@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-pr-20-20261020022402

package/esm/__chunks/XOUWDB3T.js

@@ -0,0 +1,249 @@
+import {
+  runAws
+} from "./FNXUONAV.js";
+import {
+  resolvePolicyPath
+} from "./ZO55YUSY.js";
+
+// src/commands/aws/iam/setup-acl/utils.js
+var ACL_GROUPS = [
+  "acl-admin-do-not-use",
+  "acl-iam-full-access",
+  "acl-power-users",
+  "acl-read-only",
+  "acl-s3-restrictions"
+];
+var CUSTOM_POLICIES = [
+  { name: "UserAdminsWriteList", fileName: "user-admins-write-list.json" },
+  { name: "UserAdminsDenyList", fileName: "user-admins-deny-list.json" },
+  {
+    name: "UserAdminsSelfServiceIAM",
+    fileName: "user-admins-self-service-iam.json"
+  },
+  {
+    name: "UserAdminsDenyRegionsList",
+    fileName: "user-admins-deny-regions-list.json"
+  },
+  { name: "sts-federation", fileName: "sts-federation.json" },
+  {
+    name: "S3RestrictionsDenyNonS3Services",
+    fileName: "s3-restrictions-deny-non-s3-services.json"
+  }
+];
+function ensureGroup(params) {
+  const { name, profile, verbose } = params;
+  let exists = true;
+  try {
+    runAws({
+      profile,
+      args: ["iam", "get-group", "--group-name", name],
+      verbose
+    });
+  } catch {
+    exists = false;
+  }
+  if (exists) {
+    console.log(`  Group exists: ${name}`);
+    return;
+  }
+  console.log(`  Create group: ${name}`);
+  runAws({
+    profile,
+    args: ["iam", "create-group", "--group-name", name, "--path", "/"],
+    expectJson: false,
+    verbose
+  });
+}
+function publishPolicy(params) {
+  const { name, fileName, accountId, profile, verbose } = params;
+  const arn = `arn:aws:iam::${accountId}:policy/${name}`;
+  const file = resolvePolicyPath(fileName);
+  let exists = true;
+  try {
+    runAws({
+      profile,
+      args: ["iam", "get-policy", "--policy-arn", arn],
+      verbose
+    });
+  } catch {
+    exists = false;
+  }
+  if (!exists) {
+    console.log(`  Create policy: ${name}`);
+    runAws({
+      profile,
+      args: [
+        "iam",
+        "create-policy",
+        "--policy-name",
+        name,
+        "--policy-document",
+        `file://${file}`,
+        "--description",
+        `ACL: ${name}`
+      ],
+      expectJson: false,
+      verbose
+    });
+    return;
+  }
+  const nonDefaultCount = Number.parseInt(
+    runAws({
+      profile,
+      args: [
+        "iam",
+        "list-policy-versions",
+        "--policy-arn",
+        arn,
+        "--query",
+        "length(Versions[?IsDefaultVersion==`false`])",
+        "--output",
+        "text"
+      ],
+      expectJson: false,
+      verbose
+    }),
+    10
+  ) || 0;
+  if (nonDefaultCount >= 4) {
+    const oldest = runAws({
+      profile,
+      args: [
+        "iam",
+        "list-policy-versions",
+        "--policy-arn",
+        arn,
+        "--query",
+        "Versions[?IsDefaultVersion==`false`] | sort_by(@, &CreateDate)[0].VersionId",
+        "--output",
+        "text"
+      ],
+      expectJson: false,
+      verbose
+    });
+    console.log(`  Prune oldest version of ${name}: ${oldest}`);
+    runAws({
+      profile,
+      args: [
+        "iam",
+        "delete-policy-version",
+        "--policy-arn",
+        arn,
+        "--version-id",
+        oldest
+      ],
+      expectJson: false,
+      verbose
+    });
+  }
+  console.log(`  Update policy: ${name}`);
+  runAws({
+    profile,
+    args: [
+      "iam",
+      "create-policy-version",
+      "--policy-arn",
+      arn,
+      "--policy-document",
+      `file://${file}`,
+      "--set-as-default"
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function isPolicyAttached(params) {
+  const { group, arn, profile, verbose } = params;
+  const out = runAws({
+    profile,
+    args: [
+      "iam",
+      "list-attached-group-policies",
+      "--group-name",
+      group,
+      "--query",
+      `AttachedPolicies[?PolicyArn=='${arn}'].PolicyArn`,
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  return Boolean(out);
+}
+function attach(params) {
+  const { group, arn, profile, verbose } = params;
+  const policyName = arn.split("/").pop() ?? arn;
+  if (isPolicyAttached({ group, arn, profile, verbose })) {
+    console.log(`  [${group}] already attached: ${policyName}`);
+    return;
+  }
+  console.log(`  [${group}] attach: ${policyName}`);
+  runAws({
+    profile,
+    args: [
+      "iam",
+      "attach-group-policy",
+      "--group-name",
+      group,
+      "--policy-arn",
+      arn
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function detach(params) {
+  const { group, arn, profile, verbose } = params;
+  const policyName = arn.split("/").pop() ?? arn;
+  if (!isPolicyAttached({ group, arn, profile, verbose })) {
+    return;
+  }
+  console.log(`  [${group}] detach legacy: ${policyName}`);
+  runAws({
+    profile,
+    args: [
+      "iam",
+      "detach-group-policy",
+      "--group-name",
+      group,
+      "--policy-arn",
+      arn
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function printFinalState(params) {
+  const { profile, verbose } = params;
+  for (const group of ACL_GROUPS) {
+    console.log("");
+    console.log(`=== ${group} ===`);
+    const table = runAws({
+      profile,
+      args: [
+        "iam",
+        "list-attached-group-policies",
+        "--group-name",
+        group,
+        "--query",
+        "AttachedPolicies[].PolicyName",
+        "--output",
+        "table"
+      ],
+      expectJson: false,
+      verbose
+    });
+    console.log(table);
+  }
+}
+
+export {
+  ACL_GROUPS,
+  CUSTOM_POLICIES,
+  ensureGroup,
+  publishPolicy,
+  attach,
+  detach,
+  printFinalState
+};

package/esm/__chunks/XQN2TA4S.js

@@ -0,0 +1,23 @@
+import {
+  profileField,
+  regionField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/iam/setup-acl/schema.js
+import { z } from "zod";
+var setupAclOptionsSchema = z.object({
+  restrictRegions: z.enum(["yes", "no"]).optional().describe(
+    "Attach the region restriction to acl-power-users (skips the interactive prompt)"
+  ),
+  createUsers: z.boolean().optional().default(true).describe(
+    "Create IAM users after configuring groups (use --no-create-users to skip)"
+  ),
+  profile: profileField,
+  region: regionField,
+  verbose: verboseField
+});
+
+export {
+  setupAclOptionsSchema
+};

package/esm/__chunks/XXK32TIM.js

@@ -0,0 +1,16 @@
+import {
+  profileField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/iam/users/schema.js
+import { z } from "zod";
+var usersOptionsSchema = z.object({
+  accountName: z.string().optional().describe("AWS account slug used in md-{identifier}-{account}-{role}"),
+  profile: profileField,
+  verbose: verboseField
+});
+
+export {
+  usersOptionsSchema
+};

package/esm/__chunks/{O262GK4B.js → YGWTVPZE.js}

@@ -12,9 +12,16 @@ import {
   unlinkSync,
   writeFileSync
 } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
 import { createInterface } from "readline";
 import chalk from "chalk";
 var DEFAULT_DOPPLER_ENVIRONMENT = "dev";
+var DOPPLER_INTERNAL_KEYS = /* @__PURE__ */ new Set([
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT"
+]);
 function execDoppler(args, parser = "string", silent = false, verbose = false) {
   const command = `doppler ${args.join(" ")}`;
   let verbosity = "default";
@@ -29,9 +36,9 @@ function execDoppler(args, parser = "string", silent = false, verbose = false) {
     throwOnError: true
   });
 }
-function checkDependencies(verbose = false) {
+function checkDopplerAuth(verbose = false) {
   if (verbose) {
-    console.log(chalk.blue("\n\u{1F50D} Checking Doppler dependencies..."));
+    console.log(chalk.blue("\n\u{1F50D} Checking Doppler authentication..."));
   }
   try {
     execSync("which doppler", { stdio: "pipe" });
@@ -40,7 +47,7 @@ function checkDependencies(verbose = false) {
     }
   } catch {
     throw new Error(
-      "Doppler is not installed. Please install Doppler (brew install dopplerhq/cli/doppler), login, setup, and try again."
+      "Doppler is not installed. Please install Doppler (brew install dopplerhq/cli/doppler), login, and try again."
     );
   }
   try {
@@ -50,9 +57,15 @@ function checkDependencies(verbose = false) {
     }
   } catch {
     throw new Error(
-      "Doppler is not logged in. Please run 'doppler login' then 'doppler setup' and try again."
+      "Doppler is not logged in. Please run 'doppler login' and try again."
     );
   }
+}
+function checkDependencies(verbose = false) {
+  checkDopplerAuth(verbose);
+  if (verbose) {
+    console.log(chalk.blue("\n\u{1F50D} Checking Doppler project setup..."));
+  }
   try {
     execDoppler(["configs", "--json"], "json", true, verbose);
     if (verbose) {
@@ -64,21 +77,18 @@ function checkDependencies(verbose = false) {
     );
   }
 }
-function getConfigs(environment, verbose = false) {
+function getConfigs(environments, verbose = false, project = null) {
   if (verbose) {
     console.log(
       chalk.blue(
         `
-\u{1F4CB} Resolving configurations for environment: ${chalk.cyan(environment)}`
+\u{1F4CB} Resolving configurations for environments: ${chalk.cyan(environments)}`
       )
     );
   }
-  const availableConfigs = execDoppler(
-    ["configs", "--json"],
-    "json",
-    true,
-    verbose
-  );
+  const configArgs = ["configs", "--json"];
+  if (project) configArgs.push("--project", project);
+  const availableConfigs = execDoppler(configArgs, "json", true, verbose);
   const configNames = Array.isArray(availableConfigs) ? availableConfigs.map(
     (config) => config.name
   ) : [];
@@ -87,7 +97,7 @@ function getConfigs(environment, verbose = false) {
       chalk.gray(`   Available configurations: ${configNames.join(", ")}`)
     );
   }
-  if (environment === "all") {
+  if (environments === "all") {
     if (configNames.length === 0) {
       throw new Error("No configurations found in Doppler");
     }
@@ -98,15 +108,21 @@ function getConfigs(environment, verbose = false) {
     }
     return configNames;
   }
-  if (configNames.length > 0 && !configNames.includes(environment)) {
-    throw new Error(
-      `Configuration "${environment}" not found. Available configurations: ${configNames.join(", ")}`
-    );
+  const requested = environments.split(",").map((e) => e.trim());
+  if (configNames.length > 0) {
+    const missing = requested.filter((e) => !configNames.includes(e));
+    if (missing.length > 0) {
+      throw new Error(
+        `Configurations not found: ${missing.join(", ")}. Available: ${configNames.join(", ")}`
+      );
+    }
   }
   if (verbose) {
-    console.log(chalk.green(`   \u2713 Using configuration: ${environment}`));
+    console.log(
+      chalk.green(`   \u2713 Using configurations: ${requested.join(", ")}`)
+    );
   }
-  return [environment];
+  return requested;
 }
 function normalizeEscapeSequences(content) {
   return content.replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\r/g, "\r");
@@ -145,9 +161,9 @@ function promptConfirmation(message) {
   });
 }
 async function downloadConfigs(options) {
-  const { environment, verbose } = options;
-  const actualEnvironment = environment ?? DEFAULT_DOPPLER_ENVIRONMENT;
-  const configs = getConfigs(actualEnvironment, verbose);
+  const { environments, verbose } = options;
+  const actualEnvironments = environments ?? DEFAULT_DOPPLER_ENVIRONMENT;
+  const configs = getConfigs(actualEnvironments, verbose);
   if (verbose) {
     console.log(
       chalk.blue(
@@ -156,9 +172,9 @@ async function downloadConfigs(options) {
       )
     );
   }
-  if (configs.length === 1 && environment !== "all") {
+  if (configs.length === 1 && actualEnvironments !== "all") {
     console.log(
-      "You can use -e all to download all configurations, or -e <env> for a specific environment."
+      "You can use -e all to download all configurations, or -e dev,stg for specific environments."
     );
   }
   for (const config of configs) {
@@ -228,8 +244,8 @@ async function downloadConfigs(options) {
   }
 }
 async function uploadConfigs(options) {
-  const { environment, verbose } = options;
-  const configs = getConfigs(environment, verbose);
+  const { environments, verbose } = options;
+  const configs = getConfigs(environments, verbose);
   if (verbose) {
     console.log(
       chalk.blue(
@@ -388,14 +404,135 @@ async function uploadConfigs(options) {
     }
   }
 }
+async function cloneProject({ from, to, environments, force, verbose }) {
+  if (verbose) {
+    console.log(
+      chalk.blue(
+        `
+\u{1F501} Cloning from ${chalk.cyan(from)} to ${chalk.cyan(to)}...`
+      )
+    );
+  }
+  const configsToClone = getConfigs(environments, verbose, from);
+  if (configsToClone.length === 0) {
+    throw new Error(`No configurations found in source project "${from}"`);
+  }
+  const targetConfigsRaw = execDoppler(
+    ["configs", "--json", "--project", to],
+    "json",
+    true,
+    verbose
+  );
+  const targetConfigNames = Array.isArray(targetConfigsRaw) ? targetConfigsRaw.map((c) => c.name) : [];
+  const missingInTarget = configsToClone.filter(
+    (c) => !targetConfigNames.includes(c)
+  );
+  if (missingInTarget.length > 0) {
+    throw new Error(
+      `Configs missing in target project "${to}": ${missingInTarget.join(", ")}. Create them in Doppler first.`
+    );
+  }
+  for (const config of configsToClone) {
+    if (verbose) {
+      console.log(chalk.blue(`
+\u{1F4E6} Processing config: ${chalk.cyan(config)}`));
+    }
+    const sourceSecrets = execDoppler(
+      ["secrets", "--json", "--project", from, "--config", config],
+      "json",
+      true,
+      verbose
+    );
+    const sourceKeys = sourceSecrets ? Object.keys(sourceSecrets).filter((k) => !DOPPLER_INTERNAL_KEYS.has(k)) : [];
+    const targetSecrets = execDoppler(
+      ["secrets", "--json", "--project", to, "--config", config],
+      "json",
+      true,
+      verbose
+    );
+    const targetKeys = targetSecrets ? Object.keys(targetSecrets) : [];
+    const conflicts = sourceKeys.filter((k) => targetKeys.includes(k));
+    if (conflicts.length > 0) {
+      if (process.env["CI"]) {
+        throw new Error(
+          `Config "${config}" has ${conflicts.length} conflicting key(s) in target: ${conflicts.join(", ")}`
+        );
+      }
+      if (!force) {
+        console.log(
+          `
+Config ${chalk.cyan(config)}: ${conflicts.length} key(s) already exist in ${chalk.cyan(to)}:`
+        );
+        conflicts.forEach((k) => console.log(chalk.yellow(`  \u2022 ${k}`)));
+        const confirmed = await promptConfirmation(
+          `
+Overwrite these keys in "${to}/${config}"? (y/n) `
+        );
+        if (!confirmed) {
+          console.log(`Skipped ${chalk.blue(config)}`);
+          continue;
+        }
+      }
+    }
+    const tmpFile = join(tmpdir(), `doppler-clone-${config}-${Date.now()}.env`);
+    try {
+      const content = execDoppler(
+        [
+          "secrets",
+          "download",
+          "--no-file",
+          "--format",
+          "env",
+          "--project",
+          from,
+          "--config",
+          config
+        ],
+        "string",
+        true,
+        verbose
+      );
+      if (typeof content !== "string" || !content) {
+        throw new Error(`No secrets returned for config "${config}"`);
+      }
+      const filtered = content.split("\n").filter((line) => {
+        const key = line.split("=")[0] ?? "";
+        return !DOPPLER_INTERNAL_KEYS.has(key);
+      }).join("\n");
+      writeFileSync(tmpFile, filtered, "utf-8");
+      execDoppler(
+        [
+          "secrets",
+          "upload",
+          tmpFile,
+          "--project",
+          to,
+          "--config",
+          config,
+          "--silent"
+        ],
+        "string",
+        true,
+        verbose
+      );
+      console.log(`Config ${chalk.blue(config)}: cloned to ${chalk.green(to)}`);
+    } finally {
+      if (existsSync(tmpFile)) {
+        unlinkSync(tmpFile);
+      }
+    }
+  }
+}
 
 export {
   execDoppler,
+  checkDopplerAuth,
   checkDependencies,
   getConfigs,
   normalizeEscapeSequences,
   createDiff,
   promptConfirmation,
   downloadConfigs,
-  uploadConfigs
+  uploadConfigs,
+  cloneProject
 };

package/esm/__chunks/{6L5RNR7G.js → YRG7PT33.js}

@@ -1,50 +1,77 @@
+import {
+  setSecretInteractive
+} from "./QFXN4EHM.js";
 import {
   checkDependencies,
+  checkDopplerAuth,
+  cloneProject,
   downloadConfigs,
   uploadConfigs
-} from "./O262GK4B.js";
+} from "./YGWTVPZE.js";
 import {
   dopplerCommandMetadata,
   dopplerCommandOptionsSchema
-} from "./X3R5PSWH.js";
+} from "./KWUJP5MG.js";
 
 // src/commands/doppler/handler.js
 import chalk from "chalk";
 import { ZodError } from "zod";
 async function dopplerCommand(options) {
   try {
-    const validatedOptions = dopplerCommandOptionsSchema.parse(options);
-    if (validatedOptions.help || !validatedOptions.action) {
+    const rawOptions = (
+      /** @type {any} */
+      options ?? {}
+    );
+    if (rawOptions.help || !rawOptions.action) {
       console.log(
         chalk.bold(`
 Usage: @mtndev/cli doppler [options] <action>`)
       );
       console.log(dopplerCommandMetadata.description);
       console.log(chalk.bold("\nOptions:"));
-      Object.entries(dopplerCommandOptionsSchema.shape).forEach(
-        ([key, fieldSchema]) => {
-          if (key === "action") return;
-          const description = fieldSchema.description || "No description available";
-          const optionMeta = (
+      Object.entries(dopplerCommandMetadata.options).forEach(
+        ([key, optionMeta]) => {
+          const meta = (
             /** @type {any} */
-            dopplerCommandMetadata.options[key]
+            optionMeta
           );
-          const defaultValue = optionMeta?.default ?? false;
-          const alias = optionMeta?.alias ? chalk.cyan(`, -${optionMeta.alias}`) : "";
+          const alias = meta?.alias ? chalk.cyan(`, -${meta.alias}`) : "";
+          const defaultValue = meta?.default ?? false;
           console.log(
-            chalk.cyan(`  --${key}`) + alias + `  ${description} (default: ${defaultValue})`
+            chalk.cyan(`  --${key}`) + alias + `  ${meta.description} (default: ${defaultValue})`
           );
         }
       );
       console.log("");
       return;
     }
-    const { action, environment, verbose } = validatedOptions;
-    checkDependencies(verbose);
+    const validatedOptions = dopplerCommandOptionsSchema.parse(options);
+    const { action, verbose } = validatedOptions;
+    if (action === "set") {
+      checkDopplerAuth(verbose);
+    } else {
+      checkDependencies(verbose);
+    }
     if (action === "download") {
-      await downloadConfigs({ environment, verbose });
+      const { environments } = validatedOptions;
+      await downloadConfigs({ environments, verbose });
     } else if (action === "upload") {
-      await uploadConfigs({ environment, verbose });
+      const { environments } = validatedOptions;
+      await uploadConfigs({ environments, verbose });
+    } else if (action === "clone") {
+      const { from, to, force, environments } = validatedOptions;
+      await cloneProject({ from, to, environments, force, verbose });
+    } else if (action === "set") {
+      const { project, environment, config, name, value, yes } = validatedOptions;
+      await setSecretInteractive({
+        project,
+        environment,
+        config,
+        name,
+        value,
+        yes,
+        verbose
+      });
     }
     console.log(chalk.green(`
 \u2705 Doppler ${action} completed successfully!`));