@wraps.dev/cli 2.18.4 → 2.18.6

package/dist/cli.js

@@ -1855,6 +1855,7 @@ You may need to merge your existing rules into the wraps rule set.`,
 // src/utils/shared/aws.ts
 var aws_exports = {};
 __export(aws_exports, {
+  SES_REGIONS: () => SES_REGIONS,
   checkRegion: () => checkRegion,
   getACMCertificateStatus: () => getACMCertificateStatus,
   getAWSRegion: () => getAWSRegion,
@@ -1933,31 +1934,7 @@ async function validateAWSCredentialsWithDetails() {
   }
 }
 async function checkRegion(region) {
-  const validRegions = [
-    "us-east-1",
-    "us-east-2",
-    "us-west-1",
-    "us-west-2",
-    "af-south-1",
-    "ap-east-1",
-    "ap-south-1",
-    "ap-northeast-1",
-    "ap-northeast-2",
-    "ap-northeast-3",
-    "ap-southeast-1",
-    "ap-southeast-2",
-    "ap-southeast-3",
-    "ca-central-1",
-    "eu-central-1",
-    "eu-west-1",
-    "eu-west-2",
-    "eu-west-3",
-    "eu-south-1",
-    "eu-north-1",
-    "me-south-1",
-    "sa-east-1"
-  ];
-  return validRegions.includes(region);
+  return SES_REGIONS.includes(region);
 }
 async function getAWSRegion() {
   if (process.env.AWS_REGION) {
@@ -2042,12 +2019,37 @@ async function getACMCertificateStatus(certificateArn) {
     return null;
   }
 }
+var SES_REGIONS;
 var init_aws = __esm({
   "src/utils/shared/aws.ts"() {
     "use strict";
     init_esm_shims();
     init_aws_detection();
     init_errors();
+    SES_REGIONS = [
+      "us-east-1",
+      "us-east-2",
+      "us-west-1",
+      "us-west-2",
+      "af-south-1",
+      "ap-east-1",
+      "ap-south-1",
+      "ap-northeast-1",
+      "ap-northeast-2",
+      "ap-northeast-3",
+      "ap-southeast-1",
+      "ap-southeast-2",
+      "ap-southeast-3",
+      "ca-central-1",
+      "eu-central-1",
+      "eu-west-1",
+      "eu-west-2",
+      "eu-west-3",
+      "eu-south-1",
+      "eu-north-1",
+      "me-south-1",
+      "sa-east-1"
+    ];
   }
 });
 
@@ -8123,6 +8125,9 @@ async function scanSESIdentities(region) {
     }
     return identities;
   } catch (error) {
+    if (error instanceof Error && (error.name === "AccessDeniedException" || error.name === "AccessDenied")) {
+      throw error;
+    }
     console.error(
       "Error scanning SES identities:",
       error instanceof Error ? error.message : error
@@ -8303,27 +8308,37 @@ async function scanIAMRoles(region) {
 }
 async function scanAWSResources(region) {
   const [
-    identities,
+    identityResult,
     configurationSets,
     snsTopics,
     dynamoTables,
     lambdaFunctions,
     iamRoles
   ] = await Promise.all([
-    scanSESIdentities(region),
+    scanSESIdentities(region).catch(
+      (error) => error instanceof Error ? error : new Error(String(error))
+    ),
     scanSESConfigurationSets(region),
     scanSNSTopics(region),
     scanDynamoTables(region),
     scanLambdaFunctions(region),
     scanIAMRoles(region)
   ]);
+  let identities = [];
+  let scanErrors;
+  if (identityResult instanceof Error) {
+    scanErrors = { identities: identityResult.name };
+  } else {
+    identities = identityResult;
+  }
   return {
     identities,
     configurationSets,
     snsTopics,
     dynamoTables,
     lambdaFunctions,
-    iamRoles
+    iamRoles,
+    scanErrors
   };
 }
 function filterWrapsResources(scan) {
@@ -18378,11 +18393,43 @@ async function connect2(options) {
   progress.info(
     `Found: ${scan.identities.length} identities, ${scan.configurationSets.length} config sets`
   );
+  if (scan.scanErrors?.identities) {
+    throw errors.sesPermissionDenied("ListIdentities");
+  }
   if (scan.identities.length === 0) {
-    clack17.log.warn("No SES identities found in this region.");
-    clack17.log.info(
-      `Use ${pc19.cyan("wraps email init")} to create new email infrastructure instead.`
+    const otherRegions = SES_REGIONS.filter((r) => r !== region);
+    const regionHits = await progress.execute(
+      "Checking other regions for SES identities",
+      async () => {
+        const results = await Promise.all(
+          otherRegions.map(async (r) => {
+            try {
+              const ids = await scanSESIdentities(r);
+              return ids.length > 0 ? r : null;
+            } catch (error) {
+              if (error instanceof Error && (error.name === "AccessDeniedException" || error.name === "UnrecognizedClientException" || error.message.includes("is not authorized"))) {
+                return null;
+              }
+              throw error;
+            }
+          })
+        );
+        return results.filter((r) => r !== null);
+      }
     );
+    if (regionHits.length > 0) {
+      clack17.log.warn(
+        `No SES identities found in ${pc19.cyan(region)}, but found identities in: ${regionHits.map((r) => pc19.cyan(r)).join(", ")}`
+      );
+      clack17.log.info(
+        `Run ${pc19.cyan(`wraps email connect --region ${regionHits[0]}`)} to connect to your existing infrastructure.`
+      );
+    } else {
+      clack17.log.warn("No SES identities found in any region.");
+      clack17.log.info(
+        `Use ${pc19.cyan("wraps email init")} to create new email infrastructure instead.`
+      );
+    }
     process.exit(0);
   }
   const verifiedIdentities = scan.identities.filter((id) => id.verified);
@@ -18409,6 +18456,15 @@ async function connect2(options) {
     clack17.log.warn("No identities selected. Nothing to connect.");
     process.exit(0);
   }
+  const unverifiedSelected = selectedIdentities.filter((name) => {
+    const identity2 = scan.identities.find((id) => id.name === name);
+    return identity2 && !identity2.verified;
+  });
+  if (unverifiedSelected.length > 0) {
+    clack17.log.warn(
+      `${unverifiedSelected.map((id) => pc19.cyan(id)).join(", ")} not yet verified \u2014 SES will reject sends from unverified identities until verification is complete.`
+    );
+  }
   const preset = await promptConfigPreset();
   const emailConfig = preset === "custom" ? await Promise.resolve().then(() => (init_prompts(), prompts_exports)).then(
     (m) => m.promptCustomConfig()