@mtndev/cli 1.1.0 → 2.0.1

package/esm/commands/aws/iam/users/utils.js

@@ -0,0 +1,440 @@
+import { prompt, promptYesNo } from "../../utils/tty.js";
+import { runAws } from "../../utils/exec-aws.js";
+import chalk from "chalk";
+//#region src/commands/aws/iam/users/utils.js
+const KNOWN_ROLES = [
+	"read-only",
+	"iam-admin",
+	"power-user"
+];
+const REQUIRED_ACL_GROUPS = [
+	"acl-read-only",
+	"acl-iam-full-access",
+	"acl-power-users"
+];
+/**
+* Map a user role to its ACL group.
+* @param {string} role
+* @returns {string}
+*/
+function roleToGroup(role) {
+	switch (role) {
+		case "read-only": return "acl-read-only";
+		case "iam-admin": return "acl-iam-full-access";
+		case "power-user": return "acl-power-users";
+		default: throw new Error(`Unknown role: ${role}`);
+	}
+}
+/**
+* Lowercase and hyphenate a raw value into a slug.
+* @param {string} value
+* @returns {string}
+*/
+function normalizeSlug(value) {
+	return value.toLowerCase().replace(/ /g, "-");
+}
+/**
+* @param {string} value
+* @returns {boolean}
+*/
+function isValidSlug(value) {
+	return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+/**
+* Build the canonical IAM username.
+* @param {{ identifier: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function buildUsername(params) {
+	const { identifier, accountName, role } = params;
+	return `md-${identifier}-${accountName}-${role}`;
+}
+/**
+* Strip md- prefix, role suffix, and account suffix from a raw identifier.
+* @param {{ raw: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function normalizeIdentifier(params) {
+	const { raw, accountName, role } = params;
+	let identifier = normalizeSlug(raw);
+	if (identifier.startsWith("md-")) identifier = identifier.slice(3);
+	if (identifier.endsWith(`-${role}`)) identifier = identifier.slice(0, -(role.length + 1));
+	else for (const knownRole of KNOWN_ROLES) if (identifier.endsWith(`-${knownRole}`)) {
+		identifier = identifier.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (identifier.endsWith(`-${accountName}`)) identifier = identifier.slice(0, -(accountName.length + 1));
+	return identifier;
+}
+/**
+* Parse an md-{identifier}-{account}-{role} username into parts.
+* Identifier is the first segment; account is everything between it and the role
+* (so multi-segment account slugs still work).
+* @param {string} name - Profile name or IAM user name
+* @returns {{ identifier: string; accountName: string; role: string } | null}
+*/
+function parseMdUsername(name) {
+	let value = normalizeSlug(name);
+	if (!value.startsWith("md-")) return null;
+	value = value.slice(3);
+	const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+	/** @type {string | null} */
+	let role = null;
+	for (const knownRole of rolesByLength) if (value.endsWith(`-${knownRole}`)) {
+		role = knownRole;
+		value = value.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (!role) return null;
+	const dash = value.indexOf("-");
+	if (dash <= 0 || dash === value.length - 1) return null;
+	const identifier = value.slice(0, dash);
+	const accountName = value.slice(dash + 1);
+	if (!isValidSlug(identifier) || !isValidSlug(accountName)) return null;
+	return {
+		identifier,
+		accountName,
+		role
+	};
+}
+/**
+* Infer the AWS account slug from the caller IAM user / profile name.
+* Prefers the ARN username, then the profile string.
+* @param {{
+*   profile?: string;
+*   identity?: { Arn?: string };
+* }} params
+* @returns {string | null}
+*/
+function inferAccountName(params) {
+	const { profile, identity } = params;
+	const arn = identity?.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const parsed = parseMdUsername(candidate);
+		if (parsed) return parsed.accountName;
+	}
+	return null;
+}
+/**
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function userExists(params) {
+	const { username, profile, verbose } = params;
+	try {
+		runAws({
+			profile,
+			args: [
+				"iam",
+				"get-user",
+				"--user-name",
+				username
+			],
+			verbose
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Create the IAM user if it does not exist.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUser(params) {
+	const { username, profile, verbose } = params;
+	if (userExists({
+		username,
+		profile,
+		verbose
+	})) {
+		console.log(`  User exists: ${username}`);
+		return;
+	}
+	console.log(`  Create user: ${username}`);
+	runAws({
+		profile,
+		args: [
+			"iam",
+			"create-user",
+			"--user-name",
+			username,
+			"--path",
+			"/"
+		],
+		verbose
+	});
+}
+/**
+* Add the user to the group if not already a member.
+* @param {{ username: string; group: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUserInGroup(params) {
+	const { username, group, profile, verbose } = params;
+	if (runAws({
+		profile,
+		args: [
+			"iam",
+			"get-group",
+			"--group-name",
+			group,
+			"--query",
+			`Users[?UserName=='${username}'].UserName`,
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	})) {
+		console.log(`  Already in group: ${group}`);
+		return;
+	}
+	console.log(`  Add to group: ${group}`);
+	runAws({
+		profile,
+		args: [
+			"iam",
+			"add-user-to-group",
+			"--user-name",
+			username,
+			"--group-name",
+			group
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Create a CLI access key for the user and print a one-line setup command.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean} False when the user already has the maximum number of keys
+*/
+function createCliAccessKey(params) {
+	const { username, profile, verbose } = params;
+	const keyCountRaw = runAws({
+		profile,
+		args: [
+			"iam",
+			"list-access-keys",
+			"--user-name",
+			username,
+			"--query",
+			"length(AccessKeyMetadata)",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	});
+	if ((Number.parseInt(keyCountRaw, 10) || 0) >= 2) {
+		console.log(chalk.yellow(`  WARNING: ${username} already has 2 access keys (AWS max).`));
+		console.log(chalk.yellow("  Delete an existing key before creating a new one."));
+		return false;
+	}
+	const [accessKeyId, secretAccessKey] = runAws({
+		profile,
+		args: [
+			"iam",
+			"create-access-key",
+			"--user-name",
+			username,
+			"--query",
+			"AccessKey.[AccessKeyId,SecretAccessKey]",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	}).split(/\s+/);
+	if (!accessKeyId || !secretAccessKey) throw new Error("Failed to parse the newly created access key");
+	const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+	console.log("");
+	console.log(`  CLI credentials for ${username} (secret shown once — copy now):`);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("  YOU MUST run the command below with a LEADING SPACE so it is not saved");
+	console.log("  to shell history — same idea as:  TEST=\"a\" && echo $TEST");
+	console.log("");
+	console.log(setupCmd);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("");
+	return true;
+}
+/**
+* Verify the required ACL groups exist before creating users.
+* @param {{ profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function ensureAclGroupsExist(params) {
+	const { profile, verbose } = params;
+	const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+		try {
+			runAws({
+				profile,
+				args: [
+					"iam",
+					"get-group",
+					"--group-name",
+					group
+				],
+				verbose
+			});
+			return false;
+		} catch {
+			return true;
+		}
+	});
+	if (missing.length > 0) {
+		missing.forEach((group) => console.log(`  Missing group: ${group}`));
+		console.log("");
+		console.log("  Run `mtn aws iam setup-acl` first to create ACL groups and policies.");
+		return false;
+	}
+	return true;
+}
+/**
+* @param {{ accountName?: string; inferredAccountName?: string | null }} params
+* @returns {Promise<string>}
+*/
+async function promptAccountName(params) {
+	const { accountName, inferredAccountName } = params;
+	if (accountName) {
+		const slug = normalizeSlug(accountName);
+		if (isValidSlug(slug)) {
+			console.log(`  Account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name option — falling back to prompt.");
+	}
+	const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+	for (;;) {
+		const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+		const raw = await prompt(`  AWS account name${hint} — used in md-{identifier}-{account}-{role}: `);
+		if (raw === "" && defaultSlug) {
+			console.log(`  → account name: ${defaultSlug}`);
+			return defaultSlug;
+		}
+		const slug = normalizeSlug(raw);
+		if (isValidSlug(slug)) {
+			if (raw !== slug) console.log(`  → account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name — use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : "."));
+	}
+}
+/**
+* @returns {Promise<string>}
+*/
+async function promptRole() {
+	for (;;) {
+		console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+		console.log("    1) read-only   → acl-read-only");
+		console.log("    2) iam-admin   → acl-iam-full-access");
+		console.log("    3) power-user  → acl-power-users");
+		switch (await prompt("  Choice [1-3]: ")) {
+			case "1":
+			case "read-only": return "read-only";
+			case "2":
+			case "iam-admin": return "iam-admin";
+			case "3":
+			case "power-user": return "power-user";
+			default: console.log("  Invalid choice — enter 1, 2, 3, or the role name.");
+		}
+	}
+}
+/**
+* @param {{ accountName: string; role: string }} params
+* @returns {Promise<string>}
+*/
+async function promptIdentifier(params) {
+	const { accountName, role } = params;
+	const exampleUser = buildUsername({
+		identifier: "declan",
+		accountName,
+		role
+	});
+	for (;;) {
+		const raw = await prompt(`  Identifier (e.g. declan, or full ${exampleUser}): `);
+		const lowerRaw = normalizeSlug(raw);
+		const identifier = normalizeIdentifier({
+			raw,
+			accountName,
+			role
+		});
+		if (isValidSlug(identifier)) {
+			if (lowerRaw !== identifier) console.log(`  → parsed identifier: ${identifier}`);
+			return identifier;
+		}
+		console.log("  Invalid identifier — use lowercase letters, numbers, and hyphens.");
+		console.log("  Tip: enter just the short name (e.g. declan).");
+	}
+}
+/**
+* Interactively create IAM users, assign ACL groups, and print CLI credentials.
+* @param {{
+*   accountName?: string;
+*   profile?: string;
+*   identity?: { Arn?: string };
+*   verbose?: boolean;
+* }} params
+*/
+async function createUsersInteractive(params) {
+	const { accountName: accountNameOption, profile, identity, verbose } = params;
+	if (!ensureAclGroupsExist({
+		profile,
+		verbose
+	})) return;
+	console.log("");
+	const accountName = await promptAccountName({
+		accountName: accountNameOption,
+		inferredAccountName: inferAccountName({
+			profile,
+			identity
+		})
+	});
+	console.log("");
+	while (await promptYesNo({
+		message: "  Create another user?",
+		defaultYes: false
+	})) {
+		console.log("");
+		const role = await promptRole();
+		const username = buildUsername({
+			identifier: await promptIdentifier({
+				accountName,
+				role
+			}),
+			accountName,
+			role
+		});
+		const group = roleToGroup(role);
+		console.log("");
+		console.log(`  → user: ${username}`);
+		console.log(`  → group: ${group}`);
+		console.log("");
+		ensureUser({
+			username,
+			profile,
+			verbose
+		});
+		ensureUserInGroup({
+			username,
+			group,
+			profile,
+			verbose
+		});
+		try {
+			createCliAccessKey({
+				username,
+				profile,
+				verbose
+			});
+		} catch (error) {
+			console.log(chalk.yellow(`  Could not create access key: ${error instanceof Error ? error.message : String(error)}`));
+		}
+		console.log("");
+	}
+}
+//#endregion
+export { buildUsername, createCliAccessKey, createUsersInteractive, ensureAclGroupsExist, ensureUser, ensureUserInGroup, inferAccountName, isValidSlug, normalizeIdentifier, normalizeSlug, parseMdUsername, roleToGroup };

package/esm/commands/aws/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Register the `aws` command group and its subcommands on the root program.
+ * @param {import('commander').Command} program
+ */
+export function registerAwsCommands(program: import("commander").Command): void;
+export * from "./ec2/allow-ip/index.js";
+export * from "./iam/break-glass/index.js";
+export * from "./iam/check-admin/index.js";
+export * from "./iam/remove-admin/index.js";
+export * from "./iam/setup-acl/index.js";
+export * from "./iam/users/index.js";
+export * from "./route53/add-record/index.js";
+export * from "./route53/remove-record/index.js";
+export * from "./ses/send-email/index.js";

package/esm/commands/aws/index.js

@@ -0,0 +1,142 @@
+import { sendEmailOptionsSchema } from "./ses/send-email/schema.js";
+import { defaultBody, sendViaApi, sendViaSmtp } from "./ses/send-email/utils.js";
+import { sendEmailCommand } from "./ses/send-email/handler.js";
+import "./ses/send-email/index.js";
+import { DEFAULT_TTL, RECORD_TYPES, addRecordOptionsSchema } from "./route53/add-record/schema.js";
+import { bareHostedZoneId, deleteResourceRecordSet, findCnameConflicts, findHostedZone, formatValues, getRecordSetsAtName, getResourceRecordSet, hostedZoneLabel, listHostedZones, normalizeRecordValue, planRecordChange, resolveRecordName, upsertResourceRecordSet, withTrailingDot, withoutTrailingDot } from "./route53/add-record/utils.js";
+import { addRecordCommand, resolveHostedZone, resolveName, resolveRecordType } from "./route53/add-record/handler.js";
+import { removeRecordOptionsSchema } from "./route53/remove-record/schema.js";
+import { removeRecordCommand } from "./route53/remove-record/handler.js";
+import "./route53/remove-record/index.js";
+import "./route53/add-record/index.js";
+import { usersOptionsSchema } from "./iam/users/schema.js";
+import { buildUsername, createCliAccessKey, createUsersInteractive, ensureAclGroupsExist, ensureUser, ensureUserInGroup, inferAccountName, isValidSlug, normalizeIdentifier, normalizeSlug, parseMdUsername, roleToGroup } from "./iam/users/utils.js";
+import { usersCommand } from "./iam/users/handler.js";
+import "./iam/users/index.js";
+import { setupAclOptionsSchema } from "./iam/setup-acl/schema.js";
+import { ACL_GROUPS, CUSTOM_POLICIES, attach, detach, ensureGroup, printFinalState, publishPolicy } from "./iam/setup-acl/utils.js";
+import { setupAclCommand } from "./iam/setup-acl/handler.js";
+import "./iam/setup-acl/index.js";
+import { ADMIN_GROUP_NAME } from "./iam/admin-group.js";
+import { removeAdminOptionsSchema } from "./iam/remove-admin/schema.js";
+import { removeAdminCommand } from "./iam/remove-admin/handler.js";
+import "./iam/remove-admin/index.js";
+import { checkAdminOptionsSchema } from "./iam/check-admin/schema.js";
+import { checkAdminCommand } from "./iam/check-admin/handler.js";
+import "./iam/check-admin/index.js";
+import { breakGlassOptionsSchema } from "./iam/break-glass/schema.js";
+import { breakGlassCommand } from "./iam/break-glass/handler.js";
+import "./iam/break-glass/index.js";
+import { DEFAULT_REGION, DEFAULT_ROAMING_NAME, SSH_PORT, allowIpOptionsSchema } from "./ec2/allow-ip/schema.js";
+import { authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel, sshRuleLabel } from "./ec2/allow-ip/utils.js";
+import { allowIpCommand } from "./ec2/allow-ip/handler.js";
+import "./ec2/allow-ip/index.js";
+//#region src/commands/aws/index.js
+/**
+* Commander collector for repeatable options.
+* @param {string} value
+* @param {string[]} previous
+* @returns {string[]}
+*/
+function collect(value, previous) {
+	return [...previous, value];
+}
+/**
+* Register the `aws` command group and its subcommands on the root program.
+* @param {import('commander').Command} program
+*/
+function registerAwsCommands(program) {
+	const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
+	const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
+	iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description("Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users.").option("--restrict-regions <yes|no>", "Attach the region restriction to acl-power-users (skips the prompt)").option("--no-create-users", "Skip IAM user creation after configuring groups").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await setupAclCommand({
+			restrictRegions: options.restrictRegions,
+			createUsers: options.createUsers,
+			profile: options.profile,
+			region: options.region,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("users").summary("Interactively create IAM users and assign ACL groups").description("Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands.").option("--account-name <slug>", "AWS account slug used in md-{identifier}-{account}-{role}").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await usersCommand({
+			accountName: options.accountName,
+			profile: options.profile,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description("Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group.").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await checkAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description("Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all).").option("-p, --profile <profile>", "Operate on this profile (defaults to AWS_PROFILE)").option("--all", "Scan every aws-vault profile (default when no profile is set)").option("--user <name>", "Only remove this user (repeatable); default removes all", collect, []).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
+		await removeAdminCommand({
+			profile: options.profile,
+			all: options.all ?? false,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description("Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("--user <name>", "Grant to this user (repeatable); default is your own IAM user", collect, []).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
+		await breakGlassCommand({
+			profile: options.profile,
+			user: options.user ?? [],
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands").command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description("Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("--rule-name <name>", "SSH rule description (default: \"{FirstName} Roaming\")").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await allowIpCommand({
+			profile: options.profile,
+			region: options.region,
+			ruleName: options.ruleName,
+			verbose: options.verbose ?? false
+		});
+	});
+	const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
+	route53.command("add-record").summary("Interactively add or update a DNS record").description("Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("--value <value>", "Record value (e.g. CNAME target)").option("--ttl <seconds>", "TTL in seconds (default: 300)", (value) => Number.parseInt(value, 10)).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await addRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			value: options.value,
+			ttl: options.ttl,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	route53.command("remove-record").summary("Interactively delete a DNS record").description("Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting.").option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-z, --zone <name-or-id>", "Hosted zone name or ID (e.g. mountaindev.com)").option("-t, --type <type>", "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)").option("-n, --name <name>", "Record name relative to the zone (e.g. \"redline\") or FQDN").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await removeRecordCommand({
+			profile: options.profile,
+			zone: options.zone,
+			type: options.type,
+			name: options.name,
+			yes: options.yes ?? false,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+	aws.command("ses").summary("SES operational commands").description("SES operational commands").command("send-email").summary("Send a test email via SES (API or SMTP)").description("Send a single test email through the SES API (default) or the SES SMTP endpoint.").requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option("--access-key-id <id>", "IAM access key ID used as the SMTP username (smtp transport)").option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+		await sendEmailCommand({
+			to: options.to,
+			from: options.from,
+			subject: options.subject,
+			body: options.body,
+			transport: options.transport,
+			region: options.region,
+			profile: options.profile,
+			accessKeyId: options.accessKeyId,
+			dryRun: options.dryRun ?? false,
+			verbose: options.verbose ?? false
+		});
+	});
+}
+//#endregion
+export { ACL_GROUPS, ADMIN_GROUP_NAME, CUSTOM_POLICIES, DEFAULT_REGION, DEFAULT_ROAMING_NAME, DEFAULT_TTL, RECORD_TYPES, SSH_PORT, addRecordCommand, addRecordOptionsSchema, allowIpCommand, allowIpOptionsSchema, attach, authorizeRule, bareHostedZoneId, breakGlassCommand, breakGlassOptionsSchema, buildUsername, checkAdminCommand, checkAdminOptionsSchema, createCliAccessKey, createUsersInteractive, defaultBody, deleteResourceRecordSet, describeSecurityGroups, detach, ensureAclGroupsExist, ensureGroup, ensureUser, ensureUserInGroup, extractRoamingFirstName, findCnameConflicts, findHostedZone, formatValues, getCurrentPublicIp, getRecordSetsAtName, getResourceRecordSet, getSecurityGroupDetails, hostedZoneLabel, inferAccountName, instanceLabel, isValidSlug, listEnabledRegions, listHostedZones, listInstances, listSshIngressRules, normalizeIdentifier, normalizeRecordValue, normalizeSlug, parseMdUsername, planRecordChange, printFinalState, printSshRules, publishPolicy, registerAwsCommands, removeAdminCommand, removeAdminOptionsSchema, removeRecordCommand, removeRecordOptionsSchema, resolveHostedZone, resolveName, resolveRecordName, resolveRecordType, resolveRoamingRule, revokeRule, roamingRuleDescription, roleToGroup, ruleAlreadyAllowsIp, securityGroupLabel, sendEmailCommand, sendEmailOptionsSchema, sendViaApi, sendViaSmtp, setupAclCommand, setupAclOptionsSchema, sshRuleLabel, upsertResourceRecordSet, usersCommand, usersOptionsSchema, withTrailingDot, withoutTrailingDot };

package/esm/commands/aws/route53/add-record/handler.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Resolve the hosted zone: from --zone, or interactive picker.
+ * @param {{
+ *   profile?: string;
+ *   zoneOption?: string;
+ *   verbose: boolean;
+ * }} params
+ * @returns {Promise<import("./utils.js").HostedZone>}
+ */
+export function resolveHostedZone(params: {
+    profile?: string;
+    zoneOption?: string;
+    verbose: boolean;
+}): Promise<import("./utils.js").HostedZone>;
+/**
+ * Resolve record type from --type or interactive picker.
+ * @param {string | undefined} typeOption
+ * @returns {Promise<string>}
+ */
+export function resolveRecordType(typeOption: string | undefined): Promise<string>;
+/**
+ * Resolve record name from --name or prompt.
+ * @param {{ nameOption?: string; zoneName: string }} params
+ * @returns {Promise<string>} FQDN with trailing dot
+ */
+export function resolveName(params: {
+    nameOption?: string;
+    zoneName: string;
+}): Promise<string>;
+/**
+ * `aws route53 add-record` handler: interactively (or via flags) create or
+ * update a Route53 resource record set, showing whether the change adds or
+ * overwrites.
+ * @param {unknown} options
+ */
+export function addRecordCommand(options: unknown): Promise<void>;