@zincapp/znvault-cli 4.7.1 → 4.8.0

package/dist/commands/dynamic-secrets/types.d.ts

@@ -63,6 +63,9 @@ export interface GeneratedCredential {
     maxExpiresAt: string;
     ttlSeconds: number;
     renewalCount: number;
+    host?: string;
+    port?: number;
+    database?: string;
 }
 export interface TestConnectionResult {
     success: boolean;

package/dist/commands/dynamic-secrets/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/types.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,YAAY,GAAG,OAAO,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,qBAAqB,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/types.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,YAAY,GAAG,OAAO,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,qBAAqB,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB"}

package/dist/commands/mysql/alias.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Add or overwrite a MySQL alias in the active profile.
+ */
+export declare function addAlias(name: string, connection: string, role: string): void;
+/**
+ * Get a MySQL alias from the active profile.
+ * Returns undefined if the alias does not exist.
+ */
+export declare function getAlias(name: string): {
+    connection: string;
+    role: string;
+} | undefined;
+/**
+ * List all MySQL aliases in the active profile.
+ */
+export declare function listAliases(): Array<{
+    name: string;
+    connection: string;
+    role: string;
+}>;
+/**
+ * Remove a MySQL alias from the active profile.
+ * No-op if the alias does not exist.
+ */
+export declare function removeAlias(name: string): void;
+//# sourceMappingURL=alias.d.ts.map

package/dist/commands/mysql/alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/alias.ts"],"names":[],"mappings":"AAgBA;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAM7E;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAGvF;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAQvF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAO9C"}

package/dist/commands/mysql/alias.js

@@ -0,0 +1,56 @@
+// src/commands/mysql/alias.ts
+/**
+ * Per-profile MySQL alias store.
+ *
+ * Aliases map a short name (e.g. "staging-rw") to a dynamic-secrets connection
+ * name and role name so that `znvault mysql exec staging-rw` can be used instead
+ * of spelling out the full --connection / --role flags every time.
+ *
+ * Aliases are stored under the active profile in the CLI config:
+ *   profile.mysqlAliases: Record<string, { connection: string; role: string }>
+ */
+import { getCurrentProfile, saveProfile } from '../../lib/config/profile.js';
+import { getActiveProfileName } from '../../lib/config/profile.js';
+/**
+ * Add or overwrite a MySQL alias in the active profile.
+ */
+export function addAlias(name, connection, role) {
+    const profileName = getActiveProfileName();
+    const profile = getCurrentProfile();
+    const aliases = profile.mysqlAliases ?? {};
+    aliases[name] = { connection, role };
+    saveProfile(profileName, { ...profile, mysqlAliases: aliases });
+}
+/**
+ * Get a MySQL alias from the active profile.
+ * Returns undefined if the alias does not exist.
+ */
+export function getAlias(name) {
+    const profile = getCurrentProfile();
+    return profile.mysqlAliases?.[name];
+}
+/**
+ * List all MySQL aliases in the active profile.
+ */
+export function listAliases() {
+    const profile = getCurrentProfile();
+    const aliases = profile.mysqlAliases ?? {};
+    return Object.entries(aliases).map(([name, { connection, role }]) => ({
+        name,
+        connection,
+        role,
+    }));
+}
+/**
+ * Remove a MySQL alias from the active profile.
+ * No-op if the alias does not exist.
+ */
+export function removeAlias(name) {
+    const profileName = getActiveProfileName();
+    const profile = getCurrentProfile();
+    const aliases = profile.mysqlAliases ?? {};
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+    delete aliases[name];
+    saveProfile(profileName, { ...profile, mysqlAliases: aliases });
+}
+//# sourceMappingURL=alias.js.map

package/dist/commands/mysql/alias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.js","sourceRoot":"","sources":["../../../src/commands/mysql/alias.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,UAAkB,EAAE,IAAY;IACrE,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACrC,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI;QACJ,UAAU;QACV,IAAI;KACL,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAC3C,gEAAgE;IAChE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commands/mysql/broker.d.ts

@@ -0,0 +1,38 @@
+import type { GeneratedCredential } from '../dynamic-secrets/types.js';
+/**
+ * Options for runBrokered.
+ */
+export interface RunBrokeredOptions {
+    /** The dynamic-secrets role ID to generate credentials from. */
+    roleId: string;
+    /**
+     * Requested TTL in seconds. The server may cap this to the role's maxTtl.
+     * Defaults to DEFAULT_TTL_SECONDS (600).
+     */
+    ttlSeconds?: number;
+    /**
+     * Callback that receives the credential + the open cnf fd and its /dev/fd
+     * path. Should return the numeric child process exit code.
+     *
+     * The cnf inode is valid (reachable via `fdPath`) for the duration of this
+     * callback — its directory entry is already unlinked, so the child mysql must
+     * inherit `fd` at the same number (runMysql does this). The fd is closed and
+     * the lease is revoked immediately after the callback returns (or throws).
+     */
+    run: (ctx: {
+        credential: GeneratedCredential;
+        fd: number;
+        fdPath: string;
+    }) => Promise<number>;
+}
+/**
+ * Generate a lease, write its credentials to a temp my.cnf, run the callback,
+ * then revoke the lease and shred the my.cnf on EVERY exit path.
+ *
+ * @returns The numeric exit code returned by `run`.
+ * @throws If `run` throws, the error is rethrown after cleanup.
+ * @throws If the server does not return host/port in the credential,
+ *         an upgrade error is thrown before `run` is called.
+ */
+export declare function runBrokered(opts: RunBrokeredOptions): Promise<number>;
+//# sourceMappingURL=broker.d.ts.map

package/dist/commands/mysql/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/broker.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AA8DvE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,GAAG,EAAE;QAAE,UAAU,EAAE,mBAAmB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAChG;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4F3E"}

package/dist/commands/mysql/broker.js

@@ -0,0 +1,171 @@
+// src/commands/mysql/broker.ts
+/**
+ * Brokered lease lifecycle for `znvault mysql exec/connect`.
+ *
+ * runBrokered:
+ *   1. Generates a short-lived dynamic-secret credential.
+ *   2. Writes credentials to a 0600 temp my.cnf on a memory-backed fs, then
+ *      unlinks the directory entry immediately, keeping it alive via an open fd
+ *      (spec F1 — no plaintext name on disk for the run).
+ *   3. Calls the injected `run` callback with { credential, fd, fdPath }.
+ *   4. In ALL exit paths (normal return, run error, SIGINT/SIGTERM/SIGHUP,
+ *      uncaughtException) — calls a single idempotent cleanup() that:
+ *        a. Closes the cnf fd (releasing the unlinked inode) + rmdir's the dir.
+ *        b. Revokes the lease (3 retries: 1s/2s/4s backoff).
+ *           "Already revoked" errors are treated as success.
+ *           All retries exhausted → loud WARN with leaseId (TTL backstop).
+ *   5. Returns the numeric exit code from run, or rethrows run's error.
+ *
+ * Security guarantees (spec F1–F12):
+ *   - Password only in 0600 temp file, never in argv/env/stdout.
+ *   - host/port MUST come from the server; no --host fallback (spec F2).
+ *   - Lease is always revoked; TTL is the backstop, not the primary mechanism.
+ *   - Signal handlers are removed in the finally block to avoid leaks.
+ */
+import { client } from '../../lib/client.js';
+import { createMyCnf } from './mycnf.js';
+/** Default lease TTL in seconds (spec F12 — may be capped by role maxTtl). */
+const DEFAULT_TTL_SECONDS = 600;
+/** Backoff delays in ms for revoke retries. */
+const REVOKE_BACKOFF_MS = [1_000, 2_000, 4_000];
+/** Maximum retries for revoke (length of REVOKE_BACKOFF_MS + 1 initial attempt). */
+const REVOKE_MAX_ATTEMPTS = 1 + REVOKE_BACKOFF_MS.length; // 4 total
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Returns true if the error message indicates the lease is already revoked.
+ * The server throws "Cannot revoke <id>: lease is already REVOKED" (or similar).
+ *
+ * TODO: also check the HTTP status code (e.g. 404/409) once the client surfaces
+ * it on the error object — matching solely on err.message is fragile if the
+ * server error wording changes.
+ */
+function isAlreadyRevoked(err) {
+    if (!(err instanceof Error))
+        return false;
+    const msg = err.message.toLowerCase();
+    return msg.includes('cannot revoke') || msg.includes('already revoked') || msg.includes('already_revoked');
+}
+/**
+ * Attempt to revoke the lease with up to REVOKE_MAX_ATTEMPTS tries.
+ * "Already revoked" errors are silently treated as success.
+ * If all attempts fail for other reasons, emits a loud WARN (does not throw).
+ */
+async function revokeWithRetry(leaseId) {
+    let lastErr;
+    for (let attempt = 1; attempt <= REVOKE_MAX_ATTEMPTS; attempt++) {
+        try {
+            await client.post(`/v1/dynamic-secrets/leases/${leaseId}/revoke`, {
+                reason: 'znvault-mysql-exec-cleanup',
+            });
+            return; // success
+        }
+        catch (err) {
+            if (isAlreadyRevoked(err)) {
+                return; // treat as success
+            }
+            lastErr = err;
+            // Sleep between retries; no sleep after the last attempt.
+            if (attempt < REVOKE_MAX_ATTEMPTS) {
+                await sleep(REVOKE_BACKOFF_MS[attempt - 1] ?? 1_000);
+            }
+        }
+    }
+    // All retries exhausted — log loud WARN so the operator can manually revoke.
+    // Do NOT throw: the TTL backstop will clean up the DB user.
+    const errMsg = lastErr instanceof Error ? lastErr.message : String(lastErr);
+    console.warn(`[znvault] WARN: failed to revoke lease ${leaseId} after ${REVOKE_MAX_ATTEMPTS.toString()} attempts. ` +
+        `It will expire at its TTL. Last error: ${errMsg}`);
+}
+/**
+ * Generate a lease, write its credentials to a temp my.cnf, run the callback,
+ * then revoke the lease and shred the my.cnf on EVERY exit path.
+ *
+ * @returns The numeric exit code returned by `run`.
+ * @throws If `run` throws, the error is rethrown after cleanup.
+ * @throws If the server does not return host/port in the credential,
+ *         an upgrade error is thrown before `run` is called.
+ */
+export async function runBrokered(opts) {
+    const { roleId, run } = opts;
+    const requestedTtl = opts.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    // ── 1. Generate lease ───────────────────────────────────────────────────────
+    const credential = await client.post(`/v1/dynamic-secrets/roles/${roleId}/credentials`, { ttlSeconds: requestedTtl });
+    // Log the effective TTL (may differ from requested due to role maxTtl cap — spec F12).
+    if (credential.ttlSeconds !== requestedTtl) {
+        console.warn(`[znvault] Requested TTL ${requestedTtl.toString()}s was capped to ${credential.ttlSeconds.toString()}s by the role's maxTtl.`);
+    }
+    // ── 2. Validate host/port (spec F2 — no --host fallback) ───────────────────
+    if (!credential.host || credential.port === undefined) {
+        // Revoke the just-minted lease before throwing. revokeWithRetry applies the
+        // same retry/backoff as the main cleanup path (it does NOT skip retries).
+        await revokeWithRetry(credential.leaseId);
+        throw new Error(`Vault did not return host/port in the credential for role '${roleId}'. ` +
+            `Please upgrade vault to a version that returns host/port in dynamic-secret credentials.`);
+    }
+    // ── 3. Write temp my.cnf (open fd + immediate unlink — spec F1) ────────────
+    // The lease is minted but the idempotent cleanup()/try-finally below is not
+    // installed yet. If createMyCnf throws (disk full, mkdir race, EMFILE) here,
+    // the lease would be orphaned (only the TTL backstop would save it). Revoke it
+    // first, then rethrow. No double-revoke risk: cleanup() is not installed until
+    // after this succeeds, so on this path revoke fires exactly once (I-2).
+    let cnfFd;
+    let cnfFdPath;
+    let cleanupCnf;
+    try {
+        ({ fd: cnfFd, fdPath: cnfFdPath, cleanup: cleanupCnf } = await createMyCnf({
+            user: credential.username,
+            password: credential.password,
+            host: credential.host,
+            port: credential.port,
+        }));
+    }
+    catch (err) {
+        await revokeWithRetry(credential.leaseId);
+        throw err;
+    }
+    // ── 4. Idempotent cleanup (guarded by `cleaned` boolean) ───────────────────
+    let cleaned = false;
+    async function cleanup() {
+        if (cleaned)
+            return;
+        cleaned = true;
+        cleanupCnf();
+        await revokeWithRetry(credential.leaseId);
+    }
+    // ── 5. Signal handlers ──────────────────────────────────────────────────────
+    // SIGPIPE is intentionally not handled — treat as normal (don't crash).
+    // Each handler uses an async IIFE so cleanup() is properly awaited before
+    // process.exit. The outer `void` is the lint-clean way to fire-and-forget an
+    // async function from a synchronous signal handler — cleanup() cannot throw
+    // (revokeWithRetry eats errors, cleanupCnf is try/caught), so there is no
+    // unhandled rejection risk.
+    const onSIGINT = () => { void (async () => { await cleanup(); process.exit(130); })(); };
+    const onSIGTERM = () => { void (async () => { await cleanup(); process.exit(143); })(); };
+    const onSIGHUP = () => { void (async () => { await cleanup(); process.exit(129); })(); };
+    const onUncaughtException = (err) => {
+        console.error('[znvault] Uncaught exception during mysql exec:', err.stack ?? err);
+        void (async () => { await cleanup(); process.exit(1); })();
+    };
+    process.once('SIGINT', onSIGINT);
+    process.once('SIGTERM', onSIGTERM);
+    process.once('SIGHUP', onSIGHUP);
+    process.once('uncaughtException', onUncaughtException);
+    // ── 6. Run callback + cleanup in finally ────────────────────────────────────
+    try {
+        const exitCode = await run({ credential, fd: cnfFd, fdPath: cnfFdPath });
+        return exitCode;
+    }
+    finally {
+        // Remove signal handlers BEFORE awaiting cleanup so that a signal arriving
+        // during cleanup does not re-enter the handler (which would be a no-op due
+        // to the `cleaned` guard but would also leak across repeated runBrokered calls).
+        process.off('SIGINT', onSIGINT);
+        process.off('SIGTERM', onSIGTERM);
+        process.off('SIGHUP', onSIGHUP);
+        process.off('uncaughtException', onUncaughtException);
+        await cleanup();
+    }
+}
+//# sourceMappingURL=broker.js.map

package/dist/commands/mysql/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/commands/mysql/broker.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAE/B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEhD,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,UAAU;AAEpE,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,SAAS,EAAE;gBAChE,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;YACH,OAAO,CAAC,UAAU;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,mBAAmB;YAC7B,CAAC;YACD,OAAO,GAAG,GAAG,CAAC;YACd,0DAA0D;YAC1D,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CACV,0CAA0C,OAAO,UAAU,mBAAmB,CAAC,QAAQ,EAAE,aAAa;QACtG,0CAA0C,MAAM,EAAE,CACnD,CAAC;AACJ,CAAC;AAyBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAE5D,+EAA+E;IAC/E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAClC,6BAA6B,MAAM,cAAc,EACjD,EAAE,UAAU,EAAE,YAAY,EAAE,CAC7B,CAAC;IAEF,uFAAuF;IACvF,IAAI,UAAU,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CACV,2BAA2B,YAAY,CAAC,QAAQ,EAAE,mBAAmB,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,yBAAyB,CAC/H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtD,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,KAAK;YACzE,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,KAAa,CAAC;IAClB,IAAI,SAAiB,CAAC;IACtB,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC;YACzE,IAAI,EAAE,UAAU,CAAC,QAAQ;YACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,UAAU,OAAO;QACpB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,UAAU,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,GAAS,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,GAAS,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAS,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,mBAAmB,GAAG,CAAC,GAAU,EAAQ,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACnF,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvD,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,2EAA2E;QAC3E,iFAAiF;QACjF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACtD,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/mysql/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Register `znvault mysql` commands: exec, connect, alias.
+ *
+ * Security guarantees (spec F1–F12):
+ *   - assertMysqlOnPath() is called BEFORE generating a lease (fail-fast, no
+ *     wasted credentials if mysql is absent — spec F1).
+ *   - Password never in argv/env/stdout (broker writes 0600 my.cnf — spec F3).
+ *   - host/port come from the vault server; no --host fallback (spec F2).
+ *     If the server credential lacks host, runBrokered throws a clear upgrade
+ *     error — surfaced here, never swallowed.
+ *   - process.exit(code) propagates the mysql exit code so CI scripts can rely
+ *     on non-zero exit to detect SQL failures.
+ */
+import type { Command } from 'commander';
+/**
+ * Parse and validate the `--ttl <seconds>` option (M-2).
+ *
+ * `parseInt('abc', 10)` is `NaN`, and `NaN ?? 600` stays `NaN` — which would be
+ * sent to the server as the requested TTL and produce a confusing bad request.
+ * Validate locally and fail fast with a clear message BEFORE any lease is
+ * generated.
+ *
+ * @param raw The raw `--ttl` option value, or undefined when not provided.
+ * @returns The parsed positive integer, or undefined when `--ttl` is absent
+ *          (so the server/role default applies).
+ * @throws If `--ttl` is provided but is not a positive integer.
+ */
+export declare function parseTtlSeconds(raw: string | undefined): number | undefined;
+/**
+ * Register the `mysql` command group and all subcommands on `program`.
+ */
+export declare function registerMysqlCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/mysql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBzC;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmL5D"}

package/dist/commands/mysql/index.js

@@ -0,0 +1,207 @@
+// src/commands/mysql/index.ts
+import * as output from '../../lib/output.js';
+import { resolveTarget } from './resolve.js';
+import { runBrokered } from './broker.js';
+import { assertMysqlOnPath, runMysql } from './run.js';
+import { addAlias, listAliases, removeAlias } from './alias.js';
+/**
+ * Collect helper for Commander repeatable options (--file <path> ... --file <path>).
+ * Each invocation appends the new value to the accumulator array.
+ */
+function collect(value, previous) {
+    return [...previous, value];
+}
+/**
+ * Parse and validate the `--ttl <seconds>` option (M-2).
+ *
+ * `parseInt('abc', 10)` is `NaN`, and `NaN ?? 600` stays `NaN` — which would be
+ * sent to the server as the requested TTL and produce a confusing bad request.
+ * Validate locally and fail fast with a clear message BEFORE any lease is
+ * generated.
+ *
+ * @param raw The raw `--ttl` option value, or undefined when not provided.
+ * @returns The parsed positive integer, or undefined when `--ttl` is absent
+ *          (so the server/role default applies).
+ * @throws If `--ttl` is provided but is not a positive integer.
+ */
+export function parseTtlSeconds(raw) {
+    if (raw === undefined)
+        return undefined;
+    const ttl = Number(raw);
+    if (!Number.isInteger(ttl) || ttl <= 0) {
+        throw new Error(`Invalid --ttl '${raw}': must be a positive integer number of seconds.`);
+    }
+    return ttl;
+}
+/**
+ * Register the `mysql` command group and all subcommands on `program`.
+ */
+export function registerMysqlCommands(program) {
+    const mysql = program
+        .command('mysql')
+        // enablePositionalOptions() lets the variadic [mysqlArgs...] coexist cleanly
+        // with named options — keeps '--' separator forwarding well-defined.
+        .enablePositionalOptions()
+        .description('Connect to MySQL databases via short-lived dynamic-secret credentials')
+        .addHelpText('after', `
+Examples:
+  # Interactive shell (connect mode)
+  znvault mysql connect my-connection
+
+  # Execute SQL from a file
+  znvault mysql exec my-connection --file schema.sql
+
+  # Execute inline SQL
+  znvault mysql exec my-connection --sql "SELECT 1"
+
+  # Pipe SQL from stdin
+  echo "SELECT version()" | znvault mysql exec my-connection
+
+  # Use an alias (see: znvault mysql alias add)
+  znvault mysql connect staging-rw
+
+  # Save an alias for quick access
+  znvault mysql alias add staging-rw --connection staging-mysql --role app-rw
+
+  # Pass extra mysql flags after --
+  znvault mysql connect my-connection -- --table
+`);
+    // ── exec ─────────────────────────────────────────────────────────────────────
+    //
+    // Using `exec <target> [mysqlArgs...]` (variadic) instead of passThroughOptions()
+    // so that named options (--role, --sql, etc.) can appear AFTER the positional
+    // <target> argument without being misread as excess positional args.
+    //
+    // With passThroughOptions(), Commander stops option-parsing at the first
+    // non-option token (the target), so `exec staging-mysql --role app-rw` was
+    // rejected as "too many arguments" — the target consumed the stop-point and
+    // --role/--sql were treated as excess positional args.
+    //
+    // The variadic approach: Commander continues parsing named options across the
+    // whole argv, and any unrecognised tokens (or tokens after `--`) land in the
+    // mysqlArgs array instead of causing an error.  The `--` separator itself is
+    // NOT included in mysqlArgs — Commander strips it automatically.
+    mysql
+        .command('exec <target> [mysqlArgs...]')
+        .description('Execute SQL against a MySQL database via a short-lived credential')
+        .option('--role <name>', 'Dynamic-secrets role name or ID')
+        .option('--file <path>', 'SQL file to execute (repeatable; concatenated in order)', collect, [])
+        .option('--sql <sql>', 'Inline SQL to execute')
+        .option('--ttl <seconds>', `Requested lease TTL in seconds (default: 600; capped by role maxTtl)`)
+        .option('--database <db>', 'Database/schema to select (overrides the credential default)')
+        .action(async (target, mysqlArgs, opts) => {
+        // mysqlArgs contains any extra tokens (e.g. post-`--` flags like --batch).
+        // Commander excludes the `--` separator itself from this array.
+        const passthrough = mysqlArgs;
+        try {
+            // Fail fast: check mysql binary before generating any lease.
+            assertMysqlOnPath();
+            // Validate --ttl locally before generating any lease (M-2).
+            const ttlSeconds = parseTtlSeconds(opts.ttl);
+            const { roleId } = await resolveTarget(target, opts.role);
+            const code = await runBrokered({
+                roleId,
+                ttlSeconds,
+                run: ({ credential, fd, fdPath }) => runMysql({
+                    fd,
+                    fdPath,
+                    database: opts.database ?? credential.database,
+                    mode: 'exec',
+                    files: opts.file,
+                    sql: opts.sql,
+                    passthrough,
+                }),
+            });
+            process.exit(code);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── connect ───────────────────────────────────────────────────────────────────
+    // Same variadic idiom as exec — see exec comment above.
+    mysql
+        .command('connect <target> [mysqlArgs...]')
+        .description('Open an interactive MySQL shell via a short-lived credential')
+        .option('--role <name>', 'Dynamic-secrets role name or ID')
+        .option('--ttl <seconds>', `Requested lease TTL in seconds (default: 600; capped by role maxTtl)`)
+        .option('--database <db>', 'Database/schema to select (overrides the credential default)')
+        .action(async (target, mysqlArgs, opts) => {
+        const passthrough = mysqlArgs;
+        try {
+            // Fail fast: check mysql binary before generating any lease.
+            assertMysqlOnPath();
+            // Validate --ttl locally before generating any lease (M-2).
+            const ttlSeconds = parseTtlSeconds(opts.ttl);
+            const { roleId } = await resolveTarget(target, opts.role);
+            const code = await runBrokered({
+                roleId,
+                ttlSeconds,
+                run: ({ credential, fd, fdPath }) => runMysql({
+                    fd,
+                    fdPath,
+                    database: opts.database ?? credential.database,
+                    mode: 'connect',
+                    passthrough,
+                }),
+            });
+            process.exit(code);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── alias ─────────────────────────────────────────────────────────────────────
+    const alias = mysql
+        .command('alias')
+        .description('Manage MySQL connection aliases for quick access');
+    alias
+        .command('add <name>')
+        .description('Add or overwrite a MySQL connection alias')
+        .requiredOption('--connection <connection>', 'Connection name or ID to bind')
+        .requiredOption('--role <role>', 'Role name or ID to bind')
+        .action((name, opts) => {
+        try {
+            addAlias(name, opts.connection, opts.role);
+            output.success(`Alias '${name}' saved → ${opts.connection} / ${opts.role}`);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    alias
+        .command('list')
+        .alias('ls')
+        .description('List all MySQL aliases in the active profile')
+        .action(() => {
+        try {
+            const aliases = listAliases();
+            if (aliases.length === 0) {
+                output.info('No aliases defined. Use: znvault mysql alias add <name> --connection <c> --role <r>');
+                return;
+            }
+            output.table(['Name', 'Connection', 'Role'], aliases.map(({ name, connection, role }) => [name, connection, role]));
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    alias
+        .command('rm <name>')
+        .description('Remove a MySQL alias from the active profile')
+        .action((name) => {
+        try {
+            removeAlias(name);
+            output.success(`Alias '${name}' removed`);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/mysql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/mysql/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAiB9B,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGhE;;;GAGG;AACH,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IAChD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,kDAAkD,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;QACjB,6EAA6E;QAC7E,qEAAqE;SACpE,uBAAuB,EAAE;SACzB,WAAW,CAAC,uEAAuE,CAAC;SACpF,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBzB,CAAC,CAAC;IAED,gFAAgF;IAChF,EAAE;IACF,kFAAkF;IAClF,8EAA8E;IAC9E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,iEAAiE;IACjE,KAAK;SACF,OAAO,CAAC,8BAA8B,CAAC;SACvC,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC1D,MAAM,CAAC,eAAe,EAAE,yDAAyD,EAAE,OAAO,EAAE,EAAE,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC;SAC9C,MAAM,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;SACjG,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,SAAmB,EAAE,IAAyB,EAAE,EAAE;QAC/E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,WAAW,GAAa,SAAS,CAAC;QAExC,IAAI,CAAC;YACH,6DAA6D;YAC7D,iBAAiB,EAAE,CAAC;YAEpB,4DAA4D;YAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC7B,MAAM;gBACN,UAAU;gBACV,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,QAAQ,CAAC;oBACP,EAAE;oBACF,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;oBAC9C,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,IAAI,CAAC,IAAI;oBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,WAAW;iBACZ,CAAC;aACL,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iFAAiF;IACjF,wDAAwD;IACxD,KAAK;SACF,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;SACjG,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,SAAmB,EAAE,IAAsB,EAAE,EAAE;QAC5E,MAAM,WAAW,GAAa,SAAS,CAAC;QAExC,IAAI,CAAC;YACH,6DAA6D;YAC7D,iBAAiB,EAAE,CAAC;YAEpB,4DAA4D;YAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC7B,MAAM;gBACN,UAAU;gBACV,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,QAAQ,CAAC;oBACP,EAAE;oBACF,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;oBAC9C,IAAI,EAAE,SAAS;oBACf,WAAW;iBACZ,CAAC;aACL,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iFAAiF;IACjF,MAAM,KAAK,GAAG,KAAK;SAChB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEnE,KAAK;SACF,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,2CAA2C,CAAC;SACxD,cAAc,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;SAC5E,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,CAAC,IAAY,EAAE,IAA0C,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CACtE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/mysql/mycnf.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The result of createMyCnf.
+ *
+ * - `fd`:     the open file descriptor backing the (now unlinked) my.cnf. The
+ *             child mysql inherits this fd at the SAME number and re-opens it
+ *             via `fdPath`.
+ * - `fdPath`: `/dev/fd/<fd>` — pass this verbatim as the value of
+ *             `--defaults-extra-file`. Works on macOS (/dev/fd) and Linux
+ *             (/dev/fd → /proc/self/fd).
+ * - `cleanup`: idempotent, best-effort. Closes `fd` (releasing the inode so its
+ *             bytes are reclaimed) and rmdir's the now-empty mem-fs dir.
+ */
+export interface MyCnfHandle {
+    /** Open fd backing the unlinked cnf inode. Child inherits it at this number. */
+    fd: number;
+    /** `/dev/fd/<fd>` — the value to pass to --defaults-extra-file. */
+    fdPath: string;
+    /** Idempotent best-effort teardown: closeSync(fd) + rmdir(dir). */
+    cleanup: () => void;
+}
+/**
+ * Create the temp my.cnf, unlink its directory entry immediately, and return an
+ * open fd plus an idempotent cleanup().
+ *
+ * The body is fully synchronous (all fs operations are *Sync), but the function
+ * returns a Promise to preserve the broker's `await createMyCnf(...)` contract
+ * (and so it can become genuinely async later without touching callers).
+ * Declared non-`async` + returning Promise.resolve avoids the require-await
+ * lint warning while keeping the Promise return type (M-5).
+ *
+ * @throws If the exclusive create fails (e.g. EEXIST on a suffix collision,
+ *         which is astronomically unlikely with 8 random bytes, or ENOSPC).
+ */
+export declare function createMyCnf(opts: {
+    user: string;
+    password: string;
+    host: string;
+    port: number;
+}): Promise<MyCnfHandle>;
+//# sourceMappingURL=mycnf.d.ts.map

package/dist/commands/mysql/mycnf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mycnf.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/mycnf.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CAC5D,GAAG,OAAO,CAAC,WAAW,CAAC,CA8DvB"}