@davidvornholt/standards 0.12.0 → 0.14.0

package/src/creds-login-cloudflare.ts

@@ -0,0 +1,155 @@
+// Cloudflare broker bootstrap. Cloudflare's API can create account-owned
+// tokens, but the very first token must come from the dashboard — this is the
+// one paste per account, ever. The flow tells the user exactly what to click
+// and which single permission to grant, takes the token hidden, verifies it
+// against the API before storing, and from then on every real credential is a
+// scoped, expiring account token minted by `standards creds add`.
+
+import { openInBrowser } from './creds-browser';
+import { listAccountTokens, verifyAccountToken } from './creds-cloudflare';
+import { isCloudflareAccountId } from './creds-cloudflare-account';
+import type { CfResult, CloudflareToken } from './creds-cloudflare-api';
+import { BROKER_IDENTITY_NAME, isInMintedNamespace } from './creds-naming';
+import { promptHidden, promptLine } from './creds-prompt';
+import {
+  readBrokerStore,
+  resolveBrokerPath,
+  updateBrokerStore,
+} from './creds-store';
+
+type IdentifiedBootstrapToken = {
+  readonly id: string;
+  readonly name: string;
+  readonly tokens: ReadonlyArray<CloudflareToken>;
+};
+
+export const identifyCloudflareBootstrapAuthority = async (
+  accountId: string,
+  token: string,
+): Promise<CfResult<IdentifiedBootstrapToken>> => {
+  const verified = await verifyAccountToken(accountId, token);
+  if (!verified.ok) {
+    return {
+      ok: false,
+      problem: `activity verification failed — ${verified.problem}`,
+    };
+  }
+  if (verified.value.status !== 'active') {
+    return {
+      ok: false,
+      problem: `token status is "${verified.value.status}", not "active"`,
+    };
+  }
+  const listed = await listAccountTokens(accountId, token);
+  if (!listed.ok) {
+    return {
+      ok: false,
+      problem: `token cannot list account API tokens — ${listed.problem}; grant Account / Account API Tokens / Edit`,
+    };
+  }
+  const own = listed.value.find((entry) => entry.id === verified.value.id);
+  if (own === undefined) {
+    return {
+      ok: false,
+      problem: `complete token list did not contain verified token ID ${verified.value.id}`,
+    };
+  }
+  if (own.status !== 'active') {
+    return {
+      ok: false,
+      problem: `the token verified as active but the account token list reports status "${own.status}"; refusing the contradictory provider response`,
+    };
+  }
+  return {
+    ok: true,
+    value: { id: verified.value.id, name: own.name, tokens: listed.value },
+  };
+};
+
+export const verifyCloudflareBootstrapAuthority = async (
+  accountId: string,
+  token: string,
+): Promise<CfResult<{ readonly tokenName: string }>> => {
+  const identified = await identifyCloudflareBootstrapAuthority(
+    accountId,
+    token,
+  );
+  if (!identified.ok) {
+    return identified;
+  }
+  if (isInMintedNamespace(identified.value.name)) {
+    return {
+      ok: false,
+      problem: `the token is named "${identified.value.name}", inside the broker's minted-token namespace — bootstrap credentials must remain distinguishable from minted credentials; rename it ${BROKER_IDENTITY_NAME} in the dashboard and re-run login`,
+    };
+  }
+  return { ok: true, value: { tokenName: identified.value.name } };
+};
+
+export const runCredsLoginCloudflare = async (options: {
+  readonly account: string | undefined;
+}): Promise<boolean> => {
+  const accountId =
+    options.account ??
+    (await promptLine(
+      'Cloudflare account ID (dash.cloudflare.com, account home, "Account ID" in the sidebar): ',
+    ));
+  if (!isCloudflareAccountId(accountId)) {
+    console.error(
+      'standards creds: a Cloudflare account ID is 32 lowercase hexadecimal characters',
+    );
+    return false;
+  }
+  const storePath = resolveBrokerPath();
+  const store = await readBrokerStore(storePath);
+  if (store.cloudflare.some((entry) => entry.accountId === accountId)) {
+    console.error(
+      `standards creds: account ${accountId} is already configured; remove its entry from ${storePath} to replace the bootstrap token`,
+    );
+    return false;
+  }
+  const tokensUrl = `https://dash.cloudflare.com/${accountId}/api-tokens`;
+  console.log('Create the bootstrap token (one time for this account):');
+  console.log(`  1. Open ${tokensUrl}`);
+  console.log('  2. Select Create Token');
+  console.log('  3. Find Create additional tokens and select Use template');
+  console.log(`  4. Name it ${BROKER_IDENTITY_NAME}`);
+  console.log(
+    '  5. Keep exactly one permission: Account / Account API Tokens / Edit',
+  );
+  console.log('  6. Continue to summary, create the token, and copy the value');
+  openInBrowser(tokensUrl);
+  const token = await promptHidden('Paste the token (input is hidden): ');
+  if (token.length === 0) {
+    console.error('standards creds: no token entered');
+    return false;
+  }
+  const verified = await verifyCloudflareBootstrapAuthority(accountId, token);
+  if (!verified.ok) {
+    console.error(
+      `standards creds: token verification failed — ${verified.problem}`,
+    );
+    return false;
+  }
+  const { tokenName } = verified.value;
+  if (tokenName !== BROKER_IDENTITY_NAME) {
+    console.error(
+      `standards creds: warning — the token is named "${tokenName}", not "${BROKER_IDENTITY_NAME}"; rename it in the dashboard so it stays identifiable`,
+    );
+  }
+  await updateBrokerStore(storePath, (current) => {
+    if (current.cloudflare.some((entry) => entry.accountId === accountId)) {
+      throw new Error(
+        `Cloudflare account ${accountId} was configured while login was in progress; the newly entered token was not stored`,
+      );
+    }
+    return {
+      ...current,
+      cloudflare: [...current.cloudflare, { accountId, token }],
+    };
+  });
+  console.log(
+    `standards creds: Cloudflare account ${accountId} configured; bootstrap token stored in ${storePath}`,
+  );
+  return true;
+};

package/src/creds-login-github-manifest.ts

@@ -0,0 +1,104 @@
+// Pure manifest-flow pieces for the GitHub broker login: the App manifest,
+// the auto-submitting form, the one-time state token, and the conversion
+// exchange. The localhost listener and the login orchestration live in
+// creds-login-github.ts.
+
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import type { GithubBrokerApp } from './creds-store';
+import { apiError, HTTP_CREATED, request } from './github-api';
+import { isRecord } from './github-settings-parse';
+
+export const MANIFEST_STATE_BYTES = 32;
+
+// Root-credential ceiling: everything the broker may ever delegate. Actual
+// grants are narrowed per installation token at mint time.
+const DEFAULT_PERMISSIONS = Object.fromEntries(
+  'administration actions contents issues pull_requests secrets workflows'
+    .split(' ')
+    .map((permission) => [permission, 'write']),
+);
+
+export const buildAppManifest = (
+  name: string,
+  redirectUrl: string,
+): Readonly<Record<string, unknown>> => ({
+  name,
+  url: 'https://github.com/davidvornholt/standards',
+  hook_attributes: { url: 'https://example.invalid/unused', active: false },
+  redirect_url: redirectUrl,
+  public: false,
+  default_permissions: DEFAULT_PERMISSIONS,
+  default_events: [],
+});
+
+const escapeAttribute = (value: string): string =>
+  value
+    .replaceAll('&', '&amp;')
+    .replaceAll('"', '&quot;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;');
+
+export const createManifestState = () => {
+  const expected = randomBytes(MANIFEST_STATE_BYTES);
+  let available = true;
+  return {
+    value: expected.toString('hex'),
+    accept: (candidate: string | null) => {
+      const received =
+        candidate === null ? Buffer.alloc(0) : Buffer.from(candidate, 'hex');
+      const matches =
+        available &&
+        received.length === expected.length &&
+        timingSafeEqual(received, expected);
+      available = matches ? false : available;
+      return matches;
+    },
+  };
+};
+
+export const manifestFormHtml = (
+  action: string,
+  manifest: string,
+  state: string,
+): string =>
+  `<!doctype html><html><body><form id="m" action="${escapeAttribute(`${action}?state=${encodeURIComponent(state)}`)}" method="post"><input type="hidden" name="manifest" value="${escapeAttribute(manifest)}"><noscript><button type="submit">Create GitHub App</button></noscript></form><script>document.getElementById("m").submit()</script></body></html>`;
+
+export const parseConversion = (body: unknown): GithubBrokerApp | null =>
+  isRecord(body) &&
+  typeof body.id === 'number' &&
+  typeof body.slug === 'string' &&
+  typeof body.html_url === 'string' &&
+  typeof body.client_id === 'string' &&
+  typeof body.pem === 'string'
+    ? {
+        appId: body.id,
+        slug: body.slug,
+        htmlUrl: body.html_url,
+        clientId: body.client_id,
+        privateKey: body.pem,
+      }
+    : null;
+
+export type ManifestConversion =
+  | { readonly ok: true; readonly app: GithubBrokerApp }
+  | { readonly ok: false; readonly problem: string };
+
+// POST /app-manifests/{code}/conversions — note the plural resource name:
+// the singular path hits no route and GitHub answers with the same bare 404
+// an expired code would get. The wire-contract test pins this request line.
+export const convertManifestCode = async (
+  code: string,
+): Promise<ManifestConversion> => {
+  const conversion = await request(
+    null,
+    'POST',
+    `/app-manifests/${code}/conversions`,
+  );
+  if (conversion.status !== HTTP_CREATED) {
+    return { ok: false, problem: apiError('manifest conversion', conversion) };
+  }
+  const app = parseConversion(conversion.body);
+  return app === null
+    ? { ok: false, problem: 'unexpected manifest conversion response shape' }
+    : { ok: true, app };
+};

package/src/creds-login-github.ts

@@ -0,0 +1,133 @@
+import { randomBytes } from 'node:crypto';
+import { openInBrowser } from './creds-browser';
+import {
+  buildAppManifest,
+  convertManifestCode,
+  createManifestState,
+  MANIFEST_STATE_BYTES,
+  manifestFormHtml,
+} from './creds-login-github-manifest';
+import { BROKER_IDENTITY_NAME } from './creds-naming';
+import {
+  readBrokerStore,
+  resolveBrokerPath,
+  updateBrokerStore,
+} from './creds-store';
+
+const LOGIN_TIMEOUT_MS = 600_000;
+const HTTP_BAD_REQUEST = 400;
+const HTTP_NOT_FOUND = 404;
+
+export const startManifestLoginListener = (
+  formHtml: (port: number, state: string) => string,
+  timeoutMs = LOGIN_TIMEOUT_MS,
+) => {
+  const state = createManifestState();
+  const startPath = `/start/${randomBytes(MANIFEST_STATE_BYTES).toString('hex')}`;
+  let startAvailable = true;
+  const deferred = Promise.withResolvers<string>();
+  // biome-ignore lint/correctness/noUndeclaredVariables: Bun is the CLI's required runtime.
+  const server = Bun.serve({
+    hostname: '127.0.0.1',
+    port: 0,
+    fetch: (incoming, activeServer): Response => {
+      const url = new URL(incoming.url);
+      if (incoming.method === 'GET' && url.pathname === '/callback') {
+        const callbackCode = url.searchParams.get('code');
+        if (
+          callbackCode !== null &&
+          state.accept(url.searchParams.get('state'))
+        ) {
+          deferred.resolve(callbackCode);
+          return new Response('GitHub App created. Return to the terminal.');
+        }
+        return new Response(null, { status: HTTP_BAD_REQUEST });
+      }
+      if (
+        incoming.method === 'GET' &&
+        startAvailable &&
+        url.pathname === startPath
+      ) {
+        startAvailable = false;
+        return new Response(formHtml(Number(activeServer.port), state.value), {
+          headers: { 'cache-control': 'no-store', 'content-type': 'text/html' },
+        });
+      }
+      return new Response('Not found.', { status: HTTP_NOT_FOUND });
+    },
+  });
+  let timeout: ReturnType<typeof setTimeout>;
+  const close = (): void => {
+    clearTimeout(timeout);
+    server.stop();
+  };
+  timeout = setTimeout(() => {
+    close();
+    deferred.reject(
+      new Error('timed out waiting for the GitHub App creation redirect'),
+    );
+  }, timeoutMs);
+  return {
+    startUrl: `http://127.0.0.1:${server.port}${startPath}`,
+    code: deferred.promise,
+    close,
+  };
+};
+export const waitForCode = (
+  formHtml: (port: number, state: string) => string,
+  opener: typeof openInBrowser = openInBrowser,
+): Promise<string> => {
+  const listener = startManifestLoginListener(formHtml);
+  console.log(`Open ${listener.startUrl} to create the GitHub App.`);
+  opener(listener.startUrl);
+  return listener.code.finally(listener.close);
+};
+export const githubInstallMessage = (installUrl: string): string =>
+  `Install it only on the selected repositories that need broker credentials: ${installUrl}`;
+export const runCredsLoginGithub = async (options: {
+  readonly name: string | undefined;
+  readonly org: string | undefined;
+}): Promise<boolean> => {
+  const storePath = resolveBrokerPath();
+  const store = await readBrokerStore(storePath);
+  if (store.github !== null) {
+    console.error(
+      `standards creds: a broker GitHub App is already configured (${store.github.htmlUrl}); remove the "github" section from ${storePath} to re-run login`,
+    );
+    return false;
+  }
+  const action =
+    options.org === undefined
+      ? 'https://github.com/settings/apps/new'
+      : `https://github.com/organizations/${options.org}/settings/apps/new`;
+  const name = options.name ?? BROKER_IDENTITY_NAME;
+  const code = await waitForCode((port, state) =>
+    manifestFormHtml(
+      action,
+      JSON.stringify(
+        buildAppManifest(name, `http://127.0.0.1:${port}/callback`),
+      ),
+      state,
+    ),
+  );
+  const conversion = await convertManifestCode(code);
+  if (!conversion.ok) {
+    console.error(`standards creds: ${conversion.problem}`);
+    return false;
+  }
+  const { app } = conversion;
+  await updateBrokerStore(storePath, (current) => {
+    if (current.github !== null) {
+      throw new Error(
+        `a broker GitHub App was configured while login was in progress (${current.github.htmlUrl}); the newly created App ${app.htmlUrl} was not stored and should be deleted`,
+      );
+    }
+    return { ...current, github: app };
+  });
+  console.log(`standards creds: created App ${app.slug} (${app.htmlUrl})`);
+  console.log(`  credentials stored in ${storePath}`);
+  const installUrl = `${app.htmlUrl}/installations/new`;
+  console.log(githubInstallMessage(installUrl));
+  openInBrowser(installUrl);
+  return true;
+};

package/src/creds-naming.ts

@@ -0,0 +1,82 @@
+// Deterministic provider-side token names are the reconciliation key between
+// a repository's SOPS key structure and the tokens the broker minted for it:
+// `standards/<owner>/<repo>/<sops-target>/<dotted.key>`. No separate ledger
+// exists — the SOPS file (plaintext key structure) and the provider token
+// list, joined by this scheme, are the two sources of truth.
+
+const NAME_PREFIX = 'standards';
+
+// One broker identity credential per provider — the GitHub App and each
+// account's Cloudflare bootstrap token — shares this name. It contains no
+// slash, so it can never fall inside the minted namespace below.
+export const BROKER_IDENTITY_NAME = 'standards-broker';
+
+// The whole `standards/` prefix is reserved for minted tokens, deliberately
+// broader than the names reconciliation parses today: login is the only
+// cheap place to enforce the boundary, and a name that does not parse under
+// the current scheme could become parseable if the scheme ever widens.
+export const isInMintedNamespace = (name: string): boolean =>
+  name.startsWith(`${NAME_PREFIX}/`);
+
+export type BrokeredTokenRef = {
+  readonly repo: string;
+  readonly target: string;
+  readonly key: string;
+};
+
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const SAFE_REPO = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+
+export const assertTokenRef = ({
+  repo,
+  target,
+  key,
+}: BrokeredTokenRef): void => {
+  if (!SAFE_REPO.test(repo)) {
+    throw new Error(`invalid repository for token naming: ${repo}`);
+  }
+  if (!SAFE_SEGMENT.test(target)) {
+    throw new Error(`invalid secrets target for token naming: ${target}`);
+  }
+  for (const segment of key.split('.')) {
+    if (!SAFE_SEGMENT.test(segment)) {
+      throw new Error(`invalid secret key for token naming: ${key}`);
+    }
+  }
+};
+
+export const tokenNameOf = (ref: BrokeredTokenRef): string => {
+  assertTokenRef(ref);
+  return `${NAME_PREFIX}/${ref.repo}/${ref.target}/${ref.key}`;
+};
+
+export const repoTokenPrefix = (repo: string): string =>
+  `${NAME_PREFIX}/${repo}/`;
+
+// Only names this broker minted for this repository parse; every other token
+// (hand-made, other repos, other tools) returns null and is never touched.
+export const parseTokenName = (
+  name: string,
+  repo: string,
+): BrokeredTokenRef | null => {
+  const prefix = repoTokenPrefix(repo);
+  if (!name.startsWith(prefix)) {
+    return null;
+  }
+  const rest = name.slice(prefix.length);
+  const separator = rest.indexOf('/');
+  if (separator <= 0 || separator === rest.length - 1) {
+    return null;
+  }
+  const ref = {
+    repo,
+    target: rest.slice(0, separator),
+    key: rest.slice(separator + 1),
+  };
+  try {
+    assertTokenRef(ref);
+  } catch {
+    return null;
+  }
+  return ref;
+};

package/src/creds-plan-revoke.ts

@@ -0,0 +1,15 @@
+import { deleteAccountToken } from './creds-cloudflare';
+import type { PlannedAction } from './creds-plan';
+import type { CloudflareBrokerAccount } from './creds-store';
+
+export const revokePlannedToken = async (
+  account: CloudflareBrokerAccount,
+  action: Extract<PlannedAction, { readonly kind: 'revoke' }>,
+): Promise<string | null> => {
+  const deleted = await deleteAccountToken(
+    account.accountId,
+    account.token,
+    action.tokenId,
+  );
+  return deleted.ok ? null : `${action.name}: ${deleted.problem}`;
+};

package/src/creds-plan-run.ts

@@ -0,0 +1,198 @@
+import {
+  createAccountToken as createToken,
+  deleteAccountToken as deleteToken,
+} from './creds-cloudflare';
+import { listSecretsTargets, resolveTargetRel } from './creds-dest';
+import { identifyCloudflareBootstrapAuthority } from './creds-login-cloudflare';
+import {
+  type AccountToken,
+  computeCredsPlan,
+  type PlannedAction,
+} from './creds-plan';
+import { revokePlannedToken } from './creds-plan-revoke';
+import {
+  inspectSopsScalarDestination as inspectDestination,
+  readEncryptedKeys,
+  verifySopsStoredValue as verifyStoredValue,
+  setSopsValue as writeValue,
+} from './creds-sops';
+import {
+  type BrokerStore,
+  type CloudflareBrokerAccount,
+  readBrokerStore,
+  resolveBrokerPath,
+} from './creds-store';
+import { resolveGithubRepo } from './github-api';
+
+const gatherRepoState = async (consumer: string, store: BrokerStore) => {
+  const keysByTarget = new Map<string, ReadonlySet<string>>();
+  const targetKeys = await Promise.all(
+    listSecretsTargets(consumer).map(async ({ target, rel }) => ({
+      target,
+      rel,
+      keys: await readEncryptedKeys(consumer, rel),
+    })),
+  );
+  const problems: Array<string> = [];
+  for (const { target, rel, keys } of targetKeys) {
+    if (keys.ok) {
+      keysByTarget.set(target, new Set(keys.keys));
+    } else {
+      problems.push(`${rel}: ${keys.problem}`);
+    }
+  }
+  const tokens: Array<AccountToken> = [];
+  const listings = await Promise.all(
+    store.cloudflare.map(async (account) => ({
+      account,
+      identified: await identifyCloudflareBootstrapAuthority(
+        account.accountId,
+        account.token,
+      ),
+    })),
+  );
+  for (const { account, identified } of listings) {
+    if (identified.ok) {
+      tokens.push(
+        ...identified.value.tokens
+          .filter((token) => token.id !== identified.value.id)
+          .map((token) => ({
+            accountId: account.accountId,
+            token,
+          })),
+      );
+    } else {
+      problems.push(`account ${account.accountId}: ${identified.problem}`);
+    }
+  }
+  return { keysByTarget, tokens, problems };
+};
+
+const cleanupReplacement = async (
+  account: CloudflareBrokerAccount,
+  replacementId: string,
+  oldId: string,
+  context: string,
+): Promise<string> => {
+  const { accountId, token } = account;
+  const cleanup = await deleteToken(accountId, token, replacementId);
+  return cleanup.ok
+    ? `${context}; deleted replacement ${replacementId} and preserved old token ${oldId}`
+    : `${context}; cleanup of replacement ${replacementId} also failed: ${cleanup.problem}; old token ${oldId} remains active`;
+};
+
+const applyAction = async (
+  consumer: string,
+  store: BrokerStore,
+  action: PlannedAction,
+): Promise<string | null> => {
+  const account = store.cloudflare.find(
+    (entry) => entry.accountId === action.accountId,
+  );
+  if (account === undefined) {
+    return `${action.name}: account ${action.accountId} is not in the broker store`;
+  }
+  const { accountId, token: bootstrapToken } = account;
+  if (action.kind === 'revoke') {
+    return revokePlannedToken(account, action);
+  }
+  const rel = resolveTargetRel(consumer, action.target);
+  if (rel === null) {
+    return `${action.name}: secrets target ${action.target} not found`;
+  }
+  const destination = await inspectDestination(consumer, rel, action.key);
+  if (!destination.ok) {
+    return `${action.name}: ${destination.problem}`;
+  }
+  if (destination.state !== 'scalar') {
+    return `${action.name}: secret ${action.target}:${action.key} disappeared before renewal`;
+  }
+  const replacement = await createToken(accountId, bootstrapToken, {
+    name: action.name,
+    policies: action.policies,
+    expiresOn: action.replacementExpiresOn,
+    condition: action.condition,
+  });
+  if (!replacement.ok) {
+    return `${action.name}: ${replacement.problem}`;
+  }
+  const { id: replacementId, value } = replacement.value;
+  const written = writeValue(consumer, rel, action.key, value);
+  const verified = verifyStoredValue(consumer, rel, action.key, value);
+  if (verified.ok && !verified.matches) {
+    const problem = written.ok
+      ? `${action.name}: ${rel} at ${action.key} now holds a value matching neither the old nor the replacement token; repair the stored value manually`
+      : `${action.name}: ${written.problem}`;
+    return cleanupReplacement(account, replacementId, action.tokenId, problem);
+  }
+  if (!verified.ok) {
+    return `${action.name}: ${written.ok ? verified.problem : `${written.problem}; ${verified.problem}`}; account ${accountId} replacement ${replacementId} and old token ${action.tokenId} remain active because the stored value is unverifiable`;
+  }
+  const deleted = await deleteToken(accountId, bootstrapToken, action.tokenId);
+  return deleted.ok
+    ? null
+    : `${action.name}: replacement ${replacementId} is stored, but old token ${action.tokenId} could not be revoked: ${deleted.problem}`;
+};
+
+const fail = (message: string): false => {
+  console.error(`standards creds: ${message}`);
+  return false;
+};
+
+export const runCredsPlan = async (
+  consumer: string,
+  apply: boolean,
+): Promise<boolean> => {
+  const store = await readBrokerStore(resolveBrokerPath());
+  if (store.cloudflare.length === 0) {
+    console.log(
+      'standards creds: no Cloudflare accounts configured; nothing to reconcile (`standards creds login cloudflare`)',
+    );
+    return true;
+  }
+  const repo = resolveGithubRepo(consumer);
+  if (repo === null) {
+    return fail('cannot resolve the GitHub repository from the origin remote');
+  }
+  const state = await gatherRepoState(consumer, store);
+  for (const problem of state.problems) {
+    console.error(`standards creds: ${problem}`);
+  }
+  if (state.problems.length > 0) {
+    return fail(
+      'reconciliation aborted because repository or provider state could not be read safely',
+    );
+  }
+  const plan = computeCredsPlan({
+    repo,
+    keysByTarget: state.keysByTarget,
+    tokens: state.tokens,
+    now: new Date(),
+  });
+  for (const action of plan.actions) {
+    console.log(
+      `  ${apply ? '' : 'would '}${action.kind} ${action.name} (${action.reason})`,
+    );
+  }
+  for (const finding of plan.findings) {
+    console.error(`standards creds: ${finding}`);
+  }
+  console.log(
+    `standards creds: ${plan.actions.length} action(s), ${plan.findings.length} finding(s), ${plan.healthy} brokered token(s) healthy`,
+  );
+  if (plan.findings.length > 0) {
+    return fail('reconciliation aborted until every finding is resolved');
+  }
+  if (!apply || plan.actions.length === 0) {
+    return true;
+  }
+  const failures = (
+    await Promise.all(
+      plan.actions.map((action) => applyAction(consumer, store, action)),
+    )
+  ).filter((failure): failure is string => failure !== null);
+  for (const failure of failures) {
+    console.error(`standards creds: ${failure}`);
+  }
+  return failures.length === 0;
+};