@mtndev/cli 1.1.0 → 2.0.1

package/CHANGELOG.md

@@ -1,5 +1,96 @@
 # @mtndev/cli
 
+## 2.0.1
+
+### Patch Changes
+
+- [#18](https://github.com/High-Country-Dev/core/pull/18) [`6afcc2a`](https://github.com/High-Country-Dev/core/commit/6afcc2a3d41b51afddd96adad77abae0b65b2e65) Thanks [@rnarcos](https://github.com/rnarcos)! - Fixed the published CLI crashing on every invocation with `SyntaxError: Cannot use 'import.meta' outside a module`. The CJS build (the target of the published `bin`) contained a raw `import.meta.url`: tsup's experimental CJS code splitting transpiles via sucrase, which leaves `import.meta` untouched. The build pipeline (libsync) was upgraded to 2.0.0, which replaces tsup with tsdown (Rolldown): `import.meta.url` is now rewritten inline per module for CJS output, the module structure is preserved 1:1 (no chunk relocation), and the bundled IAM policy JSON documents are shipped alongside the compiled code — so the original `resolvePolicyPath` design works as written. No CLI interface changes.
+
+- [#16](https://github.com/High-Country-Dev/core/pull/16) [`4a43df1`](https://github.com/High-Country-Dev/core/commit/4a43df1064325da93a69df798c9213178b1027c8) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Add Vitest testing infrastructure for `@mtndev/cli`: a Node-environment Vitest
+  setup with seed tests for the Doppler command utilities and schemas, wired into
+  Turbo and the PR CI checks. Tests are colocated under `src/` (so they are
+  typechecked, linted, and formatted) and excluded from the published build via
+  `libsync` ignore globs and `tsconfig.build.json`, so no test files ship in the
+  `cjs`/`esm` output. No runtime behavior changes.
+
+## 2.0.0
+
+### Major Changes
+
+- [#10](https://github.com/High-Country-Dev/core/pull/10) [`c194a34`](https://github.com/High-Country-Dev/core/commit/c194a34266e500a6d8ab4ae5d292e6d875b36549) Thanks [@rnarcos](https://github.com/rnarcos)! - Renamed `--environment` to `--environments` and added support for comma-separated environment lists. Added `clone` subcommand for cloning secrets between Doppler projects.
+
+  **Breaking change:** `--environment` has been replaced by `--environments`.
+
+  **Who is affected:** You are **not** affected if you only use the `-e` shorthand — it is preserved and works unchanged with all existing values (`-e dev`, `-e stg`, `-e prd`, `-e all`). You **are** affected if you use the verbose `--environment` flag in any script or alias.
+
+  **Migration:**
+
+  Replace `--environment` with `--environments` in any script using the verbose flag. The `-e` shorthand, and all existing values (`dev`, `stg`, `prd`, `all`) continue to work unchanged. You may now also pass comma-separated values to target multiple environments at once.
+
+  ```shell
+  # Before
+  mtndev doppler download --environment dev
+  mtndev doppler upload --environment prd
+
+  # After
+  mtndev doppler download --environments dev
+  mtndev doppler upload --environments prd
+
+  # New: multiple environments at once
+  mtndev doppler download --environments dev,stg
+
+  # New: clone secrets between projects
+  mtndev doppler clone --from my-app --to my-app-copy
+  mtndev doppler clone --from my-app --to my-app-copy -e dev,stg
+  ```
+
+### Minor Changes
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Add a nested `mtn aws` command group with IAM, EC2, and SES operational commands ported from the internal scripts repo:
+  - `aws iam setup-acl` — idempotently create the ACL groups, their managed policies, and (optionally) users
+  - `aws iam users` — interactively create IAM users and assign them to the matching ACL group
+  - `aws iam check-admin` — alert if anyone is a member of the break-glass `acl-admin-do-not-use` group
+  - `aws iam remove-admin` — remove users from `acl-admin-do-not-use` to revoke break-glass access
+  - `aws iam break-glass` — grant break-glass admin access by adding a user (default: your own IAM user) to `acl-admin-do-not-use` for one profile
+  - `aws ec2 allow-ip` — update or create a roaming SSH ingress rule for your current public IP
+  - `aws ses send-email` — send a test email via the SES API or SMTP
+
+  `check-admin` and `remove-admin` scan a single profile (`--profile` or `AWS_PROFILE`) or every `aws-vault` profile with `--all`, trying stored credentials first and falling back to `aws-vault exec`.
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added an interactive AWS profile picker to the `mtn aws` commands. When a single-profile command (`iam setup-acl`, `iam users`, `iam break-glass`, `ec2 allow-ip`, `route53 add-record` / `remove-record`, and `ses send-email` over the API transport) runs with neither `--profile` nor `AWS_PROFILE` set and you're at a terminal, it now prompts with a substring-filtered picker over the profiles in `~/.aws/config` instead of silently falling back to the `default` profile. A single filter match auto-selects, and the choice applies to that one invocation only (a child process can't export `AWS_PROFILE` to your shell). Non-interactive contexts (no TTY, e.g. CI) skip the picker and keep the previous behavior. `check-admin` / `remove-admin` are intentionally excluded, where an unset profile already means "scan every aws-vault profile".
+
+  ```shell
+  mtn aws route53 add-record   # no profile set → filter & pick, then continues
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn db create-readonly-user` to create a read-only MySQL or Postgres user on one database or all databases. Example:
+
+  ```shell
+  mtn db create-readonly-user -e postgres -u "$DATABASE_URL" -d all --yes
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn doppler set` to interactively (or via flags) add or update a secret by picking project, environment, and config. Example:
+
+  ```shell
+  mtn doppler set -p core --environment dev -c dev --name API_KEY --value secret --yes
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn aws route53 add-record` to interactively (or via flags) create or update a DNS record in a Route53 hosted zone, with clear create / overwrite / append feedback. Example:
+
+  ```shell
+  mtn aws route53 add-record -z mountaindev.com -t CNAME -n redline --value eb34fd3576733d80.vercel-dns-016.com.
+  ```
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Added `mtn aws route53 remove-record` to interactively (or via flags) delete a DNS record from a Route53 hosted zone, showing the record it found and confirming before deleting (alias records included). Also taught `add-record` to detect CNAME conflicts up front — Route53 forbids a CNAME from coexisting with any other record type at the same name, so it now stops with a clear message (and points you at `remove-record`) instead of surfacing the raw `InvalidChangeBatch` error. Example:
+
+  ```shell
+  mtn aws route53 remove-record -z etymologyexplorer.com -t CNAME -n wotd --yes
+  ```
+
+### Patch Changes
+
+- [#15](https://github.com/High-Country-Dev/core/pull/15) [`36580db`](https://github.com/High-Country-Dev/core/commit/36580db5ab3f7b17552a44bc0f198fe768d3fcdd) Thanks [@dnishiyama](https://github.com/dnishiyama)! - Updated `mtn aws iam users` to default the account slug from the caller profile / IAM ARN (e.g. `md-declan-thespeckledtrout-iam-admin` → `thespeckledtrout`). Press Enter to accept, or type a different value; `--account-name` still skips the prompt.
+
 ## 1.1.0
 
 ### Minor Changes

package/cjs/__chunks/VH7oDXx4.cjs

@@ -0,0 +1,28 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});

package/cjs/commands/aws/ec2/allow-ip/handler.cjs

@@ -0,0 +1,261 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_ec2_allow_ip_schema = require("./schema.cjs");
+const require_commands_aws_ec2_allow_ip_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/ec2/allow-ip/handler.js
+/**
+* Resolve which region to operate in: explicit, else default if it has instances,
+* else prompt from the enabled regions.
+* @param {{ profile?: string; region?: string; verbose: boolean }} params
+* @returns {Promise<string>}
+*/
+async function resolveRegion(params) {
+	const { profile, region, verbose } = params;
+	if (region) return region;
+	if (require_commands_aws_ec2_allow_ip_utils.listInstances({
+		profile,
+		region: "us-east-1",
+		verbose
+	}).length > 0) return require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION;
+	const regions = require_commands_aws_ec2_allow_ip_utils.listEnabledRegions({
+		profile,
+		region: require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION,
+		verbose
+	});
+	if (regions.length === 0) throw new Error("No enabled AWS regions found for this profile");
+	console.log(`No EC2 instances found in ${require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION}.`);
+	const chosen = regions[await require_commands_aws_utils_tty.promptChoice({
+		message: "Choose a region:",
+		options: regions
+	})];
+	if (!chosen) throw new Error("No region selected");
+	return chosen;
+}
+/**
+* Handle errors from authorize/revoke with the same UX as the original script.
+* Returns when the situation is benign (duplicate); exits the process on a
+* permissions failure; rethrows anything else.
+* @param {AwsCliError} error
+* @param {{
+*   securityGroup: import("./utils.js").SecurityGroup;
+*   sshRules: import("./utils.js").SshIngressRule[];
+*   newCidr: string;
+*   ruleDescription: string;
+*   action: "create" | "update";
+* }} ctx
+*/
+function handleRuleChangeError(error, ctx) {
+	const { securityGroup, sshRules, newCidr, ruleDescription, action } = ctx;
+	if (error.code === "InvalidPermission.Duplicate") {
+		const matching = require_commands_aws_ec2_allow_ip_utils.ruleAlreadyAllowsIp(sshRules, newCidr);
+		const label = matching ? matching.description : ruleDescription;
+		console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`);
+		return;
+	}
+	if (error.code === "UnauthorizedOperation") {
+		console.error(`Could not ${action} the SSH rule: your AWS profile does not have ec2:AuthorizeSecurityGroupIngress or ec2:RevokeSecurityGroupIngress on ${securityGroup.groupName} (${securityGroup.groupId}).`);
+		console.error("");
+		console.error("Current single-host SSH rules on port 22:");
+		require_commands_aws_ec2_allow_ip_utils.printSshRules(sshRules, (message) => console.error(message));
+		if (action === "create" && sshRules.length > 0) {
+			console.error("");
+			console.error("A rule may already exist. Re-run to update your named roaming rule, or ask an admin to grant security group ingress permissions.");
+		}
+		process.exit(1);
+	}
+	throw error;
+}
+/**
+* `aws ec2 allow-ip` handler: update or create a named roaming SSH rule for the
+* caller's current public IP on a chosen EC2 instance's security group.
+* @param {unknown} options
+*/
+async function allowIpCommand(options) {
+	try {
+		const { profile: profileOption, region: regionOption, ruleName, verbose } = require_commands_aws_ec2_allow_ip_schema.allowIpOptionsSchema.parse(options);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		if (!profile) {
+			console.error(chalk.default.red("Error: pass --profile or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			region: require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION,
+			verbose
+		});
+		const firstName = require_commands_aws_ec2_allow_ip_utils.extractRoamingFirstName({
+			profile,
+			identity
+		});
+		const ruleDescription = ruleName ?? require_commands_aws_ec2_allow_ip_utils.roamingRuleDescription(firstName);
+		console.log("Caller:");
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log(`  Roaming rule: ${ruleDescription}`);
+		console.log("");
+		const region = await resolveRegion({
+			profile,
+			region: regionOption,
+			verbose
+		});
+		console.log(`Region: ${region}`);
+		console.log("");
+		const instances = require_commands_aws_ec2_allow_ip_utils.listInstances({
+			profile,
+			region,
+			verbose
+		});
+		if (instances.length === 0) {
+			console.log(`No EC2 instances found in ${region}.`);
+			process.exit(1);
+		}
+		const instance = instances[await require_commands_aws_utils_tty.promptChoice({
+			message: "Choose an EC2 instance:",
+			options: instances.map((instance) => require_commands_aws_ec2_allow_ip_utils.instanceLabel(instance))
+		})];
+		if (!instance) throw new Error("No instance selected");
+		console.log("");
+		const securityGroups = require_commands_aws_ec2_allow_ip_utils.describeSecurityGroups({
+			profile,
+			region,
+			groupIds: instance.securityGroupIds,
+			verbose
+		});
+		if (securityGroups.length === 0) {
+			console.log("No security groups found on the selected instance.");
+			process.exit(1);
+		}
+		let securityGroup;
+		if (securityGroups.length === 1) {
+			const onlyGroup = securityGroups[0];
+			if (!onlyGroup) throw new Error("No security group found on the selected instance");
+			securityGroup = onlyGroup;
+			console.log(`Security group: ${require_commands_aws_ec2_allow_ip_utils.securityGroupLabel(securityGroup)}`);
+		} else securityGroup = securityGroups[await require_commands_aws_utils_tty.promptChoice({
+			message: "Choose a security group:",
+			options: securityGroups.map((group) => require_commands_aws_ec2_allow_ip_utils.securityGroupLabel(group))
+		})];
+		if (!securityGroup) throw new Error("No security group selected");
+		console.log("");
+		const currentIp = await require_commands_aws_ec2_allow_ip_utils.getCurrentPublicIp();
+		const newCidr = `${currentIp}/32`;
+		console.log(`Current public IP: ${currentIp}`);
+		console.log("");
+		const sgDetails = require_commands_aws_ec2_allow_ip_utils.getSecurityGroupDetails({
+			profile,
+			region,
+			groupId: securityGroup.groupId,
+			verbose
+		});
+		if (!sgDetails) {
+			console.log("Could not load security group details.");
+			process.exit(1);
+		}
+		const sshRules = require_commands_aws_ec2_allow_ip_utils.listSshIngressRules(sgDetails);
+		const roamingRule = require_commands_aws_ec2_allow_ip_utils.resolveRoamingRule(sshRules, ruleDescription);
+		if (roamingRule && roamingRule.cidrIp === newCidr) {
+			console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${ruleDescription}). Nothing to do.`);
+			return;
+		}
+		const otherRuleAtIp = require_commands_aws_ec2_allow_ip_utils.ruleAlreadyAllowsIp(sshRules, newCidr);
+		if (otherRuleAtIp && (!roamingRule || otherRuleAtIp.cidrIp !== roamingRule.cidrIp)) {
+			const label = otherRuleAtIp.description || "(no description)";
+			console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`);
+			return;
+		}
+		if (roamingRule) {
+			console.log(`Updating SSH rule (${ruleDescription}): ${roamingRule.cidrIp} -> ${newCidr}`);
+			try {
+				require_commands_aws_ec2_allow_ip_utils.revokeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					rule: roamingRule,
+					verbose
+				});
+				require_commands_aws_ec2_allow_ip_utils.authorizeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					cidrIp: newCidr,
+					description: ruleDescription,
+					fromPort: roamingRule.fromPort,
+					toPort: roamingRule.toPort,
+					ipProtocol: roamingRule.ipProtocol,
+					verbose
+				});
+			} catch (error) {
+				if (error instanceof require_commands_aws_utils_exec_aws.AwsCliError) {
+					handleRuleChangeError(error, {
+						securityGroup,
+						sshRules,
+						newCidr,
+						ruleDescription,
+						action: "update"
+					});
+					return;
+				}
+				throw error;
+			}
+		} else {
+			if (sshRules.length > 0) {
+				console.log("Existing single-host SSH rules (unchanged):");
+				require_commands_aws_ec2_allow_ip_utils.printSshRules(sshRules);
+				console.log("");
+			}
+			console.log(`Creating new "${ruleDescription}" SSH rule for ${newCidr}`);
+			try {
+				require_commands_aws_ec2_allow_ip_utils.authorizeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					cidrIp: newCidr,
+					description: ruleDescription,
+					verbose
+				});
+			} catch (error) {
+				if (error instanceof require_commands_aws_utils_exec_aws.AwsCliError) {
+					handleRuleChangeError(error, {
+						securityGroup,
+						sshRules,
+						newCidr,
+						ruleDescription,
+						action: "create"
+					});
+					return;
+				}
+				throw error;
+			}
+		}
+		console.log("");
+		console.log(`Done. ${securityGroup.groupName} (${securityGroup.groupId}) now allows SSH from ${newCidr} (${ruleDescription}).`);
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ allow-ip failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.allowIpCommand = allowIpCommand;

package/cjs/commands/aws/ec2/allow-ip/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws ec2 allow-ip` handler: update or create a named roaming SSH rule for the
+ * caller's current public IP on a chosen EC2 instance's security group.
+ * @param {unknown} options
+ */
+export function allowIpCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/ec2/allow-ip/index.cjs

@@ -0,0 +1,25 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ec2_allow_ip_schema = require("./schema.cjs");
+const require_commands_aws_ec2_allow_ip_utils = require("./utils.cjs");
+const require_commands_aws_ec2_allow_ip_handler = require("./handler.cjs");
+exports.DEFAULT_REGION = require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION;
+exports.DEFAULT_ROAMING_NAME = require_commands_aws_ec2_allow_ip_schema.DEFAULT_ROAMING_NAME;
+exports.SSH_PORT = require_commands_aws_ec2_allow_ip_schema.SSH_PORT;
+exports.allowIpCommand = require_commands_aws_ec2_allow_ip_handler.allowIpCommand;
+exports.allowIpOptionsSchema = require_commands_aws_ec2_allow_ip_schema.allowIpOptionsSchema;
+exports.authorizeRule = require_commands_aws_ec2_allow_ip_utils.authorizeRule;
+exports.describeSecurityGroups = require_commands_aws_ec2_allow_ip_utils.describeSecurityGroups;
+exports.extractRoamingFirstName = require_commands_aws_ec2_allow_ip_utils.extractRoamingFirstName;
+exports.getCurrentPublicIp = require_commands_aws_ec2_allow_ip_utils.getCurrentPublicIp;
+exports.getSecurityGroupDetails = require_commands_aws_ec2_allow_ip_utils.getSecurityGroupDetails;
+exports.instanceLabel = require_commands_aws_ec2_allow_ip_utils.instanceLabel;
+exports.listEnabledRegions = require_commands_aws_ec2_allow_ip_utils.listEnabledRegions;
+exports.listInstances = require_commands_aws_ec2_allow_ip_utils.listInstances;
+exports.listSshIngressRules = require_commands_aws_ec2_allow_ip_utils.listSshIngressRules;
+exports.printSshRules = require_commands_aws_ec2_allow_ip_utils.printSshRules;
+exports.resolveRoamingRule = require_commands_aws_ec2_allow_ip_utils.resolveRoamingRule;
+exports.revokeRule = require_commands_aws_ec2_allow_ip_utils.revokeRule;
+exports.roamingRuleDescription = require_commands_aws_ec2_allow_ip_utils.roamingRuleDescription;
+exports.ruleAlreadyAllowsIp = require_commands_aws_ec2_allow_ip_utils.ruleAlreadyAllowsIp;
+exports.securityGroupLabel = require_commands_aws_ec2_allow_ip_utils.securityGroupLabel;
+exports.sshRuleLabel = require_commands_aws_ec2_allow_ip_utils.sshRuleLabel;

package/cjs/commands/aws/ec2/allow-ip/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/ec2/allow-ip/schema.cjs

@@ -0,0 +1,33 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/ec2/allow-ip/schema.js
+/**
+* Default region checked first before prompting.
+*/
+const DEFAULT_REGION = "us-east-1";
+/**
+* SSH port managed by this command.
+*/
+const SSH_PORT = 22;
+/**
+* Fallback first name when one cannot be derived from the profile/IAM user.
+*/
+const DEFAULT_ROAMING_NAME = "Declan";
+/**
+* Zod schema for `aws ec2 allow-ip` options.
+*/
+const allowIpOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	region: require_commands_aws_schema.regionField,
+	ruleName: zod.z.string().optional().describe("SSH rule description to update or create (default: \"{FirstName} Roaming\" derived from the profile/IAM user)"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof allowIpOptionsSchema>} AllowIpOptions
+*/
+//#endregion
+exports.DEFAULT_REGION = DEFAULT_REGION;
+exports.DEFAULT_ROAMING_NAME = DEFAULT_ROAMING_NAME;
+exports.SSH_PORT = SSH_PORT;
+exports.allowIpOptionsSchema = allowIpOptionsSchema;

package/cjs/commands/aws/ec2/allow-ip/schema.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Default region checked first before prompting.
+ */
+export const DEFAULT_REGION: "us-east-1";
+/**
+ * SSH port managed by this command.
+ */
+export const SSH_PORT: 22;
+/**
+ * Fallback first name when one cannot be derived from the profile/IAM user.
+ */
+export const DEFAULT_ROAMING_NAME: "Declan";
+/**
+ * Zod schema for `aws ec2 allow-ip` options.
+ */
+export const allowIpOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    ruleName: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    profile?: string | undefined;
+    region?: string | undefined;
+    ruleName?: string | undefined;
+}, {
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    ruleName?: string | undefined;
+}>;
+export type AllowIpOptions = z.infer<typeof allowIpOptionsSchema>;
+import { z } from "zod";