@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/route53/remove-record/handler.cjs

@@ -0,0 +1,114 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_route53_add_record_utils = require("../add-record/utils.cjs");
+const require_commands_aws_route53_add_record_handler = require("../add-record/handler.cjs");
+const require_commands_aws_route53_remove_record_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/route53/remove-record/handler.js
+/**
+* `aws route53 remove-record` handler: interactively (or via flags) delete a
+* Route53 resource record set, showing the record before it is removed.
+* @param {unknown} options
+*/
+async function removeRecordCommand(options) {
+	try {
+		const { profile: profileOption, zone: zoneOption, type: typeOption, name: nameOption, yes, dryRun, verbose } = require_commands_aws_route53_remove_record_schema.removeRecordOptionsSchema.parse(options);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		if (!profile) {
+			console.error(chalk.default.red("Error: pass --profile or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			verbose
+		});
+		console.log("Caller:");
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		const zone = await require_commands_aws_route53_add_record_handler.resolveHostedZone({
+			profile,
+			zoneOption,
+			verbose
+		});
+		console.log(`Hosted zone: ${require_commands_aws_route53_add_record_utils.hostedZoneLabel(zone)}`);
+		console.log("");
+		const type = await require_commands_aws_route53_add_record_handler.resolveRecordType(typeOption);
+		const name = await require_commands_aws_route53_add_record_handler.resolveName({
+			nameOption,
+			zoneName: zone.name
+		});
+		const existing = require_commands_aws_route53_add_record_utils.getResourceRecordSet({
+			profile,
+			hostedZoneId: zone.id,
+			name,
+			type,
+			verbose
+		});
+		if (!existing) {
+			console.log(chalk.default.yellow(`No ${type} record at ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}. Nothing to remove.`));
+			return;
+		}
+		console.log("Record to remove:");
+		console.log(`  Name:  ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}`);
+		console.log(`  Type:  ${type}`);
+		if (existing.isAlias) console.log(`  Alias: ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(String(existing.aliasTarget?.DNSName ?? ""))}`);
+		else {
+			if (existing.ttl !== void 0) console.log(`  TTL:   ${existing.ttl}`);
+			console.log(`  Value:${require_commands_aws_route53_add_record_utils.formatValues(existing.values)}`);
+		}
+		console.log("");
+		if (dryRun) {
+			console.log(chalk.default.cyan("Dry run — no changes made."));
+			return;
+		}
+		if (!yes) {
+			if (!await require_commands_aws_utils_tty.promptYesNo({
+				message: `Delete this ${type} record?`,
+				defaultYes: false
+			})) {
+				console.log("Aborted.");
+				return;
+			}
+		}
+		const changeInfo = require_commands_aws_route53_add_record_utils.deleteResourceRecordSet({
+			profile,
+			hostedZoneId: zone.id,
+			record: existing,
+			verbose
+		});
+		console.log("");
+		console.log(chalk.default.green(`Done. Deleted ${type} ${require_commands_aws_route53_add_record_utils.withoutTrailingDot(name)}.`));
+		if (changeInfo?.Id) {
+			console.log(`  Change ID: ${changeInfo.Id}`);
+			console.log(`  Status:    ${changeInfo.Status ?? "PENDING"}`);
+		}
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ remove-record failed:"));
+		if (error instanceof require_commands_aws_utils_exec_aws.AwsCliError || error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.removeRecordCommand = removeRecordCommand;

package/cjs/commands/aws/route53/remove-record/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws route53 remove-record` handler: interactively (or via flags) delete a
+ * Route53 resource record set, showing the record before it is removed.
+ * @param {unknown} options
+ */
+export function removeRecordCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/route53/remove-record/index.cjs

@@ -0,0 +1,5 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_route53_remove_record_schema = require("./schema.cjs");
+const require_commands_aws_route53_remove_record_handler = require("./handler.cjs");
+exports.removeRecordCommand = require_commands_aws_route53_remove_record_handler.removeRecordCommand;
+exports.removeRecordOptionsSchema = require_commands_aws_route53_remove_record_schema.removeRecordOptionsSchema;

package/cjs/commands/aws/route53/remove-record/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/cjs/commands/aws/route53/remove-record/schema.cjs

@@ -0,0 +1,22 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+const require_commands_aws_route53_add_record_schema = require("../add-record/schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/route53/remove-record/schema.js
+/**
+* Zod schema for `aws route53 remove-record` options.
+*/
+const removeRecordOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	zone: zod.z.string().optional().describe("Hosted zone name or ID (e.g. mountaindev.com or Z123…). Skips the zone picker when set."),
+	type: zod.z.string().optional().transform((value) => value === void 0 ? void 0 : value.toUpperCase()).refine((value) => value === void 0 || typeof value === "string" && require_commands_aws_route53_add_record_schema.RECORD_TYPES.includes(value), { message: `Record type must be one of: ${require_commands_aws_route53_add_record_schema.RECORD_TYPES.join(", ")}` }).describe(`DNS record type (${require_commands_aws_route53_add_record_schema.RECORD_TYPES.join(", ")})`),
+	name: zod.z.string().optional().describe("Record name relative to the zone (e.g. \"redline\") or a fully-qualified name"),
+	yes: zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Preview the deletion without calling Route53"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof removeRecordOptionsSchema>} RemoveRecordOptions
+*/
+//#endregion
+exports.removeRecordOptionsSchema = removeRecordOptionsSchema;

package/cjs/commands/aws/route53/remove-record/schema.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Zod schema for `aws route53 remove-record` options.
+ */
+export const removeRecordOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    zone: z.ZodOptional<z.ZodString>;
+    type: z.ZodEffects<z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>, string | undefined, string | undefined>;
+    name: z.ZodOptional<z.ZodString>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    dryRun: boolean;
+    profile?: string | undefined;
+    type?: string | undefined;
+    name?: string | undefined;
+    zone?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    type?: string | undefined;
+    dryRun?: boolean | undefined;
+    name?: string | undefined;
+    zone?: string | undefined;
+}>;
+export type RemoveRecordOptions = z.infer<typeof removeRecordOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/schema.cjs

@@ -0,0 +1,19 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let zod = require("zod");
+//#region src/commands/aws/schema.js
+/**
+* Shared Zod field for the AWS profile option.
+*/
+const profileField = zod.z.string().optional().describe("AWS profile (defaults to the AWS_PROFILE environment variable)");
+/**
+* Shared Zod field for the AWS region option.
+*/
+const regionField = zod.z.string().optional().describe("AWS region");
+/**
+* Shared Zod field for verbose logging.
+*/
+const verboseField = zod.z.boolean().optional().default(false).describe("Enable verbose logging for detailed output and error traces");
+//#endregion
+exports.profileField = profileField;
+exports.regionField = regionField;
+exports.verboseField = verboseField;

package/cjs/commands/aws/schema.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Shared Zod field for the AWS profile option.
+ */
+export const profileField: z.ZodOptional<z.ZodString>;
+/**
+ * Shared Zod field for the AWS region option.
+ */
+export const regionField: z.ZodOptional<z.ZodString>;
+/**
+ * Shared Zod field for verbose logging.
+ */
+export const verboseField: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+import { z } from "zod";

package/cjs/commands/aws/ses/send-email/handler.cjs

@@ -0,0 +1,73 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_ses_send_email_schema = require("./schema.cjs");
+const require_commands_aws_ses_send_email_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/ses/send-email/handler.js
+/**
+* `aws ses send-email` handler: send a single test email via the SES API or SMTP.
+* @param {unknown} options
+*/
+async function sendEmailCommand(options) {
+	try {
+		const parsed = require_commands_aws_ses_send_email_schema.sendEmailOptionsSchema.parse(options);
+		const { to, from, subject, transport, region, profile: profileOption, accessKeyId, dryRun, verbose } = parsed;
+		const body = parsed.body ?? require_commands_aws_ses_send_email_utils.defaultBody();
+		const profile = transport === "api" ? await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption }) : profileOption;
+		console.log(chalk.default.blue("\n📧 SES send-email"));
+		console.log(chalk.default.gray(`   transport: ${transport}`));
+		console.log(chalk.default.gray(`   region:    ${region}`));
+		console.log(chalk.default.gray(`   from:      ${from}`));
+		console.log(chalk.default.gray(`   to:        ${to}`));
+		console.log(chalk.default.gray(`   subject:   ${subject}`));
+		if (verbose) console.log(chalk.default.gray(`   body:      ${body}`));
+		if (dryRun) {
+			console.log(chalk.default.yellow("\n[dry-run] No email sent."));
+			return;
+		}
+		const messageId = transport === "api" ? await require_commands_aws_ses_send_email_utils.sendViaApi({
+			to,
+			from,
+			subject,
+			body,
+			region,
+			profile
+		}) : await require_commands_aws_ses_send_email_utils.sendViaSmtp({
+			to,
+			from,
+			subject,
+			body,
+			region,
+			accessKeyId
+		});
+		console.log(chalk.default.green(`\n✅ Email sent${messageId ? ` (messageId: ${messageId})` : ""}.`));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ send-email failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Troubleshooting tips:"));
+		console.error(chalk.default.yellow("   • The sender address must be verified in SES"));
+		console.error(chalk.default.yellow("   • New SES accounts are sandboxed — recipients must also be verified"));
+		console.error(chalk.default.yellow("   • For smtp transport, set SES_SMTP_USER and SES_SMTP_PASSWORD"));
+		console.error(chalk.default.yellow("   • Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.sendEmailCommand = sendEmailCommand;

package/cjs/commands/aws/ses/send-email/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `aws ses send-email` handler: send a single test email via the SES API or SMTP.
+ * @param {unknown} options
+ */
+export function sendEmailCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/ses/send-email/index.cjs

@@ -0,0 +1,9 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ses_send_email_schema = require("./schema.cjs");
+const require_commands_aws_ses_send_email_utils = require("./utils.cjs");
+const require_commands_aws_ses_send_email_handler = require("./handler.cjs");
+exports.defaultBody = require_commands_aws_ses_send_email_utils.defaultBody;
+exports.sendEmailCommand = require_commands_aws_ses_send_email_handler.sendEmailCommand;
+exports.sendEmailOptionsSchema = require_commands_aws_ses_send_email_schema.sendEmailOptionsSchema;
+exports.sendViaApi = require_commands_aws_ses_send_email_utils.sendViaApi;
+exports.sendViaSmtp = require_commands_aws_ses_send_email_utils.sendViaSmtp;

package/cjs/commands/aws/ses/send-email/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/ses/send-email/schema.cjs

@@ -0,0 +1,24 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/ses/send-email/schema.js
+/**
+* Zod schema for `aws ses send-email` options.
+*/
+const sendEmailOptionsSchema = zod.z.object({
+	to: zod.z.string({ required_error: "--to <address> is required" }).describe("Recipient email address"),
+	from: zod.z.string({ required_error: "--from <address> is required" }).describe("Verified SES sender email address"),
+	subject: zod.z.string().optional().default("MTN CLI test email").describe("Email subject line"),
+	body: zod.z.string().optional().describe("Email body (defaults to a timestamp and random token)"),
+	transport: zod.z.enum(["api", "smtp"]).optional().default("api").describe("Send via the SES API (default) or SES SMTP"),
+	region: zod.z.string().optional().default("us-east-1").describe("AWS region for the SES endpoint"),
+	profile: require_commands_aws_schema.profileField,
+	accessKeyId: zod.z.string().optional().describe("IAM access key ID used as the SMTP username (smtp transport only)"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Print the email payload without sending"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof sendEmailOptionsSchema>} SendEmailOptions
+*/
+//#endregion
+exports.sendEmailOptionsSchema = sendEmailOptionsSchema;

package/cjs/commands/aws/ses/send-email/schema.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Zod schema for `aws ses send-email` options.
+ */
+export const sendEmailOptionsSchema: z.ZodObject<{
+    to: z.ZodString;
+    from: z.ZodString;
+    subject: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    transport: z.ZodDefault<z.ZodOptional<z.ZodEnum<["api", "smtp"]>>>;
+    region: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    profile: z.ZodOptional<z.ZodString>;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    region: string;
+    verbose: boolean;
+    dryRun: boolean;
+    to: string;
+    from: string;
+    subject: string;
+    transport: "api" | "smtp";
+    profile?: string | undefined;
+    accessKeyId?: string | undefined;
+    body?: string | undefined;
+}, {
+    to: string;
+    from: string;
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    accessKeyId?: string | undefined;
+    subject?: string | undefined;
+    body?: string | undefined;
+    transport?: "api" | "smtp" | undefined;
+}>;
+export type SendEmailOptions = z.infer<typeof sendEmailOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/ses/send-email/utils.cjs

@@ -0,0 +1,87 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ses_smtp_password = require("../smtp-password.cjs");
+let crypto = require("crypto");
+//#region src/commands/aws/ses/send-email/utils.js
+/**
+* Build a default test-email body with a timestamp and random token.
+* @returns {string}
+*/
+function defaultBody() {
+	return `MTN CLI test email — random token: ${(0, crypto.randomBytes)(16).toString("hex")} — sent at ${(/* @__PURE__ */ new Date()).toISOString()}`;
+}
+/**
+* Send an email through the SES API using the AWS SDK.
+* @param {{
+*   to: string;
+*   from: string;
+*   subject: string;
+*   body: string;
+*   region: string;
+*   profile?: string;
+* }} params
+* @returns {Promise<string | undefined>} The SES message id
+*/
+async function sendViaApi(params) {
+	const { to, from, subject, body, region, profile } = params;
+	const { SESClient, SendEmailCommand } = await import("@aws-sdk/client-ses");
+	const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+	const client = new SESClient({
+		region,
+		credentials: fromNodeProviderChain(profile ? { profile } : {})
+	});
+	const command = new SendEmailCommand({
+		Source: from,
+		Destination: { ToAddresses: [to] },
+		Message: {
+			Subject: { Data: subject },
+			Body: { Text: { Data: body } }
+		}
+	});
+	return (await client.send(command)).MessageId;
+}
+/**
+* Send an email through the SES SMTP endpoint using nodemailer.
+* Credentials come from SES_SMTP_USER/SES_SMTP_PASSWORD, or the password is
+* derived from AWS_SECRET_ACCESS_KEY when only that is available.
+* @param {{
+*   to: string;
+*   from: string;
+*   subject: string;
+*   body: string;
+*   region: string;
+*   accessKeyId?: string;
+* }} params
+* @returns {Promise<string | undefined>} The SMTP message id
+*/
+async function sendViaSmtp(params) {
+	const { to, from, subject, body, region, accessKeyId } = params;
+	const user = process.env.SES_SMTP_USER ?? accessKeyId;
+	let pass = process.env.SES_SMTP_PASSWORD;
+	if (!pass) {
+		const secret = process.env.AWS_SECRET_ACCESS_KEY;
+		if (secret) pass = require_commands_aws_ses_smtp_password.calculateSmtpPassword({
+			secretAccessKey: secret,
+			region
+		});
+	}
+	if (!user || !pass) throw new Error("SMTP transport requires SES_SMTP_USER and SES_SMTP_PASSWORD, or AWS_SECRET_ACCESS_KEY (plus --access-key-id) to derive the SMTP password.");
+	const nodemailerModule = await import("nodemailer");
+	return (await (nodemailerModule.default ?? nodemailerModule).createTransport({
+		host: require_commands_aws_ses_smtp_password.smtpEndpoint(region),
+		port: 587,
+		secure: false,
+		auth: {
+			user,
+			pass
+		}
+	}).sendMail({
+		from,
+		to,
+		subject,
+		text: body
+	})).messageId;
+}
+//#endregion
+exports.defaultBody = defaultBody;
+exports.sendViaApi = sendViaApi;
+exports.sendViaSmtp = sendViaSmtp;

package/cjs/commands/aws/ses/send-email/utils.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Build a default test-email body with a timestamp and random token.
+ * @returns {string}
+ */
+export function defaultBody(): string;
+/**
+ * Send an email through the SES API using the AWS SDK.
+ * @param {{
+ *   to: string;
+ *   from: string;
+ *   subject: string;
+ *   body: string;
+ *   region: string;
+ *   profile?: string;
+ * }} params
+ * @returns {Promise<string | undefined>} The SES message id
+ */
+export function sendViaApi(params: {
+    to: string;
+    from: string;
+    subject: string;
+    body: string;
+    region: string;
+    profile?: string;
+}): Promise<string | undefined>;
+/**
+ * Send an email through the SES SMTP endpoint using nodemailer.
+ * Credentials come from SES_SMTP_USER/SES_SMTP_PASSWORD, or the password is
+ * derived from AWS_SECRET_ACCESS_KEY when only that is available.
+ * @param {{
+ *   to: string;
+ *   from: string;
+ *   subject: string;
+ *   body: string;
+ *   region: string;
+ *   accessKeyId?: string;
+ * }} params
+ * @returns {Promise<string | undefined>} The SMTP message id
+ */
+export function sendViaSmtp(params: {
+    to: string;
+    from: string;
+    subject: string;
+    body: string;
+    region: string;
+    accessKeyId?: string;
+}): Promise<string | undefined>;

package/cjs/commands/aws/ses/smtp-password.cjs

@@ -0,0 +1,72 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let crypto = require("crypto");
+//#region src/commands/aws/ses/smtp-password.js
+/**
+* AWS regions that expose an SES SMTP endpoint.
+*/
+const SMTP_REGIONS = /* @__PURE__ */ new Set([
+	"us-east-2",
+	"us-east-1",
+	"us-west-1",
+	"us-west-2",
+	"ap-south-1",
+	"ap-northeast-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-northeast-1",
+	"ca-central-1",
+	"eu-central-1",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"eu-south-1",
+	"eu-north-1",
+	"sa-east-1",
+	"us-gov-west-1",
+	"us-gov-east-1",
+	"me-south-1",
+	"af-south-1",
+	"il-central-1"
+]);
+const DATE = "11111111";
+const SERVICE = "ses";
+const MESSAGE = "SendRawEmail";
+const TERMINAL = "aws4_request";
+const VERSION = 4;
+/**
+* @param {Buffer} key
+* @param {string} message
+* @returns {Buffer}
+*/
+function sign(key, message) {
+	return (0, crypto.createHmac)("sha256", key).update(message, "utf8").digest();
+}
+/**
+* Derive an SES SMTP password from an IAM secret access key, following the
+* AWS Signature V4 algorithm with SES-specific constants.
+* @see https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-convert
+* @param {{ secretAccessKey: string; region: string }} params
+* @returns {string}
+*/
+function calculateSmtpPassword(params) {
+	const { secretAccessKey, region } = params;
+	if (!SMTP_REGIONS.has(region)) throw new Error(`calculateSmtpPassword: region "${region}" has no SES SMTP endpoint`);
+	let signature = sign(Buffer.from(`AWS4${secretAccessKey}`, "utf8"), DATE);
+	signature = sign(signature, region);
+	signature = sign(signature, SERVICE);
+	signature = sign(signature, TERMINAL);
+	signature = sign(signature, MESSAGE);
+	return Buffer.concat([Buffer.from([VERSION]), signature]).toString("base64");
+}
+/**
+* SES SMTP endpoint host for a region.
+* @param {string} region
+* @returns {string}
+*/
+function smtpEndpoint(region) {
+	return `email-smtp.${region}.amazonaws.com`;
+}
+//#endregion
+exports.SMTP_REGIONS = SMTP_REGIONS;
+exports.calculateSmtpPassword = calculateSmtpPassword;
+exports.smtpEndpoint = smtpEndpoint;

package/cjs/commands/aws/ses/smtp-password.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Derive an SES SMTP password from an IAM secret access key, following the
+ * AWS Signature V4 algorithm with SES-specific constants.
+ * @see https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-convert
+ * @param {{ secretAccessKey: string; region: string }} params
+ * @returns {string}
+ */
+export function calculateSmtpPassword(params: {
+    secretAccessKey: string;
+    region: string;
+}): string;
+/**
+ * SES SMTP endpoint host for a region.
+ * @param {string} region
+ * @returns {string}
+ */
+export function smtpEndpoint(region: string): string;
+/**
+ * AWS regions that expose an SES SMTP endpoint.
+ */
+export const SMTP_REGIONS: Set<string>;