@mtndev/cli 2.0.0 → 2.0.1

package/esm/__chunks/NF3M2L6C.js

@@ -1,81 +0,0 @@
-import {
-  runAws,
-  runAwsVault
-} from "./FNXUONAV.js";
-
-// src/commands/aws/iam/admin-group.js
-import { spawnSync } from "child_process";
-import chalk from "chalk";
-var ADMIN_GROUP_NAME = "acl-admin-do-not-use";
-var VAULT_DURATION = process.env.AWS_VAULT_DURATION ?? "15m";
-function listVaultProfiles() {
-  const result = spawnSync("aws-vault", ["list", "--credentials"], {
-    encoding: "utf-8"
-  });
-  if (result.status !== 0) {
-    return [];
-  }
-  return (result.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
-}
-function resolveAdminScanProfiles({ profile, all = false }) {
-  const targetProfile = profile ?? process.env.AWS_PROFILE;
-  if (!all && targetProfile) {
-    return [targetProfile];
-  }
-  const profiles = listVaultProfiles();
-  if (profiles.length === 0) {
-    throw new Error("No aws-vault profiles with credentials found.");
-  }
-  return profiles;
-}
-function groupUserNames(group) {
-  return (group.Users ?? []).map((user) => user.UserName);
-}
-function resolveProfileScan(params) {
-  const { profile, verbose = false } = params;
-  const idArgs = ["sts", "get-caller-identity"];
-  const groupArgs = ["iam", "get-group", "--group-name", ADMIN_GROUP_NAME];
-  const directRun = (args, options = {}) => runAws({ profile, args, expectJson: options.expectJson ?? true, verbose });
-  const vaultRun = (args, options = {}) => runAwsVault({
-    profile,
-    args,
-    duration: VAULT_DURATION,
-    expectJson: options.expectJson ?? true,
-    verbose
-  });
-  try {
-    const identity = directRun(idArgs);
-    const group = directRun(groupArgs);
-    return {
-      accountId: identity.Account,
-      arn: identity.Arn,
-      users: groupUserNames(group),
-      run: directRun
-    };
-  } catch (directError) {
-    try {
-      const identity = vaultRun(idArgs);
-      const group = vaultRun(groupArgs);
-      return {
-        accountId: identity.Account,
-        arn: identity.Arn,
-        users: groupUserNames(group),
-        run: vaultRun
-      };
-    } catch {
-      if (verbose) {
-        const reason = directError instanceof Error ? directError.message.split("\n")[0] ?? "" : String(directError);
-        console.log(chalk.dim(`skip   ${profile} \u2014 ${reason}`));
-      }
-      return null;
-    }
-  }
-}
-
-export {
-  ADMIN_GROUP_NAME,
-  listVaultProfiles,
-  resolveAdminScanProfiles,
-  groupUserNames,
-  resolveProfileScan
-};

package/esm/__chunks/O3CCA76Q.js

@@ -1,22 +0,0 @@
-// src/commands/schema.js
-import { z } from "zod";
-var globalOptionsSchema = z.object({
-  verbose: z.boolean().default(false).optional().describe("Enable verbose logging for detailed output and error traces")
-});
-var globalCommandsMetadata = {
-  name: "mtndev-cli",
-  version: "1.0.0",
-  description: "Omnibus CLI tool for mtndev projects",
-  options: {
-    verbose: {
-      description: globalOptionsSchema.shape.verbose.description,
-      default: false,
-      alias: "v"
-    }
-  }
-};
-
-export {
-  globalOptionsSchema,
-  globalCommandsMetadata
-};

package/esm/__chunks/PNPPDYKC.js

@@ -1,299 +0,0 @@
-import {
-  authorizeRule,
-  describeSecurityGroups,
-  extractRoamingFirstName,
-  getCurrentPublicIp,
-  getSecurityGroupDetails,
-  instanceLabel,
-  listEnabledRegions,
-  listInstances,
-  listSshIngressRules,
-  printSshRules,
-  resolveRoamingRule,
-  revokeRule,
-  roamingRuleDescription,
-  ruleAlreadyAllowsIp,
-  securityGroupLabel
-} from "./U7HAE2RF.js";
-import {
-  DEFAULT_REGION,
-  allowIpOptionsSchema
-} from "./J34UVKLA.js";
-import {
-  AwsCliError,
-  getCallerIdentity,
-  requireCommands
-} from "./FNXUONAV.js";
-import {
-  resolveProfile
-} from "./5GIUAFXL.js";
-import {
-  promptChoice
-} from "./ZHKVJO2U.js";
-
-// src/commands/aws/ec2/allow-ip/handler.js
-import chalk from "chalk";
-import { ZodError } from "zod";
-async function resolveRegion(params) {
-  const { profile, region, verbose } = params;
-  if (region) {
-    return region;
-  }
-  const instances = listInstances({ profile, region: DEFAULT_REGION, verbose });
-  if (instances.length > 0) {
-    return DEFAULT_REGION;
-  }
-  const regions = listEnabledRegions({
-    profile,
-    region: DEFAULT_REGION,
-    verbose
-  });
-  if (regions.length === 0) {
-    throw new Error("No enabled AWS regions found for this profile");
-  }
-  console.log(`No EC2 instances found in ${DEFAULT_REGION}.`);
-  const index = await promptChoice({
-    message: "Choose a region:",
-    options: regions
-  });
-  const chosen = regions[index];
-  if (!chosen) {
-    throw new Error("No region selected");
-  }
-  return chosen;
-}
-function handleRuleChangeError(error, ctx) {
-  const { securityGroup, sshRules, newCidr, ruleDescription, action } = ctx;
-  if (error.code === "InvalidPermission.Duplicate") {
-    const matching = ruleAlreadyAllowsIp(sshRules, newCidr);
-    const label = matching ? matching.description : ruleDescription;
-    console.log(
-      `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`
-    );
-    return;
-  }
-  if (error.code === "UnauthorizedOperation") {
-    console.error(
-      `Could not ${action} the SSH rule: your AWS profile does not have ec2:AuthorizeSecurityGroupIngress or ec2:RevokeSecurityGroupIngress on ${securityGroup.groupName} (${securityGroup.groupId}).`
-    );
-    console.error("");
-    console.error("Current single-host SSH rules on port 22:");
-    printSshRules(sshRules, (message) => console.error(message));
-    if (action === "create" && sshRules.length > 0) {
-      console.error("");
-      console.error(
-        "A rule may already exist. Re-run to update your named roaming rule, or ask an admin to grant security group ingress permissions."
-      );
-    }
-    process.exit(1);
-  }
-  throw error;
-}
-async function allowIpCommand(options) {
-  try {
-    const {
-      profile: profileOption,
-      region: regionOption,
-      ruleName,
-      verbose
-    } = allowIpOptionsSchema.parse(options);
-    const profile = await resolveProfile({ profile: profileOption });
-    if (!profile) {
-      console.error(chalk.red("Error: pass --profile or set AWS_PROFILE."));
-      process.exit(1);
-    }
-    requireCommands(["aws"]);
-    const identity = getCallerIdentity({
-      profile,
-      region: DEFAULT_REGION,
-      verbose
-    });
-    const firstName = extractRoamingFirstName({ profile, identity });
-    const ruleDescription = ruleName ?? roamingRuleDescription(firstName);
-    console.log("Caller:");
-    console.log(`  Account: ${identity.Account}`);
-    console.log(`  Arn:     ${identity.Arn}`);
-    console.log(`  Roaming rule: ${ruleDescription}`);
-    console.log("");
-    const region = await resolveRegion({
-      profile,
-      region: regionOption,
-      verbose
-    });
-    console.log(`Region: ${region}`);
-    console.log("");
-    const instances = listInstances({ profile, region, verbose });
-    if (instances.length === 0) {
-      console.log(`No EC2 instances found in ${region}.`);
-      process.exit(1);
-    }
-    const instanceIndex = await promptChoice({
-      message: "Choose an EC2 instance:",
-      options: instances.map((instance2) => instanceLabel(instance2))
-    });
-    const instance = instances[instanceIndex];
-    if (!instance) {
-      throw new Error("No instance selected");
-    }
-    console.log("");
-    const securityGroups = describeSecurityGroups({
-      profile,
-      region,
-      groupIds: instance.securityGroupIds,
-      verbose
-    });
-    if (securityGroups.length === 0) {
-      console.log("No security groups found on the selected instance.");
-      process.exit(1);
-    }
-    let securityGroup;
-    if (securityGroups.length === 1) {
-      const onlyGroup = securityGroups[0];
-      if (!onlyGroup) {
-        throw new Error("No security group found on the selected instance");
-      }
-      securityGroup = onlyGroup;
-      console.log(`Security group: ${securityGroupLabel(securityGroup)}`);
-    } else {
-      const groupIndex = await promptChoice({
-        message: "Choose a security group:",
-        options: securityGroups.map((group) => securityGroupLabel(group))
-      });
-      securityGroup = securityGroups[groupIndex];
-    }
-    if (!securityGroup) {
-      throw new Error("No security group selected");
-    }
-    console.log("");
-    const currentIp = await getCurrentPublicIp();
-    const newCidr = `${currentIp}/32`;
-    console.log(`Current public IP: ${currentIp}`);
-    console.log("");
-    const sgDetails = getSecurityGroupDetails({
-      profile,
-      region,
-      groupId: securityGroup.groupId,
-      verbose
-    });
-    if (!sgDetails) {
-      console.log("Could not load security group details.");
-      process.exit(1);
-    }
-    const sshRules = listSshIngressRules(sgDetails);
-    const roamingRule = resolveRoamingRule(sshRules, ruleDescription);
-    if (roamingRule && roamingRule.cidrIp === newCidr) {
-      console.log(
-        `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${ruleDescription}). Nothing to do.`
-      );
-      return;
-    }
-    const otherRuleAtIp = ruleAlreadyAllowsIp(sshRules, newCidr);
-    if (otherRuleAtIp && (!roamingRule || otherRuleAtIp.cidrIp !== roamingRule.cidrIp)) {
-      const label = otherRuleAtIp.description || "(no description)";
-      console.log(
-        `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`
-      );
-      return;
-    }
-    if (roamingRule) {
-      console.log(
-        `Updating SSH rule (${ruleDescription}): ${roamingRule.cidrIp} -> ${newCidr}`
-      );
-      try {
-        revokeRule({
-          profile,
-          region,
-          groupId: securityGroup.groupId,
-          rule: roamingRule,
-          verbose
-        });
-        authorizeRule({
-          profile,
-          region,
-          groupId: securityGroup.groupId,
-          cidrIp: newCidr,
-          description: ruleDescription,
-          fromPort: roamingRule.fromPort,
-          toPort: roamingRule.toPort,
-          ipProtocol: roamingRule.ipProtocol,
-          verbose
-        });
-      } catch (error) {
-        if (error instanceof AwsCliError) {
-          handleRuleChangeError(error, {
-            securityGroup,
-            sshRules,
-            newCidr,
-            ruleDescription,
-            action: "update"
-          });
-          return;
-        }
-        throw error;
-      }
-    } else {
-      if (sshRules.length > 0) {
-        console.log("Existing single-host SSH rules (unchanged):");
-        printSshRules(sshRules);
-        console.log("");
-      }
-      console.log(`Creating new "${ruleDescription}" SSH rule for ${newCidr}`);
-      try {
-        authorizeRule({
-          profile,
-          region,
-          groupId: securityGroup.groupId,
-          cidrIp: newCidr,
-          description: ruleDescription,
-          verbose
-        });
-      } catch (error) {
-        if (error instanceof AwsCliError) {
-          handleRuleChangeError(error, {
-            securityGroup,
-            sshRules,
-            newCidr,
-            ruleDescription,
-            action: "create"
-          });
-          return;
-        }
-        throw error;
-      }
-    }
-    console.log("");
-    console.log(
-      `Done. ${securityGroup.groupName} (${securityGroup.groupId}) now allows SSH from ${newCidr} (${ruleDescription}).`
-    );
-  } catch (error) {
-    if (error instanceof ZodError) {
-      console.error(chalk.red("\n\u274C Invalid command options:"));
-      error.errors.forEach((err) => {
-        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
-      });
-      process.exit(1);
-    }
-    const verbose = (
-      /** @type {any} */
-      options?.verbose || false
-    );
-    console.error(chalk.red("\n\u274C allow-ip failed:"));
-    if (error instanceof Error) {
-      console.error(chalk.red(`   ${error.message}`));
-      if (verbose && error.stack) {
-        console.error(chalk.gray("\nStack trace:"));
-        console.error(chalk.gray(error.stack));
-      }
-    } else {
-      console.error(chalk.red(`   ${String(error)}`));
-    }
-    console.error(
-      chalk.yellow("\n\u{1F4A1} Use --verbose for detailed error information\n")
-    );
-    process.exit(1);
-  }
-}
-
-export {
-  allowIpCommand
-};