@gambi97/keel-cli 0.2.0 → 0.3.0

package/README.md

@@ -28,6 +28,14 @@ provisioned by Terraform, deployed by GitHub Actions, with secrets in
 Docker image, keel gives it a place to run. You answer a few questions, push
 to `main`, and the infrastructure is live.
 
+**keel is a starting point, not a control plane.** It runs once to lay the
+foundation and hand you a repository you fully own. From then on, day-2 work —
+scaling, new environments, custom domains, rotating secrets — happens in that
+repository: edit a tfvars line, open a PR, merge. keel does not stay in the
+loop, has nothing to update, and never manages your infrastructure after the
+first setup. If you outgrow the generated layout, it is plain Terraform you
+can take anywhere.
+
 - **Near-free to start.** Compute and database scale to zero; an idle project
   costs cents per month, with no expiring trial.
 - **Scales with your product.** Pick your environments (production only, or
@@ -47,10 +55,13 @@ GitHub (see [Prerequisites](#prerequisites) for how to get each one).
 npx @gambi97/keel-cli
 ```
 
-The CLI asks for a project name, region, repository name and visibility, picks
-up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your environment as defaults,
-then shows a **complete summary of what it will create and where**. Nothing is
-touched before you confirm. When it finishes, push to `main` (or merge the
+The CLI asks for a project name, region and environments, then walks one
+provider at a time — GitHub, Infisical, Scaleway — verifying each set of
+credentials with read-only calls the moment you enter it (a bad token or a
+non-empty repository is reported immediately, and only that answer is asked
+again). It picks up `SCW_*` / `INFISICAL_*` / `GITHUB_TOKEN` from your
+environment as defaults, then shows a **complete summary of what it will
+create and where**. Nothing is touched before you confirm. When it finishes, push to `main` (or merge the
 first PR) and the pipeline provisions the infrastructure.
 
 Non-interactive and dry-run:
@@ -152,12 +163,12 @@ local tooling or production credentials.
 
 **Phase A: bootstrap (the CLI, via APIs, after your confirmation)**
 
-| Where        | What                                                                                                                                                                                                                                                   |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                                                                   |
-| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking)                                                                                                                                                                   |
-| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; one deployment environment per selected environment (`production` gated by manual approval); branch protection on `main`                                |
-| Infisical    | A project with one environment per selected environment, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (non-production, random password), a `DATABASE_URL` placeholder per environment, and `S3_*` placeholders when Object Storage is enabled |
+| Where        | What                                                                                                                                                                                                                                                              |
+| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                                                                              |
+| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking, restricted by a bucket policy to the identity behind your API key)                                                                                                           |
+| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; one deployment environment per selected environment (`production` gated by manual approval); branch protection on `main`                                           |
+| Infisical    | A project with one environment per selected environment, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (non-production, random password), `DATABASE_URL` / `APP_URL` placeholders per environment, and `S3_*` placeholders when Object Storage is enabled |
 
 **Phase B: first deploy (Terraform in GitHub Actions, on push to `main`)**
 
@@ -181,6 +192,7 @@ my-app/
 │   ├── terraform-plan.yml       # PR: fmt + validate + plan (every environment)
 │   ├── terraform-apply.yml      # main: apply each env in order; production gated
 │   └── terraform-drift.yml      # weekly: read-only plan, opens an issue on drift
+├── .keel/manifest.json          # committed record: keel version, contract version, options
 ├── versions.tf · providers.tf · backend.tf
 ├── backend.hcl.example          # state bucket coordinates (backend.hcl is git-ignored)
 ├── variables.tf · main.tf · outputs.tf
@@ -192,15 +204,16 @@ Environments are separated with **Terraform workspaces**: same code, one
 independent state per environment in one bucket, differences confined to the
 per-environment `<env>.tfvars` files.
 
-| Data                                | Lives in                 | Why                                                                  |
-| ----------------------------------- | ------------------------ | -------------------------------------------------------------------- |
-| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                       |
-| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                        |
-| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                   |
-| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply |
-| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                |
-| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                          |
-| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                 |
+| Data                                | Lives in                 | Why                                                                                  |
+| ----------------------------------- | ------------------------ | ------------------------------------------------------------------------------------ |
+| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                                       |
+| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                                        |
+| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                                   |
+| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply                 |
+| App public URL (`APP_URL`)          | Infisical (each env)     | Synced by the pipeline once a container exists; for links, OAuth callbacks, webhooks |
+| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                                |
+| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                                          |
+| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                                 |
 
 ## After the bootstrap
 
@@ -283,10 +296,18 @@ creating anything**.
   plan, production applies need manual approval.
 - Terraform state lives in a private, versioned bucket with S3-native state
   locking (`use_lockfile`), so concurrent applies cannot corrupt it.
+- The state bucket is **restricted by a bucket policy** to the identity that
+  owns the API key you give keel — the same identity CI authenticates with,
+  so the pipeline keeps working. Terraform state contains the generated
+  credentials (`DATABASE_URL`, `S3_*`), so no other principal in the project —
+  including the app's own credentials — can read it. Note that this also
+  hides the bucket from other console users; manage or remove the policy with
+  that same API key if you need to open it up.
 - The app connects to its database with a **dedicated least-privilege IAM
   credential** (read/write on that database, nothing else), not with your
   main API key. Object Storage, when enabled, gets its own separate dedicated
-  credential the same way.
+  credential that can only use Object Storage (and, thanks to the bucket
+  policy above, cannot read the Terraform state).
 - A weekly drift-detection plan opens an issue when the real infrastructure
   no longer matches the code.
 
@@ -328,6 +349,17 @@ No. The CLI bootstraps via APIs; Terraform runs inside GitHub Actions.
 Yes. The CLI asks for the name and the visibility; default is public (the
 infra holds no secrets), or choose private interactively or with `--private`.
 
+**Can I point keel at an existing repository?**
+Only if it has no commits. keel pushes a brand-new history, so a repository
+that already has commits (even just a README from the GitHub UI) would reject
+the push; the CLI checks this up front and asks for another name. The easiest
+path is to let keel create the repository for you.
+
+**Can I reuse an existing Infisical project?**
+Yes: pass its project ID (`--infisical-project-id` or interactively). The CLI
+verifies the machine identity can access it before anything is created. Leave
+it empty and keel creates a project named after your app instead.
+
 **Why is the container not created on the first apply?**
 A Serverless Container needs an image, and none exists yet. Registry and
 database are created immediately; the container is gated on
@@ -343,9 +375,19 @@ You choose at creation: production only, staging + production (default), or
 dev + staging + production — interactively or with `--environments`
 (e.g. `--environments prod` or `--environments dev,staging,prod`). Production
 is always gated by a manual approval; non-production environments enable Basic
-Auth by default. To add one to an existing repo later: add a `<env>.tfvars`,
-an Infisical environment, a matrix entry in the plan/drift workflows, and a
-chained job in `terraform-apply.yml`.
+Auth by default. To add one to an existing repo later: add a `<env>.tfvars`
+(the plan and drift workflows discover environments from the tfvars files at
+the repo root automatically), an Infisical environment with the same slug, and
+a chained job in `terraform-apply.yml`.
+
+**Can I extend the generated repo with my own Terraform?**
+Yes, and additions never edit generated files: drop a new `.tf` file at the
+repo root (Terraform merges all root files), put per-env values in the
+existing tfvars, and expose an output named `infisical_secrets_<name>` if your
+module produces secrets the app should read — the pipeline collects every
+output matching that prefix and syncs it to Infisical automatically. The
+committed `.keel/manifest.json` records the contract version your repo was
+generated with.
 
 **Can I store files, not just rows?**
 Yes, opt in with `--object-storage` (or answer yes interactively). Each
@@ -366,7 +408,9 @@ off by default — many apps only need the database.
 --infisical-host <url>         or env INFISICAL_HOST (default: https://app.infisical.com)
 --infisical-client-id <id>     or env INFISICAL_CLIENT_ID
 --infisical-client-secret <s>  or env INFISICAL_CLIENT_SECRET
---infisical-project-name <n>   Infisical project (default: project name)
+--infisical-project-id <id>    Existing Infisical project ID to reuse
+                               (or env INFISICAL_PROJECT_ID; default: create by name)
+--infisical-project-name <n>   Infisical project name (default: project name)
 --github-token <token>         or env GITHUB_TOKEN / GH_TOKEN (scopes: repo, workflow)
 --repo-name <name>             GitHub repository name (default: project name)
 --private / --public           Repository visibility (default: public)
@@ -374,10 +418,11 @@ off by default — many apps only need the database.
                                (or a list like "dev,staging,prod"; default staging+prod)
 --object-storage               Provision a per-environment Object Storage bucket
 --no-object-storage            Do not provision Object Storage (default)
+--basic-auth                   Enable Basic Auth on non-production environments (default)
 --no-basic-auth                Disable Basic Auth on non-production environments
 --dev-min-scale <n>            Default 0        --dev-max-scale <n>       Default 1
 --staging-min-scale <n>        Default 0        --staging-max-scale <n>   Default 1
---prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 2
+--prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 1
 --config <file.json>           Load answers from a JSON file
 --advanced                     Also ask scaling questions interactively
 --yes                          Accept defaults, skip the confirmation prompt

package/dist/bootstrap/github.js

@@ -4,47 +4,104 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Octokit } from '@octokit/rest';
+import { planStatusCheckContext } from '../contracts.js';
 // The ESM build of libsodium-wrappers is broken (missing libsodium.mjs), so
 // load the CommonJS build explicitly.
 const require = createRequire(import.meta.url);
 const sodium = require('libsodium-wrappers');
 export class GitHubError extends Error {
+    field;
+    constructor(message, field = 'token') {
+        super(message);
+        this.field = field;
+    }
 }
-export async function createContext(answers) {
-    const octokit = new Octokit({ auth: answers.github.token });
+export async function createContext(github) {
+    // Silence Octokit's own request logging: expected non-2xx responses (a 404
+    // for a repo that does not exist yet, a 401 for a bad token) are handled
+    // here and would otherwise scribble over the prompt spinner.
+    const octokit = new Octokit({
+        auth: github.token,
+        log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
+    });
     let login;
     let ownerId;
+    let scopes;
     try {
-        const { data } = await octokit.users.getAuthenticated();
+        const { data, headers } = await octokit.users.getAuthenticated();
         login = data.login;
         ownerId = data.id;
+        scopes = headers['x-oauth-scopes'];
     }
     catch {
         throw new GitHubError('GitHub rejected the token. It needs the "repo" and "workflow" scopes ' +
             '(classic PAT) or equivalent fine-grained permissions.');
     }
+    // Classic PATs advertise their scopes in a header; fine-grained tokens do
+    // not, so an absent/empty header only means "cannot check here".
+    if (scopes) {
+        const granted = new Set(scopes.split(',').map((s) => s.trim()));
+        for (const required of ['repo', 'workflow']) {
+            if (!granted.has(required)) {
+                throw new GitHubError(`The GitHub token is missing the "${required}" scope (it has: ${scopes}). ` +
+                    'Create a classic PAT with the "repo" and "workflow" scopes.');
+            }
+        }
+    }
     return {
         octokit,
         owner: login,
         ownerId,
-        repo: answers.github.repoName,
-        repoPrivate: answers.github.repoPrivate,
+        repo: github.repoName,
+        repoPrivate: github.repoPrivate,
     };
 }
-/** Create the repository, or reuse it when it already exists. */
-export async function ensureRepo(ctx) {
+/** Read-only look at the target repository: existence, push access, emptiness. */
+export async function inspectRepo(ctx) {
+    let url;
     try {
         const { data } = await ctx.octokit.repos.get({ owner: ctx.owner, repo: ctx.repo });
-        if (!data.permissions?.push) {
-            throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`);
-        }
-        return { created: false, url: data.html_url };
+        if (!data.permissions?.push)
+            return { state: 'no-push', url: data.html_url };
+        url = data.html_url;
     }
     catch (error) {
-        if (error instanceof GitHubError)
-            throw error;
-        if (error.status !== 404)
-            throw error;
+        if (error.status === 404)
+            return { state: 'not-found' };
+        throw error;
+    }
+    try {
+        const { data } = await ctx.octokit.repos.listCommits({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            per_page: 1,
+        });
+        return { state: data.length > 0 ? 'non-empty' : 'empty', url };
+    }
+    catch (error) {
+        // GitHub answers 409 "Git Repository is empty" for a repo with no commits.
+        if (error.status === 409)
+            return { state: 'empty', url };
+        throw error;
+    }
+}
+/** Turn a blocking repo state into a GitHubError; pass on 'not-found'/'empty'. */
+export function assertRepoUsable(ctx, state) {
+    if (state === 'no-push') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} exists but the token cannot push to it.`, 'repo');
+    }
+    if (state === 'non-empty') {
+        throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} already has commits. keel pushes a brand-new ` +
+            'history, so the push would be rejected: use a new repository name (keel creates ' +
+            'it for you) or an existing repository with no commits.', 'repo');
+    }
+}
+/** Create the repository, or reuse it when it already exists and is empty. */
+export async function ensureRepo(ctx) {
+    const inspected = await inspectRepo(ctx);
+    assertRepoUsable(ctx, inspected.state);
+    if (inspected.state !== 'not-found') {
+        return { created: false, url: inspected.url };
     }
     const { data } = await ctx.octokit.repos.createForAuthenticatedUser({
         name: ctx.repo,
@@ -100,21 +157,25 @@ export function pushRepo(ctx, token, targetDir) {
 /** Encrypt and upload every CI secret, then set the plain variables. */
 export async function configureRepo(ctx, answers, infisicalProjectId) {
     // The workflows map AWS_* (state backend) from the same SCW_* secrets, so
-    // each credential is stored once and rotated in one place.
-    await setSecrets(ctx, {
+    // each credential is stored once and rotated in one place. The Record types
+    // force these names to stay in lockstep with the contracts the generated
+    // workflows are tested against.
+    const secrets = {
         SCW_ACCESS_KEY: answers.scaleway.accessKey,
         SCW_SECRET_KEY: answers.scaleway.secretKey,
         SCW_DEFAULT_PROJECT_ID: answers.scaleway.projectId,
         SCW_DEFAULT_ORGANIZATION_ID: answers.scaleway.organizationId,
         INFISICAL_CLIENT_ID: answers.infisical.clientId,
         INFISICAL_CLIENT_SECRET: answers.infisical.clientSecret,
-    });
-    await setVariables(ctx, {
+    };
+    await setSecrets(ctx, secrets);
+    const variables = {
         TF_STATE_BUCKET: answers.stateBucket,
         SCW_REGION: answers.region,
         INFISICAL_PROJECT_ID: infisicalProjectId,
         INFISICAL_HOST: answers.infisical.host,
-    });
+    };
+    await setVariables(ctx, variables);
     await configureEnvironments(ctx, answers);
     await protectMainBranch(ctx, answers);
 }
@@ -176,8 +237,9 @@ async function protectMainBranch(ctx, answers) {
         branch: 'main',
         required_status_checks: {
             strict: false,
-            // Matches the job names produced by the plan workflow: "plan (<slug>)".
-            contexts: answers.environments.map((env) => `plan (${env.slug})`),
+            // Must match the job names produced by the plan workflow; the shared
+            // format lives in contracts.ts and is tested against the template.
+            contexts: answers.environments.map((env) => planStatusCheckContext(env.slug)),
         },
         enforce_admins: false,
         required_pull_request_reviews: null,

package/dist/bootstrap/infisical.js

@@ -1,5 +1,11 @@
 import { randomBytes } from 'node:crypto';
+import { BASE_SYNCED_KEYS, BASIC_AUTH_SECRET_KEYS, S3_SECRET_KEYS } from '../contracts.js';
 export class InfisicalError extends Error {
+    field;
+    constructor(message, field = 'credentials') {
+        super(message);
+        this.field = field;
+    }
 }
 async function api(host, path, options = {}) {
     const response = await fetch(`${host}${path}`, {
@@ -20,8 +26,8 @@ async function api(host, path, options = {}) {
     }
     return { status: response.status, data };
 }
-export async function login(answers) {
-    const { host, clientId, clientSecret } = answers.infisical;
+export async function login(infisical) {
+    const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
         throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
@@ -29,11 +35,18 @@ export async function login(answers) {
     }
     return data.accessToken;
 }
-async function findProject(host, token, name) {
+async function listProjects(host, token) {
     const { status, data } = await api(host, '/api/v1/workspace', { token });
     if (status !== 200)
-        return undefined;
-    return data.workspaces?.find((w) => w.name === name);
+        return [];
+    return data.workspaces ?? [];
+}
+async function findProject(host, token, name) {
+    return (await listProjects(host, token)).find((w) => w.name === name);
+}
+/** Look an existing project up by ID among those the identity can access. */
+export async function findProjectById(host, token, id) {
+    return (await listProjects(host, token)).find((w) => w.id === id);
 }
 async function createProject(host, token, name) {
     const { status, data } = await api(host, '/api/v2/workspace', { method: 'POST', token, body: { projectName: name } });
@@ -71,22 +84,43 @@ async function seedSecret(host, token, projectId, environment, name, value) {
         throw new InfisicalError(`Could not seed secret ${name} in ${environment} (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
     }
 }
-const S3_PLACEHOLDER_KEYS = [
-    'S3_BUCKET',
-    'S3_ENDPOINT',
-    'S3_REGION',
-    'S3_ACCESS_KEY',
-    'S3_SECRET_KEY',
-];
+function inaccessibleProject(projectId) {
+    return new InfisicalError(`Infisical project "${projectId}" was not found or the machine identity has no access to it. ` +
+        'Check the project ID and that the identity is a member of the project.', 'project');
+}
+/**
+ * Read-only validation: Universal Auth login works and, when a project ID was
+ * given, that project is accessible. Returns the project name when found.
+ */
+export async function validateInfisical(infisical) {
+    const token = await login(infisical);
+    if (infisical.projectId) {
+        const project = await findProjectById(infisical.host, token, infisical.projectId);
+        if (!project)
+            throw inaccessibleProject(infisical.projectId);
+        return { projectName: project.name };
+    }
+    return {};
+}
 /** Create/reuse the project, ensure every environment, seed placeholder secrets. */
 export async function bootstrapInfisical(answers) {
-    const { host, projectName } = answers.infisical;
-    const token = await login(answers);
+    const { host, projectName, projectId } = answers.infisical;
+    const token = await login(answers.infisical);
     let createdProject = false;
-    let project = await findProject(host, token, projectName);
-    if (!project) {
-        project = await createProject(host, token, projectName);
-        createdProject = true;
+    let project;
+    if (projectId) {
+        // An explicit ID is never created implicitly: fail loudly if unreachable.
+        project = await findProjectById(host, token, projectId);
+        if (!project)
+            throw inaccessibleProject(projectId);
+    }
+    else {
+        // Find-by-name keeps re-runs idempotent even without a recorded ID.
+        project = await findProject(host, token, projectName);
+        if (!project) {
+            project = await createProject(host, token, projectName);
+            createdProject = true;
+        }
     }
     for (const env of answers.environments) {
         await ensureEnvironment(host, token, project, env.slug, env.displayName);
@@ -96,12 +130,15 @@ export async function bootstrapInfisical(answers) {
     const placeholder = 'placeholder-updated-by-pipeline-after-first-apply';
     for (const env of answers.environments) {
         if (env.basicAuth) {
-            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_USER', env.slug);
-            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+            const [userKey, passwordKey] = BASIC_AUTH_SECRET_KEYS;
+            await seedSecret(host, token, project.id, env.slug, userKey, env.slug);
+            await seedSecret(host, token, project.id, env.slug, passwordKey, randomBytes(18).toString('base64url'));
+        }
+        for (const key of BASE_SYNCED_KEYS) {
+            await seedSecret(host, token, project.id, env.slug, key, placeholder);
         }
-        await seedSecret(host, token, project.id, env.slug, 'DATABASE_URL', placeholder);
         if (answers.objectStorage) {
-            for (const key of S3_PLACEHOLDER_KEYS) {
+            for (const key of S3_SECRET_KEYS) {
                 await seedSecret(host, token, project.id, env.slug, key, placeholder);
             }
         }

package/dist/bootstrap/scaleway.js

@@ -1,30 +1,36 @@
-import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
+import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
 export class ScalewayError extends Error {
+    code;
+    constructor(message, code = 'api') {
+        super(message);
+        this.code = code;
+    }
 }
 const API_BASE = 'https://api.scaleway.com';
 /**
  * Validate credentials with a harmless read call before creating anything.
- * Also confirms the project belongs to the given organization.
+ * Also confirms the project belongs to the given organization. Read-only: it
+ * proves the key can see the project, not that it can create resources.
  */
-export async function validateScalewayCredentials(answers) {
-    const { secretKey, projectId, organizationId } = answers.scaleway;
+export async function validateScalewayCredentials(scaleway) {
+    const { secretKey, projectId, organizationId } = scaleway;
     const response = await fetch(`${API_BASE}/account/v3/projects/${projectId}`, {
         headers: { 'X-Auth-Token': secretKey },
     });
     if (response.status === 401 || response.status === 403) {
         throw new ScalewayError('Scaleway rejected the API key (401/403). Check SCW_ACCESS_KEY / SCW_SECRET_KEY and ' +
-            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.');
+            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.', 'auth');
     }
     if (response.status === 404) {
-        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`);
+        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`, 'project');
     }
     if (!response.ok) {
-        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`);
+        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`, 'api');
     }
     const project = (await response.json());
     if (project.organization_id && project.organization_id !== organizationId) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
-            `not ${organizationId}. Check --scw-organization-id.`);
+            `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
 }
 function s3Client(answers) {
@@ -37,13 +43,90 @@ function s3Client(answers) {
         },
     });
 }
-/** Create the Terraform state bucket if it does not exist yet (idempotent). */
+/**
+ * Resolve the IAM identity (user or application) that owns the API key, in
+ * the `<kind>:<uuid>` principal form bucket policies expect. Returns
+ * undefined when the key cannot read IAM; the caller degrades to a warning.
+ */
+async function apiKeyPrincipal(scaleway) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/api-keys/${scaleway.accessKey}`, {
+            headers: { 'X-Auth-Token': scaleway.secretKey },
+        });
+        if (!response.ok)
+            return undefined;
+        const key = (await response.json());
+        if (key.application_id)
+            return `application_id:${key.application_id}`;
+        if (key.user_id)
+            return `user_id:${key.user_id}`;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Restrict the state bucket to the identity that owns the bootstrap API key —
+ * the same identity CI authenticates with, so the pipeline keeps working.
+ * Terraform state contains the generated credentials (DATABASE_URL, S3 keys),
+ * and the per-app IAM policies are project-wide for Object Storage: without
+ * this policy the app's own storage credential could read the state. An
+ * existing policy is never overwritten. Failures degrade to a warning: a
+ * missed lockdown must not strand a half-finished bootstrap.
+ */
+async function lockDownStateBucket(client, bucket, answers) {
+    try {
+        await client.send(new GetBucketPolicyCommand({ Bucket: bucket }));
+        return undefined; // A policy is already in place: leave it alone.
+    }
+    catch (error) {
+        const status = error.$metadata?.httpStatusCode;
+        if (status !== 404) {
+            return (`Could not read the policy of bucket "${bucket}" (HTTP ${status ?? 'error'}); ` +
+                'the state bucket was NOT restricted to your identity.');
+        }
+    }
+    const principal = await apiKeyPrincipal(answers.scaleway);
+    if (!principal) {
+        return ('Could not resolve the IAM identity behind the API key, so the state bucket was NOT ' +
+            'restricted: any Object Storage credential in the project can read the Terraform state. ' +
+            'Grant the key IAM read access and re-run, or add a bucket policy manually.');
+    }
+    const policy = {
+        Version: '2023-04-17',
+        Id: 'keel-state-bucket-bootstrap-identity-only',
+        Statement: [
+            {
+                Sid: 'OnlyBootstrapIdentity',
+                Effect: 'Allow',
+                Principal: { SCW: principal },
+                Action: ['*'],
+                Resource: [bucket, `${bucket}/*`],
+            },
+        ],
+    };
+    try {
+        await client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+        return undefined;
+    }
+    catch (error) {
+        return (`Could not apply a policy to bucket "${bucket}" ` +
+            `(${error instanceof Error ? error.message : String(error)}); ` +
+            'the state bucket was NOT restricted to your identity.');
+    }
+}
+/**
+ * Create the Terraform state bucket if it does not exist yet (idempotent) and
+ * restrict it to the bootstrap identity via a bucket policy.
+ */
 export async function ensureStateBucket(answers) {
     const client = s3Client(answers);
     const bucket = answers.stateBucket;
+    let created = false;
     try {
         await client.send(new HeadBucketCommand({ Bucket: bucket }));
-        return { created: false }; // Already exists and we own it.
+        // Already exists and we own it (resume): still ensure the policy below.
     }
     catch (error) {
         const status = error.$metadata?.httpStatusCode;
@@ -54,12 +137,14 @@ export async function ensureStateBucket(answers) {
         if (status !== 404 && status !== 301) {
             throw error;
         }
+        await client.send(new CreateBucketCommand({ Bucket: bucket }));
+        // Versioning protects the state history against accidental overwrites.
+        await client.send(new PutBucketVersioningCommand({
+            Bucket: bucket,
+            VersioningConfiguration: { Status: 'Enabled' },
+        }));
+        created = true;
     }
-    await client.send(new CreateBucketCommand({ Bucket: bucket }));
-    // Versioning protects the state history against accidental overwrites.
-    await client.send(new PutBucketVersioningCommand({
-        Bucket: bucket,
-        VersioningConfiguration: { Status: 'Enabled' },
-    }));
-    return { created: true };
+    const policyWarning = await lockDownStateBucket(client, bucket, answers);
+    return policyWarning ? { created, policyWarning } : { created };
 }