@mtndev/cli 1.1.0 → 2.0.1

package/esm/commands/db/create-readonly-user/schema.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Supported database engines.
+ * @type {readonly ["postgres", "mysql"]}
+ */
+export const ENGINES: readonly ["postgres", "mysql"];
+/**
+ * Zod schema for `db create-readonly-user` options.
+ */
+export const createReadonlyUserOptionsSchema: z.ZodObject<{
+    engine: z.ZodOptional<z.ZodEnum<["postgres", "mysql"]>>;
+    url: z.ZodOptional<z.ZodString>;
+    database: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    hostPattern: z.ZodOptional<z.ZodString>;
+    ssl: z.ZodOptional<z.ZodBoolean>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    dryRun: boolean;
+    username?: string | undefined;
+    url?: string | undefined;
+    engine?: "postgres" | "mysql" | undefined;
+    password?: string | undefined;
+    database?: string | undefined;
+    ssl?: boolean | undefined;
+    hostPattern?: string | undefined;
+}, {
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    username?: string | undefined;
+    url?: string | undefined;
+    engine?: "postgres" | "mysql" | undefined;
+    password?: string | undefined;
+    database?: string | undefined;
+    ssl?: boolean | undefined;
+    hostPattern?: string | undefined;
+}>;
+/**
+ * @typedef {z.infer<typeof createReadonlyUserOptionsSchema>} CreateReadonlyUserOptions
+ */
+/**
+ * Default username when none is provided.
+ */
+export const DEFAULT_READONLY_USERNAME: "readonly";
+/**
+ * Default MySQL host pattern (any client host).
+ */
+export const DEFAULT_MYSQL_HOST_PATTERN: "%";
+export type CreateReadonlyUserOptions = z.infer<typeof createReadonlyUserOptionsSchema>;
+import { z } from "zod";

package/esm/commands/db/create-readonly-user/schema.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+//#region src/commands/db/create-readonly-user/schema.js
+/**
+* Supported database engines.
+* @type {readonly ["postgres", "mysql"]}
+*/
+const ENGINES = ["postgres", "mysql"];
+/**
+* Zod schema for `db create-readonly-user` options.
+*/
+const createReadonlyUserOptionsSchema = z.object({
+	engine: z.enum(["postgres", "mysql"]).optional().describe("Database engine (postgres or mysql); inferred from --url when omitted"),
+	url: z.string().optional().describe("Admin connection URL (postgres://… or mysql://…). Defaults to DATABASE_URL / MYSQL_URL / POSTGRES_URL."),
+	database: z.string().optional().describe("Target database name, or \"all\" for every non-system database"),
+	username: z.string().optional().describe("Read-only username to create (default: readonly)"),
+	password: z.string().optional().describe("Password for the new user (generated when omitted)"),
+	hostPattern: z.string().optional().describe("MySQL user host pattern (default: %)"),
+	ssl: z.boolean().optional().describe("Force SSL on/off. Default: off for localhost, on (loose) for remote hosts."),
+	yes: z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+	dryRun: z.boolean().optional().default(false).describe("Print the SQL plan without applying it"),
+	verbose: z.boolean().optional().default(false).describe("Enable verbose logging")
+});
+/**
+* @typedef {z.infer<typeof createReadonlyUserOptionsSchema>} CreateReadonlyUserOptions
+*/
+/**
+* Default username when none is provided.
+*/
+const DEFAULT_READONLY_USERNAME = "readonly";
+/**
+* Default MySQL host pattern (any client host).
+*/
+const DEFAULT_MYSQL_HOST_PATTERN = "%";
+//#endregion
+export { DEFAULT_MYSQL_HOST_PATTERN, DEFAULT_READONLY_USERNAME, ENGINES, createReadonlyUserOptionsSchema };

package/esm/commands/db/create-readonly-user/utils.d.ts

@@ -0,0 +1,112 @@
+/**
+ * @typedef {"postgres" | "mysql"} Engine
+ */
+/**
+ * @typedef {Object} ConnectionConfig
+ * @property {Engine} engine
+ * @property {string} host
+ * @property {number} port
+ * @property {string} user
+ * @property {string} password
+ * @property {string} database
+ * @property {boolean | object} ssl
+ * @property {string} [url]
+ */
+/**
+ * Generate a URL-safe random password.
+ * @param {{ length?: number }} [params]
+ * @returns {string}
+ */
+export function generatePassword(params?: {
+    length?: number;
+}): string;
+/**
+ * Detect engine from a connection URL scheme.
+ * @param {string} url
+ * @returns {Engine | null}
+ */
+export function detectEngineFromUrl(url: string): Engine | null;
+/**
+ * Resolve an admin URL from flags / common env vars.
+ * @param {{ url?: string; engine?: Engine }} params
+ * @returns {string | null}
+ */
+export function resolveAdminUrl(params: {
+    url?: string;
+    engine?: Engine;
+}): string | null;
+/**
+ * Decide SSL settings: remote hosts get loose SSL by default (RDS-friendly).
+ * @param {{ host: string; sslOption?: boolean }} params
+ * @returns {boolean | object}
+ */
+export function resolveSsl(params: {
+    host: string;
+    sslOption?: boolean;
+}): boolean | object;
+/**
+ * Parse a postgres/mysql connection URL into a config object.
+ * @param {{ url: string; engine?: Engine; sslOption?: boolean }} params
+ * @returns {ConnectionConfig}
+ */
+export function parseConnectionUrl(params: {
+    url: string;
+    engine?: Engine;
+    sslOption?: boolean;
+}): ConnectionConfig;
+/**
+ * Build a client connection URL for the new read-only user.
+ * @param {{
+ *   engine: Engine;
+ *   host: string;
+ *   port: number;
+ *   username: string;
+ *   password: string;
+ *   database: string;
+ * }} params
+ * @returns {string}
+ */
+export function buildReadonlyUrl(params: {
+    engine: Engine;
+    host: string;
+    port: number;
+    username: string;
+    password: string;
+    database: string;
+}): string;
+/**
+ * Quote an identifier for the given engine (not for string literals).
+ * @param {{ engine: Engine; name: string }} params
+ * @returns {string}
+ */
+export function quoteIdent(params: {
+    engine: Engine;
+    name: string;
+}): string;
+/**
+ * Escape a string literal for SQL (single-quote doubling).
+ * Prefer parameterized queries when the driver supports them for DDL.
+ * @param {string} value
+ * @returns {string}
+ */
+export function quoteLiteral(value: string): string;
+/**
+ * System / template databases to skip when granting "all".
+ * @param {{ engine: Engine; name: string }} params
+ * @returns {boolean}
+ */
+export function isSystemDatabase(params: {
+    engine: Engine;
+    name: string;
+}): boolean;
+export type Engine = "postgres" | "mysql";
+export type ConnectionConfig = {
+    engine: Engine;
+    host: string;
+    port: number;
+    user: string;
+    password: string;
+    database: string;
+    ssl: boolean | object;
+    url?: string | undefined;
+};

package/esm/commands/db/create-readonly-user/utils.js

@@ -0,0 +1,151 @@
+import { randomBytes } from "crypto";
+//#region src/commands/db/create-readonly-user/utils.js
+/**
+* @typedef {"postgres" | "mysql"} Engine
+*/
+/**
+* @typedef {Object} ConnectionConfig
+* @property {Engine} engine
+* @property {string} host
+* @property {number} port
+* @property {string} user
+* @property {string} password
+* @property {string} database
+* @property {boolean | object} ssl
+* @property {string} [url]
+*/
+/**
+* Generate a URL-safe random password.
+* @param {{ length?: number }} [params]
+* @returns {string}
+*/
+function generatePassword(params = {}) {
+	const { length = 24 } = params;
+	const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*";
+	const bytes = randomBytes(length);
+	let result = "";
+	for (let i = 0; i < length; i += 1) {
+		const byte = bytes[i] ?? 0;
+		result += alphabet[byte % 65];
+	}
+	return result;
+}
+/**
+* Detect engine from a connection URL scheme.
+* @param {string} url
+* @returns {Engine | null}
+*/
+function detectEngineFromUrl(url) {
+	const trimmed = url.trim().toLowerCase();
+	if (trimmed.startsWith("postgres://") || trimmed.startsWith("postgresql://")) return "postgres";
+	if (trimmed.startsWith("mysql://") || trimmed.startsWith("mysql2://")) return "mysql";
+	return null;
+}
+/**
+* Resolve an admin URL from flags / common env vars.
+* @param {{ url?: string; engine?: Engine }} params
+* @returns {string | null}
+*/
+function resolveAdminUrl(params) {
+	const { url, engine } = params;
+	if (url) return url;
+	if (engine === "mysql") return process.env.MYSQL_URL ?? process.env.DATABASE_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
+	if (engine === "postgres") return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? null;
+	return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? process.env.MYSQL_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
+}
+/**
+* Decide SSL settings: remote hosts get loose SSL by default (RDS-friendly).
+* @param {{ host: string; sslOption?: boolean }} params
+* @returns {boolean | object}
+*/
+function resolveSsl(params) {
+	const { host, sslOption } = params;
+	if (sslOption === true) return { rejectUnauthorized: false };
+	if (sslOption === false) return false;
+	if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "0.0.0.0") return false;
+	return { rejectUnauthorized: false };
+}
+/**
+* Parse a postgres/mysql connection URL into a config object.
+* @param {{ url: string; engine?: Engine; sslOption?: boolean }} params
+* @returns {ConnectionConfig}
+*/
+function parseConnectionUrl(params) {
+	const { url, engine: engineOption, sslOption } = params;
+	const engine = engineOption ?? detectEngineFromUrl(url);
+	if (!engine) throw new Error(`Could not detect engine from URL. Pass --engine postgres|mysql. URL starts with: ${url.slice(0, 24)}…`);
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid connection URL: ${url}`);
+	}
+	const defaultPort = engine === "postgres" ? 5432 : 3306;
+	const port = parsed.port ? Number.parseInt(parsed.port, 10) : defaultPort;
+	const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")) || (engine === "postgres" ? "postgres" : "");
+	const host = parsed.hostname || "localhost";
+	const user = decodeURIComponent(parsed.username || "");
+	const password = decodeURIComponent(parsed.password || "");
+	if (!user) throw new Error("Connection URL is missing a username");
+	return {
+		engine,
+		host,
+		port: Number.isFinite(port) ? port : defaultPort,
+		user,
+		password,
+		database,
+		ssl: resolveSsl({
+			host,
+			sslOption
+		}),
+		url
+	};
+}
+/**
+* Build a client connection URL for the new read-only user.
+* @param {{
+*   engine: Engine;
+*   host: string;
+*   port: number;
+*   username: string;
+*   password: string;
+*   database: string;
+* }} params
+* @returns {string}
+*/
+function buildReadonlyUrl(params) {
+	const { engine, host, port, username, password, database } = params;
+	return `${engine === "postgres" ? "postgresql" : "mysql"}://${`${encodeURIComponent(username)}:${encodeURIComponent(password)}`}@${host}:${port}${database ? `/${encodeURIComponent(database)}` : "/"}`;
+}
+/**
+* Quote an identifier for the given engine (not for string literals).
+* @param {{ engine: Engine; name: string }} params
+* @returns {string}
+*/
+function quoteIdent(params) {
+	const { engine, name } = params;
+	if (engine === "postgres") return `"${name.replace(/"/g, "\"\"")}"`;
+	return `\`${name.replace(/`/g, "``")}\``;
+}
+/**
+* Escape a string literal for SQL (single-quote doubling).
+* Prefer parameterized queries when the driver supports them for DDL.
+* @param {string} value
+* @returns {string}
+*/
+function quoteLiteral(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+* System / template databases to skip when granting "all".
+* @param {{ engine: Engine; name: string }} params
+* @returns {boolean}
+*/
+function isSystemDatabase(params) {
+	const { engine, name } = params;
+	const lower = name.toLowerCase();
+	if (engine === "postgres") return lower === "template0" || lower === "template1" || lower === "rdsadmin" || lower === "cloudsqladmin";
+	return lower === "information_schema" || lower === "performance_schema" || lower === "mysql" || lower === "sys" || lower === "innodb" || lower === "#mysql50#lost+found";
+}
+//#endregion
+export { buildReadonlyUrl, detectEngineFromUrl, generatePassword, isSystemDatabase, parseConnectionUrl, quoteIdent, quoteLiteral, resolveAdminUrl, resolveSsl };

package/esm/commands/db/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Register the `db` command group and its subcommands on the root program.
+ * @param {import('commander').Command} program
+ */
+export function registerDbCommands(program: import("commander").Command): void;
+export * from "./create-readonly-user/index.js";

package/esm/commands/db/index.js

@@ -0,0 +1,31 @@
+import { buildReadonlyUrl, detectEngineFromUrl, generatePassword, isSystemDatabase, parseConnectionUrl, quoteIdent, quoteLiteral, resolveAdminUrl, resolveSsl } from "./create-readonly-user/utils.js";
+import { DEFAULT_MYSQL_HOST_PATTERN, DEFAULT_READONLY_USERNAME, ENGINES, createReadonlyUserOptionsSchema } from "./create-readonly-user/schema.js";
+import { createReadonlyUserCommand } from "./create-readonly-user/handler.js";
+import "./create-readonly-user/index.js";
+//#region src/commands/db/index.js
+/**
+* Register the `db` command group and its subcommands on the root program.
+* @param {import('commander').Command} program
+*/
+function registerDbCommands(program) {
+	program.command("db").summary("Database operational commands").description("Database operational helpers (MySQL and Postgres)").command("create-readonly-user").summary("Create a read-only database user").description("Create (or update) a read-only database user on MySQL or Postgres. Interactively pick a single database or all databases, then print a connection URL.").option("-e, --engine <engine>", "Database engine: postgres or mysql (inferred from --url when omitted)").option("-u, --url <url>", "Admin connection URL (defaults to DATABASE_URL / MYSQL_URL / POSTGRES_URL)").option("-d, --database <name>", "Target database name, or \"all\" for every non-system database").option("--username <name>", "Read-only username to create (default: readonly)").option("--password <password>", "Password for the new user (generated when omitted)").option("--host-pattern <pattern>", "MySQL user host pattern (default: %)").option("--ssl", "Force SSL on (loose verify — useful for RDS)").option("--no-ssl", "Force SSL off").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Print the SQL plan without applying it").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		/** @type {boolean | undefined} */
+		let ssl;
+		if (options.ssl === true) ssl = true;
+		else if (options.noSsl === true) ssl = false;
+		await createReadonlyUserCommand({
+			engine: options.engine,
+			url: options.url,
+			database: options.database,
+			username: options.username,
+			password: options.password,
+			hostPattern: options.hostPattern,
+			ssl,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+}
+//#endregion
+export { DEFAULT_MYSQL_HOST_PATTERN, DEFAULT_READONLY_USERNAME, ENGINES, buildReadonlyUrl, createReadonlyUserCommand, createReadonlyUserOptionsSchema, detectEngineFromUrl, generatePassword, isSystemDatabase, parseConnectionUrl, quoteIdent, quoteLiteral, registerDbCommands, resolveAdminUrl, resolveSsl };

package/esm/commands/doppler/handler.js

@@ -1,9 +1,92 @@
-import {
-  dopplerCommand
-} from "../../__chunks/6L5RNR7G.js";
-import "../../__chunks/O262GK4B.js";
-import "../../__chunks/SJXQJ7RS.js";
-import "../../__chunks/X3R5PSWH.js";
-export {
-  dopplerCommand
-};
+import { dopplerCommandMetadata, dopplerCommandOptionsSchema } from "./schema.js";
+import { checkDependencies, checkDopplerAuth, cloneProject, downloadConfigs, uploadConfigs } from "./utils.js";
+import { setSecretInteractive } from "./set-secret.js";
+import chalk from "chalk";
+import { ZodError } from "zod";
+//#region src/commands/doppler/handler.js
+/**
+* Main doppler command handler
+* @param {unknown} options - Command options (will be validated)
+*/
+async function dopplerCommand(options) {
+	try {
+		const rawOptions = options ?? {};
+		if (rawOptions.help || !rawOptions.action) {
+			console.log(chalk.bold(`\nUsage: @mtndev/cli doppler [options] <action>`));
+			console.log(dopplerCommandMetadata.description);
+			console.log(chalk.bold("\nOptions:"));
+			Object.entries(dopplerCommandMetadata.options).forEach(([key, optionMeta]) => {
+				const meta = optionMeta;
+				const alias = meta?.alias ? chalk.cyan(`, -${meta.alias}`) : "";
+				const defaultValue = meta?.default ?? false;
+				console.log(chalk.cyan(`  --${key}`) + alias + `  ${meta.description} (default: ${defaultValue})`);
+			});
+			console.log("");
+			return;
+		}
+		const validatedOptions = dopplerCommandOptionsSchema.parse(options);
+		const { action, verbose } = validatedOptions;
+		if (action === "set") checkDopplerAuth(verbose);
+		else checkDependencies(verbose);
+		if (action === "download") {
+			const { environments } = validatedOptions;
+			await downloadConfigs({
+				environments,
+				verbose
+			});
+		} else if (action === "upload") {
+			const { environments } = validatedOptions;
+			await uploadConfigs({
+				environments,
+				verbose
+			});
+		} else if (action === "clone") {
+			const { from, to, force, environments } = validatedOptions;
+			await cloneProject({
+				from,
+				to,
+				environments,
+				force,
+				verbose
+			});
+		} else if (action === "set") {
+			const { project, environment, config, name, value, yes } = validatedOptions;
+			await setSecretInteractive({
+				project,
+				environment,
+				config,
+				name,
+				value,
+				yes,
+				verbose
+			});
+		}
+		console.log(chalk.green(`\n✅ Doppler ${action} completed successfully!`));
+	} catch (error) {
+		if (error instanceof ZodError) {
+			console.error(chalk.red(`\n❌ Invalid command options:`));
+			error.errors.forEach((err) => {
+				console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const action = options?.action || "operation";
+		const verbose = options?.verbose || false;
+		console.error(chalk.red(`\n❌ Doppler ${action} failed:`));
+		if (error instanceof Error) {
+			console.error(chalk.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.gray("\nStack trace:"));
+				console.error(chalk.gray(error.stack));
+			}
+		} else console.error(chalk.red(`   ${String(error)}`));
+		console.error(chalk.yellow("\n💡 Troubleshooting tips:"));
+		console.error(chalk.yellow("   • Ensure Doppler CLI is installed (brew install dopplerhq/cli/doppler)"));
+		console.error(chalk.yellow("   • Make sure you're logged in (doppler login)"));
+		console.error(chalk.yellow("   • Verify project is configured (doppler setup)"));
+		console.error(chalk.yellow("   • Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+export { dopplerCommand };

package/esm/commands/doppler/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./handler.js";
 export * from "./schema.js";
+export * from "./set-secret.js";
 export * from "./utils.js";

package/esm/commands/doppler/index.js

@@ -1,41 +1,6 @@
-import "../../__chunks/46HGXFME.js";
-import {
-  dopplerCommand
-} from "../../__chunks/6L5RNR7G.js";
-import {
-  checkDependencies,
-  createDiff,
-  downloadConfigs,
-  execDoppler,
-  getConfigs,
-  normalizeEscapeSequences,
-  promptConfirmation,
-  uploadConfigs
-} from "../../__chunks/O262GK4B.js";
-import {
-  exec,
-  execJson,
-  execNumber,
-  execString
-} from "../../__chunks/SJXQJ7RS.js";
-import {
-  dopplerCommandMetadata,
-  dopplerCommandOptionsSchema
-} from "../../__chunks/X3R5PSWH.js";
-export {
-  checkDependencies,
-  createDiff,
-  dopplerCommand,
-  dopplerCommandMetadata,
-  dopplerCommandOptionsSchema,
-  downloadConfigs,
-  exec,
-  execDoppler,
-  execJson,
-  execNumber,
-  execString,
-  getConfigs,
-  normalizeEscapeSequences,
-  promptConfirmation,
-  uploadConfigs
-};
+import { exec, execJson, execNumber, execString } from "./utils/exec.js";
+import { dopplerCloneSchema, dopplerCommandMetadata, dopplerCommandOptionsSchema, dopplerDownloadSchema, dopplerSetSchema, dopplerUploadSchema } from "./schema.js";
+import { checkDependencies, checkDopplerAuth, cloneProject, createDiff, downloadConfigs, execDoppler, getConfigs, normalizeEscapeSequences, promptConfirmation, uploadConfigs } from "./utils.js";
+import { getSecret, listConfigs, listEnvironments, listProjects, setSecret, setSecretInteractive } from "./set-secret.js";
+import { dopplerCommand } from "./handler.js";
+export { checkDependencies, checkDopplerAuth, cloneProject, createDiff, dopplerCloneSchema, dopplerCommand, dopplerCommandMetadata, dopplerCommandOptionsSchema, dopplerDownloadSchema, dopplerSetSchema, dopplerUploadSchema, downloadConfigs, exec, execDoppler, execJson, execNumber, execString, getConfigs, getSecret, listConfigs, listEnvironments, listProjects, normalizeEscapeSequences, promptConfirmation, setSecret, setSecretInteractive, uploadConfigs };