@prism-d1/cli 1.0.95 → 1.0.97

package/dist/src/utils/audit-org.js

@@ -0,0 +1,311 @@
+import { aws } from './aws.js';
+function asArray(v) {
+    if (!v)
+        return [];
+    return Array.isArray(v) ? v : [v];
+}
+/**
+ * IAM action glob matching. `bedrock:*` covers
+ * `bedrock:CreateProvisionedModelThroughput`; a bare `*` covers everything.
+ * Without this, a broad deny would read as no coverage at all.
+ */
+function actionMatches(pattern, action) {
+    if (pattern === '*')
+        return true;
+    const rx = new RegExp('^' + pattern.split('*').map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*') + '$', 'i');
+    return rx.test(action);
+}
+function parseStatements(content) {
+    try {
+        const doc = JSON.parse(content);
+        const st = doc?.Statement;
+        if (!st)
+            return [];
+        return Array.isArray(st) ? st : [st];
+    }
+    catch {
+        return [];
+    }
+}
+/** Names of policies containing a Deny that covers any of `actions`. */
+export function policiesDenying(policies, actions) {
+    return policies.filter((p) => p.statements.some((s) => {
+        if (s.Effect !== 'Deny')
+            return false;
+        const pats = asArray(s.Action);
+        return actions.some((a) => pats.some((pat) => actionMatches(pat, a)));
+    })).map((p) => p.name);
+}
+/**
+ * Names of policies whose Deny is region-conditioned in a way that would
+ * constrain Bedrock.
+ *
+ * The common shape is a broad `Deny *` with
+ * `StringNotEquals: { "aws:RequestedRegion": [...] }` -- everything outside the
+ * listed regions is refused. A Bedrock-specific variant denies `bedrock:*` under
+ * the same condition. Both count; a region condition that cannot reach Bedrock
+ * (e.g. `Action: s3:*`) does not.
+ */
+export function policiesRestrictingBedrockRegion(policies) {
+    return policies.filter((p) => p.statements.some((s) => {
+        if (s.Effect !== 'Deny')
+            return false;
+        const cond = s.Condition ?? {};
+        const mentionsRegion = Object.values(cond).some((kv) => Object.keys(kv).some((k) => k.toLowerCase() === 'aws:requestedregion'));
+        if (!mentionsRegion)
+            return false;
+        const pats = asArray(s.Action);
+        // Must be able to reach a Bedrock call to be relevant here.
+        return pats.some((pat) => actionMatches(pat, 'bedrock:InvokeModel'));
+    })).map((p) => p.name);
+}
+const ENFORCEMENT_CAVEAT = 'Detected structurally, not proven: inheritance, NotAction and principal-tag exemptions can neutralise a policy that reads correctly. Confirm with a live call from a representative role.';
+/**
+ * Expand each audited target to itself plus every ancestor up to the root.
+ *
+ * SCPs INHERIT downward: a policy attached to the root constrains every account
+ * in every OU beneath it. Judging attachment against the audited OU alone
+ * therefore ignores the most common place guardrails actually live, and would
+ * report a root-attached Bedrock region deny as absent -- a false FAIL on the
+ * highest-leverage control in this file. Verified against a live org where two
+ * of four customer SCPs sat at the root and were invisible to the OU-only view.
+ */
+export function expandToAncestors(target, scopeTargetIds) {
+    const ids = new Set(scopeTargetIds);
+    const errors = [];
+    for (const start of scopeTargetIds) {
+        let child = start;
+        // Bounded rather than while(true): OU nesting is capped at 5 levels, and a
+        // cycle here would otherwise hang the audit.
+        for (let depth = 0; depth < 10; depth++) {
+            if (/^r-/.test(child))
+                break;
+            const parents = aws(['organizations', 'list-parents', '--child-id', child], target);
+            if (!parents.ok) {
+                errors.push(`${child}: could not resolve parents (${parents.errorCode || 'unknown error'}), so inherited SCPs may be missed`);
+                break;
+            }
+            const p = (parents.json?.Parents ?? [])[0];
+            if (!p?.Id)
+                break;
+            ids.add(p.Id);
+            child = p.Id;
+        }
+    }
+    return { ids: [...ids], errors };
+}
+/**
+ * Managed Config rule identifiers that continuously assert what the IAM checks
+ * in this audit only sample. Keyed by the check they correspond to, so the
+ * output can name the gap in terms the reader already recognises.
+ */
+const IAM_CONFIG_RULES = [
+    ['ACCESS_KEYS_ROTATED', 'access-key-age'],
+    ['IAM_USER_UNUSED_CREDENTIALS_CHECK', 'unused-credentials'],
+    ['ROOT_ACCOUNT_MFA_ENABLED', 'root-mfa'],
+    ['MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS', 'console-user-no-mfa'],
+    ['IAM_PASSWORD_POLICY', 'password-policy'],
+    ['IAM_USER_NO_POLICIES_CHECK', 'user-admin-policy'],
+];
+/** The four SCP checks whose verdict depends on knowing the audited scope. */
+const SCOPE_DEPENDENT_SCP_CHECKS = [
+    ['scp-attached', 'SCPs attached to the audited scope', 'HIGH'],
+    ['scp-detection-tamper', 'SCP preventing tampering with detection', 'HIGH'],
+    ['scp-bedrock-region', 'SCP restricting which regions Bedrock can be used in', 'MEDIUM'],
+    ['scp-bedrock-provisioned-throughput', 'SCP denying Provisioned Throughput creation', 'MEDIUM'],
+];
+function scopeDependentIndeterminate(detail, remediation) {
+    return SCOPE_DEPENDENT_SCP_CHECKS.map(([id, title, severity]) => ({
+        id, category: 'preventive', title,
+        status: 'INDETERMINATE', severity,
+        detail, remediation,
+    }));
+}
+/**
+ * @param scopeTargetIds Root and OU ids in scope, so attachment is judged
+ *        against what is actually being audited rather than the org at large.
+ *        `null` means the caller could not resolve the scope -- every
+ *        attachment-dependent check is then INDETERMINATE, because an empty
+ *        scope would otherwise make all four FAIL and present a permissions
+ *        problem as four real absences.
+ */
+export function auditServiceControlPolicies(target, scopeTargetIds, scopeError) {
+    const out = [];
+    // SCPs must be enabled on the root before any can take effect. This gates the
+    // rest, the same way Cost Explorer gates the anomaly check.
+    const roots = aws(['organizations', 'list-roots'], target);
+    if (!roots.ok) {
+        const why = `Could not read organization roots (${roots.errorCode || 'unknown error'}).`;
+        const fix = 'Grant organizations:ListRoots and re-run.';
+        // Emit EVERY SCP check, not just this one. Returning a single finding here
+        // would silently shrink the check count, so a reader comparing runs would
+        // see four checks disappear rather than four checks it could not answer.
+        return [
+            {
+                id: 'scp-enabled', category: 'preventive', title: 'Service Control Policies enabled',
+                status: 'INDETERMINATE', severity: 'HIGH', detail: why, remediation: fix,
+            },
+            ...scopeDependentIndeterminate(why, fix),
+        ];
+    }
+    const rootList = roots.json?.Roots ?? [];
+    const scpEnabled = rootList.some((r) => (r.PolicyTypes ?? [])
+        .some((p) => p.Type === 'SERVICE_CONTROL_POLICY' && p.Status === 'ENABLED'));
+    out.push({
+        id: 'scp-enabled', category: 'preventive', title: 'Service Control Policies enabled',
+        status: scpEnabled ? 'PASS' : 'FAIL', severity: 'HIGH',
+        detail: scpEnabled
+            ? 'SERVICE_CONTROL_POLICY is enabled on the organization root.'
+            : 'SERVICE_CONTROL_POLICY is not enabled, so no preventive guardrail can exist at any level. Every control in this organization is therefore detective — it can tell you a stolen key was used, never refuse the call.',
+        remediation: scpEnabled ? undefined : 'Enable the SERVICE_CONTROL_POLICY type on the root (Organizations → Policies). Enabling it alone changes nothing: FullAWSAccess stays attached and no action is newly denied.',
+    });
+    if (!scpEnabled) {
+        out.push(...scopeDependentIndeterminate('Cannot be evaluated while Service Control Policies are disabled.'));
+        return out;
+    }
+    // Scope unknown: an empty target list would make all four attachment-dependent
+    // checks FAIL, dressing a permissions problem up as four real absences.
+    if (scopeTargetIds === null) {
+        out.push(...scopeDependentIndeterminate(`The audited scope could not be resolved${scopeError ? ` (${scopeError})` : ''}, so it is unknown which SCPs apply to it.`, 'Grant organizations:ListRoots and re-run.'));
+        return out;
+    }
+    // Include every ancestor: SCPs attached above the audited OU still apply to it.
+    const { ids: effectiveTargets, errors: ancestorErrors } = expandToAncestors(target, scopeTargetIds);
+    const list = aws(['organizations', 'list-policies', '--filter', 'SERVICE_CONTROL_POLICY'], target);
+    if (!list.ok) {
+        out.push(...scopeDependentIndeterminate(`Could not list SCPs (${list.errorCode || 'unknown error'}).`, 'Grant organizations:ListPolicies, DescribePolicy and ListTargetsForPolicy, then re-run.'));
+        return out;
+    }
+    // FullAWSAccess is attached everywhere by default and allows everything, so it
+    // is never evidence of a guardrail. Excluding it keeps the attachment check
+    // from passing on AWS's own default.
+    const customer = (list.json?.Policies ?? []).filter((p) => p.AwsManaged !== true);
+    const policies = [];
+    let unreadable = 0;
+    for (const p of customer) {
+        const desc = aws(['organizations', 'describe-policy', '--policy-id', p.Id], target);
+        const targets = aws(['organizations', 'list-targets-for-policy', '--policy-id', p.Id], target);
+        if (!desc.ok || !targets.ok) {
+            unreadable++;
+            continue;
+        }
+        policies.push({
+            name: p.Name ?? p.Id,
+            id: p.Id,
+            statements: parseStatements(desc.json?.Policy?.Content ?? ''),
+            targets: (targets.json?.Targets ?? []).map((t) => t.TargetId),
+        });
+    }
+    // An SCP attached nowhere in the audited scope constrains nothing there --
+    // the same shape as a budget with no subscriber, and just as easy to mistake
+    // for protection.
+    const inScope = policies.filter((p) => p.targets.some((t) => effectiveTargets.includes(t)));
+    out.push({
+        id: 'scp-attached', category: 'preventive', title: 'SCPs attached to the audited scope',
+        status: inScope.length ? 'PASS' : 'FAIL', severity: 'HIGH',
+        detail: inScope.length
+            ? `${inScope.length} customer-managed SCP(s) apply to the audited scope (including inheritance from ${effectiveTargets.length - scopeTargetIds.length} ancestor target(s)): ${inScope.map((p) => p.name).join(', ')}.`
+            : customer.length === 0
+                ? 'No customer-managed SCPs exist. Only AWS\'s default FullAWSAccess is attached, which allows everything.'
+                : `${customer.length} customer-managed SCP(s) exist but none is attached to the audited target(s) or any ancestor, so none constrains the accounts in scope.`,
+        remediation: inScope.length ? undefined : 'Attach the relevant SCP to the root or the OUs being audited. An unattached policy is inert.',
+    });
+    // Region restriction: the highest-leverage preventive control for LLMjacking.
+    const regionScoped = policiesRestrictingBedrockRegion(inScope);
+    out.push({
+        id: 'scp-bedrock-region', category: 'preventive', title: 'SCP restricting which regions Bedrock can be used in',
+        status: regionScoped.length ? 'PASS' : 'FAIL', severity: 'MEDIUM',
+        detail: regionScoped.length
+            ? `${regionScoped.join(', ')} denies Bedrock-reaching actions outside an allowed region set. ${ENFORCEMENT_CAVEAT}`
+            : 'No in-scope SCP constrains Bedrock by region. A stolen credential can call InvokeModel in every enabled region, so spend is not bounded by the regions you actually operate in — and per-region CloudWatch alarms and Provisioned Throughput checks all miss activity elsewhere.',
+        remediation: regionScoped.length ? undefined : 'Add a Deny on `*` (or `bedrock:*`) with StringNotEquals on aws:RequestedRegion listing only the regions you use. This is the cheapest large reduction in blast radius available, and it costs nothing to run.',
+    });
+    const ptDenied = policiesDenying(inScope, ['bedrock:CreateProvisionedModelThroughput']);
+    out.push({
+        id: 'scp-bedrock-provisioned-throughput', category: 'preventive', title: 'SCP denying Provisioned Throughput creation',
+        status: ptDenied.length ? 'PASS' : 'FAIL', severity: 'MEDIUM',
+        detail: ptDenied.length
+            ? `${ptDenied.join(', ')} denies bedrock:CreateProvisionedModelThroughput. ${ENFORCEMENT_CAVEAT}`
+            : 'No in-scope SCP denies bedrock:CreateProvisionedModelThroughput. It is the largest single commitment available in Bedrock — billed monthly whether used or not — and one API call creates it.',
+        remediation: ptDenied.length ? undefined : 'Deny bedrock:CreateProvisionedModelThroughput org-wide and exempt only the accounts that genuinely need it. Most organizations need it nowhere.',
+    });
+    // Protecting the detection layer the rest of this audit depends on.
+    const tamperActions = ['cloudtrail:StopLogging', 'config:DeleteConfigRule', 'guardduty:DeleteDetector'];
+    const tamperDenied = policiesDenying(inScope, tamperActions);
+    out.push({
+        id: 'scp-detection-tamper', category: 'preventive', title: 'SCP preventing tampering with detection',
+        status: tamperDenied.length ? 'PASS' : 'FAIL', severity: 'HIGH',
+        detail: tamperDenied.length
+            ? `${tamperDenied.join(', ')} denies at least one of CloudTrail/Config/GuardDuty teardown. ${ENFORCEMENT_CAVEAT}`
+            : 'No in-scope SCP prevents stopping CloudTrail, deleting Config rules or disabling GuardDuty. An attacker who reaches an admin credential can therefore remove the evidence trail before running up spend, which defeats every detective control this audit recommends.',
+        remediation: tamperDenied.length ? undefined : 'Deny cloudtrail:StopLogging/DeleteTrail, config:Delete*, guardduty:DeleteDetector org-wide. Nothing legitimate needs them from a member account.',
+    });
+    for (const e of ancestorErrors) {
+        out.push({
+            id: 'scp-inheritance-resolved', category: 'preventive', title: 'SCP inheritance fully resolved',
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: e,
+            remediation: 'Grant organizations:ListParents and re-run; without it an inherited guardrail can read as absent.',
+        });
+    }
+    if (unreadable > 0) {
+        out.push({
+            id: 'scp-readable', category: 'preventive', title: 'All SCPs readable',
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: `${unreadable} of ${customer.length} customer-managed SCP(s) could not be read, so the SCP findings above are based on a partial view.`,
+            remediation: 'Grant organizations:DescribePolicy and ListTargetsForPolicy, then re-run.',
+        });
+    }
+    return out;
+}
+export function auditConfigRules(target) {
+    const rules = aws(['configservice', 'describe-organization-config-rules'], target);
+    if (!rules.ok) {
+        // Config not being enabled for the org is a legitimate state, and distinct
+        // from a permissions problem. Both are reported, neither as a pass.
+        const notEnabled = /OrganizationAccessDenied|NoAvailableOrganization|AccessDenied/i.test(rules.errorCode || rules.raw);
+        return [{
+                id: 'config-org-rules', category: 'detective', title: 'Organization Config rules deployed',
+                status: 'INDETERMINATE', severity: 'MEDIUM',
+                detail: notEnabled
+                    ? `Could not read organization Config rules (${rules.errorCode || 'access denied'}). Either AWS Config is not enabled for the organization, or trusted access / delegated administration is not configured.`
+                    : `Could not read organization Config rules (${rules.errorCode || 'unknown error'}).`,
+                remediation: 'Enable trusted access for config.amazonaws.com in Organizations, or grant config:DescribeOrganizationConfigRules, then re-run.',
+            }, {
+                id: 'config-iam-coverage', category: 'detective', title: 'Continuous coverage of the IAM hygiene checks',
+                status: 'INDETERMINATE', severity: 'MEDIUM',
+                detail: 'Cannot be evaluated without the organization Config rule list.',
+            }];
+    }
+    const list = rules.json?.OrganizationConfigRules ?? [];
+    const out = [];
+    out.push({
+        id: 'config-org-rules', category: 'detective', title: 'Organization Config rules deployed',
+        status: list.length ? 'PASS' : 'FAIL', severity: 'MEDIUM',
+        detail: list.length
+            ? `${list.length} organization Config rule(s) deployed.`
+            : 'No organization Config rules. This audit is a point-in-time sample; without continuous rules, a key created the day after a run goes unnoticed until the next one.',
+        remediation: list.length ? undefined : 'Deploy an Organization Conformance Pack with the IAM managed rules. They evaluate on every configuration change rather than when someone remembers to audit.',
+    });
+    // Which of this audit's own IAM checks have a continuous equivalent deployed.
+    const deployed = new Set();
+    for (const r of list) {
+        const id = r?.OrganizationManagedRuleMetadata?.RuleIdentifier;
+        if (id)
+            deployed.add(String(id).toUpperCase());
+    }
+    const missing = IAM_CONFIG_RULES.filter(([ruleId]) => !deployed.has(ruleId));
+    const present = IAM_CONFIG_RULES.filter(([ruleId]) => deployed.has(ruleId));
+    out.push({
+        id: 'config-iam-coverage', category: 'detective', title: 'Continuous coverage of the IAM hygiene checks',
+        status: missing.length === 0 ? 'PASS' : list.length === 0 ? 'FAIL' : 'FAIL',
+        severity: 'MEDIUM',
+        detail: missing.length === 0
+            ? `All ${IAM_CONFIG_RULES.length} IAM hygiene checks have a continuously-evaluating Config rule: ${present.map(([r]) => r).join(', ')}.`
+            : `${missing.length} of ${IAM_CONFIG_RULES.length} IAM checks in this audit have no continuous equivalent. Sampled here but not monitored: ${missing.map(([, check]) => check).join(', ')}.${present.length ? ` Covered: ${present.map(([, check]) => check).join(', ')}.` : ''}`,
+        remediation: missing.length === 0 ? undefined
+            : `Deploy the matching managed rules org-wide: ${missing.map(([r]) => r).join(', ')}. Note the ordering pitfall — a Config rule evaluates nothing until the configuration recorder is running in the target accounts.`,
+    });
+    return out;
+}
+//# sourceMappingURL=audit-org.js.map

package/dist/src/utils/audit-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-org.js","sourceRoot":"","sources":["../../../src/utils/audit-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAa,MAAM,UAAU,CAAC;AA0C1C,SAAS,OAAO,CAAC,CAAgC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,MAAc;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3H,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,QAA0D,EAC1D,OAAiB;IAEjB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA0D;IAE1D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACrD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,4DAA4D;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,kBAAkB,GACtB,2LAA2L,CAAC;AAE9L;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA6B,EAC7B,cAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,2EAA2E;QAC3E,6CAA6C;QAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,OAAO,CAAC,SAAS,IAAI,eAAe,oCAAoC,CAAC,CAAC;gBAC9H,MAAM;YACR,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,EAAE,EAAE;gBAAE,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACd,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAA4B;IAChD,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;IACzC,CAAC,mCAAmC,EAAE,oBAAoB,CAAC;IAC3D,CAAC,0BAA0B,EAAE,UAAU,CAAC;IACxC,CAAC,oCAAoC,EAAE,qBAAqB,CAAC;IAC7D,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;IAC1C,CAAC,4BAA4B,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAEF,8EAA8E;AAC9E,MAAM,0BAA0B,GAAsC;IACpE,CAAC,cAAc,EAAE,oCAAoC,EAAE,MAAM,CAAC;IAC9D,CAAC,sBAAsB,EAAE,yCAAyC,EAAE,MAAM,CAAC;IAC3E,CAAC,oBAAoB,EAAE,sDAAsD,EAAE,QAAQ,CAAC;IACxF,CAAC,oCAAoC,EAAE,6CAA6C,EAAE,QAAQ,CAAC;CAChG,CAAC;AAEF,SAAS,2BAA2B,CAAC,MAAc,EAAE,WAAoB;IACvE,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK;QACjC,MAAM,EAAE,eAAwB,EAAE,QAAQ;QAC1C,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA6B,EAC7B,cAA+B,EAC/B,UAAmB;IAEnB,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,sCAAsC,KAAK,CAAC,SAAS,IAAI,eAAe,IAAI,CAAC;QACzF,MAAM,GAAG,GAAG,2CAA2C,CAAC;QACxD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO;YACL;gBACE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC;gBACpF,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG;aACzE;YACD,GAAG,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC;SACzC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAU,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC;IAEpF,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC;QACpF,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QACtD,MAAM,EAAE,UAAU;YAChB,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,qNAAqN;QACzN,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+KAA+K;KACtN,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAC7G,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,GAAG,2BAA2B,CACrC,0CAA0C,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,4CAA4C,EAC1H,2CAA2C,CAAC,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IAChF,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAEpG,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAAC;IACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,2BAA2B,CACrC,wBAAwB,IAAI,CAAC,SAAS,IAAI,eAAe,IAAI,EAC7D,yFAAyF,CAAC,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,qCAAqC;IACrC,MAAM,QAAQ,GAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAoF,EAAE,CAAC;IACrG,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,yBAAyB,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE;YACpB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,oCAAoC;QACvF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;YACpB,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,mFAAmF,gBAAgB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,yBAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACtN,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,yGAAyG;gBAC3G,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,yIAAyI;QACjK,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8FAA8F;KACzI,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,YAAY,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,sDAAsD;QAC/G,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QACjE,MAAM,EAAE,YAAY,CAAC,MAAM;YACzB,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE,kBAAkB,EAAE;YACnH,CAAC,CAAC,kRAAkR;QACtR,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+MAA+M;KAC/P,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACxF,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,oCAAoC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,6CAA6C;QACtH,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QAC7D,MAAM,EAAE,QAAQ,CAAC,MAAM;YACrB,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,kBAAkB,EAAE;YACjG,CAAC,CAAC,+LAA+L;QACnM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iJAAiJ;KAC7L,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,aAAa,GAAG,CAAC,wBAAwB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;IACxG,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,sBAAsB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,yCAAyC;QACpG,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QAC/D,MAAM,EAAE,YAAY,CAAC,MAAM;YACzB,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,kBAAkB,EAAE;YACjH,CAAC,CAAC,uQAAuQ;QAC3Q,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kJAAkJ;KAClM,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,gCAAgC;YAC/F,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,mGAAmG;SACjH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB;YACtE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,GAAG,UAAU,OAAO,QAAQ,CAAC,MAAM,oGAAoG;YAC/I,WAAW,EAAE,2EAA2E;SACzF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA6B;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEnF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,UAAU,GAAG,gEAAgE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACvH,OAAO,CAAC;gBACN,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,oCAAoC;gBAC1F,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;gBAC3C,MAAM,EAAE,UAAU;oBAChB,CAAC,CAAC,6CAA6C,KAAK,CAAC,SAAS,IAAI,eAAe,2HAA2H;oBAC5M,CAAC,CAAC,6CAA6C,KAAK,CAAC,SAAS,IAAI,eAAe,IAAI;gBACvF,WAAW,EAAE,gIAAgI;aAC9I,EAAE;gBACD,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,+CAA+C;gBACxG,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;gBAC3C,MAAM,EAAE,gEAAgE;aACzE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAU,KAAK,CAAC,IAAI,EAAE,uBAAuB,IAAI,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,oCAAoC;QAC1F,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,wCAAwC;YACxD,CAAC,CAAC,oKAAoK;QACxK,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8JAA8J;KACtM,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,EAAE,+BAA+B,EAAE,cAAc,CAAC;QAC9D,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5E,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,+CAA+C;QACxG,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3E,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,OAAO,gBAAgB,CAAC,MAAM,mEAAmE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACxI,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,gBAAgB,CAAC,MAAM,4FAA4F,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnR,WAAW,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3C,CAAC,CAAC,+CAA+C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mIAAmI;KACzN,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/utils/aws.d.ts

@@ -5,6 +5,23 @@
  * exposed to shell interpretation even though callers pass a user-supplied
  * --profile and --region.
  */
+/**
+ * Where an AWS call should be made: a named CLI profile, or temporary
+ * credentials from an assumed role.
+ *
+ * Both are carried in one object so every check function is agnostic about how
+ * the caller authenticated. `scan-account` supplies a profile; `scan-org`
+ * supplies assumed-role credentials per member account. Credentials travel in
+ * the child process environment rather than being written to `~/.aws/config`,
+ * so nothing is persisted and the assumed role cannot leak into a later call.
+ */
+export interface AwsTarget {
+    /** AWS CLI profile name. */
+    profile?: string;
+    /** Temporary credentials injected into the child environment. A key mapped
+     *  to undefined is removed from it. */
+    env?: Record<string, string | undefined>;
+}
 export interface AwsResult {
     ok: boolean;
     json: any;
@@ -21,7 +38,21 @@ export interface AwsResult {
  * precisely the accounts that most need auditing. Empty output is normalised to
  * {} here and interpreted by each individual check.
  */
-export declare function aws(args: string[], profile?: string): AwsResult;
+export declare function aws(args: string[], target?: AwsTarget): AwsResult;
+/**
+ * Assume a role and return credentials as an env fragment, or an error string.
+ *
+ * Deliberately returns the failure rather than throwing: at org scale a role
+ * that cannot be assumed is an expected condition (an account onboarded without
+ * the role, an SCP denying it), and the caller must surface that account as
+ * INDETERMINATE rather than dropping it. A silently skipped account is exactly
+ * how an org audit ends up reporting on a subset while looking complete.
+ */
+export declare function assumeRole(accountId: string, roleName: string, sessionName: string, durationSeconds: number, from?: AwsTarget, region?: string): {
+    env: Record<string, string | undefined>;
+} | {
+    error: string;
+};
 /**
  * Resolve the caller's account id, or print guidance and return null.
  *
@@ -29,7 +60,7 @@ export declare function aws(args: string[], profile?: string): AwsResult;
  * --profile fails in the CLI's own config layer and never reaches the service,
  * so fall back to its stderr rather than reporting "unknown error".
  */
-export declare function resolveAccount(profile?: string): string | null;
+export declare function resolveAccount(target?: AwsTarget): string | null;
 export declare function daysSince(iso: string): number | null;
 export declare const PROFILE_OPTION: {
     flags: string;

package/dist/src/utils/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAe/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS9D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,eAAO,MAAM,cAAc;;;CAG1B,CAAC"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;2CACuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAejE;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,IAAI,CAAC,EAAE,SAAS,EAChB,MAAM,CAAC,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiCjE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAShE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,eAAO,MAAM,cAAc;;;CAG1B,CAAC"}

package/dist/src/utils/aws.js

@@ -14,9 +14,9 @@ import { run } from './exec.js';
  * precisely the accounts that most need auditing. Empty output is normalised to
  * {} here and interpreted by each individual check.
  */
-export function aws(args, profile) {
-    const argv = profile ? [...args, '--profile', profile] : args;
-    const res = run('aws', [...argv, '--output', 'json']);
+export function aws(args, target) {
+    const argv = target?.profile ? [...args, '--profile', target.profile] : args;
+    const res = run('aws', [...argv, '--output', 'json'], target?.env);
     const body = (res.stdout || '').trim();
     if (!res.ok) {
         const m = /An error occurred \(([A-Za-z0-9.]+)\)/.exec(res.stderr || '');
@@ -31,6 +31,48 @@ export function aws(args, profile) {
         return { ok: false, json: null, errorCode: 'UnparseableResponse', raw: body };
     }
 }
+/**
+ * Assume a role and return credentials as an env fragment, or an error string.
+ *
+ * Deliberately returns the failure rather than throwing: at org scale a role
+ * that cannot be assumed is an expected condition (an account onboarded without
+ * the role, an SCP denying it), and the caller must surface that account as
+ * INDETERMINATE rather than dropping it. A silently skipped account is exactly
+ * how an org audit ends up reporting on a subset while looking complete.
+ */
+export function assumeRole(accountId, roleName, sessionName, durationSeconds, from, region) {
+    const res = aws([
+        'sts', 'assume-role',
+        '--role-arn', `arn:aws:iam::${accountId}:role/${roleName}`,
+        '--role-session-name', sessionName,
+        '--duration-seconds', String(durationSeconds),
+    ], from);
+    if (!res.ok) {
+        const reason = res.errorCode
+            || (res.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() ?? 'unknown error');
+        return { error: reason };
+    }
+    const c = res.json?.Credentials;
+    if (!c?.AccessKeyId || !c?.SecretAccessKey || !c?.SessionToken) {
+        return { error: 'assume-role returned no usable credentials' };
+    }
+    return {
+        env: {
+            AWS_ACCESS_KEY_ID: c.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: c.SecretAccessKey,
+            AWS_SESSION_TOKEN: c.SessionToken,
+            // REMOVED, not blanked. A profile left in the ambient environment takes
+            // precedence over the injected keys and would silently audit the WRONG
+            // account -- the worst failure available here, since every finding would
+            // be misattributed. Blanking instead of removing breaks the CLI outright.
+            AWS_PROFILE: undefined,
+            AWS_DEFAULT_PROFILE: undefined,
+            // The unset profile also took its region with it, so pin one explicitly
+            // rather than depending on whatever the CLI can still resolve.
+            ...(region ? { AWS_REGION: region, AWS_DEFAULT_REGION: region } : {}),
+        },
+    };
+}
 /**
  * Resolve the caller's account id, or print guidance and return null.
  *
@@ -38,8 +80,8 @@ export function aws(args, profile) {
  * --profile fails in the CLI's own config layer and never reaches the service,
  * so fall back to its stderr rather than reporting "unknown error".
  */
-export function resolveAccount(profile) {
-    const who = aws(['sts', 'get-caller-identity'], profile);
+export function resolveAccount(target) {
+    const who = aws(['sts', 'get-caller-identity'], target);
     if (who.ok)
         return who.json?.Account ?? null;
     const reason = who.errorCode

package/dist/src/utils/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAWhC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;WACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,gEAAgE;CAC9E,CAAC"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA6BhC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,MAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,QAAgB,EAChB,WAAmB,EACnB,eAAuB,EACvB,IAAgB,EAChB,MAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC;QACd,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,gBAAgB,SAAS,SAAS,QAAQ,EAAE;QAC1D,qBAAqB,EAAE,WAAW;QAClC,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;KAC9C,EAAE,IAAI,CAAC,CAAC;IAET,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;eACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;QACzF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;IAChC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,EAAE,eAAe,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,OAAO;QACL,GAAG,EAAE;YACH,iBAAiB,EAAE,CAAC,CAAC,WAAW;YAChC,qBAAqB,EAAE,CAAC,CAAC,eAAe;YACxC,iBAAiB,EAAE,CAAC,CAAC,YAAY;YACjC,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,0EAA0E;YAC1E,WAAW,EAAE,SAAS;YACtB,mBAAmB,EAAE,SAAS;YAC9B,wEAAwE;YACxE,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;WACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,gEAAgE;CAC9E,CAAC"}

package/dist/src/utils/exec.d.ts

@@ -42,10 +42,21 @@ export interface RunResult {
  * latter would arrive as a single argument and the command would fail, which
  * is a loud failure rather than a silent injection.
  *
+ * `extraEnv` is merged over the inherited environment. It exists so a caller
+ * can hand a child process temporary STS credentials without writing them to
+ * disk or mutating this process's own environment -- the latter would leak the
+ * assumed role into every later call in the same run.
+ *
+ * A key mapped to `undefined` is REMOVED rather than set. Blanking is not
+ * equivalent: `AWS_PROFILE=''` makes the AWS CLI look for a profile literally
+ * named `()` and fail with "The config profile () could not be found", so
+ * injected credentials are ignored and every call errors. Measured, not
+ * theoretical.
+ *
  * Never throws: a non-zero exit, a missing binary, and a signal kill all come
  * back as `ok: false`. Callers branch on `ok` and surface `stderr`.
  */
-export declare function run(file: string, args: string[]): RunResult;
+export declare function run(file: string, args: string[], extraEnv?: Record<string, string | undefined>): RunResult;
 /**
  * Like run(), but inherits stdio so the child can drive the terminal.
  *

package/dist/src/utils/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAW3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAOpE"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAmB1G;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAOpE"}

package/dist/src/utils/exec.js

@@ -38,15 +38,36 @@ import { execFileSync } from 'node:child_process';
  * latter would arrive as a single argument and the command would fail, which
  * is a loud failure rather than a silent injection.
  *
+ * `extraEnv` is merged over the inherited environment. It exists so a caller
+ * can hand a child process temporary STS credentials without writing them to
+ * disk or mutating this process's own environment -- the latter would leak the
+ * assumed role into every later call in the same run.
+ *
+ * A key mapped to `undefined` is REMOVED rather than set. Blanking is not
+ * equivalent: `AWS_PROFILE=''` makes the AWS CLI look for a profile literally
+ * named `()` and fail with "The config profile () could not be found", so
+ * injected credentials are ignored and every call errors. Measured, not
+ * theoretical.
+ *
  * Never throws: a non-zero exit, a missing binary, and a signal kill all come
  * back as `ok: false`. Callers branch on `ok` and surface `stderr`.
  */
-export function run(file, args) {
+export function run(file, args, extraEnv) {
+    let env = process.env;
+    if (extraEnv) {
+        env = { ...process.env };
+        for (const [k, v] of Object.entries(extraEnv)) {
+            if (v === undefined)
+                delete env[k];
+            else
+                env[k] = v;
+        }
+    }
     try {
         const stdout = execFileSync(file, args, {
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
-            env: process.env,
+            env,
         }).trim();
         return { ok: true, stdout, stderr: '' };
     }

package/dist/src/utils/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAc;IACzD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/utils/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,QAA6C;IAC7F,IAAI,GAAG,GAAsB,OAAO,CAAC,GAAG,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAc;IACzD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.95",
+  "version": "1.0.97",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {