@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/esm/__chunks/2FTTEFEK.js

@@ -0,0 +1,97 @@
+import {
+  defaultBody,
+  sendViaApi,
+  sendViaSmtp
+} from "./UXWY7BYE.js";
+import {
+  resolveProfile
+} from "./5GIUAFXL.js";
+import {
+  sendEmailOptionsSchema
+} from "./3BKWTHLJ.js";
+
+// src/commands/aws/ses/send-email/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function sendEmailCommand(options) {
+  try {
+    const parsed = sendEmailOptionsSchema.parse(options);
+    const {
+      to,
+      from,
+      subject,
+      transport,
+      region,
+      profile: profileOption,
+      accessKeyId,
+      dryRun,
+      verbose
+    } = parsed;
+    const body = parsed.body ?? defaultBody();
+    const profile = transport === "api" ? await resolveProfile({ profile: profileOption }) : profileOption;
+    console.log(chalk.blue("\n\u{1F4E7} SES send-email"));
+    console.log(chalk.gray(`   transport: ${transport}`));
+    console.log(chalk.gray(`   region:    ${region}`));
+    console.log(chalk.gray(`   from:      ${from}`));
+    console.log(chalk.gray(`   to:        ${to}`));
+    console.log(chalk.gray(`   subject:   ${subject}`));
+    if (verbose) {
+      console.log(chalk.gray(`   body:      ${body}`));
+    }
+    if (dryRun) {
+      console.log(chalk.yellow("\n[dry-run] No email sent."));
+      return;
+    }
+    const messageId = transport === "api" ? await sendViaApi({ to, from, subject, body, region, profile }) : await sendViaSmtp({ to, from, subject, body, region, accessKeyId });
+    console.log(
+      chalk.green(
+        `
+\u2705 Email sent${messageId ? ` (messageId: ${messageId})` : ""}.`
+      )
+    );
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C send-email failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(chalk.yellow("\n\u{1F4A1} Troubleshooting tips:"));
+    console.error(
+      chalk.yellow("   \u2022 The sender address must be verified in SES")
+    );
+    console.error(
+      chalk.yellow(
+        "   \u2022 New SES accounts are sandboxed \u2014 recipients must also be verified"
+      )
+    );
+    console.error(
+      chalk.yellow(
+        "   \u2022 For smtp transport, set SES_SMTP_USER and SES_SMTP_PASSWORD"
+      )
+    );
+    console.error(
+      chalk.yellow("   \u2022 Use --verbose for detailed error information\n")
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  sendEmailCommand
+};

package/esm/__chunks/33UYMUQD.js

@@ -0,0 +1,338 @@
+import {
+  DEFAULT_TTL
+} from "./IEOGAQYI.js";
+import {
+  runAws
+} from "./FNXUONAV.js";
+
+// src/commands/aws/route53/add-record/utils.js
+function bareHostedZoneId(rawId) {
+  return rawId.replace(/^\/hostedzone\//, "");
+}
+function withTrailingDot(name) {
+  const trimmed = name.trim();
+  if (trimmed === "") {
+    return trimmed;
+  }
+  return trimmed.endsWith(".") ? trimmed : `${trimmed}.`;
+}
+function withoutTrailingDot(name) {
+  return name.endsWith(".") ? name.slice(0, -1) : name;
+}
+function listHostedZones(params) {
+  const { profile, verbose } = params;
+  const data = runAws({
+    profile,
+    args: ["route53", "list-hosted-zones"],
+    verbose
+  });
+  const zones = [];
+  for (const zone of data.HostedZones ?? []) {
+    const id = bareHostedZoneId(String(zone.Id ?? ""));
+    const name = withTrailingDot(String(zone.Name ?? ""));
+    if (!id || !name) {
+      continue;
+    }
+    zones.push({
+      id,
+      name,
+      privateZone: Boolean(zone.Config?.PrivateZone),
+      recordCount: Number(zone.ResourceRecordSetCount ?? 0)
+    });
+  }
+  return zones.sort((a, b) => a.name.localeCompare(b.name));
+}
+function findHostedZone(params) {
+  const { zones, zoneInput } = params;
+  const input = zoneInput.trim();
+  if (!input) {
+    return null;
+  }
+  const bareId = bareHostedZoneId(input);
+  const byId = zones.find((zone) => zone.id === bareId);
+  if (byId) {
+    return byId;
+  }
+  const normalized = withTrailingDot(input).toLowerCase();
+  const matches = zones.filter(
+    (zone) => zone.name.toLowerCase() === normalized
+  );
+  if (matches.length === 1) {
+    return matches[0] ?? null;
+  }
+  if (matches.length > 1) {
+    return matches.find((zone) => !zone.privateZone) ?? matches[0] ?? null;
+  }
+  return null;
+}
+function hostedZoneLabel(zone) {
+  const visibility = zone.privateZone ? "private" : "public";
+  return `${withoutTrailingDot(zone.name)}  (${zone.id}, ${visibility}, ${zone.recordCount} records)`;
+}
+function resolveRecordName(params) {
+  const { nameInput, zoneName } = params;
+  const zoneFqdn = withTrailingDot(zoneName);
+  const raw = nameInput.trim();
+  if (raw === "" || raw === "@") {
+    return zoneFqdn;
+  }
+  const asFqdn = withTrailingDot(raw);
+  const zoneLower = zoneFqdn.toLowerCase();
+  if (asFqdn.toLowerCase() === zoneLower) {
+    return zoneFqdn;
+  }
+  if (asFqdn.toLowerCase().endsWith(`.${zoneLower}`)) {
+    return asFqdn;
+  }
+  const relative = raw.replace(/\.$/, "");
+  return withTrailingDot(`${relative}.${withoutTrailingDot(zoneFqdn)}`);
+}
+function getRecordSetsAtName(params) {
+  const { profile, hostedZoneId, name, verbose } = params;
+  const targetName = withTrailingDot(name).toLowerCase();
+  let startRecordName = withTrailingDot(name);
+  let startRecordType;
+  let nextRecordIdentifier;
+  const collected = [];
+  for (let page = 0; page < 20; page += 1) {
+    const args = [
+      "route53",
+      "list-resource-record-sets",
+      "--hosted-zone-id",
+      hostedZoneId,
+      "--max-items",
+      "100"
+    ];
+    if (startRecordName) {
+      args.push("--start-record-name", startRecordName);
+    }
+    if (startRecordType) {
+      args.push("--start-record-type", startRecordType);
+    }
+    if (nextRecordIdentifier) {
+      args.push("--start-record-identifier", nextRecordIdentifier);
+    }
+    const data = runAws({ profile, args, verbose });
+    const sets = data.ResourceRecordSets ?? [];
+    for (const set of sets) {
+      const setName = withTrailingDot(String(set.Name ?? "")).toLowerCase();
+      if (setName === targetName) {
+        collected.push(normalizeRecordSet(set));
+        continue;
+      }
+      if (setName > targetName) {
+        return collected;
+      }
+    }
+    const truncated = data.IsTruncated === true;
+    if (!truncated) {
+      return collected;
+    }
+    startRecordName = data.NextRecordName ? String(data.NextRecordName) : startRecordName;
+    startRecordType = data.NextRecordType ? String(data.NextRecordType) : void 0;
+    nextRecordIdentifier = data.NextRecordIdentifier ? String(data.NextRecordIdentifier) : void 0;
+  }
+  return collected;
+}
+function getResourceRecordSet(params) {
+  const { type, ...rest } = params;
+  const targetType = type.toUpperCase();
+  const sets = getRecordSetsAtName(rest);
+  return sets.find((set) => set.type === targetType) ?? null;
+}
+function findCnameConflicts(params) {
+  const { existingSets, type } = params;
+  const upperType = type.toUpperCase();
+  return existingSets.filter((set) => {
+    if (set.type === upperType) {
+      return false;
+    }
+    return upperType === "CNAME" || set.type === "CNAME";
+  });
+}
+function normalizeRecordSet(set) {
+  const values = (set.ResourceRecords ?? []).map(
+    (record) => String(record.Value ?? "")
+  );
+  return {
+    name: withTrailingDot(String(set.Name ?? "")),
+    type: String(set.Type ?? "").toUpperCase(),
+    ttl: typeof set.TTL === "number" ? set.TTL : void 0,
+    values,
+    isAlias: Boolean(set.AliasTarget),
+    aliasTarget: set.AliasTarget ?? void 0
+  };
+}
+function formatValues(values) {
+  if (values.length === 0) {
+    return "(none)";
+  }
+  if (values.length === 1) {
+    return values[0] ?? "(none)";
+  }
+  return values.map((value) => `
+    - ${value}`).join("");
+}
+function normalizeRecordValue(params) {
+  const { type, value } = params;
+  const trimmed = value.trim();
+  if (type === "CNAME" || type === "NS" || type === "MX" || type === "SRV") {
+    if (type === "MX") {
+      const parts = trimmed.split(/\s+/);
+      if (parts.length >= 2) {
+        const priority = parts[0];
+        const exchange = parts.slice(1).join(" ");
+        return `${priority} ${withTrailingDot(exchange)}`;
+      }
+    }
+    if (type === "SRV") {
+      const parts = trimmed.split(/\s+/);
+      if (parts.length >= 4) {
+        const prefix = parts.slice(0, 3).join(" ");
+        const target = parts.slice(3).join(" ");
+        return `${prefix} ${withTrailingDot(target)}`;
+      }
+    }
+    return withTrailingDot(trimmed);
+  }
+  if (type === "TXT") {
+    if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+      return trimmed;
+    }
+    return `"${trimmed}"`;
+  }
+  return trimmed;
+}
+function planRecordChange(params) {
+  const { existing, newValue, mode = "replace" } = params;
+  if (!existing) {
+    return {
+      action: "create",
+      finalValues: [newValue],
+      summary: "Adding a new record (nothing exists at this name + type)."
+    };
+  }
+  if (existing.isAlias) {
+    return {
+      action: "overwrite",
+      finalValues: [newValue],
+      summary: "Overwriting an existing ALIAS record with a standard record set."
+    };
+  }
+  const alreadyPresent = existing.values.some(
+    (value) => value === newValue || value === `"${newValue}"`
+  );
+  if (alreadyPresent && mode !== "replace") {
+    return {
+      action: "noop",
+      finalValues: existing.values,
+      summary: "Record already has this value. Nothing to do."
+    };
+  }
+  if (alreadyPresent && mode === "replace" && existing.values.length === 1 && existing.values[0] === newValue) {
+    return {
+      action: "noop",
+      finalValues: existing.values,
+      summary: "Record already has exactly this value. Nothing to do."
+    };
+  }
+  if (mode === "append") {
+    return {
+      action: "append",
+      finalValues: [...existing.values, newValue],
+      summary: `Adding to the existing ${existing.type} record (${existing.values.length} value(s) \u2192 ${existing.values.length + 1}).`
+    };
+  }
+  return {
+    action: "overwrite",
+    finalValues: [newValue],
+    summary: existing.values.length === 1 ? `Overwriting existing value:
+    ${existing.values[0]}
+  \u2192 ${newValue}` : `Replacing ${existing.values.length} existing values with a single new value.`
+  };
+}
+function upsertResourceRecordSet(params) {
+  const { profile, hostedZoneId, name, type, ttl, values, verbose } = params;
+  const changeBatch = {
+    Comment: `mtn aws route53 add-record: ${type} ${name}`,
+    Changes: [
+      {
+        Action: "UPSERT",
+        ResourceRecordSet: {
+          Name: withTrailingDot(name),
+          Type: type,
+          TTL: ttl ?? DEFAULT_TTL,
+          ResourceRecords: values.map((value) => ({ Value: value }))
+        }
+      }
+    ]
+  };
+  const data = runAws({
+    profile,
+    args: [
+      "route53",
+      "change-resource-record-sets",
+      "--hosted-zone-id",
+      hostedZoneId,
+      "--change-batch",
+      JSON.stringify(changeBatch)
+    ],
+    verbose
+  });
+  return data.ChangeInfo ?? data;
+}
+function deleteResourceRecordSet(params) {
+  const { profile, hostedZoneId, record, verbose } = params;
+  const resourceRecordSet = {
+    Name: withTrailingDot(record.name),
+    Type: record.type
+  };
+  if (record.isAlias && record.aliasTarget) {
+    resourceRecordSet.AliasTarget = record.aliasTarget;
+  } else {
+    resourceRecordSet.TTL = record.ttl ?? DEFAULT_TTL;
+    resourceRecordSet.ResourceRecords = record.values.map((value) => ({
+      Value: value
+    }));
+  }
+  const changeBatch = {
+    Comment: `mtn aws route53 remove-record: ${record.type} ${record.name}`,
+    Changes: [
+      {
+        Action: "DELETE",
+        ResourceRecordSet: resourceRecordSet
+      }
+    ]
+  };
+  const data = runAws({
+    profile,
+    args: [
+      "route53",
+      "change-resource-record-sets",
+      "--hosted-zone-id",
+      hostedZoneId,
+      "--change-batch",
+      JSON.stringify(changeBatch)
+    ],
+    verbose
+  });
+  return data.ChangeInfo ?? data;
+}
+
+export {
+  bareHostedZoneId,
+  withTrailingDot,
+  withoutTrailingDot,
+  listHostedZones,
+  findHostedZone,
+  hostedZoneLabel,
+  resolveRecordName,
+  getRecordSetsAtName,
+  getResourceRecordSet,
+  findCnameConflicts,
+  formatValues,
+  normalizeRecordValue,
+  planRecordChange,
+  upsertResourceRecordSet,
+  deleteResourceRecordSet
+};

package/esm/__chunks/3BKWTHLJ.js

@@ -0,0 +1,25 @@
+import {
+  profileField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/ses/send-email/schema.js
+import { z } from "zod";
+var sendEmailOptionsSchema = z.object({
+  to: z.string({ required_error: "--to <address> is required" }).describe("Recipient email address"),
+  from: z.string({ required_error: "--from <address> is required" }).describe("Verified SES sender email address"),
+  subject: z.string().optional().default("MTN CLI test email").describe("Email subject line"),
+  body: z.string().optional().describe("Email body (defaults to a timestamp and random token)"),
+  transport: z.enum(["api", "smtp"]).optional().default("api").describe("Send via the SES API (default) or SES SMTP"),
+  region: z.string().optional().default("us-east-1").describe("AWS region for the SES endpoint"),
+  profile: profileField,
+  accessKeyId: z.string().optional().describe(
+    "IAM access key ID used as the SMTP username (smtp transport only)"
+  ),
+  dryRun: z.boolean().optional().default(false).describe("Print the email payload without sending"),
+  verbose: verboseField
+});
+
+export {
+  sendEmailOptionsSchema
+};

package/esm/__chunks/3HE4BEJX.js

@@ -0,0 +1,105 @@
+import {
+  isSystemDatabase,
+  quoteIdent,
+  quoteLiteral
+} from "./DLEJ25GZ.js";
+
+// src/commands/db/create-readonly-user/mysql.js
+import mysql from "mysql2/promise";
+async function createConnection(config) {
+  return mysql.createConnection({
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: config.database || void 0,
+    ssl: config.ssl && typeof config.ssl === "object" ? config.ssl : void 0,
+    multipleStatements: false
+  });
+}
+async function listMysqlDatabases(config) {
+  const connection = await createConnection(config);
+  try {
+    const [rows] = await connection.query("SHOW DATABASES");
+    const names = (
+      /** @type {Array<{ Database?: string }>} */
+      rows.map(
+        (row) => row.Database ?? ""
+      )
+    );
+    return names.filter((name) => Boolean(name)).filter((name) => !isSystemDatabase({ engine: "mysql", name })).sort((a, b) => a.localeCompare(b));
+  } finally {
+    await connection.end();
+  }
+}
+async function applyMysqlReadonly(params) {
+  const {
+    config,
+    username,
+    password,
+    databases,
+    hostPattern,
+    dryRun = false,
+    verbose = false
+  } = params;
+  const userLiteral = quoteLiteral(username);
+  const hostLiteral = quoteLiteral(hostPattern);
+  const passwordLiteral = quoteLiteral(password);
+  const account = `${userLiteral}@${hostLiteral}`;
+  const statements = [];
+  const createSql = `CREATE USER IF NOT EXISTS ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const alterSql = `ALTER USER ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const grantSqls = [];
+  if (databases === "all") {
+    grantSqls.push(
+      `GRANT SELECT, SHOW VIEW, SHOW DATABASES ON *.* TO ${account}`
+    );
+  } else {
+    for (const database of databases) {
+      const dbIdent = quoteIdent({ engine: "mysql", name: database });
+      grantSqls.push(`GRANT SELECT, SHOW VIEW ON ${dbIdent}.* TO ${account}`);
+    }
+  }
+  const flushSql = "FLUSH PRIVILEGES";
+  statements.push(createSql, alterSql, ...grantSqls, flushSql);
+  if (dryRun) {
+    return {
+      created: true,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  }
+  const connection = await createConnection(config);
+  try {
+    if (verbose) {
+      console.log(`   Connected to MySQL as ${config.user}@${config.host}`);
+    }
+    const [existingRows] = await connection.query(
+      "SELECT 1 AS ok FROM mysql.user WHERE User = ? AND Host = ? LIMIT 1",
+      [username, hostPattern]
+    );
+    const existed = Array.isArray(existingRows) && existingRows.length > 0;
+    await connection.query(createSql);
+    await connection.query(alterSql);
+    for (const grantSql of grantSqls) {
+      await connection.query(grantSql);
+    }
+    await connection.query(flushSql);
+    return {
+      created: !existed,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  } finally {
+    await connection.end();
+  }
+}
+
+export {
+  listMysqlDatabases,
+  applyMysqlReadonly
+};