@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-pr-20-20261020022402

package/cjs/__chunks/3T2LXW7J.cjs

@@ -0,0 +1,387 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
+
+
+
+var _CMUD7LLNcjs = require('./CMUD7LLN.cjs');
+
+// src/commands/aws/iam/users/utils.js
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var KNOWN_ROLES = ["read-only", "iam-admin", "power-user"];
+var REQUIRED_ACL_GROUPS = [
+  "acl-read-only",
+  "acl-iam-full-access",
+  "acl-power-users"
+];
+function roleToGroup(role) {
+  switch (role) {
+    case "read-only":
+      return "acl-read-only";
+    case "iam-admin":
+      return "acl-iam-full-access";
+    case "power-user":
+      return "acl-power-users";
+    default:
+      throw new Error(`Unknown role: ${role}`);
+  }
+}
+function normalizeSlug(value) {
+  return value.toLowerCase().replace(/ /g, "-");
+}
+function isValidSlug(value) {
+  return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function buildUsername(params) {
+  const { identifier, accountName, role } = params;
+  return `md-${identifier}-${accountName}-${role}`;
+}
+function normalizeIdentifier(params) {
+  const { raw, accountName, role } = params;
+  let identifier = normalizeSlug(raw);
+  if (identifier.startsWith("md-")) {
+    identifier = identifier.slice(3);
+  }
+  if (identifier.endsWith(`-${role}`)) {
+    identifier = identifier.slice(0, -(role.length + 1));
+  } else {
+    for (const knownRole of KNOWN_ROLES) {
+      if (identifier.endsWith(`-${knownRole}`)) {
+        identifier = identifier.slice(0, -(knownRole.length + 1));
+        break;
+      }
+    }
+  }
+  if (identifier.endsWith(`-${accountName}`)) {
+    identifier = identifier.slice(0, -(accountName.length + 1));
+  }
+  return identifier;
+}
+function parseMdUsername(name) {
+  let value = normalizeSlug(name);
+  if (!value.startsWith("md-")) {
+    return null;
+  }
+  value = value.slice(3);
+  const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+  let role = null;
+  for (const knownRole of rolesByLength) {
+    if (value.endsWith(`-${knownRole}`)) {
+      role = knownRole;
+      value = value.slice(0, -(knownRole.length + 1));
+      break;
+    }
+  }
+  if (!role) {
+    return null;
+  }
+  const dash = value.indexOf("-");
+  if (dash <= 0 || dash === value.length - 1) {
+    return null;
+  }
+  const identifier = value.slice(0, dash);
+  const accountName = value.slice(dash + 1);
+  if (!isValidSlug(identifier) || !isValidSlug(accountName)) {
+    return null;
+  }
+  return { identifier, accountName, role };
+}
+function inferAccountName(params) {
+  const { profile, identity } = params;
+  const arn = _nullishCoalesce(_optionalChain([identity, 'optionalAccess', _ => _.Arn]), () => ( ""));
+  const username = arn.includes("/") ? _nullishCoalesce(arn.split("/").pop(), () => ( "")) : "";
+  for (const candidate of [username, _nullishCoalesce(profile, () => ( ""))]) {
+    if (!candidate) {
+      continue;
+    }
+    const parsed = parseMdUsername(candidate);
+    if (parsed) {
+      return parsed.accountName;
+    }
+  }
+  return null;
+}
+function userExists(params) {
+  const { username, profile, verbose } = params;
+  try {
+    _R3GUC7O7cjs.runAws.call(void 0, {
+      profile,
+      args: ["iam", "get-user", "--user-name", username],
+      verbose
+    });
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
+function ensureUser(params) {
+  const { username, profile, verbose } = params;
+  if (userExists({ username, profile, verbose })) {
+    console.log(`  User exists: ${username}`);
+    return;
+  }
+  console.log(`  Create user: ${username}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: ["iam", "create-user", "--user-name", username, "--path", "/"],
+    verbose
+  });
+}
+function ensureUserInGroup(params) {
+  const { username, group, profile, verbose } = params;
+  const existing = _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "get-group",
+      "--group-name",
+      group,
+      "--query",
+      `Users[?UserName=='${username}'].UserName`,
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  if (existing) {
+    console.log(`  Already in group: ${group}`);
+    return;
+  }
+  console.log(`  Add to group: ${group}`);
+  _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "add-user-to-group",
+      "--user-name",
+      username,
+      "--group-name",
+      group
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function createCliAccessKey(params) {
+  const { username, profile, verbose } = params;
+  const keyCountRaw = _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "list-access-keys",
+      "--user-name",
+      username,
+      "--query",
+      "length(AccessKeyMetadata)",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const keyCount = Number.parseInt(keyCountRaw, 10) || 0;
+  if (keyCount >= 2) {
+    console.log(
+      _chalk2.default.yellow(
+        `  WARNING: ${username} already has 2 access keys (AWS max).`
+      )
+    );
+    console.log(
+      _chalk2.default.yellow("  Delete an existing key before creating a new one.")
+    );
+    return false;
+  }
+  const created = _R3GUC7O7cjs.runAws.call(void 0, {
+    profile,
+    args: [
+      "iam",
+      "create-access-key",
+      "--user-name",
+      username,
+      "--query",
+      "AccessKey.[AccessKeyId,SecretAccessKey]",
+      "--output",
+      "text"
+    ],
+    expectJson: false,
+    verbose
+  });
+  const [accessKeyId, secretAccessKey] = created.split(/\s+/);
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Failed to parse the newly created access key");
+  }
+  const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+  console.log("");
+  console.log(
+    `  CLI credentials for ${username} (secret shown once \u2014 copy now):`
+  );
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log(
+    "  YOU MUST run the command below with a LEADING SPACE so it is not saved"
+  );
+  console.log('  to shell history \u2014 same idea as:  TEST="a" && echo $TEST');
+  console.log("");
+  console.log(setupCmd);
+  console.log(
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+  );
+  console.log("");
+  return true;
+}
+function ensureAclGroupsExist(params) {
+  const { profile, verbose } = params;
+  const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+    try {
+      _R3GUC7O7cjs.runAws.call(void 0, {
+        profile,
+        args: ["iam", "get-group", "--group-name", group],
+        verbose
+      });
+      return false;
+    } catch (e2) {
+      return true;
+    }
+  });
+  if (missing.length > 0) {
+    missing.forEach((group) => console.log(`  Missing group: ${group}`));
+    console.log("");
+    console.log(
+      "  Run `mtn aws iam setup-acl` first to create ACL groups and policies."
+    );
+    return false;
+  }
+  return true;
+}
+async function promptAccountName(params) {
+  const { accountName, inferredAccountName } = params;
+  if (accountName) {
+    const slug = normalizeSlug(accountName);
+    if (isValidSlug(slug)) {
+      console.log(`  Account name: ${slug}`);
+      return slug;
+    }
+    console.log("  Invalid account name option \u2014 falling back to prompt.");
+  }
+  const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+  for (; ; ) {
+    const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+    const raw = await _CMUD7LLNcjs.prompt.call(void 0, 
+      `  AWS account name${hint} \u2014 used in md-{identifier}-{account}-{role}: `
+    );
+    if (raw === "" && defaultSlug) {
+      console.log(`  \u2192 account name: ${defaultSlug}`);
+      return defaultSlug;
+    }
+    const slug = normalizeSlug(raw);
+    if (isValidSlug(slug)) {
+      if (raw !== slug) {
+        console.log(`  \u2192 account name: ${slug}`);
+      }
+      return slug;
+    }
+    console.log(
+      "  Invalid account name \u2014 use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : ".")
+    );
+  }
+}
+async function promptRole() {
+  for (; ; ) {
+    console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+    console.log("    1) read-only   \u2192 acl-read-only");
+    console.log("    2) iam-admin   \u2192 acl-iam-full-access");
+    console.log("    3) power-user  \u2192 acl-power-users");
+    const choice = await _CMUD7LLNcjs.prompt.call(void 0, "  Choice [1-3]: ");
+    switch (choice) {
+      case "1":
+      case "read-only":
+        return "read-only";
+      case "2":
+      case "iam-admin":
+        return "iam-admin";
+      case "3":
+      case "power-user":
+        return "power-user";
+      default:
+        console.log("  Invalid choice \u2014 enter 1, 2, 3, or the role name.");
+    }
+  }
+}
+async function promptIdentifier(params) {
+  const { accountName, role } = params;
+  const exampleUser = buildUsername({
+    identifier: "declan",
+    accountName,
+    role
+  });
+  for (; ; ) {
+    const raw = await _CMUD7LLNcjs.prompt.call(void 0, 
+      `  Identifier (e.g. declan, or full ${exampleUser}): `
+    );
+    const lowerRaw = normalizeSlug(raw);
+    const identifier = normalizeIdentifier({ raw, accountName, role });
+    if (isValidSlug(identifier)) {
+      if (lowerRaw !== identifier) {
+        console.log(`  \u2192 parsed identifier: ${identifier}`);
+      }
+      return identifier;
+    }
+    console.log(
+      "  Invalid identifier \u2014 use lowercase letters, numbers, and hyphens."
+    );
+    console.log("  Tip: enter just the short name (e.g. declan).");
+  }
+}
+async function createUsersInteractive(params) {
+  const { accountName: accountNameOption, profile, identity, verbose } = params;
+  if (!ensureAclGroupsExist({ profile, verbose })) {
+    return;
+  }
+  console.log("");
+  const inferredAccountName = inferAccountName({ profile, identity });
+  const accountName = await promptAccountName({
+    accountName: accountNameOption,
+    inferredAccountName
+  });
+  console.log("");
+  while (await _CMUD7LLNcjs.promptYesNo.call(void 0, { message: "  Create another user?", defaultYes: false })) {
+    console.log("");
+    const role = await promptRole();
+    const identifier = await promptIdentifier({ accountName, role });
+    const username = buildUsername({ identifier, accountName, role });
+    const group = roleToGroup(role);
+    console.log("");
+    console.log(`  \u2192 user: ${username}`);
+    console.log(`  \u2192 group: ${group}`);
+    console.log("");
+    ensureUser({ username, profile, verbose });
+    ensureUserInGroup({ username, group, profile, verbose });
+    try {
+      createCliAccessKey({ username, profile, verbose });
+    } catch (error) {
+      console.log(
+        _chalk2.default.yellow(
+          `  Could not create access key: ${error instanceof Error ? error.message : String(error)}`
+        )
+      );
+    }
+    console.log("");
+  }
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.roleToGroup = roleToGroup; exports.normalizeSlug = normalizeSlug; exports.isValidSlug = isValidSlug; exports.buildUsername = buildUsername; exports.normalizeIdentifier = normalizeIdentifier; exports.parseMdUsername = parseMdUsername; exports.inferAccountName = inferAccountName; exports.ensureUser = ensureUser; exports.ensureUserInGroup = ensureUserInGroup; exports.createCliAccessKey = createCliAccessKey; exports.ensureAclGroupsExist = ensureAclGroupsExist; exports.createUsersInteractive = createUsersInteractive;

package/cjs/__chunks/4XT5JEAS.cjs

@@ -0,0 +1 @@
+"use strict";

package/cjs/__chunks/AZEB4H4I.cjs

@@ -0,0 +1,208 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+var _WHGN5PZIcjs = require('./WHGN5PZI.cjs');
+
+
+var _NLKJIUEXcjs = require('./NLKJIUEX.cjs');
+
+
+var _KU76LC42cjs = require('./KU76LC42.cjs');
+
+
+var _N5MXFOQZcjs = require('./N5MXFOQZ.cjs');
+
+
+var _LXOOJR2Rcjs = require('./LXOOJR2R.cjs');
+
+
+var _LHE24ECKcjs = require('./LHE24ECK.cjs');
+
+
+var _2FSYDFUVcjs = require('./2FSYDFUV.cjs');
+
+
+var _WBOQ6AUNcjs = require('./WBOQ6AUN.cjs');
+
+
+var _TKNNDDIBcjs = require('./TKNNDDIB.cjs');
+
+// src/commands/aws/index.js
+function collect(value, previous) {
+  return [...previous, value];
+}
+function registerAwsCommands(program) {
+  const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
+  const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
+  iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description(
+    "Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users."
+  ).option(
+    "--restrict-regions <yes|no>",
+    "Attach the region restriction to acl-power-users (skips the prompt)"
+  ).option(
+    "--no-create-users",
+    "Skip IAM user creation after configuring groups"
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _LHE24ECKcjs.setupAclCommand.call(void 0, {
+      restrictRegions: options.restrictRegions,
+      createUsers: options.createUsers,
+      profile: options.profile,
+      region: options.region,
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  iam.command("users").summary("Interactively create IAM users and assign ACL groups").description(
+    "Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands."
+  ).option(
+    "--account-name <slug>",
+    "AWS account slug used in md-{identifier}-{account}-{role}"
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _LXOOJR2Rcjs.usersCommand.call(void 0, {
+      accountName: options.accountName,
+      profile: options.profile,
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description(
+    "Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group."
+  ).option(
+    "-p, --profile <profile>",
+    "Operate on this profile (defaults to AWS_PROFILE)"
+  ).option(
+    "--all",
+    "Scan every aws-vault profile (default when no profile is set)"
+  ).option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+    await _NLKJIUEXcjs.checkAdminCommand.call(void 0, {
+      profile: options.profile,
+      all: _nullishCoalesce(options.all, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description(
+    "Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all)."
+  ).option(
+    "-p, --profile <profile>",
+    "Operate on this profile (defaults to AWS_PROFILE)"
+  ).option(
+    "--all",
+    "Scan every aws-vault profile (default when no profile is set)"
+  ).option(
+    "--user <name>",
+    "Only remove this user (repeatable); default removes all",
+    collect,
+    []
+  ).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+    await _N5MXFOQZcjs.removeAdminCommand.call(void 0, {
+      profile: options.profile,
+      all: _nullishCoalesce(options.all, () => ( false)),
+      user: _nullishCoalesce(options.user, () => ( [])),
+      yes: _nullishCoalesce(options.yes, () => ( false)),
+      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description(
+    "Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "--user <name>",
+    "Grant to this user (repeatable); default is your own IAM user",
+    collect,
+    []
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
+    await _KU76LC42cjs.breakGlassCommand.call(void 0, {
+      profile: options.profile,
+      user: _nullishCoalesce(options.user, () => ( [])),
+      yes: _nullishCoalesce(options.yes, () => ( false)),
+      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  const ec2 = aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands");
+  ec2.command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description(
+    "Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option(
+    "--rule-name <name>",
+    'SSH rule description (default: "{FirstName} Roaming")'
+  ).option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _WHGN5PZIcjs.allowIpCommand.call(void 0, {
+      profile: options.profile,
+      region: options.region,
+      ruleName: options.ruleName,
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
+  route53.command("add-record").summary("Interactively add or update a DNS record").description(
+    "Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "-z, --zone <name-or-id>",
+    "Hosted zone name or ID (e.g. mountaindev.com)"
+  ).option(
+    "-t, --type <type>",
+    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
+  ).option(
+    "-n, --name <name>",
+    'Record name relative to the zone (e.g. "redline") or FQDN'
+  ).option("--value <value>", "Record value (e.g. CNAME target)").option(
+    "--ttl <seconds>",
+    "TTL in seconds (default: 300)",
+    (value) => Number.parseInt(value, 10)
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _WBOQ6AUNcjs.addRecordCommand.call(void 0, {
+      profile: options.profile,
+      zone: options.zone,
+      type: options.type,
+      name: options.name,
+      value: options.value,
+      ttl: options.ttl,
+      yes: _nullishCoalesce(options.yes, () => ( false)),
+      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  route53.command("remove-record").summary("Interactively delete a DNS record").description(
+    "Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting."
+  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
+    "-z, --zone <name-or-id>",
+    "Hosted zone name or ID (e.g. mountaindev.com)"
+  ).option(
+    "-t, --type <type>",
+    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
+  ).option(
+    "-n, --name <name>",
+    'Record name relative to the zone (e.g. "redline") or FQDN'
+  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _2FSYDFUVcjs.removeRecordCommand.call(void 0, {
+      profile: options.profile,
+      zone: options.zone,
+      type: options.type,
+      name: options.name,
+      yes: _nullishCoalesce(options.yes, () => ( false)),
+      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+  const ses = aws.command("ses").summary("SES operational commands").description("SES operational commands");
+  ses.command("send-email").summary("Send a test email via SES (API or SMTP)").description(
+    "Send a single test email through the SES API (default) or the SES SMTP endpoint."
+  ).requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option(
+    "--access-key-id <id>",
+    "IAM access key ID used as the SMTP username (smtp transport)"
+  ).option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    await _TKNNDDIBcjs.sendEmailCommand.call(void 0, {
+      to: options.to,
+      from: options.from,
+      subject: options.subject,
+      body: options.body,
+      transport: options.transport,
+      region: options.region,
+      profile: options.profile,
+      accessKeyId: options.accessKeyId,
+      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
+      verbose: _nullishCoalesce(options.verbose, () => ( false))
+    });
+  });
+}
+
+
+
+exports.registerAwsCommands = registerAwsCommands;