@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-dev-20260914234436

package/esm/__chunks/ZHKVJO2U.js

@@ -0,0 +1,47 @@
+// src/commands/aws/utils/tty.js
+import { createInterface } from "readline";
+function prompt(message) {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(message, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+async function promptChoice(params) {
+  const { message, options } = params;
+  if (options.length === 0) {
+    throw new Error("promptChoice: no options to choose from");
+  }
+  console.log(message);
+  options.forEach((option, index) => {
+    console.log(`  ${index + 1}. ${option}`);
+  });
+  for (; ; ) {
+    const raw = await prompt("Enter number: ");
+    const choice = Number.parseInt(raw, 10);
+    if (Number.isInteger(choice) && choice >= 1 && choice <= options.length) {
+      return choice - 1;
+    }
+    console.log(`Please enter a number between 1 and ${options.length}.`);
+  }
+}
+async function promptYesNo(params) {
+  const { message, defaultYes = false } = params;
+  const suffix = defaultYes ? " [Y/n]: " : " [y/N]: ";
+  const answer = (await prompt(`${message}${suffix}`)).toLowerCase();
+  if (answer === "") {
+    return defaultYes;
+  }
+  return answer === "y" || answer === "yes";
+}
+
+export {
+  prompt,
+  promptChoice,
+  promptYesNo
+};

package/esm/__chunks/ZO55YUSY.js

@@ -0,0 +1,9 @@
+// src/commands/aws/utils/resolve-policy-path.js
+import { fileURLToPath } from "url";
+function resolvePolicyPath(fileName) {
+  return fileURLToPath(new URL(`../iam/policies/${fileName}`, import.meta.url));
+}
+
+export {
+  resolvePolicyPath
+};

package/esm/commands/aws/ec2/allow-ip/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws ec2 allow-ip` handler: update or create a named roaming SSH rule for the
+ * caller's current public IP on a chosen EC2 instance's security group.
+ * @param {unknown} options
+ */
+export function allowIpCommand(options: unknown): Promise<void>;

package/esm/commands/aws/ec2/allow-ip/handler.js

@@ -0,0 +1,12 @@
+import {
+  allowIpCommand
+} from "../../../../__chunks/PNPPDYKC.js";
+import "../../../../__chunks/U7HAE2RF.js";
+import "../../../../__chunks/J34UVKLA.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  allowIpCommand
+};

package/esm/commands/aws/ec2/allow-ip/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/esm/commands/aws/ec2/allow-ip/index.js

@@ -0,0 +1,55 @@
+import "../../../../__chunks/AEDEAYF5.js";
+import {
+  allowIpCommand
+} from "../../../../__chunks/PNPPDYKC.js";
+import {
+  authorizeRule,
+  describeSecurityGroups,
+  extractRoamingFirstName,
+  getCurrentPublicIp,
+  getSecurityGroupDetails,
+  instanceLabel,
+  listEnabledRegions,
+  listInstances,
+  listSshIngressRules,
+  printSshRules,
+  resolveRoamingRule,
+  revokeRule,
+  roamingRuleDescription,
+  ruleAlreadyAllowsIp,
+  securityGroupLabel,
+  sshRuleLabel
+} from "../../../../__chunks/U7HAE2RF.js";
+import {
+  DEFAULT_REGION,
+  DEFAULT_ROAMING_NAME,
+  SSH_PORT,
+  allowIpOptionsSchema
+} from "../../../../__chunks/J34UVKLA.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  DEFAULT_REGION,
+  DEFAULT_ROAMING_NAME,
+  SSH_PORT,
+  allowIpCommand,
+  allowIpOptionsSchema,
+  authorizeRule,
+  describeSecurityGroups,
+  extractRoamingFirstName,
+  getCurrentPublicIp,
+  getSecurityGroupDetails,
+  instanceLabel,
+  listEnabledRegions,
+  listInstances,
+  listSshIngressRules,
+  printSshRules,
+  resolveRoamingRule,
+  revokeRule,
+  roamingRuleDescription,
+  ruleAlreadyAllowsIp,
+  securityGroupLabel,
+  sshRuleLabel
+};

package/esm/commands/aws/ec2/allow-ip/schema.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Default region checked first before prompting.
+ */
+export const DEFAULT_REGION: "us-east-1";
+/**
+ * SSH port managed by this command.
+ */
+export const SSH_PORT: 22;
+/**
+ * Fallback first name when one cannot be derived from the profile/IAM user.
+ */
+export const DEFAULT_ROAMING_NAME: "Declan";
+/**
+ * Zod schema for `aws ec2 allow-ip` options.
+ */
+export const allowIpOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    ruleName: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    profile?: string | undefined;
+    region?: string | undefined;
+    ruleName?: string | undefined;
+}, {
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    ruleName?: string | undefined;
+}>;
+export type AllowIpOptions = z.infer<typeof allowIpOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/ec2/allow-ip/schema.js

@@ -0,0 +1,13 @@
+import {
+  DEFAULT_REGION,
+  DEFAULT_ROAMING_NAME,
+  SSH_PORT,
+  allowIpOptionsSchema
+} from "../../../../__chunks/J34UVKLA.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  DEFAULT_REGION,
+  DEFAULT_ROAMING_NAME,
+  SSH_PORT,
+  allowIpOptionsSchema
+};

package/esm/commands/aws/ec2/allow-ip/utils.d.ts

@@ -0,0 +1,189 @@
+/**
+ * @typedef {Object} Ec2Instance
+ * @property {string} instanceId
+ * @property {string} name
+ * @property {string} state
+ * @property {string} instanceType
+ * @property {string | null} publicIp
+ * @property {string[]} securityGroupIds
+ */
+/**
+ * @typedef {Object} SecurityGroup
+ * @property {string} groupId
+ * @property {string} groupName
+ * @property {string} description
+ */
+/**
+ * @typedef {Object} SshIngressRule
+ * @property {string} cidrIp
+ * @property {string} description
+ * @property {number} fromPort
+ * @property {number} toPort
+ * @property {string} ipProtocol
+ */
+/**
+ * Determine the caller's current public IPv4 address.
+ * @returns {Promise<string>}
+ */
+export function getCurrentPublicIp(): Promise<string>;
+/**
+ * List regions that are opted-in / enabled for the profile.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {string[]}
+ */
+export function listEnabledRegions(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): string[];
+/**
+ * List non-terminated EC2 instances in a region.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {Ec2Instance[]}
+ */
+export function listInstances(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): Ec2Instance[];
+/**
+ * Describe security groups by id.
+ * @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+ * @returns {SecurityGroup[]}
+ */
+export function describeSecurityGroups(params: {
+    profile?: string;
+    region: string;
+    groupIds: string[];
+    verbose?: boolean;
+}): SecurityGroup[];
+/**
+ * Load full details for a single security group.
+ * @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+ * @returns {any | null}
+ */
+export function getSecurityGroupDetails(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    verbose?: boolean;
+}): any | null;
+/**
+ * Extract single-host SSH ingress rules (port 22, /32) from a security group.
+ * @param {any} securityGroup
+ * @returns {SshIngressRule[]}
+ */
+export function listSshIngressRules(securityGroup: any): SshIngressRule[];
+/**
+ * Derive a first name from the IAM ARN or profile (md-{name}-...).
+ * @param {{ profile?: string; identity: { Arn?: string } }} params
+ * @returns {string}
+ */
+export function extractRoamingFirstName(params: {
+    profile?: string;
+    identity: {
+        Arn?: string;
+    };
+}): string;
+/**
+ * @param {string} firstName
+ * @returns {string}
+ */
+export function roamingRuleDescription(firstName: string): string;
+/**
+ * Find an existing rule whose description matches the roaming rule name.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} ruleDescription
+ * @returns {SshIngressRule | null}
+ */
+export function resolveRoamingRule(sshRules: SshIngressRule[], ruleDescription: string): SshIngressRule | null;
+/**
+ * Find an existing rule that already allows the given CIDR.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} newCidr
+ * @returns {SshIngressRule | null}
+ */
+export function ruleAlreadyAllowsIp(sshRules: SshIngressRule[], newCidr: string): SshIngressRule | null;
+/**
+ * Authorize a new SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   cidrIp: string;
+ *   description: string;
+ *   fromPort?: number;
+ *   toPort?: number;
+ *   ipProtocol?: string;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function authorizeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    cidrIp: string;
+    description: string;
+    fromPort?: number;
+    toPort?: number;
+    ipProtocol?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Revoke an existing SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   rule: SshIngressRule;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function revokeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    rule: SshIngressRule;
+    verbose?: boolean;
+}): void;
+/**
+ * @param {Ec2Instance} instance
+ * @returns {string}
+ */
+export function instanceLabel(instance: Ec2Instance): string;
+/**
+ * @param {SecurityGroup} group
+ * @returns {string}
+ */
+export function securityGroupLabel(group: SecurityGroup): string;
+/**
+ * @param {SshIngressRule} rule
+ * @returns {string}
+ */
+export function sshRuleLabel(rule: SshIngressRule): string;
+/**
+ * Print single-host SSH rules using the given logger.
+ * @param {SshIngressRule[]} sshRules
+ * @param {(message: string) => void} [log]
+ */
+export function printSshRules(sshRules: SshIngressRule[], log?: (message: string) => void): void;
+export type Ec2Instance = {
+    instanceId: string;
+    name: string;
+    state: string;
+    instanceType: string;
+    publicIp: string | null;
+    securityGroupIds: string[];
+};
+export type SecurityGroup = {
+    groupId: string;
+    groupName: string;
+    description: string;
+};
+export type SshIngressRule = {
+    cidrIp: string;
+    description: string;
+    fromPort: number;
+    toPort: number;
+    ipProtocol: string;
+};

package/esm/commands/aws/ec2/allow-ip/utils.js

@@ -0,0 +1,39 @@
+import {
+  authorizeRule,
+  describeSecurityGroups,
+  extractRoamingFirstName,
+  getCurrentPublicIp,
+  getSecurityGroupDetails,
+  instanceLabel,
+  listEnabledRegions,
+  listInstances,
+  listSshIngressRules,
+  printSshRules,
+  resolveRoamingRule,
+  revokeRule,
+  roamingRuleDescription,
+  ruleAlreadyAllowsIp,
+  securityGroupLabel,
+  sshRuleLabel
+} from "../../../../__chunks/U7HAE2RF.js";
+import "../../../../__chunks/J34UVKLA.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  authorizeRule,
+  describeSecurityGroups,
+  extractRoamingFirstName,
+  getCurrentPublicIp,
+  getSecurityGroupDetails,
+  instanceLabel,
+  listEnabledRegions,
+  listInstances,
+  listSshIngressRules,
+  printSshRules,
+  resolveRoamingRule,
+  revokeRule,
+  roamingRuleDescription,
+  ruleAlreadyAllowsIp,
+  securityGroupLabel,
+  sshRuleLabel
+};

package/esm/commands/aws/iam/admin-group.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ * @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+ */
+/**
+ * List aws-vault profiles that have stored credentials.
+ * @returns {string[]}
+ */
+export function listVaultProfiles(): string[];
+/**
+ * Resolve which profiles to scan for admin-group commands.
+ * Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+ * @param {{ profile?: string; all?: boolean }} params
+ * @returns {string[]}
+ */
+export function resolveAdminScanProfiles({ profile, all }: {
+    profile?: string;
+    all?: boolean;
+}): string[];
+/**
+ * @param {{ Users?: Array<{ UserName: string }> }} group
+ * @returns {string[]}
+ */
+export function groupUserNames(group: {
+    Users?: Array<{
+        UserName: string;
+    }>;
+}): string[];
+/**
+ * Resolve a working credential runner for a profile and read the admin group.
+ * Tries stored credentials first, then falls back to `aws-vault exec`.
+ * The returned `run` reuses whichever mode worked, so callers can perform
+ * follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+ * @param {{ profile: string; verbose?: boolean }} params
+ * @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+ */
+export function resolveProfileScan(params: {
+    profile: string;
+    verbose?: boolean;
+}): {
+    accountId: string;
+    arn: string;
+    users: string[];
+    run: ProfileRunner;
+} | null;
+/**
+ * The IAM group that grants break-glass admin access and should normally be empty.
+ */
+export const ADMIN_GROUP_NAME: "acl-admin-do-not-use";
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ */
+export type ProfileRunner = (args: string[], options?: {
+    expectJson?: boolean;
+}) => any;

package/esm/commands/aws/iam/admin-group.js

@@ -0,0 +1,15 @@
+import {
+  ADMIN_GROUP_NAME,
+  groupUserNames,
+  listVaultProfiles,
+  resolveAdminScanProfiles,
+  resolveProfileScan
+} from "../../../__chunks/NF3M2L6C.js";
+import "../../../__chunks/FNXUONAV.js";
+export {
+  ADMIN_GROUP_NAME,
+  groupUserNames,
+  listVaultProfiles,
+  resolveAdminScanProfiles,
+  resolveProfileScan
+};

package/esm/commands/aws/iam/break-glass/handler.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `aws iam break-glass` handler: grant break-glass admin access by adding a user
+ * to the acl-admin-do-not-use group for a single profile. Defaults to the
+ * caller's own IAM user when no --user is given.
+ * @param {unknown} options
+ */
+export function breakGlassCommand(options: unknown): Promise<void>;

package/esm/commands/aws/iam/break-glass/handler.js

@@ -0,0 +1,12 @@
+import {
+  breakGlassCommand
+} from "../../../../__chunks/VKAKISRG.js";
+import "../../../../__chunks/EMSH4P76.js";
+import "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  breakGlassCommand
+};

package/esm/commands/aws/iam/break-glass/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/esm/commands/aws/iam/break-glass/index.js

@@ -0,0 +1,19 @@
+import "../../../../__chunks/TIOVE6HR.js";
+import {
+  breakGlassCommand
+} from "../../../../__chunks/VKAKISRG.js";
+import {
+  breakGlassOptionsSchema
+} from "../../../../__chunks/EMSH4P76.js";
+import {
+  ADMIN_GROUP_NAME
+} from "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/5GIUAFXL.js";
+import "../../../../__chunks/73BJG53F.js";
+import "../../../../__chunks/ZHKVJO2U.js";
+export {
+  ADMIN_GROUP_NAME,
+  breakGlassCommand,
+  breakGlassOptionsSchema
+};

package/esm/commands/aws/iam/break-glass/schema.d.ts

@@ -0,0 +1,25 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam break-glass` options.
+ */
+export const breakGlassOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    user: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    user: string[];
+    dryRun: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    user?: string[] | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type BreakGlassOptions = z.infer<typeof breakGlassOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/iam/break-glass/schema.js

@@ -0,0 +1,12 @@
+import {
+  breakGlassOptionsSchema
+} from "../../../../__chunks/EMSH4P76.js";
+import {
+  ADMIN_GROUP_NAME
+} from "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  ADMIN_GROUP_NAME,
+  breakGlassOptionsSchema
+};

package/esm/commands/aws/iam/check-admin/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `aws iam check-admin` handler: alert if anyone is a member of acl-admin-do-not-use.
+ * @param {unknown} options
+ */
+export function checkAdminCommand(options: unknown): Promise<void>;

package/esm/commands/aws/iam/check-admin/handler.js

@@ -0,0 +1,10 @@
+import {
+  checkAdminCommand
+} from "../../../../__chunks/S7IJPJ4R.js";
+import "../../../../__chunks/QUF7PS4R.js";
+import "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  checkAdminCommand
+};

package/esm/commands/aws/iam/check-admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/esm/commands/aws/iam/check-admin/index.js

@@ -0,0 +1,17 @@
+import "../../../../__chunks/5ZBVGSOK.js";
+import {
+  checkAdminCommand
+} from "../../../../__chunks/S7IJPJ4R.js";
+import {
+  checkAdminOptionsSchema
+} from "../../../../__chunks/QUF7PS4R.js";
+import {
+  ADMIN_GROUP_NAME
+} from "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  ADMIN_GROUP_NAME,
+  checkAdminCommand,
+  checkAdminOptionsSchema
+};

package/esm/commands/aws/iam/check-admin/schema.d.ts

@@ -0,0 +1,19 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam check-admin` options.
+ */
+export const checkAdminOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    all: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    all: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    all?: boolean | undefined;
+}>;
+export type CheckAdminOptions = z.infer<typeof checkAdminOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/iam/check-admin/schema.js

@@ -0,0 +1,12 @@
+import {
+  checkAdminOptionsSchema
+} from "../../../../__chunks/QUF7PS4R.js";
+import {
+  ADMIN_GROUP_NAME
+} from "../../../../__chunks/NF3M2L6C.js";
+import "../../../../__chunks/FNXUONAV.js";
+import "../../../../__chunks/73BJG53F.js";
+export {
+  ADMIN_GROUP_NAME,
+  checkAdminOptionsSchema
+};

package/esm/commands/aws/iam/policies/s3-restrictions-deny-non-s3-services.js

@@ -0,0 +1,28 @@
+// src/commands/aws/iam/policies/s3-restrictions-deny-non-s3-services.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "DenyNonS3Services",
+    Effect: "Deny",
+    NotAction: [
+      "s3:*",
+      "logs:*",
+      "sts:AssumeRole",
+      "iam:PassRole",
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:DescribeKey",
+      "lambda:InvokeFunction"
+    ],
+    Resource: "*"
+  }
+];
+var s3_restrictions_deny_non_s3_services_default = {
+  Version,
+  Statement
+};
+export {
+  Statement,
+  Version,
+  s3_restrictions_deny_non_s3_services_default as default
+};