@davidvornholt/standards 0.20.0 → 0.21.0

package/README.md

@@ -22,13 +22,14 @@ standards creds add cloudflare --dest ci:ci.eu_r2_read --bucket eu-assets --juri
 standards creds add github --dest ci:ci.broker_app
 standards creds plan
 standards creds apply
+standards creds revoke --token-id <token-id>
 standards poller --config <path>
 standards poller --print-units --config <path>
 ```
 
 `dependabot --write` regenerates the composed `.github/dependabot.yml` from the canonical `.github/dependabot.base.yml` and the optional repo-owned `.github/dependabot.local.yml`; `init` and `sync` do the same automatically. `dependabot --check` verifies the generated file still matches its sources, and `doctor`/`check` include the same verification. The overlay is deliberately lean and additive only: new update blocks for repo-specific ecosystems, top-level private registry definitions, and `ignore` or `registries` entries appended by repeating a canonical block's normalized target. Matching blocks cannot add labels, groups, cooldowns, pull-request limits, or other policy. Update blocks for the same ecosystem and target branch must not select intersecting directories after Dependabot's path normalization. A plural `directories` target is expanded as a glob when it contains `*`, `?`, or both `[` and `]`: `*` and bare `**` stay within one path segment, `**/` matches zero or more directory segments, `?` matches one non-separator character, and bracket expressions match character sets or ranges. Singular `directory` values are always literal.
 
-`dev-env` decrypts the SOPS-encrypted `secrets/dev.yaml` — keyed by workspace group and a one-segment kebab-case workspace name (`apps.<name>`, `packages.<name>`), each mapping portable environment variable names to string values — and transactionally writes every declared workspace's `.env.local` with owner-only permissions and a do-not-edit header. Its Bun-specific dotenv codec exactly round-trips every value it accepts without adding helper environment variables; a value the codec cannot encode exactly is gathered as a validation problem instead of being changed silently. Validation gathers all document, containment, destination-type, workspace, and gitignore problems before writing anything. Generation then stages every output in its destination directory and rolls the whole set back if staging or commit fails, preserving prior contents, modes, and absent files; symlink destinations, duplicate resolved destinations, changed parent-directory identities, and symlinked workspace paths are rejected without following the link. Cleanup trouble after a completed commit is reported loudly as a warning rather than falsely reporting generation failure. Parent identities are checked immediately before each path operation; an unavoidable swap in the syscall-sized interval after a check remains outside the non-hostile maintainer threat model. The canonical `justfile` exposes the command as `just dev-env-generate`, and `just dev-refresh` chains a `just secrets edit dev` session into regeneration.
+`dev-env` composes each workspace's dev environment from three layers sharing one shape — keyed by workspace group and a one-segment kebab-case workspace name (`apps.<name>`, `packages.<name>`), each mapping portable environment variable names to string values: the tracked plain `config/dev.yaml`, the SOPS-encrypted `secrets/dev.yaml` (required, decrypted via sops), and the gitignored plain `config/dev.local.yaml`, applied in that order with later layers overriding per key. A key declared in both tracked shared layers is a validation problem — a value is either configuration or a secret — while a local override of either is the file's purpose. Plain layers are optional and may be comment-only; `config/dev.local.yaml` must itself be gitignored because it may override secret values. The command transactionally writes every declared workspace's `.env.local` with owner-only permissions and a do-not-edit header naming the contributing sources. It also discovers direct `apps/*` and `packages/*` directories containing `package.json` and removes a stale `.env.local` only when its first line is that exact header; hand-owned files, edited headers, nested directories, and symlinked paths are left untouched. Writes and removals commit or roll back as one transaction, preserving prior contents, modes, and absent files. The final files and the transaction's actual random `.env.local.standards-*.tmp` and `.env.local.standards-*.bak` paths must all be gitignored before staging starts. Existing consumers must add those two artifact patterns themselves because `.gitignore` is seeded only during `init`; `sync` does not change it. Its Bun-specific dotenv codec exactly round-trips every value it accepts without adding helper environment variables; a value the codec cannot encode exactly is gathered as a validation problem instead of being changed silently. Validation gathers all document, containment, destination-type, workspace, and gitignore problems before writing anything; symlink destinations, duplicate resolved destinations, changed parent-directory identities, and symlinked workspace paths are rejected without following the link. Cleanup trouble after a completed commit is reported loudly as a warning rather than falsely reporting generation failure. Parent identities are checked immediately before each path operation; an unavoidable swap in the syscall-sized interval after a check remains outside the non-hostile maintainer threat model. The canonical `justfile` exposes the command as `just dev-env-generate`, and `just dev-refresh` chains a `just secrets edit dev` session into regeneration.
 
 `check` also rejects the raw token formed by `biome-` + `ignore` anywhere in lock-listed canonical files. The intentionally blunt policy keeps synced sources compatible with consumer Biome configurations without invoking Biome or maintaining language-aware comment parsing.
 
@@ -38,7 +39,7 @@ standards poller --print-units --config <path>
 
 `poller` runs one tick of the fix poller: host-level automation that turns maintainer-approved GitHub issues into verified draft PRs and maintainer-approved draft PRs into completed review-fix cycles, using headless Codex runs. All workflow state lives in GitHub labels, comments, and draft PRs (the labels are canonical declared settings — see `github --apply`), so ticks are stateless, re-runnable, and safe to schedule from any host. A tick claims work by label (`fix-in-progress` / `review-in-progress`), releases claims stale for longer than `staleClaimHours`, and fails loudly — a red tick means jobs stalled, never silence. A separate acknowledgement tick validates pending approvals and posts one deduplicated queued message per approval generation; it never claims or starts work, so it can keep giving maintainers prompt feedback while the worker is occupied. When a worker claims a request, it posts a concise start message. The exact approval and distributed claim records remain in hidden comment metadata, and losing claim contenders remove their duplicate comments. Trust is verified per event, not per configuration: the approval labels (`approved-for-fix`, `approved-for-review`) only count when the applying user holds the `admin` or `maintain` role, bind to the exact approved issue revision or PR head, and are revalidated before publication; only admin/maintain comments are treated as answers to agent questions. Approved Codex runs inherit the poller's GitHub token and use authenticated `gh` for relevant reads and comments; review runs also maintain the PR review ledger, apply authorized title or body edits, post fix threads, and file deferred findings directly. The run works in a throwaway git worktree, grants Codex write access to that worktree and its exact Git common directory so commits can update the linked repository metadata, and hands results back through a structured outcome file. The poller then verifies the approved head, commits, and protected paths before pushing or publishing; it replies to and resolves agent-posted fix threads only after the reviewed head is pushed, and it alone changes protocol labels, posts the final report, and flips a reviewed draft ready, while required CI remains the quality gate. If publishing a sealed fix or review result fails, the poller releases only its owned in-progress claim and keeps the approval and sealed output, so the next worker tick retries publication without another Codex run. Sealed review plans from the earlier protocol are rejected and their output branches are ignored, so the review reruns on a fresh protocol-versioned branch rather than silently dropping legacy deferred work. Host mutation is declarative-only: `--print-units` emits four correctly escaped systemd units for the polling host's infrastructure repository to adapt and deploy: the worker service and timer plus an independent lightweight acknowledgement service and timer. That repository owns the service identity, writable HOME, PATH, authenticated `gh`, lingering, and deployment. The worker service's tick budget (`TimeoutStartSec`) is derived from `maxJobsPerTick` × `runTimeoutMinutes` plus overhead, so re-render and redeploy the units after changing either value.
 
-`creds` is the credential broker: it mints scoped Cloudflare tokens, rotates and revokes those tokens, and places GitHub App credentials into SOPS-encrypted targets — secret values never touch stdout, argv, or an agent's context; commands print only metadata (token name, scopes, expiry, destination). Cloudflare reconciliation has exactly two sources of truth: the plaintext key structure of the SOPS files and the provider token list under the deterministic naming scheme `standards/<owner>/<repo>/<sops-target>/<dotted.key>`; there is no separate credential manifest. `plan` and `apply` reconcile Cloudflare only: each run uses the stored bootstrap credential to verify its current provider token ID, excludes that ID from reconciliation regardless of its current name, and aborts if the identity cannot be correlated with the complete account token list; a brokered token whose SOPS key was deleted is revoked, while one nearing expiry (30 days) is renewed by creating a fresh-expiry replacement with the live token's policies, durably writing and verifying the new value, and only then revoking the old token; secrets the broker did not mint are never touched. Without a manifest there is no desired-policy record, so live policy drift is not detected, and a repository rename or transfer changes the deterministic namespace and requires the visible old token to be re-minted under the new name and revoked. `add cloudflare` mints an account-owned API token (default TTL 90 days) scoped to the named permission groups (`permissions` lists the valid names) and writes it to `--dest <target>:<dotted.key>`, where `<target>` resolves like the canonical `just secrets` targets (`ci` → `secrets/ci.yaml`, `prod-1` → `infra/hosts/prod-1/secrets.yaml`). `--zone <zone-id>[,<zone-id>...]` adds a zone resource so zone-scoped groups such as DNS Write can be minted. Zones are named by their 32-character hexadecimal ID, shown on the zone's dashboard overview and not a secret; resolving a domain name instead would need Zone Read on the bootstrap token, which holds Account API Tokens / Edit and nothing else. With zones named, the selection is split by what each group can target: every group Cloudflare reports as zone-scoped forms one policy holding all named zones, and groups that can only target an account keep their own account policy on the same token, so one credential can hold DNS access next to account-wide access. A group Cloudflare reports as both takes the zone policy, which is the narrower reading of `--zone`. A group matching neither resource is named and rejected, `--zone` requires at least one zone-scoped group, and `--zone` cannot be combined with `--bucket`, which is a separate credential. The mint summary prints the resources the token reaches, so an account policy alongside the zones is visible rather than implied. `--bucket <name>` switches the policy resource to a single R2 bucket; `--jurisdiction default|eu` selects the provider jurisdiction and defaults to `default`, producing `com.cloudflare.edge.r2.bucket.<account_id>_default_<bucket>` or `com.cloudflare.edge.r2.bucket.<account_id>_eu_<bucket>`. FedRAMP jurisdictions are not supported. Bucket destinations accept only bucket-scoped groups such as Workers R2 Storage Bucket Item Read/Write, and account-scoped groups are rejected. `--s3` requires `--bucket` and stores the S3-compatible credential pair Cloudflare derives from an API token — access key ID is the token ID, secret access key is the SHA-256 hex digest of the token value — as `<dotted.key>.access_key_id` and `<dotted.key>.secret_access_key` under the destination instead of the raw token value; the default endpoint is `https://<account_id>.r2.cloudflarestorage.com`, while EU uses `https://<account_id>.eu.r2.cloudflarestorage.com`. Reconciliation infers each destination's concrete write footprint from the plaintext SOPS key structure — a bearer owns the leaf at its key, while an S3 token owns both pair leaves — and aborts before mutation when managed footprints intersect. `plan` and `apply` renew and revoke S3 destinations like any other brokered token, but renewal first proves the stored access key ID matches the current provider token; an incomplete pair, unreadable value, or identity mismatch is surfaced as a finding and never mutated automatically. `add github` selects the private broker App whose owner matches the destination repository's origin owner, checks both local SOPS leaves before authenticating, proves that the exact selected App is installed on that repository, and writes only while that full App identity still holds the synchronized broker-store entry; missing, duplicate, replaced, or mismatched owners fail before SOPS changes. Durable GitHub tokens cannot be created via API (PAT and OAuth-app creation are UI-only), so workflows mint short-lived installation tokens from the App at runtime (`actions/create-github-app-token`), scoped per repository and permission. The canonical weekly sync expects `bun standards creds add github --dest ci:ci.broker_app`, then mints a current-repository token with Contents read and Pull requests write; missing credentials or minting failures stop it without a fallback. Bootstrap is once per machine and per GitHub owner: `login github` creates a private personal App, while `login github --org <org>` creates or replaces only that organization's entry; each manifest conversion records GitHub's authoritative owner, and the command opens the installation page, where the App must be bound to selected repositories rather than all repositories. GitHub App names are globally unique and limited to 34 characters, so organization defaults include owners up to 17 characters; a longer owner or a colliding replacement name requires an explicit shorter unused `--name`. The first GitHub-specific command against an existing singleton broker store authenticates as that App, resolves its registration owner, and atomically migrates the old mapping to that one owner; a failed lookup leaves the persisted bytes untouched. If the singleton was a public App installed on repositories owned by other users or organizations, those repositories stop matching after migration because owner selection no longer treats that App as shared. For each affected owner, run `login github` while signed in as that personal owner or `login github --org <owner>`, install the new private App only on the selected repositories, run `bun standards creds add github --dest <target>:<key>` in every consumer, and verify its workflows can mint tokens. Retire the old public App only after every repository owner has its own entry, every intended SOPS destination has been reprovisioned, and token minting has been verified; until then, keep its key and installation available for any destinations not yet migrated. `login cloudflare` guides the one dashboard paste Cloudflare requires for the first account token (named `standards-broker` to match the App, created from the "Create additional tokens" token template because its "Account API Tokens: Edit" permission is unavailable in the custom token builder, and holding that permission only), verifies that it is active, correlates its verified ID with the complete account token list and an active list record, and stores it; a bootstrap token named inside the minted `standards/` namespace is rejected before storage to keep its role unambiguous, while any other divergence from the recommended name only warns. `plan` and `apply` do not rotate GitHub App keys; create a replacement key on the App's settings page, atomically replace that owner's `private_key` in the protected machine-global broker store while preserving its `0600` mode, then update every intended SOPS destination, verify workflows can mint installation tokens, and revoke the old key manually. Root credentials live in the machine-global broker store (see Configuration); SOPS writes go through `sops edit` with a non-interactive editor, preserving comments and reusing the file's data key.
+`creds` is the credential broker: it mints scoped Cloudflare tokens, rotates and revokes those tokens, and places GitHub App credentials into SOPS-encrypted targets — secret values never touch stdout, argv, or an agent's context; commands print only metadata (token name, scopes, expiry, destination). Cloudflare reconciliation has exactly two sources of truth: the plaintext key structure of the SOPS files and the provider token list under the deterministic naming scheme `standards/<owner>/<repo>/<sops-target>/<dotted.key>`; there is no separate credential manifest. `plan` and `apply` reconcile Cloudflare only: each run uses the stored bootstrap credential to verify its current provider token ID, excludes that ID from reconciliation regardless of its current name, and aborts if the identity cannot be correlated with the complete account token list; a brokered token whose SOPS key was deleted is revoked, while one nearing expiry (30 days) is renewed by creating a fresh-expiry replacement with the live token's policies, durably writing and verifying the new value, and only then revoking the old token; secrets the broker did not mint are never touched. Both also report what reconciliation will never touch, in two separately labelled and separately counted blocks that never block: unmanaged tokens, meaning every unexpired token in the account whose name falls outside the reserved `standards/` namespace — with one exception, this machine's own bootstrap credential, which every run removes by verified ID before anything is classified — and tokens brokered to another repository, each printed with the repository whose `apply` owns it. An expired token is omitted from the unmanaged listing because it grants nothing. Neither block is idle information: nothing here renews or revokes those tokens, and a forgotten one — the original half of a hand-made credential that was replaced rather than retired, or a brokered token whose repository was renamed away — stays valid indefinitely, so a listed token is normally printed with the exact command that retires it, carrying `--account` and, for a token brokered elsewhere, `--force` and the one condition that justifies it. Two rows are exceptions. A token named `standards-broker` holds the reserved name for a machine's bootstrap credential, so it is either another machine's or a superseded one on this machine; `revoke` refuses it by name, so the row names the Cloudflare dashboard rather than a command that would always fail. The other exception looks like an ordinary brokered-elsewhere row, and its command fails. `plan` classifies by exact token name, so a token whose brokered repository differs from this checkout's origin only in capitalisation lands in the brokered-elsewhere block with a `--force` command; `revoke` compares repository names case-insensitively, reads the same token as this checkout's own, and refuses. Row and block header both read that token as foreign — the header labels the block tokens brokered to another repository, and the row explains the `--force` by the owning repository having been renamed, transferred, or deleted. Neither holds there: GitHub names are case-insensitive, so the owning repository is this one and it is still alive. Re-point the origin remote at the capitalisation the token carries, or retire the token in the Cloudflare dashboard. A name that claims this repository's brokered namespace without being one the broker mints is a finding instead, and findings abort reconciliation before any mutation, because reconciliation cannot own that token; plain `revoke --token-id` takes it once you decide it should go. `revoke --token-id <id>` deletes exactly one Cloudflare token, named by its 32-character hexadecimal ID, with `--account <id>` required whenever more than one account is configured; it records no ownership, so the power is momentary rather than standing and a human names the target every time. It refuses an ID the account does not hold, the bootstrap credential this machine has stored (matched by verified ID, so a rename cannot disguise it), and any other token named `standards-broker`, the reserved name for a machine's bootstrap (matched by name, because that one is another machine's bootstrap or a superseded one, retired in the Cloudflare dashboard where you can confirm whose it is — the broker cannot re-mint its own root credential). A token brokered to this repository is refused with the remedy that works here: delete its SOPS key in this repository and run `apply`, which revokes the token and keeps the secret in step. A token whose brokered name differs from this checkout's origin only in capitalisation is refused too, and without the `apply` remedy: reconciliation matches the name exactly, so from here it would neither renew nor revoke the token. Its remedies are re-pointing the origin remote at the capitalisation the token carries, which brings it back under reconciliation, or retiring it in the Cloudflare dashboard. A token brokered to a repository that is genuinely a different one is refused with that repository named, because the same `apply` remedy runs there. `--force` widens exactly that last refusal, and nothing else: it lets `revoke` delete a token whose brokered repository is not this checkout's. It verifies nothing about the state of that repository, so it is justified only when nothing reconciles the token any more — the owning repository was renamed, transferred, or deleted, and no checkout resolves to its name. `revoke` decides ownership from the origin remote and compares it case-insensitively, as GitHub names are; `plan` classifies by exact name instead, which is why the two disagree about a case-only difference. When the origin remote resolves to no GitHub repository, every brokered token is refused, `--force` included, because the check it widens is the one that could not be run. `--force` never bypasses either bootstrap guard, the case-only refusal, or that unresolvable-origin refusal. Without a manifest there is no desired-policy record, so live policy drift is not detected, and a repository rename or transfer changes the deterministic namespace and requires the visible old token to be re-minted under the new name and revoked. `add cloudflare` mints an account-owned API token (default TTL 90 days) scoped to the named permission groups (`permissions` lists the valid names) and writes it to `--dest <target>:<dotted.key>`, where `<target>` resolves like the canonical `just secrets` targets (`ci` → `secrets/ci.yaml`, `prod-1` → `infra/hosts/prod-1/secrets.yaml`). `--zone <zone-id>[,<zone-id>...]` adds a zone resource so zone-scoped groups such as DNS Write can be minted. Zones are named by their 32-character hexadecimal ID, shown on the zone's dashboard overview and not a secret; resolving a domain name instead would need Zone Read on the bootstrap token, which holds Account API Tokens / Edit and nothing else. With zones named, the selection is split by what each group can target: every group Cloudflare reports as zone-scoped forms one policy holding all named zones, and groups that can only target an account keep their own account policy on the same token, so one credential can hold DNS access next to account-wide access. A group Cloudflare reports as both takes the zone policy, which is the narrower reading of `--zone`. A group matching neither resource is named and rejected, `--zone` requires at least one zone-scoped group, and `--zone` cannot be combined with `--bucket`, which is a separate credential. The mint summary prints the resources the token reaches, so an account policy alongside the zones is visible rather than implied. `--bucket <name>` switches the policy resource to a single R2 bucket; `--jurisdiction default|eu` selects the provider jurisdiction and defaults to `default`, producing `com.cloudflare.edge.r2.bucket.<account_id>_default_<bucket>` or `com.cloudflare.edge.r2.bucket.<account_id>_eu_<bucket>`. FedRAMP jurisdictions are not supported. Bucket destinations accept only bucket-scoped groups such as Workers R2 Storage Bucket Item Read/Write, and account-scoped groups are rejected. `--s3` requires `--bucket` and stores the S3-compatible credential pair Cloudflare derives from an API token — access key ID is the token ID, secret access key is the SHA-256 hex digest of the token value — as `<dotted.key>.access_key_id` and `<dotted.key>.secret_access_key` under the destination instead of the raw token value; the default endpoint is `https://<account_id>.r2.cloudflarestorage.com`, while EU uses `https://<account_id>.eu.r2.cloudflarestorage.com`. Reconciliation infers each destination's concrete write footprint from the plaintext SOPS key structure — a bearer owns the leaf at its key, while an S3 token owns both pair leaves — and aborts before mutation when managed footprints intersect. `plan` and `apply` renew and revoke S3 destinations like any other brokered token, but renewal first proves the stored access key ID matches the current provider token; an incomplete pair, unreadable value, or identity mismatch is surfaced as a finding and never mutated automatically. `add github` selects the private broker App whose owner matches the destination repository's origin owner, checks both local SOPS leaves before authenticating, proves that the exact selected App is installed on that repository, and writes only while that full App identity still holds the synchronized broker-store entry; missing, duplicate, replaced, or mismatched owners fail before SOPS changes. Durable GitHub tokens cannot be created via API (PAT and OAuth-app creation are UI-only), so workflows mint short-lived installation tokens from the App at runtime (`actions/create-github-app-token`), scoped per repository and permission. The canonical weekly sync expects `bun standards creds add github --dest ci:ci.broker_app`, then mints a current-repository token with Contents read and Pull requests write; missing credentials or minting failures stop it without a fallback. Bootstrap is once per machine and per GitHub owner: `login github` creates a private personal App, while `login github --org <org>` creates or replaces only that organization's entry; each manifest conversion records GitHub's authoritative owner, and the command opens the installation page, where the App must be bound to selected repositories rather than all repositories. GitHub App names are globally unique and limited to 34 characters, so organization defaults include owners up to 17 characters; a longer owner or a colliding replacement name requires an explicit shorter unused `--name`. The first GitHub-specific command against an existing singleton broker store authenticates as that App, resolves its registration owner, and atomically migrates the old mapping to that one owner; a failed lookup leaves the persisted bytes untouched. If the singleton was a public App installed on repositories owned by other users or organizations, those repositories stop matching after migration because owner selection no longer treats that App as shared. For each affected owner, run `login github` while signed in as that personal owner or `login github --org <owner>`, install the new private App only on the selected repositories, run `bun standards creds add github --dest <target>:<key>` in every consumer, and verify its workflows can mint tokens. Retire the old public App only after every repository owner has its own entry, every intended SOPS destination has been reprovisioned, and token minting has been verified; until then, keep its key and installation available for any destinations not yet migrated. `login cloudflare` guides the one dashboard paste Cloudflare requires for the first account token (named `standards-broker` to match the App, created from the "Create additional tokens" token template because its "Account API Tokens: Edit" permission is unavailable in the custom token builder, and holding that permission only), verifies that it is active, correlates its verified ID with the complete account token list and an active list record, and stores it; a bootstrap token named inside the minted `standards/` namespace is rejected before storage to keep its role unambiguous, while any other divergence from the recommended name only warns. `plan` and `apply` do not rotate GitHub App keys; create a replacement key on the App's settings page, atomically replace that owner's `private_key` in the protected machine-global broker store while preserving its `0600` mode, then update every intended SOPS destination, verify workflows can mint installation tokens, and revoke the old key manually. Root credentials live in the machine-global broker store (see Configuration); SOPS writes go through `sops edit` with a non-interactive editor, preserving comments and reusing the file's data key.
 
 `structure --profile source` validates the standards source repository itself, which is deliberately not a consumer. The profile pins its intentional exceptions so they cannot drift silently: exact, ordered root gate scripts that run this CLI from the local checkout (`structure --profile source`, `dependabot --check` or `dependabot --write`, `github --check`, and the Turbo gate) instead of a recursive `standards check`, and a non-private published bin-only CLI workspace that carries a stable release SemVer and exactly maps the `standards` bin to `src/cli.ts` without `exports`. Every other consumer rule still applies.
 
@@ -48,7 +49,7 @@ standards poller --print-units --config <path>
 - **`sync-standards.local.json`** (optional) — consumer-owned sync policy at the repo root, validated by `doctor`/`check` and every `init`/`sync` even when an explicit ref or local source makes its `"ref"` irrelevant. All fields optional; a missing file means the defaults. `"ref"` is a non-empty single-line string that pins a tag, branch, or full commit sha to sync from instead of `main` (an explicit `--ref` overrides it; a local-path `--from` source is used as-is and ignores only the validated pin). `"autoSync": false` is read by the standards-sync workflow, not the CLI, and skips the weekly scheduled run; deliberate syncs then run locally because the secret-bearing workflow is schedule-only. Version 0.7.0 removes the legacy `STANDARDS_AUTO_SYNC` and `STANDARDS_SYNC_REF` variable behavior; consumers must upgrade the package and lockfile before adopting a policy file.
 - **`.github/settings.local.json` `"rulesetEnforcement": "unavailable-on-plan"`** (optional) — declares that the repository's GitHub plan cannot enforce rulesets (private repositories on GitHub Free, both personal accounts and organizations). `github --check` and `--apply` then skip rulesets instead of comparing them, because a comparison cannot be trusted there: personal accounts answer ruleset reads with HTTP 403, and free-plan organizations report declared rulesets as active while silently not enforcing them. Plan-gated repository settings that only function alongside branch protection (`allow_auto_merge`) are skipped for the same reason — GitHub accepts a PATCH for them with HTTP 200 and silently keeps the old value. The remaining repository merge settings are still checked and converged, and both commands print an unprotected-branch notice on every run. The only accepted value is `"unavailable-on-plan"` (enforcement is the default; omit the key on paid plans), and combining the opt-out with additional local rulesets is rejected. After upgrading the plan, remove the declaration and run `bun standards github --apply` to restore enforcement.
 - **Poller config file** (required for `poller`, passed via `--config`) — host-level JSON, deliberately not repository state. Required: `"repos"` (1–12 unique `owner/repo` strings), `"model"` and `"reasoningEffort"` (passed to `codex exec`; the model choice is deliberate and has no default). The 12-repository maximum and five-minute acknowledgement cooldown keep supported mixed fix/review queues and persisted review-plan recovery below the 5,000-request/hour GitHub API budget with at least 1,400 requests/hour reserved for pagination, active jobs, writes, and other token users; the compound regression bound covers four acknowledged fixes plus four acknowledged reviews with persisted plans in every repository at no more than 3,312 requests/hour. Existing configs above the repository limit must be reduced or split across pollers with independent GitHub API budgets before upgrading. Optional: `"maxJobsPerTick"` (default 1 — the maximum number of new Codex runs the sequential worker may start in one tick), `"staleClaimHours"` (default 6; must exceed `runTimeoutMinutes` so a sweep can never release the claim of a job that is still running), `"runTimeoutMinutes"` (default 240 — the timeout catches wedged agents, not honest multi-hour review runs), `"cacheDir"` (default `~/.cache/standards-poller`; holds bare mirrors and job worktrees; relative paths resolve against the config file), `"extraCodexArgs"` (extra `codex exec` arguments, e.g. enabling the collaboration feature for subagent fan-out). Unknown keys are rejected. The poller needs `git`, `gh`, `codex` (authenticated — its rotating auth state must live in a writable location), and a GitHub token per the bullet below; the token needs issues, pull-requests, and contents write on the watched repos, and nothing else.
-- **Broker store** (created by `creds login`) — machine-global root credentials at `$XDG_CONFIG_HOME/standards/broker.yaml` (default `~/.config/standards/broker.yaml`; override with `STANDARDS_BROKER_FILE`), holding one private GitHub App identity (owner, id, slug, client id, private key) per GitHub account and one bootstrap token per Cloudflare account. The file is plaintext with `0600` permissions — deliberately the same local-account trust boundary as the plaintext personal age identity at `~/.config/sops/age/keys.txt`, which unlocks the same secrets; SOPS-encrypting the store to that adjacent identity would not improve custody. Writes use an owner-only temporary file and atomic replacement, and simultaneous provider logins merge rather than overwrite other accounts; `creds status` lists every App and owner and warns when the final mode is broader. The store lives outside every repository, is never synced or backed up, and losing it is cheap: re-run the provider login commands and revoke the old App keys and bootstrap tokens. On an additional machine, do not create second Apps: generate an additional private key from each existing App's settings page (GitHub Apps support several active keys; key generation has no API) and add it to that machine's store, so retiring a machine revokes one key per owner, not the setups.
+- **Broker store** (created by `creds login`) — machine-global root credentials at `$XDG_CONFIG_HOME/standards/broker.yaml` (default `~/.config/standards/broker.yaml`; override with `STANDARDS_BROKER_FILE`), holding one private GitHub App identity (owner, id, slug, client id, private key) per GitHub account and one bootstrap token per Cloudflare account. The file is plaintext with `0600` permissions — deliberately the same local-account trust boundary as the plaintext personal age identity at `~/.config/sops/age/keys.txt`, which unlocks the same secrets; SOPS-encrypting the store to that adjacent identity would not improve custody. Writes use an owner-only temporary file and atomic replacement, and simultaneous provider logins merge rather than overwrite other accounts; `creds status` lists every App and owner and warns when the final mode is broader. The store lives outside every repository, is never synced or backed up, and losing it is cheap: re-run the provider login commands, revoke the old App keys on each App's settings page, and retire the old bootstrap tokens in the Cloudflare dashboard. The dashboard is the only route for those tokens: `login cloudflare` walks you through creating a second one under the reserved `standards-broker` name, the old one stays live under that same name, and `revoke` refuses every token holding it. On an additional machine, do not create second Apps: generate an additional private key from each existing App's settings page (GitHub Apps support several active keys; key generation has no API) and add it to that machine's store, so retiring a machine revokes one key per owner, not the setups.
 - **`GH_TOKEN` / `GITHUB_TOKEN`** (optional generally; poller automation requires this or a logged-in `gh`) — GitHub API token for the `github` command and the GitHub portion of `check`; poller runs pass environment tokens through to Codex, while a local poller can share the service identity's authenticated `gh` state. When neither is available, other commands can still read public repositories anonymously, but poller writes and `github --apply` fail. GitHub's REST API reveals repo merge settings only to write-capable viewers, and `check` retries REST-hidden keys over GraphQL, which serves them to read-only tokens. REST serves ruleset `bypass_actors` only to a user-scoped token holding repository Administration read (a fine-grained PAT with that permission, or the local `gh` CLI under an admin account), and never to a GitHub App installation token at any permission level, so `check` retries the hidden lists over GraphQL, which withholds the actor identities but answers an exact bypass-actor count (established for a GitHub App installation token and for a non-admin classic-scope viewer, not for every identity class): a declared-empty list verifies exactly, a count that disagrees with the declared length is drift, and a matching non-zero count leaves *which* actors bypass unconfirmed, so the gate fails closed on that ruleset. An installation-token run therefore leaves a declared non-empty list failing until the check is re-run locally with admin `gh` auth; widening the App's permissions is not the fix. Private-repository labels require Issues read (or Pull requests read); a token that still cannot see declared state fails the check rather than passing unverified. In CI, the canonical workflow verifies with the workflow token, granted read-only "Contents" and "Issues"; Issues is what declared-label reads need, listing rulesets rides on the implicit "Metadata" read, and merge settings come over GraphQL. A private-repository probe compared that grant set against a broker App installation token across every read the check performs and found no difference, so CI provisions no settings credential of its own.
 
 See the standards repository README for the ownership model and adoption workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -32,6 +32,7 @@
     "src/creds-cloudflare-api.ts",
     "src/creds-cloudflare-condition.ts",
     "src/creds-cloudflare-expiry.ts",
+    "src/creds-cloudflare-id.ts",
     "src/creds-cloudflare-pagination.ts",
     "src/creds-cloudflare-zone.ts",
     "src/creds-commands.ts",
@@ -46,11 +47,14 @@
     "src/creds-plan.ts",
     "src/creds-plan-groups.ts",
     "src/creds-plan-renew.ts",
+    "src/creds-plan-report.ts",
     "src/creds-plan-run.ts",
     "src/creds-plan-revoke.ts",
     "src/creds-plan-types.ts",
+    "src/creds-plan-unmanaged.ts",
     "src/creds-prompt.ts",
     "src/creds-r2.ts",
+    "src/creds-revoke.ts",
     "src/creds-sops.ts",
     "src/creds-sops-editor.ts",
     "src/creds-sops-structure.ts",
@@ -68,11 +72,15 @@
     "src/dependabot-directory-overlap.ts",
     "src/dependabot-inspect.ts",
     "src/dependabot-update.ts",
+    "src/dev-env-compose.ts",
     "src/dev-env-document.ts",
     "src/dev-env-destination-duplicates.ts",
+    "src/dev-env-destination-gitignore.ts",
     "src/dev-env-destination.ts",
     "src/dev-env-dotenv-value.ts",
     "src/dev-env-dotenv.ts",
+    "src/dev-env-reconciliation.ts",
+    "src/dev-env-secrets.ts",
     "src/dev-env-transaction-recovery.ts",
     "src/dev-env-transaction.ts",
     "src/dev-env.ts",

package/src/cli.ts

@@ -965,7 +965,7 @@ Commands:
   doctor      Validate extension seams only
   structure   Validate monorepo structure rules only
   dependabot  Verify (--check) or regenerate (--write) the composed .github/dependabot.yml
-  dev-env     Write each workspace's generated .env.local from the SOPS-encrypted secrets/dev.yaml
+  dev-env     Compose each workspace's generated .env.local from config/dev.yaml, the SOPS-encrypted secrets/dev.yaml, and gitignored config/dev.local.yaml overrides
   github      Compare (--check) or converge (--apply) live GitHub settings
   creds       Mint, rotate, and revoke brokered credentials (see \`standards creds help\`)
   poller      Run one fix-poller tick over the configured repositories (host automation)

package/src/creds-args.ts

@@ -20,8 +20,10 @@ export type CredsFlags = {
   zone: string | undefined;
   jurisdiction: R2Jurisdiction;
   s3: boolean;
+  force: boolean;
   org: string | undefined;
   name: string | undefined;
+  tokenId: string | undefined;
   readonly words: Array<string>;
 };
 
@@ -55,8 +57,10 @@ export const parseCredsArgs = (argv: ReadonlyArray<string>): CredsFlags => {
     zone: undefined,
     jurisdiction: DEFAULT_R2_JURISDICTION,
     s3: false,
+    force: false,
     org: undefined,
     name: undefined,
+    tokenId: undefined,
     words: [],
   };
   const setters: Readonly<Record<string, (value: string) => void>> = {
@@ -93,12 +97,17 @@ export const parseCredsArgs = (argv: ReadonlyArray<string>): CredsFlags => {
     '--name': (value) => {
       flags.name = value;
     },
+    '--token-id': (value) => {
+      flags.tokenId = value;
+    },
   };
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index] ?? '';
     const setter = setters[arg];
     if (arg === '--s3') {
       flags.s3 = true;
+    } else if (arg === '--force') {
+      flags.force = true;
     } else if (setter !== undefined) {
       setter(flagValue(argv, index));
       index += 1;

package/src/creds-cloudflare-account.ts

@@ -1,4 +1,4 @@
-const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/u;
+import { isCloudflareId } from './creds-cloudflare-id';
 
 export const isCloudflareAccountId = (value: unknown): value is string =>
-  typeof value === 'string' && ACCOUNT_ID_PATTERN.test(value);
+  typeof value === 'string' && isCloudflareId(value);

package/src/creds-cloudflare-id.ts

@@ -0,0 +1,10 @@
+// Cloudflare identifies accounts, zones, and API tokens by the same
+// 32-character lowercase hexadecimal shape, and this module owns that shape for
+// all three. Checking it before a request turns a typo into a precise message
+// instead of a provider 404, which reads the same as a resource that exists but
+// is out of reach.
+
+const CLOUDFLARE_ID = /^[0-9a-f]{32}$/u;
+
+export const isCloudflareId = (value: string): boolean =>
+  CLOUDFLARE_ID.test(value);

package/src/creds-cloudflare-zone.ts

@@ -4,9 +4,9 @@
 // would fail — or, worse, come back empty and read as a missing zone. A zone ID
 // is not a secret and is shown on the zone's dashboard overview.
 
-export const ZONE_SCOPE = 'com.cloudflare.api.account.zone';
+import { isCloudflareId } from './creds-cloudflare-id';
 
-const ZONE_ID_PATTERN = /^[0-9a-f]{32}$/u;
+export const ZONE_SCOPE = 'com.cloudflare.api.account.zone';
 
 export const zoneResource = (zoneId: string): string =>
   `${ZONE_SCOPE}.${zoneId}`;
@@ -30,7 +30,7 @@ export const parseZoneArgument = (value: string): ParsedZoneArgument => {
     };
   }
   const entries = [first, ...rest] as const;
-  const invalid = entries.filter((zone) => !ZONE_ID_PATTERN.test(zone));
+  const invalid = entries.filter((zone) => !isCloudflareId(zone));
   return invalid.length === 0
     ? { ok: true, zoneIds: entries }
     : {

package/src/creds-commands.ts

@@ -7,6 +7,7 @@ import { runCredsLoginCloudflare } from './creds-login-cloudflare';
 import { runCredsLoginGithub } from './creds-login-github';
 import { BROKER_IDENTITY_NAME } from './creds-naming';
 import { runCredsPlan } from './creds-plan-run';
+import { runCredsRevoke } from './creds-revoke';
 import {
   inspectBrokerFileMode,
   readBrokerStore,
@@ -20,8 +21,9 @@ Commands:
   login cloudflare  Store a Cloudflare account's bootstrap token (one guided paste per account)
   add cloudflare    Mint a scoped, expiring account token and write it into a SOPS target
   add github        Select the repository owner's App, verify its installation, and write it into SOPS
-  plan              Show revocations and rotations reconciling SOPS keys against brokered tokens
-  apply             Execute the plan: revoke orphaned tokens, roll expiring ones into SOPS
+  plan              Reconcile SOPS keys against brokered tokens: show revocations, rotations, and the live account tokens nothing reconciles here
+  apply             Execute the plan: revoke brokered tokens whose SOPS key is gone, roll expiring ones into SOPS
+  revoke            Delete one Cloudflare token named by --token-id; bootstrap credentials and brokered tokens are refused
   permissions       List Cloudflare permission group names for --permissions
   status            Show the broker store location and configured providers
 
@@ -35,6 +37,8 @@ Options:
   --zone <zone-id>      Add a zone resource for zone-scoped groups (comma-separated IDs)
   --jurisdiction <name> R2 jurisdiction: default or eu (default: default)
   --s3                  Store the derived R2 S3 credential pair (<key>.access_key_id, <key>.secret_access_key) instead of the raw token
+  --token-id <id>       Cloudflare token to revoke (32-character hexadecimal ID)
+  --force               Let revoke delete a token brokered to a repository that is not this checkout's. It verifies nothing about that repository, so use it only when nothing reconciles the token any more: that repository was renamed, transferred, or deleted, so no checkout resolves to its name and no \`standards creds apply\` will ever revoke the token. It never permits revoking a broker bootstrap credential, a token brokered to this repository, a token whose brokered repository differs from this checkout's only in capitalisation, or any brokered token when this checkout's origin remote resolves to no GitHub repository, because ownership is then the very thing that could not be checked
   --org <org>           Create the GitHub App under an organization
   --name <name>         GitHub App name (default: ${BROKER_IDENTITY_NAME}, suffixed by --org)
 
@@ -117,6 +121,13 @@ export const runCredsCommand = (
     'add github': () => runCredsAddGithub(flags.dir, flags),
     plan: () => runCredsPlan(flags.dir, false),
     apply: () => runCredsPlan(flags.dir, true),
+    revoke: () =>
+      runCredsRevoke({
+        account: flags.account,
+        tokenId: flags.tokenId,
+        dir: flags.dir,
+        force: flags.force,
+      }),
     permissions: () => runCredsPermissions(flags.account),
     status: () => runCredsStatus(),
   };

package/src/creds-naming.ts

@@ -80,3 +80,16 @@ export const parseTokenName = (
   }
   return ref;
 };
+
+// The repository a minted name belongs to is carried by the name itself, so a
+// command holding no repository — `creds revoke` is account-scoped — can still
+// tell a token reconciliation owns from one nothing manages.
+export const parseAnyTokenName = (name: string): BrokeredTokenRef | null => {
+  if (!isInMintedNamespace(name)) {
+    return null;
+  }
+  const [owner, repo] = name.slice(`${NAME_PREFIX}/`.length).split('/');
+  return owner === undefined || repo === undefined
+    ? null
+    : parseTokenName(name, `${owner}/${repo}`);
+};

package/src/creds-plan-report.ts

@@ -0,0 +1,87 @@
+// The operator-facing rendering of a computed plan. Every block is labelled and
+// printed only when it has entries, because the three lists say different
+// things: what reconciliation will do, what it will never touch, and what no
+// repository reconciles at all. The summary counts them apart for the same
+// reason.
+
+import { BROKER_IDENTITY_NAME } from './creds-naming';
+import type {
+  BrokeredElsewhereToken,
+  CredsPlan,
+  PlannedAction,
+  UnmanagedToken,
+} from './creds-plan-types';
+
+// Each listed token is offered with the exact command that retires it rather
+// than with identifiers to reassemble: `plan` already holds the account, and
+// `revoke` demands it whenever the broker holds more than one.
+const revokeCommand = (token: UnmanagedToken, extra: string): string =>
+  `\`standards creds revoke --account ${token.accountId} --token-id ${token.tokenId}${extra}\``;
+
+// One unmanaged shape has no revoke command to offer: the reserved bootstrap
+// name. This machine's own bootstrap is excluded from the listing by verified
+// ID, so a row under that name is another machine's or a superseded one, and
+// `revoke` refuses it by name — printing a command that always fails would
+// send the operator down a dead end. The remedy is the dashboard, which is
+// also the only place the machine it belongs to can be confirmed.
+const unmanagedRemedy = (token: UnmanagedToken): string =>
+  token.name === BROKER_IDENTITY_NAME
+    ? "the reserved name for a machine's broker bootstrap credential, which `revoke` refuses; retire it in the Cloudflare dashboard, where you can confirm which machine it belongs to"
+    : `retire it with ${revokeCommand(token, '')}`;
+
+const reportActions = (
+  actions: ReadonlyArray<PlannedAction>,
+  apply: boolean,
+): void => {
+  if (actions.length === 0) {
+    return;
+  }
+  console.log(`standards creds: ${apply ? '' : 'planned '}actions`);
+  for (const action of actions) {
+    console.log(
+      `  ${apply ? '' : 'would '}${action.kind} ${action.name} (${action.reason})`,
+    );
+  }
+};
+
+const reportUnmanaged = (tokens: ReadonlyArray<UnmanagedToken>): void => {
+  if (tokens.length === 0) {
+    return;
+  }
+  console.log(
+    'standards creds: unmanaged tokens — reconciliation mints nothing of this shape, and plan and apply never mutate them',
+  );
+  for (const token of tokens) {
+    console.log(
+      `  ${token.name} (${token.status}) — ${unmanagedRemedy(token)}`,
+    );
+  }
+};
+
+const reportBrokeredElsewhere = (
+  tokens: ReadonlyArray<BrokeredElsewhereToken>,
+): void => {
+  if (tokens.length === 0) {
+    return;
+  }
+  console.log(
+    'standards creds: tokens brokered to another repository — never mutated here, and reconciled there only if a checkout still mints that exact name',
+  );
+  for (const token of tokens) {
+    console.log(
+      `  ${token.name} (${token.status}) — brokered to ${token.repo}; if no checkout mints this name any more — ${token.repo} renamed, transferred, or deleted — then nothing reconciles the token, and only then: ${revokeCommand(token, ' --force')}`,
+    );
+  }
+};
+
+export const reportCredsPlan = (plan: CredsPlan, apply: boolean): void => {
+  reportActions(plan.actions, apply);
+  reportUnmanaged(plan.unmanaged);
+  reportBrokeredElsewhere(plan.brokeredElsewhere);
+  for (const finding of plan.findings) {
+    console.error(`standards creds: ${finding}`);
+  }
+  console.log(
+    `standards creds: ${plan.actions.length} action(s), ${plan.findings.length} finding(s), ${plan.healthy} brokered token(s) healthy, ${plan.unmanaged.length} unmanaged token(s), ${plan.brokeredElsewhere.length} token(s) brokered to another repository`,
+  );
+};

package/src/creds-plan-run.ts

@@ -2,6 +2,7 @@ import { listSecretsTargets } from './creds-dest';
 import { identifyCloudflareBootstrapAuthority } from './creds-login-cloudflare';
 import { computeCredsPlan } from './creds-plan';
 import { renewPlannedToken } from './creds-plan-renew';
+import { reportCredsPlan } from './creds-plan-report';
 import { revokePlannedToken } from './creds-plan-revoke';
 import type { AccountToken, PlannedAction } from './creds-plan-types';
 import { readEncryptedKeys } from './creds-sops';
@@ -109,17 +110,7 @@ export const runCredsPlan = async (
     tokens: state.tokens,
     now: new Date(),
   });
-  for (const action of plan.actions) {
-    console.log(
-      `  ${apply ? '' : 'would '}${action.kind} ${action.name} (${action.reason})`,
-    );
-  }
-  for (const finding of plan.findings) {
-    console.error(`standards creds: ${finding}`);
-  }
-  console.log(
-    `standards creds: ${plan.actions.length} action(s), ${plan.findings.length} finding(s), ${plan.healthy} brokered token(s) healthy`,
-  );
+  reportCredsPlan(plan, apply);
   if (plan.findings.length > 0) {
     return fail('reconciliation aborted until every finding is resolved');
   }

package/src/creds-plan-types.ts

@@ -7,6 +7,21 @@ export type AccountToken = {
   readonly token: CloudflareToken;
 };
 
+export type UnmanagedToken = {
+  readonly accountId: string;
+  readonly tokenId: string;
+  readonly name: string;
+  readonly status: string;
+};
+
+// A token the broker minted under another repository's name. That repository
+// normally reconciles it, so it is not unmanaged — the distinction matters
+// because it stops being true when that repository is renamed, transferred, or
+// deleted, and this account is then the only place the token is still visible.
+export type BrokeredElsewhereToken = UnmanagedToken & {
+  readonly repo: string;
+};
+
 export type PlannedAction =
   | {
       readonly kind: 'revoke';
@@ -33,4 +48,8 @@ export type CredsPlan = {
   readonly actions: ReadonlyArray<PlannedAction>;
   readonly findings: ReadonlyArray<string>;
   readonly healthy: number;
+  // Tokens in the account the broker did not mint. Reported, never mutated.
+  readonly unmanaged: ReadonlyArray<UnmanagedToken>;
+  // Tokens the broker minted for another repository. Reported, never mutated.
+  readonly brokeredElsewhere: ReadonlyArray<BrokeredElsewhereToken>;
 };

package/src/creds-plan-unmanaged.ts

@@ -0,0 +1,102 @@
+// Reconciliation matches tokens to a repository by name and used to discard
+// every other token in the account silently. That silence is where a forgotten
+// credential hides: replacing a hand-made token means minting a brokered one
+// and deleting the original, and nothing noticed when the second half was
+// skipped. Classification makes the leftovers visible without giving the broker
+// any power over them — a token named here is never mutated automatically.
+
+import type { CloudflareToken } from './creds-cloudflare-api';
+import {
+  type BrokeredTokenRef,
+  isInMintedNamespace,
+  parseAnyTokenName,
+  parseTokenName,
+  repoTokenPrefix,
+} from './creds-naming';
+import type {
+  AccountToken,
+  BrokeredElsewhereToken,
+  UnmanagedToken,
+} from './creds-plan-types';
+
+type Classification =
+  | { readonly kind: 'managed'; readonly ref: BrokeredTokenRef }
+  | { readonly kind: 'malformed' }
+  | { readonly kind: 'unmanaged' }
+  | { readonly kind: 'brokered-elsewhere'; readonly repo: string }
+  | { readonly kind: 'ignored' };
+
+const classifyAccountToken = (
+  token: CloudflareToken,
+  repo: string,
+): Classification => {
+  const ref = parseTokenName(token.name, repo);
+  if (ref !== null) {
+    return { kind: 'managed', ref };
+  }
+  // An expired token grants nothing, and listing years of them would bury the
+  // live ones. Brokered tokens keep their own expiry handling in creds-plan.
+  if (token.status === 'expired') {
+    return { kind: 'ignored' };
+  }
+  if (token.name.startsWith(repoTokenPrefix(repo))) {
+    return { kind: 'malformed' };
+  }
+  // A brokered name carries the repository that owns it, which normally
+  // reconciles it. That premise fails exactly once: rename, transfer, or delete
+  // that repository and no checkout resolves to the old name, so nothing renews
+  // the token, nothing revokes it, and no repository would ever mention it.
+  // Every account sharer reporting it is the price of the orphan being seen at
+  // all. It stays out of the unmanaged bucket, which asserts something else —
+  // that the broker mints nothing of this shape anywhere.
+  const elsewhere = parseAnyTokenName(token.name);
+  if (elsewhere !== null) {
+    return { kind: 'brokered-elsewhere', repo: elsewhere.repo };
+  }
+  return isInMintedNamespace(token.name)
+    ? { kind: 'ignored' }
+    : { kind: 'unmanaged' };
+};
+
+export type ManagedTokenRef = AccountToken & {
+  readonly ref: BrokeredTokenRef;
+};
+
+export type TokenPartition = {
+  readonly managed: ReadonlyArray<ManagedTokenRef>;
+  readonly unmanaged: ReadonlyArray<UnmanagedToken>;
+  readonly brokeredElsewhere: ReadonlyArray<BrokeredElsewhereToken>;
+  readonly findings: ReadonlyArray<string>;
+};
+
+const reported = (entry: AccountToken): UnmanagedToken => ({
+  accountId: entry.accountId,
+  tokenId: entry.token.id,
+  name: entry.token.name,
+  status: entry.token.status,
+});
+
+export const partitionAccountTokens = (
+  tokens: ReadonlyArray<AccountToken>,
+  repo: string,
+): TokenPartition => {
+  const managed: Array<ManagedTokenRef> = [];
+  const unmanaged: Array<UnmanagedToken> = [];
+  const brokeredElsewhere: Array<BrokeredElsewhereToken> = [];
+  const findings: Array<string> = [];
+  for (const entry of tokens) {
+    const classification = classifyAccountToken(entry.token, repo);
+    if (classification.kind === 'managed') {
+      managed.push({ ...entry, ref: classification.ref });
+    } else if (classification.kind === 'malformed') {
+      findings.push(
+        `${entry.token.name} claims this repository's brokered namespace but is not a name this broker mints; rename it in the dashboard or retire it with \`standards creds revoke --account ${entry.accountId} --token-id ${entry.token.id}\``,
+      );
+    } else if (classification.kind === 'unmanaged') {
+      unmanaged.push(reported(entry));
+    } else if (classification.kind === 'brokered-elsewhere') {
+      brokeredElsewhere.push({ ...reported(entry), repo: classification.repo });
+    }
+  }
+  return { managed, unmanaged, brokeredElsewhere, findings };
+};

package/src/creds-plan.ts

@@ -3,23 +3,28 @@
 // naming scheme). A brokered token whose secret key vanished from SOPS is
 // revoked; one nearing expiry is replaced while copying its live policy and
 // lifetime. Secret keys without a brokered token are simply unmanaged — most
-// secrets are — and are never touched. Execution lives in creds-plan-run.ts.
+// secrets are — and are never touched. Tokens the broker did not mint, and
+// tokens it minted for another repository, are reported
+// (creds-plan-unmanaged.ts) but never mutated. Execution lives in
+// creds-plan-run.ts.
 
 import { cloudflareExpiresOn } from './creds-cloudflare-expiry';
-import { parseTokenName } from './creds-naming';
 import { groupByIntersectingFootprint } from './creds-plan-groups';
 import type {
   AccountToken,
   CredsPlan,
   PlannedAction,
 } from './creds-plan-types';
+import {
+  type ManagedTokenRef,
+  partitionAccountTokens,
+} from './creds-plan-unmanaged';
 import { destinationFormatOf, inferredDestinationFootprint } from './creds-r2';
 
 const DEFAULT_RENEW_WITHIN_DAYS = 30;
 const DAY_MS = 86_400_000;
 
-type ManagedToken = AccountToken & {
-  readonly ref: { readonly target: string; readonly key: string };
+type ManagedToken = ManagedTokenRef & {
   readonly footprint: ReadonlyArray<string>;
 };
 
@@ -145,23 +150,16 @@ export const computeCredsPlan = (input: {
   const renewWithin =
     (input.renewWithinDays ?? DEFAULT_RENEW_WITHIN_DAYS) * DAY_MS;
   const actions: Array<PlannedAction> = [];
-  const findings: Array<string> = [];
+  const partition = partitionAccountTokens(input.tokens, input.repo);
+  const findings: Array<string> = [...partition.findings];
   let healthy = 0;
-  const managed = input.tokens.flatMap((entry) => {
-    const ref = parseTokenName(entry.token.name, input.repo);
-    return ref === null
-      ? []
-      : [
-          {
-            ...entry,
-            ref,
-            footprint: inferredDestinationFootprint(
-              input.keysByTarget.get(ref.target),
-              ref.key,
-            ),
-          },
-        ];
-  });
+  const managed = partition.managed.map((entry) => ({
+    ...entry,
+    footprint: inferredDestinationFootprint(
+      input.keysByTarget.get(entry.ref.target),
+      entry.ref.key,
+    ),
+  }));
   const dispositions = groupByIntersectingFootprint(managed).map((group) =>
     dispositionForGroup(group, input, renewWithin),
   );
@@ -174,5 +172,11 @@ export const computeCredsPlan = (input: {
       healthy += 1;
     }
   }
-  return { actions, findings, healthy };
+  return {
+    actions,
+    findings,
+    healthy,
+    unmanaged: partition.unmanaged,
+    brokeredElsewhere: partition.brokeredElsewhere,
+  };
 };