@mtndev/cli 2.0.0 → 2.0.1

package/cjs/commands/aws/ec2/allow-ip/utils.cjs

@@ -1,39 +1,379 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-var _B5ENMOCDcjs = require('../../../../__chunks/B5ENMOCD.cjs');
-require('../../../../__chunks/G5K4PVIL.cjs');
-require('../../../../__chunks/R3GUC7O7.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.authorizeRule = _B5ENMOCDcjs.authorizeRule; exports.describeSecurityGroups = _B5ENMOCDcjs.describeSecurityGroups; exports.extractRoamingFirstName = _B5ENMOCDcjs.extractRoamingFirstName; exports.getCurrentPublicIp = _B5ENMOCDcjs.getCurrentPublicIp; exports.getSecurityGroupDetails = _B5ENMOCDcjs.getSecurityGroupDetails; exports.instanceLabel = _B5ENMOCDcjs.instanceLabel; exports.listEnabledRegions = _B5ENMOCDcjs.listEnabledRegions; exports.listInstances = _B5ENMOCDcjs.listInstances; exports.listSshIngressRules = _B5ENMOCDcjs.listSshIngressRules; exports.printSshRules = _B5ENMOCDcjs.printSshRules; exports.resolveRoamingRule = _B5ENMOCDcjs.resolveRoamingRule; exports.revokeRule = _B5ENMOCDcjs.revokeRule; exports.roamingRuleDescription = _B5ENMOCDcjs.roamingRuleDescription; exports.ruleAlreadyAllowsIp = _B5ENMOCDcjs.ruleAlreadyAllowsIp; exports.securityGroupLabel = _B5ENMOCDcjs.securityGroupLabel; exports.sshRuleLabel = _B5ENMOCDcjs.sshRuleLabel;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_ec2_allow_ip_schema = require("./schema.cjs");
+//#region src/commands/aws/ec2/allow-ip/utils.js
+/**
+* @typedef {Object} Ec2Instance
+* @property {string} instanceId
+* @property {string} name
+* @property {string} state
+* @property {string} instanceType
+* @property {string | null} publicIp
+* @property {string[]} securityGroupIds
+*/
+/**
+* @typedef {Object} SecurityGroup
+* @property {string} groupId
+* @property {string} groupName
+* @property {string} description
+*/
+/**
+* @typedef {Object} SshIngressRule
+* @property {string} cidrIp
+* @property {string} description
+* @property {number} fromPort
+* @property {number} toPort
+* @property {string} ipProtocol
+*/
+/**
+* Determine the caller's current public IPv4 address.
+* @returns {Promise<string>}
+*/
+async function getCurrentPublicIp() {
+	for (const url of ["https://checkip.amazonaws.com", "https://api.ipify.org"]) try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 8e3);
+		const response = await fetch(url, { signal: controller.signal });
+		clearTimeout(timeout);
+		if (!response.ok) continue;
+		const ip = (await response.text()).trim();
+		if (ip && ip.includes(".")) return ip;
+	} catch {
+		continue;
+	}
+	throw new Error("Could not determine your current public IP address");
+}
+/**
+* List regions that are opted-in / enabled for the profile.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {string[]}
+*/
+function listEnabledRegions(params) {
+	const { profile, region, verbose } = params;
+	const data = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-regions",
+			"--query",
+			"Regions[?OptInStatus!=`not-opted-in`].RegionName"
+		],
+		verbose
+	});
+	return (Array.isArray(data) ? data : []).map((value) => String(value)).sort();
+}
+/**
+* List non-terminated EC2 instances in a region.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {Ec2Instance[]}
+*/
+function listInstances(params) {
+	const { profile, region, verbose } = params;
+	const data = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: ["ec2", "describe-instances"],
+		verbose
+	});
+	/** @type {Ec2Instance[]} */
+	const instances = [];
+	for (const reservation of data.Reservations ?? []) for (const raw of reservation.Instances ?? []) {
+		const state = raw.State?.Name ?? "unknown";
+		if (state === "terminated" || state === "shutting-down") continue;
+		let name = "";
+		for (const tag of raw.Tags ?? []) if (tag.Key === "Name") {
+			name = tag.Value ?? "";
+			break;
+		}
+		const securityGroupIds = (raw.SecurityGroups ?? []).map((group) => group.GroupId).filter((id) => Boolean(id));
+		instances.push({
+			instanceId: raw.InstanceId,
+			name,
+			state,
+			instanceType: raw.InstanceType ?? "unknown",
+			publicIp: raw.PublicIpAddress ?? null,
+			securityGroupIds
+		});
+	}
+	instances.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.instanceId.localeCompare(b.instanceId));
+	return instances;
+}
+/**
+* Describe security groups by id.
+* @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+* @returns {SecurityGroup[]}
+*/
+function describeSecurityGroups(params) {
+	const { profile, region, groupIds, verbose } = params;
+	if (groupIds.length === 0) return [];
+	/** @type {SecurityGroup[]} */
+	const groups = (require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			...groupIds
+		],
+		verbose
+	}).SecurityGroups ?? []).map((raw) => ({
+		groupId: raw.GroupId,
+		groupName: raw.GroupName ?? "",
+		description: raw.Description ?? ""
+	}));
+	groups.sort((a, b) => a.groupName.localeCompare(b.groupName));
+	return groups;
+}
+/**
+* Load full details for a single security group.
+* @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+* @returns {any | null}
+*/
+function getSecurityGroupDetails(params) {
+	const { profile, region, groupId, verbose } = params;
+	const securityGroups = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			groupId
+		],
+		verbose
+	}).SecurityGroups ?? [];
+	if (securityGroups.length === 0) return null;
+	return securityGroups[0];
+}
+/**
+* @param {string} cidrIp
+* @returns {boolean}
+*/
+function isSingleHostCidr(cidrIp) {
+	return cidrIp.endsWith("/32") && cidrIp !== "0.0.0.0/0";
+}
+/**
+* @param {any} permission
+* @returns {boolean}
+*/
+function portAllowsSsh(permission) {
+	const protocol = permission.IpProtocol;
+	if (protocol !== "tcp" && protocol !== "6") return false;
+	const fromPort = permission.FromPort;
+	const toPort = permission.ToPort;
+	if (fromPort === void 0 && toPort === void 0) return true;
+	if (fromPort === void 0 || toPort === void 0) return false;
+	return fromPort <= 22 && 22 <= toPort;
+}
+/**
+* Extract single-host SSH ingress rules (port 22, /32) from a security group.
+* @param {any} securityGroup
+* @returns {SshIngressRule[]}
+*/
+function listSshIngressRules(securityGroup) {
+	/** @type {SshIngressRule[]} */
+	const rules = [];
+	for (const permission of securityGroup.IpPermissions ?? []) {
+		if (!portAllowsSsh(permission)) continue;
+		const fromPort = permission.FromPort ?? 22;
+		const toPort = permission.ToPort ?? 22;
+		const ipProtocol = permission.IpProtocol ?? "tcp";
+		for (const ipRange of permission.IpRanges ?? []) {
+			const cidrIp = ipRange.CidrIp;
+			if (!cidrIp || !isSingleHostCidr(cidrIp)) continue;
+			rules.push({
+				cidrIp,
+				description: ipRange.Description ?? "",
+				fromPort,
+				toPort,
+				ipProtocol
+			});
+		}
+	}
+	return rules;
+}
+/**
+* Derive a first name from the IAM ARN or profile (md-{name}-...).
+* @param {{ profile?: string; identity: { Arn?: string } }} params
+* @returns {string}
+*/
+function extractRoamingFirstName(params) {
+	const { profile, identity } = params;
+	const arn = identity.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const match = /^md-([^-]+)-/.exec(candidate);
+		if (match && match[1]) return match[1].charAt(0).toUpperCase() + match[1].slice(1).toLowerCase();
+	}
+	return require_commands_aws_ec2_allow_ip_schema.DEFAULT_ROAMING_NAME;
+}
+/**
+* @param {string} firstName
+* @returns {string}
+*/
+function roamingRuleDescription(firstName) {
+	return `${firstName} Roaming`;
+}
+/**
+* Find an existing rule whose description matches the roaming rule name.
+* @param {SshIngressRule[]} sshRules
+* @param {string} ruleDescription
+* @returns {SshIngressRule | null}
+*/
+function resolveRoamingRule(sshRules, ruleDescription) {
+	const target = ruleDescription.toLowerCase();
+	for (const rule of sshRules) if (rule.description.trim().toLowerCase() === target) return rule;
+	return null;
+}
+/**
+* Find an existing rule that already allows the given CIDR.
+* @param {SshIngressRule[]} sshRules
+* @param {string} newCidr
+* @returns {SshIngressRule | null}
+*/
+function ruleAlreadyAllowsIp(sshRules, newCidr) {
+	for (const rule of sshRules) if (rule.cidrIp === newCidr) return rule;
+	return null;
+}
+/**
+* @param {{
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+* }} params
+* @returns {string} JSON string for the --ip-permissions argument
+*/
+function buildIpPermissions(params) {
+	const { cidrIp, description, fromPort = 22, toPort = 22, ipProtocol = "tcp" } = params;
+	return JSON.stringify([{
+		IpProtocol: ipProtocol,
+		FromPort: fromPort,
+		ToPort: toPort,
+		IpRanges: [{
+			CidrIp: cidrIp,
+			Description: description
+		}]
+	}]);
+}
+/**
+* Authorize a new SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+*   verbose?: boolean;
+* }} params
+*/
+function authorizeRule(params) {
+	const { profile, region, groupId, verbose, ...rule } = params;
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"authorize-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions(rule)
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Revoke an existing SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   rule: SshIngressRule;
+*   verbose?: boolean;
+* }} params
+*/
+function revokeRule(params) {
+	const { profile, region, groupId, rule, verbose } = params;
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"revoke-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions({
+				cidrIp: rule.cidrIp,
+				description: rule.description,
+				fromPort: rule.fromPort,
+				toPort: rule.toPort,
+				ipProtocol: rule.ipProtocol
+			})
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* @param {Ec2Instance} instance
+* @returns {string}
+*/
+function instanceLabel(instance) {
+	const publicIp = instance.publicIp || "no public IP";
+	const name = instance.name || "(no name)";
+	return `${instance.instanceId}  ${name}  ${instance.state}  ${instance.instanceType}  ${publicIp}`;
+}
+/**
+* @param {SecurityGroup} group
+* @returns {string}
+*/
+function securityGroupLabel(group) {
+	return `${group.groupId}  ${group.groupName}  ${group.description}`;
+}
+/**
+* @param {SshIngressRule} rule
+* @returns {string}
+*/
+function sshRuleLabel(rule) {
+	const description = rule.description || "(no description)";
+	return `${rule.cidrIp}  ${description}`;
+}
+/**
+* Print single-host SSH rules using the given logger.
+* @param {SshIngressRule[]} sshRules
+* @param {(message: string) => void} [log]
+*/
+function printSshRules(sshRules, log = console.log) {
+	if (sshRules.length === 0) {
+		log("  (no single-host SSH rules on port 22)");
+		return;
+	}
+	for (const rule of sshRules) log(`  - ${sshRuleLabel(rule)}`);
+}
+//#endregion
+exports.authorizeRule = authorizeRule;
+exports.describeSecurityGroups = describeSecurityGroups;
+exports.extractRoamingFirstName = extractRoamingFirstName;
+exports.getCurrentPublicIp = getCurrentPublicIp;
+exports.getSecurityGroupDetails = getSecurityGroupDetails;
+exports.instanceLabel = instanceLabel;
+exports.listEnabledRegions = listEnabledRegions;
+exports.listInstances = listInstances;
+exports.listSshIngressRules = listSshIngressRules;
+exports.printSshRules = printSshRules;
+exports.resolveRoamingRule = resolveRoamingRule;
+exports.revokeRule = revokeRule;
+exports.roamingRuleDescription = roamingRuleDescription;
+exports.ruleAlreadyAllowsIp = ruleAlreadyAllowsIp;
+exports.securityGroupLabel = securityGroupLabel;
+exports.sshRuleLabel = sshRuleLabel;

package/cjs/commands/aws/iam/admin-group.cjs

@@ -1,15 +1,111 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-
-
-var _T2A7TN4Fcjs = require('../../../__chunks/T2A7TN4F.cjs');
-require('../../../__chunks/R3GUC7O7.cjs');
-
-
-
-
-
-
-exports.ADMIN_GROUP_NAME = _T2A7TN4Fcjs.ADMIN_GROUP_NAME; exports.groupUserNames = _T2A7TN4Fcjs.groupUserNames; exports.listVaultProfiles = _T2A7TN4Fcjs.listVaultProfiles; exports.resolveAdminScanProfiles = _T2A7TN4Fcjs.resolveAdminScanProfiles; exports.resolveProfileScan = _T2A7TN4Fcjs.resolveProfileScan;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_exec_aws = require("../utils/exec-aws.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let child_process = require("child_process");
+//#region src/commands/aws/iam/admin-group.js
+/**
+* The IAM group that grants break-glass admin access and should normally be empty.
+*/
+const ADMIN_GROUP_NAME = "acl-admin-do-not-use";
+const VAULT_DURATION = process.env.AWS_VAULT_DURATION ?? "15m";
+/**
+* A function bound to a profile's working credential mode (direct or aws-vault).
+* @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+*/
+/**
+* List aws-vault profiles that have stored credentials.
+* @returns {string[]}
+*/
+function listVaultProfiles() {
+	const result = (0, child_process.spawnSync)("aws-vault", ["list", "--credentials"], { encoding: "utf-8" });
+	if (result.status !== 0) return [];
+	return (result.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+/**
+* Resolve which profiles to scan for admin-group commands.
+* Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+* @param {{ profile?: string; all?: boolean }} params
+* @returns {string[]}
+*/
+function resolveAdminScanProfiles({ profile, all = false }) {
+	const targetProfile = profile ?? process.env.AWS_PROFILE;
+	if (!all && targetProfile) return [targetProfile];
+	const profiles = listVaultProfiles();
+	if (profiles.length === 0) throw new Error("No aws-vault profiles with credentials found.");
+	return profiles;
+}
+/**
+* @param {{ Users?: Array<{ UserName: string }> }} group
+* @returns {string[]}
+*/
+function groupUserNames(group) {
+	return (group.Users ?? []).map((user) => user.UserName);
+}
+/**
+* Resolve a working credential runner for a profile and read the admin group.
+* Tries stored credentials first, then falls back to `aws-vault exec`.
+* The returned `run` reuses whichever mode worked, so callers can perform
+* follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+* @param {{ profile: string; verbose?: boolean }} params
+* @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+*/
+function resolveProfileScan(params) {
+	const { profile, verbose = false } = params;
+	const idArgs = ["sts", "get-caller-identity"];
+	const groupArgs = [
+		"iam",
+		"get-group",
+		"--group-name",
+		ADMIN_GROUP_NAME
+	];
+	/** @type {ProfileRunner} */
+	const directRun = (args, options = {}) => require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	/** @type {ProfileRunner} */
+	const vaultRun = (args, options = {}) => require_commands_aws_utils_exec_aws.runAwsVault({
+		profile,
+		args,
+		duration: VAULT_DURATION,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	try {
+		const identity = directRun(idArgs);
+		const group = directRun(groupArgs);
+		return {
+			accountId: identity.Account,
+			arn: identity.Arn,
+			users: groupUserNames(group),
+			run: directRun
+		};
+	} catch (directError) {
+		try {
+			const identity = vaultRun(idArgs);
+			const group = vaultRun(groupArgs);
+			return {
+				accountId: identity.Account,
+				arn: identity.Arn,
+				users: groupUserNames(group),
+				run: vaultRun
+			};
+		} catch {
+			if (verbose) {
+				const reason = directError instanceof Error ? directError.message.split("\n")[0] ?? "" : String(directError);
+				console.log(chalk.default.dim(`skip   ${profile} — ${reason}`));
+			}
+			return null;
+		}
+	}
+}
+//#endregion
+exports.ADMIN_GROUP_NAME = ADMIN_GROUP_NAME;
+exports.groupUserNames = groupUserNames;
+exports.listVaultProfiles = listVaultProfiles;
+exports.resolveAdminScanProfiles = resolveAdminScanProfiles;
+exports.resolveProfileScan = resolveProfileScan;

package/cjs/commands/aws/iam/break-glass/handler.cjs

@@ -1,12 +1,127 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _KU76LC42cjs = require('../../../../__chunks/KU76LC42.cjs');
-require('../../../../__chunks/UWHPE2GI.cjs');
-require('../../../../__chunks/T2A7TN4F.cjs');
-require('../../../../__chunks/R3GUC7O7.cjs');
-require('../../../../__chunks/NT2XXAI6.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-require('../../../../__chunks/CMUD7LLN.cjs');
-
-
-exports.breakGlassCommand = _KU76LC42cjs.breakGlassCommand;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_break_glass_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/break-glass/handler.js
+/**
+* Derive an IAM user name from a caller-identity ARN.
+* Returns null for non-user ARNs (assumed roles, root, etc.).
+* @param {string} arn
+* @returns {string | null}
+*/
+function userNameFromArn(arn) {
+	const index = arn.indexOf(":user/");
+	if (index === -1) return null;
+	const name = arn.slice(index + 6).split("/").pop();
+	return name && name.length > 0 ? name : null;
+}
+/**
+* `aws iam break-glass` handler: grant break-glass admin access by adding a user
+* to the acl-admin-do-not-use group for a single profile. Defaults to the
+* caller's own IAM user when no --user is given.
+* @param {unknown} options
+*/
+async function breakGlassCommand(options) {
+	try {
+		const { profile, user, yes, dryRun, verbose } = require_commands_aws_iam_break_glass_schema.breakGlassOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const targetProfile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile });
+		if (!targetProfile) {
+			console.error(chalk.default.red("No profile specified. Pass --profile <name> or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		const scan = require_commands_aws_iam_admin_group.resolveProfileScan({
+			profile: targetProfile,
+			verbose
+		});
+		if (!scan) {
+			console.error(chalk.default.red(`\n❌ Could not read ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME} for profile "${targetProfile}".`));
+			console.error(chalk.default.yellow("   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"));
+			process.exit(1);
+		}
+		/** @type {string[]} */
+		let targets = user;
+		if (targets.length === 0) {
+			const derived = userNameFromArn(scan.arn);
+			if (!derived) {
+				console.error(chalk.default.red(`\n❌ Could not determine your IAM user from the caller identity:\n   ${scan.arn}`));
+				console.error(chalk.default.yellow("   Pass --user <name> to choose who to grant.\n"));
+				process.exit(1);
+			}
+			targets = [derived];
+		}
+		const alreadyMembers = new Set(scan.users);
+		const toGrant = targets.filter((name) => !alreadyMembers.has(name));
+		const existing = targets.filter((name) => alreadyMembers.has(name));
+		console.log(chalk.default.blue(`\n==> Break-glass admin (${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}) — profile ${targetProfile} (${scan.accountId})\n`));
+		for (const name of existing) console.log(chalk.default.dim(`--     ${name} already has break-glass access`));
+		if (toGrant.length === 0) {
+			console.log(chalk.default.green("\nNothing to do — all target user(s) already have break-glass access.\n"));
+			return;
+		}
+		console.log(chalk.default.red.bold(`⚠  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`));
+		if (dryRun) {
+			for (const name of toGrant) console.log(chalk.default.yellow(`  [dry-run] would add ${name} to ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}`));
+			console.log(chalk.default.yellow("\n[dry-run] Re-run without --dry-run to apply.\n"));
+			return;
+		}
+		let confirmed = yes;
+		if (!confirmed) confirmed = await require_commands_aws_utils_tty.promptYesNo({
+			message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
+			defaultYes: false
+		});
+		if (!confirmed) {
+			console.log(chalk.default.dim("  aborted (not confirmed)\n"));
+			return;
+		}
+		let granted = 0;
+		for (const name of toGrant) try {
+			scan.run([
+				"iam",
+				"add-user-to-group",
+				"--group-name",
+				require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME,
+				"--user-name",
+				name
+			], { expectJson: false });
+			console.log(chalk.default.green(`  granted ${name}`));
+			granted += 1;
+		} catch (grantError) {
+			const reason = grantError instanceof Error ? grantError.message.split("\n")[0] ?? "" : String(grantError);
+			console.log(chalk.default.red(`  failed to grant ${name}: ${reason}`));
+		}
+		console.log(chalk.default.blue("\n==> Summary"));
+		console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
+		console.log(`  Users granted:    ${granted}`);
+		console.log(`  Already had it:   ${existing.length}`);
+		console.log(chalk.default.yellow("\n💡 Revoke with `mtn aws iam remove-admin` when you are done."));
+		console.log(chalk.default.dim("   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ break-glass failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.breakGlassCommand = breakGlassCommand;