@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/CHANGELOG.md

@@ -1,11 +1,92 @@
 # @mtndev/cli
 
-## 0.0.0-dev-20260626045221
+## 0.0.0-dev-20260914234436
 
 ### Major Changes
 
-- [#11](https://github.com/High-Country-Dev/core/pull/11) [`ff9c7fb`](https://github.com/High-Country-Dev/core/commit/ff9c7fb79bfee9e7b77f99e289bbba7804cda9bb) Thanks [@StarScape](https://github.com/StarScape)! - Change -e to -t
+- [#10](https://github.com/High-Country-Dev/core/pull/10) [`c194a34`](https://github.com/High-Country-Dev/core/commit/c194a34266e500a6d8ab4ae5d292e6d875b36549) Thanks [@rnarcos](https://github.com/rnarcos)! - Renamed `--environment` to `--environments` and added support for comma-separated environment lists. Added `clone` subcommand for cloning secrets between Doppler projects.
+
+  **Breaking change:** `--environment` has been replaced by `--environments`.
+
+  **Who is affected:** You are **not** affected if you only use the `-e` shorthand — it is preserved and works unchanged with all existing values (`-e dev`, `-e stg`, `-e prd`, `-e all`). You **are** affected if you use the verbose `--environment` flag in any script or alias.
+
+  **Migration:**
+
+  Replace `--environment` with `--environments` in any script using the verbose flag. The `-e` shorthand, and all existing values (`dev`, `stg`, `prd`, `all`) continue to work unchanged. You may now also pass comma-separated values to target multiple environments at once.
+
+  ```shell
+  # Before
+  mtndev doppler download --environment dev
+  mtndev doppler upload --environment prd
+
+  # After
+  mtndev doppler download --environments dev
+  mtndev doppler upload --environments prd
+
+  # New: multiple environments at once
+  mtndev doppler download --environments dev,stg
+
+  # New: clone secrets between projects
+  mtndev doppler clone --from my-app --to my-app-copy
+  mtndev doppler clone --from my-app --to my-app-copy -e dev,stg
+  ```
+
+### Minor Changes
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Add a nested `mtn aws` command group with IAM, EC2, and SES operational commands ported from the internal scripts repo:
+  - `aws iam setup-acl` — idempotently create the ACL groups, their managed policies, and (optionally) users
+  - `aws iam users` — interactively create IAM users and assign them to the matching ACL group
+  - `aws iam check-admin` — alert if anyone is a member of the break-glass `acl-admin-do-not-use` group
+  - `aws iam remove-admin` — remove users from `acl-admin-do-not-use` to revoke break-glass access
+  - `aws iam break-glass` — grant break-glass admin access by adding a user (default: your own IAM user) to `acl-admin-do-not-use` for one profile
+  - `aws ec2 allow-ip` — update or create a roaming SSH ingress rule for your current public IP
+  - `aws ses send-email` — send a test email via the SES API or SMTP
+
+  `check-admin` and `remove-admin` scan a single profile (`--profile` or `AWS_PROFILE`) or every `aws-vault` profile with `--all`, trying stored credentials first and falling back to `aws-vault exec`.
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added an interactive AWS profile picker to the `mtn aws` commands. When a single-profile command (`iam setup-acl`, `iam users`, `iam break-glass`, `ec2 allow-ip`, `route53 add-record` / `remove-record`, and `ses send-email` over the API transport) runs with neither `--profile` nor `AWS_PROFILE` set and you're at a terminal, it now prompts with a substring-filtered picker over the profiles in `~/.aws/config` instead of silently falling back to the `default` profile. A single filter match auto-selects, and the choice applies to that one invocation only (a child process can't export `AWS_PROFILE` to your shell). Non-interactive contexts (no TTY, e.g. CI) skip the picker and keep the previous behavior. `check-admin` / `remove-admin` are intentionally excluded, where an unset profile already means "scan every aws-vault profile".
+
+  ```shell
+  mtn aws route53 add-record   # no profile set → filter & pick, then continues
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn db create-readonly-user` to create a read-only MySQL or Postgres user on one database or all databases. Example:
+
+  ```shell
+  mtn db create-readonly-user -e postgres -u "$DATABASE_URL" -d all --yes
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn doppler set` to interactively (or via flags) add or update a secret by picking project, environment, and config. Example:
+
+  ```shell
+  mtn doppler set -p core --environment dev -c dev --name API_KEY --value secret --yes
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn aws route53 add-record` to interactively (or via flags) create or update a DNS record in a Route53 hosted zone, with clear create / overwrite / append feedback. Example:
+
+  ```shell
+  mtn aws route53 add-record -z mountaindev.com -t CNAME -n redline --value eb34fd3576733d80.vercel-dns-016.com.
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn aws route53 remove-record` to interactively (or via flags) delete a DNS record from a Route53 hosted zone, showing the record it found and confirming before deleting (alias records included). Also taught `add-record` to detect CNAME conflicts up front — Route53 forbids a CNAME from coexisting with any other record type at the same name, so it now stops with a clear message (and points you at `remove-record`) instead of surfacing the raw `InvalidChangeBatch` error. Example:
+
+  ```shell
+  mtn aws route53 remove-record -z etymologyexplorer.com -t CNAME -n wotd --yes
+  ```
+
+### Patch Changes
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Updated `mtn aws iam users` to default the account slug from the caller profile / IAM ARN (e.g. `md-declan-thespeckledtrout-iam-admin` → `thespeckledtrout`). Press Enter to accept, or type a different value; `--account-name` still skips the prompt.
+
+- [#16](https://github.com/High-Country-Dev/core/pull/16) [`4a43df1`](https://github.com/High-Country-Dev/core/commit/4a43df1064325da93a69df798c9213178b1027c8) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Add Vitest testing infrastructure for `@mtndev/cli`: a Node-environment Vitest
+  setup with seed tests for the Doppler command utilities and schemas, wired into
+  Turbo and the PR CI checks. Tests are colocated under `src/` (so they are
+  typechecked, linted, and formatted) and excluded from the published build via
+  `libsync` ignore globs and `tsconfig.build.json`, so no test files ship in the
+  `cjs`/`esm` output. No runtime behavior changes.
+
+## 1.1.0
 
 ### Minor Changes
 
-- [#11](https://github.com/High-Country-Dev/core/pull/11) [`09df9e3`](https://github.com/High-Country-Dev/core/commit/09df9e38f98f3d3e4731763213f295717cd59324) Thanks [@StarScape](https://github.com/StarScape)! - Added extra help commands, minor improvements to style and wording
+- [#11](https://github.com/High-Country-Dev/core/pull/11) [`fa76e6d`](https://github.com/High-Country-Dev/core/commit/fa76e6d72bdb7d7ef561a140469500a01ed53c7a) Thanks [@StarScape](https://github.com/StarScape)! - Added extra help commands, minor improvements to style and wording

package/cjs/__chunks/2FSYDFUV.cjs

@@ -0,0 +1,146 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _LFDSHANPcjs = require('./LFDSHANP.cjs');
+
+
+
+
+var _WBOQ6AUNcjs = require('./WBOQ6AUN.cjs');
+
+
+
+
+
+
+var _B6XM5KSFcjs = require('./B6XM5KSF.cjs');
+
+
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/aws/route53/remove-record/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function removeRecordCommand(options) {
+  try {
+    const {
+      profile: profileOption,
+      zone: zoneOption,
+      type: typeOption,
+      name: nameOption,
+      yes,
+      dryRun,
+      verbose
+    } = _LFDSHANPcjs.removeRecordOptionsSchema.parse(options);
+    const profile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile: profileOption });
+    if (!profile) {
+      console.error(_chalk2.default.red("Error: pass --profile or set AWS_PROFILE."));
+      process.exit(1);
+    }
+    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
+    const identity = _R3GUC7O7cjs.getCallerIdentity.call(void 0, { profile, verbose });
+    console.log("Caller:");
+    console.log(`  Account: ${identity.Account}`);
+    console.log(`  Arn:     ${identity.Arn}`);
+    console.log("");
+    const zone = await _WBOQ6AUNcjs.resolveHostedZone.call(void 0, { profile, zoneOption, verbose });
+    console.log(`Hosted zone: ${_B6XM5KSFcjs.hostedZoneLabel.call(void 0, zone)}`);
+    console.log("");
+    const type = await _WBOQ6AUNcjs.resolveRecordType.call(void 0, typeOption);
+    const name = await _WBOQ6AUNcjs.resolveName.call(void 0, { nameOption, zoneName: zone.name });
+    const existing = _B6XM5KSFcjs.getResourceRecordSet.call(void 0, {
+      profile,
+      hostedZoneId: zone.id,
+      name,
+      type,
+      verbose
+    });
+    if (!existing) {
+      console.log(
+        _chalk2.default.yellow(
+          `No ${type} record at ${_B6XM5KSFcjs.withoutTrailingDot.call(void 0, name)}. Nothing to remove.`
+        )
+      );
+      return;
+    }
+    console.log("Record to remove:");
+    console.log(`  Name:  ${_B6XM5KSFcjs.withoutTrailingDot.call(void 0, name)}`);
+    console.log(`  Type:  ${type}`);
+    if (existing.isAlias) {
+      console.log(
+        `  Alias: ${_B6XM5KSFcjs.withoutTrailingDot.call(void 0, String(_nullishCoalesce(_optionalChain([existing, 'access', _ => _.aliasTarget, 'optionalAccess', _2 => _2.DNSName]), () => ( ""))))}`
+      );
+    } else {
+      if (existing.ttl !== void 0) {
+        console.log(`  TTL:   ${existing.ttl}`);
+      }
+      console.log(`  Value:${_B6XM5KSFcjs.formatValues.call(void 0, existing.values)}`);
+    }
+    console.log("");
+    if (dryRun) {
+      console.log(_chalk2.default.cyan("Dry run \u2014 no changes made."));
+      return;
+    }
+    if (!yes) {
+      const confirmed = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
+        message: `Delete this ${type} record?`,
+        defaultYes: false
+      });
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+    }
+    const changeInfo = _B6XM5KSFcjs.deleteResourceRecordSet.call(void 0, {
+      profile,
+      hostedZoneId: zone.id,
+      record: existing,
+      verbose
+    });
+    console.log("");
+    console.log(
+      _chalk2.default.green(`Done. Deleted ${type} ${_B6XM5KSFcjs.withoutTrailingDot.call(void 0, name)}.`)
+    );
+    if (_optionalChain([changeInfo, 'optionalAccess', _3 => _3.Id])) {
+      console.log(`  Change ID: ${changeInfo.Id}`);
+      console.log(`  Status:    ${_nullishCoalesce(changeInfo.Status, () => ( "PENDING"))}`);
+    }
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _4 => _4.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C remove-record failed:"));
+    if (error instanceof _R3GUC7O7cjs.AwsCliError || error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow("\n\u{1F4A1} Use --verbose for detailed error information\n")
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.removeRecordCommand = removeRecordCommand;

package/cjs/__chunks/3A5ZYU5M.cjs

@@ -0,0 +1,105 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+
+
+var _NWZGFHKHcjs = require('./NWZGFHKH.cjs');
+
+// src/commands/db/create-readonly-user/mysql.js
+var _promise = require('mysql2/promise'); var _promise2 = _interopRequireDefault(_promise);
+async function createConnection(config) {
+  return _promise2.default.createConnection({
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: config.database || void 0,
+    ssl: config.ssl && typeof config.ssl === "object" ? config.ssl : void 0,
+    multipleStatements: false
+  });
+}
+async function listMysqlDatabases(config) {
+  const connection = await createConnection(config);
+  try {
+    const [rows] = await connection.query("SHOW DATABASES");
+    const names = (
+      /** @type {Array<{ Database?: string }>} */
+      rows.map(
+        (row) => _nullishCoalesce(row.Database, () => ( ""))
+      )
+    );
+    return names.filter((name) => Boolean(name)).filter((name) => !_NWZGFHKHcjs.isSystemDatabase.call(void 0, { engine: "mysql", name })).sort((a, b) => a.localeCompare(b));
+  } finally {
+    await connection.end();
+  }
+}
+async function applyMysqlReadonly(params) {
+  const {
+    config,
+    username,
+    password,
+    databases,
+    hostPattern,
+    dryRun = false,
+    verbose = false
+  } = params;
+  const userLiteral = _NWZGFHKHcjs.quoteLiteral.call(void 0, username);
+  const hostLiteral = _NWZGFHKHcjs.quoteLiteral.call(void 0, hostPattern);
+  const passwordLiteral = _NWZGFHKHcjs.quoteLiteral.call(void 0, password);
+  const account = `${userLiteral}@${hostLiteral}`;
+  const statements = [];
+  const createSql = `CREATE USER IF NOT EXISTS ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const alterSql = `ALTER USER ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const grantSqls = [];
+  if (databases === "all") {
+    grantSqls.push(
+      `GRANT SELECT, SHOW VIEW, SHOW DATABASES ON *.* TO ${account}`
+    );
+  } else {
+    for (const database of databases) {
+      const dbIdent = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "mysql", name: database });
+      grantSqls.push(`GRANT SELECT, SHOW VIEW ON ${dbIdent}.* TO ${account}`);
+    }
+  }
+  const flushSql = "FLUSH PRIVILEGES";
+  statements.push(createSql, alterSql, ...grantSqls, flushSql);
+  if (dryRun) {
+    return {
+      created: true,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  }
+  const connection = await createConnection(config);
+  try {
+    if (verbose) {
+      console.log(`   Connected to MySQL as ${config.user}@${config.host}`);
+    }
+    const [existingRows] = await connection.query(
+      "SELECT 1 AS ok FROM mysql.user WHERE User = ? AND Host = ? LIMIT 1",
+      [username, hostPattern]
+    );
+    const existed = Array.isArray(existingRows) && existingRows.length > 0;
+    await connection.query(createSql);
+    await connection.query(alterSql);
+    for (const grantSql of grantSqls) {
+      await connection.query(grantSql);
+    }
+    await connection.query(flushSql);
+    return {
+      created: !existed,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  } finally {
+    await connection.end();
+  }
+}
+
+
+
+
+exports.listMysqlDatabases = listMysqlDatabases; exports.applyMysqlReadonly = applyMysqlReadonly;

package/cjs/__chunks/3NOHGUCF.cjs

@@ -0,0 +1,9 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/utils/resolve-policy-path.js
+var _url = require('url');
+function resolvePolicyPath(fileName) {
+  return _url.fileURLToPath.call(void 0, new URL(`../iam/policies/${fileName}`, import.meta.url));
+}
+
+
+
+exports.resolvePolicyPath = resolvePolicyPath;