@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-dev-20260914234436

package/cjs/__chunks/NLKJIUEX.cjs

@@ -0,0 +1,126 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _X26XY2N6cjs = require('./X26XY2N6.cjs');
+
+
+
+
+var _T2A7TN4Fcjs = require('./T2A7TN4F.cjs');
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+// src/commands/aws/iam/check-admin/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function checkAdminCommand(options) {
+  try {
+    const { profile, all, verbose } = _X26XY2N6cjs.checkAdminOptionsSchema.parse(options);
+    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
+    const needsVault = all || !(_nullishCoalesce(profile, () => ( process.env.AWS_PROFILE)));
+    if (needsVault) {
+      _R3GUC7O7cjs.requireCommands.call(void 0, ["aws-vault"]);
+    }
+    let profiles;
+    try {
+      profiles = _T2A7TN4Fcjs.resolveAdminScanProfiles.call(void 0, { profile, all });
+    } catch (resolveError) {
+      if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
+        console.error(_chalk2.default.red(resolveError.message));
+        process.exit(1);
+      }
+      throw resolveError;
+    }
+    console.log(
+      _chalk2.default.blue(
+        `
+==> Checking ${profiles.length} profile(s) for ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}
+`
+      )
+    );
+    let ok = 0;
+    let alert = 0;
+    let skip = 0;
+    for (const candidate of profiles) {
+      const scan = _T2A7TN4Fcjs.resolveProfileScan.call(void 0, { profile: candidate, verbose });
+      if (!scan) {
+        skip += 1;
+        continue;
+      }
+      if (scan.users.length === 0) {
+        console.log(
+          _chalk2.default.green(
+            `OK     ${candidate} (${scan.accountId}) \u2014 ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}: 0 users`
+          )
+        );
+        ok += 1;
+      } else {
+        console.log(
+          _chalk2.default.red(
+            `ALERT  ${candidate} (${scan.accountId}) \u2014 ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}: ${scan.users.length} user(s): ${scan.users.join(", ")}`
+          )
+        );
+        alert += 1;
+      }
+    }
+    console.log(_chalk2.default.blue("\n==> Summary"));
+    console.log(`  Profiles scanned:  ${profiles.length}`);
+    console.log(`  OK (empty group):  ${ok}`);
+    console.log(`  ALERT (has users): ${alert}`);
+    console.log(`  Skipped (silent):  ${skip}`);
+    if (alert > 0) {
+      console.log(
+        _chalk2.default.red(
+          `
+Remove users from ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME} when break-glass access is no longer needed.`
+        )
+      );
+      process.exit(1);
+    }
+    if (ok === 0) {
+      console.log(
+        _chalk2.default.yellow(
+          `
+No profiles returned IAM access for ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}.`
+        )
+      );
+      console.log(
+        _chalk2.default.yellow(
+          "  Use a profile with iam:GetGroup (e.g. md-*-iam-admin) or run with --verbose."
+        )
+      );
+    }
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C check-admin failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI, and aws-vault when scanning multiple profiles.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.checkAdminCommand = checkAdminCommand;

package/cjs/__chunks/NT2XXAI6.cjs

@@ -0,0 +1,89 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/aws/utils/resolve-profile.js
+var _fs = require('fs');
+var _os = require('os');
+var _path = require('path');
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var MAX_LISTED = 30;
+function listConfigProfiles() {
+  const configPath = _nullishCoalesce(process.env.AWS_CONFIG_FILE, () => ( _path.join.call(void 0, _os.homedir.call(void 0, ), ".aws", "config")));
+  let contents;
+  try {
+    contents = _fs.readFileSync.call(void 0, configPath, "utf-8");
+  } catch (e) {
+    return [];
+  }
+  const profiles = [];
+  const profileRe = /^\[profile\s+(.+?)\]$/;
+  for (const rawLine of contents.split("\n")) {
+    const line = rawLine.trim();
+    const match = profileRe.exec(line);
+    if (_optionalChain([match, 'optionalAccess', _ => _[1]])) {
+      profiles.push(match[1].trim());
+    } else if (line === "[default]") {
+      profiles.push("default");
+    }
+  }
+  return profiles;
+}
+async function pickProfileInteractive(profiles) {
+  for (; ; ) {
+    const filter = (await _CMUD7LLNcjs.prompt.call(void 0, _chalk2.default.cyan("Filter profiles (substring, Enter for all): "))).trim().toLowerCase();
+    const matches = filter ? profiles.filter((name) => name.toLowerCase().includes(filter)) : profiles;
+    if (matches.length === 0) {
+      console.log(_chalk2.default.yellow(`  No profiles match "${filter}". Try again.`));
+      continue;
+    }
+    if (matches.length === 1) {
+      const only = _nullishCoalesce(matches[0], () => ( ""));
+      console.log(_chalk2.default.green(`  \u2192 ${only}`));
+      return only;
+    }
+    if (matches.length > MAX_LISTED) {
+      console.log(
+        _chalk2.default.yellow(
+          `  ${matches.length} profiles match \u2014 narrow the filter (over ${MAX_LISTED} to list).`
+        )
+      );
+      continue;
+    }
+    const index = await _CMUD7LLNcjs.promptChoice.call(void 0, {
+      message: _chalk2.default.cyan("Select a profile:"),
+      options: matches
+    });
+    return _nullishCoalesce(matches[index], () => ( ""));
+  }
+}
+async function resolveProfile(params) {
+  const explicit = _nullishCoalesce(params.profile, () => ( process.env.AWS_PROFILE));
+  if (explicit) {
+    return explicit;
+  }
+  const interactive = _nullishCoalesce(params.interactive, () => ( Boolean(process.stdin.isTTY)));
+  if (!interactive) {
+    return void 0;
+  }
+  const profiles = listConfigProfiles();
+  if (profiles.length === 0) {
+    return void 0;
+  }
+  console.log(
+    _chalk2.default.yellow(
+      "\nNo AWS profile selected (--profile and AWS_PROFILE are unset)."
+    )
+  );
+  const chosen = await pickProfileInteractive(profiles);
+  console.log(_chalk2.default.gray(`Using profile "${chosen}" for this command.
+`));
+  return chosen;
+}
+
+
+
+
+
+exports.listConfigProfiles = listConfigProfiles; exports.pickProfileInteractive = pickProfileInteractive; exports.resolveProfile = resolveProfile;

package/cjs/__chunks/NWZGFHKH.cjs

@@ -0,0 +1,121 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/commands/db/create-readonly-user/utils.js
+var _crypto = require('crypto');
+function generatePassword(params = {}) {
+  const { length = 24 } = params;
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*";
+  const bytes = _crypto.randomBytes.call(void 0, length);
+  let result = "";
+  for (let i = 0; i < length; i += 1) {
+    const byte = _nullishCoalesce(bytes[i], () => ( 0));
+    result += alphabet[byte % alphabet.length];
+  }
+  return result;
+}
+function detectEngineFromUrl(url) {
+  const trimmed = url.trim().toLowerCase();
+  if (trimmed.startsWith("postgres://") || trimmed.startsWith("postgresql://")) {
+    return "postgres";
+  }
+  if (trimmed.startsWith("mysql://") || trimmed.startsWith("mysql2://")) {
+    return "mysql";
+  }
+  return null;
+}
+function resolveAdminUrl(params) {
+  const { url, engine } = params;
+  if (url) {
+    return url;
+  }
+  if (engine === "mysql") {
+    return _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(process.env.MYSQL_URL, () => ( process.env.DATABASE_URL)), () => ( process.env.MYSQL_DATABASE_URL)), () => ( null));
+  }
+  if (engine === "postgres") {
+    return _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(process.env.DATABASE_URL, () => ( process.env.POSTGRES_URL)), () => ( process.env.POSTGRESQL_URL)), () => ( null));
+  }
+  return _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(process.env.DATABASE_URL, () => ( process.env.POSTGRES_URL)), () => ( process.env.POSTGRESQL_URL)), () => ( process.env.MYSQL_URL)), () => ( process.env.MYSQL_DATABASE_URL)), () => ( null));
+}
+function resolveSsl(params) {
+  const { host, sslOption } = params;
+  if (sslOption === true) {
+    return { rejectUnauthorized: false };
+  }
+  if (sslOption === false) {
+    return false;
+  }
+  const local = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "0.0.0.0";
+  if (local) {
+    return false;
+  }
+  return { rejectUnauthorized: false };
+}
+function parseConnectionUrl(params) {
+  const { url, engine: engineOption, sslOption } = params;
+  const engine = _nullishCoalesce(engineOption, () => ( detectEngineFromUrl(url)));
+  if (!engine) {
+    throw new Error(
+      `Could not detect engine from URL. Pass --engine postgres|mysql. URL starts with: ${url.slice(0, 24)}\u2026`
+    );
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (e) {
+    throw new Error(`Invalid connection URL: ${url}`);
+  }
+  const defaultPort = engine === "postgres" ? 5432 : 3306;
+  const port = parsed.port ? Number.parseInt(parsed.port, 10) : defaultPort;
+  const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")) || (engine === "postgres" ? "postgres" : "");
+  const host = parsed.hostname || "localhost";
+  const user = decodeURIComponent(parsed.username || "");
+  const password = decodeURIComponent(parsed.password || "");
+  if (!user) {
+    throw new Error("Connection URL is missing a username");
+  }
+  return {
+    engine,
+    host,
+    port: Number.isFinite(port) ? port : defaultPort,
+    user,
+    password,
+    database,
+    ssl: resolveSsl({ host, sslOption }),
+    url
+  };
+}
+function buildReadonlyUrl(params) {
+  const { engine, host, port, username, password, database } = params;
+  const scheme = engine === "postgres" ? "postgresql" : "mysql";
+  const auth = `${encodeURIComponent(username)}:${encodeURIComponent(password)}`;
+  const dbPath = database ? `/${encodeURIComponent(database)}` : "/";
+  return `${scheme}://${auth}@${host}:${port}${dbPath}`;
+}
+function quoteIdent(params) {
+  const { engine, name } = params;
+  if (engine === "postgres") {
+    return `"${name.replace(/"/g, '""')}"`;
+  }
+  return `\`${name.replace(/`/g, "``")}\``;
+}
+function quoteLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function isSystemDatabase(params) {
+  const { engine, name } = params;
+  const lower = name.toLowerCase();
+  if (engine === "postgres") {
+    return lower === "template0" || lower === "template1" || lower === "rdsadmin" || lower === "cloudsqladmin";
+  }
+  return lower === "information_schema" || lower === "performance_schema" || lower === "mysql" || lower === "sys" || lower === "innodb" || lower === "#mysql50#lost+found";
+}
+
+
+
+
+
+
+
+
+
+
+
+exports.generatePassword = generatePassword; exports.detectEngineFromUrl = detectEngineFromUrl; exports.resolveAdminUrl = resolveAdminUrl; exports.resolveSsl = resolveSsl; exports.parseConnectionUrl = parseConnectionUrl; exports.buildReadonlyUrl = buildReadonlyUrl; exports.quoteIdent = quoteIdent; exports.quoteLiteral = quoteLiteral; exports.isSystemDatabase = isSystemDatabase;

package/cjs/__chunks/R3GUC7O7.cjs

@@ -0,0 +1,110 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/commands/aws/utils/exec-aws.js
+var _child_process = require('child_process');
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var AwsCliError = class extends Error {
+  /**
+   * @param {string} message
+   * @param {string | null} [code]
+   */
+  constructor(message, code = null) {
+    super(message);
+    this.name = "AwsCliError";
+    this.code = code;
+  }
+};
+function parseAwsErrorCode(stderr) {
+  const match = /\(([A-Za-z.]+)\)/.exec(stderr);
+  return _nullishCoalesce(_optionalChain([match, 'optionalAccess', _ => _[1]]), () => ( null));
+}
+function requireCommands(commands) {
+  const missing = commands.filter((command) => {
+    const result = _child_process.spawnSync.call(void 0, "which", [command], { stdio: "pipe" });
+    return result.status !== 0;
+  });
+  if (missing.length > 0) {
+    throw new Error(
+      `Required command(s) not found on PATH: ${missing.join(", ")}`
+    );
+  }
+}
+function runAws(params) {
+  const {
+    profile,
+    region,
+    args,
+    expectJson = true,
+    verbose = false,
+    env
+  } = params;
+  const finalArgs = [];
+  if (profile) finalArgs.push("--profile", profile);
+  if (region) finalArgs.push("--region", region);
+  finalArgs.push("--no-cli-pager", ...args);
+  if (expectJson) finalArgs.push("--output", "json");
+  return spawnAws("aws", finalArgs, { expectJson, verbose, env });
+}
+function runAwsVault(params) {
+  const {
+    profile,
+    args,
+    duration = "15m",
+    expectJson = true,
+    verbose = false
+  } = params;
+  const awsArgs = ["--no-cli-pager", ...args];
+  if (expectJson) awsArgs.push("--output", "json");
+  const finalArgs = [
+    "exec",
+    profile,
+    "--duration",
+    duration,
+    "--",
+    "aws",
+    ...awsArgs
+  ];
+  return spawnAws("aws-vault", finalArgs, { expectJson, verbose });
+}
+function spawnAws(command, args, options) {
+  const { expectJson, verbose, env } = options;
+  if (verbose) {
+    console.log(_chalk2.default.gray(`   Executing: ${command} ${args.join(" ")}`));
+  }
+  const result = _child_process.spawnSync.call(void 0, command, args, {
+    encoding: "utf-8",
+    env: env ? { ...process.env, ...env } : process.env
+  });
+  if (result.error) {
+    throw new AwsCliError(result.error.message);
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || result.stdout || "").trim();
+    const message = stderr || `Command failed: ${command} ${args.join(" ")}`;
+    throw new AwsCliError(message, parseAwsErrorCode(stderr));
+  }
+  const stdout = (_nullishCoalesce(result.stdout, () => ( ""))).trim();
+  if (!expectJson) {
+    return stdout;
+  }
+  if (!stdout) {
+    return {};
+  }
+  return JSON.parse(stdout);
+}
+function getCallerIdentity(params) {
+  const { profile, region, verbose } = params;
+  return runAws({
+    profile,
+    region,
+    args: ["sts", "get-caller-identity"],
+    verbose
+  });
+}
+
+
+
+
+
+
+
+
+exports.AwsCliError = AwsCliError; exports.parseAwsErrorCode = parseAwsErrorCode; exports.requireCommands = requireCommands; exports.runAws = runAws; exports.runAwsVault = runAwsVault; exports.getCallerIdentity = getCallerIdentity;

package/cjs/__chunks/RPVAXPJ4.cjs

@@ -0,0 +1 @@
+"use strict";

package/cjs/__chunks/S3LVCWPN.cjs

@@ -0,0 +1,23 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _WOYF2L6Tcjs = require('./WOYF2L6T.cjs');
+
+// src/commands/aws/iam/remove-admin/schema.js
+var _zod = require('zod');
+var removeAdminOptionsSchema = _zod.z.object({
+  profile: _WOYF2L6Tcjs.profileField,
+  all: _zod.z.boolean().optional().default(false).describe(
+    "Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"
+  ),
+  user: _zod.z.array(_zod.z.string()).optional().default([]).describe(
+    "Only remove these user(s); repeatable. Default: every user in the group"
+  ),
+  yes: _zod.z.boolean().optional().default(false).describe("Skip the per-profile confirmation prompt"),
+  dryRun: _zod.z.boolean().optional().default(false).describe("Preview removals without changing anything"),
+  verbose: _WOYF2L6Tcjs.verboseField
+});
+
+
+
+exports.removeAdminOptionsSchema = removeAdminOptionsSchema;