@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/cjs/__chunks/SBBNW2BF.cjs

@@ -0,0 +1,249 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+var _3NOHGUCFcjs = require('./3NOHGUCF.cjs');
+
+// src/commands/aws/iam/setup-acl/utils.js
+var ACL_GROUPS = [
+  "acl-admin-do-not-use",
+  "acl-iam-full-access",
+  "acl-power-users",
+  "acl-read-only",
+  "acl-s3-restrictions"
+];
+var CUSTOM_POLICIES = [
+  { name: "UserAdminsWriteList", fileName: "user-admins-write-list.json" },
+  { name: "UserAdminsDenyList", fileName: "user-admins-deny-list.json" },
+  {
+    name: "UserAdminsSelfServiceIAM",
+    fileName: "user-admins-self-service-iam.json"
+  },
+  {
+    name: "UserAdminsDenyRegionsList",
+    fileName: "user-admins-deny-regions-list.json"
+  },
+  { name: "sts-federation", fileName: "sts-federation.json" },
+  {
+    name: "S3RestrictionsDenyNonS3Services",
+    fileName: "s3-restrictions-deny-non-s3-services.json"
+  }
+];
+function ensureGroup(params) {
+  const { name, profile, verbose } = params;
+  let exists = true;
+  try {
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: ["iam", "get-group", "--group-name", name],
+      verbose
+    });
+  } catch (e) {
+    exists = false;
+  }
+  if (exists) {
+    console.log(`  Group exists: ${name}`);
+    return;
+  }
+  console.log(`  Create group: ${name}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: ["iam", "create-group", "--group-name", name, "--path", "/"],
+    expectJson: false,
+    verbose
+  });
+}
+function publishPolicy(params) {
+  const { name, fileName, accountId, profile, verbose } = params;
+  const arn = `arn:aws:iam::${accountId}:policy/${name}`;
+  const file = _3NOHGUCFcjs.resolvePolicyPath.call(void 0, fileName);
+  let exists = true;
+  try {
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: ["iam", "get-policy", "--policy-arn", arn],
+      verbose
+    });
+  } catch (e2) {
+    exists = false;
+  }
+  if (!exists) {
+    console.log(`  Create policy: ${name}`);
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: [
+        "iam",
+        "create-policy",
+        "--policy-name",
+        name,
+        "--policy-document",
+        `file://${file}`,
+        "--description",
+        `ACL: ${name}`
+      ],
+      expectJson: false,
+      verbose
+    });
+    return;
+  }
+  const nonDefaultCount = Number.parseInt(
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: [
+        "iam",
+        "list-policy-versions",
+        "--policy-arn",
+        arn,
+        "--query",
+        "length(Versions[?IsDefaultVersion==`false`])",
+        "--output",
+        "text"
+      ],
+      expectJson: false,
+      verbose
+    }),
+    10
+  ) || 0;
+  if (nonDefaultCount >= 4) {
+    const oldest = _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: [
+        "iam",
+        "list-policy-versions",
+        "--policy-arn",
+        arn,
+        "--query",
+        "Versions[?IsDefaultVersion==`false`] | sort_by(@, &CreateDate)[0].VersionId",
+        "--output",
+        "text"
+      ],
+      expectJson: false,
+      verbose
+    });
+    console.log(`  Prune oldest version of ${name}: ${oldest}`);
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: [
+        "iam",
+        "delete-policy-version",
+        "--policy-arn",
+        arn,
+        "--version-id",
+        oldest
+      ],
+      expectJson: false,
+      verbose
+    });
+  }
+  console.log(`  Update policy: ${name}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "create-policy-version",
+      "--policy-arn",
+      arn,
+      "--policy-document",
+      `file://${file}`,
+      "--set-as-default"
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function isPolicyAttached(params) {
+  const { group, arn, profile, verbose } = params;
+  const out = _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "list-attached-group-policies",
+      "--group-name",
+      group,
+      "--query",
+      `AttachedPolicies[?PolicyArn=='${arn}'].PolicyArn`,
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  return Boolean(out);
+}
+function attach(params) {
+  const { group, arn, profile, verbose } = params;
+  const policyName = _nullishCoalesce(arn.split("/").pop(), () => ( arn));
+  if (isPolicyAttached({ group, arn, profile, verbose })) {
+    console.log(`  [${group}] already attached: ${policyName}`);
+    return;
+  }
+  console.log(`  [${group}] attach: ${policyName}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "attach-group-policy",
+      "--group-name",
+      group,
+      "--policy-arn",
+      arn
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function detach(params) {
+  const { group, arn, profile, verbose } = params;
+  const policyName = _nullishCoalesce(arn.split("/").pop(), () => ( arn));
+  if (!isPolicyAttached({ group, arn, profile, verbose })) {
+    return;
+  }
+  console.log(`  [${group}] detach legacy: ${policyName}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "detach-group-policy",
+      "--group-name",
+      group,
+      "--policy-arn",
+      arn
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function printFinalState(params) {
+  const { profile, verbose } = params;
+  for (const group of ACL_GROUPS) {
+    console.log("");
+    console.log(`=== ${group} ===`);
+    const table = _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: [
+        "iam",
+        "list-attached-group-policies",
+        "--group-name",
+        group,
+        "--query",
+        "AttachedPolicies[].PolicyName",
+        "--output",
+        "table"
+      ],
+      expectJson: false,
+      verbose
+    });
+    console.log(table);
+  }
+}
+
+
+
+
+
+
+
+
+
+exports.ACL_GROUPS = ACL_GROUPS; exports.CUSTOM_POLICIES = CUSTOM_POLICIES; exports.ensureGroup = ensureGroup; exports.publishPolicy = publishPolicy; exports.attach = attach; exports.detach = detach; exports.printFinalState = printFinalState;

package/cjs/__chunks/T2A7TN4F.cjs

@@ -0,0 +1,81 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+// src/commands/aws/iam/admin-group.js
+var _child_process = require('child_process');
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var ADMIN_GROUP_NAME = "acl-admin-do-not-use";
+var VAULT_DURATION = _nullishCoalesce(process.env.AWS_VAULT_DURATION, () => ( "15m"));
+function listVaultProfiles() {
+  const result = _child_process.spawnSync.call(void 0, "aws-vault", ["list", "--credentials"], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    return [];
+  }
+  return (_nullishCoalesce(result.stdout, () => ( ""))).split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function resolveAdminScanProfiles({ profile, all = false }) {
+  const targetProfile = _nullishCoalesce(profile, () => ( process.env.AWS_PROFILE));
+  if (!all && targetProfile) {
+    return [targetProfile];
+  }
+  const profiles = listVaultProfiles();
+  if (profiles.length === 0) {
+    throw new Error("No aws-vault profiles with credentials found.");
+  }
+  return profiles;
+}
+function groupUserNames(group) {
+  return (_nullishCoalesce(group.Users, () => ( []))).map((user) => user.UserName);
+}
+function resolveProfileScan(params) {
+  const { profile, verbose = false } = params;
+  const idArgs = ["sts", "get-caller-identity"];
+  const groupArgs = ["iam", "get-group", "--group-name", ADMIN_GROUP_NAME];
+  const directRun = (args, options = {}) => _R3GUC7O7cjs.runAws.call(void 0, { profile, args, expectJson: _nullishCoalesce(options.expectJson, () => ( true)), verbose });
+  const vaultRun = (args, options = {}) => _R3GUC7O7cjs.runAwsVault.call(void 0, {
+    profile,
+    args,
+    duration: VAULT_DURATION,
+    expectJson: _nullishCoalesce(options.expectJson, () => ( true)),
+    verbose
+  });
+  try {
+    const identity = directRun(idArgs);
+    const group = directRun(groupArgs);
+    return {
+      accountId: identity.Account,
+      arn: identity.Arn,
+      users: groupUserNames(group),
+      run: directRun
+    };
+  } catch (directError) {
+    try {
+      const identity = vaultRun(idArgs);
+      const group = vaultRun(groupArgs);
+      return {
+        accountId: identity.Account,
+        arn: identity.Arn,
+        users: groupUserNames(group),
+        run: vaultRun
+      };
+    } catch (e) {
+      if (verbose) {
+        const reason = directError instanceof Error ? _nullishCoalesce(directError.message.split("\n")[0], () => ( "")) : String(directError);
+        console.log(_chalk2.default.dim(`skip   ${profile} \u2014 ${reason}`));
+      }
+      return null;
+    }
+  }
+}
+
+
+
+
+
+
+
+exports.ADMIN_GROUP_NAME = ADMIN_GROUP_NAME; exports.listVaultProfiles = listVaultProfiles; exports.resolveAdminScanProfiles = resolveAdminScanProfiles; exports.groupUserNames = groupUserNames; exports.resolveProfileScan = resolveProfileScan;

package/cjs/__chunks/TKNNDDIB.cjs

@@ -0,0 +1,97 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+
+var _YRHFKTW2cjs = require('./YRHFKTW2.cjs');
+
+
+var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
+
+
+var _N7D56LPPcjs = require('./N7D56LPP.cjs');
+
+// src/commands/aws/ses/send-email/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function sendEmailCommand(options) {
+  try {
+    const parsed = _N7D56LPPcjs.sendEmailOptionsSchema.parse(options);
+    const {
+      to,
+      from,
+      subject,
+      transport,
+      region,
+      profile: profileOption,
+      accessKeyId,
+      dryRun,
+      verbose
+    } = parsed;
+    const body = _nullishCoalesce(parsed.body, () => ( _YRHFKTW2cjs.defaultBody.call(void 0, )));
+    const profile = transport === "api" ? await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile: profileOption }) : profileOption;
+    console.log(_chalk2.default.blue("\n\u{1F4E7} SES send-email"));
+    console.log(_chalk2.default.gray(`   transport: ${transport}`));
+    console.log(_chalk2.default.gray(`   region:    ${region}`));
+    console.log(_chalk2.default.gray(`   from:      ${from}`));
+    console.log(_chalk2.default.gray(`   to:        ${to}`));
+    console.log(_chalk2.default.gray(`   subject:   ${subject}`));
+    if (verbose) {
+      console.log(_chalk2.default.gray(`   body:      ${body}`));
+    }
+    if (dryRun) {
+      console.log(_chalk2.default.yellow("\n[dry-run] No email sent."));
+      return;
+    }
+    const messageId = transport === "api" ? await _YRHFKTW2cjs.sendViaApi.call(void 0, { to, from, subject, body, region, profile }) : await _YRHFKTW2cjs.sendViaSmtp.call(void 0, { to, from, subject, body, region, accessKeyId });
+    console.log(
+      _chalk2.default.green(
+        `
+\u2705 Email sent${messageId ? ` (messageId: ${messageId})` : ""}.`
+      )
+    );
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C send-email failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(_chalk2.default.yellow("\n\u{1F4A1} Troubleshooting tips:"));
+    console.error(
+      _chalk2.default.yellow("   \u2022 The sender address must be verified in SES")
+    );
+    console.error(
+      _chalk2.default.yellow(
+        "   \u2022 New SES accounts are sandboxed \u2014 recipients must also be verified"
+      )
+    );
+    console.error(
+      _chalk2.default.yellow(
+        "   \u2022 For smtp transport, set SES_SMTP_USER and SES_SMTP_PASSWORD"
+      )
+    );
+    console.error(
+      _chalk2.default.yellow("   \u2022 Use --verbose for detailed error information\n")
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.sendEmailCommand = sendEmailCommand;

package/cjs/__chunks/TNSRDJPR.cjs

@@ -0,0 +1 @@
+"use strict";

package/cjs/__chunks/UWHPE2GI.cjs

@@ -0,0 +1,20 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _WOYF2L6Tcjs = require('./WOYF2L6T.cjs');
+
+// src/commands/aws/iam/break-glass/schema.js
+var _zod = require('zod');
+var breakGlassOptionsSchema = _zod.z.object({
+  profile: _WOYF2L6Tcjs.profileField,
+  user: _zod.z.array(_zod.z.string()).optional().default([]).describe(
+    "Grant break-glass to this user (repeatable). Default: your own IAM user"
+  ),
+  yes: _zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+  dryRun: _zod.z.boolean().optional().default(false).describe("Preview the grant without changing anything"),
+  verbose: _WOYF2L6Tcjs.verboseField
+});
+
+
+
+exports.breakGlassOptionsSchema = breakGlassOptionsSchema;

package/cjs/__chunks/W6K7BV74.cjs

@@ -0,0 +1 @@
+"use strict";