Function bodies 796 total

func (c *Client) ListCWAlarms(ctx context.Context, stateFilter string) ([]CWAlarm, error) {
	input := &cloudwatch.DescribeAlarmsInput{
		AlarmTypes: []cwtypes.AlarmType{cwtypes.AlarmTypeMetricAlarm},
	}
	if stateFilter != "" {
		input.StateValue = cwtypes.StateValue(stateFilter)
	}

	var alarms []CWAlarm
	paginator := cloudwatch.NewDescribeAlarmsPaginator(c.CW, input)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		for _, a := range page.MetricAlarms {
			alarms = append(alarms, cwAlarmFromMetric(a))
		}
	}
	return alarms, nil
}

func (c *Client) DescribeCWAlarm(ctx context.Context, alarmName string) (*CWAlarmDetail, error) {
	out, err := c.CW.DescribeAlarms(ctx, &cloudwatch.DescribeAlarmsInput{
		AlarmNames: []string{alarmName},
		AlarmTypes: []cwtypes.AlarmType{cwtypes.AlarmTypeMetricAlarm},
	})
	if err != nil {
		return nil, err
	}
	if len(out.MetricAlarms) == 0 {
		return nil, nil
	}

	a := out.MetricAlarms[0]
	detail := &CWAlarmDetail{
		CWAlarm:     cwAlarmFromMetric(a),
		Description: derefStrAws(a.AlarmDescription),
		Threshold:   derefFloat64(a.Threshold),
		EvalPeriods: int(derefInt32(a.EvaluationPeriods)),
		Period:      int(derefInt32(a.Period)),
		TreatMissing: derefStrAws(a.TreatMissingData),
	}
	if a.ComparisonOperator != "" {
		detail.ComparisonOp = string(a.ComparisonOperator)
	}
	if a.Statistic != "" {
		detail.Statistic = string(a.Statistic)
	}
	detail.Dimensions = make(map[string]string)
	for _, d := range a.Dimensions {
		if d.Name != nil && d.Value != nil {
			detail.Dimensions[*d.Name] = 

func (c *Client) EnableAlarmActions(ctx context.Context, alarmName string) error {
	_, err := c.CW.EnableAlarmActions(ctx, &cloudwatch.EnableAlarmActionsInput{
		AlarmNames: []string{alarmName},
	})
	return err
}

func (c *Client) DisableAlarmActions(ctx context.Context, alarmName string) error {
	_, err := c.CW.DisableAlarmActions(ctx, &cloudwatch.DisableAlarmActionsInput{
		AlarmNames: []string{alarmName},
	})
	return err
}

func (c *Client) SetAlarmState(ctx context.Context, alarmName, state, reason string) error {
	_, err := c.CW.SetAlarmState(ctx, &cloudwatch.SetAlarmStateInput{
		AlarmName:   &alarmName,
		StateValue:  cwtypes.StateValue(state),
		StateReason: &reason,
	})
	return err
}

func cwAlarmFromMetric(a cwtypes.MetricAlarm) CWAlarm {
	return CWAlarm{
		Name:           derefStrAws(a.AlarmName),
		State:          string(a.StateValue),
		StateReason:    derefStrAws(a.StateReason),
		StateUpdatedAt: derefTimeAws(a.StateUpdatedTimestamp),
		MetricName:     derefStrAws(a.MetricName),
		Namespace:      derefStrAws(a.Namespace),
		ActionsEnabled: a.ActionsEnabled != nil && *a.ActionsEnabled,
		AlarmARN:       derefStrAws(a.AlarmArn),
	}
}

func derefFloat64(p *float64) float64 {
	if p != nil {
		return *p
	}
	return 0
}

func derefInt32(p *int32) int32 {
	if p != nil {
		return *p
	}
	return 0
}

func NewClient(ctx context.Context, region, profile string) (*Client, error) {
	var opts []func(*config.LoadOptions) error

	if region != "" {
		opts = append(opts, config.WithRegion(region))
	}
	if profile != "" {
		opts = append(opts, config.WithSharedConfigProfile(profile))
	}

	cfg, err := config.LoadDefaultConfig(ctx, opts...)
	if err != nil {
		return nil, err
	}

	return &Client{
		ECS:    ecs.NewFromConfig(cfg),
		Logs:   cloudwatchlogs.NewFromConfig(cfg),
		CW:     cloudwatch.NewFromConfig(cfg),
		SSM:    ssm.NewFromConfig(cfg),
		SM:     secretsmanager.NewFromConfig(cfg),
		S3:     s3.NewFromConfig(cfg),
		Lambda:   lambda.NewFromConfig(cfg),
		DynamoDB: dynamodb.NewFromConfig(cfg),
		SQS:       sqs.NewFromConfig(cfg),
		CodeBuild: codebuild.NewFromConfig(cfg),
		EC2:       ec2.NewFromConfig(cfg),
		ECR:       ecr.NewFromConfig(cfg),
		Route53:   route53.NewFromConfig(cfg),
		cfg:       cfg,
		region:    cfg.Region,
	}, nil
}

func (c *Client) Region() string {
	return c.region
}

func (c *Client) SwitchRegion(ctx context.Context, region string) error {
	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(region))
	if err != nil {
		return err
	}

	c.ECS = ecs.NewFromConfig(cfg)
	c.Logs = cloudwatchlogs.NewFromConfig(cfg)
	c.CW = cloudwatch.NewFromConfig(cfg)
	c.SSM = ssm.NewFromConfig(cfg)
	c.SM = secretsmanager.NewFromConfig(cfg)
	c.S3 = s3.NewFromConfig(cfg)
	c.Lambda = lambda.NewFromConfig(cfg)
	c.DynamoDB = dynamodb.NewFromConfig(cfg)
	c.SQS = sqs.NewFromConfig(cfg)
	c.CodeBuild = codebuild.NewFromConfig(cfg)
	c.EC2 = ec2.NewFromConfig(cfg)
	c.ECR = ecr.NewFromConfig(cfg)
	c.Route53 = route53.NewFromConfig(cfg)
	c.cfg = cfg
	c.region = region
	return nil
}

func (c *Client) ListCBProjects(ctx context.Context) ([]CBProject, error) {
	var projectNames []string
	paginator := codebuild.NewListProjectsPaginator(c.CodeBuild, &codebuild.ListProjectsInput{
		SortBy:    cbtypes.ProjectSortByTypeLastModifiedTime,
		SortOrder: cbtypes.SortOrderTypeDescending,
	})
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		projectNames = append(projectNames, page.Projects...)
	}

	if len(projectNames) == 0 {
		return nil, nil
	}

	// Fetch project details in batches of 100
	var projects []CBProject
	for i := 0; i < len(projectNames); i += 100 {
		end := min(i+100, len(projectNames))
		batch, err := c.CodeBuild.BatchGetProjects(ctx, &codebuild.BatchGetProjectsInput{
			Names: projectNames[i:end],
		})
		if err != nil {
			return nil, err
		}
		for _, p := range batch.Projects {
			proj := CBProject{
				Name:        derefStrAws(p.Name),
				Description: derefStrAws(p.Description),
			}
			if p.Sour

func (c *Client) ListCBBuilds(ctx context.Context, projectName string, maxBuilds int) ([]CBBuild, error) {
	var buildIDs []string
	input := &codebuild.ListBuildsForProjectInput{
		ProjectName: &projectName,
		SortOrder:   cbtypes.SortOrderTypeDescending,
	}
	// Collect up to maxBuilds IDs
	paginator := codebuild.NewListBuildsForProjectPaginator(c.CodeBuild, input)
	for paginator.HasMorePages() && len(buildIDs) < maxBuilds {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		buildIDs = append(buildIDs, page.Ids...)
	}
	if len(buildIDs) > maxBuilds {
		buildIDs = buildIDs[:maxBuilds]
	}
	if len(buildIDs) == 0 {
		return nil, nil
	}

	return c.batchGetBuilds(ctx, buildIDs)
}

func (c *Client) GetCBBuildDetail(ctx context.Context, buildID string) (*CBBuildDetail, error) {
	out, err := c.CodeBuild.BatchGetBuilds(ctx, &codebuild.BatchGetBuildsInput{
		Ids: []string{buildID},
	})
	if err != nil {
		return nil, err
	}
	if len(out.Builds) == 0 {
		return nil, nil
	}

	b := out.Builds[0]
	detail := &CBBuildDetail{
		CBBuild:     buildFromSDK(b),
		ProjectName: derefStrAws(b.ProjectName),
		Arn:         derefStrAws(b.Arn),
	}

	if b.Source != nil {
		detail.Source = CBSource{
			Type:     string(b.Source.Type),
			Location: derefStrAws(b.Source.Location),
		}
	}
	if b.SourceVersion != nil {
		detail.Source.Version = *b.SourceVersion
	}

	if b.Logs != nil {
		detail.LogGroupName = derefStrAws(b.Logs.GroupName)
		detail.LogStreamName = derefStrAws(b.Logs.StreamName)
	}

	for _, p := range b.Phases {
		phase := CBBuildPhase{
			Name:   string(p.PhaseType),
			Status: string(p.PhaseStatus),
		}
		if p.DurationInSeconds != nil {
			phase.Duration = time.Duration(*p.Dura

func (c *Client) StartCBBuild(ctx context.Context, projectName string, sourceVersion string) (*CBBuild, error) {
	input := &codebuild.StartBuildInput{
		ProjectName: &projectName,
	}
	if sourceVersion != "" {
		input.SourceVersion = &sourceVersion
	}
	out, err := c.CodeBuild.StartBuild(ctx, input)
	if err != nil {
		return nil, err
	}
	if out.Build == nil {
		return nil, nil
	}
	build := buildFromSDK(*out.Build)
	return &build, nil
}

func (c *Client) StopCBBuild(ctx context.Context, buildID string) error {
	_, err := c.CodeBuild.StopBuild(ctx, &codebuild.StopBuildInput{
		Id: &buildID,
	})
	return err
}

func (c *Client) batchGetBuilds(ctx context.Context, ids []string) ([]CBBuild, error) {
	var builds []CBBuild
	for i := 0; i < len(ids); i += 100 {
		end := min(i+100, len(ids))
		out, err := c.CodeBuild.BatchGetBuilds(ctx, &codebuild.BatchGetBuildsInput{
			Ids: ids[i:end],
		})
		if err != nil {
			return nil, err
		}
		for _, b := range out.Builds {
			builds = append(builds, buildFromSDK(b))
		}
	}
	sort.Slice(builds, func(i, j int) bool {
		return builds[i].StartTime.After(builds[j].StartTime)
	})
	return builds, nil
}

func buildFromSDK(b cbtypes.Build) CBBuild {
	build := CBBuild{
		ID:            derefStrAws(b.Id),
		Status:        string(b.BuildStatus),
		Initiator:     derefStrAws(b.Initiator),
		SourceVersion: derefStrAws(b.SourceVersion),
		CurrentPhase:  derefStrAws(b.CurrentPhase),
	}
	if b.BuildNumber != nil {
		build.BuildNumber = *b.BuildNumber
	}
	if b.StartTime != nil {
		build.StartTime = *b.StartTime
	}
	if b.EndTime != nil {
		build.EndTime = *b.EndTime
		build.Duration = build.EndTime.Sub(build.StartTime)
	}
	return build
}

func (c *Client) ListDynamoTables(ctx context.Context, filter string) ([]string, error) {
	var tables []string
	var lastTable *string

	for {
		input := &dynamodb.ListTablesInput{
			ExclusiveStartTableName: lastTable,
		}
		out, err := c.DynamoDB.ListTables(ctx, input)
		if err != nil {
			return nil, err
		}
		for _, t := range out.TableNames {
			if filter == "" || strings.Contains(strings.ToLower(t), strings.ToLower(filter)) {
				tables = append(tables, t)
			}
		}
		if out.LastEvaluatedTableName == nil {
			break
		}
		lastTable = out.LastEvaluatedTableName
	}
	return tables, nil
}

func (c *Client) DescribeDynamoTable(ctx context.Context, tableName string) (*DynamoTable, error) {
	out, err := c.DynamoDB.DescribeTable(ctx, &dynamodb.DescribeTableInput{
		TableName: &tableName,
	})
	if err != nil {
		return nil, err
	}

	td := out.Table
	table := &DynamoTable{
		Name:   derefStrAws(td.TableName),
		Status: string(td.TableStatus),
	}
	if td.ItemCount != nil {
		table.ItemCount = *td.ItemCount
	}
	if td.TableSizeBytes != nil {
		table.SizeBytes = *td.TableSizeBytes
	}
	if td.BillingModeSummary != nil {
		table.BillingMode = string(td.BillingModeSummary.BillingMode)
	}

	// Key schema
	attrTypes := map[string]string{}
	for _, ad := range td.AttributeDefinitions {
		if ad.AttributeName != nil {
			attrTypes[*ad.AttributeName] = string(ad.AttributeType)
		}
	}
	for _, ks := range td.KeySchema {
		if ks.AttributeName != nil {
			table.KeySchema = append(table.KeySchema, DynamoKeyElement{
				Name:     *ks.AttributeName,
				Type:     string(ks.KeyType),
				AttrType: att

func (c *Client) ScanDynamoTable(ctx context.Context, tableName string, limit int, startKey map[string]dbtypes.AttributeValue) (*DynamoScanResult, error) {
	input := &dynamodb.ScanInput{
		TableName: &tableName,
	}
	if limit > 0 {
		l := int32(limit)
		input.Limit = &l
	}
	if len(startKey) > 0 {
		input.ExclusiveStartKey = startKey
	}

	out, err := c.DynamoDB.Scan(ctx, input)
	if err != nil {
		return nil, err
	}

	items := make([]DynamoItem, 0, len(out.Items))
	for _, item := range out.Items {
		var m DynamoItem
		if err := attributevalue.UnmarshalMap(item, &m); err != nil {
			continue
		}
		items = append(items, m)
	}

	return &DynamoScanResult{
		Items:            items,
		Count:            int(out.Count),
		ScannedCount:     int(out.ScannedCount),
		LastEvaluatedKey: out.LastEvaluatedKey,
	}, nil
}

func (c *Client) ScanDynamoTableWithFilter(ctx context.Context, tableName, attrName, operator, value string, limit int, startKey map[string]dbtypes.AttributeValue) (*DynamoScanResult, error) {
	filterExpr := fmt.Sprintf("#attr %s :val", operator)
	input := &dynamodb.ScanInput{
		TableName:        &tableName,
		FilterExpression: &filterExpr,
		ExpressionAttributeNames: map[string]string{
			"#attr": attrName,
		},
		ExpressionAttributeValues: map[string]dbtypes.AttributeValue{
			":val": &dbtypes.AttributeValueMemberS{Value: value},
		},
	}
	if limit > 0 {
		l := int32(limit)
		input.Limit = &l
	}
	if len(startKey) > 0 {
		input.ExclusiveStartKey = startKey
	}

	out, err := c.DynamoDB.Scan(ctx, input)
	if err != nil {
		return nil, err
	}

	items := make([]DynamoItem, 0, len(out.Items))
	for _, item := range out.Items {
		var m DynamoItem
		if err := attributevalue.UnmarshalMap(item, &m); err != nil {
			continue
		}
		items = append(items, m)
	}

	return &DynamoScanResult{
		Items:    

func (c *Client) ScanDynamoTableWithFuncFilter(ctx context.Context, tableName, attrName, funcName, value string, limit int, startKey map[string]dbtypes.AttributeValue) (*DynamoScanResult, error) {
	filterExpr := fmt.Sprintf("%s(#attr, :val)", funcName)
	input := &dynamodb.ScanInput{
		TableName:        &tableName,
		FilterExpression: &filterExpr,
		ExpressionAttributeNames: map[string]string{
			"#attr": attrName,
		},
		ExpressionAttributeValues: map[string]dbtypes.AttributeValue{
			":val": &dbtypes.AttributeValueMemberS{Value: value},
		},
	}
	if limit > 0 {
		l := int32(limit)
		input.Limit = &l
	}
	if len(startKey) > 0 {
		input.ExclusiveStartKey = startKey
	}

	out, err := c.DynamoDB.Scan(ctx, input)
	if err != nil {
		return nil, err
	}

	items := make([]DynamoItem, 0, len(out.Items))
	for _, item := range out.Items {
		var m DynamoItem
		if err := attributevalue.UnmarshalMap(item, &m); err != nil {
			continue
		}
		items = append(items, m)
	}

	return &DynamoScanResult{
		Item

func (c *Client) ExecutePartiQL(ctx context.Context, statement string) ([]DynamoItem, error) {
	out, err := c.DynamoDB.ExecuteStatement(ctx, &dynamodb.ExecuteStatementInput{
		Statement: &statement,
	})
	if err != nil {
		return nil, err
	}

	items := make([]DynamoItem, 0, len(out.Items))
	for _, item := range out.Items {
		var m DynamoItem
		if err := attributevalue.UnmarshalMap(item, &m); err != nil {
			continue
		}
		items = append(items, m)
	}
	return items, nil
}

func (c *Client) GetDynamoItem(ctx context.Context, tableName string, keyAV map[string]dbtypes.AttributeValue) (*DynamoItem, error) {
	out, err := c.DynamoDB.GetItem(ctx, &dynamodb.GetItemInput{
		TableName: &tableName,
		Key:       keyAV,
	})
	if err != nil {
		return nil, err
	}
	if out.Item == nil {
		return nil, nil
	}
	var item DynamoItem
	if err := attributevalue.UnmarshalMap(out.Item, &item); err != nil {
		return nil, err
	}
	return &item, nil
}

func (c *Client) UpdateDynamoField(ctx context.Context, tableName string, keyItem map[string]dbtypes.AttributeValue, attrName, newValue string) error {
	// Try to detect the value type and build the appropriate AttributeValue
	av := inferAttributeValue(newValue)

	expr := "SET #attr = :val"
	input := &dynamodb.UpdateItemInput{
		TableName:        &tableName,
		Key:              keyItem,
		UpdateExpression: &expr,
		ExpressionAttributeNames: map[string]string{
			"#attr": attrName,
		},
		ExpressionAttributeValues: map[string]dbtypes.AttributeValue{
			":val": av,
		},
	}

	_, err := c.DynamoDB.UpdateItem(ctx, input)
	return err
}

func (c *Client) PutDynamoItem(ctx context.Context, tableName string, item DynamoItem) error {
	av, err := attributevalue.MarshalMap(item)
	if err != nil {
		return fmt.Errorf("marshal item: %w", err)
	}
	_, err = c.DynamoDB.PutItem(ctx, &dynamodb.PutItemInput{
		TableName: &tableName,
		Item:      av,
	})
	return err
}

func BuildKeyFromItem(item DynamoItem, keyNames []string) (map[string]dbtypes.AttributeValue, error) {
	keyItem := DynamoItem{}
	for _, k := range keyNames {
		v, ok := item[k]
		if !ok {
			return nil, fmt.Errorf("key attribute %q not found in item", k)
		}
		keyItem[k] = v
	}
	return attributevalue.MarshalMap(keyItem)
}

func ParseDynamoItemFromJSON(jsonStr string) (DynamoItem, error) {
	var item DynamoItem
	if err := json.Unmarshal([]byte(jsonStr), &item); err != nil {
		return nil, fmt.Errorf("invalid JSON: %w", err)
	}
	return item, nil
}

func inferAttributeValue(s string) dbtypes.AttributeValue {
	// Try JSON object/array
	s = strings.TrimSpace(s)
	if (strings.HasPrefix(s, "{") && strings.HasSuffix(s, "}")) ||
		(strings.HasPrefix(s, "[") && strings.HasSuffix(s, "]")) {
		var m any
		if err := json.Unmarshal([]byte(s), &m); err == nil {
			if av, err := attributevalue.Marshal(m); err == nil {
				return av
			}
		}
	}

	// Try boolean
	if s == "true" {
		return &dbtypes.AttributeValueMemberBOOL{Value: true}
	}
	if s == "false" {
		return &dbtypes.AttributeValueMemberBOOL{Value: false}
	}

	// Try number (integer or float)
	isNum := true
	hasDot := false
	for i, c := range s {
		if c == '-' && i == 0 {
			continue
		}
		if c == '.' && !hasDot {
			hasDot = true
			continue
		}
		if c < '0' || c > '9' {
			isNum = false
			break
		}
	}
	if isNum && len(s) > 0 && s != "-" {
		return &dbtypes.AttributeValueMemberN{Value: s}
	}

	// Default to string
	return &dbtypes.AttributeValueMemberS{Value: s}
}

func DynamoItemToJSON(item DynamoItem) string {
	b, err := json.MarshalIndent(item, "", "  ")
	if err != nil {
		return fmt.Sprintf("%v", item)
	}
	return string(b)
}

func (c *Client) ListEC2Instances(ctx context.Context, filter string) ([]EC2Instance, error) {
	input := &ec2.DescribeInstancesInput{}

	var instances []EC2Instance
	lf := strings.ToLower(filter)

	paginator := ec2.NewDescribeInstancesPaginator(c.EC2, input)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		for _, res := range page.Reservations {
			for _, inst := range res.Instances {
				i := instanceFromSDK(inst)
				if lf != "" && !strings.Contains(strings.ToLower(i.Name), lf) &&
					!strings.Contains(strings.ToLower(i.InstanceID), lf) {
					continue
				}
				instances = append(instances, i)
			}
		}
	}

	// Sort: running first, then by name
	sort.Slice(instances, func(i, j int) bool {
		if instances[i].State != instances[j].State {
			return stateOrder(instances[i].State) < stateOrder(instances[j].State)
		}
		return instances[i].Name < instances[j].Name
	})

	return instances, nil
}

func (c *Client) DescribeEC2Instance(ctx context.Context, instanceID string) (*EC2InstanceDetail, error) {
	out, err := c.EC2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{
		InstanceIds: []string{instanceID},
	})
	if err != nil {
		return nil, err
	}
	if len(out.Reservations) == 0 || len(out.Reservations[0].Instances) == 0 {
		return nil, fmt.Errorf("instance %s not found", instanceID)
	}

	inst := out.Reservations[0].Instances[0]
	detail := &EC2InstanceDetail{
		EC2Instance: instanceFromSDK(inst),
	}
	detail.Architecture = string(inst.Architecture)
	detail.RootDeviceType = string(inst.RootDeviceType)
	detail.RootDeviceName = derefStrAws(inst.RootDeviceName)
	if inst.EbsOptimized != nil {
		detail.EBSOptimized = *inst.EbsOptimized
	}
	if inst.Monitoring != nil {
		detail.Monitoring = string(inst.Monitoring.State)
	}

	// Fetch volumes
	for _, bdm := range inst.BlockDeviceMappings {
		vol := EC2Volume{
			DeviceName: derefStrAws(bdm.DeviceName),
		}
		if bdm.Ebs != nil {
			vol.Vo

func (c *Client) GetConsoleOutput(ctx context.Context, instanceID string) (string, error) {
	out, err := c.EC2.GetConsoleOutput(ctx, &ec2.GetConsoleOutputInput{
		InstanceId: &instanceID,
	})
	if err != nil {
		return "", err
	}
	if out.Output == nil {
		return "(no console output available)", nil
	}
	return *out.Output, nil
}

func (c *Client) StartEC2Instance(ctx context.Context, instanceID string) error {
	_, err := c.EC2.StartInstances(ctx, &ec2.StartInstancesInput{
		InstanceIds: []string{instanceID},
	})
	return err
}

func (c *Client) StopEC2Instance(ctx context.Context, instanceID string) error {
	_, err := c.EC2.StopInstances(ctx, &ec2.StopInstancesInput{
		InstanceIds: []string{instanceID},
	})
	return err
}

func (c *Client) RebootEC2Instance(ctx context.Context, instanceID string) error {
	_, err := c.EC2.RebootInstances(ctx, &ec2.RebootInstancesInput{
		InstanceIds: []string{instanceID},
	})
	return err
}

func (c *Client) TerminateEC2Instance(ctx context.Context, instanceID string) error {
	_, err := c.EC2.TerminateInstances(ctx, &ec2.TerminateInstancesInput{
		InstanceIds: []string{instanceID},
	})
	return err
}

func (c *Client) StartSSMSession(ctx context.Context, instanceID string) (*ExecSession, error) {
	out, err := c.SSM.StartSession(ctx, &ssm.StartSessionInput{
		Target: &instanceID,
	})
	if err != nil {
		return nil, fmt.Errorf("start-session failed: %w", err)
	}

	return &ExecSession{
		SessionID:  derefStrAws(out.SessionId),
		StreamURL:  derefStrAws(out.StreamUrl),
		TokenValue: derefStrAws(out.TokenValue),
		Region:     c.Region(),
		Target:     instanceID,
	}, nil
}

func instanceFromSDK(inst ec2types.Instance) EC2Instance {
	i := EC2Instance{
		InstanceID: derefStrAws(inst.InstanceId),
		Type:       string(inst.InstanceType),
		PrivateIP:  derefStrAws(inst.PrivateIpAddress),
		PublicIP:   derefStrAws(inst.PublicIpAddress),
		VpcID:      derefStrAws(inst.VpcId),
		SubnetID:   derefStrAws(inst.SubnetId),
		KeyName:    derefStrAws(inst.KeyName),
		AMI:        derefStrAws(inst.ImageId),
		Platform:   derefStrAws(inst.PlatformDetails),
		Tags:       make(map[string]string),
	}
	if inst.State != nil {
		i.State = string(inst.State.Name)
	}
	if inst.Placement != nil {
		i.AZ = derefStrAws(inst.Placement.AvailabilityZone)
	}
	if inst.LaunchTime != nil {
		i.LaunchTime = *inst.LaunchTime
	}
	if inst.IamInstanceProfile != nil {
		arn := derefStrAws(inst.IamInstanceProfile.Arn)
		// Extract role name from ARN
		if parts := strings.Split(arn, "/"); len(parts) > 1 {
			i.IAMRole = parts[len(parts)-1]
		} else {
			i.IAMRole = arn
		}
	}
	for _, t := range inst

func stateOrder(state string) int {
	order := map[string]int{
		"running":       0,
		"pending":       1,
		"stopping":      2,
		"stopped":       3,
		"shutting-down": 4,
		"terminated":    5,
	}
	if o, ok := order[state]; ok {
		return o
	}
	return 9
}

func sgRulesFromPerm(direction string, perm ec2types.IpPermission) []EC2SGRule {
	proto := derefStrAws(perm.IpProtocol)
	if proto == "-1" {
		proto = "All"
	}

	portRange := "All"
	if perm.FromPort != nil && perm.ToPort != nil {
		if *perm.FromPort == *perm.ToPort {
			portRange = fmt.Sprintf("%d", *perm.FromPort)
		} else {
			portRange = fmt.Sprintf("%d-%d", *perm.FromPort, *perm.ToPort)
		}
		if *perm.FromPort == 0 && *perm.ToPort == 0 && proto != "All" {
			portRange = "All"
		}
	}

	var rules []EC2SGRule
	for _, cidr := range perm.IpRanges {
		rules = append(rules, EC2SGRule{
			Direction: direction,
			Protocol:  proto,
			PortRange: portRange,
			Source:    derefStrAws(cidr.CidrIp),
		})
	}
	for _, cidr := range perm.Ipv6Ranges {
		rules = append(rules, EC2SGRule{
			Direction: direction,
			Protocol:  proto,
			PortRange: portRange,
			Source:    derefStrAws(cidr.CidrIpv6),
		})
	}
	for _, sg := range perm.UserIdGroupPairs {
		rules = append(rules, EC2SGRule{
			Direction: dire

func (c *Client) ListECRRepos(ctx context.Context, filter string) ([]ECRRepo, error) {
	var repos []ECRRepo
	lf := strings.ToLower(filter)

	paginator := ecr.NewDescribeRepositoriesPaginator(c.ECR, &ecr.DescribeRepositoriesInput{})
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		for _, r := range page.Repositories {
			repo := repoFromSDK(r)
			if lf != "" && !strings.Contains(strings.ToLower(repo.Name), lf) {
				continue
			}
			repos = append(repos, repo)
		}
	}
	return repos, nil
}

func (c *Client) ListECRImages(ctx context.Context, repoName string) ([]ECRImage, error) {
	var images []ECRImage

	paginator := ecr.NewDescribeImagesPaginator(c.ECR, &ecr.DescribeImagesInput{
		RepositoryName: &repoName,
	})
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		for _, d := range page.ImageDetails {
			images = append(images, imageFromSDK(d))
		}
	}

	// Sort newest first
	for i, j := 0, len(images)-1; i < j; i, j = i+1, j-1 {
		// Check if already sorted
		if images[i].PushedAt.Before(images[j].PushedAt) {
			images[i], images[j] = images[j], images[i]
		}
	}
	// Proper sort
	sortImagesByPushDate(images)

	return images, nil
}

func (c *Client) GetECRScanFindings(ctx context.Context, repoName, imageDigest string) ([]ECRFinding, error) {
	var findings []ECRFinding

	paginator := ecr.NewDescribeImageScanFindingsPaginator(c.ECR, &ecr.DescribeImageScanFindingsInput{
		RepositoryName: &repoName,
		ImageId:        &ecrtypes.ImageIdentifier{ImageDigest: &imageDigest},
	})
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, err
		}
		if page.ImageScanFindings != nil {
			for _, f := range page.ImageScanFindings.Findings {
				finding := ECRFinding{
					Name:        derefStrAws(f.Name),
					Severity:    string(f.Severity),
					Description: derefStrAws(f.Description),
					URI:         derefStrAws(f.Uri),
				}
				for _, attr := range f.Attributes {
					if attr.Key != nil {
						switch *attr.Key {
						case "package_name":
							finding.Package = derefStrAws(attr.Value)
						case "package_version":
							finding.Version = derefStrAws(attr.Value)
						}
				

func (c *Client) StartECRScan(ctx context.Context, repoName, imageDigest string, tags []string) error {
	imageID := &ecrtypes.ImageIdentifier{ImageDigest: &imageDigest}
	if len(tags) > 0 {
		imageID.ImageTag = &tags[0]
	}
	_, err := c.ECR.StartImageScan(ctx, &ecr.StartImageScanInput{
		RepositoryName: &repoName,
		ImageId:        imageID,
	})
	return err
}

func (c *Client) DeleteECRImage(ctx context.Context, repoName, imageDigest string) error {
	_, err := c.ECR.BatchDeleteImage(ctx, &ecr.BatchDeleteImageInput{
		RepositoryName: &repoName,
		ImageIds:       []ecrtypes.ImageIdentifier{{ImageDigest: &imageDigest}},
	})
	return err
}

func ECRImageURI(repoURI, tag string) string {
	if tag != "" {
		return fmt.Sprintf("%s:%s", repoURI, tag)
	}
	return repoURI
}

func repoFromSDK(r ecrtypes.Repository) ECRRepo {
	repo := ECRRepo{
		Name: derefStrAws(r.RepositoryName),
		URI:  derefStrAws(r.RepositoryUri),
		ARN:  derefStrAws(r.RepositoryArn),
	}
	if r.ImageScanningConfiguration != nil {
		repo.ScanOnPush = r.ImageScanningConfiguration.ScanOnPush
	}
	repo.TagMutability = string(r.ImageTagMutability)
	if r.EncryptionConfiguration != nil {
		repo.EncryptionType = string(r.EncryptionConfiguration.EncryptionType)
	}
	if r.CreatedAt != nil {
		repo.CreatedAt = *r.CreatedAt
	}
	return repo
}

func imageFromSDK(d ecrtypes.ImageDetail) ECRImage {
	img := ECRImage{
		Digest: derefStrAws(d.ImageDigest),
		Tags:   d.ImageTags,
	}
	if d.ImagePushedAt != nil {
		img.PushedAt = *d.ImagePushedAt
	}
	if d.ImageSizeInBytes != nil {
		img.SizeBytes = *d.ImageSizeInBytes
	}
	if d.ArtifactMediaType != nil {
		img.MediaType = *d.ArtifactMediaType
	}
	if d.ImageScanStatus != nil {
		img.ScanStatus = string(d.ImageScanStatus.Status)
	}
	if d.ImageScanFindingsSummary != nil {
		img.ScanSeverity = d.ImageScanFindingsSummary.FindingSeverityCounts
	}
	return img
}