@wraps.dev/cli 1.3.0 → 1.4.1

package/dist/cli.js

@@ -146,7 +146,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@wraps.dev/cli",
-      version: "1.3.0",
+      version: "1.4.1",
       description: "CLI for deploying Wraps email infrastructure to your AWS account",
       type: "module",
       main: "./dist/cli.js",
@@ -546,6 +546,12 @@ To remove: wraps destroy --stack ${stackName}`,
         "PULUMI_NOT_INSTALLED",
         "Install Pulumi:\n  macOS: brew install pulumi/tap/pulumi\n  Linux: curl -fsSL https://get.pulumi.com | sh\n  Windows: choco install pulumi\n\nOr download from: https://www.pulumi.com/docs/install/",
         "https://www.pulumi.com/docs/install/"
+      ),
+      stackLocked: () => new WrapsError(
+        "The Pulumi stack is locked from a previous run",
+        "STACK_LOCKED",
+        "This happens when a previous deployment was interrupted.\n\nTo unlock, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nThen try your command again.",
+        "https://wraps.dev/docs/troubleshooting"
       )
     };
   }
@@ -2796,7 +2802,9 @@ function createConnectionMetadata(accountId, region, provider, emailConfig, pres
 function applyConfigUpdates(existingConfig, updates) {
   const result = { ...existingConfig };
   for (const [key, value] of Object.entries(updates)) {
-    if (value === void 0) continue;
+    if (value === void 0) {
+      continue;
+    }
     if (key === "tracking" && typeof value === "object") {
       const trackingUpdate = value;
       result.tracking = {
@@ -3269,6 +3277,7 @@ ${pc3.bold("Updated Permissions:")}`);
   console.log(
     `  ${pc3.green("\u2713")} SES metrics and identity verification (always enabled)`
   );
+  console.log(`  ${pc3.green("\u2713")} SES template management (always enabled)`);
   if (sendingEnabled) {
     console.log(`  ${pc3.green("\u2713")} Email sending via SES`);
   }
@@ -3302,6 +3311,18 @@ function buildConsolePolicyDocument(emailConfig) {
     ],
     Resource: "*"
   });
+  statements.push({
+    Effect: "Allow",
+    Action: [
+      "ses:GetTemplate",
+      "ses:ListTemplates",
+      "ses:CreateTemplate",
+      "ses:UpdateTemplate",
+      "ses:DeleteTemplate",
+      "ses:TestRenderTemplate"
+    ],
+    Resource: "*"
+  });
   const sendingEnabled = !emailConfig || emailConfig.sendingEnabled !== false;
   if (sendingEnabled) {
     statements.push({
@@ -3777,7 +3798,7 @@ Try running: pnpm build`
     entryPoints: [sourcePath],
     bundle: true,
     platform: "node",
-    target: "node20",
+    target: "node24",
     format: "esm",
     outfile: join3(outdir, "index.mjs"),
     external: ["@aws-sdk/*"],
@@ -3849,7 +3870,7 @@ async function deployLambdaFunctions(config2) {
     functionName,
     {
       name: functionName,
-      runtime: aws4.lambda.Runtime.NodeJS20dX,
+      runtime: "nodejs24.x",
       handler: "index.handler",
       role: lambdaRole.arn,
       code: new pulumi3.asset.FileArchive(eventProcessorCode),
@@ -3873,7 +3894,7 @@ async function deployLambdaFunctions(config2) {
     }
   ) : new aws4.lambda.Function(functionName, {
     name: functionName,
-    runtime: aws4.lambda.Runtime.NodeJS20dX,
+    runtime: "nodejs24.x",
     handler: "index.handler",
     role: lambdaRole.arn,
     code: new pulumi3.asset.FileArchive(eventProcessorCode),
@@ -3942,6 +3963,28 @@ async function configurationSetExists(configSetName, region) {
     return false;
   }
 }
+async function eventDestinationExists(configSetName, eventDestName, region) {
+  try {
+    const {
+      SESv2Client: SESv2Client5,
+      GetConfigurationSetEventDestinationsCommand
+    } = await import("@aws-sdk/client-sesv2");
+    const ses = new SESv2Client5({ region });
+    const response = await ses.send(
+      new GetConfigurationSetEventDestinationsCommand({
+        ConfigurationSetName: configSetName
+      })
+    );
+    return response.EventDestinations?.some(
+      (dest) => dest.Name === eventDestName
+    ) ?? false;
+  } catch (error) {
+    if (error.name === "NotFoundException") {
+      return false;
+    }
+    return false;
+  }
+}
 async function emailIdentityExists(emailIdentity, region) {
   try {
     const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
@@ -3995,29 +4038,37 @@ async function createSESResources(config2) {
   });
   if (config2.eventTrackingEnabled) {
     const eventDestName = "wraps-email-eventbridge";
-    new aws5.sesv2.ConfigurationSetEventDestination("wraps-email-all-events", {
-      configurationSetName: configSet.configurationSetName,
-      eventDestinationName: eventDestName,
-      eventDestination: {
-        enabled: true,
-        matchingEventTypes: [
-          "SEND",
-          "DELIVERY",
-          "OPEN",
-          "CLICK",
-          "BOUNCE",
-          "COMPLAINT",
-          "REJECT",
-          "RENDERING_FAILURE",
-          "DELIVERY_DELAY",
-          "SUBSCRIPTION"
-        ],
-        eventBridgeDestination: {
-          // SES requires default bus - cannot use custom bus
-          eventBusArn: defaultEventBus.arn
+    new aws5.sesv2.ConfigurationSetEventDestination(
+      "wraps-email-all-events",
+      {
+        configurationSetName: configSet.configurationSetName,
+        eventDestinationName: eventDestName,
+        eventDestination: {
+          enabled: true,
+          matchingEventTypes: [
+            "SEND",
+            "DELIVERY",
+            "OPEN",
+            "CLICK",
+            "BOUNCE",
+            "COMPLAINT",
+            "REJECT",
+            "RENDERING_FAILURE",
+            "DELIVERY_DELAY",
+            "SUBSCRIPTION"
+          ],
+          eventBridgeDestination: {
+            // SES requires default bus - cannot use custom bus
+            eventBusArn: defaultEventBus.arn
+          }
         }
+      },
+      {
+        // Import existing resource if it already exists in AWS
+        // This prevents AlreadyExistsException when the resource exists but isn't in Pulumi state
+        import: config2.importExistingEventDestination ? `wraps-email-tracking|${eventDestName}` : void 0
       }
-    });
+    );
   }
   let domainIdentity;
   let dkimTokens;
@@ -4229,6 +4280,11 @@ async function deployEmailStack(config2) {
   }
   let sesResources;
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
+    const shouldImportEventDest = emailConfig.eventTracking?.enabled && await eventDestinationExists(
+      "wraps-email-tracking",
+      "wraps-email-eventbridge",
+      config2.region
+    );
     sesResources = await createSESResources({
       domain: emailConfig.domain,
       mailFromDomain: emailConfig.mailFromDomain,
@@ -4237,8 +4293,10 @@ async function deployEmailStack(config2) {
       eventTypes: emailConfig.eventTracking?.events,
       eventTrackingEnabled: emailConfig.eventTracking?.enabled,
       // Pass flag to create EventBridge destination
-      tlsRequired: emailConfig.tlsRequired
+      tlsRequired: emailConfig.tlsRequired,
       // Require TLS encryption for all emails
+      importExistingEventDestination: shouldImportEventDest
+      // Import if exists to avoid AlreadyExistsException
     });
   }
   let dynamoTables;
@@ -4303,6 +4361,7 @@ async function deployEmailStack(config2) {
 
 // src/commands/email/config.ts
 init_aws();
+init_errors();
 
 // src/utils/shared/pulumi.ts
 init_esm_shims();
@@ -4373,7 +4432,14 @@ ${pc4.bold("Current Configuration:")}
   } else {
     console.log(`  Preset: ${pc4.cyan("custom")}`);
   }
-  const config2 = metadata.services.email.config;
+  const config2 = metadata.services.email?.config;
+  if (!config2) {
+    clack3.log.error("No email configuration found in metadata");
+    clack3.log.info(
+      `Use ${pc4.cyan("wraps email init")} to create new infrastructure.`
+    );
+    process.exit(1);
+  }
   if (config2.domain) {
     console.log(`  Sending Domain: ${pc4.cyan(config2.domain)}`);
   }
@@ -4462,6 +4528,8 @@ ${pc4.bold("Current Configuration:")}
           metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
+        await stack.refresh({ onOutput: () => {
+        } });
         const upResult = await stack.up({ onOutput: () => {
         } });
         const pulumiOutputs = upResult.outputs;
@@ -4478,12 +4546,8 @@ ${pc4.bold("Current Configuration:")}
       }
     );
   } catch (error) {
-    clack3.log.error("Infrastructure update failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack3.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack3.log.info("To fix this, run:");
-      clack3.log.info(`  ${pc4.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack3.log.info("\nThen try running wraps update again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi update failed: ${error.message}`);
   }
@@ -4524,6 +4588,7 @@ import * as pulumi6 from "@pulumi/pulumi";
 import pc6 from "picocolors";
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 
 // src/utils/shared/scanner.ts
@@ -4898,12 +4963,8 @@ async function connect(options) {
       }
     );
   } catch (error) {
-    clack5.log.error("Infrastructure deployment failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack5.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack5.log.info("To fix this, run:");
-      clack5.log.info(`  ${pc6.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack5.log.info("\nThen try running wraps email connect again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
@@ -5401,6 +5462,7 @@ import pc8 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 async function init(options) {
   clack7.intro(pc8.bold("Wraps Email Infrastructure Setup"));
@@ -5562,12 +5624,8 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
       }
     );
   } catch (error) {
-    clack7.log.error("Infrastructure deployment failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack7.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack7.log.info("To fix this, run:");
-      clack7.log.info(`  ${pc8.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack7.log.info("\nThen try running wraps email init again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
@@ -5662,13 +5720,13 @@ async function restore(options) {
 ${pc9.bold("The following Wraps resources will be removed:")}
 `
   );
-  if (metadata.services.email.config.tracking?.enabled) {
+  if (metadata.services.email?.config.tracking?.enabled) {
     console.log(`  ${pc9.cyan("\u2713")} Configuration Set (wraps-email-tracking)`);
   }
-  if (metadata.services.email.config.eventTracking?.dynamoDBHistory) {
+  if (metadata.services.email?.config.eventTracking?.dynamoDBHistory) {
     console.log(`  ${pc9.cyan("\u2713")} DynamoDB Table (wraps-email-history)`);
   }
-  if (metadata.services.email.config.eventTracking?.enabled) {
+  if (metadata.services.email?.config.eventTracking?.enabled) {
     console.log(`  ${pc9.cyan("\u2713")} EventBridge Rules`);
     console.log(`  ${pc9.cyan("\u2713")} SQS Queues`);
     console.log(`  ${pc9.cyan("\u2713")} Lambda Functions`);
@@ -5740,6 +5798,7 @@ import pc10 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 async function upgrade(options) {
   clack9.intro(pc10.bold("Wraps Upgrade - Enhance Your Email Infrastructure"));
@@ -5780,7 +5839,14 @@ ${pc10.bold("Current Configuration:")}
   } else {
     console.log(`  Preset: ${pc10.cyan("custom")}`);
   }
-  const config2 = metadata.services.email.config;
+  const config2 = metadata.services.email?.config;
+  if (!config2) {
+    clack9.log.error("No email configuration found in metadata");
+    clack9.log.info(
+      `Use ${pc10.cyan("wraps email init")} to create new infrastructure.`
+    );
+    process.exit(1);
+  }
   if (config2.domain) {
     console.log(`  Sending Domain: ${pc10.cyan(config2.domain)}`);
   }
@@ -6454,12 +6520,8 @@ ${pc10.bold("Cost Impact:")}`);
       }
     );
   } catch (error) {
-    clack9.log.error("Infrastructure upgrade failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack9.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack9.log.info("To fix this, run:");
-      clack9.log.info(`  ${pc10.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack9.log.info("\nThen try running wraps upgrade again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
@@ -7438,7 +7500,7 @@ function createSettingsRouter(config2) {
         });
       }
       const configSetName = "wraps-email-tracking";
-      const domain = metadata.services.email.config.domain;
+      const domain = metadata.services.email?.config.domain;
       const settings = await fetchEmailSettings(
         config2.roleArn,
         config2.region,
@@ -8113,7 +8175,9 @@ function showHelp() {
     `  ${pc15.cyan("email connect")}        Connect to existing AWS SES`
   );
   console.log(`  ${pc15.cyan("email domains verify")} Verify domain DNS records`);
-  console.log(`  ${pc15.cyan("email config")}         Update infrastructure`);
+  console.log(
+    `  ${pc15.cyan("email sync")}           Apply CLI updates to infrastructure`
+  );
   console.log(`  ${pc15.cyan("email upgrade")}        Add features`);
   console.log(
     `  ${pc15.cyan("email restore")}        Restore original configuration
@@ -8318,6 +8382,7 @@ async function run() {
           });
           break;
         case "config":
+        case "sync":
           await config({
             region: flags.region,
             yes: flags.yes