@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-dev-20260914234436

package/esm/__chunks/QSE66AKY.js

@@ -0,0 +1,208 @@
+import {
+  allowIpCommand
+} from "./PNPPDYKC.js";
+import {
+  checkAdminCommand
+} from "./S7IJPJ4R.js";
+import {
+  breakGlassCommand
+} from "./VKAKISRG.js";
+import {
+  removeAdminCommand
+} from "./FFKFVMIE.js";
+import {
+  usersCommand
+} from "./JZPBBBIG.js";
+import {
+  setupAclCommand
+} from "./DMYFNF54.js";
+import {
+  removeRecordCommand
+} from "./QKDDLIWD.js";
+import {
+  addRecordCommand
+} from "./G4NJHFFU.js";
+import {
+  sendEmailCommand
+} from "./2FTTEFEK.js";
+
+// src/commands/aws/index.js
+function collect(value, previous) {
+  return [...previous, value];
+}
+function registerAwsCommands(program) {
+  const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
+  const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
+  iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description(
+    "Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users."
+  ).option(
+    "--restrict-regions <yes|no>",
+    "Attach the region restriction to acl-power-users (skips the prompt)"
+  ).option(
+    "--no-create-users",
+    "Skip IAM user creation after configuring groups"
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await setupAclCommand({
+      restrictRegions: options.restrictRegions,
+      createUsers: options.createUsers,
+      profile: options.profile,
+      region: options.region,
+      verbose: options.verbose ?? false
+    });
+  });
+  iam.command("users").summary("Interactively create IAM users and assign ACL groups").description(
+    "Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands."
+  ).option(
+    "--account-name <slug>",
+    "AWS account slug used in md-{identifier}-{account}-{role}"
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await usersCommand({
+      accountName: options.accountName,
+      profile: options.profile,
+      verbose: options.verbose ?? false
+    });
+  });
+  iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description(
+    "Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group."
+  ).option(
+    "-p, --profile <profile>",
+    "Operate on this profile (defaults to AWS_PROFILE)"
+  ).option(
+    "--all",
+    "Scan every aws-vault profile (default when no profile is set)"
+  ).option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+    await checkAdminCommand({
+      profile: options.profile,
+      all: options.all ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+  iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description(
+    "Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all)."
+  ).option(
+    "-p, --profile <profile>",
+    "Operate on this profile (defaults to AWS_PROFILE)"
+  ).option(
+    "--all",
+    "Scan every aws-vault profile (default when no profile is set)"
+  ).option(
+    "--user <name>",
+    "Only remove this user (repeatable); default removes all",
+    collect,
+    []
+  ).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+    await removeAdminCommand({
+      profile: options.profile,
+      all: options.all ?? false,
+      user: options.user ?? [],
+      yes: options.yes ?? false,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+  iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description(
+    "Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "--user <name>",
+    "Grant to this user (repeatable); default is your own IAM user",
+    collect,
+    []
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
+    await breakGlassCommand({
+      profile: options.profile,
+      user: options.user ?? [],
+      yes: options.yes ?? false,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+  const ec2 = aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands");
+  ec2.command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description(
+    "Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option(
+    "--rule-name <name>",
+    'SSH rule description (default: "{FirstName} Roaming")'
+  ).option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await allowIpCommand({
+      profile: options.profile,
+      region: options.region,
+      ruleName: options.ruleName,
+      verbose: options.verbose ?? false
+    });
+  });
+  const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
+  route53.command("add-record").summary("Interactively add or update a DNS record").description(
+    "Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "-z, --zone <name-or-id>",
+    "Hosted zone name or ID (e.g. mountaindev.com)"
+  ).option(
+    "-t, --type <type>",
+    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
+  ).option(
+    "-n, --name <name>",
+    'Record name relative to the zone (e.g. "redline") or FQDN'
+  ).option("--value <value>", "Record value (e.g. CNAME target)").option(
+    "--ttl <seconds>",
+    "TTL in seconds (default: 300)",
+    (value) => Number.parseInt(value, 10)
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await addRecordCommand({
+      profile: options.profile,
+      zone: options.zone,
+      type: options.type,
+      name: options.name,
+      value: options.value,
+      ttl: options.ttl,
+      yes: options.yes ?? false,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+  route53.command("remove-record").summary("Interactively delete a DNS record").description(
+    "Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "-z, --zone <name-or-id>",
+    "Hosted zone name or ID (e.g. mountaindev.com)"
+  ).option(
+    "-t, --type <type>",
+    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
+  ).option(
+    "-n, --name <name>",
+    'Record name relative to the zone (e.g. "redline") or FQDN'
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await removeRecordCommand({
+      profile: options.profile,
+      zone: options.zone,
+      type: options.type,
+      name: options.name,
+      yes: options.yes ?? false,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+  const ses = aws.command("ses").summary("SES operational commands").description("SES operational commands");
+  ses.command("send-email").summary("Send a test email via SES (API or SMTP)").description(
+    "Send a single test email through the SES API (default) or the SES SMTP endpoint."
+  ).requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option(
+    "--access-key-id <id>",
+    "IAM access key ID used as the SMTP username (smtp transport)"
+  ).option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await sendEmailCommand({
+      to: options.to,
+      from: options.from,
+      subject: options.subject,
+      body: options.body,
+      transport: options.transport,
+      region: options.region,
+      profile: options.profile,
+      accessKeyId: options.accessKeyId,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+}
+
+export {
+  registerAwsCommands
+};

package/esm/__chunks/QUF7PS4R.js

@@ -0,0 +1,18 @@
+import {
+  profileField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/iam/check-admin/schema.js
+import { z } from "zod";
+var checkAdminOptionsSchema = z.object({
+  profile: profileField,
+  all: z.boolean().optional().default(false).describe(
+    "Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"
+  ),
+  verbose: verboseField
+});
+
+export {
+  checkAdminOptionsSchema
+};

package/esm/__chunks/S7IJPJ4R.js

@@ -0,0 +1,126 @@
+import {
+  checkAdminOptionsSchema
+} from "./QUF7PS4R.js";
+import {
+  ADMIN_GROUP_NAME,
+  resolveAdminScanProfiles,
+  resolveProfileScan
+} from "./NF3M2L6C.js";
+import {
+  requireCommands
+} from "./FNXUONAV.js";
+
+// src/commands/aws/iam/check-admin/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function checkAdminCommand(options) {
+  try {
+    const { profile, all, verbose } = checkAdminOptionsSchema.parse(options);
+    requireCommands(["aws"]);
+    const needsVault = all || !(profile ?? process.env.AWS_PROFILE);
+    if (needsVault) {
+      requireCommands(["aws-vault"]);
+    }
+    let profiles;
+    try {
+      profiles = resolveAdminScanProfiles({ profile, all });
+    } catch (resolveError) {
+      if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
+        console.error(chalk.red(resolveError.message));
+        process.exit(1);
+      }
+      throw resolveError;
+    }
+    console.log(
+      chalk.blue(
+        `
+==> Checking ${profiles.length} profile(s) for ${ADMIN_GROUP_NAME}
+`
+      )
+    );
+    let ok = 0;
+    let alert = 0;
+    let skip = 0;
+    for (const candidate of profiles) {
+      const scan = resolveProfileScan({ profile: candidate, verbose });
+      if (!scan) {
+        skip += 1;
+        continue;
+      }
+      if (scan.users.length === 0) {
+        console.log(
+          chalk.green(
+            `OK     ${candidate} (${scan.accountId}) \u2014 ${ADMIN_GROUP_NAME}: 0 users`
+          )
+        );
+        ok += 1;
+      } else {
+        console.log(
+          chalk.red(
+            `ALERT  ${candidate} (${scan.accountId}) \u2014 ${ADMIN_GROUP_NAME}: ${scan.users.length} user(s): ${scan.users.join(", ")}`
+          )
+        );
+        alert += 1;
+      }
+    }
+    console.log(chalk.blue("\n==> Summary"));
+    console.log(`  Profiles scanned:  ${profiles.length}`);
+    console.log(`  OK (empty group):  ${ok}`);
+    console.log(`  ALERT (has users): ${alert}`);
+    console.log(`  Skipped (silent):  ${skip}`);
+    if (alert > 0) {
+      console.log(
+        chalk.red(
+          `
+Remove users from ${ADMIN_GROUP_NAME} when break-glass access is no longer needed.`
+        )
+      );
+      process.exit(1);
+    }
+    if (ok === 0) {
+      console.log(
+        chalk.yellow(
+          `
+No profiles returned IAM access for ${ADMIN_GROUP_NAME}.`
+        )
+      );
+      console.log(
+        chalk.yellow(
+          "  Use a profile with iam:GetGroup (e.g. md-*-iam-admin) or run with --verbose."
+        )
+      );
+    }
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C check-admin failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI, and aws-vault when scanning multiple profiles.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  checkAdminCommand
+};

package/esm/__chunks/SD3E3EPH.js

@@ -0,0 +1,163 @@
+import {
+  isSystemDatabase,
+  quoteIdent,
+  quoteLiteral
+} from "./DLEJ25GZ.js";
+
+// src/commands/db/create-readonly-user/postgres.js
+import pg from "pg";
+var { Client } = pg;
+function createClient(config, database) {
+  return new Client({
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: database ?? (config.database || "postgres"),
+    ssl: config.ssl
+  });
+}
+async function query(client, sql, params) {
+  return client.query(sql, params);
+}
+async function listPostgresDatabases(config) {
+  const client = createClient(config, config.database || "postgres");
+  await client.connect();
+  try {
+    const result = await query(
+      client,
+      `SELECT datname
+       FROM pg_database
+       WHERE datistemplate = false
+       ORDER BY datname`
+    );
+    return result.rows.map((row) => row.datname).filter((name) => !isSystemDatabase({ engine: "postgres", name }));
+  } finally {
+    await client.end();
+  }
+}
+async function ensureRole(client, params) {
+  const { username, password } = params;
+  const ident = quoteIdent({ engine: "postgres", name: username });
+  const passwordLiteral = quoteLiteral(password);
+  const existing = await query(
+    client,
+    "SELECT 1 FROM pg_roles WHERE rolname = $1",
+    [username]
+  );
+  const statements = [];
+  if (existing.rowCount && existing.rowCount > 0) {
+    const sql2 = `ALTER ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+    statements.push(sql2);
+    await query(client, sql2);
+    return { created: false, statements };
+  }
+  const sql = `CREATE ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+  statements.push(sql);
+  await query(client, sql);
+  return { created: true, statements };
+}
+async function grantReadonlyInDatabase(client, params) {
+  const { username } = params;
+  const ident = quoteIdent({ engine: "postgres", name: username });
+  const statements = [];
+  const schemasResult = await query(
+    client,
+    `SELECT nspname
+     FROM pg_namespace
+     WHERE nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+       AND nspname NOT LIKE 'pg_temp_%'
+       AND nspname NOT LIKE 'pg_toast_temp_%'
+     ORDER BY nspname`
+  );
+  const schemas = schemasResult.rows.map(
+    (row) => row.nspname
+  );
+  if (schemas.length === 0) {
+    schemas.push("public");
+  }
+  for (const schema of schemas) {
+    const schemaIdent = quoteIdent({ engine: "postgres", name: schema });
+    const grants = [
+      `GRANT USAGE ON SCHEMA ${schemaIdent} TO ${ident}`,
+      `GRANT SELECT ON ALL TABLES IN SCHEMA ${schemaIdent} TO ${ident}`,
+      `GRANT SELECT ON ALL SEQUENCES IN SCHEMA ${schemaIdent} TO ${ident}`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON TABLES TO ${ident}`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON SEQUENCES TO ${ident}`
+    ];
+    for (const sql of grants) {
+      statements.push(sql);
+      await query(client, sql);
+    }
+  }
+  return statements;
+}
+async function applyPostgresReadonly(params) {
+  const {
+    config,
+    username,
+    password,
+    databases,
+    dryRun = false,
+    verbose = false
+  } = params;
+  const statements = [];
+  let created = false;
+  if (dryRun) {
+    const ident = quoteIdent({ engine: "postgres", name: username });
+    statements.push(
+      `-- Would CREATE/ALTER ROLE ${ident} WITH LOGIN PASSWORD ***`
+    );
+    for (const database of databases) {
+      const dbIdent = quoteIdent({ engine: "postgres", name: database });
+      statements.push(`GRANT CONNECT ON DATABASE ${dbIdent} TO ${ident}`);
+      statements.push(
+        `-- In database ${database}: GRANT USAGE/SELECT on all user schemas + ALTER DEFAULT PRIVILEGES`
+      );
+    }
+    return { created: true, statements, databases };
+  }
+  const adminDb = config.database || "postgres";
+  const adminClient = createClient(config, adminDb);
+  await adminClient.connect();
+  try {
+    if (verbose) {
+      console.log(
+        `   Connected to Postgres as ${config.user}@${config.host}/${adminDb}`
+      );
+    }
+    const roleResult = await ensureRole(adminClient, { username, password });
+    created = roleResult.created;
+    statements.push(...roleResult.statements);
+    const ident = quoteIdent({ engine: "postgres", name: username });
+    for (const database of databases) {
+      const dbIdent = quoteIdent({ engine: "postgres", name: database });
+      const connectSql = `GRANT CONNECT ON DATABASE ${dbIdent} TO ${ident}`;
+      statements.push(connectSql);
+      await query(adminClient, connectSql);
+    }
+  } finally {
+    await adminClient.end();
+  }
+  for (const database of databases) {
+    const dbClient = createClient(config, database);
+    await dbClient.connect();
+    try {
+      if (verbose) {
+        console.log(`   Granting read-only in database ${database}`);
+      }
+      const dbStatements = await grantReadonlyInDatabase(dbClient, {
+        username
+      });
+      statements.push(...dbStatements);
+    } finally {
+      await dbClient.end();
+    }
+  }
+  return { created, statements, databases };
+}
+
+export {
+  listPostgresDatabases,
+  applyPostgresReadonly
+};

package/esm/__chunks/T3TTUHTW.js

@@ -0,0 +1,30 @@
+// src/commands/db/create-readonly-user/schema.js
+import { z } from "zod";
+var ENGINES = ["postgres", "mysql"];
+var createReadonlyUserOptionsSchema = z.object({
+  engine: z.enum(["postgres", "mysql"]).optional().describe(
+    "Database engine (postgres or mysql); inferred from --url when omitted"
+  ),
+  url: z.string().optional().describe(
+    "Admin connection URL (postgres://\u2026 or mysql://\u2026). Defaults to DATABASE_URL / MYSQL_URL / POSTGRES_URL."
+  ),
+  database: z.string().optional().describe('Target database name, or "all" for every non-system database'),
+  username: z.string().optional().describe("Read-only username to create (default: readonly)"),
+  password: z.string().optional().describe("Password for the new user (generated when omitted)"),
+  hostPattern: z.string().optional().describe("MySQL user host pattern (default: %)"),
+  ssl: z.boolean().optional().describe(
+    "Force SSL on/off. Default: off for localhost, on (loose) for remote hosts."
+  ),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+  dryRun: z.boolean().optional().default(false).describe("Print the SQL plan without applying it"),
+  verbose: z.boolean().optional().default(false).describe("Enable verbose logging")
+});
+var DEFAULT_READONLY_USERNAME = "readonly";
+var DEFAULT_MYSQL_HOST_PATTERN = "%";
+
+export {
+  ENGINES,
+  createReadonlyUserOptionsSchema,
+  DEFAULT_READONLY_USERNAME,
+  DEFAULT_MYSQL_HOST_PATTERN
+};