@gambi97/keel-cli 0.2.0 → 0.2.1

package/README.md

@@ -28,6 +28,14 @@ provisioned by Terraform, deployed by GitHub Actions, with secrets in
 Docker image, keel gives it a place to run. You answer a few questions, push
 to `main`, and the infrastructure is live.
 
+**keel is a starting point, not a control plane.** It runs once to lay the
+foundation and hand you a repository you fully own. From then on, day-2 work —
+scaling, new environments, custom domains, rotating secrets — happens in that
+repository: edit a tfvars line, open a PR, merge. keel does not stay in the
+loop, has nothing to update, and never manages your infrastructure after the
+first setup. If you outgrow the generated layout, it is plain Terraform you
+can take anywhere.
+
 - **Near-free to start.** Compute and database scale to zero; an idle project
   costs cents per month, with no expiring trial.
 - **Scales with your product.** Pick your environments (production only, or
@@ -47,10 +55,13 @@ GitHub (see [Prerequisites](#prerequisites) for how to get each one).
 npx @gambi97/keel-cli
 ```
 
-The CLI asks for a project name, region, repository name and visibility, picks
-up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your environment as defaults,
-then shows a **complete summary of what it will create and where**. Nothing is
-touched before you confirm. When it finishes, push to `main` (or merge the
+The CLI asks for a project name, region and environments, then walks one
+provider at a time — GitHub, Infisical, Scaleway — verifying each set of
+credentials with read-only calls the moment you enter it (a bad token or a
+non-empty repository is reported immediately, and only that answer is asked
+again). It picks up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your
+environment as defaults, then shows a **complete summary of what it will
+create and where**. Nothing is touched before you confirm. When it finishes, push to `main` (or merge the
 first PR) and the pipeline provisions the infrastructure.
 
 Non-interactive and dry-run:
@@ -155,7 +166,7 @@ local tooling or production credentials.
 | Where        | What                                                                                                                                                                                                                                                   |
 | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                                                                   |
-| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking)                                                                                                                                                                   |
+| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking, restricted by a bucket policy to the identity behind your API key)                                                                                                |
 | GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; one deployment environment per selected environment (`production` gated by manual approval); branch protection on `main`                                |
 | Infisical    | A project with one environment per selected environment, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (non-production, random password), a `DATABASE_URL` placeholder per environment, and `S3_*` placeholders when Object Storage is enabled |
 
@@ -283,10 +294,18 @@ creating anything**.
   plan, production applies need manual approval.
 - Terraform state lives in a private, versioned bucket with S3-native state
   locking (`use_lockfile`), so concurrent applies cannot corrupt it.
+- The state bucket is **restricted by a bucket policy** to the identity that
+  owns the API key you give keel — the same identity CI authenticates with,
+  so the pipeline keeps working. Terraform state contains the generated
+  credentials (`DATABASE_URL`, `S3_*`), so no other principal in the project —
+  including the app's own credentials — can read it. Note that this also
+  hides the bucket from other console users; manage or remove the policy with
+  that same API key if you need to open it up.
 - The app connects to its database with a **dedicated least-privilege IAM
   credential** (read/write on that database, nothing else), not with your
   main API key. Object Storage, when enabled, gets its own separate dedicated
-  credential the same way.
+  credential that can only use Object Storage (and, thanks to the bucket
+  policy above, cannot read the Terraform state).
 - A weekly drift-detection plan opens an issue when the real infrastructure
   no longer matches the code.
 
@@ -328,6 +347,17 @@ No. The CLI bootstraps via APIs; Terraform runs inside GitHub Actions.
 Yes. The CLI asks for the name and the visibility; default is public (the
 infra holds no secrets), or choose private interactively or with `--private`.
 
+**Can I point keel at an existing repository?**
+Only if it has no commits. keel pushes a brand-new history, so a repository
+that already has commits (even just a README from the GitHub UI) would reject
+the push; the CLI checks this up front and asks for another name. The easiest
+path is to let keel create the repository for you.
+
+**Can I reuse an existing Infisical project?**
+Yes: pass its project ID (`--infisical-project-id` or interactively). The CLI
+verifies the machine identity can access it before anything is created. Leave
+it empty and keel creates a project named after your app instead.
+
 **Why is the container not created on the first apply?**
 A Serverless Container needs an image, and none exists yet. Registry and
 database are created immediately; the container is gated on
@@ -343,9 +373,10 @@ You choose at creation: production only, staging + production (default), or
 dev + staging + production — interactively or with `--environments`
 (e.g. `--environments prod` or `--environments dev,staging,prod`). Production
 is always gated by a manual approval; non-production environments enable Basic
-Auth by default. To add one to an existing repo later: add a `<env>.tfvars`,
-an Infisical environment, a matrix entry in the plan/drift workflows, and a
-chained job in `terraform-apply.yml`.
+Auth by default. To add one to an existing repo later: add a `<env>.tfvars`
+(the plan and drift workflows discover environments from the tfvars files at
+the repo root automatically), an Infisical environment with the same slug, and
+a chained job in `terraform-apply.yml`.
 
 **Can I store files, not just rows?**
 Yes, opt in with `--object-storage` (or answer yes interactively). Each
@@ -366,7 +397,9 @@ off by default — many apps only need the database.
 --infisical-host <url>         or env INFISICAL_HOST (default: https://app.infisical.com)
 --infisical-client-id <id>     or env INFISICAL_CLIENT_ID
 --infisical-client-secret <s>  or env INFISICAL_CLIENT_SECRET
---infisical-project-name <n>   Infisical project (default: project name)
+--infisical-project-id <id>    Existing Infisical project ID to reuse
+                               (or env INFISICAL_PROJECT_ID; default: create by name)
+--infisical-project-name <n>   Infisical project name (default: project name)
 --github-token <token>         or env GITHUB_TOKEN / GH_TOKEN (scopes: repo, workflow)
 --repo-name <name>             GitHub repository name (default: project name)
 --private / --public           Repository visibility (default: public)
@@ -374,10 +407,11 @@ off by default — many apps only need the database.
                                (or a list like "dev,staging,prod"; default staging+prod)
 --object-storage               Provision a per-environment Object Storage bucket
 --no-object-storage            Do not provision Object Storage (default)
+--basic-auth                   Enable Basic Auth on non-production environments (default)
 --no-basic-auth                Disable Basic Auth on non-production environments
 --dev-min-scale <n>            Default 0        --dev-max-scale <n>       Default 1
 --staging-min-scale <n>        Default 0        --staging-max-scale <n>   Default 1
---prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 2
+--prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 1
 --config <file.json>           Load answers from a JSON file
 --advanced                     Also ask scaling questions interactively
 --yes                          Accept defaults, skip the confirmation prompt

package/dist/bootstrap/github.js

@@ -4,47 +4,104 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Octokit } from '@octokit/rest';
+import { planStatusCheckContext } from '../contracts.js';
 // The ESM build of libsodium-wrappers is broken (missing libsodium.mjs), so
 // load the CommonJS build explicitly.
 const require = createRequire(import.meta.url);
 const sodium = require('libsodium-wrappers');
 export class GitHubError extends Error {
+    field;
+    constructor(message, field = 'token') {
+        super(message);
+        this.field = field;
+    }
 }
-export async function createContext(answers) {
-    const octokit = new Octokit({ auth: answers.github.token });
+export async function createContext(github) {
+    // Silence Octokit's own request logging: expected non-2xx responses (a 404
+    // for a repo that does not exist yet, a 401 for a bad token) are handled
+    // here and would otherwise scribble over the prompt spinner.
+    const octokit = new Octokit({
+        auth: github.token,
+        log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
+    });
     let login;
     let ownerId;
+    let scopes;
     try {
-        const { data } = await octokit.users.getAuthenticated();
+        const { data, headers } = await octokit.users.getAuthenticated();
         login = data.login;
         ownerId = data.id;
+        scopes = headers['x-oauth-scopes'];
     }
     catch {
         throw new GitHubError('GitHub rejected the token. It needs the "repo" and "workflow" scopes ' +
             '(classic PAT) or equivalent fine-grained permissions.');
     }
+    // Classic PATs advertise their scopes in a header; fine-grained tokens do
+    // not, so an absent/empty header only means "cannot check here".
+    if (scopes) {
+        const granted = new Set(scopes.split(',').map((s) => s.trim()));
+        for (const required of ['repo', 'workflow']) {
+            if (!granted.has(required)) {
+                throw new GitHubError(`The GitHub token is missing the "${required}" scope (it has: ${scopes}). ` +
+                    'Create a classic PAT with the "repo" and "workflow" scopes.');
+            }
+        }
+    }
     return {
         octokit,
         owner: login,
         ownerId,
-        repo: answers.github.repoName,
-        repoPrivate: answers.github.repoPrivate,
+        repo: github.repoName,
+        repoPrivate: github.repoPrivate,
     };
 }
-/** Create the repository, or reuse it when it already exists. */
-export async function ensureRepo(ctx) {
+/** Read-only look at the target repository: existence, push access, emptiness. */
+export async function inspectRepo(ctx) {
+    let url;
     try {
         const { data } = await ctx.octokit.repos.get({ owner: ctx.owner, repo: ctx.repo });
-        if (!data.permissions?.push) {
-            throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`);
-        }
-        return { created: false, url: data.html_url };
+        if (!data.permissions?.push)
+            return { state: 'no-push', url: data.html_url };
+        url = data.html_url;
     }
     catch (error) {
-        if (error instanceof GitHubError)
-            throw error;
-        if (error.status !== 404)
-            throw error;
+        if (error.status === 404)
+            return { state: 'not-found' };
+        throw error;
+    }
+    try {
+        const { data } = await ctx.octokit.repos.listCommits({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            per_page: 1,
+        });
+        return { state: data.length > 0 ? 'non-empty' : 'empty', url };
+    }
+    catch (error) {
+        // GitHub answers 409 "Git Repository is empty" for a repo with no commits.
+        if (error.status === 409)
+            return { state: 'empty', url };
+        throw error;
+    }
+}
+/** Turn a blocking repo state into a GitHubError; pass on 'not-found'/'empty'. */
+export function assertRepoUsable(ctx, state) {
+    if (state === 'no-push') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`, 'repo');
+    }
+    if (state === 'non-empty') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} already has commits. keel pushes a brand-new ` +
+            'history, so the push would be rejected: use a new repository name (keel creates ' +
+            'it for you) or an existing repository with no commits.', 'repo');
+    }
+}
+/** Create the repository, or reuse it when it already exists and is empty. */
+export async function ensureRepo(ctx) {
+    const inspected = await inspectRepo(ctx);
+    assertRepoUsable(ctx, inspected.state);
+    if (inspected.state !== 'not-found') {
+        return { created: false, url: inspected.url };
     }
     const { data } = await ctx.octokit.repos.createForAuthenticatedUser({
         name: ctx.repo,
@@ -100,21 +157,25 @@ export function pushRepo(ctx, token, targetDir) {
 /** Encrypt and upload every CI secret, then set the plain variables. */
 export async function configureRepo(ctx, answers, infisicalProjectId) {
     // The workflows map AWS_* (state backend) from the same SCW_* secrets, so
-    // each credential is stored once and rotated in one place.
-    await setSecrets(ctx, {
+    // each credential is stored once and rotated in one place. The Record types
+    // force these names to stay in lockstep with the contracts the generated
+    // workflows are tested against.
+    const secrets = {
         SCW_ACCESS_KEY: answers.scaleway.accessKey,
         SCW_SECRET_KEY: answers.scaleway.secretKey,
         SCW_DEFAULT_PROJECT_ID: answers.scaleway.projectId,
         SCW_DEFAULT_ORGANIZATION_ID: answers.scaleway.organizationId,
         INFISICAL_CLIENT_ID: answers.infisical.clientId,
         INFISICAL_CLIENT_SECRET: answers.infisical.clientSecret,
-    });
-    await setVariables(ctx, {
+    };
+    await setSecrets(ctx, secrets);
+    const variables = {
         TF_STATE_BUCKET: answers.stateBucket,
         SCW_REGION: answers.region,
         INFISICAL_PROJECT_ID: infisicalProjectId,
         INFISICAL_HOST: answers.infisical.host,
-    });
+    };
+    await setVariables(ctx, variables);
     await configureEnvironments(ctx, answers);
     await protectMainBranch(ctx, answers);
 }
@@ -176,8 +237,9 @@ async function protectMainBranch(ctx, answers) {
         branch: 'main',
         required_status_checks: {
             strict: false,
-            // Matches the job names produced by the plan workflow: "plan (<slug>)".
-            contexts: answers.environments.map((env) => `plan (${env.slug})`),
+            // Must match the job names produced by the plan workflow; the shared
+            // format lives in contracts.ts and is tested against the template.
+            contexts: answers.environments.map((env) => planStatusCheckContext(env.slug)),
         },
         enforce_admins: false,
         required_pull_request_reviews: null,

package/dist/bootstrap/infisical.js

@@ -1,5 +1,11 @@
 import { randomBytes } from 'node:crypto';
+import { S3_SECRET_KEYS } from '../contracts.js';
 export class InfisicalError extends Error {
+    field;
+    constructor(message, field = 'credentials') {
+        super(message);
+        this.field = field;
+    }
 }
 async function api(host, path, options = {}) {
     const response = await fetch(`${host}${path}`, {
@@ -20,8 +26,8 @@ async function api(host, path, options = {}) {
     }
     return { status: response.status, data };
 }
-export async function login(answers) {
-    const { host, clientId, clientSecret } = answers.infisical;
+export async function login(infisical) {
+    const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
         throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
@@ -29,11 +35,18 @@ export async function login(answers) {
     }
     return data.accessToken;
 }
-async function findProject(host, token, name) {
+async function listProjects(host, token) {
     const { status, data } = await api(host, '/api/v1/workspace', { token });
     if (status !== 200)
-        return undefined;
-    return data.workspaces?.find((w) => w.name === name);
+        return [];
+    return data.workspaces ?? [];
+}
+async function findProject(host, token, name) {
+    return (await listProjects(host, token)).find((w) => w.name === name);
+}
+/** Look an existing project up by ID among those the identity can access. */
+export async function findProjectById(host, token, id) {
+    return (await listProjects(host, token)).find((w) => w.id === id);
 }
 async function createProject(host, token, name) {
     const { status, data } = await api(host, '/api/v2/workspace', { method: 'POST', token, body: { projectName: name } });
@@ -71,22 +84,43 @@ async function seedSecret(host, token, projectId, environment, name, value) {
         throw new InfisicalError(`Could not seed secret ${name} in ${environment} (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
     }
 }
-const S3_PLACEHOLDER_KEYS = [
-    'S3_BUCKET',
-    'S3_ENDPOINT',
-    'S3_REGION',
-    'S3_ACCESS_KEY',
-    'S3_SECRET_KEY',
-];
+function inaccessibleProject(projectId) {
+    return new InfisicalError(`Infisical project "${projectId}" was not found or the machine identity has no access to it. ` +
+        'Check the project ID and that the identity is a member of the project.', 'project');
+}
+/**
+ * Read-only validation: Universal Auth login works and, when a project ID was
+ * given, that project is accessible. Returns the project name when found.
+ */
+export async function validateInfisical(infisical) {
+    const token = await login(infisical);
+    if (infisical.projectId) {
+        const project = await findProjectById(infisical.host, token, infisical.projectId);
+        if (!project)
+            throw inaccessibleProject(infisical.projectId);
+        return { projectName: project.name };
+    }
+    return {};
+}
 /** Create/reuse the project, ensure every environment, seed placeholder secrets. */
 export async function bootstrapInfisical(answers) {
-    const { host, projectName } = answers.infisical;
-    const token = await login(answers);
+    const { host, projectName, projectId } = answers.infisical;
+    const token = await login(answers.infisical);
     let createdProject = false;
-    let project = await findProject(host, token, projectName);
-    if (!project) {
-        project = await createProject(host, token, projectName);
-        createdProject = true;
+    let project;
+    if (projectId) {
+        // An explicit ID is never created implicitly: fail loudly if unreachable.
+        project = await findProjectById(host, token, projectId);
+        if (!project)
+            throw inaccessibleProject(projectId);
+    }
+    else {
+        // Find-by-name keeps re-runs idempotent even without a recorded ID.
+        project = await findProject(host, token, projectName);
+        if (!project) {
+            project = await createProject(host, token, projectName);
+            createdProject = true;
+        }
     }
     for (const env of answers.environments) {
         await ensureEnvironment(host, token, project, env.slug, env.displayName);
@@ -101,7 +135,7 @@ export async function bootstrapInfisical(answers) {
         }
         await seedSecret(host, token, project.id, env.slug, 'DATABASE_URL', placeholder);
         if (answers.objectStorage) {
-            for (const key of S3_PLACEHOLDER_KEYS) {
+            for (const key of S3_SECRET_KEYS) {
                 await seedSecret(host, token, project.id, env.slug, key, placeholder);
             }
         }

package/dist/bootstrap/scaleway.js

@@ -1,30 +1,36 @@
-import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
+import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
 export class ScalewayError extends Error {
+    code;
+    constructor(message, code = 'api') {
+        super(message);
+        this.code = code;
+    }
 }
 const API_BASE = 'https://api.scaleway.com';
 /**
  * Validate credentials with a harmless read call before creating anything.
- * Also confirms the project belongs to the given organization.
+ * Also confirms the project belongs to the given organization. Read-only: it
+ * proves the key can see the project, not that it can create resources.
  */
-export async function validateScalewayCredentials(answers) {
-    const { secretKey, projectId, organizationId } = answers.scaleway;
+export async function validateScalewayCredentials(scaleway) {
+    const { secretKey, projectId, organizationId } = scaleway;
     const response = await fetch(`${API_BASE}/account/v3/projects/${projectId}`, {
         headers: { 'X-Auth-Token': secretKey },
     });
     if (response.status === 401 || response.status === 403) {
         throw new ScalewayError('Scaleway rejected the API key (401/403). Check SCW_ACCESS_KEY / SCW_SECRET_KEY and ' +
-            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.');
+            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.', 'auth');
     }
     if (response.status === 404) {
-        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`);
+        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`, 'project');
     }
     if (!response.ok) {
-        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`);
+        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`, 'api');
     }
     const project = (await response.json());
     if (project.organization_id && project.organization_id !== organizationId) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
-            `not ${organizationId}. Check --scw-organization-id.`);
+            `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
 }
 function s3Client(answers) {
@@ -37,13 +43,90 @@ function s3Client(answers) {
         },
     });
 }
-/** Create the Terraform state bucket if it does not exist yet (idempotent). */
+/**
+ * Resolve the IAM identity (user or application) that owns the API key, in
+ * the `<kind>:<uuid>` principal form bucket policies expect. Returns
+ * undefined when the key cannot read IAM; the caller degrades to a warning.
+ */
+async function apiKeyPrincipal(scaleway) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/api-keys/${scaleway.accessKey}`, {
+            headers: { 'X-Auth-Token': scaleway.secretKey },
+        });
+        if (!response.ok)
+            return undefined;
+        const key = (await response.json());
+        if (key.application_id)
+            return `application_id:${key.application_id}`;
+        if (key.user_id)
+            return `user_id:${key.user_id}`;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Restrict the state bucket to the identity that owns the bootstrap API key —
+ * the same identity CI authenticates with, so the pipeline keeps working.
+ * Terraform state contains the generated credentials (DATABASE_URL, S3 keys),
+ * and the per-app IAM policies are project-wide for Object Storage: without
+ * this policy the app's own storage credential could read the state. An
+ * existing policy is never overwritten. Failures degrade to a warning: a
+ * missed lockdown must not strand a half-finished bootstrap.
+ */
+async function lockDownStateBucket(client, bucket, answers) {
+    try {
+        await client.send(new GetBucketPolicyCommand({ Bucket: bucket }));
+        return undefined; // A policy is already in place: leave it alone.
+    }
+    catch (error) {
+        const status = error.$metadata?.httpStatusCode;
+        if (status !== 404) {
+            return (`Could not read the policy of bucket "${bucket}" (HTTP ${status ?? 'error'}); ` +
+                'the state bucket was NOT restricted to your identity.');
+        }
+    }
+    const principal = await apiKeyPrincipal(answers.scaleway);
+    if (!principal) {
+        return ('Could not resolve the IAM identity behind the API key, so the state bucket was NOT ' +
+            'restricted: any Object Storage credential in the project can read the Terraform state. ' +
+            'Grant the key IAM read access and re-run, or add a bucket policy manually.');
+    }
+    const policy = {
+        Version: '2023-04-17',
+        Id: 'keel-state-bucket-bootstrap-identity-only',
+        Statement: [
+            {
+                Sid: 'OnlyBootstrapIdentity',
+                Effect: 'Allow',
+                Principal: { SCW: principal },
+                Action: ['*'],
+                Resource: [bucket, `${bucket}/*`],
+            },
+        ],
+    };
+    try {
+        await client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+        return undefined;
+    }
+    catch (error) {
+        return (`Could not apply a policy to bucket "${bucket}" ` +
+            `(${error instanceof Error ? error.message : String(error)}); ` +
+            'the state bucket was NOT restricted to your identity.');
+    }
+}
+/**
+ * Create the Terraform state bucket if it does not exist yet (idempotent) and
+ * restrict it to the bootstrap identity via a bucket policy.
+ */
 export async function ensureStateBucket(answers) {
     const client = s3Client(answers);
     const bucket = answers.stateBucket;
+    let created = false;
     try {
         await client.send(new HeadBucketCommand({ Bucket: bucket }));
-        return { created: false }; // Already exists and we own it.
+        // Already exists and we own it (resume): still ensure the policy below.
     }
     catch (error) {
         const status = error.$metadata?.httpStatusCode;
@@ -54,12 +137,14 @@ export async function ensureStateBucket(answers) {
         if (status !== 404 && status !== 301) {
             throw error;
         }
+        await client.send(new CreateBucketCommand({ Bucket: bucket }));
+        // Versioning protects the state history against accidental overwrites.
+        await client.send(new PutBucketVersioningCommand({
+            Bucket: bucket,
+            VersioningConfiguration: { Status: 'Enabled' },
+        }));
+        created = true;
     }
-    await client.send(new CreateBucketCommand({ Bucket: bucket }));
-    // Versioning protects the state history against accidental overwrites.
-    await client.send(new PutBucketVersioningCommand({
-        Bucket: bucket,
-        VersioningConfiguration: { Status: 'Enabled' },
-    }));
-    return { created: true };
+    const policyWarning = await lockDownStateBucket(client, bucket, answers);
+    return policyWarning ? { created, policyWarning } : { created };
 }

package/dist/config.js

@@ -29,7 +29,9 @@ const ENV_DEFAULTS = {
         production: true,
         gated: true,
         minScale: 0,
-        maxScale: 2,
+        // Start small: one instance is enough to go live and costs the least;
+        // raising the ceiling later is a one-line prod.tfvars change.
+        maxScale: 1,
     },
 };
 /** Default min/max scale for an environment, for prompts and summaries. */
@@ -134,6 +136,7 @@ export function fromEnv(env) {
             host: env.INFISICAL_HOST,
             clientId: env.INFISICAL_CLIENT_ID,
             clientSecret: env.INFISICAL_CLIENT_SECRET,
+            projectId: env.INFISICAL_PROJECT_ID,
         },
         github: {
             token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
@@ -223,6 +226,9 @@ export function finalizeAnswers(partial) {
             clientId: requireString(partial.infisical.clientId, 'Infisical client ID'),
             clientSecret: requireString(partial.infisical.clientSecret, 'Infisical client secret'),
             projectName: partial.infisical.projectName?.trim() || projectName,
+            ...(partial.infisical.projectId?.trim()
+                ? { projectId: partial.infisical.projectId.trim() }
+                : {}),
         },
         github: {
             token: requireString(partial.github.token, 'GitHub token'),

package/dist/contracts.js

@@ -0,0 +1,46 @@
+/**
+ * Names shared between the bootstrap code and the generated repository.
+ *
+ * The CLI configures the user's account by name (required status checks,
+ * Actions secrets/variables, seeded Infisical secrets) and the generated
+ * workflows and Terraform reference the same names. A rename on one side
+ * without the other passes CI here and breaks at runtime in the user's
+ * account — so both sides import these constants, and contracts.test.ts
+ * renders the templates and asserts they still agree.
+ */
+/**
+ * Job name of the plan workflow for one environment; branch protection
+ * requires exactly these contexts before a PR can merge.
+ */
+export function planStatusCheckContext(environment) {
+    return `plan (${environment})`;
+}
+/** Root Terraform output consumed by .github/scripts/sync-secrets.sh. */
+export const INFISICAL_SECRETS_OUTPUT = 'infisical_secrets';
+/**
+ * Object Storage coordinates: seeded as placeholders by the CLI, produced by
+ * the infisical_secrets output, synced to Infisical by the pipeline.
+ */
+export const S3_SECRET_KEYS = [
+    'S3_BUCKET',
+    'S3_ENDPOINT',
+    'S3_REGION',
+    'S3_ACCESS_KEY',
+    'S3_SECRET_KEY',
+];
+/** Encrypted Actions secrets set by configureRepo, read by the workflows. */
+export const CI_SECRET_NAMES = [
+    'SCW_ACCESS_KEY',
+    'SCW_SECRET_KEY',
+    'SCW_DEFAULT_PROJECT_ID',
+    'SCW_DEFAULT_ORGANIZATION_ID',
+    'INFISICAL_CLIENT_ID',
+    'INFISICAL_CLIENT_SECRET',
+];
+/** Plain Actions variables set by configureRepo, read by the workflows. */
+export const CI_VARIABLE_NAMES = [
+    'TF_STATE_BUCKET',
+    'SCW_REGION',
+    'INFISICAL_PROJECT_ID',
+    'INFISICAL_HOST',
+];

package/dist/generate.js

@@ -19,8 +19,6 @@ export function tokenMap(answers) {
         __PROJECT_NAME__: answers.projectName,
         __REGION__: answers.region,
         __TF_STATE_BUCKET__: answers.stateBucket,
-        // YAML inline list for the plan/drift job matrix, e.g. [staging, prod].
-        __ENV_MATRIX__: `[${slugs.join(', ')}]`,
         // HCL list for the `environment` variable validation in variables.tf.
         __ENV_SLUGS_TF__: `[${slugs.map((s) => `"${s}"`).join(', ')}]`,
     };
@@ -37,7 +35,15 @@ function envTfvarsTokens(answers, env) {
         __MAX_SCALE__: String(env.maxScale),
     };
 }
-/** Templates rendered specially (per environment) instead of copied 1:1. */
+/**
+ * Templates rendered specially (per environment) instead of copied 1:1.
+ *
+ * Keep this set small: the templating here is plain token replacement by
+ * design. A conditional feature must become a Terraform variable rendered
+ * into tfvars (as enable_object_storage does), never a conditionally emitted
+ * file — the day a feature cannot be expressed that way is the day to adopt
+ * a real template engine, not to add another special case here.
+ */
 const SPECIAL_TEMPLATES = new Set(['env.tfvars', '.github/workflows/terraform-apply.yml']);
 function isSpecial(rel) {
     return SPECIAL_TEMPLATES.has(rel) || rel.startsWith('_partials/');