@davidvornholt/standards 0.26.0 → 0.26.1

package/README.md

@@ -60,7 +60,7 @@ Existing project-owned files are kept. Synced files are replaced. `init` refuses
 ```sh
 bun standards sync --dry-run
 bun standards sync
-bun standards sync --ref v0.26.0
+bun standards sync --ref v0.26.1
 bun standards sync --from ../standards
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -184,17 +184,17 @@
   },
   "devDependencies": {
     "@davidvornholt/typescript-config": "0.0.0",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     "sigstore": "5.0.0",
     "typescript": "7.0.2"
   },
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.2"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.1"
   }
 }

package/src/creds-cloudflare.ts

@@ -3,6 +3,8 @@
 // itself, lists and mints scoped tokens, and revokes them. Token values
 // returned by create flow only into SOPS writers,
 // never stdout.
+// User-owned tokens are intentionally outside this API and the bootstrap
+// credential's authority; they must be managed separately in Cloudflare.
 
 import {
   type CfResult,

package/src/creds-github-apps.ts

@@ -57,6 +57,8 @@ export const loadOwnedGithubStore = async (
   return { ok: true, value: migrated };
 };
 
+// Private Apps belong to one owner. Selecting by repository owner keeps each
+// owner's credentials separate; installation access is verified before export.
 export const selectGithubAppForRepo = (
   apps: ReadonlyArray<GithubBrokerApp>,
   repo: string,

package/src/creds-plan.ts

@@ -7,6 +7,8 @@
 // tokens it minted for another repository, are reported
 // (creds-plan-unmanaged.ts) but never mutated. Execution lives in
 // creds-plan-run.ts.
+// Live policy is preserved, not compared with a separate desired-policy manifest.
+// Adding policy-drift enforcement would require a new source of truth.
 
 import { cloudflareExpiresOn } from './creds-cloudflare-expiry';
 import { groupByIntersectingFootprint } from './creds-plan-groups';

package/src/creds-store.ts

@@ -24,6 +24,9 @@ export type BrokerStore = {
   readonly cloudflare: ReadonlyArray<CloudflareBrokerAccount>;
 };
 export const EMPTY_BROKER_STORE: BrokerStore = { github: [], cloudflare: [] };
+// This machine-global store trusts the local account, like its age private key.
+// Encrypting it with a colocated key would not protect against that account.
+// Repository secrets still belong in SOPS; this store stays outside repositories.
 const OWNER_ONLY_FILE_MODE = 0o600;
 const OWNER_ONLY_DIR_MODE = 0o700;
 const FILE_MODE_MODULUS = 0o1000;

package/src/dev-env-brokered-resolve.ts

@@ -22,6 +22,8 @@ export type ResolvedDevEnv = {
   readonly problems: ReadonlyArray<string>;
 };
 
+// Each variable independently selects a complete pair and then one part.
+// Variable names and neighboring references do not imply a shared credential.
 const lookupReference = (
   document: unknown,
   reference: BrokeredS3Reference,

package/src/github-graphql.ts

@@ -120,6 +120,8 @@ const BYPASS_ACTOR_PROBE = 1;
 // `totalCount` means the connection is being filtered rather than merely
 // redacted, so it supplies no count; a null *element* is the documented
 // identity-withholding shape, so only the length is checked.
+// Probes with restricted tokens confirmed that hidden actors still count:
+// https://github.com/davidvornholt/standards/pull/176
 const countedRuleset = (node: unknown): readonly [number, number] | null => {
   if (!isRecord(node) || typeof node.databaseId !== 'number') {
     return null;

package/src/poller-codex.ts

@@ -163,6 +163,9 @@ export const runCodex = async (
       {
         detached: true,
         stdio: ['ignore', 'ignore', 'pipe'],
+        // Approved runs share the host service identity and its GitHub token.
+        // Approval and write revalidation constrain the workflow; they do not
+        // isolate credentials. This assumes trusted, maintainer-approved work.
         env: { ...process.env },
       },
     );