@mtndev/cli 1.0.0 → 2.0.0

package/esm/__chunks/3HE4BEJX.js

@@ -0,0 +1,105 @@
+import {
+  isSystemDatabase,
+  quoteIdent,
+  quoteLiteral
+} from "./DLEJ25GZ.js";
+
+// src/commands/db/create-readonly-user/mysql.js
+import mysql from "mysql2/promise";
+async function createConnection(config) {
+  return mysql.createConnection({
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: config.database || void 0,
+    ssl: config.ssl && typeof config.ssl === "object" ? config.ssl : void 0,
+    multipleStatements: false
+  });
+}
+async function listMysqlDatabases(config) {
+  const connection = await createConnection(config);
+  try {
+    const [rows] = await connection.query("SHOW DATABASES");
+    const names = (
+      /** @type {Array<{ Database?: string }>} */
+      rows.map(
+        (row) => row.Database ?? ""
+      )
+    );
+    return names.filter((name) => Boolean(name)).filter((name) => !isSystemDatabase({ engine: "mysql", name })).sort((a, b) => a.localeCompare(b));
+  } finally {
+    await connection.end();
+  }
+}
+async function applyMysqlReadonly(params) {
+  const {
+    config,
+    username,
+    password,
+    databases,
+    hostPattern,
+    dryRun = false,
+    verbose = false
+  } = params;
+  const userLiteral = quoteLiteral(username);
+  const hostLiteral = quoteLiteral(hostPattern);
+  const passwordLiteral = quoteLiteral(password);
+  const account = `${userLiteral}@${hostLiteral}`;
+  const statements = [];
+  const createSql = `CREATE USER IF NOT EXISTS ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const alterSql = `ALTER USER ${account} IDENTIFIED BY ${passwordLiteral}`;
+  const grantSqls = [];
+  if (databases === "all") {
+    grantSqls.push(
+      `GRANT SELECT, SHOW VIEW, SHOW DATABASES ON *.* TO ${account}`
+    );
+  } else {
+    for (const database of databases) {
+      const dbIdent = quoteIdent({ engine: "mysql", name: database });
+      grantSqls.push(`GRANT SELECT, SHOW VIEW ON ${dbIdent}.* TO ${account}`);
+    }
+  }
+  const flushSql = "FLUSH PRIVILEGES";
+  statements.push(createSql, alterSql, ...grantSqls, flushSql);
+  if (dryRun) {
+    return {
+      created: true,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  }
+  const connection = await createConnection(config);
+  try {
+    if (verbose) {
+      console.log(`   Connected to MySQL as ${config.user}@${config.host}`);
+    }
+    const [existingRows] = await connection.query(
+      "SELECT 1 AS ok FROM mysql.user WHERE User = ? AND Host = ? LIMIT 1",
+      [username, hostPattern]
+    );
+    const existed = Array.isArray(existingRows) && existingRows.length > 0;
+    await connection.query(createSql);
+    await connection.query(alterSql);
+    for (const grantSql of grantSqls) {
+      await connection.query(grantSql);
+    }
+    await connection.query(flushSql);
+    return {
+      created: !existed,
+      statements: statements.map(
+        (sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql
+      ),
+      databases
+    };
+  } finally {
+    await connection.end();
+  }
+}
+
+export {
+  listMysqlDatabases,
+  applyMysqlReadonly
+};

package/esm/__chunks/3QLI5BDL.js

@@ -0,0 +1,387 @@
+import {
+  runAws
+} from "./FNXUONAV.js";
+import {
+  prompt,
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/iam/users/utils.js
+import chalk from "chalk";
+var KNOWN_ROLES = ["read-only", "iam-admin", "power-user"];
+var REQUIRED_ACL_GROUPS = [
+  "acl-read-only",
+  "acl-iam-full-access",
+  "acl-power-users"
+];
+function roleToGroup(role) {
+  switch (role) {
+    case "read-only":
+      return "acl-read-only";
+    case "iam-admin":
+      return "acl-iam-full-access";
+    case "power-user":
+      return "acl-power-users";
+    default:
+      throw new Error(`Unknown role: ${role}`);
+  }
+}
+function normalizeSlug(value) {
+  return value.toLowerCase().replace(/ /g, "-");
+}
+function isValidSlug(value) {
+  return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function buildUsername(params) {
+  const { identifier, accountName, role } = params;
+  return `md-${identifier}-${accountName}-${role}`;
+}
+function normalizeIdentifier(params) {
+  const { raw, accountName, role } = params;
+  let identifier = normalizeSlug(raw);
+  if (identifier.startsWith("md-")) {
+    identifier = identifier.slice(3);
+  }
+  if (identifier.endsWith(`-${role}`)) {
+    identifier = identifier.slice(0, -(role.length + 1));
+  } else {
+    for (const knownRole of KNOWN_ROLES) {
+      if (identifier.endsWith(`-${knownRole}`)) {
+        identifier = identifier.slice(0, -(knownRole.length + 1));
+        break;
+      }
+    }
+  }
+  if (identifier.endsWith(`-${accountName}`)) {
+    identifier = identifier.slice(0, -(accountName.length + 1));
+  }
+  return identifier;
+}
+function parseMdUsername(name) {
+  let value = normalizeSlug(name);
+  if (!value.startsWith("md-")) {
+    return null;
+  }
+  value = value.slice(3);
+  const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+  let role = null;
+  for (const knownRole of rolesByLength) {
+    if (value.endsWith(`-${knownRole}`)) {
+      role = knownRole;
+      value = value.slice(0, -(knownRole.length + 1));
+      break;
+    }
+  }
+  if (!role) {
+    return null;
+  }
+  const dash = value.indexOf("-");
+  if (dash <= 0 || dash === value.length - 1) {
+    return null;
+  }
+  const identifier = value.slice(0, dash);
+  const accountName = value.slice(dash + 1);
+  if (!isValidSlug(identifier) || !isValidSlug(accountName)) {
+    return null;
+  }
+  return { identifier, accountName, role };
+}
+function inferAccountName(params) {
+  const { profile, identity } = params;
+  const arn = identity?.Arn ?? "";
+  const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+  for (const candidate of [username, profile ?? ""]) {
+    if (!candidate) {
+      continue;
+    }
+    const parsed = parseMdUsername(candidate);
+    if (parsed) {
+      return parsed.accountName;
+    }
+  }
+  return null;
+}
+function userExists(params) {
+  const { username, profile, verbose } = params;
+  try {
+    runAws({
+      profile,
+      args: ["iam", "get-user", "--user-name", username],
+      verbose
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureUser(params) {
+  const { username, profile, verbose } = params;
+  if (userExists({ username, profile, verbose })) {
+    console.log(`  User exists: ${username}`);
+    return;
+  }
+  console.log(`  Create user: ${username}`);
+  runAws({
+    profile,
+    args: ["iam", "create-user", "--user-name", username, "--path", "/"],
+    verbose
+  });
+}
+function ensureUserInGroup(params) {
+  const { username, group, profile, verbose } = params;
+  const existing = runAws({
+    profile,
+    args: [
+      "iam",
+      "get-group",
+      "--group-name",
+      group,
+      "--query",
+      `Users[?UserName=='${username}'].UserName`,
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  if (existing) {
+    console.log(`  Already in group: ${group}`);
+    return;
+  }
+  console.log(`  Add to group: ${group}`);
+  runAws({
+    profile,
+    args: [
+      "iam",
+      "add-user-to-group",
+      "--user-name",
+      username,
+      "--group-name",
+      group
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function createCliAccessKey(params) {
+  const { username, profile, verbose } = params;
+  const keyCountRaw = runAws({
+    profile,
+    args: [
+      "iam",
+      "list-access-keys",
+      "--user-name",
+      username,
+      "--query",
+      "length(AccessKeyMetadata)",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const keyCount = Number.parseInt(keyCountRaw, 10) || 0;
+  if (keyCount >= 2) {
+    console.log(
+      chalk.yellow(
+        `  WARNING: ${username} already has 2 access keys (AWS max).`
+      )
+    );
+    console.log(
+      chalk.yellow("  Delete an existing key before creating a new one.")
+    );
+    return false;
+  }
+  const created = runAws({
+    profile,
+    args: [
+      "iam",
+      "create-access-key",
+      "--user-name",
+      username,
+      "--query",
+      "AccessKey.[AccessKeyId,SecretAccessKey]",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const [accessKeyId, secretAccessKey] = created.split(/\s+/);
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Failed to parse the newly created access key");
+  }
+  const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+  console.log("");
+  console.log(
+    `  CLI credentials for ${username} (secret shown once \u2014 copy now):`
+  );
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log(
+    "  YOU MUST run the command below with a LEADING SPACE so it is not saved"
+  );
+  console.log('  to shell history \u2014 same idea as:  TEST="a" && echo $TEST');
+  console.log("");
+  console.log(setupCmd);
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log("");
+  return true;
+}
+function ensureAclGroupsExist(params) {
+  const { profile, verbose } = params;
+  const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+    try {
+      runAws({
+        profile,
+        args: ["iam", "get-group", "--group-name", group],
+        verbose
+      });
+      return false;
+    } catch {
+      return true;
+    }
+  });
+  if (missing.length > 0) {
+    missing.forEach((group) => console.log(`  Missing group: ${group}`));
+    console.log("");
+    console.log(
+      "  Run `mtn aws iam setup-acl` first to create ACL groups and policies."
+    );
+    return false;
+  }
+  return true;
+}
+async function promptAccountName(params) {
+  const { accountName, inferredAccountName } = params;
+  if (accountName) {
+    const slug = normalizeSlug(accountName);
+    if (isValidSlug(slug)) {
+      console.log(`  Account name: ${slug}`);
+      return slug;
+    }
+    console.log("  Invalid account name option \u2014 falling back to prompt.");
+  }
+  const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+  for (; ; ) {
+    const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+    const raw = await prompt(
+      `  AWS account name${hint} \u2014 used in md-{identifier}-{account}-{role}: `
+    );
+    if (raw === "" && defaultSlug) {
+      console.log(`  \u2192 account name: ${defaultSlug}`);
+      return defaultSlug;
+    }
+    const slug = normalizeSlug(raw);
+    if (isValidSlug(slug)) {
+      if (raw !== slug) {
+        console.log(`  \u2192 account name: ${slug}`);
+      }
+      return slug;
+    }
+    console.log(
+      "  Invalid account name \u2014 use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : ".")
+    );
+  }
+}
+async function promptRole() {
+  for (; ; ) {
+    console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+    console.log("    1) read-only   \u2192 acl-read-only");
+    console.log("    2) iam-admin   \u2192 acl-iam-full-access");
+    console.log("    3) power-user  \u2192 acl-power-users");
+    const choice = await prompt("  Choice [1-3]: ");
+    switch (choice) {
+      case "1":
+      case "read-only":
+        return "read-only";
+      case "2":
+      case "iam-admin":
+        return "iam-admin";
+      case "3":
+      case "power-user":
+        return "power-user";
+      default:
+        console.log("  Invalid choice \u2014 enter 1, 2, 3, or the role name.");
+    }
+  }
+}
+async function promptIdentifier(params) {
+  const { accountName, role } = params;
+  const exampleUser = buildUsername({
+    identifier: "declan",
+    accountName,
+    role
+  });
+  for (; ; ) {
+    const raw = await prompt(
+      `  Identifier (e.g. declan, or full ${exampleUser}): `
+    );
+    const lowerRaw = normalizeSlug(raw);
+    const identifier = normalizeIdentifier({ raw, accountName, role });
+    if (isValidSlug(identifier)) {
+      if (lowerRaw !== identifier) {
+        console.log(`  \u2192 parsed identifier: ${identifier}`);
+      }
+      return identifier;
+    }
+    console.log(
+      "  Invalid identifier \u2014 use lowercase letters, numbers, and hyphens."
+    );
+    console.log("  Tip: enter just the short name (e.g. declan).");
+  }
+}
+async function createUsersInteractive(params) {
+  const { accountName: accountNameOption, profile, identity, verbose } = params;
+  if (!ensureAclGroupsExist({ profile, verbose })) {
+    return;
+  }
+  console.log("");
+  const inferredAccountName = inferAccountName({ profile, identity });
+  const accountName = await promptAccountName({
+    accountName: accountNameOption,
+    inferredAccountName
+  });
+  console.log("");
+  while (await promptYesNo({ message: "  Create another user?", defaultYes: false })) {
+    console.log("");
+    const role = await promptRole();
+    const identifier = await promptIdentifier({ accountName, role });
+    const username = buildUsername({ identifier, accountName, role });
+    const group = roleToGroup(role);
+    console.log("");
+    console.log(`  \u2192 user: ${username}`);
+    console.log(`  \u2192 group: ${group}`);
+    console.log("");
+    ensureUser({ username, profile, verbose });
+    ensureUserInGroup({ username, group, profile, verbose });
+    try {
+      createCliAccessKey({ username, profile, verbose });
+    } catch (error) {
+      console.log(
+        chalk.yellow(
+          `  Could not create access key: ${error instanceof Error ? error.message : String(error)}`
+        )
+      );
+    }
+    console.log("");
+  }
+}
+
+export {
+  roleToGroup,
+  normalizeSlug,
+  isValidSlug,
+  buildUsername,
+  normalizeIdentifier,
+  parseMdUsername,
+  inferAccountName,
+  ensureUser,
+  ensureUserInGroup,
+  createCliAccessKey,
+  ensureAclGroupsExist,
+  createUsersInteractive
+};

package/esm/__chunks/5GIUAFXL.js

@@ -0,0 +1,89 @@
+import {
+  prompt,
+  promptChoice
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/utils/resolve-profile.js
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import chalk from "chalk";
+var MAX_LISTED = 30;
+function listConfigProfiles() {
+  const configPath = process.env.AWS_CONFIG_FILE ?? join(homedir(), ".aws", "config");
+  let contents;
+  try {
+    contents = readFileSync(configPath, "utf-8");
+  } catch {
+    return [];
+  }
+  const profiles = [];
+  const profileRe = /^\[profile\s+(.+?)\]$/;
+  for (const rawLine of contents.split("\n")) {
+    const line = rawLine.trim();
+    const match = profileRe.exec(line);
+    if (match?.[1]) {
+      profiles.push(match[1].trim());
+    } else if (line === "[default]") {
+      profiles.push("default");
+    }
+  }
+  return profiles;
+}
+async function pickProfileInteractive(profiles) {
+  for (; ; ) {
+    const filter = (await prompt(chalk.cyan("Filter profiles (substring, Enter for all): "))).trim().toLowerCase();
+    const matches = filter ? profiles.filter((name) => name.toLowerCase().includes(filter)) : profiles;
+    if (matches.length === 0) {
+      console.log(chalk.yellow(`  No profiles match "${filter}". Try again.`));
+      continue;
+    }
+    if (matches.length === 1) {
+      const only = matches[0] ?? "";
+      console.log(chalk.green(`  \u2192 ${only}`));
+      return only;
+    }
+    if (matches.length > MAX_LISTED) {
+      console.log(
+        chalk.yellow(
+          `  ${matches.length} profiles match \u2014 narrow the filter (over ${MAX_LISTED} to list).`
+        )
+      );
+      continue;
+    }
+    const index = await promptChoice({
+      message: chalk.cyan("Select a profile:"),
+      options: matches
+    });
+    return matches[index] ?? "";
+  }
+}
+async function resolveProfile(params) {
+  const explicit = params.profile ?? process.env.AWS_PROFILE;
+  if (explicit) {
+    return explicit;
+  }
+  const interactive = params.interactive ?? Boolean(process.stdin.isTTY);
+  if (!interactive) {
+    return void 0;
+  }
+  const profiles = listConfigProfiles();
+  if (profiles.length === 0) {
+    return void 0;
+  }
+  console.log(
+    chalk.yellow(
+      "\nNo AWS profile selected (--profile and AWS_PROFILE are unset)."
+    )
+  );
+  const chosen = await pickProfileInteractive(profiles);
+  console.log(chalk.gray(`Using profile "${chosen}" for this command.
+`));
+  return chosen;
+}
+
+export {
+  listConfigProfiles,
+  pickProfileInteractive,
+  resolveProfile
+};

package/esm/__chunks/73BJG53F.js

@@ -0,0 +1,11 @@
+// src/commands/aws/schema.js
+import { z } from "zod";
+var profileField = z.string().optional().describe("AWS profile (defaults to the AWS_PROFILE environment variable)");
+var regionField = z.string().optional().describe("AWS region");
+var verboseField = z.boolean().optional().default(false).describe("Enable verbose logging for detailed output and error traces");
+
+export {
+  profileField,
+  regionField,
+  verboseField
+};

package/esm/__chunks/B2DVQ2UL.js

@@ -0,0 +1,61 @@
+// src/commands/aws/ses/smtp-password.js
+import { createHmac } from "crypto";
+var SMTP_REGIONS = /* @__PURE__ */ new Set([
+  "us-east-2",
+  "us-east-1",
+  "us-west-1",
+  "us-west-2",
+  "ap-south-1",
+  "ap-northeast-2",
+  "ap-southeast-1",
+  "ap-southeast-2",
+  "ap-northeast-1",
+  "ca-central-1",
+  "eu-central-1",
+  "eu-west-1",
+  "eu-west-2",
+  "eu-west-3",
+  "eu-south-1",
+  "eu-north-1",
+  "sa-east-1",
+  "us-gov-west-1",
+  "us-gov-east-1",
+  "me-south-1",
+  "af-south-1",
+  "il-central-1"
+]);
+var DATE = "11111111";
+var SERVICE = "ses";
+var MESSAGE = "SendRawEmail";
+var TERMINAL = "aws4_request";
+var VERSION = 4;
+function sign(key, message) {
+  return createHmac("sha256", key).update(message, "utf8").digest();
+}
+function calculateSmtpPassword(params) {
+  const { secretAccessKey, region } = params;
+  if (!SMTP_REGIONS.has(region)) {
+    throw new Error(
+      `calculateSmtpPassword: region "${region}" has no SES SMTP endpoint`
+    );
+  }
+  let signature = sign(Buffer.from(`AWS4${secretAccessKey}`, "utf8"), DATE);
+  signature = sign(signature, region);
+  signature = sign(signature, SERVICE);
+  signature = sign(signature, TERMINAL);
+  signature = sign(signature, MESSAGE);
+  const signatureAndVersion = Buffer.concat([
+    Buffer.from([VERSION]),
+    signature
+  ]);
+  return signatureAndVersion.toString("base64");
+}
+function smtpEndpoint(region) {
+  return `email-smtp.${region}.amazonaws.com`;
+}
+
+export {
+  SMTP_REGIONS,
+  calculateSmtpPassword,
+  smtpEndpoint
+};