@wraps.dev/cli 2.18.3 → 2.18.5

package/dist/cli.js

@@ -1855,6 +1855,7 @@ You may need to merge your existing rules into the wraps rule set.`,
 // src/utils/shared/aws.ts
 var aws_exports = {};
 __export(aws_exports, {
+  SES_REGIONS: () => SES_REGIONS,
   checkRegion: () => checkRegion,
   getACMCertificateStatus: () => getACMCertificateStatus,
   getAWSRegion: () => getAWSRegion,
@@ -1933,31 +1934,7 @@ async function validateAWSCredentialsWithDetails() {
   }
 }
 async function checkRegion(region) {
-  const validRegions = [
-    "us-east-1",
-    "us-east-2",
-    "us-west-1",
-    "us-west-2",
-    "af-south-1",
-    "ap-east-1",
-    "ap-south-1",
-    "ap-northeast-1",
-    "ap-northeast-2",
-    "ap-northeast-3",
-    "ap-southeast-1",
-    "ap-southeast-2",
-    "ap-southeast-3",
-    "ca-central-1",
-    "eu-central-1",
-    "eu-west-1",
-    "eu-west-2",
-    "eu-west-3",
-    "eu-south-1",
-    "eu-north-1",
-    "me-south-1",
-    "sa-east-1"
-  ];
-  return validRegions.includes(region);
+  return SES_REGIONS.includes(region);
 }
 async function getAWSRegion() {
   if (process.env.AWS_REGION) {
@@ -2042,12 +2019,37 @@ async function getACMCertificateStatus(certificateArn) {
     return null;
   }
 }
+var SES_REGIONS;
 var init_aws = __esm({
   "src/utils/shared/aws.ts"() {
     "use strict";
     init_esm_shims();
     init_aws_detection();
     init_errors();
+    SES_REGIONS = [
+      "us-east-1",
+      "us-east-2",
+      "us-west-1",
+      "us-west-2",
+      "af-south-1",
+      "ap-east-1",
+      "ap-south-1",
+      "ap-northeast-1",
+      "ap-northeast-2",
+      "ap-northeast-3",
+      "ap-southeast-1",
+      "ap-southeast-2",
+      "ap-southeast-3",
+      "ca-central-1",
+      "eu-central-1",
+      "eu-west-1",
+      "eu-west-2",
+      "eu-west-3",
+      "eu-south-1",
+      "eu-north-1",
+      "me-south-1",
+      "sa-east-1"
+    ];
   }
 });
 
@@ -8123,6 +8125,9 @@ async function scanSESIdentities(region) {
     }
     return identities;
   } catch (error) {
+    if (error instanceof Error && (error.name === "AccessDeniedException" || error.name === "AccessDenied")) {
+      throw error;
+    }
     console.error(
       "Error scanning SES identities:",
       error instanceof Error ? error.message : error
@@ -8303,27 +8308,37 @@ async function scanIAMRoles(region) {
 }
 async function scanAWSResources(region) {
   const [
-    identities,
+    identityResult,
     configurationSets,
     snsTopics,
     dynamoTables,
     lambdaFunctions,
     iamRoles
   ] = await Promise.all([
-    scanSESIdentities(region),
+    scanSESIdentities(region).catch(
+      (error) => error instanceof Error ? error : new Error(String(error))
+    ),
     scanSESConfigurationSets(region),
     scanSNSTopics(region),
     scanDynamoTables(region),
     scanLambdaFunctions(region),
     scanIAMRoles(region)
   ]);
+  let identities = [];
+  let scanErrors;
+  if (identityResult instanceof Error) {
+    scanErrors = { identities: identityResult.name };
+  } else {
+    identities = identityResult;
+  }
   return {
     identities,
     configurationSets,
     snsTopics,
     dynamoTables,
     lambdaFunctions,
-    iamRoles
+    iamRoles,
+    scanErrors
   };
 }
 function filterWrapsResources(scan) {
@@ -8978,9 +8993,8 @@ Run ${pc27.cyan("wraps email init")} to deploy email infrastructure.
     process.exit(1);
     return;
   }
-  const emailConfig = metadata.services.email;
-  const domain = emailConfig.config.domain;
-  if (!domain) {
+  const trackedDomains = getAllTrackedDomains(metadata);
+  if (trackedDomains.length === 0) {
     progress.stop();
     clack25.log.error("No domain configured in email infrastructure");
     console.log(`
@@ -8989,6 +9003,24 @@ Run ${pc27.cyan("wraps email init")} to set up a domain.
     process.exit(1);
     return;
   }
+  let domain;
+  if (trackedDomains.length === 1) {
+    domain = trackedDomains[0].domain;
+  } else {
+    const selected = await clack25.select({
+      message: "Which domain do you want to send from?",
+      options: trackedDomains.map((d) => ({
+        value: d.domain,
+        label: d.domain,
+        hint: d.isPrimary ? "primary" : d.purpose
+      }))
+    });
+    if (clack25.isCancel(selected)) {
+      clack25.cancel("Operation cancelled.");
+      process.exit(0);
+    }
+    domain = selected;
+  }
   let toEmail = options.to;
   if (!toEmail) {
     if (isJsonMode() && !options.scenario) {
@@ -17714,12 +17746,7 @@ async function createSMTPCredentials(config2) {
         {
           Effect: "Allow",
           Action: "ses:SendRawEmail",
-          Resource: "*",
-          Condition: {
-            StringEquals: {
-              "ses:ConfigurationSetName": config2.configSetName
-            }
-          }
+          Resource: "*"
         }
       ]
     })
@@ -18366,11 +18393,40 @@ async function connect2(options) {
   progress.info(
     `Found: ${scan.identities.length} identities, ${scan.configurationSets.length} config sets`
   );
+  if (scan.scanErrors?.identities) {
+    throw errors.sesPermissionDenied("ListIdentities");
+  }
   if (scan.identities.length === 0) {
-    clack17.log.warn("No SES identities found in this region.");
-    clack17.log.info(
-      `Use ${pc19.cyan("wraps email init")} to create new email infrastructure instead.`
+    const otherRegions = SES_REGIONS.filter((r) => r !== region);
+    const regionHits = await progress.execute(
+      "Checking other regions for SES identities",
+      async () => {
+        const results = await Promise.all(
+          otherRegions.map(async (r) => {
+            try {
+              const ids = await scanSESIdentities(r);
+              return ids.length > 0 ? r : null;
+            } catch {
+              return null;
+            }
+          })
+        );
+        return results.filter((r) => r !== null);
+      }
     );
+    if (regionHits.length > 0) {
+      clack17.log.warn(
+        `No SES identities found in ${pc19.cyan(region)}, but found identities in: ${regionHits.map((r) => pc19.cyan(r)).join(", ")}`
+      );
+      clack17.log.info(
+        `Run ${pc19.cyan(`wraps email connect --region ${regionHits[0]}`)} to connect to your existing infrastructure.`
+      );
+    } else {
+      clack17.log.warn("No SES identities found in any region.");
+      clack17.log.info(
+        `Use ${pc19.cyan("wraps email init")} to create new email infrastructure instead.`
+      );
+    }
     process.exit(0);
   }
   const verifiedIdentities = scan.identities.filter((id) => id.verified);
@@ -18397,6 +18453,15 @@ async function connect2(options) {
     clack17.log.warn("No identities selected. Nothing to connect.");
     process.exit(0);
   }
+  const unverifiedSelected = selectedIdentities.filter((name) => {
+    const identity2 = scan.identities.find((id) => id.name === name);
+    return identity2 && !identity2.verified;
+  });
+  if (unverifiedSelected.length > 0) {
+    clack17.log.warn(
+      `${unverifiedSelected.map((id) => pc19.cyan(id)).join(", ")} not yet verified \u2014 SES will reject sends from unverified identities until verification is complete.`
+    );
+  }
   const preset = await promptConfigPreset();
   const emailConfig = preset === "custom" ? await Promise.resolve().then(() => (init_prompts(), prompts_exports)).then(
     (m) => m.promptCustomConfig()
@@ -19749,18 +19814,17 @@ Run ${pc23.cyan("wraps email init")} first to deploy email infrastructure.
     }
     clack21.log.step(`Adding ${pc23.cyan(domain)}`);
     const sesClient = new SESv2Client4({ region });
+    let domainAlreadyExists = false;
+    let dkimTokens = [];
     try {
-      await sesClient.send(
+      const existing = await sesClient.send(
         new GetEmailIdentityCommand2({ EmailIdentity: domain })
       );
-      progress.stop();
-      clack21.log.warn(`Domain ${domain} already exists in SES`);
-      console.log(
-        `
-Run ${pc23.cyan(`wraps email domains verify --domain ${domain}`)} to check verification status.
-`
+      domainAlreadyExists = true;
+      dkimTokens = existing.DkimAttributes?.Tokens || [];
+      clack21.log.info(
+        `Domain ${pc23.cyan(domain)} already exists in SES \u2014 adopting into Wraps`
       );
-      return;
     } catch (error) {
       if (!isAWSNotFoundError(error)) {
         throw error;
@@ -19770,22 +19834,34 @@ Run ${pc23.cyan(`wraps email domains verify --domain ${domain}`)} to check verif
     if (!options.yes) {
       purpose = await promptDomainPurpose();
     }
-    const { CreateEmailIdentityCommand } = await import("@aws-sdk/client-sesv2");
-    await progress.execute("Creating SES identity", async () => {
-      await sesClient.send(
-        new CreateEmailIdentityCommand({
-          EmailIdentity: domain,
-          ConfigurationSetName: "wraps-email-tracking",
-          DkimSigningAttributes: {
-            NextSigningKeyLength: "RSA_2048_BIT"
-          }
-        })
+    if (domainAlreadyExists) {
+      const { PutEmailIdentityConfigurationSetAttributesCommand } = await import("@aws-sdk/client-sesv2");
+      await progress.execute("Associating tracking configuration", async () => {
+        await sesClient.send(
+          new PutEmailIdentityConfigurationSetAttributesCommand({
+            EmailIdentity: domain,
+            ConfigurationSetName: "wraps-email-tracking"
+          })
+        );
+      });
+    } else {
+      const { CreateEmailIdentityCommand } = await import("@aws-sdk/client-sesv2");
+      await progress.execute("Creating SES identity", async () => {
+        await sesClient.send(
+          new CreateEmailIdentityCommand({
+            EmailIdentity: domain,
+            ConfigurationSetName: "wraps-email-tracking",
+            DkimSigningAttributes: {
+              NextSigningKeyLength: "RSA_2048_BIT"
+            }
+          })
+        );
+      });
+      const sesIdentity = await sesClient.send(
+        new GetEmailIdentityCommand2({ EmailIdentity: domain })
       );
-    });
-    const sesIdentity = await sesClient.send(
-      new GetEmailIdentityCommand2({ EmailIdentity: domain })
-    );
-    const dkimTokens = sesIdentity.DkimAttributes?.Tokens || [];
+      dkimTokens = sesIdentity.DkimAttributes?.Tokens || [];
+    }
     let mailFromDomain;
     if (options.yes) {
       mailFromDomain = `mail.${domain}`;
@@ -20477,12 +20553,30 @@ async function inboundInit(options) {
   if (!metadata?.services?.email) {
     throw errors.inboundRequiresOutbound();
   }
-  const emailService = metadata.services.email;
-  const emailConfig = emailService.config;
-  const domain = emailConfig.domain;
-  if (!domain) {
+  const trackedDomains = getAllTrackedDomains(metadata);
+  if (trackedDomains.length === 0) {
     throw errors.inboundRequiresOutbound();
   }
+  let domain;
+  if (trackedDomains.length === 1) {
+    domain = trackedDomains[0].domain;
+  } else {
+    const selected = await clack22.select({
+      message: "Which domain do you want to receive email on?",
+      options: trackedDomains.map((d) => ({
+        value: d.domain,
+        label: d.domain,
+        hint: d.isPrimary ? "primary" : d.purpose
+      }))
+    });
+    if (clack22.isCancel(selected)) {
+      clack22.cancel("Operation cancelled.");
+      process.exit(0);
+    }
+    domain = selected;
+  }
+  const emailService = metadata.services.email;
+  const emailConfig = emailService.config;
   const subdomain = options.root ? "" : options.subdomain ?? (options.yes ? "inbound" : await promptInboundSubdomain(domain));
   const receivingDomain = subdomain ? `${subdomain}.${domain}` : domain;
   clack22.log.info(`Receiving domain: ${pc24.cyan(receivingDomain)}`);
@@ -21658,6 +21752,21 @@ async function init2(options) {
   if (domain) {
     emailConfig.domain = domain;
   }
+  if (domain && !options.quick && preset !== "custom") {
+    const wantsMailFrom = await clack26.confirm({
+      message: `Configure MAIL FROM for ${pc28.cyan(domain)}? ${pc28.dim("(improves DMARC alignment)")}`,
+      initialValue: true
+    });
+    if (clack26.isCancel(wantsMailFrom)) {
+      clack26.cancel("Operation cancelled.");
+      process.exit(0);
+    }
+    if (wantsMailFrom) {
+      const mailFromFull = await promptMailFromSubdomain(domain);
+      const suffix = `.${domain}`;
+      emailConfig.mailFromSubdomain = mailFromFull.endsWith(suffix) ? mailFromFull.slice(0, -suffix.length) || "mail" : "mail";
+    }
+  }
   let costSummary;
   if (!options.quick) {
     const estimatedVolume = await promptEstimatedVolume();