cloud-doctor 0.0.1-alpha.0

package/README.md

@@ -0,0 +1,26 @@
+# cloud-doctor
+
+**Alpha** — early scaffold. One command grades your whole cloud account.
+
+```bash
+npx cloud-doctor@alpha
+npx cloud-doctor@alpha aws --profile prod
+```
+
+## Status
+
+This is an **alpha name-reservation release**. The CLI shell works (provider picker, AWS profile discovery, identity validation). Security rules and scoring land in upcoming releases.
+
+## Commands
+
+```bash
+cloud-doctor              # interactive: pick provider → AWS profile → scan
+cloud-doctor aws          # grade AWS account
+cloud-doctor aws profiles # list ~/.aws/config profiles
+cloud-doctor aws whoami   # show resolved AWS identity
+cloud-doctor aws --yes --json  # CI-friendly JSON output
+```
+
+## License
+
+MIT

package/bin/cloud-doctor.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import module from "node:module";
+
+if (module.enableCompileCache && !process.env.NODE_DISABLE_COMPILE_CACHE) {
+  try {
+    module.enableCompileCache();
+  } catch {
+    // Ignore compile-cache errors.
+  }
+}
+
+await import("../dist/cli/index.js");

package/dist/chunk-4PZ65VRA.js

@@ -0,0 +1,586 @@
+// ../core/dist/index.js
+import pc from "picocolors";
+import { createJiti } from "jiti";
+import * as fs from "fs";
+import * as path from "path";
+import { parseJSONC } from "confbox";
+var PERFECT_SCORE = 100;
+var SCORE_GOOD_THRESHOLD = 75;
+var SCORE_OK_THRESHOLD = 50;
+var TOP_FIXES_DISPLAY_COUNT = 5;
+var ERROR_RULE_PENALTY = 1.5;
+var WARNING_RULE_PENALTY = 0.75;
+var DIAGNOSTIC_CATEGORY_BUCKETS = [
+  "Security",
+  "Misconfiguration",
+  "Observability",
+  "Reliability",
+  "Governance"
+];
+var getScoreLabel = (score) => {
+  if (score >= SCORE_GOOD_THRESHOLD) return "Great";
+  if (score >= SCORE_OK_THRESHOLD) return "Needs work";
+  return "Critical";
+};
+var calculateScore = (diagnostics) => {
+  if (diagnostics.length === 0) {
+    return { score: PERFECT_SCORE, label: getScoreLabel(PERFECT_SCORE) };
+  }
+  const errorRules = /* @__PURE__ */ new Set();
+  const warningRules = /* @__PURE__ */ new Set();
+  for (const diagnostic of diagnostics) {
+    const ruleKey = `${diagnostic.plugin}/${diagnostic.rule}`;
+    if (diagnostic.severity === "error") {
+      errorRules.add(ruleKey);
+    } else {
+      warningRules.add(ruleKey);
+    }
+  }
+  const penalty = errorRules.size * ERROR_RULE_PENALTY + warningRules.size * WARNING_RULE_PENALTY;
+  const score = Math.max(0, Math.round(PERFECT_SCORE - penalty));
+  return { score, label: getScoreLabel(score) };
+};
+var highlighter = {
+  error: pc.red,
+  warn: pc.yellow,
+  info: pc.cyan,
+  success: pc.green,
+  dim: pc.dim,
+  gray: pc.gray,
+  bold: pc.bold
+};
+var setColorEnabled = (enabled) => {
+  const colors = pc.createColors(enabled);
+  highlighter.error = colors.red;
+  highlighter.warn = colors.yellow;
+  highlighter.info = colors.cyan;
+  highlighter.success = colors.green;
+  highlighter.dim = colors.dim;
+  highlighter.gray = colors.gray;
+  highlighter.bold = colors.bold;
+};
+var CONFIG_FILENAMES = [
+  "doctor.config.ts",
+  "doctor.config.mts",
+  "doctor.config.js",
+  "doctor.config.mjs",
+  "doctor.config.json",
+  "doctor.config.jsonc"
+];
+var findConfigFile = (startDir) => {
+  let current = path.resolve(startDir);
+  const root = path.parse(current).root;
+  while (true) {
+    for (const filename of CONFIG_FILENAMES) {
+      const candidate = path.join(current, filename);
+      if (fs.existsSync(candidate)) return candidate;
+    }
+    const packageJsonPath = path.join(current, "package.json");
+    if (fs.existsSync(packageJsonPath)) {
+      try {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        if (packageJson.cloudDoctor) {
+          return packageJsonPath;
+        }
+      } catch {
+      }
+    }
+    if (current === root) break;
+    current = path.dirname(current);
+  }
+  return null;
+};
+var loadConfigModule = async (configPath) => {
+  const ext = path.extname(configPath);
+  if (ext === ".json" || ext === ".jsonc") {
+    return parseJSONC(fs.readFileSync(configPath, "utf8"));
+  }
+  if (configPath.endsWith("package.json")) {
+    const packageJson = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    return packageJson.cloudDoctor ?? {};
+  }
+  const jiti = createJiti(import.meta.url, { interopDefault: true });
+  const loaded = await jiti.import(configPath);
+  const config = loaded.default ?? loaded;
+  return config;
+};
+var loadConfig = async (cwd = process.cwd()) => {
+  const configPath = findConfigFile(cwd);
+  if (!configPath) return {};
+  return loadConfigModule(configPath);
+};
+var defineConfig = (config) => config;
+var PluginRegistry = class {
+  plugins = /* @__PURE__ */ new Map();
+  register(plugin) {
+    this.plugins.set(plugin.id, plugin);
+  }
+  get(id) {
+    return this.plugins.get(id);
+  }
+  require(id) {
+    const plugin = this.plugins.get(id);
+    if (!plugin) {
+      throw new Error(`Unknown provider: ${id}`);
+    }
+    return plugin;
+  }
+  list() {
+    return [...this.plugins.values()];
+  }
+  listAvailable() {
+    return this.list().filter((plugin) => plugin.status !== "coming-soon");
+  }
+};
+var createPluginRegistry = () => new PluginRegistry();
+var buildCategoryCounts = (diagnostics) => {
+  const counts = {};
+  for (const diagnostic of diagnostics) {
+    const bucket = counts[diagnostic.category] ?? { errors: 0, warnings: 0 };
+    if (diagnostic.severity === "error") {
+      bucket.errors += 1;
+    } else {
+      bucket.warnings += 1;
+    }
+    counts[diagnostic.category] = bucket;
+  }
+  return counts;
+};
+var buildScanSummary = (diagnostics) => {
+  const { score, label } = calculateScore(diagnostics);
+  const errorCount = diagnostics.filter((d) => d.severity === "error").length;
+  const warningCount = diagnostics.filter((d) => d.severity === "warning").length;
+  return {
+    score,
+    label,
+    errorCount,
+    warningCount,
+    categoryCounts: buildCategoryCounts(diagnostics)
+  };
+};
+var computeProjectedScore = (diagnostics, topRuleCount = TOP_FIXES_DISPLAY_COUNT) => {
+  const errorRuleKeys = /* @__PURE__ */ new Set();
+  const orderedErrorRules = [];
+  for (const diagnostic of diagnostics) {
+    if (diagnostic.severity !== "error") continue;
+    const ruleKey = `${diagnostic.plugin}/${diagnostic.rule}`;
+    if (!errorRuleKeys.has(ruleKey)) {
+      errorRuleKeys.add(ruleKey);
+      orderedErrorRules.push(ruleKey);
+    }
+  }
+  if (orderedErrorRules.length === 0) return void 0;
+  const rulesToRemove = new Set(orderedErrorRules.slice(0, topRuleCount));
+  const remaining = diagnostics.filter(
+    (d) => !rulesToRemove.has(`${d.plugin}/${d.rule}`)
+  );
+  return calculateScore(remaining).score;
+};
+var buildJsonReport = (input) => {
+  const summary = buildScanSummary(input.diagnostics);
+  const projectedScore = computeProjectedScore(input.diagnostics);
+  if (projectedScore !== void 0) {
+    summary.projectedScore = projectedScore;
+  }
+  return {
+    schemaVersion: 1,
+    provider: input.provider,
+    identity: input.identity,
+    summary,
+    diagnostics: input.diagnostics,
+    meta: input.meta
+  };
+};
+var buildJsonReportError = (input) => ({
+  schemaVersion: 1,
+  error: input.error instanceof Error ? input.error.message : String(input.error),
+  elapsedMilliseconds: input.elapsedMilliseconds
+});
+var groupDiagnosticsByRule = (diagnostics) => {
+  const groups = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const key = `${diagnostic.plugin}/${diagnostic.rule}`;
+    const existing = groups.get(key) ?? [];
+    existing.push(diagnostic);
+    groups.set(key, existing);
+  }
+  return groups;
+};
+var getTopErrorRules = (diagnostics, limit = TOP_FIXES_DISPLAY_COUNT) => {
+  const errorDiagnostics = diagnostics.filter((d) => d.severity === "error");
+  const groups = groupDiagnosticsByRule(errorDiagnostics);
+  return [...groups.entries()].slice(0, limit).map(([ruleKey, ruleDiagnostics]) => ({ ruleKey, diagnostics: ruleDiagnostics }));
+};
+var sortCategoriesForDisplay = (categories) => {
+  const rank = new Map(DIAGNOSTIC_CATEGORY_BUCKETS.map((category, index) => [category, index]));
+  return [...categories].sort((a, b) => {
+    const rankA = rank.get(a);
+    const rankB = rank.get(b);
+    if (rankA !== void 0 && rankB !== void 0) return rankA - rankB;
+    if (rankA !== void 0) return -1;
+    if (rankB !== void 0) return 1;
+    return a.localeCompare(b);
+  });
+};
+
+// ../plugin-aws/dist/index.js
+import * as os from "os";
+import * as path2 from "path";
+import { loadSharedConfigFiles } from "@smithy/shared-ini-file-loader";
+import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
+import { fromEnv, fromIni, fromInstanceMetadata, fromTokenFile } from "@aws-sdk/credential-providers";
+var profileNameFromSection = (sectionName) => {
+  if (sectionName === "default") return "default";
+  if (sectionName.startsWith("profile ")) return sectionName.slice("profile ".length);
+  if (!sectionName.includes(" ")) return sectionName;
+  return null;
+};
+var classifyProfile = (profileName, configSection, hasStaticCredentials) => {
+  if (configSection["sso_start_url"] || configSection["sso_session"]) return "sso";
+  if (configSection["role_arn"]) return "assume-role";
+  if (configSection["web_identity_token_file"]) return "web-identity";
+  if (hasStaticCredentials) return "static";
+  if (profileName === "default" && hasStaticCredentials) return "static";
+  return "unknown";
+};
+var getAwsConfigPaths = () => {
+  const home = os.homedir();
+  return {
+    configFile: process.env.AWS_CONFIG_FILE ?? path2.join(home, ".aws", "config"),
+    credentialsFile: process.env.AWS_SHARED_CREDENTIALS_FILE ?? path2.join(home, ".aws", "credentials")
+  };
+};
+var listAwsProfiles = async () => {
+  const { configFile, credentialsFile } = getAwsConfigPaths();
+  const { configFile: configSections, credentialsFile: credentialSections } = await loadSharedConfigFiles({
+    configFilepath: configFile,
+    filepath: credentialsFile
+  });
+  const profileNames = /* @__PURE__ */ new Set();
+  for (const sectionName of Object.keys(configSections)) {
+    const profileName = profileNameFromSection(sectionName);
+    if (profileName) profileNames.add(profileName);
+  }
+  for (const sectionName of Object.keys(credentialSections)) {
+    const profileName = profileNameFromSection(sectionName);
+    if (profileName) profileNames.add(profileName);
+  }
+  if (profileNames.size === 0 && process.env.AWS_ACCESS_KEY_ID) {
+    return [
+      {
+        name: "(environment)",
+        kind: "unknown"
+      }
+    ];
+  }
+  const profiles = [];
+  for (const profileName of [...profileNames].sort((a, b) => {
+    if (a === "default") return -1;
+    if (b === "default") return 1;
+    return a.localeCompare(b);
+  })) {
+    const configSection = configSections[`profile ${profileName}`] ?? configSections[profileName] ?? {};
+    const credentialSection = credentialSections[profileName] ?? {};
+    const hasStaticCredentials = Boolean(
+      credentialSection.aws_access_key_id && credentialSection.aws_secret_access_key
+    );
+    profiles.push({
+      name: profileName,
+      region: configSection.region,
+      kind: classifyProfile(profileName, configSection, hasStaticCredentials),
+      ssoSessionName: configSection.sso_session,
+      roleArn: configSection.role_arn,
+      sourceProfile: configSection.source_profile
+    });
+  }
+  return profiles;
+};
+var resolveDefaultProfileName = (profiles) => {
+  if (process.env.AWS_PROFILE) return process.env.AWS_PROFILE;
+  if (profiles.some((profile) => profile.name === "default")) return "default";
+  if (profiles.length === 1 && profiles[0]?.name !== "(environment)") {
+    return profiles[0]?.name;
+  }
+  return void 0;
+};
+var hasEnvironmentCredentials = () => Boolean(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY);
+var hasWebIdentityCredentials = () => Boolean(process.env.AWS_WEB_IDENTITY_TOKEN_FILE && process.env.AWS_ROLE_ARN);
+var kindFromProfile = (profile) => {
+  switch (profile.kind) {
+    case "sso":
+      return "sso";
+    case "assume-role":
+      return "assume-role";
+    case "web-identity":
+      return "web-identity";
+    case "static":
+      return "profile";
+    default:
+      return "profile";
+  }
+};
+var createCredentialProvider = (input) => {
+  if (input.manualAccessKeyId && input.manualSecretAccessKey) {
+    return async () => ({
+      accessKeyId: input.manualAccessKeyId,
+      secretAccessKey: input.manualSecretAccessKey,
+      sessionToken: input.manualSessionToken
+    });
+  }
+  if (input.useEnvironment || !input.profileName && process.env.AWS_ACCESS_KEY_ID) {
+    return fromEnv();
+  }
+  if (!input.profileName && process.env.AWS_WEB_IDENTITY_TOKEN_FILE) {
+    return fromTokenFile({
+      roleArn: process.env.AWS_ROLE_ARN,
+      webIdentityTokenFile: process.env.AWS_WEB_IDENTITY_TOKEN_FILE
+    });
+  }
+  if (input.profileName) {
+    return fromIni({ profile: input.profileName });
+  }
+  return async () => {
+    try {
+      return await fromEnv()();
+    } catch {
+      try {
+        return await fromIni()();
+      } catch {
+        return fromInstanceMetadata()();
+      }
+    }
+  };
+};
+var validateAwsCredentials = async (input) => {
+  const credentials = createCredentialProvider({
+    profileName: input.profileName,
+    region: input.region,
+    useEnvironment: input.useEnvironment,
+    manualAccessKeyId: input.manualAccessKeyId,
+    manualSecretAccessKey: input.manualSecretAccessKey,
+    manualSessionToken: input.manualSessionToken
+  });
+  const client = new STSClient({
+    credentials,
+    region: input.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-1"
+  });
+  try {
+    const response = await client.send(new GetCallerIdentityCommand({}));
+    return {
+      provider: "aws",
+      id: response.Account ?? "unknown",
+      label: input.label,
+      kind: input.kind,
+      profileName: input.profileName,
+      region: input.region,
+      accountId: response.Account,
+      arn: response.Arn
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("Token has expired") || message.includes("sso")) {
+      throw new SsoLoginRequiredError(input.profileName ?? "default");
+    }
+    throw error;
+  } finally {
+    client.destroy();
+  }
+};
+var SsoLoginRequiredError = class extends Error {
+  profileName;
+  constructor(profileName) {
+    super(`Profile "${profileName}" requires SSO login. Run: aws sso login --profile ${profileName}`);
+    this.name = "SsoLoginRequiredError";
+    this.profileName = profileName;
+  }
+};
+var profileToIdentityKind = kindFromProfile;
+var runAwsRules = async (identity, _config) => {
+  void identity;
+  return [];
+};
+var formatProfileLabel = (profileName, region) => {
+  const regionSuffix = region ? ` \xB7 ${region}` : "";
+  return `${profileName}${regionSuffix}`;
+};
+var buildProfileSummaries = async () => {
+  const profiles = await listAwsProfiles();
+  const summaries = [];
+  for (const profile of profiles) {
+    if (profile.name === "(environment)") continue;
+    summaries.push({
+      id: profile.name,
+      label: formatProfileLabel(profile.name, profile.region),
+      kind: profileToIdentityKind(profile),
+      profileName: profile.name,
+      defaultRegion: profile.region,
+      status: "unknown",
+      hint: profile.kind === "sso" ? "SSO profile \u2014 will validate on selection" : profile.kind === "assume-role" ? `Assumes ${profile.roleArn ?? "role"}` : void 0
+    });
+  }
+  if (hasEnvironmentCredentials()) {
+    summaries.unshift({
+      id: "__environment__",
+      label: "(environment credentials)",
+      kind: "environment",
+      status: "unknown",
+      hint: "AWS_ACCESS_KEY_ID is set"
+    });
+  }
+  if (hasWebIdentityCredentials()) {
+    summaries.unshift({
+      id: "__web_identity__",
+      label: "(web identity / OIDC)",
+      kind: "web-identity",
+      status: "unknown",
+      hint: process.env.AWS_ROLE_ARN
+    });
+  }
+  return summaries;
+};
+var resolveProfileInput = (input, configProfile) => {
+  if (input.useEnvironment) return { useEnvironment: true };
+  if (input.profile) return { profileName: input.profile };
+  if (configProfile) return { profileName: configProfile };
+  if (process.env.AWS_PROFILE) return { profileName: process.env.AWS_PROFILE };
+  const envSelected = input.manualAccessKeyId ? void 0 : hasEnvironmentCredentials();
+  if (envSelected && !input.profile) return { useEnvironment: true };
+  return {};
+};
+var awsPlugin = {
+  id: "aws",
+  displayName: "AWS",
+  description: "Amazon Web Services account",
+  status: "stable",
+  async discoverIdentities(_ctx) {
+    return buildProfileSummaries();
+  },
+  async resolveIdentity(ctx, input) {
+    const profiles = await listAwsProfiles();
+    const resolution = resolveProfileInput(input, void 0);
+    if (resolution.useEnvironment) {
+      return {
+        provider: "aws",
+        id: "__environment__",
+        label: "(environment credentials)",
+        kind: "environment",
+        region: input.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION
+      };
+    }
+    if (input.manualAccessKeyId && input.manualSecretAccessKey) {
+      return {
+        provider: "aws",
+        id: "__manual__",
+        label: "(manual credentials)",
+        kind: "manual",
+        region: input.region
+      };
+    }
+    const profileName = resolution.profileName ?? resolveDefaultProfileName(profiles) ?? profiles[0]?.name;
+    if (!profileName) {
+      if (ctx.yes || ctx.json) {
+        throw new Error(
+          "No AWS profiles found. Configure ~/.aws/config or pass --profile, set AWS_PROFILE, or use environment credentials."
+        );
+      }
+      throw new Error("No AWS profiles found");
+    }
+    const profile = profiles.find((entry) => entry.name === profileName);
+    return {
+      provider: "aws",
+      id: profileName,
+      label: formatProfileLabel(profileName, profile?.region ?? input.region),
+      kind: profile ? profileToIdentityKind(profile) : "profile",
+      profileName,
+      region: input.region ?? profile?.region
+    };
+  },
+  async validateIdentity(identity) {
+    if (identity.kind === "manual") {
+      throw new Error("Manual credentials must be validated via validateAwsCredentials before scan.");
+    }
+    return validateAwsCredentials({
+      profileName: identity.profileName,
+      region: identity.region,
+      label: identity.label,
+      kind: identity.kind,
+      useEnvironment: identity.kind === "environment"
+    });
+  },
+  async scan(identity, config) {
+    const start = performance.now();
+    const diagnostics = await runAwsRules(identity, config);
+    const summary = buildScanSummary(diagnostics);
+    return {
+      provider: "aws",
+      identity,
+      diagnostics,
+      summary,
+      meta: {
+        durationMs: Math.round(performance.now() - start),
+        regionsScanned: config.regions
+      }
+    };
+  }
+};
+
+// ../plugins/dist/index.js
+var comingSoon = (id, displayName, description) => ({
+  id,
+  displayName,
+  description,
+  status: "coming-soon",
+  async discoverIdentities() {
+    return [];
+  },
+  async resolveIdentity() {
+    throw new Error(`${displayName} support is coming soon. Use "aws" for now.`);
+  },
+  async validateIdentity(identity) {
+    return identity;
+  },
+  async scan() {
+    throw new Error(`${displayName} support is coming soon.`);
+  }
+});
+var gcloudPlugin = comingSoon("gcloud", "GCloud", "Google Cloud project");
+var k8sPlugin = comingSoon("k8s", "Kubernetes", "Cluster workloads");
+var dbPlugin = comingSoon("db", "Database", "Postgres, MySQL, Redis, and more");
+var cloudflarePlugin = comingSoon("cloudflare", "Cloudflare", "DNS, WAF, Workers");
+var cachedRegistry = null;
+var createDefaultRegistry = () => {
+  const registry = createPluginRegistry();
+  registry.register(awsPlugin);
+  registry.register(gcloudPlugin);
+  registry.register(k8sPlugin);
+  registry.register(dbPlugin);
+  registry.register(cloudflarePlugin);
+  return registry;
+};
+var getDefaultRegistry = () => {
+  if (!cachedRegistry) {
+    cachedRegistry = createDefaultRegistry();
+  }
+  return cachedRegistry;
+};
+var PROVIDER_IDS = ["aws", "gcloud", "k8s", "db", "cloudflare"];
+var isProviderId = (value) => PROVIDER_IDS.includes(value);
+
+export {
+  TOP_FIXES_DISPLAY_COUNT,
+  highlighter,
+  setColorEnabled,
+  loadConfig,
+  defineConfig,
+  computeProjectedScore,
+  buildJsonReport,
+  buildJsonReportError,
+  getTopErrorRules,
+  sortCategoriesForDisplay,
+  listAwsProfiles,
+  validateAwsCredentials,
+  SsoLoginRequiredError,
+  getDefaultRegistry,
+  isProviderId
+};
+//# sourceMappingURL=chunk-4PZ65VRA.js.map