient credentials and logged-in tool state; that accepted visibility must not be treated as credential isolation. The run works in a throwaway git worktree, hands results back through a structured outcome file, and the poller verifies effects (commits exist, no protected paths touched) before pushing, opening the draft PR, or posting the review — the required CI checks on the resulting PR remain the quality gate. Host mutation is declarative-only: `--print-units` emits a correctly escaped systemd service and timer for the polling host's infrastructure repository to adapt and deploy. That repository owns the service identity, writable HOME, PATH, GitHub token environment, lingering, and deployment. The service's tick budget (`TimeoutStartSec`) is derived from `maxJobsPerTick` × `runTimeoutMinutes` plus overhead, so re-render and redeploy the units after changing either value.
+`poller` runs one tick of the fix poller: host-level automation that turns maintainer-approved GitHub issues into verified draft PRs and maintainer-approved draft PRs into completed review-fix cycles, using headless Codex runs. All workflow state lives in GitHub labels, comments, and draft PRs (the labels are canonical declared settings — see `github --apply`), so ticks are stateless, re-runnable, and safe to schedule from any host. A tick claims work by label (`fix-in-progress` / `review-in-progress`), releases claims stale for longer than `staleClaimHours`, and fails loudly — a red tick means jobs stalled, never silence. Trust is verified per event, not per configuration: the approval labels (`approved-for-fix`, `approved-for-review`) only count when the applying user holds the `admin` or `maintain` role, bind to the exact approved issue revision or PR head, and are revalidated before publication; only admin/maintain comments are treated as answers to agent questions. The poller removes its direct GitHub token variables before launching Codex, but the approved run shares the host service identity and can read its other ambient credentials and logged-in tool state; that accepted visibility must not be treated as credential isolation. The run works in a throwaway git worktree, grants Codex write access to that worktree and its exact Git common directory so commits can update the linked repository metadata, hands results back through a structured outcome file, and then verifies effects (commits exist, no protected paths touched) before pushing, opening the draft PR, or posting the review — the required CI checks on the resulting PR remain the quality gate. Host mutation is declarative-only: `--print-units` emits a correctly escaped systemd service and timer for the polling host's infrastructure repository to adapt and deploy. That repository owns the service identity, writable HOME, PATH, GitHub token environment, lingering, and deployment. The service's tick budget (`TimeoutStartSec`) is derived from `maxJobsPerTick` × `runTimeoutMinutes` plus overhead, so re-render and redeploy the units after changing either value.
 
-`creds` is the credential broker: it mints scoped Cloudflare tokens, rotates and revokes those tokens, and places GitHub App credentials into SOPS-encrypted targets — secret values never touch stdout, argv, or an agent's context; commands print only metadata (token name, scopes, expiry, destination). Cloudflare reconciliation has exactly two sources of truth: the plaintext key structure of the SOPS files and the provider token list under the deterministic naming scheme `standards/<owner>/<repo>/<sops-target>/<dotted.key>`; there is no separate credential manifest. `plan` and `apply` reconcile Cloudflare only: each run uses the stored bootstrap credential to verify its current provider token ID, excludes that ID from reconciliation regardless of its current name, and aborts if the identity cannot be correlated with the complete account token list; a brokered token whose SOPS key was deleted is revoked, while one nearing expiry (30 days) is renewed by creating a fresh-expiry replacement with the live token's policy, durably writing and verifying the new value, and only then revoking the old token; secrets the broker did not mint are never touched. Without a manifest there is no desired-policy record, so live policy drift is not detected, and a repository rename or transfer changes the deterministic namespace and requires the visible old token to be re-minted under the new name and revoked. `add cloudflare` mints an account-owned API token (default TTL 90 days) scoped to the named permission groups (`permissions` lists the valid names) and writes it to `--dest <target>:<dotted.key>`, where `<target>` resolves like the canonical `just secrets` targets (`ci` → `secrets/ci.yaml`, `prod-1` → `infra/hosts/prod-1/secrets.yaml`); zone-scoped groups such as DNS Write are rejected because the current command supplies an account resource, not a zone resource. `add github` writes the broker GitHub App's `app_id` and `private_key` under the destination key; durable GitHub tokens cannot be created via API (PAT and OAuth-app creation are UI-only), so workflows mint short-lived installation tokens from the App at runtime (`actions/create-github-app-token`), scoped per repository and permission. Bootstrap is once per machine: `login github` runs the App manifest flow (a localhost page posts the pre-filled manifest; one "Create GitHub App" click; credentials return through the conversion endpoint — nothing is copied by hand) and opens the installation page, where the App must be bound to selected repositories rather than all repositories; `login cloudflare` guides the one dashboard paste Cloudflare requires for the first account token (named `standards-broker` to match the App, created from the "Create additional tokens" token template because its "Account API Tokens: Edit" permission is unavailable in the custom token builder, and holding that permission only), verifies that it is active, correlates its verified ID with the complete account token list and an active list record, and stores it; a bootstrap token named inside the minted `standards/` namespace is rejected before storage to keep its role unambiguous, while any other divergence from the recommended name only warns. `plan` and `apply` do not rotate GitHub App keys; create a replacement key on the App's settings page, atomically replace `github.private_key` in the protected machine-global broker store while preserving its `0600` mode, then update every intended SOPS destination, verify workflows can mint installation tokens, and revoke the old key manually. Root credentials live in the machine-global broker store (see Configuration); SOPS writes go through `sops edit` with a non-interactive editor, preserving comments and reusing the file's data key.
+`creds` is the credential broker: it mints scoped Cloudflare tokens, rotates and revokes those tokens, and places GitHub App credentials into SOPS-encrypted targets — secret values never touch stdout, argv, or an agent's context; commands print only metadata (token name, scopes, expiry, destination). Cloudflare reconciliation has exactly two sources of truth: the plaintext key structure of the SOPS files and the provider token list under the deterministic naming scheme `standards/<owner>/<repo>/<sops-target>/<dotted.key>`; there is no separate credential manifest. `plan` and `apply` reconcile Cloudflare only: each run uses the stored bootstrap credential to verify its current provider token ID, excludes that ID from reconciliation regardless of its current name, and aborts if the identity cannot be correlated with the complete account token list; a brokered token whose SOPS key was deleted is revoked, while one nearing expiry (30 days) is renewed by creating a fresh-expiry replacement with the live token's policy, durably writing and verifying the new value, and only then revoking the old token; secrets the broker did not mint are never touched. Without a manifest there is no desired-policy record, so live policy drift is not detected, and a repository rename or transfer changes the deterministic namespace and requires the visible old token to be re-minted under the new name and revoked. `add cloudflare` mints an account-owned API token (default TTL 90 days) scoped to the named permission groups (`permissions` lists the valid names) and writes it to `--dest <target>:<dotted.key>`, where `<target>` resolves like the canonical `just secrets` targets (`ci` → `secrets/ci.yaml`, `prod-1` → `infra/hosts/prod-1/secrets.yaml`); zone-scoped groups such as DNS Write are rejected because the current command supplies an account resource, not a zone resource. `--bucket <name>` switches the policy resource to a single R2 bucket; `--jurisdiction default|eu` selects the provider jurisdiction and defaults to `default`, producing `com.cloudflare.edge.r2.bucket.<account_id>_default_<bucket>` or `com.cloudflare.edge.r2.bucket.<account_id>_eu_<bucket>`. FedRAMP jurisdictions are not supported. Bucket destinations accept only bucket-scoped groups such as Workers R2 Storage Bucket Item Read/Write, and account-scoped groups are rejected. `--s3` requires `--bucket` and stores the S3-compatible credential pair Cloudflare derives from an API token — access key ID is the token ID, secret access key is the SHA-256 hex digest of the token value — as `<dotted.key>.access_key_id` and `<dotted.key>.secret_access_key` under the destination instead of the raw token value; the default endpoint is `https://<account_id>.r2.cloudflarestorage.com`, while EU uses `https://<account_id>.eu.r2.cloudflarestorage.com`. Reconciliation infers each destination's concrete write footprint from the plaintext SOPS key structure — a bearer owns the leaf at its key, while an S3 token owns both pair leaves — and aborts before mutation when managed footprints intersect. `plan` and `apply` renew and revoke S3 destinations like any other brokered token, but renewal first proves the stored access key ID matches the current provider token; an incomplete pair, unreadable value, or identity mismatch is surfaced as a finding and never mutated automatically. `add github` writes the broker GitHub App's `app_id` and `private_key` under the destination key; durable GitHub tokens cannot be created via API (PAT and OAuth-app creation are UI-only), so workflows mint short-lived installation tokens from the App at runtime (`actions/create-github-app-token`), scoped per repository and permission. The canonical weekly sync expects `bun standards creds add github --dest ci:ci.broker_app`, then mints a current-repository token with Contents read and Pull requests write; missing credentials or minting failures stop it without a fallback. Bootstrap is once per machine: `login github` runs the App manifest flow (a localhost page posts the pre-filled manifest; one "Create GitHub App" click; credentials return through the conversion endpoint — nothing is copied by hand) and opens the installation page, where the App must be bound to selected repositories rather than all repositories; `login cloudflare` guides the one dashboard paste Cloudflare requires for the first account token (named `standards-broker` to match the App, created from the "Create additional tokens" token template because its "Account API Tokens: Edit" permission is unavailable in the custom token builder, and holding that permission only), verifies that it is active, correlates its verified ID with the complete account token list and an active list record, and stores it; a bootstrap token named inside the minted `standards/` namespace is rejected before storage to keep its role unambiguous, while any other divergence from the recommended name only warns. `plan` and `apply` do not rotate GitHub App keys; create a replacement key on the App's settings page, atomically replace `github.private_key` in the protected machine-global broker store while preserving its `0600` mode, then update every intended SOPS destination, verify workflows can mint installation tokens, and revoke the old key manually. Root credentials live in the machine-global broker store (see Configuration); SOPS writes go through `sops edit` with a non-interactive editor, preserving comments and reusing the file's data key.
 
 `structure --profile source` validates the standards source repository itself, which is deliberately not a consumer. The profile pins its intentional exceptions so they cannot drift silently: exact, ordered root gate scripts that run this CLI from the local checkout (`structure --profile source`, `dependabot --check` or `dependabot --write`, `github --check`, and the Turbo gate) instead of a recursive `standards check`, and a non-private published bin-only CLI workspace that carries a stable release SemVer and exactly maps the `standards` bin to `src/cli.ts` without `exports`. Every other consumer rule still applies.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -21,8 +21,10 @@
     "README.md",
     "src/cli.ts",
     "src/creds-add.ts",
+    "src/creds-add-collision.ts",
     "src/creds-add-cloudflare-commit.ts",
     "src/creds-add-github.ts",
+    "src/creds-add-policy.ts",
     "src/creds-browser.ts",
     "src/creds-cloudflare-account.ts",
     "src/creds-cloudflare.ts",
@@ -30,15 +32,20 @@
     "src/creds-cloudflare-condition.ts",
     "src/creds-cloudflare-pagination.ts",
     "src/creds-commands.ts",
+    "src/creds-args.ts",
     "src/creds-dest.ts",
     "src/creds-login-cloudflare.ts",
     "src/creds-login-github.ts",
     "src/creds-login-github-manifest.ts",
     "src/creds-naming.ts",
     "src/creds-plan.ts",
+    "src/creds-plan-groups.ts",
+    "src/creds-plan-renew.ts",
     "src/creds-plan-run.ts",
     "src/creds-plan-revoke.ts",
+    "src/creds-plan-types.ts",
     "src/creds-prompt.ts",
+    "src/creds-r2.ts",
     "src/creds-sops.ts",
     "src/creds-sops-editor.ts",
     "src/creds-sops-structure.ts",

package/src/creds-add-cloudflare-commit.ts

@@ -1,11 +1,14 @@
 import { deleteAccountToken } from './creds-cloudflare';
-import { type SopsWriteResult, verifySopsStoredValue } from './creds-sops';
+import {
+  type SopsValueChange,
+  type SopsWriteResult,
+  verifySopsStoredValue,
+} from './creds-sops';
 
 export const commitCreatedCloudflareToken = async (input: {
   readonly consumer: string;
   readonly rel: string;
-  readonly key: string;
-  readonly value: string;
+  readonly writes: ReadonlyArray<SopsValueChange>;
   readonly written: SopsWriteResult;
   readonly accountId: string;
   readonly bootstrapToken: string;
@@ -14,23 +17,33 @@ export const commitCreatedCloudflareToken = async (input: {
 }): Promise<
   { readonly ok: true } | { readonly ok: false; readonly problem: string }
 > => {
-  const stored = verifySopsStoredValue(
-    input.consumer,
-    input.rel,
-    input.key,
-    input.value,
-  );
-  if (stored.ok && stored.matches) {
+  const stored = input.writes.map((write) => ({
+    path: write.path,
+    result: verifySopsStoredValue(
+      input.consumer,
+      input.rel,
+      write.path,
+      write.value,
+    ),
+  }));
+  if (stored.every(({ result }) => result.ok && result.matches)) {
     return { ok: true };
   }
-  if (!stored.ok) {
+  const unverifiable = stored.flatMap(({ result }) =>
+    result.ok ? [] : [result.problem],
+  );
+  if (unverifiable.length > 0) {
+    const detail = unverifiable.join('; ');
     return {
       ok: false,
-      problem: `token ${input.name} was created as ${input.accountId}/${input.tokenId}, but ${input.written.ok ? stored.problem : `${input.written.problem}; ${stored.problem}`}; the token remains active because its stored state is unverifiable`,
+      problem: `token ${input.name} was created as ${input.accountId}/${input.tokenId}, but ${input.written.ok ? detail : `${input.written.problem}; ${detail}`}; the token remains active because its stored state is unverifiable`,
     };
   }
+  const mismatched = stored.flatMap(({ path, result }) =>
+    result.ok && !result.matches ? [path] : [],
+  );
   const problem = input.written.ok
-    ? 'the stored SOPS value does not match the replacement'
+    ? `the stored SOPS value at ${mismatched.join(', ')} does not match the replacement`
     : input.written.problem;
   const cleanup = await deleteAccountToken(
     input.accountId,

package/src/creds-add-collision.ts

@@ -0,0 +1,46 @@
+import { listAccountTokens } from './creds-cloudflare';
+import type { ResolvedContext } from './creds-dest';
+import { parseTokenName } from './creds-naming';
+import {
+  type DestinationFormat,
+  destinationFootprint,
+  destinationFootprintsIntersect,
+  inferredDestinationFootprint,
+} from './creds-r2';
+
+export const findManagedDestinationCollision = async (
+  context: ResolvedContext,
+  format: DestinationFormat,
+  keys: ReadonlySet<string>,
+): Promise<string | null> => {
+  const listings = await Promise.all(
+    context.store.cloudflare.map(async (configured) => ({
+      accountId: configured.accountId,
+      listed: await listAccountTokens(configured.accountId, configured.token),
+    })),
+  );
+  const failed = listings.find(({ listed }) => !listed.ok);
+  if (failed?.listed.ok === false) {
+    return `account ${failed.accountId}: ${failed.listed.problem}; cannot prove the destination is unambiguous`;
+  }
+  const wanted = destinationFootprint(format, context.dest.key);
+  const collisions = listings.flatMap(({ accountId, listed }) =>
+    listed.ok
+      ? listed.value.flatMap((token) => {
+          const ref = parseTokenName(token.name, context.repo);
+          return ref !== null &&
+            ref.target === context.dest.target &&
+            (ref.key === context.dest.key ||
+              destinationFootprintsIntersect(
+                wanted,
+                inferredDestinationFootprint(keys, ref.key),
+              ))
+            ? [`${accountId}/${token.id} (${ref.key})`]
+            : [];
+        })
+      : [],
+  );
+  return collisions.length === 0
+    ? null
+    : `managed Cloudflare token already exists at ${collisions.join(', ')} and conflicts with ${context.dest.target}:${context.dest.key} by exact identity or destination footprint; one SOPS destination may be managed by only one account`;
+};

package/src/creds-add-policy.ts

@@ -0,0 +1,118 @@
+// Permission-group and token-policy resolution for `standards creds add
+// cloudflare`. The scope gates are cheap preconditions mirroring provider
+// ground truth: a policy resource only accepts permission groups whose
+// reported scopes include it, so incompatible selections fail here with the
+// group names instead of failing at token creation.
+
+import { listPermissionGroups } from './creds-cloudflare';
+import type { PermissionGroup, TokenPolicy } from './creds-cloudflare-api';
+import {
+  DEFAULT_R2_JURISDICTION,
+  isR2BucketName,
+  R2_BUCKET_SCOPE,
+  type R2Jurisdiction,
+  r2BucketResource,
+} from './creds-r2';
+import type { CloudflareBrokerAccount } from './creds-store';
+
+const ACCOUNT_SCOPE = 'com.cloudflare.api.account';
+
+export const unsupportedResourceScopes = (
+  groups: ReadonlyArray<PermissionGroup>,
+  scope: string,
+): ReadonlyArray<string> =>
+  groups
+    .filter((group) => !group.scopes.includes(scope))
+    .map((group) => group.name);
+
+const scopeProblem = (
+  bucket: string | undefined,
+  selected: ReadonlyArray<PermissionGroup>,
+): string | null => {
+  const scope = bucket === undefined ? ACCOUNT_SCOPE : R2_BUCKET_SCOPE;
+  const unsupported = unsupportedResourceScopes(selected, scope);
+  if (unsupported.length === 0) {
+    return null;
+  }
+  return bucket === undefined
+    ? `permission group(s) ${unsupported.join(', ')} cannot target an account resource; choose account-scoped groups (zone-scoped groups require an explicit zone resource, which this command does not yet support, and R2 bucket-item groups require --bucket)`
+    : `permission group(s) ${unsupported.join(', ')} cannot target an R2 bucket resource; --bucket accepts only bucket-scoped groups such as Workers R2 Storage Bucket Item Read/Write`;
+};
+
+export type ResolvedTokenPolicy =
+  | {
+      readonly ok: true;
+      readonly policy: TokenPolicy;
+      readonly wanted: ReadonlyArray<string>;
+    }
+  | { readonly ok: false; readonly problem: string };
+
+export const resolveTokenPolicy = async (
+  account: CloudflareBrokerAccount,
+  options: {
+    readonly permissions: string | undefined;
+    readonly bucket: string | undefined;
+    readonly jurisdiction?: R2Jurisdiction;
+  },
+): Promise<ResolvedTokenPolicy> => {
+  if (options.permissions === undefined || options.permissions.length === 0) {
+    return {
+      ok: false,
+      problem:
+        '--permissions "<Group Name>[,<Group Name>...]" is required; list names with `standards creds permissions`',
+    };
+  }
+  if (options.bucket !== undefined && !isR2BucketName(options.bucket)) {
+    return {
+      ok: false,
+      problem: `invalid R2 bucket name: ${options.bucket} (3-63 lowercase letters, digits, and hyphens)`,
+    };
+  }
+  const groups = await listPermissionGroups(account.accountId, account.token);
+  if (!groups.ok) {
+    return { ok: false, problem: groups.problem };
+  }
+  const wanted = options.permissions
+    .split(',')
+    .map((groupName) => groupName.trim());
+  const resolved = wanted.map((name) => ({
+    name,
+    group: groups.value.find(
+      (group) => group.name.toLowerCase() === name.toLowerCase(),
+    ),
+  }));
+  const unknown = resolved.flatMap(({ name, group }) =>
+    group === undefined ? [name] : [],
+  );
+  if (unknown.length > 0) {
+    return {
+      ok: false,
+      problem: `unknown permission group(s): ${unknown.join(', ')}; list names with \`standards creds permissions\``,
+    };
+  }
+  const selected = resolved.flatMap(({ group }) =>
+    group === undefined ? [] : [group],
+  );
+  const problem = scopeProblem(options.bucket, selected);
+  if (problem !== null) {
+    return { ok: false, problem };
+  }
+  const resource =
+    options.bucket === undefined
+      ? `${ACCOUNT_SCOPE}.${account.accountId}`
+      : r2BucketResource(
+          account.accountId,
+          options.bucket,
+          options.jurisdiction ?? DEFAULT_R2_JURISDICTION,
+        );
+  return {
+    ok: true,
+    wanted,
+    policy: {
+      effect: 'allow',
+      resources: { [resource]: '*' },
+      // biome-ignore lint/style/useNamingConvention: Cloudflare's policy wire field is snake_case.
+      permission_groups: selected.map(({ id }) => ({ id })),
+    },
+  };
+};

package/src/creds-add.ts

@@ -1,58 +1,60 @@
 import { commitCreatedCloudflareToken } from './creds-add-cloudflare-commit';
-import {
-  createAccountToken,
-  listAccountTokens,
-  listPermissionGroups,
-} from './creds-cloudflare';
-import type { PermissionGroup } from './creds-cloudflare-api';
+import { findManagedDestinationCollision } from './creds-add-collision';
+import { resolveTokenPolicy } from './creds-add-policy';
+import { createAccountToken } from './creds-cloudflare';
 import { resolveContext, selectAccount } from './creds-dest';
 import { tokenNameOf } from './creds-naming';
-import { inspectSopsScalarDestination, setSopsValue } from './creds-sops';
+import {
+  DEFAULT_R2_JURISDICTION,
+  type DestinationFormat,
+  destinationWrites,
+  type R2Jurisdiction,
+  s3Endpoint,
+  s3PairPaths,
+} from './creds-r2';
+import {
+  inspectSopsScalarDestination,
+  readEncryptedKeys,
+  setSopsValues,
+} from './creds-sops';
 
 const DEFAULT_TTL_DAYS = 90;
 const DAY_MS = 86_400_000;
-const ACCOUNT_SCOPE = 'com.cloudflare.api.account';
 
-export const unsupportedAccountScopes = (
-  groups: ReadonlyArray<PermissionGroup>,
-): ReadonlyArray<string> =>
-  groups
-    .filter((group) => !group.scopes.includes(ACCOUNT_SCOPE))
-    .map((group) => group.name);
-
-const resolveWantedGroups = (
-  names: ReadonlyArray<string>,
-  available: ReadonlyArray<PermissionGroup>,
-): {
-  readonly selected: ReadonlyArray<PermissionGroup>;
-  readonly unknown: ReadonlyArray<string>;
-} => {
-  const resolved = names.map((name) => ({
-    name,
-    group: available.find(
-      (group) => group.name.toLowerCase() === name.toLowerCase(),
-    ),
-  }));
-  return {
-    selected: resolved.flatMap(({ group }) =>
-      group === undefined ? [] : [group],
-    ),
-    unknown: resolved.flatMap(({ name, group }) =>
-      group === undefined ? [name] : [],
-    ),
-  };
+const printSuccess = (input: {
+  readonly name: string;
+  readonly permissions: ReadonlyArray<string>;
+  readonly expiresOn: string;
+  readonly destination: string;
+  readonly format: DestinationFormat;
+  readonly accountId: string;
+  readonly jurisdiction: R2Jurisdiction;
+}): void => {
+  console.log(`standards creds: minted Cloudflare token ${input.name}`);
+  console.log(`  permissions: ${input.permissions.join(', ')}`);
+  console.log(
+    `  expires: ${input.expiresOn} (rotate via \`standards creds apply\`)`,
+  );
+  console.log(
+    `  ${input.format === 's3' ? 'derived S3 credential pair' : 'value'} written to ${input.destination}`,
+  );
+  if (input.format === 's3') {
+    console.log(
+      `  S3 endpoint: ${s3Endpoint(input.accountId, input.jurisdiction)}`,
+    );
+  }
 };
 
-const printSuccess = (
-  name: string,
-  permissions: ReadonlyArray<string>,
-  expiresOn: string,
-  destination: string,
-): void => {
-  console.log(`standards creds: minted Cloudflare token ${name}`);
-  console.log(`  permissions: ${permissions.join(', ')}`);
-  console.log(`  expires: ${expiresOn} (rotate via \`standards creds apply\`)`);
-  console.log(`  value written to ${destination}`);
+const inspectDestinations = async (
+  consumer: string,
+  rel: string,
+  paths: ReadonlyArray<string>,
+): Promise<string | null> => {
+  const inspected = await Promise.all(
+    paths.map((path) => inspectSopsScalarDestination(consumer, rel, path)),
+  );
+  const blocked = inspected.find((result) => !result.ok);
+  return blocked !== undefined && !blocked.ok ? blocked.problem : null;
 };
 
 export const runCredsAddCloudflare = async (
@@ -62,76 +64,56 @@ export const runCredsAddCloudflare = async (
     readonly permissions: string | undefined;
     readonly account: string | undefined;
     readonly ttlDays: number | undefined;
+    readonly bucket: string | undefined;
+    readonly jurisdiction?: R2Jurisdiction;
+    readonly s3: boolean;
   },
 ): Promise<boolean> => {
-  const context = await resolveContext(consumer, options.dest);
-  if (context === null) {
-    return false;
-  }
-  if (options.permissions === undefined || options.permissions.length === 0) {
+  if (options.s3 && options.bucket === undefined) {
     console.error(
-      'standards creds: --permissions "<Group Name>[,<Group Name>...]" is required; list names with `standards creds permissions`',
+      'standards creds: --s3 requires --bucket so the credential is backed by a bucket-scoped R2 policy',
     );
     return false;
   }
+  const context = await resolveContext(consumer, options.dest);
+  if (context === null) {
+    return false;
+  }
   const account = selectAccount(context.store, options.account);
   if (account === null) {
     return false;
   }
-  const destination = await inspectSopsScalarDestination(
+  const format: DestinationFormat = options.s3 ? 's3' : 'bearer';
+  const paths =
+    format === 's3' ? s3PairPaths(context.dest.key) : [context.dest.key];
+  const destinationProblem = await inspectDestinations(
     consumer,
     context.rel,
-    context.dest.key,
+    paths,
   );
-  if (!destination.ok) {
-    console.error(`standards creds: ${destination.problem}`);
-    return false;
-  }
-  const groups = await listPermissionGroups(account.accountId, account.token);
-  if (!groups.ok) {
-    console.error(`standards creds: ${groups.problem}`);
+  if (destinationProblem !== null) {
+    console.error(`standards creds: ${destinationProblem}`);
     return false;
   }
-  const wanted = options.permissions
-    .split(',')
-    .map((groupName) => groupName.trim());
-  const { selected, unknown } = resolveWantedGroups(wanted, groups.value);
-  if (unknown.length > 0) {
-    console.error(
-      `standards creds: unknown permission group(s): ${unknown.join(', ')}; list names with \`standards creds permissions\``,
-    );
+  const encryptedKeys = await readEncryptedKeys(consumer, context.rel);
+  if (!encryptedKeys.ok) {
+    console.error(`standards creds: ${encryptedKeys.problem}`);
     return false;
   }
-  const unsupported = unsupportedAccountScopes(selected);
-  if (unsupported.length > 0) {
-    console.error(
-      `standards creds: permission group(s) ${unsupported.join(', ')} cannot target an account resource; choose account-scoped groups (zone-scoped groups require an explicit zone resource, which this command does not yet support)`,
-    );
+  const keys = new Set(encryptedKeys.keys);
+  const resolved = await resolveTokenPolicy(account, options);
+  if (!resolved.ok) {
+    console.error(`standards creds: ${resolved.problem}`);
     return false;
   }
   const name = tokenNameOf({ ...context.dest, repo: context.repo });
-  const listings = await Promise.all(
-    context.store.cloudflare.map(async (configured) => ({
-      accountId: configured.accountId,
-      listed: await listAccountTokens(configured.accountId, configured.token),
-    })),
+  const collisionProblem = await findManagedDestinationCollision(
+    context,
+    format,
+    keys,
   );
-  const failedListing = listings.find(({ listed }) => !listed.ok);
-  if (failedListing?.listed.ok === false) {
-    console.error(
-      `standards creds: account ${failedListing.accountId}: ${failedListing.listed.problem}; cannot prove the destination is unambiguous`,
-    );
-    return false;
-  }
-  const collisions = listings.flatMap(({ accountId, listed }) =>
-    listed.ok && listed.value.some((token) => token.name === name)
-      ? [accountId]
-      : [],
-  );
-  if (collisions.length > 0) {
-    console.error(
-      `standards creds: token ${name} already exists in Cloudflare account(s) ${collisions.join(', ')}; one SOPS destination may be managed by only one account`,
-    );
+  if (collisionProblem !== null) {
+    console.error(`standards creds: ${collisionProblem}`);
     return false;
   }
   const ttlDays = options.ttlDays ?? DEFAULT_TTL_DAYS;
@@ -140,29 +122,23 @@ export const runCredsAddCloudflare = async (
     name,
     expiresOn,
     condition: null,
-    policies: [
-      {
-        effect: 'allow',
-        resources: { [`com.cloudflare.api.account.${account.accountId}`]: '*' },
-        permission_groups: selected.map(({ id }) => ({ id })),
-      },
-    ],
+    policies: [resolved.policy],
   });
   if (!created.ok) {
     console.error(`standards creds: ${created.problem}`);
     return false;
   }
-  const written = setSopsValue(
-    consumer,
-    context.rel,
+  const writes = destinationWrites(
+    format,
     context.dest.key,
+    created.value.id,
     created.value.value,
   );
+  const written = setSopsValues(consumer, context.rel, writes);
   const committed = await commitCreatedCloudflareToken({
     consumer,
     rel: context.rel,
-    key: context.dest.key,
-    value: created.value.value,
+    writes,
     written,
     accountId: account.accountId,
     bootstrapToken: account.token,
@@ -173,11 +149,14 @@ export const runCredsAddCloudflare = async (
     console.error(`standards creds: ${committed.problem}`);
     return false;
   }
-  printSuccess(
+  printSuccess({
     name,
-    wanted,
+    permissions: resolved.wanted,
     expiresOn,
-    `${context.rel} at ${context.dest.key}`,
-  );
+    destination: `${context.rel} at ${context.dest.key}`,
+    format,
+    accountId: account.accountId,
+    jurisdiction: options.jurisdiction ?? DEFAULT_R2_JURISDICTION,
+  });
   return true;
 };