@gambi97/keel-cli 0.1.1

package/dist/index.js

@@ -0,0 +1,294 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { parseArgs } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { ConfigError, finalizeAnswers, fromEnv, mergeAnswers, missingRequired, } from './config.js';
+import { generateProject, GenerateError } from './generate.js';
+import { confirmSummary, fillMissing } from './prompts.js';
+import { isDone, loadState, markDone, STATE_FILE, stepData } from './state.js';
+import { cancel, intro, log, outro, renderNextSteps, renderSummary, withSpinner } from './ui.js';
+import { ensureStateBucket, validateScalewayCredentials } from './bootstrap/scaleway.js';
+import { bootstrapInfisical, login as infisicalLogin } from './bootstrap/infisical.js';
+import { configureRepo, createContext, ensureRepo, pushRepo, } from './bootstrap/github.js';
+const HELP = `keel: generate and bootstrap serverless infra on Scaleway
+
+Usage:
+  npx @gambi97/keel-cli [options]
+
+Options:
+  --name <name>                  Project name (dns-safe)
+  --dir <path>                   Target directory (default: ./<name>)
+  --region <region>              fr-par | nl-ams | pl-waw (default: fr-par)
+  --scw-access-key <key>         Scaleway access key        (env SCW_ACCESS_KEY)
+  --scw-secret-key <key>         Scaleway secret key        (env SCW_SECRET_KEY)
+  --scw-project-id <id>          Scaleway project ID        (env SCW_DEFAULT_PROJECT_ID)
+  --scw-organization-id <id>     Scaleway organization ID   (env SCW_DEFAULT_ORGANIZATION_ID)
+  --infisical-host <url>         Infisical host             (env INFISICAL_HOST)
+  --infisical-client-id <id>     Machine identity client ID (env INFISICAL_CLIENT_ID)
+  --infisical-client-secret <s>  Machine identity secret    (env INFISICAL_CLIENT_SECRET)
+  --infisical-project-name <n>   Infisical project (default: project name)
+  --github-token <token>         GitHub token, repo+workflow (env GITHUB_TOKEN)
+  --repo-name <name>             GitHub repository name (default: project name)
+  --private / --public           GitHub repository visibility (default: public)
+  --no-basic-auth                Disable Basic Auth on staging
+  --staging-min-scale <n>        Staging min instances (default 0)
+  --staging-max-scale <n>        Staging max instances (default 1)
+  --prod-min-scale <n>           Prod min instances (default 0)
+  --prod-max-scale <n>           Prod max instances (default 2)
+  --config <file.json>           Read answers from a JSON config file
+  --advanced                     Also ask scaling questions interactively
+  --yes                          Accept defaults, no confirmation prompt
+  --dry-run                      Generate files locally, touch no account
+  --help, --version
+`;
+function parseCli(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: {
+            name: { type: 'string' },
+            dir: { type: 'string' },
+            region: { type: 'string' },
+            'scw-access-key': { type: 'string' },
+            'scw-secret-key': { type: 'string' },
+            'scw-project-id': { type: 'string' },
+            'scw-organization-id': { type: 'string' },
+            'infisical-host': { type: 'string' },
+            'infisical-client-id': { type: 'string' },
+            'infisical-client-secret': { type: 'string' },
+            'infisical-project-name': { type: 'string' },
+            'github-token': { type: 'string' },
+            'repo-name': { type: 'string' },
+            private: { type: 'boolean' },
+            public: { type: 'boolean' },
+            'basic-auth': { type: 'boolean' },
+            'no-basic-auth': { type: 'boolean' },
+            'staging-min-scale': { type: 'string' },
+            'staging-max-scale': { type: 'string' },
+            'prod-min-scale': { type: 'string' },
+            'prod-max-scale': { type: 'string' },
+            config: { type: 'string' },
+            advanced: { type: 'boolean' },
+            yes: { type: 'boolean' },
+            'dry-run': { type: 'boolean' },
+            help: { type: 'boolean' },
+            version: { type: 'boolean' },
+        },
+    });
+    if (values.help) {
+        process.stdout.write(HELP);
+        process.exit(0);
+    }
+    if (values.version) {
+        process.stdout.write(`${toolVersion()}\n`);
+        process.exit(0);
+    }
+    const fileAnswers = values.config
+        ? normalizeConfigFile(JSON.parse(readFileSync(values.config, 'utf8')))
+        : { scaleway: {}, infisical: {}, github: {}, scaling: {} };
+    const num = (v) => (v === undefined ? undefined : Number(v));
+    const flagAnswers = {
+        projectName: values.name,
+        targetDir: values.dir,
+        region: values.region,
+        scaleway: {
+            accessKey: values['scw-access-key'],
+            secretKey: values['scw-secret-key'],
+            projectId: values['scw-project-id'],
+            organizationId: values['scw-organization-id'],
+        },
+        infisical: {
+            host: values['infisical-host'],
+            clientId: values['infisical-client-id'],
+            clientSecret: values['infisical-client-secret'],
+            projectName: values['infisical-project-name'],
+        },
+        github: {
+            token: values['github-token'],
+            repoName: values['repo-name'],
+            repoPrivate: values.private ? true : values.public ? false : undefined,
+        },
+        basicAuthStaging: values['no-basic-auth'] ? false : values['basic-auth'],
+        scaling: {
+            stagingMinScale: num(values['staging-min-scale']),
+            stagingMaxScale: num(values['staging-max-scale']),
+            prodMinScale: num(values['prod-min-scale']),
+            prodMaxScale: num(values['prod-max-scale']),
+        },
+    };
+    return {
+        partial: mergeAnswers(fromEnv(process.env), fileAnswers, flagAnswers),
+        flags: {
+            yes: values.yes ?? false,
+            dryRun: values['dry-run'] ?? false,
+            advanced: values.advanced ?? false,
+        },
+    };
+}
+/** Config files use the same nested shape as PartialAnswers. */
+function normalizeConfigFile(raw) {
+    const obj = (raw ?? {});
+    return mergeAnswers({
+        projectName: obj.projectName,
+        region: obj.region,
+        targetDir: obj.targetDir,
+        basicAuthStaging: obj.basicAuthStaging,
+        scaleway: (obj.scaleway ?? {}),
+        infisical: (obj.infisical ?? {}),
+        github: (obj.github ?? {}),
+        scaling: (obj.scaling ?? {}),
+    });
+}
+function toolVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+function checkEnvironment() {
+    const [major] = process.versions.node.split('.');
+    if (Number(major) < 18) {
+        cancel(`Node.js >= 18 is required (found ${process.versions.node}).`);
+    }
+    if (spawnSync('git', ['--version'], { stdio: 'ignore' }).status !== 0) {
+        cancel('git is required but was not found on PATH.');
+    }
+}
+function printDryRunPlan(answers) {
+    log.info([
+        'Dry run: generated the repository locally. A real run would additionally:',
+        `  - Scaleway: create Object Storage bucket "${answers.stateBucket}" (${answers.region})`,
+        `  - Infisical: create/reuse project "${answers.infisical.projectName}", environments staging/prod,`,
+        '    seed BASIC_AUTH_USER/BASIC_AUTH_PASSWORD (staging) and DATABASE_URL placeholders',
+        `  - GitHub: create ${answers.github.repoPrivate ? 'private' : 'public'} repo "${answers.github.repoName}", push, set 6 encrypted secrets,`,
+        '    4 variables, staging/production environments and main branch protection',
+    ].join('\n'));
+}
+async function runBootstrap(answers, state) {
+    const dir = answers.targetDir;
+    // All three credentials are checked before anything is created anywhere,
+    // so a bad token cannot leave a half-bootstrapped account behind.
+    let ctx;
+    await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
+        await validateScalewayCredentials(answers);
+        await infisicalLogin(answers);
+        ctx = await createContext(answers);
+    });
+    if (!isDone(state, 'scaleway-bucket')) {
+        await withSpinner('Creating Terraform state bucket', () => ensureStateBucket(answers));
+        markDone(dir, state, 'scaleway-bucket');
+    }
+    else {
+        log.info('Scaleway state bucket: already done, skipping.');
+    }
+    let infisicalProjectId = stepData(state, 'infisical', 'projectId');
+    if (!infisicalProjectId) {
+        const result = await withSpinner('Bootstrapping Infisical project and secrets', () => bootstrapInfisical(answers));
+        infisicalProjectId = result.projectId;
+        markDone(dir, state, 'infisical', { projectId: infisicalProjectId });
+    }
+    else {
+        log.info('Infisical project: already done, skipping.');
+    }
+    let repoUrl = stepData(state, 'github-repo', 'url');
+    if (!repoUrl) {
+        const repo = await withSpinner(`Creating GitHub repository ${ctx.owner}/${ctx.repo}`, () => ensureRepo(ctx));
+        repoUrl = repo.url;
+        markDone(dir, state, 'github-repo', { url: repoUrl });
+    }
+    else {
+        log.info('GitHub repository: already done, skipping.');
+    }
+    if (!isDone(state, 'github-push')) {
+        await withSpinner('Pushing generated code to GitHub', async () => {
+            pushRepo(ctx, answers.github.token, dir);
+        });
+        markDone(dir, state, 'github-push');
+    }
+    else {
+        log.info('GitHub push: already done, skipping.');
+    }
+    if (!isDone(state, 'github-config')) {
+        await withSpinner('Setting GitHub secrets, variables and branch protection', () => configureRepo(ctx, answers, infisicalProjectId));
+        markDone(dir, state, 'github-config');
+    }
+    else {
+        log.info('GitHub configuration: already done, skipping.');
+    }
+    return repoUrl;
+}
+async function main() {
+    const { partial, flags } = parseCli(process.argv.slice(2));
+    intro(toolVersion());
+    checkEnvironment();
+    const interactive = process.stdin.isTTY && !flags.yes;
+    let collected = partial;
+    if (interactive) {
+        collected = await fillMissing(partial, { advanced: flags.advanced });
+    }
+    else if (!flags.dryRun) {
+        const missing = missingRequired(partial);
+        if (missing.length > 0) {
+            cancel(`Non-interactive run is missing required values:\n  - ${missing.join('\n  - ')}`);
+        }
+    }
+    // In a dry run, missing credentials are replaced by placeholders: nothing
+    // will be validated against or sent to any account.
+    if (flags.dryRun) {
+        collected = mergeAnswers({
+            scaleway: {
+                accessKey: 'dry-run',
+                secretKey: 'dry-run',
+                projectId: 'dry-run',
+                organizationId: 'dry-run',
+            },
+            infisical: { clientId: 'dry-run', clientSecret: 'dry-run' },
+            github: { token: 'dry-run' },
+            scaling: {},
+        }, collected);
+        if (!collected.projectName)
+            collected.projectName = 'my-app';
+    }
+    const answers = finalizeAnswers(collected);
+    const summary = renderSummary(answers, flags.dryRun);
+    if (interactive) {
+        const confirmed = await confirmSummary(summary);
+        if (!confirmed)
+            cancel('Aborted. Nothing was created.');
+    }
+    else {
+        log.info(summary);
+    }
+    const state = loadState(answers.targetDir, answers.projectName);
+    if (!isDone(state, 'generate')) {
+        await withSpinner(`Generating repository in ./${answers.targetDir}`, async () => {
+            generateProject(answers);
+        });
+        markDone(answers.targetDir, state, 'generate');
+    }
+    else {
+        log.info('Generation: already done, skipping.');
+    }
+    if (flags.dryRun) {
+        printDryRunPlan(answers);
+        outro('Dry run complete. No account was touched.');
+        return;
+    }
+    const repoUrl = await runBootstrap(answers, state);
+    outro(renderNextSteps(answers, repoUrl, `rg.${answers.region}.scw.cloud/${answers.projectName}-staging`));
+}
+main().catch((error) => {
+    if (error instanceof ConfigError || error instanceof GenerateError) {
+        log.error(error.message);
+    }
+    else {
+        log.error(error instanceof Error ? error.message : String(error));
+        log.warn('The run stopped before completing. Completed steps are recorded in ' +
+            `${STATE_FILE} inside the project directory: re-run the same ` +
+            'command to resume from where it failed. Already-created resources are reused, never duplicated.');
+    }
+    process.exit(1);
+});

package/dist/prompts.js

@@ -0,0 +1,109 @@
+import * as p from '@clack/prompts';
+import { ConfigError, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, REGIONS, validateProjectName, validateScale, } from './config.js';
+function bail() {
+    p.cancel('Cancelled. Nothing was created.');
+    process.exit(1);
+}
+async function ask(promise) {
+    const value = await promise;
+    if (p.isCancel(value))
+        bail();
+    return value;
+}
+function validate(fn) {
+    return (value) => {
+        try {
+            fn(value);
+            return undefined;
+        }
+        catch (error) {
+            return error instanceof ConfigError ? error.message : 'Invalid value.';
+        }
+    };
+}
+/** Interactively fill everything still missing from flags/env/config file. */
+export async function fillMissing(partial, options) {
+    const out = structuredClone(partial);
+    if (!out.projectName) {
+        out.projectName = await ask(p.text({
+            message: 'Project name (dns-safe, used for repo, bucket and resources)',
+            placeholder: 'my-app',
+            validate: validate(validateProjectName),
+        }));
+    }
+    if (!out.region) {
+        out.region = await ask(p.select({
+            message: 'Scaleway region',
+            initialValue: DEFAULT_REGION,
+            options: REGIONS.map((r) => ({ value: r, label: r })),
+        }));
+    }
+    const secret = (message) => ask(p.password({ message }));
+    const text = (message, placeholder) => ask(p.text({
+        message,
+        ...(placeholder ? { placeholder } : {}),
+        validate: (v) => (v.trim() ? undefined : 'Required.'),
+    }));
+    if (!out.scaleway.accessKey)
+        out.scaleway.accessKey = await text('Scaleway access key');
+    if (!out.scaleway.secretKey)
+        out.scaleway.secretKey = await secret('Scaleway secret key');
+    if (!out.scaleway.projectId)
+        out.scaleway.projectId = await text('Scaleway project ID');
+    if (!out.scaleway.organizationId)
+        out.scaleway.organizationId = await text('Scaleway organization ID');
+    if (!out.infisical.host) {
+        out.infisical.host = await ask(p.text({ message: 'Infisical host', initialValue: DEFAULT_INFISICAL_HOST }));
+    }
+    if (!out.infisical.clientId)
+        out.infisical.clientId = await text('Infisical machine identity client ID');
+    if (!out.infisical.clientSecret)
+        out.infisical.clientSecret = await secret('Infisical machine identity client secret');
+    if (!out.infisical.projectName) {
+        out.infisical.projectName = await ask(p.text({
+            message: 'Infisical project name (existing project is reused, otherwise created)',
+            initialValue: out.projectName,
+        }));
+    }
+    if (!out.github.token)
+        out.github.token = await secret('GitHub token (scopes: repo, workflow)');
+    if (!out.github.repoName) {
+        out.github.repoName = await ask(p.text({
+            message: 'GitHub repository name',
+            initialValue: out.projectName,
+            validate: validate(validateProjectName),
+        }));
+    }
+    if (out.github.repoPrivate === undefined) {
+        out.github.repoPrivate = await ask(p.select({
+            message: 'Repository visibility',
+            initialValue: false,
+            options: [
+                { value: false, label: 'Public', hint: 'the infra contains no secrets' },
+                { value: true, label: 'Private' },
+            ],
+        }));
+    }
+    if (out.basicAuthStaging === undefined) {
+        out.basicAuthStaging = await ask(p.confirm({
+            message: 'Protect staging with Basic Auth (enforced by your app)?',
+            initialValue: true,
+        }));
+    }
+    if (options.advanced) {
+        const scale = async (message, initial) => Number(await ask(p.text({
+            message,
+            initialValue: String(initial),
+            validate: validate((v) => validateScale(v, 'scale')),
+        })));
+        out.scaling.stagingMinScale = await scale('Staging min scale', out.scaling.stagingMinScale ?? 0);
+        out.scaling.stagingMaxScale = await scale('Staging max scale', out.scaling.stagingMaxScale ?? 1);
+        out.scaling.prodMinScale = await scale('Prod min scale', out.scaling.prodMinScale ?? 0);
+        out.scaling.prodMaxScale = await scale('Prod max scale', out.scaling.prodMaxScale ?? 2);
+    }
+    return out;
+}
+export async function confirmSummary(summary) {
+    p.note(summary, 'About to create');
+    return ask(p.confirm({ message: 'Proceed? No account is touched before this point.' }));
+}

package/dist/state.js

@@ -0,0 +1,29 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const STATE_FILE = '.keel.json';
+export function loadState(targetDir, projectName) {
+    try {
+        const raw = readFileSync(join(targetDir, STATE_FILE), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.version === 1 && parsed.projectName === projectName) {
+            return parsed;
+        }
+    }
+    catch {
+        // No resume file or unreadable: start fresh.
+    }
+    return { version: 1, projectName, steps: {} };
+}
+export function saveState(targetDir, state) {
+    writeFileSync(join(targetDir, STATE_FILE), `${JSON.stringify(state, null, 2)}\n`);
+}
+export function isDone(state, step) {
+    return state.steps[step] !== undefined;
+}
+export function markDone(targetDir, state, step, data) {
+    state.steps[step] = data ? { data } : {};
+    saveState(targetDir, state);
+}
+export function stepData(state, step, key) {
+    return state.steps[step]?.data?.[key];
+}

package/dist/ui.js

@@ -0,0 +1,76 @@
+import * as p from '@clack/prompts';
+export const log = p.log;
+export function intro(version) {
+    p.intro(`keel v${version}`);
+}
+export function outro(message) {
+    p.outro(message);
+}
+export function cancel(message) {
+    p.cancel(message);
+    process.exit(1);
+}
+/** Show only a hint of a secret, never the value itself. */
+export function redact(secret) {
+    if (secret.length <= 6)
+        return '***';
+    return `${secret.slice(0, 4)}…(redacted)`;
+}
+export async function withSpinner(label, fn) {
+    const spinner = p.spinner();
+    spinner.start(label);
+    try {
+        const result = await fn();
+        spinner.stop(`${label} ✓`);
+        return result;
+    }
+    catch (error) {
+        spinner.stop(`${label} ✗`, 1);
+        throw error;
+    }
+}
+export function renderSummary(answers, dryRun) {
+    const lines = [
+        `Project          ${answers.projectName}`,
+        `Directory        ./${answers.targetDir}`,
+        `Region           ${answers.region}`,
+        '',
+        'Scaleway',
+        `  access key     ${redact(answers.scaleway.accessKey)}`,
+        `  project        ${answers.scaleway.projectId}`,
+        `  state bucket   ${answers.stateBucket} (will be created)`,
+        '',
+        'GitHub',
+        `  repository     ${answers.github.repoName} (${answers.github.repoPrivate ? 'private' : 'public'}, will be created + pushed)`,
+        `  secrets        SCW_*, INFISICAL_* (encrypted)`,
+        `  variables      TF_STATE_BUCKET, SCW_REGION, INFISICAL_PROJECT_ID, INFISICAL_HOST`,
+        '',
+        'Infisical',
+        `  host           ${answers.infisical.host}`,
+        `  project        ${answers.infisical.projectName} (created or reused)`,
+        `  environments   staging, prod (+ placeholder secrets)`,
+        '',
+        `Basic Auth on staging   ${answers.basicAuthStaging ? 'enabled' : 'disabled'}`,
+        `Scaling staging         ${answers.scaling.stagingMinScale}-${answers.scaling.stagingMaxScale} instances`,
+        `Scaling prod            ${answers.scaling.prodMinScale}-${answers.scaling.prodMaxScale} instances`,
+    ];
+    if (dryRun) {
+        lines.push('', 'DRY RUN: files will be generated locally, no account will be touched.');
+    }
+    return lines.join('\n');
+}
+export function renderNextSteps(answers, repoUrl, containerUrlHint) {
+    return [
+        'Next steps:',
+        '',
+        `  1. Add a Dockerfile to your application and push its image to the`,
+        `     registry created by the first pipeline run (${containerUrlHint}).`,
+        `  2. Replace the placeholder secrets in Infisical (${answers.infisical.host})`,
+        `     project "${answers.infisical.projectName}" with real values.`,
+        `  3. Push to main (or merge a PR) to trigger the first terraform apply:`,
+        `     ${repoUrl}/actions`,
+        `  4. Set container_image in staging.tfvars / prod.tfvars once an image exists.`,
+        '',
+        `Repository: ${repoUrl}`,
+    ].join('\n');
+}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@gambi97/keel-cli",
+  "version": "0.1.1",
+  "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
+  "keywords": [
+    "keel",
+    "scaleway",
+    "terraform",
+    "serverless",
+    "infisical",
+    "github-actions",
+    "scaffold",
+    "infrastructure"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Gambi97/keel.git"
+  },
+  "homepage": "https://github.com/Gambi97/keel#readme",
+  "bugs": {
+    "url": "https://github.com/Gambi97/keel/issues"
+  },
+  "type": "module",
+  "bin": {
+    "keel": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "engines": {
+    "node": ">=18.17.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "vitest run",
+    "verify:templates": "node scripts/verify-templates.mjs",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run lint && npm run test"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.600.0",
+    "@clack/prompts": "^0.11.0",
+    "@octokit/rest": "^21.0.0",
+    "libsodium-wrappers": "^0.7.13"
+  },
+  "devDependencies": {
+    "@types/libsodium-wrappers": "^0.7.14",
+    "@types/node": "^20.14.0",
+    "eslint": "^9.0.0",
+    "prettier": "^3.3.0",
+    "typescript": "^5.5.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^3.0.0"
+  }
+}

package/templates/.github/scripts/sync-database-url.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Pushes the ready-to-use database connection string (dedicated IAM
+# credential included) to Infisical as DATABASE_URL.
+# Usage: sync-database-url.sh <staging|prod>
+# Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
+#          INFISICAL_PROJECT_ID in the environment; terraform init already run.
+set -euo pipefail
+
+ENVIRONMENT="${1:?usage: sync-database-url.sh <staging|prod>}"
+
+DB_URL="$(terraform output -raw database_url)"
+if [ -z "$DB_URL" ]; then
+  echo "No database_url in outputs, skipping Infisical sync."
+  exit 0
+fi
+echo "::add-mask::$DB_URL"
+
+ACCESS_TOKEN="$(curl -sS --fail-with-body -X POST \
+  "$INFISICAL_HOST/api/v1/auth/universal-auth/login" \
+  -H "Content-Type: application/json" \
+  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}" \
+  | jq -r .accessToken)"
+echo "::add-mask::$ACCESS_TOKEN"
+
+payload="$(jq -n \
+  --arg workspaceId "$INFISICAL_PROJECT_ID" \
+  --arg environment "$ENVIRONMENT" \
+  --arg value "$DB_URL" \
+  '{workspaceId: $workspaceId, environment: $environment, secretPath: "/", secretValue: $value, type: "shared"}')"
+
+# Update the placeholder seeded at bootstrap; create the secret if missing.
+status="$(curl -sS -o /dev/null -w "%{http_code}" -X PATCH \
+  "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "$payload")"
+
+if [ "$status" = "404" ]; then
+  curl -sS --fail-with-body -o /dev/null -X POST \
+    "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "$payload"
+elif [ "$status" -ge 300 ]; then
+  echo "Failed to update DATABASE_URL in Infisical (HTTP $status)" >&2
+  exit 1
+fi
+
+echo "DATABASE_URL synced to Infisical ($ENVIRONMENT)."