@mtndev/cli 2.0.0 → 2.0.1

package/cjs/commands/aws/ses/send-email/handler.cjs

@@ -1,12 +1,73 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _TKNNDDIBcjs = require('../../../../__chunks/TKNNDDIB.cjs');
-require('../../../../__chunks/YRHFKTW2.cjs');
-require('../../../../__chunks/GUL36IFZ.cjs');
-require('../../../../__chunks/NT2XXAI6.cjs');
-require('../../../../__chunks/N7D56LPP.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-require('../../../../__chunks/CMUD7LLN.cjs');
-
-
-exports.sendEmailCommand = _TKNNDDIBcjs.sendEmailCommand;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_ses_send_email_schema = require("./schema.cjs");
+const require_commands_aws_ses_send_email_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/ses/send-email/handler.js
+/**
+* `aws ses send-email` handler: send a single test email via the SES API or SMTP.
+* @param {unknown} options
+*/
+async function sendEmailCommand(options) {
+	try {
+		const parsed = require_commands_aws_ses_send_email_schema.sendEmailOptionsSchema.parse(options);
+		const { to, from, subject, transport, region, profile: profileOption, accessKeyId, dryRun, verbose } = parsed;
+		const body = parsed.body ?? require_commands_aws_ses_send_email_utils.defaultBody();
+		const profile = transport === "api" ? await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption }) : profileOption;
+		console.log(chalk.default.blue("\n📧 SES send-email"));
+		console.log(chalk.default.gray(`   transport: ${transport}`));
+		console.log(chalk.default.gray(`   region:    ${region}`));
+		console.log(chalk.default.gray(`   from:      ${from}`));
+		console.log(chalk.default.gray(`   to:        ${to}`));
+		console.log(chalk.default.gray(`   subject:   ${subject}`));
+		if (verbose) console.log(chalk.default.gray(`   body:      ${body}`));
+		if (dryRun) {
+			console.log(chalk.default.yellow("\n[dry-run] No email sent."));
+			return;
+		}
+		const messageId = transport === "api" ? await require_commands_aws_ses_send_email_utils.sendViaApi({
+			to,
+			from,
+			subject,
+			body,
+			region,
+			profile
+		}) : await require_commands_aws_ses_send_email_utils.sendViaSmtp({
+			to,
+			from,
+			subject,
+			body,
+			region,
+			accessKeyId
+		});
+		console.log(chalk.default.green(`\n✅ Email sent${messageId ? ` (messageId: ${messageId})` : ""}.`));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ send-email failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Troubleshooting tips:"));
+		console.error(chalk.default.yellow("   • The sender address must be verified in SES"));
+		console.error(chalk.default.yellow("   • New SES accounts are sandboxed — recipients must also be verified"));
+		console.error(chalk.default.yellow("   • For smtp transport, set SES_SMTP_USER and SES_SMTP_PASSWORD"));
+		console.error(chalk.default.yellow("   • Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.sendEmailCommand = sendEmailCommand;

package/cjs/commands/aws/ses/send-email/index.cjs

@@ -1,23 +1,9 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../../../../__chunks/XTJPQ3EX.cjs');
-
-
-var _TKNNDDIBcjs = require('../../../../__chunks/TKNNDDIB.cjs');
-
-
-
-
-var _YRHFKTW2cjs = require('../../../../__chunks/YRHFKTW2.cjs');
-require('../../../../__chunks/GUL36IFZ.cjs');
-require('../../../../__chunks/NT2XXAI6.cjs');
-
-
-var _N7D56LPPcjs = require('../../../../__chunks/N7D56LPP.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-require('../../../../__chunks/CMUD7LLN.cjs');
-
-
-
-
-
-
-exports.defaultBody = _YRHFKTW2cjs.defaultBody; exports.sendEmailCommand = _TKNNDDIBcjs.sendEmailCommand; exports.sendEmailOptionsSchema = _N7D56LPPcjs.sendEmailOptionsSchema; exports.sendViaApi = _YRHFKTW2cjs.sendViaApi; exports.sendViaSmtp = _YRHFKTW2cjs.sendViaSmtp;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ses_send_email_schema = require("./schema.cjs");
+const require_commands_aws_ses_send_email_utils = require("./utils.cjs");
+const require_commands_aws_ses_send_email_handler = require("./handler.cjs");
+exports.defaultBody = require_commands_aws_ses_send_email_utils.defaultBody;
+exports.sendEmailCommand = require_commands_aws_ses_send_email_handler.sendEmailCommand;
+exports.sendEmailOptionsSchema = require_commands_aws_ses_send_email_schema.sendEmailOptionsSchema;
+exports.sendViaApi = require_commands_aws_ses_send_email_utils.sendViaApi;
+exports.sendViaSmtp = require_commands_aws_ses_send_email_utils.sendViaSmtp;

package/cjs/commands/aws/ses/send-email/schema.cjs

@@ -1,7 +1,24 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _N7D56LPPcjs = require('../../../../__chunks/N7D56LPP.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-
-
-exports.sendEmailOptionsSchema = _N7D56LPPcjs.sendEmailOptionsSchema;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/ses/send-email/schema.js
+/**
+* Zod schema for `aws ses send-email` options.
+*/
+const sendEmailOptionsSchema = zod.z.object({
+	to: zod.z.string({ required_error: "--to <address> is required" }).describe("Recipient email address"),
+	from: zod.z.string({ required_error: "--from <address> is required" }).describe("Verified SES sender email address"),
+	subject: zod.z.string().optional().default("MTN CLI test email").describe("Email subject line"),
+	body: zod.z.string().optional().describe("Email body (defaults to a timestamp and random token)"),
+	transport: zod.z.enum(["api", "smtp"]).optional().default("api").describe("Send via the SES API (default) or SES SMTP"),
+	region: zod.z.string().optional().default("us-east-1").describe("AWS region for the SES endpoint"),
+	profile: require_commands_aws_schema.profileField,
+	accessKeyId: zod.z.string().optional().describe("IAM access key ID used as the SMTP username (smtp transport only)"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Print the email payload without sending"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof sendEmailOptionsSchema>} SendEmailOptions
+*/
+//#endregion
+exports.sendEmailOptionsSchema = sendEmailOptionsSchema;

package/cjs/commands/aws/ses/send-email/utils.cjs

@@ -1,11 +1,87 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-var _YRHFKTW2cjs = require('../../../../__chunks/YRHFKTW2.cjs');
-require('../../../../__chunks/GUL36IFZ.cjs');
-
-
-
-
-exports.defaultBody = _YRHFKTW2cjs.defaultBody; exports.sendViaApi = _YRHFKTW2cjs.sendViaApi; exports.sendViaSmtp = _YRHFKTW2cjs.sendViaSmtp;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_ses_smtp_password = require("../smtp-password.cjs");
+let crypto = require("crypto");
+//#region src/commands/aws/ses/send-email/utils.js
+/**
+* Build a default test-email body with a timestamp and random token.
+* @returns {string}
+*/
+function defaultBody() {
+	return `MTN CLI test email — random token: ${(0, crypto.randomBytes)(16).toString("hex")} — sent at ${(/* @__PURE__ */ new Date()).toISOString()}`;
+}
+/**
+* Send an email through the SES API using the AWS SDK.
+* @param {{
+*   to: string;
+*   from: string;
+*   subject: string;
+*   body: string;
+*   region: string;
+*   profile?: string;
+* }} params
+* @returns {Promise<string | undefined>} The SES message id
+*/
+async function sendViaApi(params) {
+	const { to, from, subject, body, region, profile } = params;
+	const { SESClient, SendEmailCommand } = await import("@aws-sdk/client-ses");
+	const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+	const client = new SESClient({
+		region,
+		credentials: fromNodeProviderChain(profile ? { profile } : {})
+	});
+	const command = new SendEmailCommand({
+		Source: from,
+		Destination: { ToAddresses: [to] },
+		Message: {
+			Subject: { Data: subject },
+			Body: { Text: { Data: body } }
+		}
+	});
+	return (await client.send(command)).MessageId;
+}
+/**
+* Send an email through the SES SMTP endpoint using nodemailer.
+* Credentials come from SES_SMTP_USER/SES_SMTP_PASSWORD, or the password is
+* derived from AWS_SECRET_ACCESS_KEY when only that is available.
+* @param {{
+*   to: string;
+*   from: string;
+*   subject: string;
+*   body: string;
+*   region: string;
+*   accessKeyId?: string;
+* }} params
+* @returns {Promise<string | undefined>} The SMTP message id
+*/
+async function sendViaSmtp(params) {
+	const { to, from, subject, body, region, accessKeyId } = params;
+	const user = process.env.SES_SMTP_USER ?? accessKeyId;
+	let pass = process.env.SES_SMTP_PASSWORD;
+	if (!pass) {
+		const secret = process.env.AWS_SECRET_ACCESS_KEY;
+		if (secret) pass = require_commands_aws_ses_smtp_password.calculateSmtpPassword({
+			secretAccessKey: secret,
+			region
+		});
+	}
+	if (!user || !pass) throw new Error("SMTP transport requires SES_SMTP_USER and SES_SMTP_PASSWORD, or AWS_SECRET_ACCESS_KEY (plus --access-key-id) to derive the SMTP password.");
+	const nodemailerModule = await import("nodemailer");
+	return (await (nodemailerModule.default ?? nodemailerModule).createTransport({
+		host: require_commands_aws_ses_smtp_password.smtpEndpoint(region),
+		port: 587,
+		secure: false,
+		auth: {
+			user,
+			pass
+		}
+	}).sendMail({
+		from,
+		to,
+		subject,
+		text: body
+	})).messageId;
+}
+//#endregion
+exports.defaultBody = defaultBody;
+exports.sendViaApi = sendViaApi;
+exports.sendViaSmtp = sendViaSmtp;

package/cjs/commands/aws/ses/smtp-password.cjs

@@ -1,10 +1,72 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-var _GUL36IFZcjs = require('../../../__chunks/GUL36IFZ.cjs');
-
-
-
-
-exports.SMTP_REGIONS = _GUL36IFZcjs.SMTP_REGIONS; exports.calculateSmtpPassword = _GUL36IFZcjs.calculateSmtpPassword; exports.smtpEndpoint = _GUL36IFZcjs.smtpEndpoint;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let crypto = require("crypto");
+//#region src/commands/aws/ses/smtp-password.js
+/**
+* AWS regions that expose an SES SMTP endpoint.
+*/
+const SMTP_REGIONS = /* @__PURE__ */ new Set([
+	"us-east-2",
+	"us-east-1",
+	"us-west-1",
+	"us-west-2",
+	"ap-south-1",
+	"ap-northeast-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-northeast-1",
+	"ca-central-1",
+	"eu-central-1",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"eu-south-1",
+	"eu-north-1",
+	"sa-east-1",
+	"us-gov-west-1",
+	"us-gov-east-1",
+	"me-south-1",
+	"af-south-1",
+	"il-central-1"
+]);
+const DATE = "11111111";
+const SERVICE = "ses";
+const MESSAGE = "SendRawEmail";
+const TERMINAL = "aws4_request";
+const VERSION = 4;
+/**
+* @param {Buffer} key
+* @param {string} message
+* @returns {Buffer}
+*/
+function sign(key, message) {
+	return (0, crypto.createHmac)("sha256", key).update(message, "utf8").digest();
+}
+/**
+* Derive an SES SMTP password from an IAM secret access key, following the
+* AWS Signature V4 algorithm with SES-specific constants.
+* @see https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-convert
+* @param {{ secretAccessKey: string; region: string }} params
+* @returns {string}
+*/
+function calculateSmtpPassword(params) {
+	const { secretAccessKey, region } = params;
+	if (!SMTP_REGIONS.has(region)) throw new Error(`calculateSmtpPassword: region "${region}" has no SES SMTP endpoint`);
+	let signature = sign(Buffer.from(`AWS4${secretAccessKey}`, "utf8"), DATE);
+	signature = sign(signature, region);
+	signature = sign(signature, SERVICE);
+	signature = sign(signature, TERMINAL);
+	signature = sign(signature, MESSAGE);
+	return Buffer.concat([Buffer.from([VERSION]), signature]).toString("base64");
+}
+/**
+* SES SMTP endpoint host for a region.
+* @param {string} region
+* @returns {string}
+*/
+function smtpEndpoint(region) {
+	return `email-smtp.${region}.amazonaws.com`;
+}
+//#endregion
+exports.SMTP_REGIONS = SMTP_REGIONS;
+exports.calculateSmtpPassword = calculateSmtpPassword;
+exports.smtpEndpoint = smtpEndpoint;

package/cjs/commands/aws/utils/exec-aws.cjs

@@ -1,16 +1,145 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-
-
-
-var _R3GUC7O7cjs = require('../../../__chunks/R3GUC7O7.cjs');
-
-
-
-
-
-
-
-exports.AwsCliError = _R3GUC7O7cjs.AwsCliError; exports.getCallerIdentity = _R3GUC7O7cjs.getCallerIdentity; exports.parseAwsErrorCode = _R3GUC7O7cjs.parseAwsErrorCode; exports.requireCommands = _R3GUC7O7cjs.requireCommands; exports.runAws = _R3GUC7O7cjs.runAws; exports.runAwsVault = _R3GUC7O7cjs.runAwsVault;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let child_process = require("child_process");
+//#region src/commands/aws/utils/exec-aws.js
+/**
+* Error raised when the AWS CLI (or aws-vault) exits non-zero.
+* The `code` is the AWS service error code parsed from stderr (e.g. "UnauthorizedOperation").
+*/
+var AwsCliError = class extends Error {
+	/**
+	* @param {string} message
+	* @param {string | null} [code]
+	*/
+	constructor(message, code = null) {
+		super(message);
+		this.name = "AwsCliError";
+		this.code = code;
+	}
+};
+/**
+* Extract the AWS service error code from a CLI stderr string.
+* AWS prints codes in parentheses, e.g. "...(UnauthorizedOperation) when calling...".
+* @param {string} stderr
+* @returns {string | null}
+*/
+function parseAwsErrorCode(stderr) {
+	return /\(([A-Za-z.]+)\)/.exec(stderr)?.[1] ?? null;
+}
+/**
+* Verify that the given executables are available on PATH.
+* @param {string[]} commands
+* @throws {Error} If any command is missing
+*/
+function requireCommands(commands) {
+	const missing = commands.filter((command) => {
+		return (0, child_process.spawnSync)("which", [command], { stdio: "pipe" }).status !== 0;
+	});
+	if (missing.length > 0) throw new Error(`Required command(s) not found on PATH: ${missing.join(", ")}`);
+}
+/**
+* Run an AWS CLI command using a credential profile.
+* Uses an argument array (no shell) so JSON arguments need no escaping.
+* @param {{
+*   profile?: string;
+*   region?: string;
+*   args: string[];
+*   expectJson?: boolean;
+*   verbose?: boolean;
+*   env?: Record<string, string>;
+* }} params
+* @returns {any} Parsed JSON when expectJson is true, otherwise trimmed stdout string
+*/
+function runAws(params) {
+	const { profile, region, args, expectJson = true, verbose = false, env } = params;
+	/** @type {string[]} */
+	const finalArgs = [];
+	if (profile) finalArgs.push("--profile", profile);
+	if (region) finalArgs.push("--region", region);
+	finalArgs.push("--no-cli-pager", ...args);
+	if (expectJson) finalArgs.push("--output", "json");
+	return spawnAws("aws", finalArgs, {
+		expectJson,
+		verbose,
+		env
+	});
+}
+/**
+* Run an AWS CLI command through `aws-vault exec` for profiles whose credentials
+* are stored in the OS keychain rather than ~/.aws/credentials.
+* @param {{
+*   profile: string;
+*   args: string[];
+*   duration?: string;
+*   expectJson?: boolean;
+*   verbose?: boolean;
+* }} params
+* @returns {any}
+*/
+function runAwsVault(params) {
+	const { profile, args, duration = "15m", expectJson = true, verbose = false } = params;
+	/** @type {string[]} */
+	const awsArgs = ["--no-cli-pager", ...args];
+	if (expectJson) awsArgs.push("--output", "json");
+	return spawnAws("aws-vault", [
+		"exec",
+		profile,
+		"--duration",
+		duration,
+		"--",
+		"aws",
+		...awsArgs
+	], {
+		expectJson,
+		verbose
+	});
+}
+/**
+* @param {string} command
+* @param {string[]} args
+* @param {{ expectJson: boolean; verbose: boolean; env?: Record<string, string> }} options
+* @returns {any}
+*/
+function spawnAws(command, args, options) {
+	const { expectJson, verbose, env } = options;
+	if (verbose) console.log(chalk.default.gray(`   Executing: ${command} ${args.join(" ")}`));
+	const result = (0, child_process.spawnSync)(command, args, {
+		encoding: "utf-8",
+		env: env ? {
+			...process.env,
+			...env
+		} : process.env
+	});
+	if (result.error) throw new AwsCliError(result.error.message);
+	if (result.status !== 0) {
+		const stderr = (result.stderr || result.stdout || "").trim();
+		throw new AwsCliError(stderr || `Command failed: ${command} ${args.join(" ")}`, parseAwsErrorCode(stderr));
+	}
+	const stdout = (result.stdout ?? "").trim();
+	if (!expectJson) return stdout;
+	if (!stdout) return {};
+	return JSON.parse(stdout);
+}
+/**
+* Fetch the caller identity for a profile (account id and ARN).
+* @param {{ profile?: string; region?: string; verbose?: boolean }} params
+* @returns {{ Account: string; Arn: string; UserId: string }}
+*/
+function getCallerIdentity(params) {
+	const { profile, region, verbose } = params;
+	return runAws({
+		profile,
+		region,
+		args: ["sts", "get-caller-identity"],
+		verbose
+	});
+}
+//#endregion
+exports.AwsCliError = AwsCliError;
+exports.getCallerIdentity = getCallerIdentity;
+exports.parseAwsErrorCode = parseAwsErrorCode;
+exports.requireCommands = requireCommands;
+exports.runAws = runAws;
+exports.runAwsVault = runAwsVault;

package/cjs/commands/aws/utils/resolve-policy-path.cjs

@@ -1,6 +1,15 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _3NOHGUCFcjs = require('../../../__chunks/3NOHGUCF.cjs');
-
-
-exports.resolvePolicyPath = _3NOHGUCFcjs.resolvePolicyPath;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let url = require("url");
+//#region src/commands/aws/utils/resolve-policy-path.js
+/**
+* Resolve the absolute path to a bundled IAM policy document.
+* Policies live alongside the source in `iam/policies/`, and the CLI runs from
+* source, so this path is valid at runtime.
+* @param {string} fileName - Policy JSON file name (e.g. "user-admins-write-list.json")
+* @returns {string}
+*/
+function resolvePolicyPath(fileName) {
+	return (0, url.fileURLToPath)(new URL(`../iam/policies/${fileName}`, require("url").pathToFileURL(__filename).href));
+}
+//#endregion
+exports.resolvePolicyPath = resolvePolicyPath;

package/cjs/commands/aws/utils/resolve-profile.cjs

@@ -1,11 +1,93 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-var _NT2XXAI6cjs = require('../../../__chunks/NT2XXAI6.cjs');
-require('../../../__chunks/CMUD7LLN.cjs');
-
-
-
-
-exports.listConfigProfiles = _NT2XXAI6cjs.listConfigProfiles; exports.pickProfileInteractive = _NT2XXAI6cjs.pickProfileInteractive; exports.resolveProfile = _NT2XXAI6cjs.resolveProfile;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("./tty.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let fs = require("fs");
+let path = require("path");
+let os = require("os");
+//#region src/commands/aws/utils/resolve-profile.js
+/**
+* Above this many matches we ask the user to narrow the filter rather than
+* printing an unusable wall of numbered options.
+*/
+const MAX_LISTED = 30;
+/**
+* Read profile names from ~/.aws/config (honoring AWS_CONFIG_FILE).
+* Handles both `[profile NAME]` entries and a bare `[default]` section.
+* @returns {string[]}
+*/
+function listConfigProfiles() {
+	const configPath = process.env.AWS_CONFIG_FILE ?? (0, path.join)((0, os.homedir)(), ".aws", "config");
+	let contents;
+	try {
+		contents = (0, fs.readFileSync)(configPath, "utf-8");
+	} catch {
+		return [];
+	}
+	/** @type {string[]} */
+	const profiles = [];
+	const profileRe = /^\[profile\s+(.+?)\]$/;
+	for (const rawLine of contents.split("\n")) {
+		const line = rawLine.trim();
+		const match = profileRe.exec(line);
+		if (match?.[1]) profiles.push(match[1].trim());
+		else if (line === "[default]") profiles.push("default");
+	}
+	return profiles;
+}
+/**
+* Interactively narrow a profile list by substring, then pick one.
+* A single match auto-selects; too many matches asks the user to narrow.
+* @param {string[]} profiles
+* @returns {Promise<string>}
+*/
+async function pickProfileInteractive(profiles) {
+	for (;;) {
+		const filter = (await require_commands_aws_utils_tty.prompt(chalk.default.cyan("Filter profiles (substring, Enter for all): "))).trim().toLowerCase();
+		const matches = filter ? profiles.filter((name) => name.toLowerCase().includes(filter)) : profiles;
+		if (matches.length === 0) {
+			console.log(chalk.default.yellow(`  No profiles match "${filter}". Try again.`));
+			continue;
+		}
+		if (matches.length === 1) {
+			const only = matches[0] ?? "";
+			console.log(chalk.default.green(`  → ${only}`));
+			return only;
+		}
+		if (matches.length > MAX_LISTED) {
+			console.log(chalk.default.yellow(`  ${matches.length} profiles match — narrow the filter (over ${MAX_LISTED} to list).`));
+			continue;
+		}
+		return matches[await require_commands_aws_utils_tty.promptChoice({
+			message: chalk.default.cyan("Select a profile:"),
+			options: matches
+		})] ?? "";
+	}
+}
+/**
+* Resolve the AWS profile for a single-profile command.
+*
+* Precedence: explicit `--profile`, then `AWS_PROFILE`, then — only when stdin
+* is a TTY — an interactive filter-and-pick over `~/.aws/config` profiles.
+* Returns `undefined` when nothing is set and we cannot prompt (non-interactive
+* shell, or no config profiles), leaving each command's existing "no profile"
+* handling in place.
+* @param {{ profile?: string; interactive?: boolean }} params
+* @returns {Promise<string | undefined>}
+*/
+async function resolveProfile(params) {
+	const explicit = params.profile ?? process.env.AWS_PROFILE;
+	if (explicit) return explicit;
+	if (!(params.interactive ?? Boolean(process.stdin.isTTY))) return;
+	const profiles = listConfigProfiles();
+	if (profiles.length === 0) return;
+	console.log(chalk.default.yellow("\nNo AWS profile selected (--profile and AWS_PROFILE are unset)."));
+	const chosen = await pickProfileInteractive(profiles);
+	console.log(chalk.default.gray(`Using profile "${chosen}" for this command.\n`));
+	return chosen;
+}
+//#endregion
+exports.listConfigProfiles = listConfigProfiles;
+exports.pickProfileInteractive = pickProfileInteractive;
+exports.resolveProfile = resolveProfile;