@gambi97/keel-cli 0.1.1

package/dist/bootstrap/infisical.js

@@ -0,0 +1,95 @@
+import { randomBytes } from 'node:crypto';
+export class InfisicalError extends Error {
+}
+async function api(host, path, options = {}) {
+    const response = await fetch(`${host}${path}`, {
+        method: options.method ?? 'GET',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(options.token ? { Authorization: `Bearer ${options.token}` } : {}),
+        },
+        ...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
+    });
+    const text = await response.text();
+    let data;
+    try {
+        data = (text ? JSON.parse(text) : {});
+    }
+    catch {
+        data = {};
+    }
+    return { status: response.status, data };
+}
+export async function login(answers) {
+    const { host, clientId, clientSecret } = answers.infisical;
+    const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
+    if (status !== 200 || !data.accessToken) {
+        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
+            'Check the machine identity client ID/secret and that Universal Auth is enabled.');
+    }
+    return data.accessToken;
+}
+async function findProject(host, token, name) {
+    const { status, data } = await api(host, '/api/v1/workspace', { token });
+    if (status !== 200)
+        return undefined;
+    return data.workspaces?.find((w) => w.name === name);
+}
+async function createProject(host, token, name) {
+    const { status, data } = await api(host, '/api/v2/workspace', { method: 'POST', token, body: { projectName: name } });
+    if (status !== 200 || !data.project) {
+        throw new InfisicalError(`Could not create Infisical project "${name}" (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
+            'The machine identity needs permission to create projects.');
+    }
+    return data.project;
+}
+async function ensureEnvironment(host, token, project, slug) {
+    if (project.environments?.some((e) => e.slug === slug))
+        return;
+    const name = slug === 'prod' ? 'Production' : 'Staging';
+    const { status, data } = await api(host, `/api/v1/workspace/${project.id}/environments`, { method: 'POST', token, body: { name, slug } });
+    // 400 usually means the environment already exists: fine for idempotency.
+    if (status !== 200 && status !== 400) {
+        throw new InfisicalError(`Could not create Infisical environment "${slug}" (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
+    }
+}
+async function seedSecret(host, token, projectId, environment, name, value) {
+    const { status, data } = await api(host, `/api/v3/secrets/raw/${name}`, {
+        method: 'POST',
+        token,
+        body: {
+            workspaceId: projectId,
+            environment,
+            secretPath: '/',
+            secretValue: value,
+            type: 'shared',
+        },
+    });
+    if (status === 400 && /exist/i.test(data.message ?? '')) {
+        return; // Already seeded on a previous run: never overwrite.
+    }
+    if (status !== 200) {
+        throw new InfisicalError(`Could not seed secret ${name} in ${environment} (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
+    }
+}
+/** Create/reuse the project, ensure staging+prod, seed placeholder secrets. */
+export async function bootstrapInfisical(answers) {
+    const { host, projectName } = answers.infisical;
+    const token = await login(answers);
+    let createdProject = false;
+    let project = await findProject(host, token, projectName);
+    if (!project) {
+        project = await createProject(host, token, projectName);
+        createdProject = true;
+    }
+    await ensureEnvironment(host, token, project, 'staging');
+    await ensureEnvironment(host, token, project, 'prod');
+    if (answers.basicAuthStaging) {
+        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_USER', 'staging');
+        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+    }
+    const placeholder = 'placeholder-updated-by-pipeline-after-first-apply';
+    await seedSecret(host, token, project.id, 'staging', 'DATABASE_URL', placeholder);
+    await seedSecret(host, token, project.id, 'prod', 'DATABASE_URL', placeholder);
+    return { projectId: project.id, createdProject };
+}

package/dist/bootstrap/scaleway.js

@@ -0,0 +1,65 @@
+import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
+export class ScalewayError extends Error {
+}
+const API_BASE = 'https://api.scaleway.com';
+/**
+ * Validate credentials with a harmless read call before creating anything.
+ * Also confirms the project belongs to the given organization.
+ */
+export async function validateScalewayCredentials(answers) {
+    const { secretKey, projectId, organizationId } = answers.scaleway;
+    const response = await fetch(`${API_BASE}/account/v3/projects/${projectId}`, {
+        headers: { 'X-Auth-Token': secretKey },
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw new ScalewayError('Scaleway rejected the API key (401/403). Check SCW_ACCESS_KEY / SCW_SECRET_KEY and ' +
+            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.');
+    }
+    if (response.status === 404) {
+        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`);
+    }
+    if (!response.ok) {
+        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`);
+    }
+    const project = (await response.json());
+    if (project.organization_id && project.organization_id !== organizationId) {
+        throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
+            `not ${organizationId}. Check --scw-organization-id.`);
+    }
+}
+function s3Client(answers) {
+    return new S3Client({
+        region: answers.region,
+        endpoint: `https://s3.${answers.region}.scw.cloud`,
+        credentials: {
+            accessKeyId: answers.scaleway.accessKey,
+            secretAccessKey: answers.scaleway.secretKey,
+        },
+    });
+}
+/** Create the Terraform state bucket if it does not exist yet (idempotent). */
+export async function ensureStateBucket(answers) {
+    const client = s3Client(answers);
+    const bucket = answers.stateBucket;
+    try {
+        await client.send(new HeadBucketCommand({ Bucket: bucket }));
+        return { created: false }; // Already exists and we own it.
+    }
+    catch (error) {
+        const status = error.$metadata?.httpStatusCode;
+        if (status === 403) {
+            throw new ScalewayError(`Bucket "${bucket}" already exists but is owned by another account. ` +
+                'Choose a different project name.');
+        }
+        if (status !== 404 && status !== 301) {
+            throw error;
+        }
+    }
+    await client.send(new CreateBucketCommand({ Bucket: bucket }));
+    // Versioning protects the state history against accidental overwrites.
+    await client.send(new PutBucketVersioningCommand({
+        Bucket: bucket,
+        VersioningConfiguration: { Status: 'Enabled' },
+    }));
+    return { created: true };
+}

package/dist/config.js

@@ -0,0 +1,153 @@
+export const REGIONS = ['fr-par', 'nl-ams', 'pl-waw'];
+export const DEFAULT_INFISICAL_HOST = 'https://app.infisical.com';
+export const DEFAULT_REGION = 'fr-par';
+export const DEFAULT_SCALING = {
+    stagingMinScale: 0,
+    stagingMaxScale: 1,
+    prodMinScale: 0,
+    prodMaxScale: 2,
+};
+export class ConfigError extends Error {
+}
+const PROJECT_NAME_RE = /^[a-z](?:[a-z0-9-]{0,48}[a-z0-9])?$/;
+export function validateProjectName(name) {
+    const trimmed = name.trim();
+    if (!PROJECT_NAME_RE.test(trimmed) || trimmed.includes('--')) {
+        throw new ConfigError(`Invalid project name "${trimmed}": use 1-50 lowercase letters, digits or single hyphens, ` +
+            'starting with a letter and not ending with a hyphen (DNS-safe).');
+    }
+    return trimmed;
+}
+export function validateRegion(region) {
+    const trimmed = region.trim();
+    if (!REGIONS.includes(trimmed)) {
+        throw new ConfigError(`Invalid region "${region}". Supported regions: ${REGIONS.join(', ')}.`);
+    }
+    return trimmed;
+}
+export function validateScale(value, label) {
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isInteger(n) || n < 0 || n > 20) {
+        throw new ConfigError(`Invalid ${label}: expected an integer between 0 and 20.`);
+    }
+    return n;
+}
+export function validateUrl(value, label) {
+    let parsed;
+    try {
+        parsed = new URL(value.trim());
+    }
+    catch {
+        throw new ConfigError(`Invalid ${label}: "${value}" is not a valid URL.`);
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new ConfigError(`Invalid ${label}: only http(s) URLs are supported.`);
+    }
+    return parsed.origin;
+}
+function requireString(value, label) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        throw new ConfigError(`Missing required value: ${label}.`);
+    }
+    return trimmed;
+}
+export function stateBucketName(projectName) {
+    return `${projectName}-tfstate`;
+}
+/** Read partial answers from environment variables. */
+export function fromEnv(env) {
+    return {
+        scaleway: {
+            accessKey: env.SCW_ACCESS_KEY,
+            secretKey: env.SCW_SECRET_KEY,
+            projectId: env.SCW_DEFAULT_PROJECT_ID ?? env.SCW_PROJECT_ID,
+            organizationId: env.SCW_DEFAULT_ORGANIZATION_ID ?? env.SCW_ORGANIZATION_ID,
+        },
+        infisical: {
+            host: env.INFISICAL_HOST,
+            clientId: env.INFISICAL_CLIENT_ID,
+            clientSecret: env.INFISICAL_CLIENT_SECRET,
+        },
+        github: {
+            token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
+        },
+        scaling: {},
+    };
+}
+/** Merge partial answers; later sources win over earlier ones. */
+export function mergeAnswers(...sources) {
+    const out = { scaleway: {}, infisical: {}, github: {}, scaling: {} };
+    for (const src of sources) {
+        for (const key of ['projectName', 'region', 'targetDir', 'basicAuthStaging']) {
+            const value = src[key];
+            if (value !== undefined) {
+                out[key] = value;
+            }
+        }
+        for (const group of ['scaleway', 'infisical', 'github', 'scaling']) {
+            for (const [k, v] of Object.entries(src[group] ?? {})) {
+                if (v !== undefined) {
+                    out[group][k] = v;
+                }
+            }
+        }
+    }
+    return out;
+}
+/** Validate a fully-collected set of answers and freeze it into a Config. */
+export function finalizeAnswers(partial) {
+    const projectName = validateProjectName(requireString(partial.projectName, 'project name'));
+    const region = validateRegion(partial.region ?? DEFAULT_REGION);
+    return {
+        projectName,
+        region,
+        targetDir: partial.targetDir?.trim() || projectName,
+        stateBucket: stateBucketName(projectName),
+        scaleway: {
+            accessKey: requireString(partial.scaleway.accessKey, 'Scaleway access key'),
+            secretKey: requireString(partial.scaleway.secretKey, 'Scaleway secret key'),
+            projectId: requireString(partial.scaleway.projectId, 'Scaleway project ID'),
+            organizationId: requireString(partial.scaleway.organizationId, 'Scaleway organization ID'),
+        },
+        infisical: {
+            host: validateUrl(partial.infisical.host ?? DEFAULT_INFISICAL_HOST, 'Infisical host'),
+            clientId: requireString(partial.infisical.clientId, 'Infisical client ID'),
+            clientSecret: requireString(partial.infisical.clientSecret, 'Infisical client secret'),
+            projectName: partial.infisical.projectName?.trim() || projectName,
+        },
+        github: {
+            token: requireString(partial.github.token, 'GitHub token'),
+            repoName: validateProjectName(partial.github.repoName?.trim() || projectName),
+            repoPrivate: partial.github.repoPrivate ?? false,
+        },
+        basicAuthStaging: partial.basicAuthStaging ?? true,
+        scaling: {
+            stagingMinScale: validateScale(partial.scaling.stagingMinScale ?? DEFAULT_SCALING.stagingMinScale, 'staging min scale'),
+            stagingMaxScale: validateScale(partial.scaling.stagingMaxScale ?? DEFAULT_SCALING.stagingMaxScale, 'staging max scale'),
+            prodMinScale: validateScale(partial.scaling.prodMinScale ?? DEFAULT_SCALING.prodMinScale, 'prod min scale'),
+            prodMaxScale: validateScale(partial.scaling.prodMaxScale ?? DEFAULT_SCALING.prodMaxScale, 'prod max scale'),
+        },
+    };
+}
+/** List which required values are still missing, for non-interactive runs. */
+export function missingRequired(partial) {
+    const missing = [];
+    if (!partial.projectName?.trim())
+        missing.push('project name (--name)');
+    if (!partial.scaleway.accessKey?.trim())
+        missing.push('Scaleway access key (--scw-access-key or SCW_ACCESS_KEY)');
+    if (!partial.scaleway.secretKey?.trim())
+        missing.push('Scaleway secret key (--scw-secret-key or SCW_SECRET_KEY)');
+    if (!partial.scaleway.projectId?.trim())
+        missing.push('Scaleway project ID (--scw-project-id or SCW_DEFAULT_PROJECT_ID)');
+    if (!partial.scaleway.organizationId?.trim())
+        missing.push('Scaleway organization ID (--scw-organization-id or SCW_DEFAULT_ORGANIZATION_ID)');
+    if (!partial.infisical.clientId?.trim())
+        missing.push('Infisical client ID (--infisical-client-id or INFISICAL_CLIENT_ID)');
+    if (!partial.infisical.clientSecret?.trim())
+        missing.push('Infisical client secret (--infisical-client-secret or INFISICAL_CLIENT_SECRET)');
+    if (!partial.github.token?.trim())
+        missing.push('GitHub token (--github-token or GITHUB_TOKEN)');
+    return missing;
+}

package/dist/generate.js

@@ -0,0 +1,104 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { STATE_FILE } from './state.js';
+export class GenerateError extends Error {
+}
+/** Files whose real name would confuse npm packaging are stored renamed. */
+const RENAMES = {
+    _gitignore: '.gitignore',
+};
+export function templatesDir() {
+    return fileURLToPath(new URL('../templates', import.meta.url));
+}
+export function tokenMap(answers) {
+    return {
+        __PROJECT_NAME__: answers.projectName,
+        __REGION__: answers.region,
+        __TF_STATE_BUCKET__: answers.stateBucket,
+        __STAGING_MIN_SCALE__: String(answers.scaling.stagingMinScale),
+        __STAGING_MAX_SCALE__: String(answers.scaling.stagingMaxScale),
+        __PROD_MIN_SCALE__: String(answers.scaling.prodMinScale),
+        __PROD_MAX_SCALE__: String(answers.scaling.prodMaxScale),
+    };
+}
+function renderContent(content, tokens, file) {
+    let out = content;
+    for (const [token, value] of Object.entries(tokens)) {
+        out = out.replaceAll(token, value);
+    }
+    const leftover = out.match(/__[A-Z0-9_]+__/);
+    if (leftover) {
+        throw new GenerateError(`Template ${file} contains an unknown token: ${leftover[0]}`);
+    }
+    return out;
+}
+function walk(dir, base = '') {
+    const files = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const rel = base ? `${base}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            files.push(...walk(join(dir, entry.name), rel));
+        }
+        else {
+            files.push(rel);
+        }
+    }
+    return files;
+}
+/** Render all templates into targetDir and create the initial git commit. */
+export function generateProject(answers, options = {}) {
+    const source = templatesDir();
+    const tokens = tokenMap(answers);
+    const target = answers.targetDir;
+    if (existsSync(target) && readdirSync(target).some((f) => f !== STATE_FILE)) {
+        throw new GenerateError(`Directory "${target}" already exists and is not empty. ` +
+            'Pick a different name with --dir or remove it first.');
+    }
+    mkdirSync(target, { recursive: true });
+    const written = [];
+    for (const rel of walk(source)) {
+        const parts = rel.split('/');
+        const fileName = parts[parts.length - 1] ?? rel;
+        const destRel = [...parts.slice(0, -1), RENAMES[fileName] ?? fileName].join('/');
+        const destPath = join(target, destRel);
+        mkdirSync(join(target, ...parts.slice(0, -1)), { recursive: true });
+        const rendered = renderContent(readFileSync(join(source, rel), 'utf8'), tokens, rel);
+        writeFileSync(destPath, rendered);
+        if (destRel.endsWith('.sh')) {
+            chmodSync(destPath, 0o755);
+        }
+        written.push(destRel);
+    }
+    // backend.hcl (git-ignored) so local terraform runs work out of the box.
+    cpSync(join(target, 'backend.hcl.example'), join(target, 'backend.hcl'));
+    if (options.git !== false) {
+        gitInit(target);
+    }
+    return written;
+}
+function run(cwd, args, extraEnv = {}) {
+    const result = spawnSync('git', args, {
+        cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, ...extraEnv },
+    });
+    if (result.status !== 0) {
+        throw new GenerateError(`git ${args[0]} failed: ${result.stderr?.toString().trim()}`);
+    }
+}
+function gitInit(target) {
+    if (!existsSync(join(target, '.git'))) {
+        run(target, ['init', '-b', 'main']);
+    }
+    run(target, ['add', '-A']);
+    const status = spawnSync('git', ['status', '--porcelain'], { cwd: target });
+    if (status.stdout.toString().trim() === '') {
+        return; // Nothing to commit (resume case).
+    }
+    // Fall back to a tool identity when the user has no git identity configured.
+    const hasIdentity = spawnSync('git', ['config', 'user.email'], { cwd: target }).status === 0;
+    const identity = hasIdentity ? [] : ['-c', 'user.name=keel', '-c', 'user.email=noreply@keel'];
+    run(target, [...identity, 'commit', '-m', 'Initial infrastructure from keel']);
+}