@gambi97/keel-cli 0.1.1 → 0.2.1

package/dist/prompts.js

@@ -1,5 +1,10 @@
 import * as p from '@clack/prompts';
-import { ConfigError, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, REGIONS, validateProjectName, validateScale, } from './config.js';
+import { createContext, GitHubError, inspectRepo, assertRepoUsable } from './bootstrap/github.js';
+import { InfisicalError, validateInfisical } from './bootstrap/infisical.js';
+import { ScalewayError, validateScalewayCredentials } from './bootstrap/scaleway.js';
+import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
+import { isDone, loadState } from './state.js';
+import { log } from './ui.js';
 function bail() {
     p.cancel('Cancelled. Nothing was created.');
     process.exit(1);
@@ -21,87 +26,289 @@ function validate(fn) {
         }
     };
 }
-/** Interactively fill everything still missing from flags/env/config file. */
+const secret = (message) => ask(p.password({ message }));
+const text = (message, placeholder) => ask(p.text({
+    message,
+    ...(placeholder ? { placeholder } : {}),
+    validate: (v) => (v.trim() ? undefined : 'Required.'),
+}));
+/**
+ * Interactively fill everything still missing from flags/env/config file.
+ *
+ * The project name comes first (it seeds the repo/bucket/project defaults),
+ * then the three provider blocks (GitHub, Infisical, Scaleway) — each closed
+ * by a read-only validation call that reports bad input immediately and
+ * re-asks only the offending value — and finally the configuration you want
+ * (region, environments, storage, scaling). Nothing is created here; creation
+ * starts only after the final confirmation.
+ */
 export async function fillMissing(partial, options) {
     const out = structuredClone(partial);
-    if (!out.projectName) {
-        out.projectName = await ask(p.text({
-            message: 'Project name (dns-safe, used for repo, bucket and resources)',
-            placeholder: 'my-app',
-            validate: validate(validateProjectName),
-        }));
-    }
-    if (!out.region) {
-        out.region = await ask(p.select({
-            message: 'Scaleway region',
-            initialValue: DEFAULT_REGION,
-            options: REGIONS.map((r) => ({ value: r, label: r })),
-        }));
+    await askProjectName(out);
+    // Each block opens with a "┌ <Provider>" section corner and closes with a
+    // "└ <Provider> connected — …" line, so every question flows inside its own
+    // section and the next one opens only when the previous is verified.
+    if (!options.dryRun) {
+        await askGitHub(out);
+        await askInfisical(out);
+        await askScaleway(out);
     }
-    const secret = (message) => ask(p.password({ message }));
-    const text = (message, placeholder) => ask(p.text({
-        message,
-        ...(placeholder ? { placeholder } : {}),
-        validate: (v) => (v.trim() ? undefined : 'Required.'),
+    // Configuration comes last: with the accounts verified, these are the only
+    // real choices left. In a dry run it is all that is asked after the name.
+    await askConfiguration(out, options);
+    return out;
+}
+async function askProjectName(out) {
+    if (out.projectName)
+        return;
+    out.projectName = await ask(p.text({
+        message: 'Project name (dns-safe, used for repo, bucket and resources)',
+        placeholder: 'my-app',
+        validate: validate(validateProjectName),
     }));
-    if (!out.scaleway.accessKey)
-        out.scaleway.accessKey = await text('Scaleway access key');
-    if (!out.scaleway.secretKey)
-        out.scaleway.secretKey = await secret('Scaleway secret key');
-    if (!out.scaleway.projectId)
-        out.scaleway.projectId = await text('Scaleway project ID');
-    if (!out.scaleway.organizationId)
-        out.scaleway.organizationId = await text('Scaleway organization ID');
-    if (!out.infisical.host) {
-        out.infisical.host = await ask(p.text({ message: 'Infisical host', initialValue: DEFAULT_INFISICAL_HOST }));
-    }
-    if (!out.infisical.clientId)
-        out.infisical.clientId = await text('Infisical machine identity client ID');
-    if (!out.infisical.clientSecret)
-        out.infisical.clientSecret = await secret('Infisical machine identity client secret');
-    if (!out.infisical.projectName) {
-        out.infisical.projectName = await ask(p.text({
-            message: 'Infisical project name (existing project is reused, otherwise created)',
-            initialValue: out.projectName,
-        }));
-    }
-    if (!out.github.token)
-        out.github.token = await secret('GitHub token (scopes: repo, workflow)');
-    if (!out.github.repoName) {
-        out.github.repoName = await ask(p.text({
-            message: 'GitHub repository name',
-            initialValue: out.projectName,
-            validate: validate(validateProjectName),
+}
+/** Everything that shapes the infrastructure: region, environments, options. */
+async function askConfiguration(out, options) {
+    p.intro('Configuration — region, environments and options');
+    await askRegion(out);
+    if (!out.environments || out.environments.length === 0) {
+        const preset = await ask(p.select({
+            message: 'Which environments do you want?',
+            initialValue: DEFAULT_ENV_PRESET,
+            options: [
+                { value: 'prod', label: 'Production only', hint: 'single environment' },
+                { value: 'staging+prod', label: 'Staging + Production', hint: 'recommended' },
+                { value: 'dev+staging+prod', label: 'Dev + Staging + Production' },
+            ],
         }));
+        out.environments = ENV_PRESETS[preset];
     }
-    if (out.github.repoPrivate === undefined) {
-        out.github.repoPrivate = await ask(p.select({
-            message: 'Repository visibility',
+    const slugs = out.environments;
+    const hasNonProd = slugs.some((s) => s !== 'prod');
+    if (out.objectStorage === undefined) {
+        out.objectStorage = await ask(p.confirm({
+            message: 'Provision an Object Storage bucket for application files (in addition to the database)?',
             initialValue: false,
-            options: [
-                { value: false, label: 'Public', hint: 'the infra contains no secrets' },
-                { value: true, label: 'Private' },
-            ],
         }));
     }
-    if (out.basicAuthStaging === undefined) {
-        out.basicAuthStaging = await ask(p.confirm({
-            message: 'Protect staging with Basic Auth (enforced by your app)?',
+    if (hasNonProd && out.basicAuth === undefined) {
+        out.basicAuth = await ask(p.confirm({
+            message: 'Protect non-production environments with Basic Auth (enforced by your app)?',
             initialValue: true,
         }));
     }
+    // Production is the one scaling knob worth surfacing at setup: everything
+    // scales to zero when idle, and this is the ceiling. Staging/dev stay 0-1;
+    // full per-environment control lives behind --advanced.
+    if (!options.advanced && slugs.includes('prod') && out.scaling.prod?.maxScale === undefined) {
+        const max = await ask(p.text({
+            message: 'Maximum production instances (idle scales to zero; raise later in prod.tfvars)',
+            initialValue: String(envDefaultScale('prod').maxScale),
+            validate: validate((v) => validateScale(v, 'prod max scale')),
+        }));
+        out.scaling.prod = { ...(out.scaling.prod ?? {}), maxScale: Number(max) };
+    }
     if (options.advanced) {
         const scale = async (message, initial) => Number(await ask(p.text({
             message,
             initialValue: String(initial),
             validate: validate((v) => validateScale(v, 'scale')),
         })));
-        out.scaling.stagingMinScale = await scale('Staging min scale', out.scaling.stagingMinScale ?? 0);
-        out.scaling.stagingMaxScale = await scale('Staging max scale', out.scaling.stagingMaxScale ?? 1);
-        out.scaling.prodMinScale = await scale('Prod min scale', out.scaling.prodMinScale ?? 0);
-        out.scaling.prodMaxScale = await scale('Prod max scale', out.scaling.prodMaxScale ?? 2);
+        for (const slug of slugs) {
+            const def = envDefaultScale(slug);
+            const current = out.scaling[slug] ?? {};
+            current.minScale = await scale(`${slug} min scale`, current.minScale ?? def.minScale);
+            current.maxScale = await scale(`${slug} max scale`, current.maxScale ?? def.maxScale);
+            out.scaling[slug] = current;
+        }
+    }
+}
+/** GitHub block: repo + token, then verify token, scopes and repo state. */
+async function askGitHub(out) {
+    // When resuming a run that already pushed, the repo legitimately has
+    // commits: a non-empty repo must not block the resume.
+    const targetDir = out.targetDir?.trim() || out.projectName;
+    const alreadyPushed = isDone(loadState(targetDir, out.projectName), 'github-push');
+    p.intro('GitHub — repository, visibility and token');
+    for (;;) {
+        if (!out.github.repoName) {
+            out.github.repoName = await ask(p.text({
+                message: 'GitHub repository name (a new empty repository works best)',
+                initialValue: out.projectName,
+                validate: validate(validateProjectName),
+            }));
+        }
+        if (out.github.repoPrivate === undefined) {
+            out.github.repoPrivate = await ask(p.select({
+                message: 'Repository visibility',
+                initialValue: false,
+                options: [
+                    { value: false, label: 'Public', hint: 'the infra contains no secrets' },
+                    { value: true, label: 'Private' },
+                ],
+            }));
+        }
+        if (!out.github.token) {
+            out.github.token = await secret('GitHub token (scopes: repo, workflow)');
+        }
+        try {
+            const ctx = await createContext({
+                token: out.github.token,
+                repoName: out.github.repoName,
+                repoPrivate: out.github.repoPrivate ?? false,
+            });
+            const { state } = await inspectRepo(ctx);
+            if (!(state === 'non-empty' && alreadyPushed)) {
+                assertRepoUsable(ctx, state);
+            }
+            const repo = `${ctx.owner}/${out.github.repoName}`;
+            p.outro(state === 'not-found'
+                ? `GitHub connected — ${repo} will be created after confirmation.`
+                : state === 'non-empty'
+                    ? `GitHub connected — resuming, ${repo} was already pushed.`
+                    : `GitHub connected — existing empty repository ${repo} will be reused.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof GitHubError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'repo') {
+                out.github.repoName = undefined;
+            }
+            else {
+                out.github.token = undefined;
+            }
+        }
+    }
+}
+/** Infisical block: host + machine identity, then verify login and project. */
+async function askInfisical(out) {
+    p.intro('Infisical — secret-manager project and machine identity');
+    if (!out.infisical.host) {
+        const choice = await ask(p.select({
+            message: 'Infisical host',
+            initialValue: 'us',
+            options: [
+                { value: 'us', label: 'US — app.infisical.com', hint: 'default' },
+                { value: 'eu', label: 'EU — eu.infisical.com' },
+                { value: 'other', label: 'Other (self-hosted)' },
+            ],
+        }));
+        if (choice === 'us')
+            out.infisical.host = DEFAULT_INFISICAL_HOST;
+        else if (choice === 'eu')
+            out.infisical.host = 'https://eu.infisical.com';
+        else {
+            out.infisical.host = await ask(p.text({
+                message: 'Infisical host URL',
+                placeholder: 'https://infisical.example.com',
+                validate: validate((v) => validateUrl(v, 'Infisical host')),
+            }));
+        }
+    }
+    for (;;) {
+        if (!out.infisical.clientId) {
+            out.infisical.clientId = await text('Infisical machine identity client ID');
+        }
+        if (!out.infisical.clientSecret) {
+            out.infisical.clientSecret = await secret('Infisical machine identity client secret');
+        }
+        if (!out.infisical.projectId && !out.infisical.projectName) {
+            const id = await ask(p.text({
+                message: `Infisical project ID to reuse (leave empty to create "${out.projectName}")`,
+                placeholder: 'empty: create a new project',
+                defaultValue: '',
+            }));
+            if (id.trim())
+                out.infisical.projectId = id.trim();
+            else
+                out.infisical.projectName = out.projectName;
+        }
+        try {
+            const { projectName } = await validateInfisical({
+                host: out.infisical.host,
+                clientId: out.infisical.clientId,
+                clientSecret: out.infisical.clientSecret,
+                projectId: out.infisical.projectId,
+            });
+            if (projectName)
+                out.infisical.projectName = projectName;
+            p.outro(out.infisical.projectId
+                ? `Infisical connected — existing project "${projectName}" (${out.infisical.projectId}) will be reused.`
+                : `Infisical connected — project "${out.infisical.projectName}" will be created after confirmation.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof InfisicalError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'project') {
+                out.infisical.projectId = undefined;
+                out.infisical.projectName = undefined;
+            }
+            else {
+                out.infisical.clientId = undefined;
+                out.infisical.clientSecret = undefined;
+            }
+        }
+    }
+}
+async function askRegion(out) {
+    if (out.region)
+        return;
+    out.region = await ask(p.select({
+        message: 'Scaleway region',
+        initialValue: DEFAULT_REGION,
+        options: REGIONS.map((r) => ({ value: r, label: r })),
+    }));
+}
+/** Scaleway block: keys + IDs, then verify with a read-only API call. */
+async function askScaleway(out) {
+    p.intro('Scaleway — account keys and project');
+    for (;;) {
+        if (!out.scaleway.accessKey)
+            out.scaleway.accessKey = await text('Scaleway access key');
+        if (!out.scaleway.secretKey)
+            out.scaleway.secretKey = await secret('Scaleway secret key');
+        if (!out.scaleway.projectId)
+            out.scaleway.projectId = await text('Scaleway project ID');
+        if (!out.scaleway.organizationId) {
+            out.scaleway.organizationId = await text('Scaleway organization ID');
+        }
+        try {
+            await validateScalewayCredentials({
+                secretKey: out.scaleway.secretKey,
+                projectId: out.scaleway.projectId,
+                organizationId: out.scaleway.organizationId,
+            });
+            p.outro('Scaleway connected — credentials valid and project reachable.');
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof ScalewayError))
+                throw error;
+            log.error(error.message);
+            switch (error.code) {
+                case 'auth':
+                    out.scaleway.accessKey = undefined;
+                    out.scaleway.secretKey = undefined;
+                    break;
+                case 'project':
+                    out.scaleway.projectId = undefined;
+                    break;
+                case 'organization':
+                    out.scaleway.organizationId = undefined;
+                    break;
+                default: {
+                    // Transient API error: nothing to correct, offer a plain retry.
+                    const retry = await ask(p.confirm({ message: 'Scaleway API error. Retry?' }));
+                    if (!retry)
+                        bail();
+                }
+            }
+        }
     }
-    return out;
 }
 export async function confirmSummary(summary) {
     p.note(summary, 'About to create');

package/dist/ui.js

@@ -30,6 +30,7 @@ export async function withSpinner(label, fn) {
     }
 }
 export function renderSummary(answers, dryRun) {
+    const envSlugs = answers.environments.map((e) => e.slug).join(', ');
     const lines = [
         `Project          ${answers.projectName}`,
         `Directory        ./${answers.targetDir}`,
@@ -47,13 +48,24 @@ export function renderSummary(answers, dryRun) {
         '',
         'Infisical',
         `  host           ${answers.infisical.host}`,
-        `  project        ${answers.infisical.projectName} (created or reused)`,
-        `  environments   staging, prod (+ placeholder secrets)`,
+        `  project        ${answers.infisical.projectId
+            ? `${answers.infisical.projectName} (existing, ${answers.infisical.projectId})`
+            : `${answers.infisical.projectName} (will be created)`}`,
+        `  environments   ${envSlugs} (+ placeholder secrets)`,
         '',
-        `Basic Auth on staging   ${answers.basicAuthStaging ? 'enabled' : 'disabled'}`,
-        `Scaling staging         ${answers.scaling.stagingMinScale}-${answers.scaling.stagingMaxScale} instances`,
-        `Scaling prod            ${answers.scaling.prodMinScale}-${answers.scaling.prodMaxScale} instances`,
+        `Object Storage   ${answers.objectStorage ? 'enabled (per-environment bucket + S3_* secrets)' : 'disabled'}`,
+        'Environments',
     ];
+    for (const env of answers.environments) {
+        const flags = [
+            `scale ${env.minScale}-${env.maxScale}`,
+            env.gated ? 'manual approval' : 'auto-deploy',
+            env.basicAuth ? 'basic auth' : null,
+        ]
+            .filter(Boolean)
+            .join(', ');
+        lines.push(`  ${env.slug.padEnd(8)} ${flags}`);
+    }
     if (dryRun) {
         lines.push('', 'DRY RUN: files will be generated locally, no account will be touched.');
     }
@@ -69,7 +81,7 @@ export function renderNextSteps(answers, repoUrl, containerUrlHint) {
         `     project "${answers.infisical.projectName}" with real values.`,
         `  3. Push to main (or merge a PR) to trigger the first terraform apply:`,
         `     ${repoUrl}/actions`,
-        `  4. Set container_image in staging.tfvars / prod.tfvars once an image exists.`,
+        `  4. Set container_image in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')} once an image exists.`,
         '',
         `Repository: ${repoUrl}`,
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/.github/scripts/sync-secrets.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Pushes the secrets Terraform produced to Infisical, so the application reads
+# them at runtime: always DATABASE_URL (dedicated IAM credential included), plus
+# the S3_* Object Storage coordinates when that feature is enabled.
+# Usage: sync-secrets.sh <environment>
+# Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
+#          INFISICAL_PROJECT_ID in the environment; terraform init already run.
+set -euo pipefail
+
+ENVIRONMENT="${1:?usage: sync-secrets.sh <environment>}"
+
+SECRETS_JSON="$(terraform output -json infisical_secrets)"
+if [ -z "$SECRETS_JSON" ] || [ "$SECRETS_JSON" = "null" ] || [ "$SECRETS_JSON" = "{}" ]; then
+  echo "No secrets to sync."
+  exit 0
+fi
+
+ACCESS_TOKEN="$(curl -sS --fail-with-body -X POST \
+  "$INFISICAL_HOST/api/v1/auth/universal-auth/login" \
+  -H "Content-Type: application/json" \
+  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}" \
+  | jq -r .accessToken)"
+echo "::add-mask::$ACCESS_TOKEN"
+
+sync_secret() {
+  local name="$1" value="$2"
+  echo "::add-mask::$value"
+  local payload
+  payload="$(jq -n \
+    --arg workspaceId "$INFISICAL_PROJECT_ID" \
+    --arg environment "$ENVIRONMENT" \
+    --arg value "$value" \
+    '{workspaceId: $workspaceId, environment: $environment, secretPath: "/", secretValue: $value, type: "shared"}')"
+  local status
+  status="$(curl -sS -o /dev/null -w "%{http_code}" -X PATCH \
+    "$INFISICAL_HOST/api/v3/secrets/raw/$name" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "$payload")"
+  # PATCH updates the placeholder seeded at bootstrap; create the secret if missing.
+  if [ "$status" = "404" ]; then
+    curl -sS --fail-with-body -o /dev/null -X POST \
+      "$INFISICAL_HOST/api/v3/secrets/raw/$name" \
+      -H "Authorization: Bearer $ACCESS_TOKEN" \
+      -H "Content-Type: application/json" \
+      -d "$payload"
+  elif [ "$status" -ge 300 ]; then
+    echo "Failed to update $name in Infisical (HTTP $status)" >&2
+    exit 1
+  fi
+  echo "Synced $name to Infisical ($ENVIRONMENT)."
+}
+
+# Iterate the output map as base64-encoded {key,value} rows to survive any
+# special characters in the values.
+while IFS= read -r row; do
+  entry="$(echo "$row" | base64 --decode)"
+  name="$(echo "$entry" | jq -r '.key')"
+  value="$(echo "$entry" | jq -r '.value')"
+  if [ -z "$value" ] || [ "$value" = "null" ]; then
+    echo "Skipping $name (no value yet)."
+    continue
+  fi
+  sync_secret "$name" "$value"
+done < <(echo "$SECRETS_JSON" | jq -r 'to_entries[] | @base64')

package/templates/.github/workflows/terraform-drift.yml

@@ -29,13 +29,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the drift matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   drift:
     name: drift (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: [staging, prod]
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4
 

package/templates/.github/workflows/terraform-plan.yml

@@ -23,13 +23,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the plan matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   plan:
     name: plan (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: [staging, prod]
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4