@davidvornholt/standards 0.26.3 → 0.27.0

package/README.md

@@ -148,6 +148,31 @@ brokeredReferences:
 
 The referenced target must contain both `access_key_id` and `secret_access_key`. Every generated `.env.local`, transaction artifact, and `config/dev.local.yaml` must be ignored by Git.
 
+A pair owned by another repository uses an explicit source descriptor. The checkout path is resolved relative to the consumer root; put machine-specific paths in ignored `config/dev.local.yaml`.
+
+```yaml
+apps:
+  web:
+    S3_ACCESS_KEY_ID:
+      brokeredS3: garage
+      key: garage.development
+      part: access_key_id
+      source:
+        repository: owner/source
+        checkout: ../source
+    S3_SECRET_ACCESS_KEY:
+      brokeredS3: garage
+      key: garage.development
+      part: secret_access_key
+      source:
+        repository: owner/source
+        checkout: ../source
+```
+
+The consumer's encrypted allowlist must authorize the exact repository, target, and key as `owner/source@garage:garage.development`. Local target authorization does not authorize an external source. The source must be a Git checkout root whose `origin` is that GitHub repository, with no symlinked checkout or target path. Targets remain contained regular SOPS files under the source repository. One source repository must resolve to one checkout per generation. This verifies a maintainer-managed checkout's identity; it does not attest untrusted local Git configuration.
+
+Run `bun standards dev-env` in the consumer after updating the source checkout or rotating its pair. Both values are read from the one encrypted owner and only written to ignored generated environments. Rotation in a separate source repository cannot discover or update other workstations automatically. All selected source references and configuration are validated before any source target is decrypted; a failed generation leaves previous environments intact.
+
 ## github
 
 ```sh
@@ -205,7 +230,13 @@ To delete one Cloudflare token outside normal reconciliation:
 bun standards creds revoke --account <account-id> --token-id <token-id>
 ```
 
-Bootstrap credentials and tokens still owned by an active repository are refused.
+For same-name brokered duplicates left by interrupted renewal, keep the stored key intact and select the unused token ID. `revoke` proves which credential is stored, refuses that token, and rechecks the destination before deleting the selected duplicate. Unreadable or unidentifiable stored credentials leave every token intact. A destination already missing its key can also be recovered after successful decryption.
+
+Bootstrap credentials and singular tokens still owned by an active repository are refused.
+
+### Prepare existing consumers for GitHub App client IDs
+
+`standards creds add github --dest ci:ci.broker_app` writes and verifies `app_id`, `client_id`, and `private_key` together. Run it in each existing consumer, mirror the new `client_id` key with a placeholder in its `secrets/ci.example.yaml`, and commit both files before adopting a workflow that resolves `broker_app.client_id` and passes `client-id` to `actions/create-github-app-token@v3`. The numeric `app_id` remains available while existing workflows are migrated. Do not remove it until every local and canonical caller has switched. Canonical workflows continue using `app-id` until consumer provisioning is complete.
 
 ## screenshots
 
@@ -265,3 +296,7 @@ The worker accepts only exact issue or draft-PR revisions approved by a user wit
 The [root README](../../README.md) gives the short overview. The [adoption guide](../../docs/adoption.md) and [sync guide](../../docs/sync-and-ownership.md) explain repository ownership and first use.
 
 The poller timers use monotonic intervals: after boot, acknowledgement starts after one minute and work starts after two minutes. Missed downtime intervals are not replayed; each tick reads the current queue. The service budget reserves thirty minutes for scanning and setup in addition to its configured agent budget, with at most twelve watched repositories per poller. Split larger lists across pollers with independent API budgets; unusually slow provider or clone operations can exhaust that overhead and require investigating the service timeout before retrying.
+
+## Source text validation
+
+`bun standards source-text` checks tracked source, configuration, and documentation files as UTF-8 text, regardless of Git’s binary classification. `bun standards check` includes this gate. Raw Unicode control characters are rejected except tab and LF; write control characters in fixtures and composite keys using escaped representations such as `\0` or `\u0000`. Binary asset formats and untracked files are outside this gate. Missing tracked source files and source symlinks fail validation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.26.3",
+  "version": "0.27.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -56,6 +56,7 @@
     "src/creds-prompt.ts",
     "src/creds-r2.ts",
     "src/creds-revoke.ts",
+    "src/creds-revoke-duplicate.ts",
     "src/creds-sops.ts",
     "src/creds-sops-editor.ts",
     "src/creds-sops-structure.ts",
@@ -74,8 +75,10 @@
     "src/dependabot-directory-overlap.ts",
     "src/dependabot-inspect.ts",
     "src/dependabot-update.ts",
+    "src/dev-env-brokered-source.ts",
     "src/dev-env-brokered.ts",
     "src/dev-env-brokered-allowlist.ts",
+    "src/dev-env-brokered-preflight.ts",
     "src/dev-env-brokered-preserve.ts",
     "src/dev-env-brokered-resolve.ts",
     "src/dev-env-brokered-refresh.ts",
@@ -162,6 +165,7 @@
     "src/screenshots-publish.ts",
     "src/screenshots-upload.ts",
     "src/sops-exec.ts",
+    "src/source-text.ts",
     "src/structure-check.ts",
     "src/structure-bun-version.ts",
     "src/structure-profile.ts",
@@ -172,7 +176,8 @@
     "src/structure-workspace.ts",
     "src/sync-policy.ts",
     "src/yaml-emit.ts",
-    "src/yaml-parse.ts"
+    "src/yaml-parse.ts",
+    "src/sops-action-callers.ts"
   ],
   "scripts": {
     "lint": "biome check --error-on-warnings .",

package/src/cli.ts

@@ -44,6 +44,8 @@ import {
 } from './managed-path-ownership';
 import { runPollerCommand } from './poller-commands';
 import { runScreenshotsCommand } from './screenshots-commands';
+import { collectSopsActionCallerProblems } from './sops-action-callers';
+import { collectSourceTextProblems } from './source-text';
 import { collectStructureProblems } from './structure-check';
 import type { StructureProfile } from './structure-profile';
 import { hasSafeCommand } from './structure-script';
@@ -92,6 +94,7 @@ type Command =
   | 'help'
   | 'init'
   | 'poller'
+  | 'source-text'
   | 'structure'
   | 'sync';
 
@@ -153,13 +156,90 @@ const symlinkTargetProblem = (rel: string, target: string): string | null => {
   return null;
 };
 
+// Resolve components in filesystem order: missing/../real is dangling, and a
+// symlink component must be followed before a subsequent .. is interpreted.
+const MAX_SYMLINK_TRAVERSALS = 40;
+type ManagedTargetTraversal = {
+  readonly pending: Array<string>;
+  readonly resolved: Array<string>;
+  traversals: number;
+};
+const resolveManagedComponent = (
+  component: string,
+  state: ManagedTargetTraversal,
+  entries: ReadonlyMap<string, ManagedEntry>,
+): boolean => {
+  if (component === '' || component === '.') {
+    return true;
+  }
+  if (component === '..') {
+    return state.resolved.pop() !== undefined;
+  }
+  const path = [...state.resolved, component].join('/');
+  const entry = entries.get(path);
+  if (entry?.kind === 'symlink') {
+    state.traversals += 1;
+    if (
+      state.traversals > MAX_SYMLINK_TRAVERSALS ||
+      symlinkTargetProblem(path, entry.target) !== null
+    ) {
+      return false;
+    }
+    state.pending.unshift(...entry.target.split('/'));
+    return true;
+  }
+  const directory = [...entries.keys()].some((key) =>
+    key.startsWith(`${path}/`),
+  );
+  if (
+    !(directory || entry?.kind === 'file') ||
+    (state.pending.length > 0 && !directory)
+  ) {
+    return false;
+  }
+  state.resolved.push(component);
+  return true;
+};
+const managedTargetExists = (
+  target: string,
+  entries: ReadonlyMap<string, ManagedEntry>,
+): boolean => {
+  const state: ManagedTargetTraversal = {
+    pending: target.split('/'),
+    resolved: [],
+    // The original managed symlink also consumes one kernel traversal.
+    traversals: 1,
+  };
+  while (state.pending.length > 0) {
+    const component = state.pending.shift();
+    if (
+      component !== undefined &&
+      !resolveManagedComponent(component, state, entries)
+    ) {
+      return false;
+    }
+  }
+  return true;
+};
+
 const symlinkTargetProblems = (
   entries: ReadonlyMap<string, ManagedEntry>,
+  requireManagedTarget = false,
 ): ReadonlyArray<string> =>
   [...entries]
-    .map(([rel, entry]) =>
-      entry.kind === 'symlink' ? symlinkTargetProblem(rel, entry.target) : null,
-    )
+    .map(([rel, entry]) => {
+      if (entry.kind !== 'symlink') {
+        return null;
+      }
+      const problem = symlinkTargetProblem(rel, entry.target);
+      if (problem !== null) {
+        return problem;
+      }
+      const target = `${posix.dirname(rel)}/${entry.target}`;
+      return requireManagedTarget && !managedTargetExists(target, entries)
+        ? `canonical symlink ${rel} targets ${target}, which is missing from the managed payload or forms a symlink cycle`
+        : null;
+    })
     .filter((problem): problem is string => problem !== null);
 
 const parseManifest = (raw: unknown): Manifest => {
@@ -332,6 +412,10 @@ const mirrorPreconditionProblems = async (
   const locked = new Set(Object.keys(previous));
   const collisions = await Promise.all(
     [...upstream.keys()].map(async (rel) => {
+      const ancestor = await interposedAncestor(consumer, rel, upstream);
+      if (ancestor !== null) {
+        return `${rel} is below the ${ancestor.kind} ${ancestor.rel}; refusing to write through an existing file or symlink ancestor; move it aside before syncing this payload`;
+      }
       const current = await inspectManagedPath(join(consumer, rel));
       if (current?.kind !== 'directory') {
         return null;
@@ -343,7 +427,8 @@ const mirrorPreconditionProblems = async (
     }),
   );
   return [
-    ...symlinkTargetProblems(upstream),
+    ...symlinkTargetProblems(upstream, true),
+    ...(await collectSopsActionCallerProblems(consumer, upstream)),
     ...collisions.filter((problem): problem is string => problem !== null),
   ];
 };
@@ -362,16 +447,16 @@ const assertNoProblems = (
 };
 
 type PruneOutcome =
-  | { readonly kind: 'absent' }
+  | { readonly kind: 'replaced'; readonly rel: string }
   | { readonly kind: 'delete'; readonly rel: string }
   | { readonly kind: 'retain'; readonly note: string }
   | { readonly kind: 'stale'; readonly note: string };
 
 // Two things the prune pass must never do: resolve through a symlink it (or an
 // older CLI's lock) put in the parent chain, and recursively delete a
-// destination the consumer turned into a directory. Every answer is decided
-// against the shape the mirror leaves behind, not the shape on disk right now,
-// so `--dry-run` predicts what the matching real run does.
+// destination the consumer turned into a directory. Ancestor inspection uses
+// planned canonical replacements so dry-run and application classify the same
+// stale lock entries.
 const pruneOutcome = async (
   consumer: string,
   rel: string,
@@ -388,13 +473,21 @@ const pruneOutcome = async (
   // whether or not a directory still stands there while a dry run looks.
   const current =
     ancestor === null ? await inspectManagedPath(join(consumer, rel)) : null;
+  if (ancestor?.kind === 'file' && planned.has(ancestor.rel)) {
+    return { kind: 'replaced', rel };
+  }
   if (current === null) {
-    return { kind: 'absent' };
+    return {
+      kind: 'stale',
+      note: `${rel} (already absent; nothing was deleted)`,
+    };
   }
   if (current.kind === 'directory') {
     return {
       kind: 'retain',
-      note: `${rel}: removed upstream but now a directory this repository does not manage; delete it yourself if you no longer want it`,
+      note: [...planned.keys()].some((path) => path.startsWith(`${rel}/`))
+        ? `${rel}: removed upstream as a file, but retained as a directory containing canonical paths; keep those managed descendants`
+        : `${rel}: removed upstream but now a directory this repository does not manage; delete it yourself if you no longer want it`,
     };
   }
   return { kind: 'delete', rel };
@@ -432,7 +525,16 @@ const prune = async (
       deleted.map((rel) => rm(join(consumer, rel), { force: true })),
     );
   }
-  return { deleted, retained, stale };
+  return {
+    deleted: [
+      ...deleted,
+      ...outcomes.flatMap((outcome) =>
+        outcome.kind === 'replaced' ? [outcome.rel] : [],
+      ),
+    ],
+    retained,
+    stale,
+  };
 };
 
 // Mirror managed files into the consumer, deleting any previously-locked file
@@ -475,9 +577,8 @@ const mirror = async ({
       }
       if (!dryRun) {
         await mkdir(dirname(dest), { recursive: true });
-        // The precondition above proved every path inside this directory is one
-        // the lock already records, so replacing it restores the managed shape
-        // rather than destroying consumer work.
+        // The precondition proved every non-directory entry is locked. Empty
+        // directories are not tracked and are removed with the old shape.
         if (current?.kind === 'directory') {
           await rm(dest, { recursive: true, force: true });
         }
@@ -667,7 +768,7 @@ const runSync = async (
 
 // Offline drift detection: every locked file must still match its hash. Catches
 // local edits or deletions of canonical files. Does NOT detect upstream moving
-// on — see the "known limitation" in the standards repository README.
+// on. Mirror preconditions reject those ancestor conflicts before any writes.
 const runCheck = async (consumer: string): Promise<boolean> => {
   const lock = await readLock(consumer);
   if (lock === null || Object.keys(lock.files).length === 0) {
@@ -694,7 +795,10 @@ const runCheck = async (consumer: string): Promise<boolean> => {
       return null;
     }),
   );
-  const problems = results.filter((p): p is string => p !== null);
+  const problems = [
+    ...results.filter((p): p is string => p !== null),
+    ...symlinkTargetProblems(lockedFiles, true),
+  ];
   const directiveFiles =
     await findManagedFilesContainingBiomeDirectiveToken(lockedFiles);
   if (problems.length > 0) {
@@ -820,6 +924,15 @@ const prepareProspectiveDependabot = async (
   const existingLocal = await readTextIfPresent(
     join(consumer, DEPENDABOT_LOCAL_FILE),
   );
+  if (
+    existingLocal === null &&
+    localSeed !== null &&
+    localSeed.kind !== 'file'
+  ) {
+    throw new Error(
+      `source seed ${DEPENDABOT_LOCAL_FILE} must be a regular file; replace its symlink with the overlay content`,
+    );
+  }
   const local =
     existingLocal ??
     (localSeed === null || localSeed.kind !== 'file'
@@ -969,6 +1082,7 @@ Commands:
   sync        Mirror canonical files from upstream, regenerate the composed Dependabot config, and rewrite the lock
   check       Verify canonical files, extension seams, monorepo structure, and GitHub settings
   doctor      Validate extension seams only
+  source-text Reject raw control characters in tracked source text
   structure   Validate monorepo structure rules only
   dependabot  Verify (--check) or regenerate (--write) the composed .github/dependabot.yml
   dev-env     Compose each workspace's generated .env.local from its three dev layers and authorized broker-owned S3 pair references
@@ -1002,6 +1116,7 @@ const commandFromArg = (arg: string): Command => {
     arg === 'help' ||
     arg === 'init' ||
     arg === 'poller' ||
+    arg === 'source-text' ||
     arg === 'structure' ||
     arg === 'sync'
   ) {
@@ -1209,10 +1324,24 @@ const runStructure = async (
   return true;
 };
 
+const runSourceTextCheck = (consumer: string): boolean => {
+  const problems = collectSourceTextProblems(consumer);
+  if (problems.length > 0) {
+    console.error(`standards source-text: ${problems.length} problem(s):`);
+    console.error(problems.map((problem) => `  - ${problem}`).join('\n'));
+    return false;
+  }
+  console.log(
+    'standards source-text: tracked source text contains no forbidden control characters',
+  );
+  return true;
+};
+
 const runCheckCommand = async (consumer: string): Promise<boolean> => {
   const driftIsClean = await runCheck(consumer);
   const integrationIsValid = await runDoctor(consumer);
   const structureIsValid = await runStructure(consumer, 'consumer');
+  const sourceTextIsValid = runSourceTextCheck(consumer);
   // The GitHub gate activates with the synced declaration and then fails
   // closed: once .github/settings.json exists, an unreachable API or an
   // unreadable origin is a failure, not a skip.
@@ -1220,7 +1349,11 @@ const runCheckCommand = async (consumer: string): Promise<boolean> => {
     ? await runGithubCheckGate(consumer)
     : true;
   return (
-    driftIsClean && integrationIsValid && structureIsValid && githubIsConverged
+    driftIsClean &&
+    integrationIsValid &&
+    structureIsValid &&
+    sourceTextIsValid &&
+    githubIsConverged
   );
 };
 
@@ -1296,6 +1429,7 @@ const runGateCommand = (
     | 'dev-env'
     | 'doctor'
     | 'github'
+    | 'source-text'
     | 'structure',
   consumer: string,
   apply: boolean,
@@ -1313,6 +1447,9 @@ const runGateCommand = (
   if (command === 'doctor') {
     return runDoctor(consumer);
   }
+  if (command === 'source-text') {
+    return Promise.resolve(runSourceTextCheck(consumer));
+  }
   if (command === 'structure') {
     return runStructure(consumer, profile);
   }

package/src/creds-add-github.ts

@@ -8,7 +8,7 @@ import { inspectDestinations } from './creds-add-preflight';
 import { resolveContext } from './creds-dest';
 import { verifyGithubAppInstallation } from './creds-github-app-api';
 import {
-  loadOwnedGithubStore,
+  refreshOwnedGithubStore,
   sameGithubApp,
   selectGithubAppForRepo,
 } from './creds-github-apps';
@@ -26,9 +26,11 @@ export const runCredsAddGithub = async (
     return false;
   }
   const appIdPath = `${context.dest.key}.app_id`;
+  const clientIdPath = `${context.dest.key}.client_id`;
   const privateKeyPath = `${context.dest.key}.private_key`;
   const blocked = await inspectDestinations(consumer, context.rel, [
     appIdPath,
+    clientIdPath,
     privateKeyPath,
   ]);
   if (blocked.problem !== null) {
@@ -36,7 +38,11 @@ export const runCredsAddGithub = async (
     return false;
   }
   const storePath = resolveBrokerPath();
-  const loaded = await loadOwnedGithubStore(storePath);
+  const loaded = await refreshOwnedGithubStore(
+    storePath,
+    undefined,
+    context.repo.split('/')[0],
+  );
   if (!loaded.ok) {
     console.error(`standards creds: ${loaded.problem}`);
     return false;
@@ -54,7 +60,7 @@ export const runCredsAddGithub = async (
     console.error(`standards creds: ${installation.problem}`);
     return false;
   }
-  const { appId, privateKey, slug } = selected.value;
+  const { appId, clientId, privateKey, slug } = selected.value;
   let writeResult:
     | { readonly ok: true }
     | { readonly ok: false; readonly problem: string };
@@ -75,6 +81,7 @@ export const runCredsAddGithub = async (
       }
       return setSopsValues(consumer, context.rel, [
         { path: appIdPath, value: String(appId) },
+        { path: clientIdPath, value: clientId },
         { path: privateKeyPath, value: privateKey },
       ]);
     });
@@ -89,6 +96,7 @@ export const runCredsAddGithub = async (
   }
   const verified = [
     { path: appIdPath, value: String(appId) },
+    { path: clientIdPath, value: clientId },
     { path: privateKeyPath, value: privateKey },
   ].map(({ path, value }) => ({
     path,
@@ -109,7 +117,7 @@ export const runCredsAddGithub = async (
     return false;
   }
   console.log(
-    `standards creds: wrote App ${slug} credentials to ${context.rel} at ${context.dest.key}.{app_id,private_key}`,
+    `standards creds: wrote App ${slug} credentials to ${context.rel} at ${context.dest.key}.{app_id,client_id,private_key}`,
   );
   console.log(
     '  workflows mint short-lived installation tokens from these at runtime (actions/create-github-app-token), scoped per repository and permission',

package/src/creds-add.ts

@@ -19,6 +19,8 @@ import {
   s3PairPaths,
 } from './creds-r2';
 import { readEncryptedKeys, setSopsValues } from './creds-sops';
+import { resolveBrokerPath } from './creds-store';
+import { withBrokerLock } from './creds-store-lock';
 import { refreshDevEnvForSopsWrites } from './dev-env-brokered-refresh';
 
 const DEFAULT_TTL_DAYS = 90;
@@ -80,7 +82,7 @@ const warnOccupiedDestinations = (
   }
 };
 
-export const runCredsAddCloudflare = async (
+const addCloudflareWhileLocked = async (
   consumer: string,
   options: {
     readonly dest: string | undefined;
@@ -196,3 +198,14 @@ export const runCredsAddCloudflare = async (
     addRefreshEvidence(format, context.dest),
   );
 };
+
+// Share the transaction boundary with renewal and duplicate retirement. No
+// contender may mint from an outdated collision check or retire an in-flight
+// token before its destination is durably verified.
+export const runCredsAddCloudflare = (
+  consumer: string,
+  options: Parameters<typeof addCloudflareWhileLocked>[1],
+): Promise<boolean> =>
+  withBrokerLock(resolveBrokerPath(), () =>
+    addCloudflareWhileLocked(consumer, options),
+  );

package/src/creds-commands.ts

@@ -31,7 +31,7 @@ Options:
   --dir <path>          Repository to operate on (default: current directory)
   --dest <target>:<key> SOPS destination, e.g. ci:ci.cloudflare_dns_token
   --permissions <list>  Comma-separated Cloudflare permission group names
-  --account <id>        Cloudflare account when more than one is configured
+  --account <id>        Cloudflare account for login, add, revoke, or permissions; plan/apply always cover all accounts
   --ttl-days <n>        Token lifetime in days (default: 90)
   --bucket <name>       Scope a Cloudflare token to one R2 bucket
   --zone <zone-id>      Add a zone resource for zone-scoped groups (comma-separated IDs)
@@ -112,6 +112,12 @@ export const runCredsCommand = (
     console.log(CREDS_USAGE);
     return Promise.resolve(route === 'help');
   }
+  if (flags.account !== undefined && (route === 'plan' || route === 'apply')) {
+    console.error(
+      `standards creds: ${route} always covers every configured account; --account is not supported for this command`,
+    );
+    return Promise.resolve(false);
+  }
   const handlers: Readonly<Record<string, () => Promise<boolean>>> = {
     'login github': () =>
       runCredsLoginGithub({ name: flags.name, org: flags.org }),

package/src/creds-github-apps.ts

@@ -57,6 +57,72 @@ export const loadOwnedGithubStore = async (
   return { ok: true, value: migrated };
 };
 
+// Refresh authenticated metadata before selecting by a mutable owner login.
+// Owner changes are committed together, and concurrent credential replacement
+// aborts the refresh rather than attaching stale metadata to a different App.
+export const refreshOwnedGithubStore = async (
+  path: string,
+  lookupOwner: (
+    app: GithubBrokerApp,
+  ) => Promise<GithubAppsResult<string>> = resolveGithubAppOwner,
+  requestedOwner?: string,
+): Promise<GithubAppsResult<BrokerStore>> => {
+  const loaded = await loadOwnedGithubStore(path, lookupOwner);
+  if (!loaded.ok) {
+    return loaded;
+  }
+  const observed = loaded.value.github;
+  const hasDirectMatch = observed.some(
+    (app) => app.owner?.toLowerCase() === requestedOwner?.toLowerCase(),
+  );
+  const results = await Promise.all(
+    observed.map((app) =>
+      hasDirectMatch &&
+      app.owner?.toLowerCase() !== requestedOwner?.toLowerCase()
+        ? Promise.resolve({ ok: true as const, value: app.owner ?? '' })
+        : lookupOwner(app),
+    ),
+  );
+  const failed = results.find((result) => !result.ok);
+  if (failed !== undefined && !failed.ok) {
+    return {
+      ok: false,
+      problem: `cannot refresh authenticated GitHub App owners: ${failed.problem}; keep existing credentials and retry before creating another App`,
+    };
+  }
+  const refreshed = observed.map((app, index) => {
+    const result = results[index];
+    return result?.ok ? { ...app, owner: result.value } : app;
+  });
+  if (refreshed.every((app, index) => app.owner === observed[index]?.owner)) {
+    return loaded;
+  }
+  const committed = { value: loaded.value };
+  try {
+    await updateBrokerStore(path, (current) => {
+      if (
+        current.github.length !== observed.length ||
+        !current.github.every((app, index) => {
+          const previous = observed[index];
+          return previous !== undefined && sameGithubApp(app, previous);
+        })
+      ) {
+        throw new Error(
+          'GitHub Apps changed while authenticated owners were refreshed; retry',
+        );
+      }
+      committed.value = { ...current, github: refreshed };
+      return committed.value;
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      problem: error instanceof Error ? error.message : String(error),
+    };
+  }
+  return { ok: true, value: committed.value };
+};
+
 // Private Apps belong to one owner. Selecting by repository owner keeps each
 // owner's credentials separate; installation access is verified before export.
 export const selectGithubAppForRepo = (
@@ -79,10 +145,13 @@ export const selectGithubAppForRepo = (
   const loginHint =
     apps.length === 0
       ? 'no broker GitHub Apps are configured'
-      : `configured owners: ${apps.map((app) => app.owner).join(', ')}`;
+      : `authenticated configured owners: ${apps.map((app) => app.owner).join(', ')}; if an account was renamed, update this checkout origin to the current owner shown here before retrying; do not create a duplicate App for a renamed account`;
   return {
     ok: false,
-    problem: `no broker GitHub App is configured for repository owner ${owner} (${loginHint}); run \`standards creds login github --org ${owner}\` for an organization, or run it without --org while signed in as ${owner}`,
+    problem:
+      apps.length > 0
+        ? `no broker GitHub App matches repository owner ${owner} (${loginHint}); verify the origin and existing App ownership before configuring a new App`
+        : `no broker GitHub App is configured for repository owner ${owner} (${loginHint}); run \`standards creds login github --org ${owner}\` for an organization, or run it without --org while signed in as ${owner}`,
   };
 };
 

package/src/creds-login-cloudflare.ts

@@ -83,6 +83,12 @@ export const verifyCloudflareBootstrapAuthority = async (
       problem: `the token is named "${identified.value.name}", inside the broker's minted-token namespace — bootstrap credentials must remain distinguishable from minted credentials; rename it ${BROKER_IDENTITY_NAME} in the dashboard and re-run login`,
     };
   }
+  if (identified.value.name.toLowerCase() !== BROKER_IDENTITY_NAME) {
+    return {
+      ok: false,
+      problem: `bootstrap tokens must use the reserved name ${BROKER_IDENTITY_NAME}; rename this token in the dashboard and re-run login so other machines cannot revoke it as unmanaged`,
+    };
+  }
   return { ok: true, value: { tokenName: identified.value.name } };
 };
 
@@ -136,12 +142,6 @@ export const runCredsLoginCloudflare = async (options: {
     );
     return false;
   }
-  const { tokenName } = verified.value;
-  if (tokenName !== BROKER_IDENTITY_NAME) {
-    console.error(
-      `standards creds: warning — the token is named "${tokenName}", not "${BROKER_IDENTITY_NAME}"; rename it in the dashboard so it stays identifiable`,
-    );
-  }
   await updateBrokerStore(storePath, (current) => {
     if (current.cloudflare.some((entry) => entry.accountId === accountId)) {
       throw new Error(

package/src/creds-login-github.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openInBrowser } from './creds-browser';
 import {
-  loadOwnedGithubStore,
+  refreshOwnedGithubStore,
   sameGithubApp,
   upsertGithubApp,
 } from './creds-github-apps';
@@ -115,7 +115,11 @@ export const runCredsLoginGithub = async (
     return false;
   }
   const storePath = resolveBrokerPath();
-  const loaded = await loadOwnedGithubStore(storePath);
+  const loaded = await refreshOwnedGithubStore(
+    storePath,
+    undefined,
+    options.org,
+  );
   if (!loaded.ok) {
     console.error(`standards creds: ${loaded.problem}`);
     return false;