@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/utils/exec-aws.cjs

@@ -0,0 +1,145 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let child_process = require("child_process");
+//#region src/commands/aws/utils/exec-aws.js
+/**
+* Error raised when the AWS CLI (or aws-vault) exits non-zero.
+* The `code` is the AWS service error code parsed from stderr (e.g. "UnauthorizedOperation").
+*/
+var AwsCliError = class extends Error {
+	/**
+	* @param {string} message
+	* @param {string | null} [code]
+	*/
+	constructor(message, code = null) {
+		super(message);
+		this.name = "AwsCliError";
+		this.code = code;
+	}
+};
+/**
+* Extract the AWS service error code from a CLI stderr string.
+* AWS prints codes in parentheses, e.g. "...(UnauthorizedOperation) when calling...".
+* @param {string} stderr
+* @returns {string | null}
+*/
+function parseAwsErrorCode(stderr) {
+	return /\(([A-Za-z.]+)\)/.exec(stderr)?.[1] ?? null;
+}
+/**
+* Verify that the given executables are available on PATH.
+* @param {string[]} commands
+* @throws {Error} If any command is missing
+*/
+function requireCommands(commands) {
+	const missing = commands.filter((command) => {
+		return (0, child_process.spawnSync)("which", [command], { stdio: "pipe" }).status !== 0;
+	});
+	if (missing.length > 0) throw new Error(`Required command(s) not found on PATH: ${missing.join(", ")}`);
+}
+/**
+* Run an AWS CLI command using a credential profile.
+* Uses an argument array (no shell) so JSON arguments need no escaping.
+* @param {{
+*   profile?: string;
+*   region?: string;
+*   args: string[];
+*   expectJson?: boolean;
+*   verbose?: boolean;
+*   env?: Record<string, string>;
+* }} params
+* @returns {any} Parsed JSON when expectJson is true, otherwise trimmed stdout string
+*/
+function runAws(params) {
+	const { profile, region, args, expectJson = true, verbose = false, env } = params;
+	/** @type {string[]} */
+	const finalArgs = [];
+	if (profile) finalArgs.push("--profile", profile);
+	if (region) finalArgs.push("--region", region);
+	finalArgs.push("--no-cli-pager", ...args);
+	if (expectJson) finalArgs.push("--output", "json");
+	return spawnAws("aws", finalArgs, {
+		expectJson,
+		verbose,
+		env
+	});
+}
+/**
+* Run an AWS CLI command through `aws-vault exec` for profiles whose credentials
+* are stored in the OS keychain rather than ~/.aws/credentials.
+* @param {{
+*   profile: string;
+*   args: string[];
+*   duration?: string;
+*   expectJson?: boolean;
+*   verbose?: boolean;
+* }} params
+* @returns {any}
+*/
+function runAwsVault(params) {
+	const { profile, args, duration = "15m", expectJson = true, verbose = false } = params;
+	/** @type {string[]} */
+	const awsArgs = ["--no-cli-pager", ...args];
+	if (expectJson) awsArgs.push("--output", "json");
+	return spawnAws("aws-vault", [
+		"exec",
+		profile,
+		"--duration",
+		duration,
+		"--",
+		"aws",
+		...awsArgs
+	], {
+		expectJson,
+		verbose
+	});
+}
+/**
+* @param {string} command
+* @param {string[]} args
+* @param {{ expectJson: boolean; verbose: boolean; env?: Record<string, string> }} options
+* @returns {any}
+*/
+function spawnAws(command, args, options) {
+	const { expectJson, verbose, env } = options;
+	if (verbose) console.log(chalk.default.gray(`   Executing: ${command} ${args.join(" ")}`));
+	const result = (0, child_process.spawnSync)(command, args, {
+		encoding: "utf-8",
+		env: env ? {
+			...process.env,
+			...env
+		} : process.env
+	});
+	if (result.error) throw new AwsCliError(result.error.message);
+	if (result.status !== 0) {
+		const stderr = (result.stderr || result.stdout || "").trim();
+		throw new AwsCliError(stderr || `Command failed: ${command} ${args.join(" ")}`, parseAwsErrorCode(stderr));
+	}
+	const stdout = (result.stdout ?? "").trim();
+	if (!expectJson) return stdout;
+	if (!stdout) return {};
+	return JSON.parse(stdout);
+}
+/**
+* Fetch the caller identity for a profile (account id and ARN).
+* @param {{ profile?: string; region?: string; verbose?: boolean }} params
+* @returns {{ Account: string; Arn: string; UserId: string }}
+*/
+function getCallerIdentity(params) {
+	const { profile, region, verbose } = params;
+	return runAws({
+		profile,
+		region,
+		args: ["sts", "get-caller-identity"],
+		verbose
+	});
+}
+//#endregion
+exports.AwsCliError = AwsCliError;
+exports.getCallerIdentity = getCallerIdentity;
+exports.parseAwsErrorCode = parseAwsErrorCode;
+exports.requireCommands = requireCommands;
+exports.runAws = runAws;
+exports.runAwsVault = runAwsVault;

package/cjs/commands/aws/utils/exec-aws.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Extract the AWS service error code from a CLI stderr string.
+ * AWS prints codes in parentheses, e.g. "...(UnauthorizedOperation) when calling...".
+ * @param {string} stderr
+ * @returns {string | null}
+ */
+export function parseAwsErrorCode(stderr: string): string | null;
+/**
+ * Verify that the given executables are available on PATH.
+ * @param {string[]} commands
+ * @throws {Error} If any command is missing
+ */
+export function requireCommands(commands: string[]): void;
+/**
+ * Run an AWS CLI command using a credential profile.
+ * Uses an argument array (no shell) so JSON arguments need no escaping.
+ * @param {{
+ *   profile?: string;
+ *   region?: string;
+ *   args: string[];
+ *   expectJson?: boolean;
+ *   verbose?: boolean;
+ *   env?: Record<string, string>;
+ * }} params
+ * @returns {any} Parsed JSON when expectJson is true, otherwise trimmed stdout string
+ */
+export function runAws(params: {
+    profile?: string;
+    region?: string;
+    args: string[];
+    expectJson?: boolean;
+    verbose?: boolean;
+    env?: Record<string, string>;
+}): any;
+/**
+ * Run an AWS CLI command through `aws-vault exec` for profiles whose credentials
+ * are stored in the OS keychain rather than ~/.aws/credentials.
+ * @param {{
+ *   profile: string;
+ *   args: string[];
+ *   duration?: string;
+ *   expectJson?: boolean;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {any}
+ */
+export function runAwsVault(params: {
+    profile: string;
+    args: string[];
+    duration?: string;
+    expectJson?: boolean;
+    verbose?: boolean;
+}): any;
+/**
+ * Fetch the caller identity for a profile (account id and ARN).
+ * @param {{ profile?: string; region?: string; verbose?: boolean }} params
+ * @returns {{ Account: string; Arn: string; UserId: string }}
+ */
+export function getCallerIdentity(params: {
+    profile?: string;
+    region?: string;
+    verbose?: boolean;
+}): {
+    Account: string;
+    Arn: string;
+    UserId: string;
+};
+/**
+ * Error raised when the AWS CLI (or aws-vault) exits non-zero.
+ * The `code` is the AWS service error code parsed from stderr (e.g. "UnauthorizedOperation").
+ */
+export class AwsCliError extends Error {
+    /**
+     * @param {string} message
+     * @param {string | null} [code]
+     */
+    constructor(message: string, code?: string | null);
+    code: string | null;
+}

package/cjs/commands/aws/utils/resolve-policy-path.cjs

@@ -0,0 +1,15 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let url = require("url");
+//#region src/commands/aws/utils/resolve-policy-path.js
+/**
+* Resolve the absolute path to a bundled IAM policy document.
+* Policies live alongside the source in `iam/policies/`, and the CLI runs from
+* source, so this path is valid at runtime.
+* @param {string} fileName - Policy JSON file name (e.g. "user-admins-write-list.json")
+* @returns {string}
+*/
+function resolvePolicyPath(fileName) {
+	return (0, url.fileURLToPath)(new URL(`../iam/policies/${fileName}`, require("url").pathToFileURL(__filename).href));
+}
+//#endregion
+exports.resolvePolicyPath = resolvePolicyPath;

package/cjs/commands/aws/utils/resolve-policy-path.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve the absolute path to a bundled IAM policy document.
+ * Policies live alongside the source in `iam/policies/`, and the CLI runs from
+ * source, so this path is valid at runtime.
+ * @param {string} fileName - Policy JSON file name (e.g. "user-admins-write-list.json")
+ * @returns {string}
+ */
+export function resolvePolicyPath(fileName: string): string;

package/cjs/commands/aws/utils/resolve-profile.cjs

@@ -0,0 +1,93 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("./tty.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let fs = require("fs");
+let path = require("path");
+let os = require("os");
+//#region src/commands/aws/utils/resolve-profile.js
+/**
+* Above this many matches we ask the user to narrow the filter rather than
+* printing an unusable wall of numbered options.
+*/
+const MAX_LISTED = 30;
+/**
+* Read profile names from ~/.aws/config (honoring AWS_CONFIG_FILE).
+* Handles both `[profile NAME]` entries and a bare `[default]` section.
+* @returns {string[]}
+*/
+function listConfigProfiles() {
+	const configPath = process.env.AWS_CONFIG_FILE ?? (0, path.join)((0, os.homedir)(), ".aws", "config");
+	let contents;
+	try {
+		contents = (0, fs.readFileSync)(configPath, "utf-8");
+	} catch {
+		return [];
+	}
+	/** @type {string[]} */
+	const profiles = [];
+	const profileRe = /^\[profile\s+(.+?)\]$/;
+	for (const rawLine of contents.split("\n")) {
+		const line = rawLine.trim();
+		const match = profileRe.exec(line);
+		if (match?.[1]) profiles.push(match[1].trim());
+		else if (line === "[default]") profiles.push("default");
+	}
+	return profiles;
+}
+/**
+* Interactively narrow a profile list by substring, then pick one.
+* A single match auto-selects; too many matches asks the user to narrow.
+* @param {string[]} profiles
+* @returns {Promise<string>}
+*/
+async function pickProfileInteractive(profiles) {
+	for (;;) {
+		const filter = (await require_commands_aws_utils_tty.prompt(chalk.default.cyan("Filter profiles (substring, Enter for all): "))).trim().toLowerCase();
+		const matches = filter ? profiles.filter((name) => name.toLowerCase().includes(filter)) : profiles;
+		if (matches.length === 0) {
+			console.log(chalk.default.yellow(`  No profiles match "${filter}". Try again.`));
+			continue;
+		}
+		if (matches.length === 1) {
+			const only = matches[0] ?? "";
+			console.log(chalk.default.green(`  → ${only}`));
+			return only;
+		}
+		if (matches.length > MAX_LISTED) {
+			console.log(chalk.default.yellow(`  ${matches.length} profiles match — narrow the filter (over ${MAX_LISTED} to list).`));
+			continue;
+		}
+		return matches[await require_commands_aws_utils_tty.promptChoice({
+			message: chalk.default.cyan("Select a profile:"),
+			options: matches
+		})] ?? "";
+	}
+}
+/**
+* Resolve the AWS profile for a single-profile command.
+*
+* Precedence: explicit `--profile`, then `AWS_PROFILE`, then — only when stdin
+* is a TTY — an interactive filter-and-pick over `~/.aws/config` profiles.
+* Returns `undefined` when nothing is set and we cannot prompt (non-interactive
+* shell, or no config profiles), leaving each command's existing "no profile"
+* handling in place.
+* @param {{ profile?: string; interactive?: boolean }} params
+* @returns {Promise<string | undefined>}
+*/
+async function resolveProfile(params) {
+	const explicit = params.profile ?? process.env.AWS_PROFILE;
+	if (explicit) return explicit;
+	if (!(params.interactive ?? Boolean(process.stdin.isTTY))) return;
+	const profiles = listConfigProfiles();
+	if (profiles.length === 0) return;
+	console.log(chalk.default.yellow("\nNo AWS profile selected (--profile and AWS_PROFILE are unset)."));
+	const chosen = await pickProfileInteractive(profiles);
+	console.log(chalk.default.gray(`Using profile "${chosen}" for this command.\n`));
+	return chosen;
+}
+//#endregion
+exports.listConfigProfiles = listConfigProfiles;
+exports.pickProfileInteractive = pickProfileInteractive;
+exports.resolveProfile = resolveProfile;

package/cjs/commands/aws/utils/resolve-profile.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Read profile names from ~/.aws/config (honoring AWS_CONFIG_FILE).
+ * Handles both `[profile NAME]` entries and a bare `[default]` section.
+ * @returns {string[]}
+ */
+export function listConfigProfiles(): string[];
+/**
+ * Interactively narrow a profile list by substring, then pick one.
+ * A single match auto-selects; too many matches asks the user to narrow.
+ * @param {string[]} profiles
+ * @returns {Promise<string>}
+ */
+export function pickProfileInteractive(profiles: string[]): Promise<string>;
+/**
+ * Resolve the AWS profile for a single-profile command.
+ *
+ * Precedence: explicit `--profile`, then `AWS_PROFILE`, then — only when stdin
+ * is a TTY — an interactive filter-and-pick over `~/.aws/config` profiles.
+ * Returns `undefined` when nothing is set and we cannot prompt (non-interactive
+ * shell, or no config profiles), leaving each command's existing "no profile"
+ * handling in place.
+ * @param {{ profile?: string; interactive?: boolean }} params
+ * @returns {Promise<string | undefined>}
+ */
+export function resolveProfile(params: {
+    profile?: string;
+    interactive?: boolean;
+}): Promise<string | undefined>;

package/cjs/commands/aws/utils/tty.cjs

@@ -0,0 +1,54 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let readline = require("readline");
+//#region src/commands/aws/utils/tty.js
+/**
+* Prompt for a single line of input.
+* @param {string} message - Prompt text shown to the user
+* @returns {Promise<string>}
+*/
+function prompt(message) {
+	return new Promise((resolve) => {
+		const rl = (0, readline.createInterface)({
+			input: process.stdin,
+			output: process.stdout
+		});
+		rl.question(message, (answer) => {
+			rl.close();
+			resolve(answer.trim());
+		});
+	});
+}
+/**
+* Prompt the user to pick one option from a numbered list.
+* @param {{ message: string; options: string[] }} params
+* @returns {Promise<number>} Zero-based index of the chosen option
+*/
+async function promptChoice(params) {
+	const { message, options } = params;
+	if (options.length === 0) throw new Error("promptChoice: no options to choose from");
+	console.log(message);
+	options.forEach((option, index) => {
+		console.log(`  ${index + 1}. ${option}`);
+	});
+	for (;;) {
+		const raw = await prompt("Enter number: ");
+		const choice = Number.parseInt(raw, 10);
+		if (Number.isInteger(choice) && choice >= 1 && choice <= options.length) return choice - 1;
+		console.log(`Please enter a number between 1 and ${options.length}.`);
+	}
+}
+/**
+* Prompt a yes/no question.
+* @param {{ message: string; defaultYes?: boolean }} params
+* @returns {Promise<boolean>}
+*/
+async function promptYesNo(params) {
+	const { message, defaultYes = false } = params;
+	const answer = (await prompt(`${message}${defaultYes ? " [Y/n]: " : " [y/N]: "}`)).toLowerCase();
+	if (answer === "") return defaultYes;
+	return answer === "y" || answer === "yes";
+}
+//#endregion
+exports.prompt = prompt;
+exports.promptChoice = promptChoice;
+exports.promptYesNo = promptYesNo;

package/cjs/commands/aws/utils/tty.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Prompt for a single line of input.
+ * @param {string} message - Prompt text shown to the user
+ * @returns {Promise<string>}
+ */
+export function prompt(message: string): Promise<string>;
+/**
+ * Prompt the user to pick one option from a numbered list.
+ * @param {{ message: string; options: string[] }} params
+ * @returns {Promise<number>} Zero-based index of the chosen option
+ */
+export function promptChoice(params: {
+    message: string;
+    options: string[];
+}): Promise<number>;
+/**
+ * Prompt a yes/no question.
+ * @param {{ message: string; defaultYes?: boolean }} params
+ * @returns {Promise<boolean>}
+ */
+export function promptYesNo(params: {
+    message: string;
+    defaultYes?: boolean;
+}): Promise<boolean>;