@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/cjs/__chunks/LFDSHANP.cjs

@@ -0,0 +1,34 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _BLMSMR5Ecjs = require('./BLMSMR5E.cjs');
+
+
+
+var _WOYF2L6Tcjs = require('./WOYF2L6T.cjs');
+
+// src/commands/aws/route53/remove-record/schema.js
+var _zod = require('zod');
+var removeRecordOptionsSchema = _zod.z.object({
+  profile: _WOYF2L6Tcjs.profileField,
+  zone: _zod.z.string().optional().describe(
+    "Hosted zone name or ID (e.g. mountaindev.com or Z123\u2026). Skips the zone picker when set."
+  ),
+  type: _zod.z.string().optional().transform(
+    (value) => value === void 0 ? void 0 : value.toUpperCase()
+  ).refine(
+    (value) => value === void 0 || typeof value === "string" && _BLMSMR5Ecjs.RECORD_TYPES.includes(value),
+    {
+      message: `Record type must be one of: ${_BLMSMR5Ecjs.RECORD_TYPES.join(", ")}`
+    }
+  ).describe(`DNS record type (${_BLMSMR5Ecjs.RECORD_TYPES.join(", ")})`),
+  name: _zod.z.string().optional().describe(
+    'Record name relative to the zone (e.g. "redline") or a fully-qualified name'
+  ),
+  yes: _zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+  dryRun: _zod.z.boolean().optional().default(false).describe("Preview the deletion without calling Route53"),
+  verbose: _WOYF2L6Tcjs.verboseField
+});
+
+
+
+exports.removeRecordOptionsSchema = removeRecordOptionsSchema;

package/cjs/__chunks/LHE24ECK.cjs

@@ -0,0 +1,192 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+
+
+
+
+
+var _SBBNW2BFcjs = require('./SBBNW2BF.cjs');
+
+
+var _3T2LXW7Jcjs = require('./3T2LXW7J.cjs');
+
+
+var _FM5MVRQFcjs = require('./FM5MVRQF.cjs');
+
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/aws/iam/setup-acl/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function resolveRestrictRegions(params) {
+  const { restrictRegions } = params;
+  if (restrictRegions) {
+    console.log(`Region restriction: ${restrictRegions}`);
+    return restrictRegions === "yes";
+  }
+  console.log("Region restriction");
+  console.log(
+    "  The policy UserAdminsDenyRegionsList limits acl-power-users to a hard-coded"
+  );
+  console.log(
+    "  region allowlist. Most accounts should leave this OFF unless you have a strong reason."
+  );
+  const restrict = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
+    message: "  Attach region restriction to acl-power-users?",
+    defaultYes: false
+  });
+  console.log(`  \u2192 ${restrict ? "yes" : "no"}`);
+  console.log("");
+  return restrict;
+}
+async function setupAclCommand(options) {
+  try {
+    const {
+      restrictRegions,
+      createUsers,
+      profile: profileOption,
+      region,
+      verbose
+    } = _FM5MVRQFcjs.setupAclOptionsSchema.parse(options);
+    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
+    const profile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile: profileOption });
+    const identity = _R3GUC7O7cjs.getCallerIdentity.call(void 0, { profile, region, verbose });
+    const accountId = identity.Account;
+    console.log("Caller:");
+    console.log(`  Account: ${accountId}`);
+    console.log(`  Arn:     ${identity.Arn}`);
+    console.log("");
+    const restrict = await resolveRestrictRegions({ restrictRegions });
+    console.log("1. Ensure groups exist...");
+    for (const group of _SBBNW2BFcjs.ACL_GROUPS) {
+      _SBBNW2BFcjs.ensureGroup.call(void 0, { name: group, profile, verbose });
+    }
+    console.log("");
+    console.log("2. Publish custom policies...");
+    for (const policy of _SBBNW2BFcjs.CUSTOM_POLICIES) {
+      _SBBNW2BFcjs.publishPolicy.call(void 0, {
+        name: policy.name,
+        fileName: policy.fileName,
+        accountId,
+        profile,
+        verbose
+      });
+    }
+    console.log("");
+    const ADMIN = "arn:aws:iam::aws:policy/AdministratorAccess";
+    const IAM_FULL = "arn:aws:iam::aws:policy/IAMFullAccess";
+    const READ_ONLY = "arn:aws:iam::aws:policy/ReadOnlyAccess";
+    const WRITE_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsWriteList`;
+    const DENY_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsDenyList`;
+    const SELF_SERVICE = `arn:aws:iam::${accountId}:policy/UserAdminsSelfServiceIAM`;
+    const DENY_REGIONS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyRegionsList`;
+    const STS_FEDERATION = `arn:aws:iam::${accountId}:policy/sts-federation`;
+    const S3_RESTRICTIONS = `arn:aws:iam::${accountId}:policy/S3RestrictionsDenyNonS3Services`;
+    console.log("3. Attach policies to groups...");
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-admin-do-not-use", arn: ADMIN, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-iam-full-access", arn: IAM_FULL, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-iam-full-access", arn: READ_ONLY, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, {
+      group: "acl-iam-full-access",
+      arn: SELF_SERVICE,
+      profile,
+      verbose
+    });
+    _SBBNW2BFcjs.attach.call(void 0, {
+      group: "acl-iam-full-access",
+      arn: STS_FEDERATION,
+      profile,
+      verbose
+    });
+    _SBBNW2BFcjs.detach.call(void 0, { group: "acl-iam-full-access", arn: DENY_LIST, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: READ_ONLY, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: WRITE_LIST, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: DENY_LIST, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: SELF_SERVICE, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-read-only", arn: READ_ONLY, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, { group: "acl-read-only", arn: STS_FEDERATION, profile, verbose });
+    _SBBNW2BFcjs.attach.call(void 0, {
+      group: "acl-s3-restrictions",
+      arn: S3_RESTRICTIONS,
+      profile,
+      verbose
+    });
+    console.log("");
+    console.log("4. Apply region restriction to acl-power-users...");
+    if (restrict) {
+      _SBBNW2BFcjs.attach.call(void 0, { group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
+    } else {
+      _SBBNW2BFcjs.detach.call(void 0, { group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
+    }
+    console.log("");
+    console.log("5. Detach legacy policies (if present)...");
+    const LEGACY_POWER_USER = "arn:aws:iam::aws:policy/PowerUserAccess";
+    const LEGACY_IAM_RO = "arn:aws:iam::aws:policy/IAMReadOnlyAccess";
+    const LEGACY_ALLOW = `arn:aws:iam::${accountId}:policy/UserAdminsAllowList`;
+    const LEGACY_DENY_SVCS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListServices`;
+    const LEGACY_DENY_GPU = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListGpu`;
+    const legacyArns = [
+      LEGACY_POWER_USER,
+      LEGACY_IAM_RO,
+      LEGACY_ALLOW,
+      LEGACY_DENY_SVCS,
+      LEGACY_DENY_GPU
+    ];
+    for (const group of _SBBNW2BFcjs.ACL_GROUPS) {
+      for (const arn of legacyArns) {
+        _SBBNW2BFcjs.detach.call(void 0, { group, arn, profile, verbose });
+      }
+    }
+    console.log("");
+    console.log("6. Final state:");
+    _SBBNW2BFcjs.printFinalState.call(void 0, { profile, verbose });
+    console.log("");
+    if (createUsers) {
+      console.log("7. Create IAM users (optional)");
+      console.log("");
+      await _3T2LXW7Jcjs.createUsersInteractive.call(void 0, { profile, verbose });
+    }
+    console.log(_chalk2.default.green("\n\u2705 ACL setup complete."));
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C iam setup-acl failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Run with a profile that has IAMFullAccess (e.g. md-*-iam-admin).\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.setupAclCommand = setupAclCommand;

package/cjs/__chunks/LIKQ3SI4.cjs

@@ -0,0 +1 @@
+"use strict";

package/cjs/__chunks/LXDF5QVZ.cjs

@@ -0,0 +1,313 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _3A5ZYU5Mcjs = require('./3A5ZYU5M.cjs');
+
+
+
+var _K4QNHRTPcjs = require('./K4QNHRTP.cjs');
+
+
+
+
+
+var _H74JSDBUcjs = require('./H74JSDBU.cjs');
+
+
+
+
+
+
+var _NWZGFHKHcjs = require('./NWZGFHKH.cjs');
+
+
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/db/create-readonly-user/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function resolveEngine(engineOption, url) {
+  if (engineOption) {
+    return engineOption;
+  }
+  if (url) {
+    const detected = _NWZGFHKHcjs.detectEngineFromUrl.call(void 0, url);
+    if (detected) {
+      return detected;
+    }
+  }
+  const index = await _CMUD7LLNcjs.promptChoice.call(void 0, {
+    message: "Choose a database engine:",
+    options: ["postgres", "mysql"]
+  });
+  const chosen = _H74JSDBUcjs.ENGINES[index];
+  if (!chosen) {
+    throw new Error("No engine selected");
+  }
+  return chosen;
+}
+async function resolveUrl(params) {
+  const { urlOption, engine } = params;
+  const fromEnv = _NWZGFHKHcjs.resolveAdminUrl.call(void 0, { url: urlOption, engine });
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const example = engine === "postgres" ? "postgresql://admin:pass@host:5432/postgres" : "mysql://admin:pass@host:3306/";
+  const raw = await _CMUD7LLNcjs.prompt.call(void 0, `  Admin connection URL (e.g. ${example}): `);
+  if (!raw) {
+    throw new Error(
+      "Admin connection URL is required (pass --url or set DATABASE_URL)"
+    );
+  }
+  return raw;
+}
+async function resolveScope(params) {
+  const { databaseOption, databases } = params;
+  if (databaseOption) {
+    const normalized = databaseOption.trim().toLowerCase();
+    if (normalized === "all" || normalized === "*") {
+      return { mode: "all", databases };
+    }
+    if (!databases.includes(databaseOption)) {
+      throw new Error(
+        `Database "${databaseOption}" not found. Available: ${databases.join(", ") || "(none)"}`
+      );
+    }
+    return { mode: "one", databases: [databaseOption] };
+  }
+  if (databases.length === 0) {
+    throw new Error("No user databases found to grant access on.");
+  }
+  const options = [
+    ...databases.map((name) => name),
+    `all (${databases.length} databases)`
+  ];
+  const index = await _CMUD7LLNcjs.promptChoice.call(void 0, {
+    message: "Grant read-only on which database?",
+    options
+  });
+  if (index === options.length - 1) {
+    return { mode: "all", databases };
+  }
+  const chosen = databases[index];
+  if (!chosen) {
+    throw new Error("No database selected");
+  }
+  return { mode: "one", databases: [chosen] };
+}
+async function resolveUsername(usernameOption) {
+  if (usernameOption) {
+    return usernameOption;
+  }
+  const raw = await _CMUD7LLNcjs.prompt.call(void 0, 
+    `  Read-only username [default: ${_H74JSDBUcjs.DEFAULT_READONLY_USERNAME}]: `
+  );
+  const username = raw || _H74JSDBUcjs.DEFAULT_READONLY_USERNAME;
+  if (!/^[A-Za-z0-9_]+$/.test(username)) {
+    throw new Error(
+      "Username must contain only letters, numbers, and underscores"
+    );
+  }
+  return username;
+}
+async function resolvePassword(passwordOption) {
+  if (passwordOption) {
+    return { password: passwordOption, generated: false };
+  }
+  const generate = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
+    message: "  Generate a random password?",
+    defaultYes: true
+  });
+  if (generate) {
+    return { password: _NWZGFHKHcjs.generatePassword.call(void 0, ), generated: true };
+  }
+  const password = await _CMUD7LLNcjs.prompt.call(void 0, "  Password: ");
+  if (!password) {
+    throw new Error("Password is required");
+  }
+  return { password, generated: false };
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.password) {
+      parsed.password = "***";
+    }
+    return parsed.toString();
+  } catch (e) {
+    return url;
+  }
+}
+async function createReadonlyUserCommand(options) {
+  try {
+    const {
+      engine: engineOption,
+      url: urlOption,
+      database: databaseOption,
+      username: usernameOption,
+      password: passwordOption,
+      hostPattern: hostPatternOption,
+      ssl: sslOption,
+      yes,
+      dryRun,
+      verbose
+    } = _H74JSDBUcjs.createReadonlyUserOptionsSchema.parse(options);
+    console.log(_chalk2.default.blue("\nCreate read-only database user"));
+    console.log("");
+    const urlForDetect = _NWZGFHKHcjs.resolveAdminUrl.call(void 0, {
+      url: urlOption,
+      engine: engineOption
+    });
+    const engine = await resolveEngine(engineOption, urlForDetect);
+    console.log(`Engine: ${engine}`);
+    const url = await resolveUrl({ urlOption, engine });
+    const config = _NWZGFHKHcjs.parseConnectionUrl.call(void 0, {
+      url,
+      engine,
+      sslOption
+    });
+    console.log(
+      `Admin:  ${config.user}@${config.host}:${config.port}` + (config.database ? `/${config.database}` : "")
+    );
+    console.log("");
+    const listed = engine === "postgres" ? await _K4QNHRTPcjs.listPostgresDatabases.call(void 0, config) : await _3A5ZYU5Mcjs.listMysqlDatabases.call(void 0, config);
+    if (verbose) {
+      console.log(`Found databases: ${listed.join(", ") || "(none)"}`);
+      console.log("");
+    }
+    const scope = await resolveScope({
+      databaseOption,
+      databases: listed
+    });
+    console.log(
+      scope.mode === "all" ? `Scope:  all (${scope.databases.length} databases)` : `Scope:  ${scope.databases[0]}`
+    );
+    console.log("");
+    const username = await resolveUsername(usernameOption);
+    const { password, generated } = await resolvePassword(passwordOption);
+    const hostPattern = _nullishCoalesce(hostPatternOption, () => ( _H74JSDBUcjs.DEFAULT_MYSQL_HOST_PATTERN));
+    console.log("");
+    console.log("Plan:");
+    console.log(`  User:     ${username}`);
+    console.log(
+      `  Password: ${generated ? "(generated)" : "(provided)"}${dryRun ? " [dry-run]" : ""}`
+    );
+    if (engine === "mysql") {
+      console.log(`  Host:     ${hostPattern}`);
+    }
+    console.log(
+      scope.mode === "all" ? `  Grants:   SELECT on ALL databases (${scope.databases.length})` : `  Grants:   SELECT on ${scope.databases[0]}`
+    );
+    if (scope.mode === "all" && engine === "postgres") {
+      console.log(
+        _chalk2.default.yellow(
+          "  Note:     Databases created later will NOT get these grants automatically \u2014 re-run this command."
+        )
+      );
+    }
+    console.log("");
+    if (!yes && !dryRun) {
+      const confirmed = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
+        message: "Apply these changes?",
+        defaultYes: false
+      });
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+      console.log("");
+    }
+    const result = engine === "postgres" ? await _K4QNHRTPcjs.applyPostgresReadonly.call(void 0, {
+      config,
+      username,
+      password,
+      databases: scope.databases,
+      dryRun,
+      verbose
+    }) : await _3A5ZYU5Mcjs.applyMysqlReadonly.call(void 0, {
+      config,
+      username,
+      password,
+      databases: scope.mode === "all" ? "all" : scope.databases,
+      hostPattern,
+      dryRun,
+      verbose
+    });
+    if (dryRun) {
+      console.log(_chalk2.default.cyan("Dry run \u2014 SQL that would run:"));
+      for (const statement of result.statements) {
+        console.log(`  ${statement}`);
+      }
+      console.log("");
+      console.log(_chalk2.default.cyan("No changes made."));
+      return;
+    }
+    console.log(
+      _chalk2.default.green(
+        result.created ? `Created user "${username}" and granted read-only access.` : `Updated user "${username}" password and refreshed read-only grants.`
+      )
+    );
+    console.log("");
+    const sampleDb = scope.mode === "one" ? _nullishCoalesce(scope.databases[0], () => ( "")) : _nullishCoalesce(scope.databases[0], () => ( ""));
+    const readonlyUrl = _NWZGFHKHcjs.buildReadonlyUrl.call(void 0, {
+      engine,
+      host: config.host,
+      port: config.port,
+      username,
+      password,
+      database: sampleDb
+    });
+    console.log("Connection (secret shown once \u2014 copy now):");
+    console.log(
+      "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+    );
+    console.log(readonlyUrl);
+    if (scope.mode === "all") {
+      console.log("");
+      console.log(
+        _chalk2.default.gray(
+          `  (URL uses database "${sampleDb}" as an example; user can connect to any granted database.)`
+        )
+      );
+    }
+    console.log(
+      "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+    );
+    console.log("");
+    console.log(_chalk2.default.gray(`Admin URL used: ${redactUrl(url)}`));
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C create-readonly-user failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Pass --url or set DATABASE_URL. Use --verbose for details.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.createReadonlyUserCommand = createReadonlyUserCommand;

package/cjs/__chunks/LXOOJR2R.cjs

@@ -0,0 +1,74 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _XMKOKRXZcjs = require('./XMKOKRXZ.cjs');
+
+
+var _3T2LXW7Jcjs = require('./3T2LXW7J.cjs');
+
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
+
+// src/commands/aws/iam/users/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+async function usersCommand(options) {
+  try {
+    const {
+      accountName,
+      profile: profileOption,
+      verbose
+    } = _XMKOKRXZcjs.usersOptionsSchema.parse(options);
+    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
+    const profile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile: profileOption });
+    console.log(_chalk2.default.blue("\nAWS IAM user management"));
+    console.log("");
+    console.log("Caller:");
+    const identity = _R3GUC7O7cjs.getCallerIdentity.call(void 0, { profile, verbose });
+    console.log(`  Account: ${identity.Account}`);
+    console.log(`  Arn:     ${identity.Arn}`);
+    console.log("");
+    await _3T2LXW7Jcjs.createUsersInteractive.call(void 0, {
+      accountName,
+      profile,
+      identity,
+      verbose
+    });
+    console.log("Done.");
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C iam users failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI and a profile with IAM write access.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.usersCommand = usersCommand;