@davidvornholt/standards 0.26.4 → 0.27.0

package/README.md

@@ -148,6 +148,31 @@ brokeredReferences:
 
 The referenced target must contain both `access_key_id` and `secret_access_key`. Every generated `.env.local`, transaction artifact, and `config/dev.local.yaml` must be ignored by Git.
 
+A pair owned by another repository uses an explicit source descriptor. The checkout path is resolved relative to the consumer root; put machine-specific paths in ignored `config/dev.local.yaml`.
+
+```yaml
+apps:
+  web:
+    S3_ACCESS_KEY_ID:
+      brokeredS3: garage
+      key: garage.development
+      part: access_key_id
+      source:
+        repository: owner/source
+        checkout: ../source
+    S3_SECRET_ACCESS_KEY:
+      brokeredS3: garage
+      key: garage.development
+      part: secret_access_key
+      source:
+        repository: owner/source
+        checkout: ../source
+```
+
+The consumer's encrypted allowlist must authorize the exact repository, target, and key as `owner/source@garage:garage.development`. Local target authorization does not authorize an external source. The source must be a Git checkout root whose `origin` is that GitHub repository, with no symlinked checkout or target path. Targets remain contained regular SOPS files under the source repository. One source repository must resolve to one checkout per generation. This verifies a maintainer-managed checkout's identity; it does not attest untrusted local Git configuration.
+
+Run `bun standards dev-env` in the consumer after updating the source checkout or rotating its pair. Both values are read from the one encrypted owner and only written to ignored generated environments. Rotation in a separate source repository cannot discover or update other workstations automatically. All selected source references and configuration are validated before any source target is decrypted; a failed generation leaves previous environments intact.
+
 ## github
 
 ```sh
@@ -205,7 +230,13 @@ To delete one Cloudflare token outside normal reconciliation:
 bun standards creds revoke --account <account-id> --token-id <token-id>
 ```
 
-Bootstrap credentials and tokens still owned by an active repository are refused.
+For same-name brokered duplicates left by interrupted renewal, keep the stored key intact and select the unused token ID. `revoke` proves which credential is stored, refuses that token, and rechecks the destination before deleting the selected duplicate. Unreadable or unidentifiable stored credentials leave every token intact. A destination already missing its key can also be recovered after successful decryption.
+
+Bootstrap credentials and singular tokens still owned by an active repository are refused.
+
+### Prepare existing consumers for GitHub App client IDs
+
+`standards creds add github --dest ci:ci.broker_app` writes and verifies `app_id`, `client_id`, and `private_key` together. Run it in each existing consumer, mirror the new `client_id` key with a placeholder in its `secrets/ci.example.yaml`, and commit both files before adopting a workflow that resolves `broker_app.client_id` and passes `client-id` to `actions/create-github-app-token@v3`. The numeric `app_id` remains available while existing workflows are migrated. Do not remove it until every local and canonical caller has switched. Canonical workflows continue using `app-id` until consumer provisioning is complete.
 
 ## screenshots
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.26.4",
+  "version": "0.27.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -56,6 +56,7 @@
     "src/creds-prompt.ts",
     "src/creds-r2.ts",
     "src/creds-revoke.ts",
+    "src/creds-revoke-duplicate.ts",
     "src/creds-sops.ts",
     "src/creds-sops-editor.ts",
     "src/creds-sops-structure.ts",
@@ -74,8 +75,10 @@
     "src/dependabot-directory-overlap.ts",
     "src/dependabot-inspect.ts",
     "src/dependabot-update.ts",
+    "src/dev-env-brokered-source.ts",
     "src/dev-env-brokered.ts",
     "src/dev-env-brokered-allowlist.ts",
+    "src/dev-env-brokered-preflight.ts",
     "src/dev-env-brokered-preserve.ts",
     "src/dev-env-brokered-resolve.ts",
     "src/dev-env-brokered-refresh.ts",
@@ -173,7 +176,8 @@
     "src/structure-workspace.ts",
     "src/sync-policy.ts",
     "src/yaml-emit.ts",
-    "src/yaml-parse.ts"
+    "src/yaml-parse.ts",
+    "src/sops-action-callers.ts"
   ],
   "scripts": {
     "lint": "biome check --error-on-warnings .",

package/src/cli.ts

@@ -44,6 +44,7 @@ import {
 } from './managed-path-ownership';
 import { runPollerCommand } from './poller-commands';
 import { runScreenshotsCommand } from './screenshots-commands';
+import { collectSopsActionCallerProblems } from './sops-action-callers';
 import { collectSourceTextProblems } from './source-text';
 import { collectStructureProblems } from './structure-check';
 import type { StructureProfile } from './structure-profile';
@@ -155,13 +156,90 @@ const symlinkTargetProblem = (rel: string, target: string): string | null => {
   return null;
 };
 
+// Resolve components in filesystem order: missing/../real is dangling, and a
+// symlink component must be followed before a subsequent .. is interpreted.
+const MAX_SYMLINK_TRAVERSALS = 40;
+type ManagedTargetTraversal = {
+  readonly pending: Array<string>;
+  readonly resolved: Array<string>;
+  traversals: number;
+};
+const resolveManagedComponent = (
+  component: string,
+  state: ManagedTargetTraversal,
+  entries: ReadonlyMap<string, ManagedEntry>,
+): boolean => {
+  if (component === '' || component === '.') {
+    return true;
+  }
+  if (component === '..') {
+    return state.resolved.pop() !== undefined;
+  }
+  const path = [...state.resolved, component].join('/');
+  const entry = entries.get(path);
+  if (entry?.kind === 'symlink') {
+    state.traversals += 1;
+    if (
+      state.traversals > MAX_SYMLINK_TRAVERSALS ||
+      symlinkTargetProblem(path, entry.target) !== null
+    ) {
+      return false;
+    }
+    state.pending.unshift(...entry.target.split('/'));
+    return true;
+  }
+  const directory = [...entries.keys()].some((key) =>
+    key.startsWith(`${path}/`),
+  );
+  if (
+    !(directory || entry?.kind === 'file') ||
+    (state.pending.length > 0 && !directory)
+  ) {
+    return false;
+  }
+  state.resolved.push(component);
+  return true;
+};
+const managedTargetExists = (
+  target: string,
+  entries: ReadonlyMap<string, ManagedEntry>,
+): boolean => {
+  const state: ManagedTargetTraversal = {
+    pending: target.split('/'),
+    resolved: [],
+    // The original managed symlink also consumes one kernel traversal.
+    traversals: 1,
+  };
+  while (state.pending.length > 0) {
+    const component = state.pending.shift();
+    if (
+      component !== undefined &&
+      !resolveManagedComponent(component, state, entries)
+    ) {
+      return false;
+    }
+  }
+  return true;
+};
+
 const symlinkTargetProblems = (
   entries: ReadonlyMap<string, ManagedEntry>,
+  requireManagedTarget = false,
 ): ReadonlyArray<string> =>
   [...entries]
-    .map(([rel, entry]) =>
-      entry.kind === 'symlink' ? symlinkTargetProblem(rel, entry.target) : null,
-    )
+    .map(([rel, entry]) => {
+      if (entry.kind !== 'symlink') {
+        return null;
+      }
+      const problem = symlinkTargetProblem(rel, entry.target);
+      if (problem !== null) {
+        return problem;
+      }
+      const target = `${posix.dirname(rel)}/${entry.target}`;
+      return requireManagedTarget && !managedTargetExists(target, entries)
+        ? `canonical symlink ${rel} targets ${target}, which is missing from the managed payload or forms a symlink cycle`
+        : null;
+    })
     .filter((problem): problem is string => problem !== null);
 
 const parseManifest = (raw: unknown): Manifest => {
@@ -334,6 +412,10 @@ const mirrorPreconditionProblems = async (
   const locked = new Set(Object.keys(previous));
   const collisions = await Promise.all(
     [...upstream.keys()].map(async (rel) => {
+      const ancestor = await interposedAncestor(consumer, rel, upstream);
+      if (ancestor !== null) {
+        return `${rel} is below the ${ancestor.kind} ${ancestor.rel}; refusing to write through an existing file or symlink ancestor; move it aside before syncing this payload`;
+      }
       const current = await inspectManagedPath(join(consumer, rel));
       if (current?.kind !== 'directory') {
         return null;
@@ -345,7 +427,8 @@ const mirrorPreconditionProblems = async (
     }),
   );
   return [
-    ...symlinkTargetProblems(upstream),
+    ...symlinkTargetProblems(upstream, true),
+    ...(await collectSopsActionCallerProblems(consumer, upstream)),
     ...collisions.filter((problem): problem is string => problem !== null),
   ];
 };
@@ -364,16 +447,16 @@ const assertNoProblems = (
 };
 
 type PruneOutcome =
-  | { readonly kind: 'absent' }
+  | { readonly kind: 'replaced'; readonly rel: string }
   | { readonly kind: 'delete'; readonly rel: string }
   | { readonly kind: 'retain'; readonly note: string }
   | { readonly kind: 'stale'; readonly note: string };
 
 // Two things the prune pass must never do: resolve through a symlink it (or an
 // older CLI's lock) put in the parent chain, and recursively delete a
-// destination the consumer turned into a directory. Every answer is decided
-// against the shape the mirror leaves behind, not the shape on disk right now,
-// so `--dry-run` predicts what the matching real run does.
+// destination the consumer turned into a directory. Ancestor inspection uses
+// planned canonical replacements so dry-run and application classify the same
+// stale lock entries.
 const pruneOutcome = async (
   consumer: string,
   rel: string,
@@ -390,13 +473,21 @@ const pruneOutcome = async (
   // whether or not a directory still stands there while a dry run looks.
   const current =
     ancestor === null ? await inspectManagedPath(join(consumer, rel)) : null;
+  if (ancestor?.kind === 'file' && planned.has(ancestor.rel)) {
+    return { kind: 'replaced', rel };
+  }
   if (current === null) {
-    return { kind: 'absent' };
+    return {
+      kind: 'stale',
+      note: `${rel} (already absent; nothing was deleted)`,
+    };
   }
   if (current.kind === 'directory') {
     return {
       kind: 'retain',
-      note: `${rel}: removed upstream but now a directory this repository does not manage; delete it yourself if you no longer want it`,
+      note: [...planned.keys()].some((path) => path.startsWith(`${rel}/`))
+        ? `${rel}: removed upstream as a file, but retained as a directory containing canonical paths; keep those managed descendants`
+        : `${rel}: removed upstream but now a directory this repository does not manage; delete it yourself if you no longer want it`,
     };
   }
   return { kind: 'delete', rel };
@@ -434,7 +525,16 @@ const prune = async (
       deleted.map((rel) => rm(join(consumer, rel), { force: true })),
     );
   }
-  return { deleted, retained, stale };
+  return {
+    deleted: [
+      ...deleted,
+      ...outcomes.flatMap((outcome) =>
+        outcome.kind === 'replaced' ? [outcome.rel] : [],
+      ),
+    ],
+    retained,
+    stale,
+  };
 };
 
 // Mirror managed files into the consumer, deleting any previously-locked file
@@ -477,9 +577,8 @@ const mirror = async ({
       }
       if (!dryRun) {
         await mkdir(dirname(dest), { recursive: true });
-        // The precondition above proved every path inside this directory is one
-        // the lock already records, so replacing it restores the managed shape
-        // rather than destroying consumer work.
+        // The precondition proved every non-directory entry is locked. Empty
+        // directories are not tracked and are removed with the old shape.
         if (current?.kind === 'directory') {
           await rm(dest, { recursive: true, force: true });
         }
@@ -669,7 +768,7 @@ const runSync = async (
 
 // Offline drift detection: every locked file must still match its hash. Catches
 // local edits or deletions of canonical files. Does NOT detect upstream moving
-// on — see the "known limitation" in the standards repository README.
+// on. Mirror preconditions reject those ancestor conflicts before any writes.
 const runCheck = async (consumer: string): Promise<boolean> => {
   const lock = await readLock(consumer);
   if (lock === null || Object.keys(lock.files).length === 0) {
@@ -696,7 +795,10 @@ const runCheck = async (consumer: string): Promise<boolean> => {
       return null;
     }),
   );
-  const problems = results.filter((p): p is string => p !== null);
+  const problems = [
+    ...results.filter((p): p is string => p !== null),
+    ...symlinkTargetProblems(lockedFiles, true),
+  ];
   const directiveFiles =
     await findManagedFilesContainingBiomeDirectiveToken(lockedFiles);
   if (problems.length > 0) {
@@ -822,6 +924,15 @@ const prepareProspectiveDependabot = async (
   const existingLocal = await readTextIfPresent(
     join(consumer, DEPENDABOT_LOCAL_FILE),
   );
+  if (
+    existingLocal === null &&
+    localSeed !== null &&
+    localSeed.kind !== 'file'
+  ) {
+    throw new Error(
+      `source seed ${DEPENDABOT_LOCAL_FILE} must be a regular file; replace its symlink with the overlay content`,
+    );
+  }
   const local =
     existingLocal ??
     (localSeed === null || localSeed.kind !== 'file'

package/src/creds-add-github.ts

@@ -8,7 +8,7 @@ import { inspectDestinations } from './creds-add-preflight';
 import { resolveContext } from './creds-dest';
 import { verifyGithubAppInstallation } from './creds-github-app-api';
 import {
-  loadOwnedGithubStore,
+  refreshOwnedGithubStore,
   sameGithubApp,
   selectGithubAppForRepo,
 } from './creds-github-apps';
@@ -26,9 +26,11 @@ export const runCredsAddGithub = async (
     return false;
   }
   const appIdPath = `${context.dest.key}.app_id`;
+  const clientIdPath = `${context.dest.key}.client_id`;
   const privateKeyPath = `${context.dest.key}.private_key`;
   const blocked = await inspectDestinations(consumer, context.rel, [
     appIdPath,
+    clientIdPath,
     privateKeyPath,
   ]);
   if (blocked.problem !== null) {
@@ -36,7 +38,11 @@ export const runCredsAddGithub = async (
     return false;
   }
   const storePath = resolveBrokerPath();
-  const loaded = await loadOwnedGithubStore(storePath);
+  const loaded = await refreshOwnedGithubStore(
+    storePath,
+    undefined,
+    context.repo.split('/')[0],
+  );
   if (!loaded.ok) {
     console.error(`standards creds: ${loaded.problem}`);
     return false;
@@ -54,7 +60,7 @@ export const runCredsAddGithub = async (
     console.error(`standards creds: ${installation.problem}`);
     return false;
   }
-  const { appId, privateKey, slug } = selected.value;
+  const { appId, clientId, privateKey, slug } = selected.value;
   let writeResult:
     | { readonly ok: true }
     | { readonly ok: false; readonly problem: string };
@@ -75,6 +81,7 @@ export const runCredsAddGithub = async (
       }
       return setSopsValues(consumer, context.rel, [
         { path: appIdPath, value: String(appId) },
+        { path: clientIdPath, value: clientId },
         { path: privateKeyPath, value: privateKey },
       ]);
     });
@@ -89,6 +96,7 @@ export const runCredsAddGithub = async (
   }
   const verified = [
     { path: appIdPath, value: String(appId) },
+    { path: clientIdPath, value: clientId },
     { path: privateKeyPath, value: privateKey },
   ].map(({ path, value }) => ({
     path,
@@ -109,7 +117,7 @@ export const runCredsAddGithub = async (
     return false;
   }
   console.log(
-    `standards creds: wrote App ${slug} credentials to ${context.rel} at ${context.dest.key}.{app_id,private_key}`,
+    `standards creds: wrote App ${slug} credentials to ${context.rel} at ${context.dest.key}.{app_id,client_id,private_key}`,
   );
   console.log(
     '  workflows mint short-lived installation tokens from these at runtime (actions/create-github-app-token), scoped per repository and permission',

package/src/creds-add.ts

@@ -19,6 +19,8 @@ import {
   s3PairPaths,
 } from './creds-r2';
 import { readEncryptedKeys, setSopsValues } from './creds-sops';
+import { resolveBrokerPath } from './creds-store';
+import { withBrokerLock } from './creds-store-lock';
 import { refreshDevEnvForSopsWrites } from './dev-env-brokered-refresh';
 
 const DEFAULT_TTL_DAYS = 90;
@@ -80,7 +82,7 @@ const warnOccupiedDestinations = (
   }
 };
 
-export const runCredsAddCloudflare = async (
+const addCloudflareWhileLocked = async (
   consumer: string,
   options: {
     readonly dest: string | undefined;
@@ -196,3 +198,14 @@ export const runCredsAddCloudflare = async (
     addRefreshEvidence(format, context.dest),
   );
 };
+
+// Share the transaction boundary with renewal and duplicate retirement. No
+// contender may mint from an outdated collision check or retire an in-flight
+// token before its destination is durably verified.
+export const runCredsAddCloudflare = (
+  consumer: string,
+  options: Parameters<typeof addCloudflareWhileLocked>[1],
+): Promise<boolean> =>
+  withBrokerLock(resolveBrokerPath(), () =>
+    addCloudflareWhileLocked(consumer, options),
+  );

package/src/creds-commands.ts

@@ -31,7 +31,7 @@ Options:
   --dir <path>          Repository to operate on (default: current directory)
   --dest <target>:<key> SOPS destination, e.g. ci:ci.cloudflare_dns_token
   --permissions <list>  Comma-separated Cloudflare permission group names
-  --account <id>        Cloudflare account when more than one is configured
+  --account <id>        Cloudflare account for login, add, revoke, or permissions; plan/apply always cover all accounts
   --ttl-days <n>        Token lifetime in days (default: 90)
   --bucket <name>       Scope a Cloudflare token to one R2 bucket
   --zone <zone-id>      Add a zone resource for zone-scoped groups (comma-separated IDs)
@@ -112,6 +112,12 @@ export const runCredsCommand = (
     console.log(CREDS_USAGE);
     return Promise.resolve(route === 'help');
   }
+  if (flags.account !== undefined && (route === 'plan' || route === 'apply')) {
+    console.error(
+      `standards creds: ${route} always covers every configured account; --account is not supported for this command`,
+    );
+    return Promise.resolve(false);
+  }
   const handlers: Readonly<Record<string, () => Promise<boolean>>> = {
     'login github': () =>
       runCredsLoginGithub({ name: flags.name, org: flags.org }),

package/src/creds-github-apps.ts

@@ -57,6 +57,72 @@ export const loadOwnedGithubStore = async (
   return { ok: true, value: migrated };
 };
 
+// Refresh authenticated metadata before selecting by a mutable owner login.
+// Owner changes are committed together, and concurrent credential replacement
+// aborts the refresh rather than attaching stale metadata to a different App.
+export const refreshOwnedGithubStore = async (
+  path: string,
+  lookupOwner: (
+    app: GithubBrokerApp,
+  ) => Promise<GithubAppsResult<string>> = resolveGithubAppOwner,
+  requestedOwner?: string,
+): Promise<GithubAppsResult<BrokerStore>> => {
+  const loaded = await loadOwnedGithubStore(path, lookupOwner);
+  if (!loaded.ok) {
+    return loaded;
+  }
+  const observed = loaded.value.github;
+  const hasDirectMatch = observed.some(
+    (app) => app.owner?.toLowerCase() === requestedOwner?.toLowerCase(),
+  );
+  const results = await Promise.all(
+    observed.map((app) =>
+      hasDirectMatch &&
+      app.owner?.toLowerCase() !== requestedOwner?.toLowerCase()
+        ? Promise.resolve({ ok: true as const, value: app.owner ?? '' })
+        : lookupOwner(app),
+    ),
+  );
+  const failed = results.find((result) => !result.ok);
+  if (failed !== undefined && !failed.ok) {
+    return {
+      ok: false,
+      problem: `cannot refresh authenticated GitHub App owners: ${failed.problem}; keep existing credentials and retry before creating another App`,
+    };
+  }
+  const refreshed = observed.map((app, index) => {
+    const result = results[index];
+    return result?.ok ? { ...app, owner: result.value } : app;
+  });
+  if (refreshed.every((app, index) => app.owner === observed[index]?.owner)) {
+    return loaded;
+  }
+  const committed = { value: loaded.value };
+  try {
+    await updateBrokerStore(path, (current) => {
+      if (
+        current.github.length !== observed.length ||
+        !current.github.every((app, index) => {
+          const previous = observed[index];
+          return previous !== undefined && sameGithubApp(app, previous);
+        })
+      ) {
+        throw new Error(
+          'GitHub Apps changed while authenticated owners were refreshed; retry',
+        );
+      }
+      committed.value = { ...current, github: refreshed };
+      return committed.value;
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      problem: error instanceof Error ? error.message : String(error),
+    };
+  }
+  return { ok: true, value: committed.value };
+};
+
 // Private Apps belong to one owner. Selecting by repository owner keeps each
 // owner's credentials separate; installation access is verified before export.
 export const selectGithubAppForRepo = (
@@ -79,10 +145,13 @@ export const selectGithubAppForRepo = (
   const loginHint =
     apps.length === 0
       ? 'no broker GitHub Apps are configured'
-      : `configured owners: ${apps.map((app) => app.owner).join(', ')}`;
+      : `authenticated configured owners: ${apps.map((app) => app.owner).join(', ')}; if an account was renamed, update this checkout origin to the current owner shown here before retrying; do not create a duplicate App for a renamed account`;
   return {
     ok: false,
-    problem: `no broker GitHub App is configured for repository owner ${owner} (${loginHint}); run \`standards creds login github --org ${owner}\` for an organization, or run it without --org while signed in as ${owner}`,
+    problem:
+      apps.length > 0
+        ? `no broker GitHub App matches repository owner ${owner} (${loginHint}); verify the origin and existing App ownership before configuring a new App`
+        : `no broker GitHub App is configured for repository owner ${owner} (${loginHint}); run \`standards creds login github --org ${owner}\` for an organization, or run it without --org while signed in as ${owner}`,
   };
 };
 

package/src/creds-login-cloudflare.ts

@@ -83,6 +83,12 @@ export const verifyCloudflareBootstrapAuthority = async (
       problem: `the token is named "${identified.value.name}", inside the broker's minted-token namespace — bootstrap credentials must remain distinguishable from minted credentials; rename it ${BROKER_IDENTITY_NAME} in the dashboard and re-run login`,
     };
   }
+  if (identified.value.name.toLowerCase() !== BROKER_IDENTITY_NAME) {
+    return {
+      ok: false,
+      problem: `bootstrap tokens must use the reserved name ${BROKER_IDENTITY_NAME}; rename this token in the dashboard and re-run login so other machines cannot revoke it as unmanaged`,
+    };
+  }
   return { ok: true, value: { tokenName: identified.value.name } };
 };
 
@@ -136,12 +142,6 @@ export const runCredsLoginCloudflare = async (options: {
     );
     return false;
   }
-  const { tokenName } = verified.value;
-  if (tokenName !== BROKER_IDENTITY_NAME) {
-    console.error(
-      `standards creds: warning — the token is named "${tokenName}", not "${BROKER_IDENTITY_NAME}"; rename it in the dashboard so it stays identifiable`,
-    );
-  }
   await updateBrokerStore(storePath, (current) => {
     if (current.cloudflare.some((entry) => entry.accountId === accountId)) {
       throw new Error(

package/src/creds-login-github.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openInBrowser } from './creds-browser';
 import {
-  loadOwnedGithubStore,
+  refreshOwnedGithubStore,
   sameGithubApp,
   upsertGithubApp,
 } from './creds-github-apps';
@@ -115,7 +115,11 @@ export const runCredsLoginGithub = async (
     return false;
   }
   const storePath = resolveBrokerPath();
-  const loaded = await loadOwnedGithubStore(storePath);
+  const loaded = await refreshOwnedGithubStore(
+    storePath,
+    undefined,
+    options.org,
+  );
   if (!loaded.ok) {
     console.error(`standards creds: ${loaded.problem}`);
     return false;

package/src/creds-naming.ts

@@ -60,7 +60,10 @@ export const parseTokenName = (
   repo: string,
 ): BrokeredTokenRef | null => {
   const prefix = repoTokenPrefix(repo);
-  if (!name.startsWith(prefix)) {
+  if (
+    !isInMintedNamespace(name) ||
+    name.slice(0, prefix.length).toLowerCase() !== prefix.toLowerCase()
+  ) {
     return null;
   }
   const rest = name.slice(prefix.length);

package/src/creds-plan-renew.ts

@@ -8,7 +8,8 @@ import type { PlannedAction } from './creds-plan-types';
 import { destinationWrites, s3AccessKeyPath, s3PairPaths } from './creds-r2';
 import { inspectSopsScalarDestination, setSopsValues } from './creds-sops';
 import { verifySopsStoredValue } from './creds-sops-value';
-import type { CloudflareBrokerAccount } from './creds-store';
+import { type CloudflareBrokerAccount, resolveBrokerPath } from './creds-store';
+import { withBrokerLock } from './creds-store-lock';
 import { resolveTargetRelResult } from './creds-target';
 import type { BrokeredRefreshEvidence } from './dev-env-brokered-refresh';
 
@@ -63,7 +64,7 @@ const inspectRenewDestinations = async (
     : null;
 };
 
-export const renewPlannedToken = async (
+const renewWhileLocked = async (
   consumer: string,
   account: CloudflareBrokerAccount,
   action: RenewAction,
@@ -151,3 +152,14 @@ export const renewPlannedToken = async (
     refreshEvidence(action, 'verified'),
   );
 };
+
+// Duplicate retirement uses this same lock. Hold it before minting until the
+// replacement is durably verified and the old token's deletion has finished.
+export const renewPlannedToken = (
+  consumer: string,
+  account: CloudflareBrokerAccount,
+  action: RenewAction,
+): Promise<RenewPlannedTokenResult> =>
+  withBrokerLock(resolveBrokerPath(), () =>
+    renewWhileLocked(consumer, account, action),
+  );

package/src/creds-plan-report.ts

@@ -25,7 +25,7 @@ const revokeCommand = (token: UnmanagedToken, extra: string): string =>
 // send the operator down a dead end. The remedy is the dashboard, which is
 // also the only place the machine it belongs to can be confirmed.
 const unmanagedRemedy = (token: UnmanagedToken): string =>
-  token.name === BROKER_IDENTITY_NAME
+  token.name.toLowerCase() === BROKER_IDENTITY_NAME
     ? "the reserved name for a machine's broker bootstrap credential, which `revoke` refuses; retire it in the Cloudflare dashboard, where you can confirm which machine it belongs to"
     : `retire it with ${revokeCommand(token, '')}`;
 

package/src/creds-plan-unmanaged.ts

@@ -8,7 +8,6 @@
 import type { CloudflareToken } from './creds-cloudflare-api';
 import {
   type BrokeredTokenRef,
-  isInMintedNamespace,
   parseAnyTokenName,
   parseTokenName,
   repoTokenPrefix,
@@ -39,7 +38,9 @@ const classifyAccountToken = (
   if (token.status === 'expired') {
     return { kind: 'ignored' };
   }
-  if (token.name.startsWith(repoTokenPrefix(repo))) {
+  if (
+    token.name.toLowerCase().startsWith(repoTokenPrefix(repo).toLowerCase())
+  ) {
     return { kind: 'malformed' };
   }
   // A brokered name carries the repository that owns it, which normally
@@ -53,9 +54,7 @@ const classifyAccountToken = (
   if (elsewhere !== null) {
     return { kind: 'brokered-elsewhere', repo: elsewhere.repo };
   }
-  return isInMintedNamespace(token.name)
-    ? { kind: 'ignored' }
-    : { kind: 'unmanaged' };
+  return { kind: 'unmanaged' };
 };
 
 export type ManagedTokenRef = AccountToken & {

package/src/creds-plan.ts

@@ -133,7 +133,7 @@ const dispositionForGroup = (
     const [first] = group;
     return {
       kind: 'finding',
-      finding: `ambiguous Cloudflare tokens have destination footprints intersecting in ${first?.ref.target}: ${group.map((candidate) => `${candidate.ref.key} (${candidate.accountId}/${candidate.token.id})`).join(', ')}; revoke duplicates manually before plan/apply`,
+      finding: `ambiguous Cloudflare tokens have destination footprints intersecting in ${first?.ref.target}: ${group.map((candidate) => `${candidate.ref.key} (${candidate.accountId}/${candidate.token.id})`).join(', ')}; for same-name duplicates, keep the encrypted key intact and use \`standards creds revoke --account <account-id> --token-id <duplicate-id>\` to retire only a token proven not to be stored; resolve other intersecting destinations before plan/apply`,
     };
   }
   const [entry] = group;