@mtndev/cli 2.0.0 → 2.0.1

package/cjs/__chunks/KU76LC42.cjs

@@ -1,192 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
-var _UWHPE2GIcjs = require('./UWHPE2GI.cjs');
-
-
-
-var _T2A7TN4Fcjs = require('./T2A7TN4F.cjs');
-
-
-var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
-
-
-var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
-
-
-var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
-
-// src/commands/aws/iam/break-glass/handler.js
-var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
-var _zod = require('zod');
-function userNameFromArn(arn) {
-  const marker = ":user/";
-  const index = arn.indexOf(marker);
-  if (index === -1) {
-    return null;
-  }
-  const name = arn.slice(index + marker.length).split("/").pop();
-  return name && name.length > 0 ? name : null;
-}
-async function breakGlassCommand(options) {
-  try {
-    const { profile, user, yes, dryRun, verbose } = _UWHPE2GIcjs.breakGlassOptionsSchema.parse(options);
-    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
-    const targetProfile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile });
-    if (!targetProfile) {
-      console.error(
-        _chalk2.default.red(
-          "No profile specified. Pass --profile <name> or set AWS_PROFILE."
-        )
-      );
-      process.exit(1);
-    }
-    const scan = _T2A7TN4Fcjs.resolveProfileScan.call(void 0, { profile: targetProfile, verbose });
-    if (!scan) {
-      console.error(
-        _chalk2.default.red(
-          `
-\u274C Could not read ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME} for profile "${targetProfile}".`
-        )
-      );
-      console.error(
-        _chalk2.default.yellow(
-          "   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"
-        )
-      );
-      process.exit(1);
-    }
-    let targets = user;
-    if (targets.length === 0) {
-      const derived = userNameFromArn(scan.arn);
-      if (!derived) {
-        console.error(
-          _chalk2.default.red(
-            `
-\u274C Could not determine your IAM user from the caller identity:
-   ${scan.arn}`
-          )
-        );
-        console.error(
-          _chalk2.default.yellow("   Pass --user <name> to choose who to grant.\n")
-        );
-        process.exit(1);
-      }
-      targets = [derived];
-    }
-    const alreadyMembers = new Set(scan.users);
-    const toGrant = targets.filter((name) => !alreadyMembers.has(name));
-    const existing = targets.filter((name) => alreadyMembers.has(name));
-    console.log(
-      _chalk2.default.blue(
-        `
-==> Break-glass admin (${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}) \u2014 profile ${targetProfile} (${scan.accountId})
-`
-      )
-    );
-    for (const name of existing) {
-      console.log(_chalk2.default.dim(`--     ${name} already has break-glass access`));
-    }
-    if (toGrant.length === 0) {
-      console.log(
-        _chalk2.default.green(
-          "\nNothing to do \u2014 all target user(s) already have break-glass access.\n"
-        )
-      );
-      return;
-    }
-    console.log(
-      _chalk2.default.red.bold(
-        `\u26A0  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`
-      )
-    );
-    if (dryRun) {
-      for (const name of toGrant) {
-        console.log(
-          _chalk2.default.yellow(`  [dry-run] would add ${name} to ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}`)
-        );
-      }
-      console.log(
-        _chalk2.default.yellow("\n[dry-run] Re-run without --dry-run to apply.\n")
-      );
-      return;
-    }
-    let confirmed = yes;
-    if (!confirmed) {
-      confirmed = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
-        message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
-        defaultYes: false
-      });
-    }
-    if (!confirmed) {
-      console.log(_chalk2.default.dim("  aborted (not confirmed)\n"));
-      return;
-    }
-    let granted = 0;
-    for (const name of toGrant) {
-      try {
-        scan.run(
-          [
-            "iam",
-            "add-user-to-group",
-            "--group-name",
-            _T2A7TN4Fcjs.ADMIN_GROUP_NAME,
-            "--user-name",
-            name
-          ],
-          { expectJson: false }
-        );
-        console.log(_chalk2.default.green(`  granted ${name}`));
-        granted += 1;
-      } catch (grantError) {
-        const reason = grantError instanceof Error ? _nullishCoalesce(grantError.message.split("\n")[0], () => ( "")) : String(grantError);
-        console.log(_chalk2.default.red(`  failed to grant ${name}: ${reason}`));
-      }
-    }
-    console.log(_chalk2.default.blue("\n==> Summary"));
-    console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
-    console.log(`  Users granted:    ${granted}`);
-    console.log(`  Already had it:   ${existing.length}`);
-    console.log(
-      _chalk2.default.yellow(
-        "\n\u{1F4A1} Revoke with `mtn aws iam remove-admin` when you are done."
-      )
-    );
-    console.log(
-      _chalk2.default.dim(
-        "   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"
-      )
-    );
-  } catch (error) {
-    if (error instanceof _zod.ZodError) {
-      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
-      error.errors.forEach((err) => {
-        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
-      });
-      process.exit(1);
-    }
-    const verbose = (
-      /** @type {any} */
-      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
-    );
-    console.error(_chalk2.default.red("\n\u274C break-glass failed:"));
-    if (error instanceof Error) {
-      console.error(_chalk2.default.red(`   ${error.message}`));
-      if (verbose && error.stack) {
-        console.error(_chalk2.default.gray("\nStack trace:"));
-        console.error(_chalk2.default.gray(error.stack));
-      }
-    } else {
-      console.error(_chalk2.default.red(`   ${String(error)}`));
-    }
-    console.error(
-      _chalk2.default.yellow(
-        "\n\u{1F4A1} Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"
-      )
-    );
-    process.exit(1);
-  }
-}
-
-
-
-exports.breakGlassCommand = breakGlassCommand;

package/cjs/__chunks/LFDSHANP.cjs

@@ -1,34 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _BLMSMR5Ecjs = require('./BLMSMR5E.cjs');
-
-
-
-var _WOYF2L6Tcjs = require('./WOYF2L6T.cjs');
-
-// src/commands/aws/route53/remove-record/schema.js
-var _zod = require('zod');
-var removeRecordOptionsSchema = _zod.z.object({
-  profile: _WOYF2L6Tcjs.profileField,
-  zone: _zod.z.string().optional().describe(
-    "Hosted zone name or ID (e.g. mountaindev.com or Z123\u2026). Skips the zone picker when set."
-  ),
-  type: _zod.z.string().optional().transform(
-    (value) => value === void 0 ? void 0 : value.toUpperCase()
-  ).refine(
-    (value) => value === void 0 || typeof value === "string" && _BLMSMR5Ecjs.RECORD_TYPES.includes(value),
-    {
-      message: `Record type must be one of: ${_BLMSMR5Ecjs.RECORD_TYPES.join(", ")}`
-    }
-  ).describe(`DNS record type (${_BLMSMR5Ecjs.RECORD_TYPES.join(", ")})`),
-  name: _zod.z.string().optional().describe(
-    'Record name relative to the zone (e.g. "redline") or a fully-qualified name'
-  ),
-  yes: _zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
-  dryRun: _zod.z.boolean().optional().default(false).describe("Preview the deletion without calling Route53"),
-  verbose: _WOYF2L6Tcjs.verboseField
-});
-
-
-
-exports.removeRecordOptionsSchema = removeRecordOptionsSchema;

package/cjs/__chunks/LHE24ECK.cjs

@@ -1,192 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
-
-
-
-
-
-
-var _SBBNW2BFcjs = require('./SBBNW2BF.cjs');
-
-
-var _3T2LXW7Jcjs = require('./3T2LXW7J.cjs');
-
-
-var _FM5MVRQFcjs = require('./FM5MVRQF.cjs');
-
-
-
-var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
-
-
-var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
-
-
-var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
-
-// src/commands/aws/iam/setup-acl/handler.js
-var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
-var _zod = require('zod');
-async function resolveRestrictRegions(params) {
-  const { restrictRegions } = params;
-  if (restrictRegions) {
-    console.log(`Region restriction: ${restrictRegions}`);
-    return restrictRegions === "yes";
-  }
-  console.log("Region restriction");
-  console.log(
-    "  The policy UserAdminsDenyRegionsList limits acl-power-users to a hard-coded"
-  );
-  console.log(
-    "  region allowlist. Most accounts should leave this OFF unless you have a strong reason."
-  );
-  const restrict = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
-    message: "  Attach region restriction to acl-power-users?",
-    defaultYes: false
-  });
-  console.log(`  \u2192 ${restrict ? "yes" : "no"}`);
-  console.log("");
-  return restrict;
-}
-async function setupAclCommand(options) {
-  try {
-    const {
-      restrictRegions,
-      createUsers,
-      profile: profileOption,
-      region,
-      verbose
-    } = _FM5MVRQFcjs.setupAclOptionsSchema.parse(options);
-    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
-    const profile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile: profileOption });
-    const identity = _R3GUC7O7cjs.getCallerIdentity.call(void 0, { profile, region, verbose });
-    const accountId = identity.Account;
-    console.log("Caller:");
-    console.log(`  Account: ${accountId}`);
-    console.log(`  Arn:     ${identity.Arn}`);
-    console.log("");
-    const restrict = await resolveRestrictRegions({ restrictRegions });
-    console.log("1. Ensure groups exist...");
-    for (const group of _SBBNW2BFcjs.ACL_GROUPS) {
-      _SBBNW2BFcjs.ensureGroup.call(void 0, { name: group, profile, verbose });
-    }
-    console.log("");
-    console.log("2. Publish custom policies...");
-    for (const policy of _SBBNW2BFcjs.CUSTOM_POLICIES) {
-      _SBBNW2BFcjs.publishPolicy.call(void 0, {
-        name: policy.name,
-        fileName: policy.fileName,
-        accountId,
-        profile,
-        verbose
-      });
-    }
-    console.log("");
-    const ADMIN = "arn:aws:iam::aws:policy/AdministratorAccess";
-    const IAM_FULL = "arn:aws:iam::aws:policy/IAMFullAccess";
-    const READ_ONLY = "arn:aws:iam::aws:policy/ReadOnlyAccess";
-    const WRITE_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsWriteList`;
-    const DENY_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsDenyList`;
-    const SELF_SERVICE = `arn:aws:iam::${accountId}:policy/UserAdminsSelfServiceIAM`;
-    const DENY_REGIONS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyRegionsList`;
-    const STS_FEDERATION = `arn:aws:iam::${accountId}:policy/sts-federation`;
-    const S3_RESTRICTIONS = `arn:aws:iam::${accountId}:policy/S3RestrictionsDenyNonS3Services`;
-    console.log("3. Attach policies to groups...");
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-admin-do-not-use", arn: ADMIN, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-iam-full-access", arn: IAM_FULL, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-iam-full-access", arn: READ_ONLY, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, {
-      group: "acl-iam-full-access",
-      arn: SELF_SERVICE,
-      profile,
-      verbose
-    });
-    _SBBNW2BFcjs.attach.call(void 0, {
-      group: "acl-iam-full-access",
-      arn: STS_FEDERATION,
-      profile,
-      verbose
-    });
-    _SBBNW2BFcjs.detach.call(void 0, { group: "acl-iam-full-access", arn: DENY_LIST, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: READ_ONLY, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: WRITE_LIST, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: DENY_LIST, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: SELF_SERVICE, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-read-only", arn: READ_ONLY, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-read-only", arn: STS_FEDERATION, profile, verbose });
-    _SBBNW2BFcjs.attach.call(void 0, {
-      group: "acl-s3-restrictions",
-      arn: S3_RESTRICTIONS,
-      profile,
-      verbose
-    });
-    console.log("");
-    console.log("4. Apply region restriction to acl-power-users...");
-    if (restrict) {
-      _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
-    } else {
-      _SBBNW2BFcjs.detach.call(void 0, { group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
-    }
-    console.log("");
-    console.log("5. Detach legacy policies (if present)...");
-    const LEGACY_POWER_USER = "arn:aws:iam::aws:policy/PowerUserAccess";
-    const LEGACY_IAM_RO = "arn:aws:iam::aws:policy/IAMReadOnlyAccess";
-    const LEGACY_ALLOW = `arn:aws:iam::${accountId}:policy/UserAdminsAllowList`;
-    const LEGACY_DENY_SVCS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListServices`;
-    const LEGACY_DENY_GPU = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListGpu`;
-    const legacyArns = [
-      LEGACY_POWER_USER,
-      LEGACY_IAM_RO,
-      LEGACY_ALLOW,
-      LEGACY_DENY_SVCS,
-      LEGACY_DENY_GPU
-    ];
-    for (const group of _SBBNW2BFcjs.ACL_GROUPS) {
-      for (const arn of legacyArns) {
-        _SBBNW2BFcjs.detach.call(void 0, { group, arn, profile, verbose });
-      }
-    }
-    console.log("");
-    console.log("6. Final state:");
-    _SBBNW2BFcjs.printFinalState.call(void 0, { profile, verbose });
-    console.log("");
-    if (createUsers) {
-      console.log("7. Create IAM users (optional)");
-      console.log("");
-      await _3T2LXW7Jcjs.createUsersInteractive.call(void 0, { profile, verbose });
-    }
-    console.log(_chalk2.default.green("\n\u2705 ACL setup complete."));
-  } catch (error) {
-    if (error instanceof _zod.ZodError) {
-      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
-      error.errors.forEach((err) => {
-        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
-      });
-      process.exit(1);
-    }
-    const verbose = (
-      /** @type {any} */
-      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
-    );
-    console.error(_chalk2.default.red("\n\u274C iam setup-acl failed:"));
-    if (error instanceof Error) {
-      console.error(_chalk2.default.red(`   ${error.message}`));
-      if (verbose && error.stack) {
-        console.error(_chalk2.default.gray("\nStack trace:"));
-        console.error(_chalk2.default.gray(error.stack));
-      }
-    } else {
-      console.error(_chalk2.default.red(`   ${String(error)}`));
-    }
-    console.error(
-      _chalk2.default.yellow(
-        "\n\u{1F4A1} Run with a profile that has IAMFullAccess (e.g. md-*-iam-admin).\n"
-      )
-    );
-    process.exit(1);
-  }
-}
-
-
-
-exports.setupAclCommand = setupAclCommand;

package/cjs/__chunks/LIKQ3SI4.cjs

@@ -1 +0,0 @@
-"use strict";