@prism-d1/cli 1.0.95 → 1.0.96

package/dist/src/utils/aws.d.ts

@@ -5,6 +5,23 @@
  * exposed to shell interpretation even though callers pass a user-supplied
  * --profile and --region.
  */
+/**
+ * Where an AWS call should be made: a named CLI profile, or temporary
+ * credentials from an assumed role.
+ *
+ * Both are carried in one object so every check function is agnostic about how
+ * the caller authenticated. `scan-account` supplies a profile; `scan-org`
+ * supplies assumed-role credentials per member account. Credentials travel in
+ * the child process environment rather than being written to `~/.aws/config`,
+ * so nothing is persisted and the assumed role cannot leak into a later call.
+ */
+export interface AwsTarget {
+    /** AWS CLI profile name. */
+    profile?: string;
+    /** Temporary credentials injected into the child environment. A key mapped
+     *  to undefined is removed from it. */
+    env?: Record<string, string | undefined>;
+}
 export interface AwsResult {
     ok: boolean;
     json: any;
@@ -21,7 +38,21 @@ export interface AwsResult {
  * precisely the accounts that most need auditing. Empty output is normalised to
  * {} here and interpreted by each individual check.
  */
-export declare function aws(args: string[], profile?: string): AwsResult;
+export declare function aws(args: string[], target?: AwsTarget): AwsResult;
+/**
+ * Assume a role and return credentials as an env fragment, or an error string.
+ *
+ * Deliberately returns the failure rather than throwing: at org scale a role
+ * that cannot be assumed is an expected condition (an account onboarded without
+ * the role, an SCP denying it), and the caller must surface that account as
+ * INDETERMINATE rather than dropping it. A silently skipped account is exactly
+ * how an org audit ends up reporting on a subset while looking complete.
+ */
+export declare function assumeRole(accountId: string, roleName: string, sessionName: string, durationSeconds: number, from?: AwsTarget, region?: string): {
+    env: Record<string, string | undefined>;
+} | {
+    error: string;
+};
 /**
  * Resolve the caller's account id, or print guidance and return null.
  *
@@ -29,7 +60,7 @@ export declare function aws(args: string[], profile?: string): AwsResult;
  * --profile fails in the CLI's own config layer and never reaches the service,
  * so fall back to its stderr rather than reporting "unknown error".
  */
-export declare function resolveAccount(profile?: string): string | null;
+export declare function resolveAccount(target?: AwsTarget): string | null;
 export declare function daysSince(iso: string): number | null;
 export declare const PROFILE_OPTION: {
     flags: string;

package/dist/src/utils/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAe/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS9D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,eAAO,MAAM,cAAc;;;CAG1B,CAAC"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;2CACuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAejE;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,IAAI,CAAC,EAAE,SAAS,EAChB,MAAM,CAAC,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiCjE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAShE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,eAAO,MAAM,cAAc;;;CAG1B,CAAC"}

package/dist/src/utils/aws.js

@@ -14,9 +14,9 @@ import { run } from './exec.js';
  * precisely the accounts that most need auditing. Empty output is normalised to
  * {} here and interpreted by each individual check.
  */
-export function aws(args, profile) {
-    const argv = profile ? [...args, '--profile', profile] : args;
-    const res = run('aws', [...argv, '--output', 'json']);
+export function aws(args, target) {
+    const argv = target?.profile ? [...args, '--profile', target.profile] : args;
+    const res = run('aws', [...argv, '--output', 'json'], target?.env);
     const body = (res.stdout || '').trim();
     if (!res.ok) {
         const m = /An error occurred \(([A-Za-z0-9.]+)\)/.exec(res.stderr || '');
@@ -31,6 +31,48 @@ export function aws(args, profile) {
         return { ok: false, json: null, errorCode: 'UnparseableResponse', raw: body };
     }
 }
+/**
+ * Assume a role and return credentials as an env fragment, or an error string.
+ *
+ * Deliberately returns the failure rather than throwing: at org scale a role
+ * that cannot be assumed is an expected condition (an account onboarded without
+ * the role, an SCP denying it), and the caller must surface that account as
+ * INDETERMINATE rather than dropping it. A silently skipped account is exactly
+ * how an org audit ends up reporting on a subset while looking complete.
+ */
+export function assumeRole(accountId, roleName, sessionName, durationSeconds, from, region) {
+    const res = aws([
+        'sts', 'assume-role',
+        '--role-arn', `arn:aws:iam::${accountId}:role/${roleName}`,
+        '--role-session-name', sessionName,
+        '--duration-seconds', String(durationSeconds),
+    ], from);
+    if (!res.ok) {
+        const reason = res.errorCode
+            || (res.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() ?? 'unknown error');
+        return { error: reason };
+    }
+    const c = res.json?.Credentials;
+    if (!c?.AccessKeyId || !c?.SecretAccessKey || !c?.SessionToken) {
+        return { error: 'assume-role returned no usable credentials' };
+    }
+    return {
+        env: {
+            AWS_ACCESS_KEY_ID: c.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: c.SecretAccessKey,
+            AWS_SESSION_TOKEN: c.SessionToken,
+            // REMOVED, not blanked. A profile left in the ambient environment takes
+            // precedence over the injected keys and would silently audit the WRONG
+            // account -- the worst failure available here, since every finding would
+            // be misattributed. Blanking instead of removing breaks the CLI outright.
+            AWS_PROFILE: undefined,
+            AWS_DEFAULT_PROFILE: undefined,
+            // The unset profile also took its region with it, so pin one explicitly
+            // rather than depending on whatever the CLI can still resolve.
+            ...(region ? { AWS_REGION: region, AWS_DEFAULT_REGION: region } : {}),
+        },
+    };
+}
 /**
  * Resolve the caller's account id, or print guidance and return null.
  *
@@ -38,8 +80,8 @@ export function aws(args, profile) {
  * --profile fails in the CLI's own config layer and never reaches the service,
  * so fall back to its stderr rather than reporting "unknown error".
  */
-export function resolveAccount(profile) {
-    const who = aws(['sts', 'get-caller-identity'], profile);
+export function resolveAccount(target) {
+    const who = aws(['sts', 'get-caller-identity'], target);
     if (who.ok)
         return who.json?.Account ?? null;
     const reason = who.errorCode

package/dist/src/utils/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAWhC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;WACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,gEAAgE;CAC9E,CAAC"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA6BhC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,MAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,QAAgB,EAChB,WAAmB,EACnB,eAAuB,EACvB,IAAgB,EAChB,MAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC;QACd,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,gBAAgB,SAAS,SAAS,QAAQ,EAAE;QAC1D,qBAAqB,EAAE,WAAW;QAClC,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;KAC9C,EAAE,IAAI,CAAC,CAAC;IAET,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;eACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;QACzF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;IAChC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,EAAE,eAAe,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,OAAO;QACL,GAAG,EAAE;YACH,iBAAiB,EAAE,CAAC,CAAC,WAAW;YAChC,qBAAqB,EAAE,CAAC,CAAC,eAAe;YACxC,iBAAiB,EAAE,CAAC,CAAC,YAAY;YACjC,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,0EAA0E;YAC1E,WAAW,EAAE,SAAS;YACtB,mBAAmB,EAAE,SAAS;YAC9B,wEAAwE;YACxE,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;WACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,gEAAgE;CAC9E,CAAC"}

package/dist/src/utils/exec.d.ts

@@ -42,10 +42,21 @@ export interface RunResult {
  * latter would arrive as a single argument and the command would fail, which
  * is a loud failure rather than a silent injection.
  *
+ * `extraEnv` is merged over the inherited environment. It exists so a caller
+ * can hand a child process temporary STS credentials without writing them to
+ * disk or mutating this process's own environment -- the latter would leak the
+ * assumed role into every later call in the same run.
+ *
+ * A key mapped to `undefined` is REMOVED rather than set. Blanking is not
+ * equivalent: `AWS_PROFILE=''` makes the AWS CLI look for a profile literally
+ * named `()` and fail with "The config profile () could not be found", so
+ * injected credentials are ignored and every call errors. Measured, not
+ * theoretical.
+ *
  * Never throws: a non-zero exit, a missing binary, and a signal kill all come
  * back as `ok: false`. Callers branch on `ok` and surface `stderr`.
  */
-export declare function run(file: string, args: string[]): RunResult;
+export declare function run(file: string, args: string[], extraEnv?: Record<string, string | undefined>): RunResult;
 /**
  * Like run(), but inherits stdio so the child can drive the terminal.
  *

package/dist/src/utils/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAW3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAOpE"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAmB1G;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAOpE"}

package/dist/src/utils/exec.js

@@ -38,15 +38,36 @@ import { execFileSync } from 'node:child_process';
  * latter would arrive as a single argument and the command would fail, which
  * is a loud failure rather than a silent injection.
  *
+ * `extraEnv` is merged over the inherited environment. It exists so a caller
+ * can hand a child process temporary STS credentials without writing them to
+ * disk or mutating this process's own environment -- the latter would leak the
+ * assumed role into every later call in the same run.
+ *
+ * A key mapped to `undefined` is REMOVED rather than set. Blanking is not
+ * equivalent: `AWS_PROFILE=''` makes the AWS CLI look for a profile literally
+ * named `()` and fail with "The config profile () could not be found", so
+ * injected credentials are ignored and every call errors. Measured, not
+ * theoretical.
+ *
  * Never throws: a non-zero exit, a missing binary, and a signal kill all come
  * back as `ok: false`. Callers branch on `ok` and surface `stderr`.
  */
-export function run(file, args) {
+export function run(file, args, extraEnv) {
+    let env = process.env;
+    if (extraEnv) {
+        env = { ...process.env };
+        for (const [k, v] of Object.entries(extraEnv)) {
+            if (v === undefined)
+                delete env[k];
+            else
+                env[k] = v;
+        }
+    }
     try {
         const stdout = execFileSync(file, args, {
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
-            env: process.env,
+            env,
         }).trim();
         return { ok: true, stdout, stderr: '' };
     }

package/dist/src/utils/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAc;IACzD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,QAA6C;IAC7F,IAAI,GAAG,GAAsB,OAAO,CAAC,GAAG,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAc;IACzD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.95",
+  "version": "1.0.96",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {