@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/index.cjs

@@ -0,0 +1,223 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ses_send_email_schema = require("./ses/send-email/schema.cjs");
+const require_commands_aws_ses_send_email_utils = require("./ses/send-email/utils.cjs");
+const require_commands_aws_ses_send_email_handler = require("./ses/send-email/handler.cjs");
+require("./ses/send-email/index.cjs");
+const require_commands_aws_route53_add_record_schema = require("./route53/add-record/schema.cjs");
+const require_commands_aws_route53_add_record_utils = require("./route53/add-record/utils.cjs");
+const require_commands_aws_route53_add_record_handler = require("./route53/add-record/handler.cjs");
+const require_commands_aws_route53_remove_record_schema = require("./route53/remove-record/schema.cjs");
+const require_commands_aws_route53_remove_record_handler = require("./route53/remove-record/handler.cjs");
+require("./route53/remove-record/index.cjs");
+require("./route53/add-record/index.cjs");
+const require_commands_aws_iam_users_schema = require("./iam/users/schema.cjs");
+const require_commands_aws_iam_users_utils = require("./iam/users/utils.cjs");
+const require_commands_aws_iam_users_handler = require("./iam/users/handler.cjs");
+require("./iam/users/index.cjs");
+const require_commands_aws_iam_setup_acl_schema = require("./iam/setup-acl/schema.cjs");
+const require_commands_aws_iam_setup_acl_utils = require("./iam/setup-acl/utils.cjs");
+const require_commands_aws_iam_setup_acl_handler = require("./iam/setup-acl/handler.cjs");
+require("./iam/setup-acl/index.cjs");
+const require_commands_aws_iam_admin_group = require("./iam/admin-group.cjs");
+const require_commands_aws_iam_remove_admin_schema = require("./iam/remove-admin/schema.cjs");
+const require_commands_aws_iam_remove_admin_handler = require("./iam/remove-admin/handler.cjs");
+require("./iam/remove-admin/index.cjs");
+const require_commands_aws_iam_check_admin_schema = require("./iam/check-admin/schema.cjs");
+const require_commands_aws_iam_check_admin_handler = require("./iam/check-admin/handler.cjs");
+require("./iam/check-admin/index.cjs");
+const require_commands_aws_iam_break_glass_schema = require("./iam/break-glass/schema.cjs");
+const require_commands_aws_iam_break_glass_handler = require("./iam/break-glass/handler.cjs");
+require("./iam/break-glass/index.cjs");
+const require_commands_aws_ec2_allow_ip_schema = require("./ec2/allow-ip/schema.cjs");
+const require_commands_aws_ec2_allow_ip_utils = require("./ec2/allow-ip/utils.cjs");
+const require_commands_aws_ec2_allow_ip_handler = require("./ec2/allow-ip/handler.cjs");
+require("./ec2/allow-ip/index.cjs");
+//#region src/commands/aws/index.js
+/**
+* Commander collector for repeatable options.
+* @param {string} value
+* @param {string[]} previous
+* @returns {string[]}
+*/
+function collect(value, previous) {
+	return [...previous, value];
+}
+/**
+* Register the `aws` command group and its subcommands on the root program.
+* @param {import('commander').Command} program
+*/
+function registerAwsCommands(program) {
+	const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
+	const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
+	iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description("Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users.").option("--restrict-regions <yes|no>", "Attach the region restriction to acl-power-users (skips the prompt)").option("--no-create-users", "Skip IAM user creation after configuring groups").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_iam_setup_acl_handler.setupAclCommand({
+			restrictRegions: options.restrictRegions,
+			createUsers: options.createUsers,
+			profile: options.profile,
+			region: options.region,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("users").summary("Interactively create IAM users and assign ACL groups").description("Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands.").option("--account-name <slug>", "AWS account slug used in md-{identifier}-{account}-{role}").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_iam_users_handler.usersCommand({
+			accountName: options.accountName,
+			profile: options.profile,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description("Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group.").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await require_commands_aws_iam_check_admin_handler.checkAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description("Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all).").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("--user <name>", "Only remove this user (repeatable); default removes all", collect, []).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await require_commands_aws_iam_remove_admin_handler.removeAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description("Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("--user <name>", "Grant to this user (repeatable); default is your own IAM user", collect, []).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
+		await require_commands_aws_iam_break_glass_handler.breakGlassCommand({
+			profile: options.profile,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands").command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description("Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("--rule-name <name>", "SSH rule description (default: \"{FirstName} Roaming\")").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_ec2_allow_ip_handler.allowIpCommand({
+			profile: options.profile,
+			region: options.region,
+			ruleName: options.ruleName,
+			verbose: options.verbose ?? false
+		});
+	});
+	const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
+	route53.command("add-record").summary("Interactively add or update a DNS record").description("Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("--value <value>", "Record value (e.g. CNAME target)").option("--ttl <seconds>", "TTL in seconds (default: 300)", (value) => Number.parseInt(value, 10)).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_route53_add_record_handler.addRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			value: options.value,
+			ttl: options.ttl,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	route53.command("remove-record").summary("Interactively delete a DNS record").description("Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_route53_remove_record_handler.removeRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ses").summary("SES operational commands").description("SES operational commands").command("send-email").summary("Send a test email via SES (API or SMTP)").description("Send a single test email through the SES API (default) or the SES SMTP endpoint.").requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option("--access-key-id <id>", "IAM access key ID used as the SMTP username (smtp transport)").option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await require_commands_aws_ses_send_email_handler.sendEmailCommand({
+			to: options.to,
+			from: options.from,
+			subject: options.subject,
+			body: options.body,
+			transport: options.transport,
+			region: options.region,
+			profile: options.profile,
+			accessKeyId: options.accessKeyId,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+}
+//#endregion
+exports.ACL_GROUPS = require_commands_aws_iam_setup_acl_utils.ACL_GROUPS;
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.CUSTOM_POLICIES = require_commands_aws_iam_setup_acl_utils.CUSTOM_POLICIES;
+exports.DEFAULT_REGION = require_commands_aws_ec2_allow_ip_schema.DEFAULT_REGION;
+exports.DEFAULT_ROAMING_NAME = require_commands_aws_ec2_allow_ip_schema.DEFAULT_ROAMING_NAME;
+exports.DEFAULT_TTL = require_commands_aws_route53_add_record_schema.DEFAULT_TTL;
+exports.RECORD_TYPES = require_commands_aws_route53_add_record_schema.RECORD_TYPES;
+exports.SSH_PORT = require_commands_aws_ec2_allow_ip_schema.SSH_PORT;
+exports.addRecordCommand = require_commands_aws_route53_add_record_handler.addRecordCommand;
+exports.addRecordOptionsSchema = require_commands_aws_route53_add_record_schema.addRecordOptionsSchema;
+exports.allowIpCommand = require_commands_aws_ec2_allow_ip_handler.allowIpCommand;
+exports.allowIpOptionsSchema = require_commands_aws_ec2_allow_ip_schema.allowIpOptionsSchema;
+exports.attach = require_commands_aws_iam_setup_acl_utils.attach;
+exports.authorizeRule = require_commands_aws_ec2_allow_ip_utils.authorizeRule;
+exports.bareHostedZoneId = require_commands_aws_route53_add_record_utils.bareHostedZoneId;
+exports.breakGlassCommand = require_commands_aws_iam_break_glass_handler.breakGlassCommand;
+exports.breakGlassOptionsSchema = require_commands_aws_iam_break_glass_schema.breakGlassOptionsSchema;
+exports.buildUsername = require_commands_aws_iam_users_utils.buildUsername;
+exports.checkAdminCommand = require_commands_aws_iam_check_admin_handler.checkAdminCommand;
+exports.checkAdminOptionsSchema = require_commands_aws_iam_check_admin_schema.checkAdminOptionsSchema;
+exports.createCliAccessKey = require_commands_aws_iam_users_utils.createCliAccessKey;
+exports.createUsersInteractive = require_commands_aws_iam_users_utils.createUsersInteractive;
+exports.defaultBody = require_commands_aws_ses_send_email_utils.defaultBody;
+exports.deleteResourceRecordSet = require_commands_aws_route53_add_record_utils.deleteResourceRecordSet;
+exports.describeSecurityGroups = require_commands_aws_ec2_allow_ip_utils.describeSecurityGroups;
+exports.detach = require_commands_aws_iam_setup_acl_utils.detach;
+exports.ensureAclGroupsExist = require_commands_aws_iam_users_utils.ensureAclGroupsExist;
+exports.ensureGroup = require_commands_aws_iam_setup_acl_utils.ensureGroup;
+exports.ensureUser = require_commands_aws_iam_users_utils.ensureUser;
+exports.ensureUserInGroup = require_commands_aws_iam_users_utils.ensureUserInGroup;
+exports.extractRoamingFirstName = require_commands_aws_ec2_allow_ip_utils.extractRoamingFirstName;
+exports.findCnameConflicts = require_commands_aws_route53_add_record_utils.findCnameConflicts;
+exports.findHostedZone = require_commands_aws_route53_add_record_utils.findHostedZone;
+exports.formatValues = require_commands_aws_route53_add_record_utils.formatValues;
+exports.getCurrentPublicIp = require_commands_aws_ec2_allow_ip_utils.getCurrentPublicIp;
+exports.getRecordSetsAtName = require_commands_aws_route53_add_record_utils.getRecordSetsAtName;
+exports.getResourceRecordSet = require_commands_aws_route53_add_record_utils.getResourceRecordSet;
+exports.getSecurityGroupDetails = require_commands_aws_ec2_allow_ip_utils.getSecurityGroupDetails;
+exports.hostedZoneLabel = require_commands_aws_route53_add_record_utils.hostedZoneLabel;
+exports.inferAccountName = require_commands_aws_iam_users_utils.inferAccountName;
+exports.instanceLabel = require_commands_aws_ec2_allow_ip_utils.instanceLabel;
+exports.isValidSlug = require_commands_aws_iam_users_utils.isValidSlug;
+exports.listEnabledRegions = require_commands_aws_ec2_allow_ip_utils.listEnabledRegions;
+exports.listHostedZones = require_commands_aws_route53_add_record_utils.listHostedZones;
+exports.listInstances = require_commands_aws_ec2_allow_ip_utils.listInstances;
+exports.listSshIngressRules = require_commands_aws_ec2_allow_ip_utils.listSshIngressRules;
+exports.normalizeIdentifier = require_commands_aws_iam_users_utils.normalizeIdentifier;
+exports.normalizeRecordValue = require_commands_aws_route53_add_record_utils.normalizeRecordValue;
+exports.normalizeSlug = require_commands_aws_iam_users_utils.normalizeSlug;
+exports.parseMdUsername = require_commands_aws_iam_users_utils.parseMdUsername;
+exports.planRecordChange = require_commands_aws_route53_add_record_utils.planRecordChange;
+exports.printFinalState = require_commands_aws_iam_setup_acl_utils.printFinalState;
+exports.printSshRules = require_commands_aws_ec2_allow_ip_utils.printSshRules;
+exports.publishPolicy = require_commands_aws_iam_setup_acl_utils.publishPolicy;
+exports.registerAwsCommands = registerAwsCommands;
+exports.removeAdminCommand = require_commands_aws_iam_remove_admin_handler.removeAdminCommand;
+exports.removeAdminOptionsSchema = require_commands_aws_iam_remove_admin_schema.removeAdminOptionsSchema;
+exports.removeRecordCommand = require_commands_aws_route53_remove_record_handler.removeRecordCommand;
+exports.removeRecordOptionsSchema = require_commands_aws_route53_remove_record_schema.removeRecordOptionsSchema;
+exports.resolveHostedZone = require_commands_aws_route53_add_record_handler.resolveHostedZone;
+exports.resolveName = require_commands_aws_route53_add_record_handler.resolveName;
+exports.resolveRecordName = require_commands_aws_route53_add_record_utils.resolveRecordName;
+exports.resolveRecordType = require_commands_aws_route53_add_record_handler.resolveRecordType;
+exports.resolveRoamingRule = require_commands_aws_ec2_allow_ip_utils.resolveRoamingRule;
+exports.revokeRule = require_commands_aws_ec2_allow_ip_utils.revokeRule;
+exports.roamingRuleDescription = require_commands_aws_ec2_allow_ip_utils.roamingRuleDescription;
+exports.roleToGroup = require_commands_aws_iam_users_utils.roleToGroup;
+exports.ruleAlreadyAllowsIp = require_commands_aws_ec2_allow_ip_utils.ruleAlreadyAllowsIp;
+exports.securityGroupLabel = require_commands_aws_ec2_allow_ip_utils.securityGroupLabel;
+exports.sendEmailCommand = require_commands_aws_ses_send_email_handler.sendEmailCommand;
+exports.sendEmailOptionsSchema = require_commands_aws_ses_send_email_schema.sendEmailOptionsSchema;
+exports.sendViaApi = require_commands_aws_ses_send_email_utils.sendViaApi;
+exports.sendViaSmtp = require_commands_aws_ses_send_email_utils.sendViaSmtp;
+exports.setupAclCommand = require_commands_aws_iam_setup_acl_handler.setupAclCommand;
+exports.setupAclOptionsSchema = require_commands_aws_iam_setup_acl_schema.setupAclOptionsSchema;
+exports.sshRuleLabel = require_commands_aws_ec2_allow_ip_utils.sshRuleLabel;
+exports.upsertResourceRecordSet = require_commands_aws_route53_add_record_utils.upsertResourceRecordSet;
+exports.usersCommand = require_commands_aws_iam_users_handler.usersCommand;
+exports.usersOptionsSchema = require_commands_aws_iam_users_schema.usersOptionsSchema;
+exports.withTrailingDot = require_commands_aws_route53_add_record_utils.withTrailingDot;
+exports.withoutTrailingDot = require_commands_aws_route53_add_record_utils.withoutTrailingDot;

package/cjs/commands/aws/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Register the `aws` command group and its subcommands on the root program.
+ * @param {import('commander').Command} program
+ */
+export function registerAwsCommands(program: import("commander").Command): void;
+export * from "./ec2/allow-ip/index.js";
+export * from "./iam/break-glass/index.js";
+export * from "./iam/check-admin/index.js";
+export * from "./iam/remove-admin/index.js";
+export * from "./iam/setup-acl/index.js";
+export * from "./iam/users/index.js";
+export * from "./route53/add-record/index.js";
+export * from "./route53/remove-record/index.js";
+export * from "./ses/send-email/index.js";

package/cjs/commands/aws/route53/add-record/handler.cjs

@@ -0,0 +1,264 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_route53_add_record_schema = require("./schema.cjs");
+const require_commands_aws_route53_add_record_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/route53/add-record/handler.js
+/**
+* Resolve the hosted zone: from --zone, or interactive picker.
+* @param {{
+*   profile?: string;
+*   zoneOption?: string;
+*   verbose: boolean;
+* }} params
+* @returns {Promise<import("./utils.js").HostedZone>}
+*/
+async function resolveHostedZone(params) {
+	const { profile, zoneOption, verbose } = params;
+	const zones = require_commands_aws_route53_add_record_utils.listHostedZones({
+		profile,
+		verbose
+	});
+	if (zones.length === 0) throw new Error("No Route53 hosted zones found for this profile.");
+	if (zoneOption) {
+		const match = require_commands_aws_route53_add_record_utils.findHostedZone({
+			zones,
+			zoneInput: zoneOption
+		});
+		if (!match) throw new Error(`No hosted zone matching "${zoneOption}". Available: ${zones.map((z) => require_commands_aws_route53_add_record_utils.withoutTrailingDot(z.name)).join(", ")}`);
+		return match;
+	}
+	const chosen = zones[await require_commands_aws_utils_tty.promptChoice({
+		message: "Choose a hosted zone:",
+		options: zones.map((zone) => require_commands_aws_route53_add_record_utils.hostedZoneLabel(zone))
+	})];
+	if (!chosen) throw new Error("No hosted zone selected");
+	return chosen;
+}
+/**
+* Resolve record type from --type or interactive picker.
+* @param {string | undefined} typeOption
+* @returns {Promise<string>}
+*/
+async function resolveRecordType(typeOption) {
+	if (typeOption) return typeOption.toUpperCase();
+	const index = await require_commands_aws_utils_tty.promptChoice({
+		message: "Choose a record type:",
+		options: require_commands_aws_route53_add_record_schema.RECORD_TYPES
+	});
+	const chosen = require_commands_aws_route53_add_record_schema.RECORD_TYPES[index];
+	if (!chosen) throw new Error("No record type selected");
+	return chosen;
+}
+/**
+* Resolve record name from --name or prompt.
+* @param {{ nameOption?: string; zoneName: string }} params
+* @returns {Promise<string>} FQDN with trailing dot
+*/
+async function resolveName(params) {
+	const { nameOption, zoneName } = params;
+	let input = nameOption;
+	if (!input) input = await require_commands_aws_utils_tty.prompt(`Record name (relative to ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(zoneName)}, or FQDN; @ for apex): `);
+	if (!input) throw new Error("Record name is required");
+	return require_commands_aws_route53_add_record_utils.resolveRecordName({
+		nameInput: input,
+		zoneName
+	});
+}
+/**
+* Resolve record value from --value or prompt.
+* @param {{ valueOption?: string; type: string }} params
+* @returns {Promise<string>}
+*/
+async function resolveValue(params) {
+	const { valueOption, type } = params;
+	let input = valueOption;
+	if (!input) input = await require_commands_aws_utils_tty.prompt(`Record value${type === "CNAME" ? " (e.g. target.example.com.)" : type === "TXT" ? " (quotes added if omitted)" : ""}: `);
+	if (!input) throw new Error("Record value is required");
+	return require_commands_aws_route53_add_record_utils.normalizeRecordValue({
+		type,
+		value: input
+	});
+}
+/**
+* When an existing multi-value set is present, ask replace vs append
+* (single-value types default to replace).
+* @param {{
+*   existing: import("./utils.js").ResourceRecordSet;
+*   type: string;
+* }} params
+* @returns {Promise<"replace" | "append">}
+*/
+async function resolveChangeMode(params) {
+	const { existing, type } = params;
+	if (type === "CNAME" || existing.values.length <= 1) return "replace";
+	console.log("");
+	console.log(chalk.default.yellow(`Existing ${type} record has ${existing.values.length} values:${require_commands_aws_route53_add_record_utils.formatValues(existing.values)}`));
+	return await require_commands_aws_utils_tty.promptYesNo({
+		message: "Add to the existing values instead of replacing them?",
+		defaultYes: false
+	}) ? "append" : "replace";
+}
+/**
+* `aws route53 add-record` handler: interactively (or via flags) create or
+* update a Route53 resource record set, showing whether the change adds or
+* overwrites.
+* @param {unknown} options
+*/
+async function addRecordCommand(options) {
+	try {
+		const { profile: profileOption, zone: zoneOption, type: typeOption, name: nameOption, value: valueOption, ttl: ttlOption, yes, dryRun, verbose } = require_commands_aws_route53_add_record_schema.addRecordOptionsSchema.parse(options);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		if (!profile) {
+			console.error(chalk.default.red("Error: pass --profile or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			verbose
+		});
+		console.log("Caller:");
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		const zone = await resolveHostedZone({
+			profile,
+			zoneOption,
+			verbose
+		});
+		console.log(`Hosted zone: ${require_commands_aws_route53_add_record_utils.hostedZoneLabel(zone)}`);
+		console.log("");
+		const type = await resolveRecordType(typeOption);
+		const name = await resolveName({
+			nameOption,
+			zoneName: zone.name
+		});
+		const value = await resolveValue({
+			valueOption,
+			type
+		});
+		const ttl = ttlOption ?? 300;
+		console.log("");
+		console.log("Proposed record:");
+		console.log(`  Name:  ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}`);
+		console.log(`  Type:  ${type}`);
+		console.log(`  TTL:   ${ttl}`);
+		console.log(`  Value: ${value}`);
+		console.log("");
+		const existingSets = require_commands_aws_route53_add_record_utils.getRecordSetsAtName({
+			profile,
+			hostedZoneId: zone.id,
+			name,
+			verbose
+		});
+		const existing = existingSets.find((set) => set.type === type) ?? null;
+		const conflicts = require_commands_aws_route53_add_record_utils.findCnameConflicts({
+			existingSets,
+			type
+		});
+		if (conflicts.length > 0) {
+			console.error(chalk.default.red(`❌ Conflict: cannot add a ${type} record at ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}.`));
+			console.error("");
+			console.error(chalk.default.yellow("Route53 does not allow a CNAME and any other record type to coexist at the same name. Conflicting record(s) already exist:"));
+			for (const conflict of conflicts) console.error(`  ${conflict.type}  ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(conflict.name)}${require_commands_aws_route53_add_record_utils.formatValues(conflict.isAlias ? ["(alias)"] : conflict.values)}`);
+			console.error("");
+			console.error(chalk.default.yellow("Remove the conflicting record, then re-create the one you wanted:"));
+			const zoneName = require_commands_aws_route53_add_record_utils.withoutTrailingDot(zone.name);
+			const displayName = require_commands_aws_route53_add_record_utils.withoutTrailingDot(name);
+			const quotedValue = /^[A-Za-z0-9._:@/-]+$/.test(value) ? value : `"${value}"`;
+			const ttlFlag = ttl === 300 ? "" : ` --ttl ${ttl}`;
+			let step = 1;
+			for (const conflict of conflicts) console.error(chalk.default.cyan(`  ${step++}. mtn aws route53 remove-record -z ${zoneName} -t ${conflict.type} -n ${displayName}`));
+			console.error(chalk.default.cyan(`  ${step}. mtn aws route53 add-record -z ${zoneName} -t ${type} -n ${displayName} --value ${quotedValue}${ttlFlag}`));
+			process.exit(1);
+		}
+		if (existing?.isAlias) {
+			console.log(chalk.default.yellow("An ALIAS record already exists at this name + type. Continuing will replace it with a standard record set."));
+			console.log("");
+		} else if (existing) {
+			console.log(chalk.default.yellow(`Existing ${type} record at ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}:${require_commands_aws_route53_add_record_utils.formatValues(existing.values)}`));
+			if (existing.ttl !== void 0) console.log(`  TTL: ${existing.ttl}`);
+			console.log("");
+		} else {
+			console.log(chalk.default.green(`No existing ${type} record at ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}.`));
+			console.log("");
+		}
+		/** @type {"replace" | "append"} */
+		let mode = "replace";
+		if (existing && !existing.isAlias && existing.values.length > 0) mode = await resolveChangeMode({
+			existing,
+			type
+		});
+		const plan = require_commands_aws_route53_add_record_utils.planRecordChange({
+			existing,
+			newValue: value,
+			mode
+		});
+		console.log(plan.summary);
+		console.log("");
+		if (plan.action === "noop") return;
+		if (plan.action === "overwrite" || plan.action === "append") {
+			console.log("Final values that will be written:");
+			for (const finalValue of plan.finalValues) console.log(`  - ${finalValue}`);
+			console.log("");
+		}
+		if (dryRun) {
+			console.log(chalk.default.cyan("Dry run — no changes made."));
+			return;
+		}
+		if (!yes) {
+			if (!await require_commands_aws_utils_tty.promptYesNo({
+				message: plan.action === "create" ? "Create this record?" : plan.action === "append" ? "Add this value to the existing record?" : "Overwrite the existing record?",
+				defaultYes: false
+			})) {
+				console.log("Aborted.");
+				return;
+			}
+		}
+		const changeInfo = require_commands_aws_route53_add_record_utils.upsertResourceRecordSet({
+			profile,
+			hostedZoneId: zone.id,
+			name,
+			type,
+			ttl: existing?.ttl ?? ttl,
+			values: plan.finalValues,
+			verbose
+		});
+		console.log("");
+		console.log(chalk.default.green(`Done. ${plan.action === "create" ? "Created" : plan.action === "append" ? "Updated (appended)" : "Updated (overwrote)"} ${type} ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}.`));
+		if (changeInfo?.Id) {
+			console.log(`  Change ID: ${changeInfo.Id}`);
+			console.log(`  Status:    ${changeInfo.Status ?? "PENDING"}`);
+		}
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ add-record failed:"));
+		if (error instanceof require_commands_aws_utils_exec_aws.AwsCliError || error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.addRecordCommand = addRecordCommand;
+exports.resolveHostedZone = resolveHostedZone;
+exports.resolveName = resolveName;
+exports.resolveRecordType = resolveRecordType;

package/cjs/commands/aws/route53/add-record/handler.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Resolve the hosted zone: from --zone, or interactive picker.
+ * @param {{
+ *   profile?: string;
+ *   zoneOption?: string;
+ *   verbose: boolean;
+ * }} params
+ * @returns {Promise<import("./utils.js").HostedZone>}
+ */
+export function resolveHostedZone(params: {
+    profile?: string;
+    zoneOption?: string;
+    verbose: boolean;
+}): Promise<import("./utils.js").HostedZone>;
+/**
+ * Resolve record type from --type or interactive picker.
+ * @param {string | undefined} typeOption
+ * @returns {Promise<string>}
+ */
+export function resolveRecordType(typeOption: string | undefined): Promise<string>;
+/**
+ * Resolve record name from --name or prompt.
+ * @param {{ nameOption?: string; zoneName: string }} params
+ * @returns {Promise<string>} FQDN with trailing dot
+ */
+export function resolveName(params: {
+    nameOption?: string;
+    zoneName: string;
+}): Promise<string>;
+/**
+ * `aws route53 add-record` handler: interactively (or via flags) create or
+ * update a Route53 resource record set, showing whether the change adds or
+ * overwrites.
+ * @param {unknown} options
+ */
+export function addRecordCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/route53/add-record/index.cjs

@@ -0,0 +1,26 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_route53_add_record_schema = require("./schema.cjs");
+const require_commands_aws_route53_add_record_utils = require("./utils.cjs");
+const require_commands_aws_route53_add_record_handler = require("./handler.cjs");
+exports.DEFAULT_TTL = require_commands_aws_route53_add_record_schema.DEFAULT_TTL;
+exports.RECORD_TYPES = require_commands_aws_route53_add_record_schema.RECORD_TYPES;
+exports.addRecordCommand = require_commands_aws_route53_add_record_handler.addRecordCommand;
+exports.addRecordOptionsSchema = require_commands_aws_route53_add_record_schema.addRecordOptionsSchema;
+exports.bareHostedZoneId = require_commands_aws_route53_add_record_utils.bareHostedZoneId;
+exports.deleteResourceRecordSet = require_commands_aws_route53_add_record_utils.deleteResourceRecordSet;
+exports.findCnameConflicts = require_commands_aws_route53_add_record_utils.findCnameConflicts;
+exports.findHostedZone = require_commands_aws_route53_add_record_utils.findHostedZone;
+exports.formatValues = require_commands_aws_route53_add_record_utils.formatValues;
+exports.getRecordSetsAtName = require_commands_aws_route53_add_record_utils.getRecordSetsAtName;
+exports.getResourceRecordSet = require_commands_aws_route53_add_record_utils.getResourceRecordSet;
+exports.hostedZoneLabel = require_commands_aws_route53_add_record_utils.hostedZoneLabel;
+exports.listHostedZones = require_commands_aws_route53_add_record_utils.listHostedZones;
+exports.normalizeRecordValue = require_commands_aws_route53_add_record_utils.normalizeRecordValue;
+exports.planRecordChange = require_commands_aws_route53_add_record_utils.planRecordChange;
+exports.resolveHostedZone = require_commands_aws_route53_add_record_handler.resolveHostedZone;
+exports.resolveName = require_commands_aws_route53_add_record_handler.resolveName;
+exports.resolveRecordName = require_commands_aws_route53_add_record_utils.resolveRecordName;
+exports.resolveRecordType = require_commands_aws_route53_add_record_handler.resolveRecordType;
+exports.upsertResourceRecordSet = require_commands_aws_route53_add_record_utils.upsertResourceRecordSet;
+exports.withTrailingDot = require_commands_aws_route53_add_record_utils.withTrailingDot;
+exports.withoutTrailingDot = require_commands_aws_route53_add_record_utils.withoutTrailingDot;

package/cjs/commands/aws/route53/add-record/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/route53/add-record/schema.cjs

@@ -0,0 +1,43 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/route53/add-record/schema.js
+/**
+* Common Route53 record types offered in the interactive picker.
+* Alias records are not supported by this command.
+*/
+const RECORD_TYPES = [
+	"A",
+	"AAAA",
+	"CNAME",
+	"TXT",
+	"MX",
+	"NS",
+	"SRV",
+	"CAA"
+];
+/**
+* Default TTL (seconds) when creating or replacing a record set.
+*/
+const DEFAULT_TTL = 300;
+/**
+* Zod schema for `aws route53 add-record` options.
+*/
+const addRecordOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	zone: zod.z.string().optional().describe("Hosted zone name or ID (e.g. mountaindev.com or Z123…). Skips the zone picker when set."),
+	type: zod.z.string().optional().transform((value) => value === void 0 ? void 0 : value.toUpperCase()).refine((value) => value === void 0 || typeof value === "string" && RECORD_TYPES.includes(value), { message: `Record type must be one of: ${RECORD_TYPES.join(", ")}` }).describe(`DNS record type (${RECORD_TYPES.join(", ")})`),
+	name: zod.z.string().optional().describe("Record name relative to the zone (e.g. \"redline\") or a fully-qualified name"),
+	value: zod.z.string().optional().describe("Record value (e.g. a CNAME target or A address)"),
+	ttl: zod.z.number().int().positive().optional().describe(`TTL in seconds (default: 300)`),
+	yes: zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Preview the change without calling Route53"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof addRecordOptionsSchema>} AddRecordOptions
+*/
+//#endregion
+exports.DEFAULT_TTL = DEFAULT_TTL;
+exports.RECORD_TYPES = RECORD_TYPES;
+exports.addRecordOptionsSchema = addRecordOptionsSchema;