@mtndev/cli 1.1.0 → 2.0.1

package/esm/commands/aws/ec2/allow-ip/utils.js

@@ -0,0 +1,363 @@
+import { runAws } from "../../utils/exec-aws.js";
+import { DEFAULT_ROAMING_NAME } from "./schema.js";
+//#region src/commands/aws/ec2/allow-ip/utils.js
+/**
+* @typedef {Object} Ec2Instance
+* @property {string} instanceId
+* @property {string} name
+* @property {string} state
+* @property {string} instanceType
+* @property {string | null} publicIp
+* @property {string[]} securityGroupIds
+*/
+/**
+* @typedef {Object} SecurityGroup
+* @property {string} groupId
+* @property {string} groupName
+* @property {string} description
+*/
+/**
+* @typedef {Object} SshIngressRule
+* @property {string} cidrIp
+* @property {string} description
+* @property {number} fromPort
+* @property {number} toPort
+* @property {string} ipProtocol
+*/
+/**
+* Determine the caller's current public IPv4 address.
+* @returns {Promise<string>}
+*/
+async function getCurrentPublicIp() {
+	for (const url of ["https://checkip.amazonaws.com", "https://api.ipify.org"]) try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 8e3);
+		const response = await fetch(url, { signal: controller.signal });
+		clearTimeout(timeout);
+		if (!response.ok) continue;
+		const ip = (await response.text()).trim();
+		if (ip && ip.includes(".")) return ip;
+	} catch {
+		continue;
+	}
+	throw new Error("Could not determine your current public IP address");
+}
+/**
+* List regions that are opted-in / enabled for the profile.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {string[]}
+*/
+function listEnabledRegions(params) {
+	const { profile, region, verbose } = params;
+	const data = runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-regions",
+			"--query",
+			"Regions[?OptInStatus!=`not-opted-in`].RegionName"
+		],
+		verbose
+	});
+	return (Array.isArray(data) ? data : []).map((value) => String(value)).sort();
+}
+/**
+* List non-terminated EC2 instances in a region.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {Ec2Instance[]}
+*/
+function listInstances(params) {
+	const { profile, region, verbose } = params;
+	const data = runAws({
+		profile,
+		region,
+		args: ["ec2", "describe-instances"],
+		verbose
+	});
+	/** @type {Ec2Instance[]} */
+	const instances = [];
+	for (const reservation of data.Reservations ?? []) for (const raw of reservation.Instances ?? []) {
+		const state = raw.State?.Name ?? "unknown";
+		if (state === "terminated" || state === "shutting-down") continue;
+		let name = "";
+		for (const tag of raw.Tags ?? []) if (tag.Key === "Name") {
+			name = tag.Value ?? "";
+			break;
+		}
+		const securityGroupIds = (raw.SecurityGroups ?? []).map((group) => group.GroupId).filter((id) => Boolean(id));
+		instances.push({
+			instanceId: raw.InstanceId,
+			name,
+			state,
+			instanceType: raw.InstanceType ?? "unknown",
+			publicIp: raw.PublicIpAddress ?? null,
+			securityGroupIds
+		});
+	}
+	instances.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.instanceId.localeCompare(b.instanceId));
+	return instances;
+}
+/**
+* Describe security groups by id.
+* @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+* @returns {SecurityGroup[]}
+*/
+function describeSecurityGroups(params) {
+	const { profile, region, groupIds, verbose } = params;
+	if (groupIds.length === 0) return [];
+	/** @type {SecurityGroup[]} */
+	const groups = (runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			...groupIds
+		],
+		verbose
+	}).SecurityGroups ?? []).map((raw) => ({
+		groupId: raw.GroupId,
+		groupName: raw.GroupName ?? "",
+		description: raw.Description ?? ""
+	}));
+	groups.sort((a, b) => a.groupName.localeCompare(b.groupName));
+	return groups;
+}
+/**
+* Load full details for a single security group.
+* @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+* @returns {any | null}
+*/
+function getSecurityGroupDetails(params) {
+	const { profile, region, groupId, verbose } = params;
+	const securityGroups = runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			groupId
+		],
+		verbose
+	}).SecurityGroups ?? [];
+	if (securityGroups.length === 0) return null;
+	return securityGroups[0];
+}
+/**
+* @param {string} cidrIp
+* @returns {boolean}
+*/
+function isSingleHostCidr(cidrIp) {
+	return cidrIp.endsWith("/32") && cidrIp !== "0.0.0.0/0";
+}
+/**
+* @param {any} permission
+* @returns {boolean}
+*/
+function portAllowsSsh(permission) {
+	const protocol = permission.IpProtocol;
+	if (protocol !== "tcp" && protocol !== "6") return false;
+	const fromPort = permission.FromPort;
+	const toPort = permission.ToPort;
+	if (fromPort === void 0 && toPort === void 0) return true;
+	if (fromPort === void 0 || toPort === void 0) return false;
+	return fromPort <= 22 && 22 <= toPort;
+}
+/**
+* Extract single-host SSH ingress rules (port 22, /32) from a security group.
+* @param {any} securityGroup
+* @returns {SshIngressRule[]}
+*/
+function listSshIngressRules(securityGroup) {
+	/** @type {SshIngressRule[]} */
+	const rules = [];
+	for (const permission of securityGroup.IpPermissions ?? []) {
+		if (!portAllowsSsh(permission)) continue;
+		const fromPort = permission.FromPort ?? 22;
+		const toPort = permission.ToPort ?? 22;
+		const ipProtocol = permission.IpProtocol ?? "tcp";
+		for (const ipRange of permission.IpRanges ?? []) {
+			const cidrIp = ipRange.CidrIp;
+			if (!cidrIp || !isSingleHostCidr(cidrIp)) continue;
+			rules.push({
+				cidrIp,
+				description: ipRange.Description ?? "",
+				fromPort,
+				toPort,
+				ipProtocol
+			});
+		}
+	}
+	return rules;
+}
+/**
+* Derive a first name from the IAM ARN or profile (md-{name}-...).
+* @param {{ profile?: string; identity: { Arn?: string } }} params
+* @returns {string}
+*/
+function extractRoamingFirstName(params) {
+	const { profile, identity } = params;
+	const arn = identity.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const match = /^md-([^-]+)-/.exec(candidate);
+		if (match && match[1]) return match[1].charAt(0).toUpperCase() + match[1].slice(1).toLowerCase();
+	}
+	return DEFAULT_ROAMING_NAME;
+}
+/**
+* @param {string} firstName
+* @returns {string}
+*/
+function roamingRuleDescription(firstName) {
+	return `${firstName} Roaming`;
+}
+/**
+* Find an existing rule whose description matches the roaming rule name.
+* @param {SshIngressRule[]} sshRules
+* @param {string} ruleDescription
+* @returns {SshIngressRule | null}
+*/
+function resolveRoamingRule(sshRules, ruleDescription) {
+	const target = ruleDescription.toLowerCase();
+	for (const rule of sshRules) if (rule.description.trim().toLowerCase() === target) return rule;
+	return null;
+}
+/**
+* Find an existing rule that already allows the given CIDR.
+* @param {SshIngressRule[]} sshRules
+* @param {string} newCidr
+* @returns {SshIngressRule | null}
+*/
+function ruleAlreadyAllowsIp(sshRules, newCidr) {
+	for (const rule of sshRules) if (rule.cidrIp === newCidr) return rule;
+	return null;
+}
+/**
+* @param {{
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+* }} params
+* @returns {string} JSON string for the --ip-permissions argument
+*/
+function buildIpPermissions(params) {
+	const { cidrIp, description, fromPort = 22, toPort = 22, ipProtocol = "tcp" } = params;
+	return JSON.stringify([{
+		IpProtocol: ipProtocol,
+		FromPort: fromPort,
+		ToPort: toPort,
+		IpRanges: [{
+			CidrIp: cidrIp,
+			Description: description
+		}]
+	}]);
+}
+/**
+* Authorize a new SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+*   verbose?: boolean;
+* }} params
+*/
+function authorizeRule(params) {
+	const { profile, region, groupId, verbose, ...rule } = params;
+	runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"authorize-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions(rule)
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Revoke an existing SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   rule: SshIngressRule;
+*   verbose?: boolean;
+* }} params
+*/
+function revokeRule(params) {
+	const { profile, region, groupId, rule, verbose } = params;
+	runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"revoke-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions({
+				cidrIp: rule.cidrIp,
+				description: rule.description,
+				fromPort: rule.fromPort,
+				toPort: rule.toPort,
+				ipProtocol: rule.ipProtocol
+			})
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* @param {Ec2Instance} instance
+* @returns {string}
+*/
+function instanceLabel(instance) {
+	const publicIp = instance.publicIp || "no public IP";
+	const name = instance.name || "(no name)";
+	return `${instance.instanceId}  ${name}  ${instance.state}  ${instance.instanceType}  ${publicIp}`;
+}
+/**
+* @param {SecurityGroup} group
+* @returns {string}
+*/
+function securityGroupLabel(group) {
+	return `${group.groupId}  ${group.groupName}  ${group.description}`;
+}
+/**
+* @param {SshIngressRule} rule
+* @returns {string}
+*/
+function sshRuleLabel(rule) {
+	const description = rule.description || "(no description)";
+	return `${rule.cidrIp}  ${description}`;
+}
+/**
+* Print single-host SSH rules using the given logger.
+* @param {SshIngressRule[]} sshRules
+* @param {(message: string) => void} [log]
+*/
+function printSshRules(sshRules, log = console.log) {
+	if (sshRules.length === 0) {
+		log("  (no single-host SSH rules on port 22)");
+		return;
+	}
+	for (const rule of sshRules) log(`  - ${sshRuleLabel(rule)}`);
+}
+//#endregion
+export { authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel, sshRuleLabel };

package/esm/commands/aws/iam/admin-group.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ * @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+ */
+/**
+ * List aws-vault profiles that have stored credentials.
+ * @returns {string[]}
+ */
+export function listVaultProfiles(): string[];
+/**
+ * Resolve which profiles to scan for admin-group commands.
+ * Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+ * @param {{ profile?: string; all?: boolean }} params
+ * @returns {string[]}
+ */
+export function resolveAdminScanProfiles({ profile, all }: {
+    profile?: string;
+    all?: boolean;
+}): string[];
+/**
+ * @param {{ Users?: Array<{ UserName: string }> }} group
+ * @returns {string[]}
+ */
+export function groupUserNames(group: {
+    Users?: Array<{
+        UserName: string;
+    }>;
+}): string[];
+/**
+ * Resolve a working credential runner for a profile and read the admin group.
+ * Tries stored credentials first, then falls back to `aws-vault exec`.
+ * The returned `run` reuses whichever mode worked, so callers can perform
+ * follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+ * @param {{ profile: string; verbose?: boolean }} params
+ * @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+ */
+export function resolveProfileScan(params: {
+    profile: string;
+    verbose?: boolean;
+}): {
+    accountId: string;
+    arn: string;
+    users: string[];
+    run: ProfileRunner;
+} | null;
+/**
+ * The IAM group that grants break-glass admin access and should normally be empty.
+ */
+export const ADMIN_GROUP_NAME: "acl-admin-do-not-use";
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ */
+export type ProfileRunner = (args: string[], options?: {
+    expectJson?: boolean;
+}) => any;

package/esm/commands/aws/iam/admin-group.js

@@ -0,0 +1,104 @@
+import { runAws, runAwsVault } from "../utils/exec-aws.js";
+import chalk from "chalk";
+import { spawnSync } from "child_process";
+//#region src/commands/aws/iam/admin-group.js
+/**
+* The IAM group that grants break-glass admin access and should normally be empty.
+*/
+const ADMIN_GROUP_NAME = "acl-admin-do-not-use";
+const VAULT_DURATION = process.env.AWS_VAULT_DURATION ?? "15m";
+/**
+* A function bound to a profile's working credential mode (direct or aws-vault).
+* @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+*/
+/**
+* List aws-vault profiles that have stored credentials.
+* @returns {string[]}
+*/
+function listVaultProfiles() {
+	const result = spawnSync("aws-vault", ["list", "--credentials"], { encoding: "utf-8" });
+	if (result.status !== 0) return [];
+	return (result.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+/**
+* Resolve which profiles to scan for admin-group commands.
+* Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+* @param {{ profile?: string; all?: boolean }} params
+* @returns {string[]}
+*/
+function resolveAdminScanProfiles({ profile, all = false }) {
+	const targetProfile = profile ?? process.env.AWS_PROFILE;
+	if (!all && targetProfile) return [targetProfile];
+	const profiles = listVaultProfiles();
+	if (profiles.length === 0) throw new Error("No aws-vault profiles with credentials found.");
+	return profiles;
+}
+/**
+* @param {{ Users?: Array<{ UserName: string }> }} group
+* @returns {string[]}
+*/
+function groupUserNames(group) {
+	return (group.Users ?? []).map((user) => user.UserName);
+}
+/**
+* Resolve a working credential runner for a profile and read the admin group.
+* Tries stored credentials first, then falls back to `aws-vault exec`.
+* The returned `run` reuses whichever mode worked, so callers can perform
+* follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+* @param {{ profile: string; verbose?: boolean }} params
+* @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+*/
+function resolveProfileScan(params) {
+	const { profile, verbose = false } = params;
+	const idArgs = ["sts", "get-caller-identity"];
+	const groupArgs = [
+		"iam",
+		"get-group",
+		"--group-name",
+		ADMIN_GROUP_NAME
+	];
+	/** @type {ProfileRunner} */
+	const directRun = (args, options = {}) => runAws({
+		profile,
+		args,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	/** @type {ProfileRunner} */
+	const vaultRun = (args, options = {}) => runAwsVault({
+		profile,
+		args,
+		duration: VAULT_DURATION,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	try {
+		const identity = directRun(idArgs);
+		const group = directRun(groupArgs);
+		return {
+			accountId: identity.Account,
+			arn: identity.Arn,
+			users: groupUserNames(group),
+			run: directRun
+		};
+	} catch (directError) {
+		try {
+			const identity = vaultRun(idArgs);
+			const group = vaultRun(groupArgs);
+			return {
+				accountId: identity.Account,
+				arn: identity.Arn,
+				users: groupUserNames(group),
+				run: vaultRun
+			};
+		} catch {
+			if (verbose) {
+				const reason = directError instanceof Error ? directError.message.split("\n")[0] ?? "" : String(directError);
+				console.log(chalk.dim(`skip   ${profile} — ${reason}`));
+			}
+			return null;
+		}
+	}
+}
+//#endregion
+export { ADMIN_GROUP_NAME, groupUserNames, listVaultProfiles, resolveAdminScanProfiles, resolveProfileScan };

package/esm/commands/aws/iam/break-glass/handler.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `aws iam break-glass` handler: grant break-glass admin access by adding a user
+ * to the acl-admin-do-not-use group for a single profile. Defaults to the
+ * caller's own IAM user when no --user is given.
+ * @param {unknown} options
+ */
+export function breakGlassCommand(options: unknown): Promise<void>;

package/esm/commands/aws/iam/break-glass/handler.js

@@ -0,0 +1,124 @@
+import { promptYesNo } from "../../utils/tty.js";
+import { requireCommands } from "../../utils/exec-aws.js";
+import { resolveProfile } from "../../utils/resolve-profile.js";
+import { ADMIN_GROUP_NAME, resolveProfileScan } from "../admin-group.js";
+import { breakGlassOptionsSchema } from "./schema.js";
+import chalk from "chalk";
+import { ZodError } from "zod";
+//#region src/commands/aws/iam/break-glass/handler.js
+/**
+* Derive an IAM user name from a caller-identity ARN.
+* Returns null for non-user ARNs (assumed roles, root, etc.).
+* @param {string} arn
+* @returns {string | null}
+*/
+function userNameFromArn(arn) {
+	const index = arn.indexOf(":user/");
+	if (index === -1) return null;
+	const name = arn.slice(index + 6).split("/").pop();
+	return name && name.length > 0 ? name : null;
+}
+/**
+* `aws iam break-glass` handler: grant break-glass admin access by adding a user
+* to the acl-admin-do-not-use group for a single profile. Defaults to the
+* caller's own IAM user when no --user is given.
+* @param {unknown} options
+*/
+async function breakGlassCommand(options) {
+	try {
+		const { profile, user, yes, dryRun, verbose } = breakGlassOptionsSchema.parse(options);
+		requireCommands(["aws"]);
+		const targetProfile = await resolveProfile({ profile });
+		if (!targetProfile) {
+			console.error(chalk.red("No profile specified. Pass --profile <name> or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		const scan = resolveProfileScan({
+			profile: targetProfile,
+			verbose
+		});
+		if (!scan) {
+			console.error(chalk.red(`\n❌ Could not read ${ADMIN_GROUP_NAME} for profile "${targetProfile}".`));
+			console.error(chalk.yellow("   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"));
+			process.exit(1);
+		}
+		/** @type {string[]} */
+		let targets = user;
+		if (targets.length === 0) {
+			const derived = userNameFromArn(scan.arn);
+			if (!derived) {
+				console.error(chalk.red(`\n❌ Could not determine your IAM user from the caller identity:\n   ${scan.arn}`));
+				console.error(chalk.yellow("   Pass --user <name> to choose who to grant.\n"));
+				process.exit(1);
+			}
+			targets = [derived];
+		}
+		const alreadyMembers = new Set(scan.users);
+		const toGrant = targets.filter((name) => !alreadyMembers.has(name));
+		const existing = targets.filter((name) => alreadyMembers.has(name));
+		console.log(chalk.blue(`\n==> Break-glass admin (${ADMIN_GROUP_NAME}) — profile ${targetProfile} (${scan.accountId})\n`));
+		for (const name of existing) console.log(chalk.dim(`--     ${name} already has break-glass access`));
+		if (toGrant.length === 0) {
+			console.log(chalk.green("\nNothing to do — all target user(s) already have break-glass access.\n"));
+			return;
+		}
+		console.log(chalk.red.bold(`⚠  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`));
+		if (dryRun) {
+			for (const name of toGrant) console.log(chalk.yellow(`  [dry-run] would add ${name} to ${ADMIN_GROUP_NAME}`));
+			console.log(chalk.yellow("\n[dry-run] Re-run without --dry-run to apply.\n"));
+			return;
+		}
+		let confirmed = yes;
+		if (!confirmed) confirmed = await promptYesNo({
+			message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
+			defaultYes: false
+		});
+		if (!confirmed) {
+			console.log(chalk.dim("  aborted (not confirmed)\n"));
+			return;
+		}
+		let granted = 0;
+		for (const name of toGrant) try {
+			scan.run([
+				"iam",
+				"add-user-to-group",
+				"--group-name",
+				ADMIN_GROUP_NAME,
+				"--user-name",
+				name
+			], { expectJson: false });
+			console.log(chalk.green(`  granted ${name}`));
+			granted += 1;
+		} catch (grantError) {
+			const reason = grantError instanceof Error ? grantError.message.split("\n")[0] ?? "" : String(grantError);
+			console.log(chalk.red(`  failed to grant ${name}: ${reason}`));
+		}
+		console.log(chalk.blue("\n==> Summary"));
+		console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
+		console.log(`  Users granted:    ${granted}`);
+		console.log(`  Already had it:   ${existing.length}`);
+		console.log(chalk.yellow("\n💡 Revoke with `mtn aws iam remove-admin` when you are done."));
+		console.log(chalk.dim("   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"));
+	} catch (error) {
+		if (error instanceof ZodError) {
+			console.error(chalk.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.red("\n❌ break-glass failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.gray("\nStack trace:"));
+				console.error(chalk.gray(error.stack));
+			}
+		} else console.error(chalk.red(`   ${String(error)}`));
+		console.error(chalk.yellow("\n💡 Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+export { breakGlassCommand };

package/esm/commands/aws/iam/break-glass/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/esm/commands/aws/iam/break-glass/index.js

@@ -0,0 +1,4 @@
+import { ADMIN_GROUP_NAME } from "../admin-group.js";
+import { breakGlassOptionsSchema } from "./schema.js";
+import { breakGlassCommand } from "./handler.js";
+export { ADMIN_GROUP_NAME, breakGlassCommand, breakGlassOptionsSchema };

package/esm/commands/aws/iam/break-glass/schema.d.ts

@@ -0,0 +1,25 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam break-glass` options.
+ */
+export const breakGlassOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    user: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    user: string[];
+    dryRun: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    user?: string[] | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type BreakGlassOptions = z.infer<typeof breakGlassOptionsSchema>;
+import { z } from "zod";