@mtndev/cli 2.0.0 → 2.0.1

package/esm/__chunks/DLEJ25GZ.js

@@ -1,121 +0,0 @@
-// src/commands/db/create-readonly-user/utils.js
-import { randomBytes } from "crypto";
-function generatePassword(params = {}) {
-  const { length = 24 } = params;
-  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*";
-  const bytes = randomBytes(length);
-  let result = "";
-  for (let i = 0; i < length; i += 1) {
-    const byte = bytes[i] ?? 0;
-    result += alphabet[byte % alphabet.length];
-  }
-  return result;
-}
-function detectEngineFromUrl(url) {
-  const trimmed = url.trim().toLowerCase();
-  if (trimmed.startsWith("postgres://") || trimmed.startsWith("postgresql://")) {
-    return "postgres";
-  }
-  if (trimmed.startsWith("mysql://") || trimmed.startsWith("mysql2://")) {
-    return "mysql";
-  }
-  return null;
-}
-function resolveAdminUrl(params) {
-  const { url, engine } = params;
-  if (url) {
-    return url;
-  }
-  if (engine === "mysql") {
-    return process.env.MYSQL_URL ?? process.env.DATABASE_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
-  }
-  if (engine === "postgres") {
-    return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? null;
-  }
-  return process.env.DATABASE_URL ?? process.env.POSTGRES_URL ?? process.env.POSTGRESQL_URL ?? process.env.MYSQL_URL ?? process.env.MYSQL_DATABASE_URL ?? null;
-}
-function resolveSsl(params) {
-  const { host, sslOption } = params;
-  if (sslOption === true) {
-    return { rejectUnauthorized: false };
-  }
-  if (sslOption === false) {
-    return false;
-  }
-  const local = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "0.0.0.0";
-  if (local) {
-    return false;
-  }
-  return { rejectUnauthorized: false };
-}
-function parseConnectionUrl(params) {
-  const { url, engine: engineOption, sslOption } = params;
-  const engine = engineOption ?? detectEngineFromUrl(url);
-  if (!engine) {
-    throw new Error(
-      `Could not detect engine from URL. Pass --engine postgres|mysql. URL starts with: ${url.slice(0, 24)}\u2026`
-    );
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid connection URL: ${url}`);
-  }
-  const defaultPort = engine === "postgres" ? 5432 : 3306;
-  const port = parsed.port ? Number.parseInt(parsed.port, 10) : defaultPort;
-  const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")) || (engine === "postgres" ? "postgres" : "");
-  const host = parsed.hostname || "localhost";
-  const user = decodeURIComponent(parsed.username || "");
-  const password = decodeURIComponent(parsed.password || "");
-  if (!user) {
-    throw new Error("Connection URL is missing a username");
-  }
-  return {
-    engine,
-    host,
-    port: Number.isFinite(port) ? port : defaultPort,
-    user,
-    password,
-    database,
-    ssl: resolveSsl({ host, sslOption }),
-    url
-  };
-}
-function buildReadonlyUrl(params) {
-  const { engine, host, port, username, password, database } = params;
-  const scheme = engine === "postgres" ? "postgresql" : "mysql";
-  const auth = `${encodeURIComponent(username)}:${encodeURIComponent(password)}`;
-  const dbPath = database ? `/${encodeURIComponent(database)}` : "/";
-  return `${scheme}://${auth}@${host}:${port}${dbPath}`;
-}
-function quoteIdent(params) {
-  const { engine, name } = params;
-  if (engine === "postgres") {
-    return `"${name.replace(/"/g, '""')}"`;
-  }
-  return `\`${name.replace(/`/g, "``")}\``;
-}
-function quoteLiteral(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function isSystemDatabase(params) {
-  const { engine, name } = params;
-  const lower = name.toLowerCase();
-  if (engine === "postgres") {
-    return lower === "template0" || lower === "template1" || lower === "rdsadmin" || lower === "cloudsqladmin";
-  }
-  return lower === "information_schema" || lower === "performance_schema" || lower === "mysql" || lower === "sys" || lower === "innodb" || lower === "#mysql50#lost+found";
-}
-
-export {
-  generatePassword,
-  detectEngineFromUrl,
-  resolveAdminUrl,
-  resolveSsl,
-  parseConnectionUrl,
-  buildReadonlyUrl,
-  quoteIdent,
-  quoteLiteral,
-  isSystemDatabase
-};

package/esm/__chunks/DMYFNF54.js

@@ -1,192 +0,0 @@
-import {
-  ACL_GROUPS,
-  CUSTOM_POLICIES,
-  attach,
-  detach,
-  ensureGroup,
-  printFinalState,
-  publishPolicy
-} from "./XOUWDB3T.js";
-import {
-  createUsersInteractive
-} from "./3QLI5BDL.js";
-import {
-  setupAclOptionsSchema
-} from "./XQN2TA4S.js";
-import {
-  getCallerIdentity,
-  requireCommands
-} from "./FNXUONAV.js";
-import {
-  resolveProfile
-} from "./5GIUAFXL.js";
-import {
-  promptYesNo
-} from "./ZHKVJO2U.js";
-
-// src/commands/aws/iam/setup-acl/handler.js
-import chalk from "chalk";
-import { ZodError } from "zod";
-async function resolveRestrictRegions(params) {
-  const { restrictRegions } = params;
-  if (restrictRegions) {
-    console.log(`Region restriction: ${restrictRegions}`);
-    return restrictRegions === "yes";
-  }
-  console.log("Region restriction");
-  console.log(
-    "  The policy UserAdminsDenyRegionsList limits acl-power-users to a hard-coded"
-  );
-  console.log(
-    "  region allowlist. Most accounts should leave this OFF unless you have a strong reason."
-  );
-  const restrict = await promptYesNo({
-    message: "  Attach region restriction to acl-power-users?",
-    defaultYes: false
-  });
-  console.log(`  \u2192 ${restrict ? "yes" : "no"}`);
-  console.log("");
-  return restrict;
-}
-async function setupAclCommand(options) {
-  try {
-    const {
-      restrictRegions,
-      createUsers,
-      profile: profileOption,
-      region,
-      verbose
-    } = setupAclOptionsSchema.parse(options);
-    requireCommands(["aws"]);
-    const profile = await resolveProfile({ profile: profileOption });
-    const identity = getCallerIdentity({ profile, region, verbose });
-    const accountId = identity.Account;
-    console.log("Caller:");
-    console.log(`  Account: ${accountId}`);
-    console.log(`  Arn:     ${identity.Arn}`);
-    console.log("");
-    const restrict = await resolveRestrictRegions({ restrictRegions });
-    console.log("1. Ensure groups exist...");
-    for (const group of ACL_GROUPS) {
-      ensureGroup({ name: group, profile, verbose });
-    }
-    console.log("");
-    console.log("2. Publish custom policies...");
-    for (const policy of CUSTOM_POLICIES) {
-      publishPolicy({
-        name: policy.name,
-        fileName: policy.fileName,
-        accountId,
-        profile,
-        verbose
-      });
-    }
-    console.log("");
-    const ADMIN = "arn:aws:iam::aws:policy/AdministratorAccess";
-    const IAM_FULL = "arn:aws:iam::aws:policy/IAMFullAccess";
-    const READ_ONLY = "arn:aws:iam::aws:policy/ReadOnlyAccess";
-    const WRITE_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsWriteList`;
-    const DENY_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsDenyList`;
-    const SELF_SERVICE = `arn:aws:iam::${accountId}:policy/UserAdminsSelfServiceIAM`;
-    const DENY_REGIONS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyRegionsList`;
-    const STS_FEDERATION = `arn:aws:iam::${accountId}:policy/sts-federation`;
-    const S3_RESTRICTIONS = `arn:aws:iam::${accountId}:policy/S3RestrictionsDenyNonS3Services`;
-    console.log("3. Attach policies to groups...");
-    attach({ group: "acl-admin-do-not-use", arn: ADMIN, profile, verbose });
-    attach({ group: "acl-iam-full-access", arn: IAM_FULL, profile, verbose });
-    attach({ group: "acl-iam-full-access", arn: READ_ONLY, profile, verbose });
-    attach({
-      group: "acl-iam-full-access",
-      arn: SELF_SERVICE,
-      profile,
-      verbose
-    });
-    attach({
-      group: "acl-iam-full-access",
-      arn: STS_FEDERATION,
-      profile,
-      verbose
-    });
-    detach({ group: "acl-iam-full-access", arn: DENY_LIST, profile, verbose });
-    attach({ group: "acl-power-users", arn: READ_ONLY, profile, verbose });
-    attach({ group: "acl-power-users", arn: WRITE_LIST, profile, verbose });
-    attach({ group: "acl-power-users", arn: DENY_LIST, profile, verbose });
-    attach({ group: "acl-power-users", arn: SELF_SERVICE, profile, verbose });
-    attach({ group: "acl-read-only", arn: READ_ONLY, profile, verbose });
-    attach({ group: "acl-read-only", arn: STS_FEDERATION, profile, verbose });
-    attach({
-      group: "acl-s3-restrictions",
-      arn: S3_RESTRICTIONS,
-      profile,
-      verbose
-    });
-    console.log("");
-    console.log("4. Apply region restriction to acl-power-users...");
-    if (restrict) {
-      attach({ group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
-    } else {
-      detach({ group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
-    }
-    console.log("");
-    console.log("5. Detach legacy policies (if present)...");
-    const LEGACY_POWER_USER = "arn:aws:iam::aws:policy/PowerUserAccess";
-    const LEGACY_IAM_RO = "arn:aws:iam::aws:policy/IAMReadOnlyAccess";
-    const LEGACY_ALLOW = `arn:aws:iam::${accountId}:policy/UserAdminsAllowList`;
-    const LEGACY_DENY_SVCS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListServices`;
-    const LEGACY_DENY_GPU = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListGpu`;
-    const legacyArns = [
-      LEGACY_POWER_USER,
-      LEGACY_IAM_RO,
-      LEGACY_ALLOW,
-      LEGACY_DENY_SVCS,
-      LEGACY_DENY_GPU
-    ];
-    for (const group of ACL_GROUPS) {
-      for (const arn of legacyArns) {
-        detach({ group, arn, profile, verbose });
-      }
-    }
-    console.log("");
-    console.log("6. Final state:");
-    printFinalState({ profile, verbose });
-    console.log("");
-    if (createUsers) {
-      console.log("7. Create IAM users (optional)");
-      console.log("");
-      await createUsersInteractive({ profile, verbose });
-    }
-    console.log(chalk.green("\n\u2705 ACL setup complete."));
-  } catch (error) {
-    if (error instanceof ZodError) {
-      console.error(chalk.red("\n\u274C Invalid command options:"));
-      error.errors.forEach((err) => {
-        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
-      });
-      process.exit(1);
-    }
-    const verbose = (
-      /** @type {any} */
-      options?.verbose || false
-    );
-    console.error(chalk.red("\n\u274C iam setup-acl failed:"));
-    if (error instanceof Error) {
-      console.error(chalk.red(`   ${error.message}`));
-      if (verbose && error.stack) {
-        console.error(chalk.gray("\nStack trace:"));
-        console.error(chalk.gray(error.stack));
-      }
-    } else {
-      console.error(chalk.red(`   ${String(error)}`));
-    }
-    console.error(
-      chalk.yellow(
-        "\n\u{1F4A1} Run with a profile that has IAMFullAccess (e.g. md-*-iam-admin).\n"
-      )
-    );
-    process.exit(1);
-  }
-}
-
-export {
-  setupAclCommand
-};

package/esm/__chunks/DNFTUMGD.js

@@ -1,23 +0,0 @@
-import {
-  profileField,
-  verboseField
-} from "./73BJG53F.js";
-
-// src/commands/aws/iam/remove-admin/schema.js
-import { z } from "zod";
-var removeAdminOptionsSchema = z.object({
-  profile: profileField,
-  all: z.boolean().optional().default(false).describe(
-    "Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"
-  ),
-  user: z.array(z.string()).optional().default([]).describe(
-    "Only remove these user(s); repeatable. Default: every user in the group"
-  ),
-  yes: z.boolean().optional().default(false).describe("Skip the per-profile confirmation prompt"),
-  dryRun: z.boolean().optional().default(false).describe("Preview removals without changing anything"),
-  verbose: verboseField
-});
-
-export {
-  removeAdminOptionsSchema
-};

package/esm/__chunks/DVKD6YSR.js

@@ -1,49 +0,0 @@
-import {
-  createReadonlyUserCommand
-} from "./M35URMT4.js";
-
-// src/commands/db/index.js
-function registerDbCommands(program) {
-  const db = program.command("db").summary("Database operational commands").description("Database operational helpers (MySQL and Postgres)");
-  db.command("create-readonly-user").summary("Create a read-only database user").description(
-    "Create (or update) a read-only database user on MySQL or Postgres. Interactively pick a single database or all databases, then print a connection URL."
-  ).option(
-    "-e, --engine <engine>",
-    "Database engine: postgres or mysql (inferred from --url when omitted)"
-  ).option(
-    "-u, --url <url>",
-    "Admin connection URL (defaults to DATABASE_URL / MYSQL_URL / POSTGRES_URL)"
-  ).option(
-    "-d, --database <name>",
-    'Target database name, or "all" for every non-system database'
-  ).option(
-    "--username <name>",
-    "Read-only username to create (default: readonly)"
-  ).option(
-    "--password <password>",
-    "Password for the new user (generated when omitted)"
-  ).option("--host-pattern <pattern>", "MySQL user host pattern (default: %)").option("--ssl", "Force SSL on (loose verify \u2014 useful for RDS)").option("--no-ssl", "Force SSL off").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Print the SQL plan without applying it").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    let ssl;
-    if (options.ssl === true) {
-      ssl = true;
-    } else if (options.noSsl === true) {
-      ssl = false;
-    }
-    await createReadonlyUserCommand({
-      engine: options.engine,
-      url: options.url,
-      database: options.database,
-      username: options.username,
-      password: options.password,
-      hostPattern: options.hostPattern,
-      ssl,
-      yes: options.yes ?? false,
-      dryRun: options.dryRun ?? false,
-      verbose: options.verbose ?? false
-    });
-  });
-}
-
-export {
-  registerDbCommands
-};

package/esm/__chunks/EMSH4P76.js

@@ -1,20 +0,0 @@
-import {
-  profileField,
-  verboseField
-} from "./73BJG53F.js";
-
-// src/commands/aws/iam/break-glass/schema.js
-import { z } from "zod";
-var breakGlassOptionsSchema = z.object({
-  profile: profileField,
-  user: z.array(z.string()).optional().default([]).describe(
-    "Grant break-glass to this user (repeatable). Default: your own IAM user"
-  ),
-  yes: z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
-  dryRun: z.boolean().optional().default(false).describe("Preview the grant without changing anything"),
-  verbose: verboseField
-});
-
-export {
-  breakGlassOptionsSchema
-};

package/esm/__chunks/FFKFVMIE.js

@@ -1,167 +0,0 @@
-import {
-  removeAdminOptionsSchema
-} from "./DNFTUMGD.js";
-import {
-  ADMIN_GROUP_NAME,
-  resolveAdminScanProfiles,
-  resolveProfileScan
-} from "./NF3M2L6C.js";
-import {
-  requireCommands
-} from "./FNXUONAV.js";
-import {
-  promptYesNo
-} from "./ZHKVJO2U.js";
-
-// src/commands/aws/iam/remove-admin/handler.js
-import chalk from "chalk";
-import { ZodError } from "zod";
-async function removeAdminCommand(options) {
-  try {
-    const { profile, all, user, yes, dryRun, verbose } = removeAdminOptionsSchema.parse(options);
-    requireCommands(["aws"]);
-    const userFilter = new Set(user);
-    const needsVault = all || !(profile ?? process.env.AWS_PROFILE);
-    if (needsVault) {
-      requireCommands(["aws-vault"]);
-    }
-    let profiles;
-    try {
-      profiles = resolveAdminScanProfiles({ profile, all });
-    } catch (resolveError) {
-      if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
-        console.error(chalk.red(resolveError.message));
-        process.exit(1);
-      }
-      throw resolveError;
-    }
-    console.log(
-      chalk.blue(
-        `
-==> Removing break-glass access (${ADMIN_GROUP_NAME}) across ${profiles.length} profile(s)
-`
-      )
-    );
-    if (dryRun) {
-      console.log(chalk.yellow("[dry-run] No changes will be made.\n"));
-    }
-    let removed = 0;
-    let cleaned = 0;
-    let skipped = 0;
-    for (const candidate of profiles) {
-      const scan = resolveProfileScan({ profile: candidate, verbose });
-      if (!scan) {
-        skipped += 1;
-        continue;
-      }
-      if (scan.users.length === 0) {
-        if (verbose) {
-          console.log(
-            chalk.green(`OK     ${candidate} (${scan.accountId}) \u2014 0 users`)
-          );
-        }
-        cleaned += 1;
-        continue;
-      }
-      const targets = userFilter.size > 0 ? scan.users.filter((name) => userFilter.has(name)) : scan.users;
-      if (targets.length === 0) {
-        console.log(
-          chalk.dim(
-            `--     ${candidate} (${scan.accountId}) \u2014 has users but none match --user`
-          )
-        );
-        skipped += 1;
-        continue;
-      }
-      console.log(
-        chalk.red(
-          `FOUND  ${candidate} (${scan.accountId}) \u2014 ${targets.length} user(s): ${targets.join(", ")}`
-        )
-      );
-      if (dryRun) {
-        for (const name of targets) {
-          console.log(
-            chalk.yellow(
-              `  [dry-run] would remove ${name} from ${ADMIN_GROUP_NAME}`
-            )
-          );
-        }
-        continue;
-      }
-      let confirmed = yes;
-      if (!confirmed) {
-        confirmed = await promptYesNo({
-          message: `  Remove ${targets.length} user(s) from ${ADMIN_GROUP_NAME} in ${candidate}?`,
-          defaultYes: false
-        });
-      }
-      if (!confirmed) {
-        console.log(chalk.dim("  skipped (not confirmed)"));
-        skipped += 1;
-        continue;
-      }
-      for (const name of targets) {
-        try {
-          scan.run(
-            [
-              "iam",
-              "remove-user-from-group",
-              "--group-name",
-              ADMIN_GROUP_NAME,
-              "--user-name",
-              name
-            ],
-            { expectJson: false }
-          );
-          console.log(chalk.green(`  removed ${name}`));
-          removed += 1;
-        } catch (removeError) {
-          const reason = removeError instanceof Error ? removeError.message.split("\n")[0] ?? "" : String(removeError);
-          console.log(chalk.red(`  failed to remove ${name}: ${reason}`));
-        }
-      }
-    }
-    console.log(chalk.blue("\n==> Summary"));
-    console.log(`  Profiles scanned:  ${profiles.length}`);
-    console.log(`  Users removed:     ${removed}`);
-    console.log(`  Already clean:     ${cleaned}`);
-    console.log(`  Skipped:           ${skipped}`);
-    if (dryRun) {
-      console.log(
-        chalk.yellow("\n[dry-run] Re-run without --dry-run to apply changes.")
-      );
-    }
-  } catch (error) {
-    if (error instanceof ZodError) {
-      console.error(chalk.red("\n\u274C Invalid command options:"));
-      error.errors.forEach((err) => {
-        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
-      });
-      process.exit(1);
-    }
-    const verbose = (
-      /** @type {any} */
-      options?.verbose || false
-    );
-    console.error(chalk.red("\n\u274C remove-admin failed:"));
-    if (error instanceof Error) {
-      console.error(chalk.red(`   ${error.message}`));
-      if (verbose && error.stack) {
-        console.error(chalk.gray("\nStack trace:"));
-        console.error(chalk.gray(error.stack));
-      }
-    } else {
-      console.error(chalk.red(`   ${String(error)}`));
-    }
-    console.error(
-      chalk.yellow(
-        "\n\u{1F4A1} Requires the AWS CLI (and aws-vault when scanning multiple profiles) and iam:RemoveUserFromGroup.\n"
-      )
-    );
-    process.exit(1);
-  }
-}
-
-export {
-  removeAdminCommand
-};