@davidvornholt/standards 0.18.0 → 0.20.0

package/src/creds-add-github.ts

@@ -4,12 +4,18 @@
 // identity itself; workflows mint short-lived installation tokens from it at
 // runtime, scoped per repository and permission.
 
+import { inspectDestinations } from './creds-add-preflight';
 import { resolveContext } from './creds-dest';
+import { verifyGithubAppInstallation } from './creds-github-app-api';
 import {
-  inspectSopsScalarDestination,
-  setSopsValues,
-  verifySopsScalarLeaf,
-} from './creds-sops';
+  loadOwnedGithubStore,
+  sameGithubApp,
+  selectGithubAppForRepo,
+} from './creds-github-apps';
+import { setSopsValues } from './creds-sops';
+import { verifySopsStoredValue } from './creds-sops-value';
+import { readBrokerStore, resolveBrokerPath } from './creds-store';
+import { withBrokerLock } from './creds-store-lock';
 
 export const runCredsAddGithub = async (
   consumer: string,
@@ -19,41 +25,87 @@ export const runCredsAddGithub = async (
   if (context === null) {
     return false;
   }
-  if (context.store.github === null) {
-    console.error(
-      'standards creds: no broker GitHub App configured; run `standards creds login github`',
-    );
-    return false;
-  }
-  const { appId, privateKey, slug } = context.store.github;
   const appIdPath = `${context.dest.key}.app_id`;
   const privateKeyPath = `${context.dest.key}.private_key`;
-  const preflight = await Promise.all(
-    [appIdPath, privateKeyPath].map((path) =>
-      inspectSopsScalarDestination(consumer, context.rel, path),
-    ),
+  const blocked = await inspectDestinations(consumer, context.rel, [
+    appIdPath,
+    privateKeyPath,
+  ]);
+  if (blocked !== null) {
+    console.error(`standards creds: ${blocked}`);
+    return false;
+  }
+  const storePath = resolveBrokerPath();
+  const loaded = await loadOwnedGithubStore(storePath);
+  if (!loaded.ok) {
+    console.error(`standards creds: ${loaded.problem}`);
+    return false;
+  }
+  const selected = selectGithubAppForRepo(loaded.value.github, context.repo);
+  if (!selected.ok) {
+    console.error(`standards creds: ${selected.problem}`);
+    return false;
+  }
+  const installation = await verifyGithubAppInstallation(
+    selected.value,
+    context.repo,
   );
-  const blocked = preflight.find((result) => !result.ok);
-  if (blocked !== undefined && !blocked.ok) {
-    console.error(`standards creds: ${blocked.problem}`);
+  if (!installation.ok) {
+    console.error(`standards creds: ${installation.problem}`);
+    return false;
+  }
+  const { appId, privateKey, slug } = selected.value;
+  let writeResult:
+    | { readonly ok: true }
+    | { readonly ok: false; readonly problem: string };
+  try {
+    writeResult = await withBrokerLock(storePath, async () => {
+      const current = selectGithubAppForRepo(
+        (await readBrokerStore(storePath)).github,
+        context.repo,
+      );
+      if (!current.ok) {
+        return current;
+      }
+      if (!sameGithubApp(current.value, selected.value)) {
+        return {
+          ok: false,
+          problem: `the broker GitHub App for ${selected.value.owner} changed while its installation was being verified; retry so the replacement can be verified`,
+        };
+      }
+      return setSopsValues(consumer, context.rel, [
+        { path: appIdPath, value: String(appId) },
+        { path: privateKeyPath, value: privateKey },
+      ]);
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`standards creds: ${message}`);
+    return false;
+  }
+  if (!writeResult.ok) {
+    console.error(`standards creds: ${writeResult.problem}`);
     return false;
   }
-  const written = setSopsValues(consumer, context.rel, [
+  const verified = [
     { path: appIdPath, value: String(appId) },
     { path: privateKeyPath, value: privateKey },
-  ]);
-  if (!written.ok) {
-    console.error(`standards creds: ${written.problem}`);
+  ].map(({ path, value }) => ({
+    path,
+    result: verifySopsStoredValue(consumer, context.rel, path, value),
+  }));
+  const unverifiable = verified.find(({ result }) => !result.ok);
+  if (unverifiable !== undefined && !unverifiable.result.ok) {
+    console.error(`standards creds: ${unverifiable.result.problem}`);
     return false;
   }
-  const verified = await Promise.all(
-    [appIdPath, privateKeyPath].map((path) =>
-      verifySopsScalarLeaf(consumer, context.rel, path),
-    ),
-  );
-  const failedVerification = verified.find((result) => !result.ok);
-  if (failedVerification !== undefined && !failedVerification.ok) {
-    console.error(`standards creds: ${failedVerification.problem}`);
+  const mismatched = verified
+    .filter(({ result }) => result.ok && !result.matches)
+    .map(({ path }) => path);
+  if (mismatched.length > 0) {
+    console.error(
+      `standards creds: the stored SOPS value at ${mismatched.join(', ')} does not match the selected GitHub App`,
+    );
     return false;
   }
   console.log(

package/src/creds-add-policy.ts

@@ -6,9 +6,8 @@
 
 import { listPermissionGroups } from './creds-cloudflare';
 import type { PermissionGroup, TokenPolicy } from './creds-cloudflare-api';
+import { ZONE_SCOPE, zoneResource } from './creds-cloudflare-zone';
 import {
-  DEFAULT_R2_JURISDICTION,
-  isR2BucketName,
   R2_BUCKET_SCOPE,
   type R2Jurisdiction,
   r2BucketResource,
@@ -17,6 +16,16 @@ import type { CloudflareBrokerAccount } from './creds-store';
 
 const ACCOUNT_SCOPE = 'com.cloudflare.api.account';
 
+const tokenPolicy = (
+  resources: TokenPolicy['resources'],
+  groups: ReadonlyArray<PermissionGroup>,
+): TokenPolicy => ({
+  effect: 'allow',
+  resources,
+  // biome-ignore lint/style/useNamingConvention: Cloudflare's policy wire field is snake_case.
+  permission_groups: groups.map(({ id }) => ({ id })),
+});
+
 export const unsupportedResourceScopes = (
   groups: ReadonlyArray<PermissionGroup>,
   scope: string,
@@ -26,23 +35,99 @@ export const unsupportedResourceScopes = (
     .map((group) => group.name);
 
 const scopeProblem = (
-  bucket: string | undefined,
+  resource: { readonly kind: 'account' | 'bucket' },
   selected: ReadonlyArray<PermissionGroup>,
 ): string | null => {
-  const scope = bucket === undefined ? ACCOUNT_SCOPE : R2_BUCKET_SCOPE;
+  const scope = resource.kind === 'account' ? ACCOUNT_SCOPE : R2_BUCKET_SCOPE;
   const unsupported = unsupportedResourceScopes(selected, scope);
   if (unsupported.length === 0) {
     return null;
   }
-  return bucket === undefined
-    ? `permission group(s) ${unsupported.join(', ')} cannot target an account resource; choose account-scoped groups (zone-scoped groups require an explicit zone resource, which this command does not yet support, and R2 bucket-item groups require --bucket)`
+  return resource.kind === 'account'
+    ? `permission group(s) ${unsupported.join(', ')} cannot target an account resource; choose account-scoped groups, name the zones with --zone for zone-scoped groups, or pass --bucket for R2 bucket-item groups`
     : `permission group(s) ${unsupported.join(', ')} cannot target an R2 bucket resource; --bucket accepts only bucket-scoped groups such as Workers R2 Storage Bucket Item Read/Write`;
 };
 
+// With zones named, a token spans two resources, so the selection is split by
+// what each group can actually target rather than checked against one scope.
+// A group matching neither resource is the operator's mistake and is named.
+// A group Cloudflare reports as both zone- and account-scoped goes to the zone
+// policy: `--zone` asks for zone reach, and the narrower reading is the safe
+// one to guess wrong.
+const zonePolicies = (
+  accountId: string,
+  zoneIds: ReadonlyArray<string>,
+  selected: ReadonlyArray<PermissionGroup>,
+):
+  | { readonly policies: ReadonlyArray<TokenPolicy> }
+  | { readonly problem: string } => {
+  const zoneGroups = selected.filter((group) =>
+    group.scopes.includes(ZONE_SCOPE),
+  );
+  const accountGroups = selected.filter(
+    (group) =>
+      !group.scopes.includes(ZONE_SCOPE) &&
+      group.scopes.includes(ACCOUNT_SCOPE),
+  );
+  const unsupported = selected
+    .filter(
+      (group) =>
+        !(
+          group.scopes.includes(ZONE_SCOPE) ||
+          group.scopes.includes(ACCOUNT_SCOPE)
+        ),
+    )
+    .map((group) => group.name);
+  if (unsupported.length > 0) {
+    return {
+      problem: `permission group(s) ${unsupported.join(', ')} target neither a zone nor an account resource; R2 bucket-item groups require --bucket, which cannot be combined with --zone`,
+    };
+  }
+  if (zoneGroups.length === 0) {
+    return {
+      problem:
+        '--zone was given but no selected permission group is zone-scoped; drop --zone, or add a zone-scoped group such as DNS Write',
+    };
+  }
+  const zoneResources = Object.fromEntries(
+    zoneIds.map((zoneId) => [zoneResource(zoneId), '*']),
+  );
+  return {
+    policies: [
+      ...(accountGroups.length === 0
+        ? []
+        : [
+            tokenPolicy(
+              { [`${ACCOUNT_SCOPE}.${accountId}`]: '*' },
+              accountGroups,
+            ),
+          ]),
+      tokenPolicy(zoneResources, zoneGroups),
+    ],
+  };
+};
+
+// One token reaches exactly one kind of resource, so the caller states which
+// rather than passing flags whose illegal combinations would have to be
+// re-rejected here.
+export type PolicyResource =
+  | { readonly kind: 'account' }
+  | {
+      readonly kind: 'bucket';
+      readonly bucket: string;
+      readonly jurisdiction: R2Jurisdiction;
+    }
+  | {
+      readonly kind: 'zones';
+      // Non-empty by type: a zone policy with no resource would be accepted by
+      // the wire shape and reach nothing.
+      readonly zoneIds: readonly [string, ...ReadonlyArray<string>];
+    };
+
 export type ResolvedTokenPolicy =
   | {
       readonly ok: true;
-      readonly policy: TokenPolicy;
+      readonly policies: ReadonlyArray<TokenPolicy>;
       readonly wanted: ReadonlyArray<string>;
     }
   | { readonly ok: false; readonly problem: string };
@@ -51,10 +136,10 @@ export const resolveTokenPolicy = async (
   account: CloudflareBrokerAccount,
   options: {
     readonly permissions: string | undefined;
-    readonly bucket: string | undefined;
-    readonly jurisdiction?: R2Jurisdiction;
+    readonly resource: PolicyResource;
   },
 ): Promise<ResolvedTokenPolicy> => {
+  const { resource } = options;
   if (options.permissions === undefined || options.permissions.length === 0) {
     return {
       ok: false,
@@ -62,12 +147,6 @@ export const resolveTokenPolicy = async (
         '--permissions "<Group Name>[,<Group Name>...]" is required; list names with `standards creds permissions`',
     };
   }
-  if (options.bucket !== undefined && !isR2BucketName(options.bucket)) {
-    return {
-      ok: false,
-      problem: `invalid R2 bucket name: ${options.bucket} (3-63 lowercase letters, digits, and hyphens)`,
-    };
-  }
   const groups = await listPermissionGroups(account.accountId, account.token);
   if (!groups.ok) {
     return { ok: false, problem: groups.problem };
@@ -93,26 +172,27 @@ export const resolveTokenPolicy = async (
   const selected = resolved.flatMap(({ group }) =>
     group === undefined ? [] : [group],
   );
-  const problem = scopeProblem(options.bucket, selected);
+  if (resource.kind === 'zones') {
+    const zoned = zonePolicies(account.accountId, resource.zoneIds, selected);
+    return 'problem' in zoned
+      ? { ok: false, problem: zoned.problem }
+      : { ok: true, wanted, policies: zoned.policies };
+  }
+  const problem = scopeProblem(resource, selected);
   if (problem !== null) {
     return { ok: false, problem };
   }
-  const resource =
-    options.bucket === undefined
+  const target =
+    resource.kind === 'account'
       ? `${ACCOUNT_SCOPE}.${account.accountId}`
       : r2BucketResource(
           account.accountId,
-          options.bucket,
-          options.jurisdiction ?? DEFAULT_R2_JURISDICTION,
+          resource.bucket,
+          resource.jurisdiction,
         );
   return {
     ok: true,
     wanted,
-    policy: {
-      effect: 'allow',
-      resources: { [resource]: '*' },
-      // biome-ignore lint/style/useNamingConvention: Cloudflare's policy wire field is snake_case.
-      permission_groups: selected.map(({ id }) => ({ id })),
-    },
+    policies: [tokenPolicy({ [target]: '*' }, selected)],
   };
 };

package/src/creds-add-preflight.ts

@@ -0,0 +1,68 @@
+// Everything `creds add cloudflare` can settle before it mints anything: which
+// resource the token will reach, and whether each destination is a writable
+// scalar leaf. Minting first and discovering these afterwards would leave a
+// live credential nobody asked for.
+
+import type { PolicyResource } from './creds-add-policy';
+import { parseZoneArgument } from './creds-cloudflare-zone';
+import {
+  DEFAULT_R2_JURISDICTION,
+  isR2BucketName,
+  type R2Jurisdiction,
+} from './creds-r2';
+import { inspectSopsScalarDestination } from './creds-sops';
+
+export const inspectDestinations = async (
+  consumer: string,
+  rel: string,
+  paths: ReadonlyArray<string>,
+): Promise<string | null> => {
+  const inspected = await Promise.all(
+    paths.map((path) => inspectSopsScalarDestination(consumer, rel, path)),
+  );
+  const blocked = inspected.find((result) => !result.ok);
+  return blocked !== undefined && !blocked.ok ? blocked.problem : null;
+};
+
+export type ResolvedResourceFlags =
+  | { readonly ok: true; readonly resource: PolicyResource }
+  | { readonly ok: false; readonly problem: string };
+
+// A token reaches one kind of resource, so the flags naming it collapse to that
+// one choice here — before any provider or SOPS work, because no rejection
+// below can be salvaged afterwards.
+export const resolveResourceFlags = (options: {
+  readonly bucket: string | undefined;
+  readonly zone: string | undefined;
+  readonly jurisdiction?: R2Jurisdiction;
+}): ResolvedResourceFlags => {
+  if (options.bucket !== undefined && options.zone !== undefined) {
+    return {
+      ok: false,
+      problem:
+        '--bucket and --zone cannot be combined; an R2 bucket credential and a zone credential are separate tokens',
+    };
+  }
+  if (options.bucket !== undefined) {
+    return isR2BucketName(options.bucket)
+      ? {
+          ok: true,
+          resource: {
+            kind: 'bucket',
+            bucket: options.bucket,
+            jurisdiction: options.jurisdiction ?? DEFAULT_R2_JURISDICTION,
+          },
+        }
+      : {
+          ok: false,
+          problem: `invalid R2 bucket name: ${options.bucket} (3-63 lowercase letters, digits, and hyphens)`,
+        };
+  }
+  if (options.zone === undefined) {
+    return { ok: true, resource: { kind: 'account' } };
+  }
+  const zones = parseZoneArgument(options.zone);
+  return zones.ok
+    ? { ok: true, resource: { kind: 'zones', zoneIds: zones.zoneIds } }
+    : { ok: false, problem: zones.problem };
+};

package/src/creds-add.ts

@@ -1,7 +1,12 @@
 import { commitCreatedCloudflareToken } from './creds-add-cloudflare-commit';
 import { findManagedDestinationCollision } from './creds-add-collision';
 import { resolveTokenPolicy } from './creds-add-policy';
+import {
+  inspectDestinations,
+  resolveResourceFlags,
+} from './creds-add-preflight';
 import { createAccountToken } from './creds-cloudflare';
+import type { TokenPolicy } from './creds-cloudflare-api';
 import { cloudflareExpiresOn } from './creds-cloudflare-expiry';
 import { resolveContext, selectAccount } from './creds-dest';
 import { tokenNameOf } from './creds-naming';
@@ -13,11 +18,7 @@ import {
   s3Endpoint,
   s3PairPaths,
 } from './creds-r2';
-import {
-  inspectSopsScalarDestination,
-  readEncryptedKeys,
-  setSopsValues,
-} from './creds-sops';
+import { readEncryptedKeys, setSopsValues } from './creds-sops';
 
 const DEFAULT_TTL_DAYS = 90;
 const DAY_MS = 86_400_000;
@@ -30,9 +31,16 @@ const printSuccess = (input: {
   readonly format: DestinationFormat;
   readonly accountId: string;
   readonly jurisdiction: R2Jurisdiction;
+  readonly policies: ReadonlyArray<TokenPolicy>;
 }): void => {
   console.log(`standards creds: minted Cloudflare token ${input.name}`);
   console.log(`  permissions: ${input.permissions.join(', ')}`);
+  // Read off the minted policies rather than the flags that asked for them:
+  // a selection can add an account policy the flags do not mention, and the
+  // reach of a token is the one thing worth stating from ground truth.
+  console.log(
+    `  resources: ${input.policies.flatMap((policy) => Object.keys(policy.resources)).join(', ')}`,
+  );
   console.log(
     `  expires: ${input.expiresOn} (rotate via \`standards creds apply\`)`,
   );
@@ -46,18 +54,6 @@ const printSuccess = (input: {
   }
 };
 
-const inspectDestinations = async (
-  consumer: string,
-  rel: string,
-  paths: ReadonlyArray<string>,
-): Promise<string | null> => {
-  const inspected = await Promise.all(
-    paths.map((path) => inspectSopsScalarDestination(consumer, rel, path)),
-  );
-  const blocked = inspected.find((result) => !result.ok);
-  return blocked !== undefined && !blocked.ok ? blocked.problem : null;
-};
-
 export const runCredsAddCloudflare = async (
   consumer: string,
   options: {
@@ -66,6 +62,7 @@ export const runCredsAddCloudflare = async (
     readonly account: string | undefined;
     readonly ttlDays: number | undefined;
     readonly bucket: string | undefined;
+    readonly zone: string | undefined;
     readonly jurisdiction?: R2Jurisdiction;
     readonly s3: boolean;
   },
@@ -76,6 +73,11 @@ export const runCredsAddCloudflare = async (
     );
     return false;
   }
+  const flags = resolveResourceFlags(options);
+  if (!flags.ok) {
+    console.error(`standards creds: ${flags.problem}`);
+    return false;
+  }
   const context = await resolveContext(consumer, options.dest);
   if (context === null) {
     return false;
@@ -102,7 +104,10 @@ export const runCredsAddCloudflare = async (
     return false;
   }
   const keys = new Set(encryptedKeys.keys);
-  const resolved = await resolveTokenPolicy(account, options);
+  const resolved = await resolveTokenPolicy(account, {
+    permissions: options.permissions,
+    resource: flags.resource,
+  });
   if (!resolved.ok) {
     console.error(`standards creds: ${resolved.problem}`);
     return false;
@@ -123,7 +128,7 @@ export const runCredsAddCloudflare = async (
     name,
     expiresOn,
     condition: null,
-    policies: [resolved.policy],
+    policies: resolved.policies,
   });
   if (!created.ok) {
     console.error(`standards creds: ${created.problem}`);
@@ -157,7 +162,11 @@ export const runCredsAddCloudflare = async (
     destination: `${context.rel} at ${context.dest.key}`,
     format,
     accountId: account.accountId,
-    jurisdiction: options.jurisdiction ?? DEFAULT_R2_JURISDICTION,
+    jurisdiction:
+      flags.resource.kind === 'bucket'
+        ? flags.resource.jurisdiction
+        : DEFAULT_R2_JURISDICTION,
+    policies: resolved.policies,
   });
   return true;
 };

package/src/creds-args.ts

@@ -17,6 +17,7 @@ export type CredsFlags = {
   account: string | undefined;
   ttlDays: number | undefined;
   bucket: string | undefined;
+  zone: string | undefined;
   jurisdiction: R2Jurisdiction;
   s3: boolean;
   org: string | undefined;
@@ -51,6 +52,7 @@ export const parseCredsArgs = (argv: ReadonlyArray<string>): CredsFlags => {
     account: undefined,
     ttlDays: undefined,
     bucket: undefined,
+    zone: undefined,
     jurisdiction: DEFAULT_R2_JURISDICTION,
     s3: false,
     org: undefined,
@@ -76,6 +78,9 @@ export const parseCredsArgs = (argv: ReadonlyArray<string>): CredsFlags => {
     '--bucket': (value) => {
       flags.bucket = value;
     },
+    '--zone': (value) => {
+      flags.zone = value;
+    },
     '--jurisdiction': (value) => {
       if (!isR2Jurisdiction(value)) {
         throw new Error('--jurisdiction must be default or eu');

package/src/creds-cloudflare-zone.ts

@@ -0,0 +1,40 @@
+// Zone resources for `standards creds add cloudflare`. Zones are named by ID,
+// never by domain name: resolving a name would need Zone Read on the bootstrap
+// token, which holds Account API Tokens / Edit and nothing else, so the lookup
+// would fail — or, worse, come back empty and read as a missing zone. A zone ID
+// is not a secret and is shown on the zone's dashboard overview.
+
+export const ZONE_SCOPE = 'com.cloudflare.api.account.zone';
+
+const ZONE_ID_PATTERN = /^[0-9a-f]{32}$/u;
+
+export const zoneResource = (zoneId: string): string =>
+  `${ZONE_SCOPE}.${zoneId}`;
+
+export type ParsedZoneArgument =
+  | {
+      readonly ok: true;
+      readonly zoneIds: readonly [string, ...ReadonlyArray<string>];
+    }
+  | { readonly ok: false; readonly problem: string };
+
+export const parseZoneArgument = (value: string): ParsedZoneArgument => {
+  const [first, ...rest] = value
+    .split(',')
+    .map((zone) => zone.trim())
+    .filter((zone) => zone.length > 0);
+  if (first === undefined) {
+    return {
+      ok: false,
+      problem: '--zone requires at least one zone ID',
+    };
+  }
+  const entries = [first, ...rest] as const;
+  const invalid = entries.filter((zone) => !ZONE_ID_PATTERN.test(zone));
+  return invalid.length === 0
+    ? { ok: true, zoneIds: entries }
+    : {
+        ok: false,
+        problem: `not a zone ID: ${invalid.join(', ')}; --zone takes the 32-character hexadecimal zone ID shown on the zone's dashboard overview, not its domain name`,
+      };
+};

package/src/creds-commands.ts

@@ -2,6 +2,7 @@ import { runCredsAddCloudflare } from './creds-add';
 import { runCredsAddGithub } from './creds-add-github';
 import { parseCredsArgs } from './creds-args';
 import { listPermissionGroups } from './creds-cloudflare';
+import { loadOwnedGithubStore } from './creds-github-apps';
 import { runCredsLoginCloudflare } from './creds-login-cloudflare';
 import { runCredsLoginGithub } from './creds-login-github';
 import { BROKER_IDENTITY_NAME } from './creds-naming';
@@ -15,10 +16,10 @@ import {
 const CREDS_USAGE = `Usage: standards creds <command> [options]
 
 Commands:
-  login github      Create the broker GitHub App via the manifest flow (one click) and store its credentials
+  login github      Create or replace one account's broker GitHub App via the manifest flow
   login cloudflare  Store a Cloudflare account's bootstrap token (one guided paste per account)
   add cloudflare    Mint a scoped, expiring account token and write it into a SOPS target
-  add github        Write the broker App's credentials into a SOPS target for runtime token minting
+  add github        Select the repository owner's App, verify its installation, and write it into SOPS
   plan              Show revocations and rotations reconciling SOPS keys against brokered tokens
   apply             Execute the plan: revoke orphaned tokens, roll expiring ones into SOPS
   permissions       List Cloudflare permission group names for --permissions
@@ -31,15 +32,21 @@ Options:
   --account <id>        Cloudflare account when more than one is configured
   --ttl-days <n>        Token lifetime in days (default: 90)
   --bucket <name>       Scope a Cloudflare token to one R2 bucket
+  --zone <zone-id>      Add a zone resource for zone-scoped groups (comma-separated IDs)
   --jurisdiction <name> R2 jurisdiction: default or eu (default: default)
   --s3                  Store the derived R2 S3 credential pair (<key>.access_key_id, <key>.secret_access_key) instead of the raw token
   --org <org>           Create the GitHub App under an organization
-  --name <name>         GitHub App name (default: ${BROKER_IDENTITY_NAME})
+  --name <name>         GitHub App name (default: ${BROKER_IDENTITY_NAME}, suffixed by --org)
 
 Secret values are written directly into SOPS-encrypted targets and never printed.`;
 const runCredsStatus = async (): Promise<boolean> => {
   const path = resolveBrokerPath();
-  const store = await readBrokerStore(path);
+  const loaded = await loadOwnedGithubStore(path);
+  if (!loaded.ok) {
+    console.error(`standards creds: ${loaded.problem}`);
+    return false;
+  }
+  const { value: store } = loaded;
   console.log(`broker store: ${path}`);
   const mode = inspectBrokerFileMode(path);
   if (!mode.exists) {
@@ -47,11 +54,16 @@ const runCredsStatus = async (): Promise<boolean> => {
   } else if (mode.problem !== null) {
     console.log(`  WARNING: ${mode.problem}`);
   }
-  console.log(
-    store.github === null
-      ? 'github: not configured (`standards creds login github`)'
-      : `github: App ${store.github.slug} (id ${store.github.appId}) — ${store.github.htmlUrl}`,
-  );
+  if (store.github.length === 0) {
+    console.log('github: not configured (`standards creds login github`)');
+  } else {
+    console.log('github:');
+    for (const app of store.github) {
+      console.log(
+        `  ${app.owner}: App ${app.slug} (id ${app.appId}) — ${app.htmlUrl}`,
+      );
+    }
+  }
   console.log(
     store.cloudflare.length === 0
       ? 'cloudflare: not configured (`standards creds login cloudflare`)'