@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-pr-20-20261020022402

package/cjs/__chunks/{EMMC33QA.cjs → JB7T7PKQ.cjs}

@@ -12,9 +12,16 @@ var _child_process = require('child_process');
 
 
 var _fs = require('fs');
+var _os = require('os');
+var _path = require('path');
 var _readline = require('readline');
 var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
 var DEFAULT_DOPPLER_ENVIRONMENT = "dev";
+var DOPPLER_INTERNAL_KEYS = /* @__PURE__ */ new Set([
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT"
+]);
 function execDoppler(args, parser = "string", silent = false, verbose = false) {
   const command = `doppler ${args.join(" ")}`;
   let verbosity = "default";
@@ -29,18 +36,18 @@ function execDoppler(args, parser = "string", silent = false, verbose = false) {
     throwOnError: true
   });
 }
-function checkDependencies(verbose = false) {
+function checkDopplerAuth(verbose = false) {
   if (verbose) {
-    console.log(_chalk2.default.blue("\n\u{1F50D} Checking Doppler dependencies..."));
+    console.log(_chalk2.default.blue("\n\u{1F50D} Checking Doppler authentication..."));
   }
   try {
     _child_process.execSync.call(void 0, "which doppler", { stdio: "pipe" });
     if (verbose) {
       console.log(_chalk2.default.green("   \u2713 Doppler CLI is installed"));
     }
-  } catch (e) {
+  } catch (e2) {
     throw new Error(
-      "Doppler is not installed. Please install Doppler (brew install dopplerhq/cli/doppler), login, setup, and try again."
+      "Doppler is not installed. Please install Doppler (brew install dopplerhq/cli/doppler), login, and try again."
     );
   }
   try {
@@ -48,37 +55,40 @@ function checkDependencies(verbose = false) {
     if (verbose) {
       console.log(_chalk2.default.green("   \u2713 Doppler is authenticated"));
     }
-  } catch (e2) {
+  } catch (e3) {
     throw new Error(
-      "Doppler is not logged in. Please run 'doppler login' then 'doppler setup' and try again."
+      "Doppler is not logged in. Please run 'doppler login' and try again."
     );
   }
+}
+function checkDependencies(verbose = false) {
+  checkDopplerAuth(verbose);
+  if (verbose) {
+    console.log(_chalk2.default.blue("\n\u{1F50D} Checking Doppler project setup..."));
+  }
   try {
     execDoppler(["configs", "--json"], "json", true, verbose);
     if (verbose) {
       console.log(_chalk2.default.green("   \u2713 Doppler project is configured"));
     }
-  } catch (e3) {
+  } catch (e4) {
     throw new Error(
       "Doppler is not configured. Please run 'doppler setup' and try again."
     );
   }
 }
-function getConfigs(environment, verbose = false) {
+function getConfigs(environments, verbose = false, project = null) {
   if (verbose) {
     console.log(
       _chalk2.default.blue(
         `
-\u{1F4CB} Resolving configurations for environment: ${_chalk2.default.cyan(environment)}`
+\u{1F4CB} Resolving configurations for environments: ${_chalk2.default.cyan(environments)}`
       )
     );
   }
-  const availableConfigs = execDoppler(
-    ["configs", "--json"],
-    "json",
-    true,
-    verbose
-  );
+  const configArgs = ["configs", "--json"];
+  if (project) configArgs.push("--project", project);
+  const availableConfigs = execDoppler(configArgs, "json", true, verbose);
   const configNames = Array.isArray(availableConfigs) ? availableConfigs.map(
     (config) => config.name
   ) : [];
@@ -87,7 +97,7 @@ function getConfigs(environment, verbose = false) {
       _chalk2.default.gray(`   Available configurations: ${configNames.join(", ")}`)
     );
   }
-  if (environment === "all") {
+  if (environments === "all") {
     if (configNames.length === 0) {
       throw new Error("No configurations found in Doppler");
     }
@@ -98,15 +108,21 @@ function getConfigs(environment, verbose = false) {
     }
     return configNames;
   }
-  if (configNames.length > 0 && !configNames.includes(environment)) {
-    throw new Error(
-      `Configuration "${environment}" not found. Available configurations: ${configNames.join(", ")}`
-    );
+  const requested = environments.split(",").map((e) => e.trim());
+  if (configNames.length > 0) {
+    const missing = requested.filter((e) => !configNames.includes(e));
+    if (missing.length > 0) {
+      throw new Error(
+        `Configurations not found: ${missing.join(", ")}. Available: ${configNames.join(", ")}`
+      );
+    }
   }
   if (verbose) {
-    console.log(_chalk2.default.green(`   \u2713 Using configuration: ${environment}`));
+    console.log(
+      _chalk2.default.green(`   \u2713 Using configurations: ${requested.join(", ")}`)
+    );
   }
-  return [environment];
+  return requested;
 }
 function normalizeEscapeSequences(content) {
   return content.replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\r/g, "\r");
@@ -145,9 +161,9 @@ function promptConfirmation(message) {
   });
 }
 async function downloadConfigs(options) {
-  const { environment, verbose } = options;
-  const actualEnvironment = _nullishCoalesce(environment, () => ( DEFAULT_DOPPLER_ENVIRONMENT));
-  const configs = getConfigs(actualEnvironment, verbose);
+  const { environments, verbose } = options;
+  const actualEnvironments = _nullishCoalesce(environments, () => ( DEFAULT_DOPPLER_ENVIRONMENT));
+  const configs = getConfigs(actualEnvironments, verbose);
   if (verbose) {
     console.log(
       _chalk2.default.blue(
@@ -156,9 +172,9 @@ async function downloadConfigs(options) {
       )
     );
   }
-  if (configs.length === 1 && environment !== "all") {
+  if (configs.length === 1 && actualEnvironments !== "all") {
     console.log(
-      "You can use -e all to download all configurations, or -e <env> for a specific environment."
+      "You can use -e all to download all configurations, or -e dev,stg for specific environments."
     );
   }
   for (const config of configs) {
@@ -228,8 +244,8 @@ async function downloadConfigs(options) {
   }
 }
 async function uploadConfigs(options) {
-  const { environment, verbose } = options;
-  const configs = getConfigs(environment, verbose);
+  const { environments, verbose } = options;
+  const configs = getConfigs(environments, verbose);
   if (verbose) {
     console.log(
       _chalk2.default.blue(
@@ -282,7 +298,7 @@ async function uploadConfigs(options) {
         } else {
           throw new Error("Invalid backup content received from Doppler");
         }
-      } catch (e4) {
+      } catch (e5) {
         console.log(
           `Config ${config}: Failed to create backup. Skipping upload.`
         );
@@ -345,7 +361,7 @@ async function uploadConfigs(options) {
             `Config ${config}: Successfully uploaded ${_chalk2.default.green(envFile)}`
           );
         }
-      } catch (e5) {
+      } catch (e6) {
         console.error(
           `Config ${config}: Failed to upload ${_chalk2.default.green(envFile)}. Restoring previous configuration.`
         );
@@ -363,7 +379,7 @@ async function uploadConfigs(options) {
           console.log(
             `Config ${config}: Successfully restored previous configuration`
           );
-        } catch (e6) {
+        } catch (e7) {
           console.error(
             `Config ${config}: Failed to restore previous configuration`
           );
@@ -388,6 +404,127 @@ async function uploadConfigs(options) {
     }
   }
 }
+async function cloneProject({ from, to, environments, force, verbose }) {
+  if (verbose) {
+    console.log(
+      _chalk2.default.blue(
+        `
+\u{1F501} Cloning from ${_chalk2.default.cyan(from)} to ${_chalk2.default.cyan(to)}...`
+      )
+    );
+  }
+  const configsToClone = getConfigs(environments, verbose, from);
+  if (configsToClone.length === 0) {
+    throw new Error(`No configurations found in source project "${from}"`);
+  }
+  const targetConfigsRaw = execDoppler(
+    ["configs", "--json", "--project", to],
+    "json",
+    true,
+    verbose
+  );
+  const targetConfigNames = Array.isArray(targetConfigsRaw) ? targetConfigsRaw.map((c) => c.name) : [];
+  const missingInTarget = configsToClone.filter(
+    (c) => !targetConfigNames.includes(c)
+  );
+  if (missingInTarget.length > 0) {
+    throw new Error(
+      `Configs missing in target project "${to}": ${missingInTarget.join(", ")}. Create them in Doppler first.`
+    );
+  }
+  for (const config of configsToClone) {
+    if (verbose) {
+      console.log(_chalk2.default.blue(`
+\u{1F4E6} Processing config: ${_chalk2.default.cyan(config)}`));
+    }
+    const sourceSecrets = execDoppler(
+      ["secrets", "--json", "--project", from, "--config", config],
+      "json",
+      true,
+      verbose
+    );
+    const sourceKeys = sourceSecrets ? Object.keys(sourceSecrets).filter((k) => !DOPPLER_INTERNAL_KEYS.has(k)) : [];
+    const targetSecrets = execDoppler(
+      ["secrets", "--json", "--project", to, "--config", config],
+      "json",
+      true,
+      verbose
+    );
+    const targetKeys = targetSecrets ? Object.keys(targetSecrets) : [];
+    const conflicts = sourceKeys.filter((k) => targetKeys.includes(k));
+    if (conflicts.length > 0) {
+      if (process.env["CI"]) {
+        throw new Error(
+          `Config "${config}" has ${conflicts.length} conflicting key(s) in target: ${conflicts.join(", ")}`
+        );
+      }
+      if (!force) {
+        console.log(
+          `
+Config ${_chalk2.default.cyan(config)}: ${conflicts.length} key(s) already exist in ${_chalk2.default.cyan(to)}:`
+        );
+        conflicts.forEach((k) => console.log(_chalk2.default.yellow(`  \u2022 ${k}`)));
+        const confirmed = await promptConfirmation(
+          `
+Overwrite these keys in "${to}/${config}"? (y/n) `
+        );
+        if (!confirmed) {
+          console.log(`Skipped ${_chalk2.default.blue(config)}`);
+          continue;
+        }
+      }
+    }
+    const tmpFile = _path.join.call(void 0, _os.tmpdir.call(void 0, ), `doppler-clone-${config}-${Date.now()}.env`);
+    try {
+      const content = execDoppler(
+        [
+          "secrets",
+          "download",
+          "--no-file",
+          "--format",
+          "env",
+          "--project",
+          from,
+          "--config",
+          config
+        ],
+        "string",
+        true,
+        verbose
+      );
+      if (typeof content !== "string" || !content) {
+        throw new Error(`No secrets returned for config "${config}"`);
+      }
+      const filtered = content.split("\n").filter((line) => {
+        const key = _nullishCoalesce(line.split("=")[0], () => ( ""));
+        return !DOPPLER_INTERNAL_KEYS.has(key);
+      }).join("\n");
+      _fs.writeFileSync.call(void 0, tmpFile, filtered, "utf-8");
+      execDoppler(
+        [
+          "secrets",
+          "upload",
+          tmpFile,
+          "--project",
+          to,
+          "--config",
+          config,
+          "--silent"
+        ],
+        "string",
+        true,
+        verbose
+      );
+      console.log(`Config ${_chalk2.default.blue(config)}: cloned to ${_chalk2.default.green(to)}`);
+    } finally {
+      if (_fs.existsSync.call(void 0, tmpFile)) {
+        _fs.unlinkSync.call(void 0, tmpFile);
+      }
+    }
+  }
+}
+
+
 
 
 
@@ -398,4 +535,4 @@ async function uploadConfigs(options) {
 
 
 
-exports.execDoppler = execDoppler; exports.checkDependencies = checkDependencies; exports.getConfigs = getConfigs; exports.normalizeEscapeSequences = normalizeEscapeSequences; exports.createDiff = createDiff; exports.promptConfirmation = promptConfirmation; exports.downloadConfigs = downloadConfigs; exports.uploadConfigs = uploadConfigs;
+exports.execDoppler = execDoppler; exports.checkDopplerAuth = checkDopplerAuth; exports.checkDependencies = checkDependencies; exports.getConfigs = getConfigs; exports.normalizeEscapeSequences = normalizeEscapeSequences; exports.createDiff = createDiff; exports.promptConfirmation = promptConfirmation; exports.downloadConfigs = downloadConfigs; exports.uploadConfigs = uploadConfigs; exports.cloneProject = cloneProject;

package/cjs/__chunks/JSL2JDMW.cjs

@@ -0,0 +1 @@
+"use strict";

package/cjs/__chunks/K4QNHRTP.cjs

@@ -0,0 +1,163 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+
+
+var _NWZGFHKHcjs = require('./NWZGFHKH.cjs');
+
+// src/commands/db/create-readonly-user/postgres.js
+var _pg = require('pg'); var _pg2 = _interopRequireDefault(_pg);
+var { Client } = _pg2.default;
+function createClient(config, database) {
+  return new Client({
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: _nullishCoalesce(database, () => ( (config.database || "postgres"))),
+    ssl: config.ssl
+  });
+}
+async function query(client, sql, params) {
+  return client.query(sql, params);
+}
+async function listPostgresDatabases(config) {
+  const client = createClient(config, config.database || "postgres");
+  await client.connect();
+  try {
+    const result = await query(
+      client,
+      `SELECT datname
+       FROM pg_database
+       WHERE datistemplate = false
+       ORDER BY datname`
+    );
+    return result.rows.map((row) => row.datname).filter((name) => !_NWZGFHKHcjs.isSystemDatabase.call(void 0, { engine: "postgres", name }));
+  } finally {
+    await client.end();
+  }
+}
+async function ensureRole(client, params) {
+  const { username, password } = params;
+  const ident = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: username });
+  const passwordLiteral = _NWZGFHKHcjs.quoteLiteral.call(void 0, password);
+  const existing = await query(
+    client,
+    "SELECT 1 FROM pg_roles WHERE rolname = $1",
+    [username]
+  );
+  const statements = [];
+  if (existing.rowCount && existing.rowCount > 0) {
+    const sql2 = `ALTER ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+    statements.push(sql2);
+    await query(client, sql2);
+    return { created: false, statements };
+  }
+  const sql = `CREATE ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+  statements.push(sql);
+  await query(client, sql);
+  return { created: true, statements };
+}
+async function grantReadonlyInDatabase(client, params) {
+  const { username } = params;
+  const ident = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: username });
+  const statements = [];
+  const schemasResult = await query(
+    client,
+    `SELECT nspname
+     FROM pg_namespace
+     WHERE nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+       AND nspname NOT LIKE 'pg_temp_%'
+       AND nspname NOT LIKE 'pg_toast_temp_%'
+     ORDER BY nspname`
+  );
+  const schemas = schemasResult.rows.map(
+    (row) => row.nspname
+  );
+  if (schemas.length === 0) {
+    schemas.push("public");
+  }
+  for (const schema of schemas) {
+    const schemaIdent = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: schema });
+    const grants = [
+      `GRANT USAGE ON SCHEMA ${schemaIdent} TO ${ident}`,
+      `GRANT SELECT ON ALL TABLES IN SCHEMA ${schemaIdent} TO ${ident}`,
+      `GRANT SELECT ON ALL SEQUENCES IN SCHEMA ${schemaIdent} TO ${ident}`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON TABLES TO ${ident}`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON SEQUENCES TO ${ident}`
+    ];
+    for (const sql of grants) {
+      statements.push(sql);
+      await query(client, sql);
+    }
+  }
+  return statements;
+}
+async function applyPostgresReadonly(params) {
+  const {
+    config,
+    username,
+    password,
+    databases,
+    dryRun = false,
+    verbose = false
+  } = params;
+  const statements = [];
+  let created = false;
+  if (dryRun) {
+    const ident = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: username });
+    statements.push(
+      `-- Would CREATE/ALTER ROLE ${ident} WITH LOGIN PASSWORD ***`
+    );
+    for (const database of databases) {
+      const dbIdent = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: database });
+      statements.push(`GRANT CONNECT ON DATABASE ${dbIdent} TO ${ident}`);
+      statements.push(
+        `-- In database ${database}: GRANT USAGE/SELECT on all user schemas + ALTER DEFAULT PRIVILEGES`
+      );
+    }
+    return { created: true, statements, databases };
+  }
+  const adminDb = config.database || "postgres";
+  const adminClient = createClient(config, adminDb);
+  await adminClient.connect();
+  try {
+    if (verbose) {
+      console.log(
+        `   Connected to Postgres as ${config.user}@${config.host}/${adminDb}`
+      );
+    }
+    const roleResult = await ensureRole(adminClient, { username, password });
+    created = roleResult.created;
+    statements.push(...roleResult.statements);
+    const ident = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: username });
+    for (const database of databases) {
+      const dbIdent = _NWZGFHKHcjs.quoteIdent.call(void 0, { engine: "postgres", name: database });
+      const connectSql = `GRANT CONNECT ON DATABASE ${dbIdent} TO ${ident}`;
+      statements.push(connectSql);
+      await query(adminClient, connectSql);
+    }
+  } finally {
+    await adminClient.end();
+  }
+  for (const database of databases) {
+    const dbClient = createClient(config, database);
+    await dbClient.connect();
+    try {
+      if (verbose) {
+        console.log(`   Granting read-only in database ${database}`);
+      }
+      const dbStatements = await grantReadonlyInDatabase(dbClient, {
+        username
+      });
+      statements.push(...dbStatements);
+    } finally {
+      await dbClient.end();
+    }
+  }
+  return { created, statements, databases };
+}
+
+
+
+
+exports.listPostgresDatabases = listPostgresDatabases; exports.applyPostgresReadonly = applyPostgresReadonly;

package/cjs/__chunks/KU76LC42.cjs

@@ -0,0 +1,192 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _UWHPE2GIcjs = require('./UWHPE2GI.cjs');
+
+
+
+var _T2A7TN4Fcjs = require('./T2A7TN4F.cjs');
+
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+var _NT2XXAI6cjs = require('./NT2XXAI6.cjs');
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/aws/iam/break-glass/handler.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var _zod = require('zod');
+function userNameFromArn(arn) {
+  const marker = ":user/";
+  const index = arn.indexOf(marker);
+  if (index === -1) {
+    return null;
+  }
+  const name = arn.slice(index + marker.length).split("/").pop();
+  return name && name.length > 0 ? name : null;
+}
+async function breakGlassCommand(options) {
+  try {
+    const { profile, user, yes, dryRun, verbose } = _UWHPE2GIcjs.breakGlassOptionsSchema.parse(options);
+    _R3GUC7O7cjs.requireCommands.call(void 0, ["aws"]);
+    const targetProfile = await _NT2XXAI6cjs.resolveProfile.call(void 0, { profile });
+    if (!targetProfile) {
+      console.error(
+        _chalk2.default.red(
+          "No profile specified. Pass --profile <name> or set AWS_PROFILE."
+        )
+      );
+      process.exit(1);
+    }
+    const scan = _T2A7TN4Fcjs.resolveProfileScan.call(void 0, { profile: targetProfile, verbose });
+    if (!scan) {
+      console.error(
+        _chalk2.default.red(
+          `
+\u274C Could not read ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME} for profile "${targetProfile}".`
+        )
+      );
+      console.error(
+        _chalk2.default.yellow(
+          "   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"
+        )
+      );
+      process.exit(1);
+    }
+    let targets = user;
+    if (targets.length === 0) {
+      const derived = userNameFromArn(scan.arn);
+      if (!derived) {
+        console.error(
+          _chalk2.default.red(
+            `
+\u274C Could not determine your IAM user from the caller identity:
+   ${scan.arn}`
+          )
+        );
+        console.error(
+          _chalk2.default.yellow("   Pass --user <name> to choose who to grant.\n")
+        );
+        process.exit(1);
+      }
+      targets = [derived];
+    }
+    const alreadyMembers = new Set(scan.users);
+    const toGrant = targets.filter((name) => !alreadyMembers.has(name));
+    const existing = targets.filter((name) => alreadyMembers.has(name));
+    console.log(
+      _chalk2.default.blue(
+        `
+==> Break-glass admin (${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}) \u2014 profile ${targetProfile} (${scan.accountId})
+`
+      )
+    );
+    for (const name of existing) {
+      console.log(_chalk2.default.dim(`--     ${name} already has break-glass access`));
+    }
+    if (toGrant.length === 0) {
+      console.log(
+        _chalk2.default.green(
+          "\nNothing to do \u2014 all target user(s) already have break-glass access.\n"
+        )
+      );
+      return;
+    }
+    console.log(
+      _chalk2.default.red.bold(
+        `\u26A0  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`
+      )
+    );
+    if (dryRun) {
+      for (const name of toGrant) {
+        console.log(
+          _chalk2.default.yellow(`  [dry-run] would add ${name} to ${_T2A7TN4Fcjs.ADMIN_GROUP_NAME}`)
+        );
+      }
+      console.log(
+        _chalk2.default.yellow("\n[dry-run] Re-run without --dry-run to apply.\n")
+      );
+      return;
+    }
+    let confirmed = yes;
+    if (!confirmed) {
+      confirmed = await _CMUD7LLNcjs.promptYesNo.call(void 0, {
+        message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
+        defaultYes: false
+      });
+    }
+    if (!confirmed) {
+      console.log(_chalk2.default.dim("  aborted (not confirmed)\n"));
+      return;
+    }
+    let granted = 0;
+    for (const name of toGrant) {
+      try {
+        scan.run(
+          [
+            "iam",
+            "add-user-to-group",
+            "--group-name",
+            _T2A7TN4Fcjs.ADMIN_GROUP_NAME,
+            "--user-name",
+            name
+          ],
+          { expectJson: false }
+        );
+        console.log(_chalk2.default.green(`  granted ${name}`));
+        granted += 1;
+      } catch (grantError) {
+        const reason = grantError instanceof Error ? _nullishCoalesce(grantError.message.split("\n")[0], () => ( "")) : String(grantError);
+        console.log(_chalk2.default.red(`  failed to grant ${name}: ${reason}`));
+      }
+    }
+    console.log(_chalk2.default.blue("\n==> Summary"));
+    console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
+    console.log(`  Users granted:    ${granted}`);
+    console.log(`  Already had it:   ${existing.length}`);
+    console.log(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Revoke with `mtn aws iam remove-admin` when you are done."
+      )
+    );
+    console.log(
+      _chalk2.default.dim(
+        "   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"
+      )
+    );
+  } catch (error) {
+    if (error instanceof _zod.ZodError) {
+      console.error(_chalk2.default.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(_chalk2.default.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      _optionalChain([options, 'optionalAccess', _ => _.verbose]) || false
+    );
+    console.error(_chalk2.default.red("\n\u274C break-glass failed:"));
+    if (error instanceof Error) {
+      console.error(_chalk2.default.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(_chalk2.default.gray("\nStack trace:"));
+        console.error(_chalk2.default.gray(error.stack));
+      }
+    } else {
+      console.error(_chalk2.default.red(`   ${String(error)}`));
+    }
+    console.error(
+      _chalk2.default.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+
+
+exports.breakGlassCommand = breakGlassCommand;