@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/esm/commands/aws/route53/add-record/utils.d.ts

@@ -0,0 +1,216 @@
+/**
+ * @typedef {Object} HostedZone
+ * @property {string} id - Bare hosted zone ID (without /hostedzone/ prefix)
+ * @property {string} name - Zone name with trailing dot (e.g. mountaindev.com.)
+ * @property {boolean} privateZone
+ * @property {number} recordCount
+ */
+/**
+ * @typedef {Object} ResourceRecordSet
+ * @property {string} name
+ * @property {string} type
+ * @property {number | undefined} ttl
+ * @property {string[]} values
+ * @property {boolean} isAlias
+ * @property {any} [aliasTarget] - Raw AliasTarget block (present when isAlias)
+ */
+/**
+ * Strip the `/hostedzone/` prefix from a Route53 hosted zone Id.
+ * @param {string} rawId
+ * @returns {string}
+ */
+export function bareHostedZoneId(rawId: string): string;
+/**
+ * Ensure a DNS name ends with a trailing dot (Route53 FQDN form).
+ * @param {string} name
+ * @returns {string}
+ */
+export function withTrailingDot(name: string): string;
+/**
+ * Strip a trailing dot for display.
+ * @param {string} name
+ * @returns {string}
+ */
+export function withoutTrailingDot(name: string): string;
+/**
+ * List hosted zones for the profile.
+ * @param {{ profile?: string; verbose?: boolean }} params
+ * @returns {HostedZone[]}
+ */
+export function listHostedZones(params: {
+    profile?: string;
+    verbose?: boolean;
+}): HostedZone[];
+/**
+ * Resolve a hosted zone from a name (mountaindev.com) or bare/prefixed ID.
+ * @param {{ zones: HostedZone[]; zoneInput: string }} params
+ * @returns {HostedZone | null}
+ */
+export function findHostedZone(params: {
+    zones: HostedZone[];
+    zoneInput: string;
+}): HostedZone | null;
+/**
+ * Build a display label for a hosted zone in the picker.
+ * @param {HostedZone} zone
+ * @returns {string}
+ */
+export function hostedZoneLabel(zone: HostedZone): string;
+/**
+ * Turn a relative or absolute name into a Route53 FQDN under the zone.
+ * Apex / "@" / empty → the zone apex.
+ * @param {{ nameInput: string; zoneName: string }} params
+ * @returns {string} FQDN with trailing dot
+ */
+export function resolveRecordName(params: {
+    nameInput: string;
+    zoneName: string;
+}): string;
+/**
+ * Fetch every resource record set at an exact name, across all types.
+ * Paginates when needed; Route53 list is ordered by name then type.
+ * @param {{
+ *   profile?: string;
+ *   hostedZoneId: string;
+ *   name: string;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {ResourceRecordSet[]}
+ */
+export function getRecordSetsAtName(params: {
+    profile?: string;
+    hostedZoneId: string;
+    name: string;
+    verbose?: boolean;
+}): ResourceRecordSet[];
+/**
+ * Fetch a single resource record set by exact name + type, if it exists.
+ * @param {{
+ *   profile?: string;
+ *   hostedZoneId: string;
+ *   name: string;
+ *   type: string;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {ResourceRecordSet | null}
+ */
+export function getResourceRecordSet(params: {
+    profile?: string;
+    hostedZoneId: string;
+    name: string;
+    type: string;
+    verbose?: boolean;
+}): ResourceRecordSet | null;
+/**
+ * Route53 forbids a CNAME from coexisting with any other record type at the
+ * same name. Given the type about to be written and the record sets already at
+ * that name, return the sets that would conflict (empty when there is none).
+ * A same-type set is an overwrite, not a conflict.
+ * @param {{ existingSets: ResourceRecordSet[]; type: string }} params
+ * @returns {ResourceRecordSet[]}
+ */
+export function findCnameConflicts(params: {
+    existingSets: ResourceRecordSet[];
+    type: string;
+}): ResourceRecordSet[];
+/**
+ * Format existing values for console display.
+ * @param {string[]} values
+ * @returns {string}
+ */
+export function formatValues(values: string[]): string;
+/**
+ * Normalize a single record value for a given type (trailing dots, TXT quotes).
+ * @param {{ type: string; value: string }} params
+ * @returns {string}
+ */
+export function normalizeRecordValue(params: {
+    type: string;
+    value: string;
+}): string;
+/**
+ * Decide how the new value relates to an existing RRSet.
+ * @param {{
+ *   existing: ResourceRecordSet | null;
+ *   newValue: string;
+ *   mode?: "replace" | "append";
+ * }} params
+ * @returns {{
+ *   action: "create" | "overwrite" | "append" | "noop";
+ *   finalValues: string[];
+ *   summary: string;
+ * }}
+ */
+export function planRecordChange(params: {
+    existing: ResourceRecordSet | null;
+    newValue: string;
+    mode?: "replace" | "append";
+}): {
+    action: "create" | "overwrite" | "append" | "noop";
+    finalValues: string[];
+    summary: string;
+};
+/**
+ * Submit a Route53 UPSERT for a simple (non-alias) resource record set.
+ * @param {{
+ *   profile?: string;
+ *   hostedZoneId: string;
+ *   name: string;
+ *   type: string;
+ *   ttl: number;
+ *   values: string[];
+ *   verbose?: boolean;
+ * }} params
+ * @returns {any} ChangeInfo from Route53
+ */
+export function upsertResourceRecordSet(params: {
+    profile?: string;
+    hostedZoneId: string;
+    name: string;
+    type: string;
+    ttl: number;
+    values: string[];
+    verbose?: boolean;
+}): any;
+/**
+ * Submit a Route53 DELETE for an existing resource record set. Route53 requires
+ * the record's exact current definition, so this is driven by the record set
+ * returned from {@link getResourceRecordSet} — alias records reuse their
+ * AliasTarget; standard records reuse their TTL + values.
+ * @param {{
+ *   profile?: string;
+ *   hostedZoneId: string;
+ *   record: ResourceRecordSet;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {any} ChangeInfo from Route53
+ */
+export function deleteResourceRecordSet(params: {
+    profile?: string;
+    hostedZoneId: string;
+    record: ResourceRecordSet;
+    verbose?: boolean;
+}): any;
+export type HostedZone = {
+    /**
+     * - Bare hosted zone ID (without /hostedzone/ prefix)
+     */
+    id: string;
+    /**
+     * - Zone name with trailing dot (e.g. mountaindev.com.)
+     */
+    name: string;
+    privateZone: boolean;
+    recordCount: number;
+};
+export type ResourceRecordSet = {
+    name: string;
+    type: string;
+    ttl: number | undefined;
+    values: string[];
+    isAlias: boolean;
+    /**
+     * - Raw AliasTarget block (present when isAlias)
+     */
+    aliasTarget?: any;
+};

package/esm/commands/aws/route53/add-record/utils.js

@@ -0,0 +1,37 @@
+import {
+  bareHostedZoneId,
+  deleteResourceRecordSet,
+  findCnameConflicts,
+  findHostedZone,
+  formatValues,
+  getRecordSetsAtName,
+  getResourceRecordSet,
+  hostedZoneLabel,
+  listHostedZones,
+  normalizeRecordValue,
+  planRecordChange,
+  resolveRecordName,
+  upsertResourceRecordSet,
+  withTrailingDot,
+  withoutTrailingDot
+} from "../../../../__chunks/33UYMUQD.js";
+import "../../../../__chunks/IEOGAQYI.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  bareHostedZoneId,
+  deleteResourceRecordSet,
+  findCnameConflicts,
+  findHostedZone,
+  formatValues,
+  getRecordSetsAtName,
+  getResourceRecordSet,
+  hostedZoneLabel,
+  listHostedZones,
+  normalizeRecordValue,
+  planRecordChange,
+  resolveRecordName,
+  upsertResourceRecordSet,
+  withTrailingDot,
+  withoutTrailingDot
+};

package/esm/commands/aws/route53/remove-record/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws route53 remove-record` handler: interactively (or via flags) delete a
+ * Route53 resource record set, showing the record before it is removed.
+ * @param {unknown} options
+ */
+export function removeRecordCommand(options: unknown): Promise<void>;

package/esm/commands/aws/route53/remove-record/handler.js

@@ -0,0 +1,14 @@
+import {
+  removeRecordCommand
+} from "../../../../__chunks/QKDDLIWD.js";
+import "../../../../__chunks/IZFGBYGE.js";
+import "../../../../__chunks/G4NJHFFU.js";
+import "../../../../__chunks/33UYMUQD.js";
+import "../../../../__chunks/IEOGAQYI.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  removeRecordCommand
+};

package/esm/commands/aws/route53/remove-record/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/esm/commands/aws/route53/remove-record/index.js

@@ -0,0 +1,18 @@
+import "../../../../__chunks/7VF4Q43Q.js";
+import {
+  removeRecordCommand
+} from "../../../../__chunks/QKDDLIWD.js";
+import {
+  removeRecordOptionsSchema
+} from "../../../../__chunks/IZFGBYGE.js";
+import "../../../../__chunks/G4NJHFFU.js";
+import "../../../../__chunks/33UYMUQD.js";
+import "../../../../__chunks/IEOGAQYI.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  removeRecordCommand,
+  removeRecordOptionsSchema
+};

package/esm/commands/aws/route53/remove-record/schema.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Zod schema for `aws route53 remove-record` options.
+ */
+export const removeRecordOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    zone: z.ZodOptional<z.ZodString>;
+    type: z.ZodEffects<z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>, string | undefined, string | undefined>;
+    name: z.ZodOptional<z.ZodString>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    dryRun: boolean;
+    profile?: string | undefined;
+    type?: string | undefined;
+    name?: string | undefined;
+    zone?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    type?: string | undefined;
+    dryRun?: boolean | undefined;
+    name?: string | undefined;
+    zone?: string | undefined;
+}>;
+export type RemoveRecordOptions = z.infer<typeof removeRecordOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/route53/remove-record/schema.js

@@ -0,0 +1,8 @@
+import {
+  removeRecordOptionsSchema
+} from "../../../../__chunks/IZFGBYGE.js";
+import "../../../../__chunks/IEOGAQYI.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  removeRecordOptionsSchema
+};

package/esm/commands/aws/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Shared Zod field for the AWS profile option.
+ */
+export const profileField: z.ZodOptional<z.ZodString>;
+/**
+ * Shared Zod field for the AWS region option.
+ */
+export const regionField: z.ZodOptional<z.ZodString>;
+/**
+ * Shared Zod field for verbose logging.
+ */
+export const verboseField: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+import { z } from "zod";

package/esm/commands/aws/schema.js

@@ -0,0 +1,10 @@
+import {
+  profileField,
+  regionField,
+  verboseField
+} from "../../__chunks/73BJG53F.js";
+export {
+  profileField,
+  regionField,
+  verboseField
+};

package/esm/commands/aws/ses/send-email/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `aws ses send-email` handler: send a single test email via the SES API or SMTP.
+ * @param {unknown} options
+ */
+export function sendEmailCommand(options: unknown): Promise<void>;

package/esm/commands/aws/ses/send-email/handler.js

@@ -0,0 +1,12 @@
+import {
+  sendEmailCommand
+} from "../../../../__chunks/2FTTEFEK.js";
+import "../../../../__chunks/UXWY7BYE.js";
+import "../../../../__chunks/B2DVQ2UL.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/3BKWTHLJ.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  sendEmailCommand
+};

package/esm/commands/aws/ses/send-email/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/esm/commands/aws/ses/send-email/index.js

@@ -0,0 +1,23 @@
+import "../../../../__chunks/TXKMEIDQ.js";
+import {
+  sendEmailCommand
+} from "../../../../__chunks/2FTTEFEK.js";
+import {
+  defaultBody,
+  sendViaApi,
+  sendViaSmtp
+} from "../../../../__chunks/UXWY7BYE.js";
+import "../../../../__chunks/B2DVQ2UL.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import {
+  sendEmailOptionsSchema
+} from "../../../../__chunks/3BKWTHLJ.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  defaultBody,
+  sendEmailCommand,
+  sendEmailOptionsSchema,
+  sendViaApi,
+  sendViaSmtp
+};

package/esm/commands/aws/ses/send-email/schema.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Zod schema for `aws ses send-email` options.
+ */
+export const sendEmailOptionsSchema: z.ZodObject<{
+    to: z.ZodString;
+    from: z.ZodString;
+    subject: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    transport: z.ZodDefault<z.ZodOptional<z.ZodEnum<["api", "smtp"]>>>;
+    region: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    profile: z.ZodOptional<z.ZodString>;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    region: string;
+    verbose: boolean;
+    dryRun: boolean;
+    to: string;
+    from: string;
+    subject: string;
+    transport: "api" | "smtp";
+    profile?: string | undefined;
+    accessKeyId?: string | undefined;
+    body?: string | undefined;
+}, {
+    to: string;
+    from: string;
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    accessKeyId?: string | undefined;
+    subject?: string | undefined;
+    body?: string | undefined;
+    transport?: "api" | "smtp" | undefined;
+}>;
+export type SendEmailOptions = z.infer<typeof sendEmailOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/ses/send-email/schema.js

@@ -0,0 +1,7 @@
+import {
+  sendEmailOptionsSchema
+} from "../../../../__chunks/3BKWTHLJ.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  sendEmailOptionsSchema
+};

package/esm/commands/aws/ses/send-email/utils.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Build a default test-email body with a timestamp and random token.
+ * @returns {string}
+ */
+export function defaultBody(): string;
+/**
+ * Send an email through the SES API using the AWS SDK.
+ * @param {{
+ *   to: string;
+ *   from: string;
+ *   subject: string;
+ *   body: string;
+ *   region: string;
+ *   profile?: string;
+ * }} params
+ * @returns {Promise<string | undefined>} The SES message id
+ */
+export function sendViaApi(params: {
+    to: string;
+    from: string;
+    subject: string;
+    body: string;
+    region: string;
+    profile?: string;
+}): Promise<string | undefined>;
+/**
+ * Send an email through the SES SMTP endpoint using nodemailer.
+ * Credentials come from SES_SMTP_USER/SES_SMTP_PASSWORD, or the password is
+ * derived from AWS_SECRET_ACCESS_KEY when only that is available.
+ * @param {{
+ *   to: string;
+ *   from: string;
+ *   subject: string;
+ *   body: string;
+ *   region: string;
+ *   accessKeyId?: string;
+ * }} params
+ * @returns {Promise<string | undefined>} The SMTP message id
+ */
+export function sendViaSmtp(params: {
+    to: string;
+    from: string;
+    subject: string;
+    body: string;
+    region: string;
+    accessKeyId?: string;
+}): Promise<string | undefined>;

package/esm/commands/aws/ses/send-email/utils.js

@@ -0,0 +1,11 @@
+import {
+  defaultBody,
+  sendViaApi,
+  sendViaSmtp
+} from "../../../../__chunks/UXWY7BYE.js";
+import "../../../../__chunks/B2DVQ2UL.js";
+export {
+  defaultBody,
+  sendViaApi,
+  sendViaSmtp
+};

package/esm/commands/aws/ses/smtp-password.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Derive an SES SMTP password from an IAM secret access key, following the
+ * AWS Signature V4 algorithm with SES-specific constants.
+ * @see https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-convert
+ * @param {{ secretAccessKey: string; region: string }} params
+ * @returns {string}
+ */
+export function calculateSmtpPassword(params: {
+    secretAccessKey: string;
+    region: string;
+}): string;
+/**
+ * SES SMTP endpoint host for a region.
+ * @param {string} region
+ * @returns {string}
+ */
+export function smtpEndpoint(region: string): string;
+/**
+ * AWS regions that expose an SES SMTP endpoint.
+ */
+export const SMTP_REGIONS: Set<string>;

package/esm/commands/aws/ses/smtp-password.js

@@ -0,0 +1,10 @@
+import {
+  SMTP_REGIONS,
+  calculateSmtpPassword,
+  smtpEndpoint
+} from "../../../__chunks/B2DVQ2UL.js";
+export {
+  SMTP_REGIONS,
+  calculateSmtpPassword,
+  smtpEndpoint
+};

package/esm/commands/aws/utils/exec-aws.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Extract the AWS service error code from a CLI stderr string.
+ * AWS prints codes in parentheses, e.g. "...(UnauthorizedOperation) when calling...".
+ * @param {string} stderr
+ * @returns {string | null}
+ */
+export function parseAwsErrorCode(stderr: string): string | null;
+/**
+ * Verify that the given executables are available on PATH.
+ * @param {string[]} commands
+ * @throws {Error} If any command is missing
+ */
+export function requireCommands(commands: string[]): void;
+/**
+ * Run an AWS CLI command using a credential profile.
+ * Uses an argument array (no shell) so JSON arguments need no escaping.
+ * @param {{
+ *   profile?: string;
+ *   region?: string;
+ *   args: string[];
+ *   expectJson?: boolean;
+ *   verbose?: boolean;
+ *   env?: Record<string, string>;
+ * }} params
+ * @returns {any} Parsed JSON when expectJson is true, otherwise trimmed stdout string
+ */
+export function runAws(params: {
+    profile?: string;
+    region?: string;
+    args: string[];
+    expectJson?: boolean;
+    verbose?: boolean;
+    env?: Record<string, string>;
+}): any;
+/**
+ * Run an AWS CLI command through `aws-vault exec` for profiles whose credentials
+ * are stored in the OS keychain rather than ~/.aws/credentials.
+ * @param {{
+ *   profile: string;
+ *   args: string[];
+ *   duration?: string;
+ *   expectJson?: boolean;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {any}
+ */
+export function runAwsVault(params: {
+    profile: string;
+    args: string[];
+    duration?: string;
+    expectJson?: boolean;
+    verbose?: boolean;
+}): any;
+/**
+ * Fetch the caller identity for a profile (account id and ARN).
+ * @param {{ profile?: string; region?: string; verbose?: boolean }} params
+ * @returns {{ Account: string; Arn: string; UserId: string }}
+ */
+export function getCallerIdentity(params: {
+    profile?: string;
+    region?: string;
+    verbose?: boolean;
+}): {
+    Account: string;
+    Arn: string;
+    UserId: string;
+};
+/**
+ * Error raised when the AWS CLI (or aws-vault) exits non-zero.
+ * The `code` is the AWS service error code parsed from stderr (e.g. "UnauthorizedOperation").
+ */
+export class AwsCliError extends Error {
+    /**
+     * @param {string} message
+     * @param {string | null} [code]
+     */
+    constructor(message: string, code?: string | null);
+    code: string | null;
+}

package/esm/commands/aws/utils/exec-aws.js

@@ -0,0 +1,16 @@
+import {
+  AwsCliError,
+  getCallerIdentity,
+  parseAwsErrorCode,
+  requireCommands,
+  runAws,
+  runAwsVault
+} from "../../../__chunks/FNXUONAV.js";
+export {
+  AwsCliError,
+  getCallerIdentity,
+  parseAwsErrorCode,
+  requireCommands,
+  runAws,
+  runAwsVault
+};

package/esm/commands/aws/utils/resolve-policy-path.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve the absolute path to a bundled IAM policy document.
+ * Policies live alongside the source in `iam/policies/`, and the CLI runs from
+ * source, so this path is valid at runtime.
+ * @param {string} fileName - Policy JSON file name (e.g. "user-admins-write-list.json")
+ * @returns {string}
+ */
+export function resolvePolicyPath(fileName: string): string;

package/esm/commands/aws/utils/resolve-policy-path.js

@@ -0,0 +1,6 @@
+import {
+  resolvePolicyPath
+} from "../../../__chunks/ZO55YUSY.js";
+export {
+  resolvePolicyPath
+};