@mtndev/cli 2.0.0 → 2.0.1

package/esm/commands/aws/index.js

@@ -1,229 +1,142 @@
-import {
-  registerAwsCommands
-} from "../../__chunks/QSE66AKY.js";
-import "../../__chunks/AEDEAYF5.js";
-import {
-  allowIpCommand
-} from "../../__chunks/PNPPDYKC.js";
-import {
-  authorizeRule,
-  describeSecurityGroups,
-  extractRoamingFirstName,
-  getCurrentPublicIp,
-  getSecurityGroupDetails,
-  instanceLabel,
-  listEnabledRegions,
-  listInstances,
-  listSshIngressRules,
-  printSshRules,
-  resolveRoamingRule,
-  revokeRule,
-  roamingRuleDescription,
-  ruleAlreadyAllowsIp,
-  securityGroupLabel,
-  sshRuleLabel
-} from "../../__chunks/U7HAE2RF.js";
-import {
-  DEFAULT_REGION,
-  DEFAULT_ROAMING_NAME,
-  SSH_PORT,
-  allowIpOptionsSchema
-} from "../../__chunks/J34UVKLA.js";
-import "../../__chunks/5ZBVGSOK.js";
-import {
-  checkAdminCommand
-} from "../../__chunks/S7IJPJ4R.js";
-import {
-  checkAdminOptionsSchema
-} from "../../__chunks/QUF7PS4R.js";
-import "../../__chunks/TIOVE6HR.js";
-import {
-  breakGlassCommand
-} from "../../__chunks/VKAKISRG.js";
-import {
-  breakGlassOptionsSchema
-} from "../../__chunks/EMSH4P76.js";
-import "../../__chunks/D62SPZXC.js";
-import {
-  removeAdminCommand
-} from "../../__chunks/FFKFVMIE.js";
-import {
-  removeAdminOptionsSchema
-} from "../../__chunks/DNFTUMGD.js";
-import {
-  ADMIN_GROUP_NAME
-} from "../../__chunks/NF3M2L6C.js";
-import "../../__chunks/CVQVHLW5.js";
-import {
-  usersCommand
-} from "../../__chunks/JZPBBBIG.js";
-import {
-  usersOptionsSchema
-} from "../../__chunks/XXK32TIM.js";
-import "../../__chunks/WOZFZKFY.js";
-import {
-  setupAclCommand
-} from "../../__chunks/DMYFNF54.js";
-import {
-  ACL_GROUPS,
-  CUSTOM_POLICIES,
-  attach,
-  detach,
-  ensureGroup,
-  printFinalState,
-  publishPolicy
-} from "../../__chunks/XOUWDB3T.js";
-import {
-  buildUsername,
-  createCliAccessKey,
-  createUsersInteractive,
-  ensureAclGroupsExist,
-  ensureUser,
-  ensureUserInGroup,
-  inferAccountName,
-  isValidSlug,
-  normalizeIdentifier,
-  normalizeSlug,
-  parseMdUsername,
-  roleToGroup
-} from "../../__chunks/3QLI5BDL.js";
-import {
-  setupAclOptionsSchema
-} from "../../__chunks/XQN2TA4S.js";
-import "../../__chunks/7VF4Q43Q.js";
-import {
-  removeRecordCommand
-} from "../../__chunks/QKDDLIWD.js";
-import {
-  removeRecordOptionsSchema
-} from "../../__chunks/IZFGBYGE.js";
-import "../../__chunks/XI7GZDE2.js";
-import {
-  addRecordCommand,
-  resolveHostedZone,
-  resolveName,
-  resolveRecordType
-} from "../../__chunks/G4NJHFFU.js";
-import {
-  bareHostedZoneId,
-  deleteResourceRecordSet,
-  findCnameConflicts,
-  findHostedZone,
-  formatValues,
-  getRecordSetsAtName,
-  getResourceRecordSet,
-  hostedZoneLabel,
-  listHostedZones,
-  normalizeRecordValue,
-  planRecordChange,
-  resolveRecordName,
-  upsertResourceRecordSet,
-  withTrailingDot,
-  withoutTrailingDot
-} from "../../__chunks/33UYMUQD.js";
-import {
-  DEFAULT_TTL,
-  RECORD_TYPES,
-  addRecordOptionsSchema
-} from "../../__chunks/IEOGAQYI.js";
-import "../../__chunks/FNXUONAV.js";
-import "../../__chunks/ZO55YUSY.js";
-import "../../__chunks/TXKMEIDQ.js";
-import {
-  sendEmailCommand
-} from "../../__chunks/2FTTEFEK.js";
-import {
-  defaultBody,
-  sendViaApi,
-  sendViaSmtp
-} from "../../__chunks/UXWY7BYE.js";
-import "../../__chunks/B2DVQ2UL.js";
-import "../../__chunks/5GIUAFXL.js";
-import {
-  sendEmailOptionsSchema
-} from "../../__chunks/3BKWTHLJ.js";
-import "../../__chunks/73BJG53F.js";
-import "../../__chunks/ZHKVJO2U.js";
-export {
-  ACL_GROUPS,
-  ADMIN_GROUP_NAME,
-  CUSTOM_POLICIES,
-  DEFAULT_REGION,
-  DEFAULT_ROAMING_NAME,
-  DEFAULT_TTL,
-  RECORD_TYPES,
-  SSH_PORT,
-  addRecordCommand,
-  addRecordOptionsSchema,
-  allowIpCommand,
-  allowIpOptionsSchema,
-  attach,
-  authorizeRule,
-  bareHostedZoneId,
-  breakGlassCommand,
-  breakGlassOptionsSchema,
-  buildUsername,
-  checkAdminCommand,
-  checkAdminOptionsSchema,
-  createCliAccessKey,
-  createUsersInteractive,
-  defaultBody,
-  deleteResourceRecordSet,
-  describeSecurityGroups,
-  detach,
-  ensureAclGroupsExist,
-  ensureGroup,
-  ensureUser,
-  ensureUserInGroup,
-  extractRoamingFirstName,
-  findCnameConflicts,
-  findHostedZone,
-  formatValues,
-  getCurrentPublicIp,
-  getRecordSetsAtName,
-  getResourceRecordSet,
-  getSecurityGroupDetails,
-  hostedZoneLabel,
-  inferAccountName,
-  instanceLabel,
-  isValidSlug,
-  listEnabledRegions,
-  listHostedZones,
-  listInstances,
-  listSshIngressRules,
-  normalizeIdentifier,
-  normalizeRecordValue,
-  normalizeSlug,
-  parseMdUsername,
-  planRecordChange,
-  printFinalState,
-  printSshRules,
-  publishPolicy,
-  registerAwsCommands,
-  removeAdminCommand,
-  removeAdminOptionsSchema,
-  removeRecordCommand,
-  removeRecordOptionsSchema,
-  resolveHostedZone,
-  resolveName,
-  resolveRecordName,
-  resolveRecordType,
-  resolveRoamingRule,
-  revokeRule,
-  roamingRuleDescription,
-  roleToGroup,
-  ruleAlreadyAllowsIp,
-  securityGroupLabel,
-  sendEmailCommand,
-  sendEmailOptionsSchema,
-  sendViaApi,
-  sendViaSmtp,
-  setupAclCommand,
-  setupAclOptionsSchema,
-  sshRuleLabel,
-  upsertResourceRecordSet,
-  usersCommand,
-  usersOptionsSchema,
-  withTrailingDot,
-  withoutTrailingDot
-};
+import { sendEmailOptionsSchema } from "./ses/send-email/schema.js";
+import { defaultBody, sendViaApi, sendViaSmtp } from "./ses/send-email/utils.js";
+import { sendEmailCommand } from "./ses/send-email/handler.js";
+import "./ses/send-email/index.js";
+import { DEFAULT_TTL, RECORD_TYPES, addRecordOptionsSchema } from "./route53/add-record/schema.js";
+import { bareHostedZoneId, deleteResourceRecordSet, findCnameConflicts, findHostedZone, formatValues, getRecordSetsAtName, getResourceRecordSet, hostedZoneLabel, listHostedZones, normalizeRecordValue, planRecordChange, resolveRecordName, upsertResourceRecordSet, withTrailingDot, withoutTrailingDot } from "./route53/add-record/utils.js";
+import { addRecordCommand, resolveHostedZone, resolveName, resolveRecordType } from "./route53/add-record/handler.js";
+import { removeRecordOptionsSchema } from "./route53/remove-record/schema.js";
+import { removeRecordCommand } from "./route53/remove-record/handler.js";
+import "./route53/remove-record/index.js";
+import "./route53/add-record/index.js";
+import { usersOptionsSchema } from "./iam/users/schema.js";
+import { buildUsername, createCliAccessKey, createUsersInteractive, ensureAclGroupsExist, ensureUser, ensureUserInGroup, inferAccountName, isValidSlug, normalizeIdentifier, normalizeSlug, parseMdUsername, roleToGroup } from "./iam/users/utils.js";
+import { usersCommand } from "./iam/users/handler.js";
+import "./iam/users/index.js";
+import { setupAclOptionsSchema } from "./iam/setup-acl/schema.js";
+import { ACL_GROUPS, CUSTOM_POLICIES, attach, detach, ensureGroup, printFinalState, publishPolicy } from "./iam/setup-acl/utils.js";
+import { setupAclCommand } from "./iam/setup-acl/handler.js";
+import "./iam/setup-acl/index.js";
+import { ADMIN_GROUP_NAME } from "./iam/admin-group.js";
+import { removeAdminOptionsSchema } from "./iam/remove-admin/schema.js";
+import { removeAdminCommand } from "./iam/remove-admin/handler.js";
+import "./iam/remove-admin/index.js";
+import { checkAdminOptionsSchema } from "./iam/check-admin/schema.js";
+import { checkAdminCommand } from "./iam/check-admin/handler.js";
+import "./iam/check-admin/index.js";
+import { breakGlassOptionsSchema } from "./iam/break-glass/schema.js";
+import { breakGlassCommand } from "./iam/break-glass/handler.js";
+import "./iam/break-glass/index.js";
+import { DEFAULT_REGION, DEFAULT_ROAMING_NAME, SSH_PORT, allowIpOptionsSchema } from "./ec2/allow-ip/schema.js";
+import { authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel, sshRuleLabel } from "./ec2/allow-ip/utils.js";
+import { allowIpCommand } from "./ec2/allow-ip/handler.js";
+import "./ec2/allow-ip/index.js";
+//#region src/commands/aws/index.js
+/**
+* Commander collector for repeatable options.
+* @param {string} value
+* @param {string[]} previous
+* @returns {string[]}
+*/
+function collect(value, previous) {
+	return [...previous, value];
+}
+/**
+* Register the `aws` command group and its subcommands on the root program.
+* @param {import('commander').Command} program
+*/
+function registerAwsCommands(program) {
+	const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
+	const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
+	iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description("Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users.").option("--restrict-regions <yes|no>", "Attach the region restriction to acl-power-users (skips the prompt)").option("--no-create-users", "Skip IAM user creation after configuring groups").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await setupAclCommand({
+			restrictRegions: options.restrictRegions,
+			createUsers: options.createUsers,
+			profile: options.profile,
+			region: options.region,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("users").summary("Interactively create IAM users and assign ACL groups").description("Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands.").option("--account-name <slug>", "AWS account slug used in md-{identifier}-{account}-{role}").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await usersCommand({
+			accountName: options.accountName,
+			profile: options.profile,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description("Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group.").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await checkAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description("Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all).").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("--user <name>", "Only remove this user (repeatable); default removes all", collect, []).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await removeAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description("Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("--user <name>", "Grant to this user (repeatable); default is your own IAM user", collect, []).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
+		await breakGlassCommand({
+			profile: options.profile,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands").command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description("Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("--rule-name <name>", "SSH rule description (default: \"{FirstName} Roaming\")").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await allowIpCommand({
+			profile: options.profile,
+			region: options.region,
+			ruleName: options.ruleName,
+			verbose: options.verbose ?? false
+		});
+	});
+	const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
+	route53.command("add-record").summary("Interactively add or update a DNS record").description("Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("--value <value>", "Record value (e.g. CNAME target)").option("--ttl <seconds>", "TTL in seconds (default: 300)", (value) => Number.parseInt(value, 10)).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await addRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			value: options.value,
+			ttl: options.ttl,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	route53.command("remove-record").summary("Interactively delete a DNS record").description("Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await removeRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ses").summary("SES operational commands").description("SES operational commands").command("send-email").summary("Send a test email via SES (API or SMTP)").description("Send a single test email through the SES API (default) or the SES SMTP endpoint.").requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option("--access-key-id <id>", "IAM access key ID used as the SMTP username (smtp transport)").option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await sendEmailCommand({
+			to: options.to,
+			from: options.from,
+			subject: options.subject,
+			body: options.body,
+			transport: options.transport,
+			region: options.region,
+			profile: options.profile,
+			accessKeyId: options.accessKeyId,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+}
+//#endregion
+export { ACL_GROUPS, ADMIN_GROUP_NAME, CUSTOM_POLICIES, DEFAULT_REGION, DEFAULT_ROAMING_NAME, DEFAULT_TTL, RECORD_TYPES, SSH_PORT, addRecordCommand, addRecordOptionsSchema, allowIpCommand, allowIpOptionsSchema, attach, authorizeRule, bareHostedZoneId, breakGlassCommand, breakGlassOptionsSchema, buildUsername, checkAdminCommand, checkAdminOptionsSchema, createCliAccessKey, createUsersInteractive, defaultBody, deleteResourceRecordSet, describeSecurityGroups, detach, ensureAclGroupsExist, ensureGroup, ensureUser, ensureUserInGroup, extractRoamingFirstName, findCnameConflicts, findHostedZone, formatValues, getCurrentPublicIp, getRecordSetsAtName, getResourceRecordSet, getSecurityGroupDetails, hostedZoneLabel, inferAccountName, instanceLabel, isValidSlug, listEnabledRegions, listHostedZones, listInstances, listSshIngressRules, normalizeIdentifier, normalizeRecordValue, normalizeSlug, parseMdUsername, planRecordChange, printFinalState, printSshRules, publishPolicy, registerAwsCommands, removeAdminCommand, removeAdminOptionsSchema, removeRecordCommand, removeRecordOptionsSchema, resolveHostedZone, resolveName, resolveRecordName, resolveRecordType, resolveRoamingRule, revokeRule, roamingRuleDescription, roleToGroup, ruleAlreadyAllowsIp, securityGroupLabel, sendEmailCommand, sendEmailOptionsSchema, sendViaApi, sendViaSmtp, setupAclCommand, setupAclOptionsSchema, sshRuleLabel, upsertResourceRecordSet, usersCommand, usersOptionsSchema, withTrailingDot, withoutTrailingDot };

package/esm/commands/aws/route53/add-record/handler.js

@@ -1,18 +1,258 @@
-import {
-  addRecordCommand,
-  resolveHostedZone,
-  resolveName,
-  resolveRecordType
-} from "../../../../__chunks/G4NJHFFU.js";
-import "../../../../__chunks/33UYMUQD.js";
-import "../../../../__chunks/IEOGAQYI.js";
-import "../../../../__chunks/FNXUONAV.js";
-import "../../../../__chunks/5GIUAFXL.js";
-import "../../../../__chunks/73BJG53F.js";
-import "../../../../__chunks/ZHKVJO2U.js";
-export {
-  addRecordCommand,
-  resolveHostedZone,
-  resolveName,
-  resolveRecordType
-};
+import { prompt, promptChoice, promptYesNo } from "../../utils/tty.js";
+import { AwsCliError, getCallerIdentity, requireCommands } from "../../utils/exec-aws.js";
+import { resolveProfile } from "../../utils/resolve-profile.js";
+import { RECORD_TYPES, addRecordOptionsSchema } from "./schema.js";
+import { findCnameConflicts, findHostedZone, formatValues, getRecordSetsAtName, hostedZoneLabel, listHostedZones, normalizeRecordValue, planRecordChange, resolveRecordName, upsertResourceRecordSet, withoutTrailingDot } from "./utils.js";
+import chalk from "chalk";
+import { ZodError } from "zod";
+//#region src/commands/aws/route53/add-record/handler.js
+/**
+* Resolve the hosted zone: from --zone, or interactive picker.
+* @param {{
+*   profile?: string;
+*   zoneOption?: string;
+*   verbose: boolean;
+* }} params
+* @returns {Promise<import("./utils.js").HostedZone>}
+*/
+async function resolveHostedZone(params) {
+	const { profile, zoneOption, verbose } = params;
+	const zones = listHostedZones({
+		profile,
+		verbose
+	});
+	if (zones.length === 0) throw new Error("No Route53 hosted zones found for this profile.");
+	if (zoneOption) {
+		const match = findHostedZone({
+			zones,
+			zoneInput: zoneOption
+		});
+		if (!match) throw new Error(`No hosted zone matching "${zoneOption}". Available: ${zones.map((z) => withoutTrailingDot(z.name)).join(", ")}`);
+		return match;
+	}
+	const chosen = zones[await promptChoice({
+		message: "Choose a hosted zone:",
+		options: zones.map((zone) => hostedZoneLabel(zone))
+	})];
+	if (!chosen) throw new Error("No hosted zone selected");
+	return chosen;
+}
+/**
+* Resolve record type from --type or interactive picker.
+* @param {string | undefined} typeOption
+* @returns {Promise<string>}
+*/
+async function resolveRecordType(typeOption) {
+	if (typeOption) return typeOption.toUpperCase();
+	const index = await promptChoice({
+		message: "Choose a record type:",
+		options: RECORD_TYPES
+	});
+	const chosen = RECORD_TYPES[index];
+	if (!chosen) throw new Error("No record type selected");
+	return chosen;
+}
+/**
+* Resolve record name from --name or prompt.
+* @param {{ nameOption?: string; zoneName: string }} params
+* @returns {Promise<string>} FQDN with trailing dot
+*/
+async function resolveName(params) {
+	const { nameOption, zoneName } = params;
+	let input = nameOption;
+	if (!input) input = await prompt(`Record name (relative to ${withoutTrailingDot(zoneName)}, or FQDN; @ for apex): `);
+	if (!input) throw new Error("Record name is required");
+	return resolveRecordName({
+		nameInput: input,
+		zoneName
+	});
+}
+/**
+* Resolve record value from --value or prompt.
+* @param {{ valueOption?: string; type: string }} params
+* @returns {Promise<string>}
+*/
+async function resolveValue(params) {
+	const { valueOption, type } = params;
+	let input = valueOption;
+	if (!input) input = await prompt(`Record value${type === "CNAME" ? " (e.g. target.example.com.)" : type === "TXT" ? " (quotes added if omitted)" : ""}: `);
+	if (!input) throw new Error("Record value is required");
+	return normalizeRecordValue({
+		type,
+		value: input
+	});
+}
+/**
+* When an existing multi-value set is present, ask replace vs append
+* (single-value types default to replace).
+* @param {{
+*   existing: import("./utils.js").ResourceRecordSet;
+*   type: string;
+* }} params
+* @returns {Promise<"replace" | "append">}
+*/
+async function resolveChangeMode(params) {
+	const { existing, type } = params;
+	if (type === "CNAME" || existing.values.length <= 1) return "replace";
+	console.log("");
+	console.log(chalk.yellow(`Existing ${type} record has ${existing.values.length} values:${formatValues(existing.values)}`));
+	return await promptYesNo({
+		message: "Add to the existing values instead of replacing them?",
+		defaultYes: false
+	}) ? "append" : "replace";
+}
+/**
+* `aws route53 add-record` handler: interactively (or via flags) create or
+* update a Route53 resource record set, showing whether the change adds or
+* overwrites.
+* @param {unknown} options
+*/
+async function addRecordCommand(options) {
+	try {
+		const { profile: profileOption, zone: zoneOption, type: typeOption, name: nameOption, value: valueOption, ttl: ttlOption, yes, dryRun, verbose } = addRecordOptionsSchema.parse(options);
+		const profile = await resolveProfile({ profile: profileOption });
+		if (!profile) {
+			console.error(chalk.red("Error: pass --profile or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		requireCommands(["aws"]);
+		const identity = getCallerIdentity({
+			profile,
+			verbose
+		});
+		console.log("Caller:");
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		const zone = await resolveHostedZone({
+			profile,
+			zoneOption,
+			verbose
+		});
+		console.log(`Hosted zone: ${hostedZoneLabel(zone)}`);
+		console.log("");
+		const type = await resolveRecordType(typeOption);
+		const name = await resolveName({
+			nameOption,
+			zoneName: zone.name
+		});
+		const value = await resolveValue({
+			valueOption,
+			type
+		});
+		const ttl = ttlOption ?? 300;
+		console.log("");
+		console.log("Proposed record:");
+		console.log(`  Name:  ${withoutTrailingDot(name)}`);
+		console.log(`  Type:  ${type}`);
+		console.log(`  TTL:   ${ttl}`);
+		console.log(`  Value: ${value}`);
+		console.log("");
+		const existingSets = getRecordSetsAtName({
+			profile,
+			hostedZoneId: zone.id,
+			name,
+			verbose
+		});
+		const existing = existingSets.find((set) => set.type === type) ?? null;
+		const conflicts = findCnameConflicts({
+			existingSets,
+			type
+		});
+		if (conflicts.length > 0) {
+			console.error(chalk.red(`❌ Conflict: cannot add a ${type} record at ${withoutTrailingDot(name)}.`));
+			console.error("");
+			console.error(chalk.yellow("Route53 does not allow a CNAME and any other record type to coexist at the same name. Conflicting record(s) already exist:"));
+			for (const conflict of conflicts) console.error(`  ${conflict.type}  ${withoutTrailingDot(conflict.name)}${formatValues(conflict.isAlias ? ["(alias)"] : conflict.values)}`);
+			console.error("");
+			console.error(chalk.yellow("Remove the conflicting record, then re-create the one you wanted:"));
+			const zoneName = withoutTrailingDot(zone.name);
+			const displayName = withoutTrailingDot(name);
+			const quotedValue = /^[A-Za-z0-9._:@/-]+$/.test(value) ? value : `"${value}"`;
+			const ttlFlag = ttl === 300 ? "" : ` --ttl ${ttl}`;
+			let step = 1;
+			for (const conflict of conflicts) console.error(chalk.cyan(`  ${step++}. mtn aws route53 remove-record -z ${zoneName} -t ${conflict.type} -n ${displayName}`));
+			console.error(chalk.cyan(`  ${step}. mtn aws route53 add-record -z ${zoneName} -t ${type} -n ${displayName} --value ${quotedValue}${ttlFlag}`));
+			process.exit(1);
+		}
+		if (existing?.isAlias) {
+			console.log(chalk.yellow("An ALIAS record already exists at this name + type. Continuing will replace it with a standard record set."));
+			console.log("");
+		} else if (existing) {
+			console.log(chalk.yellow(`Existing ${type} record at ${withoutTrailingDot(name)}:${formatValues(existing.values)}`));
+			if (existing.ttl !== void 0) console.log(`  TTL: ${existing.ttl}`);
+			console.log("");
+		} else {
+			console.log(chalk.green(`No existing ${type} record at ${withoutTrailingDot(name)}.`));
+			console.log("");
+		}
+		/** @type {"replace" | "append"} */
+		let mode = "replace";
+		if (existing && !existing.isAlias && existing.values.length > 0) mode = await resolveChangeMode({
+			existing,
+			type
+		});
+		const plan = planRecordChange({
+			existing,
+			newValue: value,
+			mode
+		});
+		console.log(plan.summary);
+		console.log("");
+		if (plan.action === "noop") return;
+		if (plan.action === "overwrite" || plan.action === "append") {
+			console.log("Final values that will be written:");
+			for (const finalValue of plan.finalValues) console.log(`  - ${finalValue}`);
+			console.log("");
+		}
+		if (dryRun) {
+			console.log(chalk.cyan("Dry run — no changes made."));
+			return;
+		}
+		if (!yes) {
+			if (!await promptYesNo({
+				message: plan.action === "create" ? "Create this record?" : plan.action === "append" ? "Add this value to the existing record?" : "Overwrite the existing record?",
+				defaultYes: false
+			})) {
+				console.log("Aborted.");
+				return;
+			}
+		}
+		const changeInfo = upsertResourceRecordSet({
+			profile,
+			hostedZoneId: zone.id,
+			name,
+			type,
+			ttl: existing?.ttl ?? ttl,
+			values: plan.finalValues,
+			verbose
+		});
+		console.log("");
+		console.log(chalk.green(`Done. ${plan.action === "create" ? "Created" : plan.action === "append" ? "Updated (appended)" : "Updated (overwrote)"} ${type} ${withoutTrailingDot(name)}.`));
+		if (changeInfo?.Id) {
+			console.log(`  Change ID: ${changeInfo.Id}`);
+			console.log(`  Status:    ${changeInfo.Status ?? "PENDING"}`);
+		}
+	} catch (error) {
+		if (error instanceof ZodError) {
+			console.error(chalk.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.red("\n❌ add-record failed:"));
+		if (error instanceof AwsCliError || error instanceof Error) {
+			console.error(chalk.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.gray("\nStack trace:"));
+				console.error(chalk.gray(error.stack));
+			}
+		} else console.error(chalk.red(`   ${String(error)}`));
+		console.error(chalk.yellow("\n💡 Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+export { addRecordCommand, resolveHostedZone, resolveName, resolveRecordType };