@gambi97/keel-cli 0.1.1 → 0.2.1

package/README.md

@@ -28,10 +28,19 @@ provisioned by Terraform, deployed by GitHub Actions, with secrets in
 Docker image, keel gives it a place to run. You answer a few questions, push
 to `main`, and the infrastructure is live.
 
+**keel is a starting point, not a control plane.** It runs once to lay the
+foundation and hand you a repository you fully own. From then on, day-2 work —
+scaling, new environments, custom domains, rotating secrets — happens in that
+repository: edit a tfvars line, open a PR, merge. keel does not stay in the
+loop, has nothing to update, and never manages your infrastructure after the
+first setup. If you outgrow the generated layout, it is plain Terraform you
+can take anywhere.
+
 - **Near-free to start.** Compute and database scale to zero; an idle project
   costs cents per month, with no expiring trial.
-- **Scales with your product.** Staging and prod from day one; growing is a
-  one-line tfvars change reviewed in a PR.
+- **Scales with your product.** Pick your environments (production only, or
+  add staging and dev) and, if you need it, an application file store; growing
+  is a one-line tfvars change reviewed in a PR.
 - **Nothing to install.** No Terraform, no cloud CLI. Node and git, done.
 - **No secrets in the repo, ever.** Encrypted CI secrets and a dedicated
   secret manager, wired for you.
@@ -46,10 +55,13 @@ GitHub (see [Prerequisites](#prerequisites) for how to get each one).
 npx @gambi97/keel-cli
 ```
 
-The CLI asks for a project name, region, repository name and visibility, picks
-up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your environment as defaults,
-then shows a **complete summary of what it will create and where**. Nothing is
-touched before you confirm. When it finishes, push to `main` (or merge the
+The CLI asks for a project name, region and environments, then walks one
+provider at a time — GitHub, Infisical, Scaleway — verifying each set of
+credentials with read-only calls the moment you enter it (a bad token or a
+non-empty repository is reported immediately, and only that answer is asked
+again). It picks up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your
+environment as defaults, then shows a **complete summary of what it will
+create and where**. Nothing is touched before you confirm. When it finishes, push to `main` (or merge the
 first PR) and the pipeline provisions the infrastructure.
 
 Non-interactive and dry-run:
@@ -151,21 +163,22 @@ local tooling or production credentials.
 
 **Phase A: bootstrap (the CLI, via APIs, after your confirmation)**
 
-| Where        | What                                                                                                                                                                                                     |
-| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                     |
-| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking)                                                                                                                     |
-| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; `staging` and `production` environments, the latter gated by manual approval; branch protection on `main` |
-| Infisical    | A project with `staging` and `prod` environments, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (staging, random password) and a `DATABASE_URL` placeholder per environment                      |
+| Where        | What                                                                                                                                                                                                                                                   |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                                                                   |
+| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking, restricted by a bucket policy to the identity behind your API key)                                                                                                |
+| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; one deployment environment per selected environment (`production` gated by manual approval); branch protection on `main`                                |
+| Infisical    | A project with one environment per selected environment, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (non-production, random password), a `DATABASE_URL` placeholder per environment, and `S3_*` placeholders when Object Storage is enabled |
 
 **Phase B: first deploy (Terraform in GitHub Actions, on push to `main`)**
 
-| Scaleway resource                          | Notes                                                                                                                     |
-| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
-| Registry namespace                         | Private, one per environment                                                                                              |
-| Container namespace + Serverless Container | The container appears once you set `container_image` in the tfvars; registry and database are created right away          |
-| Serverless SQL Database                    | One per environment; after each apply the pipeline writes a ready-to-use connection string to Infisical as `DATABASE_URL` |
-| IAM application + API key                  | Dedicated credential that can only read/write the database (least privilege), embedded in `DATABASE_URL`                  |
+| Scaleway resource                           | Notes                                                                                                                                           |
+| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Registry namespace                          | Private, one per environment                                                                                                                    |
+| Container namespace + Serverless Container  | The container appears once you set `container_image` in the tfvars; registry and database are created right away                                |
+| Serverless SQL Database                     | One per environment; after each apply the pipeline writes a ready-to-use connection string to Infisical as `DATABASE_URL`                       |
+| IAM application + API key                   | Dedicated credential that can only read/write the database (least privilege), embedded in `DATABASE_URL`                                        |
+| Object Storage bucket + credential (opt-in) | Only with `--object-storage`: one bucket per environment plus a dedicated least-privilege credential; coordinates synced to Infisical as `S3_*` |
 
 No custom domain is configured: the app gets an auto-generated Scaleway URL.
 Add one later with a single `scaleway_container_domain` resource.
@@ -176,28 +189,29 @@ Add one later with a single `scaleway_container_domain` resource.
 my-app/
 ├── README.md                    # operating manual for the repo
 ├── .github/workflows/
-│   ├── terraform-plan.yml       # PR: fmt + validate + plan (staging & prod)
-│   ├── terraform-apply.yml      # main: apply staging -> approval -> apply prod
+│   ├── terraform-plan.yml       # PR: fmt + validate + plan (every environment)
+│   ├── terraform-apply.yml      # main: apply each env in order; production gated
 │   └── terraform-drift.yml      # weekly: read-only plan, opens an issue on drift
 ├── versions.tf · providers.tf · backend.tf
 ├── backend.hcl.example          # state bucket coordinates (backend.hcl is git-ignored)
 ├── variables.tf · main.tf · outputs.tf
-├── staging.tfvars · prod.tfvars # non-sensitive config only, committed
-└── modules/app_stack/           # registry + container + database + db credential
+├── <env>.tfvars                 # one per environment, non-sensitive config, committed
+└── modules/app_stack/           # registry + container + database (+ object storage) + credentials
 ```
 
-Environments are separated with **Terraform workspaces**: same code, two
-independent states in one bucket, differences confined to the two `.tfvars`
-files.
+Environments are separated with **Terraform workspaces**: same code, one
+independent state per environment in one bucket, differences confined to the
+per-environment `<env>.tfvars` files.
 
-| Data                              | Lives in                 | Why                                                                  |
-| --------------------------------- | ------------------------ | -------------------------------------------------------------------- |
-| Scaleway API keys                 | GitHub encrypted secrets | CI needs them to run Terraform                                       |
-| Infisical machine identity        | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                        |
-| Basic Auth user/password          | Infisical (staging)      | App secret, injected into the container, rotatable                   |
-| Database connection string        | Infisical (both envs)    | Complete, ready-to-use value synced by the pipeline after each apply |
-| Bucket, region, Infisical project | GitHub variables         | Non-sensitive wiring, editable in one place                          |
-| Project name, scaling, image      | Committed tfvars         | Reviewable configuration, no secrets                                 |
+| Data                                | Lives in                 | Why                                                                  |
+| ----------------------------------- | ------------------------ | -------------------------------------------------------------------- |
+| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                       |
+| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                        |
+| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                   |
+| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply |
+| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                |
+| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                          |
+| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                 |
 
 ## After the bootstrap
 
@@ -206,19 +220,21 @@ day-2 work (scaling, rotating secrets, custom domains, troubleshooting). The
 short version of the first deploy:
 
 1. **Push to `main`** (or merge a PR): the pipeline provisions registry and
-   databases. Approve the `production` gate when prompted.
+   databases (and an Object Storage bucket, if enabled). Approve the
+   `production` gate when prompted.
 2. **Build and push your app image** to the registry endpoint from the apply
-   output:
+   output (replace `<env>` with your target environment):
    ```sh
-   docker login rg.fr-par.scw.cloud/my-app-staging -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
-   docker build -t rg.fr-par.scw.cloud/my-app-staging/app:latest .
-   docker push rg.fr-par.scw.cloud/my-app-staging/app:latest
+   docker login rg.fr-par.scw.cloud/my-app-<env> -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
+   docker build -t rg.fr-par.scw.cloud/my-app-<env>/app:latest .
+   docker push rg.fr-par.scw.cloud/my-app-<env>/app:latest
    ```
 3. **Set `container_image`** in the tfvars and open a PR: the next apply
    creates the containers.
 4. **Replace the placeholder secrets** in Infisical with real values. The app
-   reads `DATABASE_URL` and `BASIC_AUTH_*` from its environment; on staging
-   it also receives `BASIC_AUTH_ENABLED=true` and enforces it.
+   reads `DATABASE_URL`, `BASIC_AUTH_*` and (if enabled) `S3_*` from its
+   environment; non-production environments also receive `BASIC_AUTH_ENABLED=true`
+   and enforce it.
 
 ## Prerequisites
 
@@ -278,9 +294,18 @@ creating anything**.
   plan, production applies need manual approval.
 - Terraform state lives in a private, versioned bucket with S3-native state
   locking (`use_lockfile`), so concurrent applies cannot corrupt it.
+- The state bucket is **restricted by a bucket policy** to the identity that
+  owns the API key you give keel — the same identity CI authenticates with,
+  so the pipeline keeps working. Terraform state contains the generated
+  credentials (`DATABASE_URL`, `S3_*`), so no other principal in the project —
+  including the app's own credentials — can read it. Note that this also
+  hides the bucket from other console users; manage or remove the policy with
+  that same API key if you need to open it up.
 - The app connects to its database with a **dedicated least-privilege IAM
   credential** (read/write on that database, nothing else), not with your
-  main API key.
+  main API key. Object Storage, when enabled, gets its own separate dedicated
+  credential that can only use Object Storage (and, thanks to the bucket
+  policy above, cannot read the Terraform state).
 - A weekly drift-detection plan opens an issue when the real infrastructure
   no longer matches the code.
 
@@ -296,6 +321,7 @@ included (Scaleway `fr-par` list prices, excl. VAT):
 | Serverless SQL (both envs)        | idle most of the time      | ~€0.20 storage + a few cents of compute    |
 | Object Storage (Terraform state)  | a few MB                   | ~€0                                        |
 | Container Registry                | 1-2 image versions         | ~€0.05 (€0 if the registry is public)      |
+| Object Storage (optional)         | only if `--object-storage` | ~€0 idle (a few GB of storage when used)   |
 | **Total to start**                |                            | **under ~€1 / month**                      |
 
 Compute is billed per second, only while actually serving: an idle container
@@ -321,6 +347,17 @@ No. The CLI bootstraps via APIs; Terraform runs inside GitHub Actions.
 Yes. The CLI asks for the name and the visibility; default is public (the
 infra holds no secrets), or choose private interactively or with `--private`.
 
+**Can I point keel at an existing repository?**
+Only if it has no commits. keel pushes a brand-new history, so a repository
+that already has commits (even just a README from the GitHub UI) would reject
+the push; the CLI checks this up front and asks for another name. The easiest
+path is to let keel create the repository for you.
+
+**Can I reuse an existing Infisical project?**
+Yes: pass its project ID (`--infisical-project-id` or interactively). The CLI
+verifies the machine identity can access it before anything is created. Leave
+it empty and keel creates a project named after your app instead.
+
 **Why is the container not created on the first apply?**
 A Serverless Container needs an image, and none exists yet. Registry and
 database are created immediately; the container is gated on
@@ -331,9 +368,21 @@ Scaleway Serverless Containers have no built-in auth in front of public
 endpoints. Credentials live in Infisical, the container gets
 `BASIC_AUTH_ENABLED=true`, and a few lines of middleware enforce it.
 
-**Can I add more environments?**
-Yes: add a workspace, a `<env>.tfvars`, an Infisical environment, and mirror
-one job in each workflow.
+**Which environments do I get, and can I change them?**
+You choose at creation: production only, staging + production (default), or
+dev + staging + production — interactively or with `--environments`
+(e.g. `--environments prod` or `--environments dev,staging,prod`). Production
+is always gated by a manual approval; non-production environments enable Basic
+Auth by default. To add one to an existing repo later: add a `<env>.tfvars`
+(the plan and drift workflows discover environments from the tfvars files at
+the repo root automatically), an Infisical environment with the same slug, and
+a chained job in `terraform-apply.yml`.
+
+**Can I store files, not just rows?**
+Yes, opt in with `--object-storage` (or answer yes interactively). Each
+environment gets its own Object Storage bucket and a dedicated credential; the
+pipeline syncs the `S3_*` coordinates to Infisical for the app to read. It is
+off by default — many apps only need the database.
 
 ## CLI reference
 
@@ -348,13 +397,21 @@ one job in each workflow.
 --infisical-host <url>         or env INFISICAL_HOST (default: https://app.infisical.com)
 --infisical-client-id <id>     or env INFISICAL_CLIENT_ID
 --infisical-client-secret <s>  or env INFISICAL_CLIENT_SECRET
---infisical-project-name <n>   Infisical project (default: project name)
+--infisical-project-id <id>    Existing Infisical project ID to reuse
+                               (or env INFISICAL_PROJECT_ID; default: create by name)
+--infisical-project-name <n>   Infisical project name (default: project name)
 --github-token <token>         or env GITHUB_TOKEN / GH_TOKEN (scopes: repo, workflow)
 --repo-name <name>             GitHub repository name (default: project name)
 --private / --public           Repository visibility (default: public)
---no-basic-auth                Disable Basic Auth on staging
+--environments <preset>        prod | staging+prod | dev+staging+prod
+                               (or a list like "dev,staging,prod"; default staging+prod)
+--object-storage               Provision a per-environment Object Storage bucket
+--no-object-storage            Do not provision Object Storage (default)
+--basic-auth                   Enable Basic Auth on non-production environments (default)
+--no-basic-auth                Disable Basic Auth on non-production environments
+--dev-min-scale <n>            Default 0        --dev-max-scale <n>       Default 1
 --staging-min-scale <n>        Default 0        --staging-max-scale <n>   Default 1
---prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 2
+--prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 1
 --config <file.json>           Load answers from a JSON file
 --advanced                     Also ask scaling questions interactively
 --yes                          Accept defaults, skip the confirmation prompt
@@ -368,8 +425,10 @@ is taken from the environment or asked interactively:
 {
   "projectName": "my-app",
   "region": "fr-par",
+  "environments": ["staging", "prod"],
+  "objectStorage": true,
   "github": { "repoPrivate": true },
-  "scaling": { "prodMaxScale": 4 }
+  "scaling": { "prod": { "maxScale": 4 } }
 }
 ```
 

package/dist/bootstrap/github.js

@@ -4,47 +4,104 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Octokit } from '@octokit/rest';
+import { planStatusCheckContext } from '../contracts.js';
 // The ESM build of libsodium-wrappers is broken (missing libsodium.mjs), so
 // load the CommonJS build explicitly.
 const require = createRequire(import.meta.url);
 const sodium = require('libsodium-wrappers');
 export class GitHubError extends Error {
+    field;
+    constructor(message, field = 'token') {
+        super(message);
+        this.field = field;
+    }
 }
-export async function createContext(answers) {
-    const octokit = new Octokit({ auth: answers.github.token });
+export async function createContext(github) {
+    // Silence Octokit's own request logging: expected non-2xx responses (a 404
+    // for a repo that does not exist yet, a 401 for a bad token) are handled
+    // here and would otherwise scribble over the prompt spinner.
+    const octokit = new Octokit({
+        auth: github.token,
+        log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
+    });
     let login;
     let ownerId;
+    let scopes;
     try {
-        const { data } = await octokit.users.getAuthenticated();
+        const { data, headers } = await octokit.users.getAuthenticated();
         login = data.login;
         ownerId = data.id;
+        scopes = headers['x-oauth-scopes'];
     }
     catch {
         throw new GitHubError('GitHub rejected the token. It needs the "repo" and "workflow" scopes ' +
             '(classic PAT) or equivalent fine-grained permissions.');
     }
+    // Classic PATs advertise their scopes in a header; fine-grained tokens do
+    // not, so an absent/empty header only means "cannot check here".
+    if (scopes) {
+        const granted = new Set(scopes.split(',').map((s) => s.trim()));
+        for (const required of ['repo', 'workflow']) {
+            if (!granted.has(required)) {
+                throw new GitHubError(`The GitHub token is missing the "${required}" scope (it has: ${scopes}). ` +
+                    'Create a classic PAT with the "repo" and "workflow" scopes.');
+            }
+        }
+    }
     return {
         octokit,
         owner: login,
         ownerId,
-        repo: answers.github.repoName,
-        repoPrivate: answers.github.repoPrivate,
+        repo: github.repoName,
+        repoPrivate: github.repoPrivate,
     };
 }
-/** Create the repository, or reuse it when it already exists. */
-export async function ensureRepo(ctx) {
+/** Read-only look at the target repository: existence, push access, emptiness. */
+export async function inspectRepo(ctx) {
+    let url;
     try {
         const { data } = await ctx.octokit.repos.get({ owner: ctx.owner, repo: ctx.repo });
-        if (!data.permissions?.push) {
-            throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`);
-        }
-        return { created: false, url: data.html_url };
+        if (!data.permissions?.push)
+            return { state: 'no-push', url: data.html_url };
+        url = data.html_url;
     }
     catch (error) {
-        if (error instanceof GitHubError)
-            throw error;
-        if (error.status !== 404)
-            throw error;
+        if (error.status === 404)
+            return { state: 'not-found' };
+        throw error;
+    }
+    try {
+        const { data } = await ctx.octokit.repos.listCommits({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            per_page: 1,
+        });
+        return { state: data.length > 0 ? 'non-empty' : 'empty', url };
+    }
+    catch (error) {
+        // GitHub answers 409 "Git Repository is empty" for a repo with no commits.
+        if (error.status === 409)
+            return { state: 'empty', url };
+        throw error;
+    }
+}
+/** Turn a blocking repo state into a GitHubError; pass on 'not-found'/'empty'. */
+export function assertRepoUsable(ctx, state) {
+    if (state === 'no-push') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`, 'repo');
+    }
+    if (state === 'non-empty') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} already has commits. keel pushes a brand-new ` +
+            'history, so the push would be rejected: use a new repository name (keel creates ' +
+            'it for you) or an existing repository with no commits.', 'repo');
+    }
+}
+/** Create the repository, or reuse it when it already exists and is empty. */
+export async function ensureRepo(ctx) {
+    const inspected = await inspectRepo(ctx);
+    assertRepoUsable(ctx, inspected.state);
+    if (inspected.state !== 'not-found') {
+        return { created: false, url: inspected.url };
     }
     const { data } = await ctx.octokit.repos.createForAuthenticatedUser({
         name: ctx.repo,
@@ -100,23 +157,27 @@ export function pushRepo(ctx, token, targetDir) {
 /** Encrypt and upload every CI secret, then set the plain variables. */
 export async function configureRepo(ctx, answers, infisicalProjectId) {
     // The workflows map AWS_* (state backend) from the same SCW_* secrets, so
-    // each credential is stored once and rotated in one place.
-    await setSecrets(ctx, {
+    // each credential is stored once and rotated in one place. The Record types
+    // force these names to stay in lockstep with the contracts the generated
+    // workflows are tested against.
+    const secrets = {
         SCW_ACCESS_KEY: answers.scaleway.accessKey,
         SCW_SECRET_KEY: answers.scaleway.secretKey,
         SCW_DEFAULT_PROJECT_ID: answers.scaleway.projectId,
         SCW_DEFAULT_ORGANIZATION_ID: answers.scaleway.organizationId,
         INFISICAL_CLIENT_ID: answers.infisical.clientId,
         INFISICAL_CLIENT_SECRET: answers.infisical.clientSecret,
-    });
-    await setVariables(ctx, {
+    };
+    await setSecrets(ctx, secrets);
+    const variables = {
         TF_STATE_BUCKET: answers.stateBucket,
         SCW_REGION: answers.region,
         INFISICAL_PROJECT_ID: infisicalProjectId,
         INFISICAL_HOST: answers.infisical.host,
-    });
-    await configureEnvironments(ctx);
-    await protectMainBranch(ctx);
+    };
+    await setVariables(ctx, variables);
+    await configureEnvironments(ctx, answers);
+    await protectMainBranch(ctx, answers);
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -157,29 +218,28 @@ async function setVariables(ctx, variables) {
         }
     }
 }
-/** staging deploys automatically; production requires a manual approval. */
-async function configureEnvironments(ctx) {
-    await ctx.octokit.repos.createOrUpdateEnvironment({
-        owner: ctx.owner,
-        repo: ctx.repo,
-        environment_name: 'staging',
-    });
-    await ctx.octokit.repos.createOrUpdateEnvironment({
-        owner: ctx.owner,
-        repo: ctx.repo,
-        environment_name: 'production',
-        reviewers: [{ type: 'User', id: ctx.ownerId }],
-    });
+/** Each environment gets a GitHub deployment environment; gated ones (prod) require approval. */
+async function configureEnvironments(ctx, answers) {
+    for (const env of answers.environments) {
+        await ctx.octokit.repos.createOrUpdateEnvironment({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            environment_name: env.githubEnvironment,
+            ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+        });
+    }
 }
 /** Require a green plan on PRs and forbid force-pushes/deletion of main. */
-async function protectMainBranch(ctx) {
+async function protectMainBranch(ctx, answers) {
     await ctx.octokit.repos.updateBranchProtection({
         owner: ctx.owner,
         repo: ctx.repo,
         branch: 'main',
         required_status_checks: {
             strict: false,
-            contexts: ['plan (staging)', 'plan (prod)'],
+            // Must match the job names produced by the plan workflow; the shared
+            // format lives in contracts.ts and is tested against the template.
+            contexts: answers.environments.map((env) => planStatusCheckContext(env.slug)),
         },
         enforce_admins: false,
         required_pull_request_reviews: null,

package/dist/bootstrap/infisical.js

@@ -1,5 +1,11 @@
 import { randomBytes } from 'node:crypto';
+import { S3_SECRET_KEYS } from '../contracts.js';
 export class InfisicalError extends Error {
+    field;
+    constructor(message, field = 'credentials') {
+        super(message);
+        this.field = field;
+    }
 }
 async function api(host, path, options = {}) {
     const response = await fetch(`${host}${path}`, {
@@ -20,8 +26,8 @@ async function api(host, path, options = {}) {
     }
     return { status: response.status, data };
 }
-export async function login(answers) {
-    const { host, clientId, clientSecret } = answers.infisical;
+export async function login(infisical) {
+    const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
         throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
@@ -29,11 +35,18 @@ export async function login(answers) {
     }
     return data.accessToken;
 }
-async function findProject(host, token, name) {
+async function listProjects(host, token) {
     const { status, data } = await api(host, '/api/v1/workspace', { token });
     if (status !== 200)
-        return undefined;
-    return data.workspaces?.find((w) => w.name === name);
+        return [];
+    return data.workspaces ?? [];
+}
+async function findProject(host, token, name) {
+    return (await listProjects(host, token)).find((w) => w.name === name);
+}
+/** Look an existing project up by ID among those the identity can access. */
+export async function findProjectById(host, token, id) {
+    return (await listProjects(host, token)).find((w) => w.id === id);
 }
 async function createProject(host, token, name) {
     const { status, data } = await api(host, '/api/v2/workspace', { method: 'POST', token, body: { projectName: name } });
@@ -43,10 +56,9 @@ async function createProject(host, token, name) {
     }
     return data.project;
 }
-async function ensureEnvironment(host, token, project, slug) {
+async function ensureEnvironment(host, token, project, slug, name) {
     if (project.environments?.some((e) => e.slug === slug))
         return;
-    const name = slug === 'prod' ? 'Production' : 'Staging';
     const { status, data } = await api(host, `/api/v1/workspace/${project.id}/environments`, { method: 'POST', token, body: { name, slug } });
     // 400 usually means the environment already exists: fine for idempotency.
     if (status !== 200 && status !== 400) {
@@ -72,24 +84,61 @@ async function seedSecret(host, token, projectId, environment, name, value) {
         throw new InfisicalError(`Could not seed secret ${name} in ${environment} (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
     }
 }
-/** Create/reuse the project, ensure staging+prod, seed placeholder secrets. */
+function inaccessibleProject(projectId) {
+    return new InfisicalError(`Infisical project "${projectId}" was not found or the machine identity has no access to it. ` +
+        'Check the project ID and that the identity is a member of the project.', 'project');
+}
+/**
+ * Read-only validation: Universal Auth login works and, when a project ID was
+ * given, that project is accessible. Returns the project name when found.
+ */
+export async function validateInfisical(infisical) {
+    const token = await login(infisical);
+    if (infisical.projectId) {
+        const project = await findProjectById(infisical.host, token, infisical.projectId);
+        if (!project)
+            throw inaccessibleProject(infisical.projectId);
+        return { projectName: project.name };
+    }
+    return {};
+}
+/** Create/reuse the project, ensure every environment, seed placeholder secrets. */
 export async function bootstrapInfisical(answers) {
-    const { host, projectName } = answers.infisical;
-    const token = await login(answers);
+    const { host, projectName, projectId } = answers.infisical;
+    const token = await login(answers.infisical);
     let createdProject = false;
-    let project = await findProject(host, token, projectName);
-    if (!project) {
-        project = await createProject(host, token, projectName);
-        createdProject = true;
+    let project;
+    if (projectId) {
+        // An explicit ID is never created implicitly: fail loudly if unreachable.
+        project = await findProjectById(host, token, projectId);
+        if (!project)
+            throw inaccessibleProject(projectId);
     }
-    await ensureEnvironment(host, token, project, 'staging');
-    await ensureEnvironment(host, token, project, 'prod');
-    if (answers.basicAuthStaging) {
-        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_USER', 'staging');
-        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+    else {
+        // Find-by-name keeps re-runs idempotent even without a recorded ID.
+        project = await findProject(host, token, projectName);
+        if (!project) {
+            project = await createProject(host, token, projectName);
+            createdProject = true;
+        }
     }
+    for (const env of answers.environments) {
+        await ensureEnvironment(host, token, project, env.slug, env.displayName);
+    }
+    // Real values arrive from the pipeline after the first apply; seed placeholders
+    // now so the secret paths exist and the container has something to read.
     const placeholder = 'placeholder-updated-by-pipeline-after-first-apply';
-    await seedSecret(host, token, project.id, 'staging', 'DATABASE_URL', placeholder);
-    await seedSecret(host, token, project.id, 'prod', 'DATABASE_URL', placeholder);
+    for (const env of answers.environments) {
+        if (env.basicAuth) {
+            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_USER', env.slug);
+            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+        }
+        await seedSecret(host, token, project.id, env.slug, 'DATABASE_URL', placeholder);
+        if (answers.objectStorage) {
+            for (const key of S3_SECRET_KEYS) {
+                await seedSecret(host, token, project.id, env.slug, key, placeholder);
+            }
+        }
+    }
     return { projectId: project.id, createdProject };
 }