@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-dev-20260914234436

package/esm/__chunks/3QLI5BDL.js

@@ -0,0 +1,387 @@
+import {
+  runAws
+} from "./FNXUONAV.js";
+import {
+  prompt,
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/iam/users/utils.js
+import chalk from "chalk";
+var KNOWN_ROLES = ["read-only", "iam-admin", "power-user"];
+var REQUIRED_ACL_GROUPS = [
+  "acl-read-only",
+  "acl-iam-full-access",
+  "acl-power-users"
+];
+function roleToGroup(role) {
+  switch (role) {
+    case "read-only":
+      return "acl-read-only";
+    case "iam-admin":
+      return "acl-iam-full-access";
+    case "power-user":
+      return "acl-power-users";
+    default:
+      throw new Error(`Unknown role: ${role}`);
+  }
+}
+function normalizeSlug(value) {
+  return value.toLowerCase().replace(/ /g, "-");
+}
+function isValidSlug(value) {
+  return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function buildUsername(params) {
+  const { identifier, accountName, role } = params;
+  return `md-${identifier}-${accountName}-${role}`;
+}
+function normalizeIdentifier(params) {
+  const { raw, accountName, role } = params;
+  let identifier = normalizeSlug(raw);
+  if (identifier.startsWith("md-")) {
+    identifier = identifier.slice(3);
+  }
+  if (identifier.endsWith(`-${role}`)) {
+    identifier = identifier.slice(0, -(role.length + 1));
+  } else {
+    for (const knownRole of KNOWN_ROLES) {
+      if (identifier.endsWith(`-${knownRole}`)) {
+        identifier = identifier.slice(0, -(knownRole.length + 1));
+        break;
+      }
+    }
+  }
+  if (identifier.endsWith(`-${accountName}`)) {
+    identifier = identifier.slice(0, -(accountName.length + 1));
+  }
+  return identifier;
+}
+function parseMdUsername(name) {
+  let value = normalizeSlug(name);
+  if (!value.startsWith("md-")) {
+    return null;
+  }
+  value = value.slice(3);
+  const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+  let role = null;
+  for (const knownRole of rolesByLength) {
+    if (value.endsWith(`-${knownRole}`)) {
+      role = knownRole;
+      value = value.slice(0, -(knownRole.length + 1));
+      break;
+    }
+  }
+  if (!role) {
+    return null;
+  }
+  const dash = value.indexOf("-");
+  if (dash <= 0 || dash === value.length - 1) {
+    return null;
+  }
+  const identifier = value.slice(0, dash);
+  const accountName = value.slice(dash + 1);
+  if (!isValidSlug(identifier) || !isValidSlug(accountName)) {
+    return null;
+  }
+  return { identifier, accountName, role };
+}
+function inferAccountName(params) {
+  const { profile, identity } = params;
+  const arn = identity?.Arn ?? "";
+  const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+  for (const candidate of [username, profile ?? ""]) {
+    if (!candidate) {
+      continue;
+    }
+    const parsed = parseMdUsername(candidate);
+    if (parsed) {
+      return parsed.accountName;
+    }
+  }
+  return null;
+}
+function userExists(params) {
+  const { username, profile, verbose } = params;
+  try {
+    runAws({
+      profile,
+      args: ["iam", "get-user", "--user-name", username],
+      verbose
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureUser(params) {
+  const { username, profile, verbose } = params;
+  if (userExists({ username, profile, verbose })) {
+    console.log(`  User exists: ${username}`);
+    return;
+  }
+  console.log(`  Create user: ${username}`);
+  runAws({
+    profile,
+    args: ["iam", "create-user", "--user-name", username, "--path", "/"],
+    verbose
+  });
+}
+function ensureUserInGroup(params) {
+  const { username, group, profile, verbose } = params;
+  const existing = runAws({
+    profile,
+    args: [
+      "iam",
+      "get-group",
+      "--group-name",
+      group,
+      "--query",
+      `Users[?UserName=='${username}'].UserName`,
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  if (existing) {
+    console.log(`  Already in group: ${group}`);
+    return;
+  }
+  console.log(`  Add to group: ${group}`);
+  runAws({
+    profile,
+    args: [
+      "iam",
+      "add-user-to-group",
+      "--user-name",
+      username,
+      "--group-name",
+      group
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function createCliAccessKey(params) {
+  const { username, profile, verbose } = params;
+  const keyCountRaw = runAws({
+    profile,
+    args: [
+      "iam",
+      "list-access-keys",
+      "--user-name",
+      username,
+      "--query",
+      "length(AccessKeyMetadata)",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const keyCount = Number.parseInt(keyCountRaw, 10) || 0;
+  if (keyCount >= 2) {
+    console.log(
+      chalk.yellow(
+        `  WARNING: ${username} already has 2 access keys (AWS max).`
+      )
+    );
+    console.log(
+      chalk.yellow("  Delete an existing key before creating a new one.")
+    );
+    return false;
+  }
+  const created = runAws({
+    profile,
+    args: [
+      "iam",
+      "create-access-key",
+      "--user-name",
+      username,
+      "--query",
+      "AccessKey.[AccessKeyId,SecretAccessKey]",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const [accessKeyId, secretAccessKey] = created.split(/\s+/);
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Failed to parse the newly created access key");
+  }
+  const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+  console.log("");
+  console.log(
+    `  CLI credentials for ${username} (secret shown once \u2014 copy now):`
+  );
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log(
+    "  YOU MUST run the command below with a LEADING SPACE so it is not saved"
+  );
+  console.log('  to shell history \u2014 same idea as:  TEST="a" && echo $TEST');
+  console.log("");
+  console.log(setupCmd);
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log("");
+  return true;
+}
+function ensureAclGroupsExist(params) {
+  const { profile, verbose } = params;
+  const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+    try {
+      runAws({
+        profile,
+        args: ["iam", "get-group", "--group-name", group],
+        verbose
+      });
+      return false;
+    } catch {
+      return true;
+    }
+  });
+  if (missing.length > 0) {
+    missing.forEach((group) => console.log(`  Missing group: ${group}`));
+    console.log("");
+    console.log(
+      "  Run `mtn aws iam setup-acl` first to create ACL groups and policies."
+    );
+    return false;
+  }
+  return true;
+}
+async function promptAccountName(params) {
+  const { accountName, inferredAccountName } = params;
+  if (accountName) {
+    const slug = normalizeSlug(accountName);
+    if (isValidSlug(slug)) {
+      console.log(`  Account name: ${slug}`);
+      return slug;
+    }
+    console.log("  Invalid account name option \u2014 falling back to prompt.");
+  }
+  const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+  for (; ; ) {
+    const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+    const raw = await prompt(
+      `  AWS account name${hint} \u2014 used in md-{identifier}-{account}-{role}: `
+    );
+    if (raw === "" && defaultSlug) {
+      console.log(`  \u2192 account name: ${defaultSlug}`);
+      return defaultSlug;
+    }
+    const slug = normalizeSlug(raw);
+    if (isValidSlug(slug)) {
+      if (raw !== slug) {
+        console.log(`  \u2192 account name: ${slug}`);
+      }
+      return slug;
+    }
+    console.log(
+      "  Invalid account name \u2014 use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : ".")
+    );
+  }
+}
+async function promptRole() {
+  for (; ; ) {
+    console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+    console.log("    1) read-only   \u2192 acl-read-only");
+    console.log("    2) iam-admin   \u2192 acl-iam-full-access");
+    console.log("    3) power-user  \u2192 acl-power-users");
+    const choice = await prompt("  Choice [1-3]: ");
+    switch (choice) {
+      case "1":
+      case "read-only":
+        return "read-only";
+      case "2":
+      case "iam-admin":
+        return "iam-admin";
+      case "3":
+      case "power-user":
+        return "power-user";
+      default:
+        console.log("  Invalid choice \u2014 enter 1, 2, 3, or the role name.");
+    }
+  }
+}
+async function promptIdentifier(params) {
+  const { accountName, role } = params;
+  const exampleUser = buildUsername({
+    identifier: "declan",
+    accountName,
+    role
+  });
+  for (; ; ) {
+    const raw = await prompt(
+      `  Identifier (e.g. declan, or full ${exampleUser}): `
+    );
+    const lowerRaw = normalizeSlug(raw);
+    const identifier = normalizeIdentifier({ raw, accountName, role });
+    if (isValidSlug(identifier)) {
+      if (lowerRaw !== identifier) {
+        console.log(`  \u2192 parsed identifier: ${identifier}`);
+      }
+      return identifier;
+    }
+    console.log(
+      "  Invalid identifier \u2014 use lowercase letters, numbers, and hyphens."
+    );
+    console.log("  Tip: enter just the short name (e.g. declan).");
+  }
+}
+async function createUsersInteractive(params) {
+  const { accountName: accountNameOption, profile, identity, verbose } = params;
+  if (!ensureAclGroupsExist({ profile, verbose })) {
+    return;
+  }
+  console.log("");
+  const inferredAccountName = inferAccountName({ profile, identity });
+  const accountName = await promptAccountName({
+    accountName: accountNameOption,
+    inferredAccountName
+  });
+  console.log("");
+  while (await promptYesNo({ message: "  Create another user?", defaultYes: false })) {
+    console.log("");
+    const role = await promptRole();
+    const identifier = await promptIdentifier({ accountName, role });
+    const username = buildUsername({ identifier, accountName, role });
+    const group = roleToGroup(role);
+    console.log("");
+    console.log(`  \u2192 user: ${username}`);
+    console.log(`  \u2192 group: ${group}`);
+    console.log("");
+    ensureUser({ username, profile, verbose });
+    ensureUserInGroup({ username, group, profile, verbose });
+    try {
+      createCliAccessKey({ username, profile, verbose });
+    } catch (error) {
+      console.log(
+        chalk.yellow(
+          `  Could not create access key: ${error instanceof Error ? error.message : String(error)}`
+        )
+      );
+    }
+    console.log("");
+  }
+}
+
+export {
+  roleToGroup,
+  normalizeSlug,
+  isValidSlug,
+  buildUsername,
+  normalizeIdentifier,
+  parseMdUsername,
+  inferAccountName,
+  ensureUser,
+  ensureUserInGroup,
+  createCliAccessKey,
+  ensureAclGroupsExist,
+  createUsersInteractive
+};

package/esm/__chunks/5GIUAFXL.js

@@ -0,0 +1,89 @@
+import {
+  prompt,
+  promptChoice
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/utils/resolve-profile.js
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import chalk from "chalk";
+var MAX_LISTED = 30;
+function listConfigProfiles() {
+  const configPath = process.env.AWS_CONFIG_FILE ?? join(homedir(), ".aws", "config");
+  let contents;
+  try {
+    contents = readFileSync(configPath, "utf-8");
+  } catch {
+    return [];
+  }
+  const profiles = [];
+  const profileRe = /^\[profile\s+(.+?)\]$/;
+  for (const rawLine of contents.split("\n")) {
+    const line = rawLine.trim();
+    const match = profileRe.exec(line);
+    if (match?.[1]) {
+      profiles.push(match[1].trim());
+    } else if (line === "[default]") {
+      profiles.push("default");
+    }
+  }
+  return profiles;
+}
+async function pickProfileInteractive(profiles) {
+  for (; ; ) {
+    const filter = (await prompt(chalk.cyan("Filter profiles (substring, Enter for all): "))).trim().toLowerCase();
+    const matches = filter ? profiles.filter((name) => name.toLowerCase().includes(filter)) : profiles;
+    if (matches.length === 0) {
+      console.log(chalk.yellow(`  No profiles match "${filter}". Try again.`));
+      continue;
+    }
+    if (matches.length === 1) {
+      const only = matches[0] ?? "";
+      console.log(chalk.green(`  \u2192 ${only}`));
+      return only;
+    }
+    if (matches.length > MAX_LISTED) {
+      console.log(
+        chalk.yellow(
+          `  ${matches.length} profiles match \u2014 narrow the filter (over ${MAX_LISTED} to list).`
+        )
+      );
+      continue;
+    }
+    const index = await promptChoice({
+      message: chalk.cyan("Select a profile:"),
+      options: matches
+    });
+    return matches[index] ?? "";
+  }
+}
+async function resolveProfile(params) {
+  const explicit = params.profile ?? process.env.AWS_PROFILE;
+  if (explicit) {
+    return explicit;
+  }
+  const interactive = params.interactive ?? Boolean(process.stdin.isTTY);
+  if (!interactive) {
+    return void 0;
+  }
+  const profiles = listConfigProfiles();
+  if (profiles.length === 0) {
+    return void 0;
+  }
+  console.log(
+    chalk.yellow(
+      "\nNo AWS profile selected (--profile and AWS_PROFILE are unset)."
+    )
+  );
+  const chosen = await pickProfileInteractive(profiles);
+  console.log(chalk.gray(`Using profile "${chosen}" for this command.
+`));
+  return chosen;
+}
+
+export {
+  listConfigProfiles,
+  pickProfileInteractive,
+  resolveProfile
+};

package/esm/__chunks/73BJG53F.js

@@ -0,0 +1,11 @@
+// src/commands/aws/schema.js
+import { z } from "zod";
+var profileField = z.string().optional().describe("AWS profile (defaults to the AWS_PROFILE environment variable)");
+var regionField = z.string().optional().describe("AWS region");
+var verboseField = z.boolean().optional().default(false).describe("Enable verbose logging for detailed output and error traces");
+
+export {
+  profileField,
+  regionField,
+  verboseField
+};

package/esm/__chunks/B2DVQ2UL.js

@@ -0,0 +1,61 @@
+// src/commands/aws/ses/smtp-password.js
+import { createHmac } from "crypto";
+var SMTP_REGIONS = /* @__PURE__ */ new Set([
+  "us-east-2",
+  "us-east-1",
+  "us-west-1",
+  "us-west-2",
+  "ap-south-1",
+  "ap-northeast-2",
+  "ap-southeast-1",
+  "ap-southeast-2",
+  "ap-northeast-1",
+  "ca-central-1",
+  "eu-central-1",
+  "eu-west-1",
+  "eu-west-2",
+  "eu-west-3",
+  "eu-south-1",
+  "eu-north-1",
+  "sa-east-1",
+  "us-gov-west-1",
+  "us-gov-east-1",
+  "me-south-1",
+  "af-south-1",
+  "il-central-1"
+]);
+var DATE = "11111111";
+var SERVICE = "ses";
+var MESSAGE = "SendRawEmail";
+var TERMINAL = "aws4_request";
+var VERSION = 4;
+function sign(key, message) {
+  return createHmac("sha256", key).update(message, "utf8").digest();
+}
+function calculateSmtpPassword(params) {
+  const { secretAccessKey, region } = params;
+  if (!SMTP_REGIONS.has(region)) {
+    throw new Error(
+      `calculateSmtpPassword: region "${region}" has no SES SMTP endpoint`
+    );
+  }
+  let signature = sign(Buffer.from(`AWS4${secretAccessKey}`, "utf8"), DATE);
+  signature = sign(signature, region);
+  signature = sign(signature, SERVICE);
+  signature = sign(signature, TERMINAL);
+  signature = sign(signature, MESSAGE);
+  const signatureAndVersion = Buffer.concat([
+    Buffer.from([VERSION]),
+    signature
+  ]);
+  return signatureAndVersion.toString("base64");
+}
+function smtpEndpoint(region) {
+  return `email-smtp.${region}.amazonaws.com`;
+}
+
+export {
+  SMTP_REGIONS,
+  calculateSmtpPassword,
+  smtpEndpoint
+};

package/esm/__chunks/DLEJ25GZ.js

@@ -0,0 +1,121 @@
+// src/commands/db/create-readonly-user/utils.js
+import { randomBytes } from "crypto";
+function generatePassword(params = {}) {
+  const { length = 24 } = params;
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*";
+  const bytes = randomBytes(length);
+  let result = "";
+  for (let i = 0; i < length; i += 1) {
+    const byte = bytes[i] ?? 0;
+    result += alphabet[byte % alphabet.length];
+  }
+  return result;
+}
+function detectEngineFromUrl(url) {
+  const trimmed = url.trim().toLowerCase();
+  if (trimmed.startsWith("postgres://") || trimmed.startsWith("postgresql://")) {
+    return "postgres";
+  }
+  if (trimmed.startsWith("mysql://") || trimmed.startsWith("mysql2://")) {
+    return "mysql";
+  }
+  return null;
+}
+function resolveAdminUrl(params) {
+  const { url, engine } = params;
+  if (url) {
+    return url;
+  }
+  if (engine === "mysql") {
+    return process.env.MYSQL_URL ?? process.env.DATABASE_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
+  }
+  if (engine === "postgres") {
+    return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? null;
+  }
+  return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? process.env.MYSQL_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
+}
+function resolveSsl(params) {
+  const { host, sslOption } = params;
+  if (sslOption === true) {
+    return { rejectUnauthorized: false };
+  }
+  if (sslOption === false) {
+    return false;
+  }
+  const local = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "0.0.0.0";
+  if (local) {
+    return false;
+  }
+  return { rejectUnauthorized: false };
+}
+function parseConnectionUrl(params) {
+  const { url, engine: engineOption, sslOption } = params;
+  const engine = engineOption ?? detectEngineFromUrl(url);
+  if (!engine) {
+    throw new Error(
+      `Could not detect engine from URL. Pass --engine postgres|mysql. URL starts with: ${url.slice(0, 24)}\u2026`
+    );
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid connection URL: ${url}`);
+  }
+  const defaultPort = engine === "postgres" ? 5432 : 3306;
+  const port = parsed.port ? Number.parseInt(parsed.port, 10) : defaultPort;
+  const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")) || (engine === "postgres" ? "postgres" : "");
+  const host = parsed.hostname || "localhost";
+  const user = decodeURIComponent(parsed.username || "");
+  const password = decodeURIComponent(parsed.password || "");
+  if (!user) {
+    throw new Error("Connection URL is missing a username");
+  }
+  return {
+    engine,
+    host,
+    port: Number.isFinite(port) ? port : defaultPort,
+    user,
+    password,
+    database,
+    ssl: resolveSsl({ host, sslOption }),
+    url
+  };
+}
+function buildReadonlyUrl(params) {
+  const { engine, host, port, username, password, database } = params;
+  const scheme = engine === "postgres" ? "postgresql" : "mysql";
+  const auth = `${encodeURIComponent(username)}:${encodeURIComponent(password)}`;
+  const dbPath = database ? `/${encodeURIComponent(database)}` : "/";
+  return `${scheme}://${auth}@${host}:${port}${dbPath}`;
+}
+function quoteIdent(params) {
+  const { engine, name } = params;
+  if (engine === "postgres") {
+    return `"${name.replace(/"/g, '""')}"`;
+  }
+  return `\`${name.replace(/`/g, "``")}\``;
+}
+function quoteLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function isSystemDatabase(params) {
+  const { engine, name } = params;
+  const lower = name.toLowerCase();
+  if (engine === "postgres") {
+    return lower === "template0" || lower === "template1" || lower === "rdsadmin" || lower === "cloudsqladmin";
+  }
+  return lower === "information_schema" || lower === "performance_schema" || lower === "mysql" || lower === "sys" || lower === "innodb" || lower === "#mysql50#lost+found";
+}
+
+export {
+  generatePassword,
+  detectEngineFromUrl,
+  resolveAdminUrl,
+  resolveSsl,
+  parseConnectionUrl,
+  buildReadonlyUrl,
+  quoteIdent,
+  quoteLiteral,
+  isSystemDatabase
+};