fix(setup): harden setup-aws/setup-gcp exits, confirmation, and output

deploy/mod.ts

@@ -36,6 +36,10 @@ const setupAWSCommand = new Command<GlobalContext>()
     "--role-name <name:string>",
     "Name for the IAM role to create (omit for a random-suffixed default; pass to allow idempotent re-runs)",
   )
+  .option(
+    "--apply",
+    "Authorize creating/modifying the cloud resources without a confirmation prompt (required in --non-interactive mode)",
+  )
   .arguments("[contexts:string]")
   .action(actionHandler(async (config, options, contexts) => {
     const org = await getOrg(options, config, options.org);
@@ -50,6 +54,7 @@ const setupAWSCommand = new Command<GlobalContext>()
     await setupAws(options, org, app, contextList, {
       policies: options.policies,
       roleName: options.roleName as unknown as string | undefined,
+      apply: options.apply as unknown as boolean | undefined,
     });
   }));
 
@@ -72,7 +77,11 @@ const setupGCPCommand = new Command<GlobalContext>()
   )
   .option(
     "--enable-apis",
-    "Auto-enable required APIs that are missing, without prompting",
+    "Authorize enabling required APIs that are missing (in --non-interactive mode also requires --apply; nothing is enabled without it)",
+  )
+  .option(
+    "--apply",
+    "Authorize creating/modifying cloud resources, including enabling required APIs, without a confirmation prompt (required in --non-interactive mode)",
   )
   .arguments("[contexts:string]")
   .action(actionHandler(async (config, options, contexts) => {
@@ -91,6 +100,7 @@ const setupGCPCommand = new Command<GlobalContext>()
         | string
         | undefined,
       enableApis: options.enableApis as unknown as boolean | undefined,
+      apply: options.apply as unknown as boolean | undefined,
     });
   }));
 

deploy/setup-cloud.test.ts

@@ -0,0 +1,84 @@
+import { assertEquals } from "@std/assert";
+import { applyGate, gcpApiEnableDecision } from "./setup-cloud.ts";
+
+// The apply gate is the safety contract for `setup-aws` / `setup-gcp`: it must
+// never resolve to "apply" in non-interactive mode unless the caller passed the
+// explicit opt-in flag (`--apply` / `--enable-apis`).
+
+Deno.test("applyGate: explicit opt-in always applies", () => {
+  assertEquals(applyGate({ nonInteractive: true, optIn: true }), "apply");
+  assertEquals(applyGate({ nonInteractive: false, optIn: true }), "apply");
+});
+
+Deno.test("applyGate: non-interactive without opt-in refuses (never auto-applies)", () => {
+  assertEquals(applyGate({ nonInteractive: true, optIn: false }), "refuse");
+});
+
+Deno.test("applyGate: interactive without opt-in prompts the human", () => {
+  assertEquals(applyGate({ nonInteractive: false, optIn: false }), "prompt");
+});
+
+// Enabling GCP APIs is the first cloud mutation, so it must be gated by the
+// master `--apply` *before* the API-specific `--enable-apis`. Without `--apply`,
+// non-interactive runs must refuse before anything is enabled — no partial
+// mutation — regardless of whether `--enable-apis` was passed.
+
+Deno.test("gcpApiEnableDecision: non-interactive without --apply refuses before mutating, even with --enable-apis", () => {
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: true,
+      apply: false,
+      enableApis: true,
+    }),
+    "refuse-apply",
+  );
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: true,
+      apply: false,
+      enableApis: false,
+    }),
+    "refuse-apply",
+  );
+});
+
+Deno.test("gcpApiEnableDecision: non-interactive with --apply still requires --enable-apis", () => {
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: true,
+      apply: true,
+      enableApis: false,
+    }),
+    "refuse-enable-apis",
+  );
+});
+
+Deno.test("gcpApiEnableDecision: non-interactive enables only with both --apply and --enable-apis", () => {
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: true,
+      apply: true,
+      enableApis: true,
+    }),
+    "enable",
+  );
+});
+
+Deno.test("gcpApiEnableDecision: interactive prompts unless --enable-apis pre-authorizes", () => {
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: false,
+      apply: false,
+      enableApis: false,
+    }),
+    "prompt",
+  );
+  assertEquals(
+    gcpApiEnableDecision({
+      nonInteractive: false,
+      apply: false,
+      enableApis: true,
+    }),
+    "enable",
+  );
+});