@wraps.dev/cli 2.18.5 → 2.18.7

package/dist/cli.js

@@ -1252,6 +1252,7 @@ var init_aws_detection = __esm({
 var errors_exports = {};
 __export(errors_exports, {
   WrapsError: () => WrapsError,
+  awsErrorToWrapsError: () => awsErrorToWrapsError,
   classifyDNSError: () => classifyDNSError,
   errors: () => errors,
   handleCLIError: () => handleCLIError,
@@ -1408,7 +1409,7 @@ function handleCLIError(error, command) {
       const parsed = parseAWSError(error);
       code = `AWS_${parsed.code}`;
       trackError(code, cmdContext, { action: parsed.action });
-      const wrapsErr = awsErrorToWrapsError(parsed.code, parsed.action);
+      const wrapsErr = awsErrorToWrapsError(parsed.code, parsed.action, error);
       message = wrapsErr.message;
       suggestion = wrapsErr.suggestion;
       docsUrl = wrapsErr.docsUrl;
@@ -1463,7 +1464,7 @@ ${pc5.yellow("Suggestion:")}`);
   if (isAWSError(error)) {
     const { code, action } = parseAWSError(error);
     trackError(`AWS_${code}`, cmdContext, { action });
-    const wrapsError = awsErrorToWrapsError(code, action);
+    const wrapsError = awsErrorToWrapsError(code, action, error);
     clack4.log.error(wrapsError.message);
     if (wrapsError.suggestion) {
       console.log(`
@@ -1528,8 +1529,9 @@ ${pc5.dim("If this persists, please report at:")}`);
 `);
   process.exit(1);
 }
-function awsErrorToWrapsError(code, action) {
+function awsErrorToWrapsError(code, action, originalError) {
   switch (code) {
+    // Credential / token errors — these mean the request never reached the API
     case "ExpiredTokenException":
     case "TokenRefreshRequired":
     case "SSOTokenExpired":
@@ -1537,7 +1539,9 @@ function awsErrorToWrapsError(code, action) {
     case "InvalidClientTokenId":
     case "InvalidAccessKeyId":
     case "SignatureDoesNotMatch":
+    case "UnrecognizedClientException":
       return errors.accessKeyInvalid();
+    // IAM permission errors — request reached AWS but was denied
     case "AccessDenied":
     case "AccessDeniedException":
     case "UnauthorizedAccess":
@@ -1546,8 +1550,35 @@ function awsErrorToWrapsError(code, action) {
         "AWS resource",
         "Ensure your IAM user/role has the required permissions."
       );
+    // SES SendEmail errors — request reached SES but was rejected
+    case "MessageRejected":
+      return errors.sesMessageRejected(sanitizeErrorMessage(originalError));
+    case "MailFromDomainNotVerifiedException":
+      return errors.sesMailFromNotVerified(sanitizeErrorMessage(originalError));
+    case "AccountSendingPausedException":
+      return errors.sesAccountSendingPaused();
+    case "ConfigurationSetSendingPausedException":
+      return errors.sesConfigSetSendingPaused();
+    case "ConfigurationSetDoesNotExistException":
+      return errors.sesConfigSetMissing(sanitizeErrorMessage(originalError));
+    // Throughput / quota errors
+    case "Throttling":
+    case "ThrottlingException":
+    case "TooManyRequestsException":
+      return errors.awsThrottled(action);
+    case "LimitExceededException":
+    case "ServiceQuotaExceededException":
+      return errors.awsLimitExceeded(
+        action,
+        sanitizeErrorMessage(originalError)
+      );
+    // Anything else — surface the real error instead of lying about credentials
     default:
-      return errors.noAWSCredentials();
+      return errors.awsUnknownError(
+        code,
+        action,
+        sanitizeErrorMessage(originalError)
+      );
   }
 }
 function pulumiErrorToWrapsError(code, iamAction, service, resourceName, resourceType) {
@@ -1747,6 +1778,61 @@ View required SES permissions:
   wraps permissions --service email --json`,
         "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
+      // SES SendEmail rejection errors — request reached SES but the send failed
+      // for a reason unrelated to credentials.
+      sesMessageRejected: (detail) => new WrapsError(
+        `SES rejected the message: ${detail}`,
+        "SES_MESSAGE_REJECTED",
+        "Common causes:\n  \u2022 Account is in the SES sandbox and the recipient is not a verified address\n  \u2022 Sender identity (domain or email) is not verified for sending\n  \u2022 The sender domain is verified for receiving but not for sending\n\nCheck status:\n  wraps email status\n  wraps email doctor\n\nRequest production access (exit sandbox):\n  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html",
+        "https://wraps.dev/docs/guides/email/troubleshooting"
+      ),
+      sesMailFromNotVerified: (detail) => new WrapsError(
+        `SES MAIL FROM domain is not verified: ${detail}`,
+        "SES_MAIL_FROM_NOT_VERIFIED",
+        "The custom MAIL FROM domain configured for this identity is not fully verified.\n\nCheck DNS records:\n  wraps email verify\n\nOr remove the custom MAIL FROM domain in the SES console and retry.",
+        "https://docs.aws.amazon.com/ses/latest/dg/mail-from.html"
+      ),
+      sesAccountSendingPaused: () => new WrapsError(
+        "SES account-level sending is paused",
+        "SES_ACCOUNT_SENDING_PAUSED",
+        "Your SES account is currently paused from sending email. This is usually caused by:\n  \u2022 A high bounce or complaint rate\n  \u2022 An AWS-initiated review\n\nCheck the SES console \u2192 Reputation Dashboard for details, then resume sending once the issue is resolved.",
+        "https://docs.aws.amazon.com/ses/latest/dg/reputationdashboard.html"
+      ),
+      sesConfigSetSendingPaused: () => new WrapsError(
+        "SES configuration set sending is paused",
+        "SES_CONFIG_SET_SENDING_PAUSED",
+        "The configuration set used for this send has sending paused. Resume it in the SES console under Configuration Sets, or send without specifying the paused configuration set.",
+        "https://docs.aws.amazon.com/ses/latest/dg/using-configuration-sets.html"
+      ),
+      sesConfigSetMissing: (detail) => new WrapsError(
+        `SES configuration set does not exist: ${detail}`,
+        "SES_CONFIG_SET_MISSING",
+        "The configuration set referenced by this send does not exist in the current region. Create it in the SES console, switch regions, or remove the ConfigurationSetName from the request.",
+        "https://docs.aws.amazon.com/ses/latest/dg/using-configuration-sets.html"
+      ),
+      // Generic AWS error fallbacks — used by awsErrorToWrapsError when no specific
+      // mapping exists. These NEVER claim credentials are missing.
+      awsThrottled: (action) => new WrapsError(
+        `AWS request was throttled${action ? ` (${action})` : ""}`,
+        "AWS_THROTTLED",
+        "AWS is rate-limiting requests to this API. Wait a moment and retry.\n\nIf this happens repeatedly, request a service quota increase in the AWS console.",
+        "https://docs.aws.amazon.com/general/latest/gr/api-retries.html"
+      ),
+      awsLimitExceeded: (action, detail) => new WrapsError(
+        `AWS service limit exceeded${action ? ` (${action})` : ""}${detail ? `: ${detail}` : ""}`,
+        "AWS_LIMIT_EXCEEDED",
+        "You've hit a service quota for this AWS API.\n\nRequest a quota increase in the AWS console:\n  Service Quotas \u2192 AWS Services \u2192 (your service)",
+        "https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html"
+      ),
+      awsUnknownError: (code, action, detail) => new WrapsError(
+        `AWS API error: ${code}${action ? ` (${action})` : ""}${detail ? ` \u2014 ${detail}` : ""}`,
+        `AWS_${code}`,
+        `This is an AWS API error, not a credentials problem. Look up "${code}" in the AWS documentation for the failing service.
+
+If you believe this is a Wraps bug, report it at:
+  https://github.com/wraps-team/wraps/issues`,
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
+      ),
       dynamoDBPermissionDenied: () => new WrapsError(
         "DynamoDB permission denied",
         "DYNAMODB_PERMISSION_DENIED",
@@ -18406,8 +18492,11 @@ async function connect2(options) {
             try {
               const ids = await scanSESIdentities(r);
               return ids.length > 0 ? r : null;
-            } catch {
-              return null;
+            } catch (error) {
+              if (error instanceof Error && (error.name === "AccessDeniedException" || error.name === "UnrecognizedClientException" || error.message.includes("is not authorized"))) {
+                return null;
+              }
+              throw error;
             }
           })
         );
@@ -21086,6 +21175,77 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   }
   console.log();
 }
+var NOT_VERIFIED_PATTERN = /not verified/i;
+function mapInboundTestSendError(error, ctx) {
+  if (error instanceof WrapsError) {
+    return error;
+  }
+  if (!(error instanceof Error)) {
+    return new WrapsError(
+      `Failed to send inbound test email to ${ctx.recipient}`,
+      "INBOUND_TEST_SEND_FAILED",
+      "An unexpected error occurred while sending the test email.\n\nCheck infrastructure status:\n  wraps email status\n  wraps email doctor",
+      "https://wraps.dev/docs/guides/email/troubleshooting"
+    );
+  }
+  const name = error.name;
+  const message = error.message || "";
+  if (name === "MailFromDomainNotVerifiedException") {
+    return new WrapsError(
+      `Custom MAIL FROM domain is not verified for ${ctx.domain}`,
+      "INBOUND_TEST_MAIL_FROM_NOT_VERIFIED",
+      `The MAIL FROM domain configured for "${ctx.domain}" is not fully verified.
+
+Verify DNS records:
+  wraps email verify
+
+Or remove the custom MAIL FROM domain in the SES console and retry.`,
+      "https://docs.aws.amazon.com/ses/latest/dg/mail-from.html"
+    );
+  }
+  if (name === "MessageRejected" || name === "InvalidParameterValue" || NOT_VERIFIED_PATTERN.test(message)) {
+    return new WrapsError(
+      `SES rejected the inbound test send: ${message || name}`,
+      "INBOUND_TEST_MESSAGE_REJECTED",
+      [
+        `Tried to send: ${ctx.source} \u2192 ${ctx.recipient} (region ${ctx.region})`,
+        "",
+        "Most likely causes:",
+        `  \u2022 Your SES account is in the sandbox and ${ctx.recipient} is not a verified address`,
+        `  \u2022 The sender domain "${ctx.domain}" is not verified for sending in ${ctx.region}`,
+        `  \u2022 The receiving domain "${ctx.receivingDomain}" is verified for receiving (MX) but not for sending`,
+        "",
+        "Check status:",
+        "  wraps email status",
+        "  wraps email doctor",
+        "",
+        "Exit the SES sandbox to send to any address:",
+        "  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html"
+      ].join("\n"),
+      "https://wraps.dev/docs/guides/email/troubleshooting"
+    );
+  }
+  if (name === "AccountSendingPausedException" || name === "ConfigurationSetSendingPausedException") {
+    return new WrapsError(
+      "SES sending is paused for this account",
+      "INBOUND_TEST_SENDING_PAUSED",
+      "Your SES account or configuration set has sending paused, usually due to a high bounce or complaint rate.\n\nCheck the SES Reputation Dashboard in the AWS console and resume sending once the issue is resolved.",
+      "https://docs.aws.amazon.com/ses/latest/dg/reputationdashboard.html"
+    );
+  }
+  if (name === "AccessDeniedException" || name === "AccessDenied") {
+    return new WrapsError(
+      `IAM permission denied: ses:SendEmail in ${ctx.region}`,
+      "INBOUND_TEST_PERMISSION_DENIED",
+      `Your AWS credentials lack the "ses:SendEmail" permission in region ${ctx.region}.
+
+View required SES permissions:
+  wraps permissions --service email --json`,
+      "https://wraps.dev/docs/guides/aws-setup/permissions"
+    );
+  }
+  return error;
+}
 async function inboundTest(options) {
   if (!isJsonMode()) {
     clack22.intro(pc24.bold("Inbound Email Test"));
@@ -21109,34 +21269,45 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   const receivingDomain = inbound.receivingDomain || (inbound.subdomain ? `${inbound.subdomain}.${emailConfig.domain}` : emailConfig.domain || "");
   const bucketName = inbound.bucketName || `wraps-inbound-${identity.accountId}-${region}`;
   const testRecipient = `test@${receivingDomain}`;
+  const testSource = `test@${emailConfig.domain}`;
   const testSubject = `Wraps Inbound Test - ${(/* @__PURE__ */ new Date()).toISOString()}`;
   await progress.execute(`Sending test email to ${testRecipient}`, async () => {
     const { SESClient: SESClient7, SendEmailCommand: SendEmailCommand2 } = await import("@aws-sdk/client-ses");
     const ses = new SESClient7({ region });
-    await ses.send(
-      new SendEmailCommand2({
-        Source: `test@${emailConfig.domain}`,
-        Destination: {
-          ToAddresses: [testRecipient]
-        },
-        Message: {
-          Subject: { Data: testSubject },
-          Body: {
-            Text: {
-              Data: "This is a test email from Wraps CLI to verify inbound email processing."
-            },
-            Html: {
-              Data: "<h1>Wraps Inbound Test</h1><p>This email was sent to verify inbound email processing is working correctly.</p>"
+    try {
+      await ses.send(
+        new SendEmailCommand2({
+          Source: testSource,
+          Destination: {
+            ToAddresses: [testRecipient]
+          },
+          Message: {
+            Subject: { Data: testSubject },
+            Body: {
+              Text: {
+                Data: "This is a test email from Wraps CLI to verify inbound email processing."
+              },
+              Html: {
+                Data: "<h1>Wraps Inbound Test</h1><p>This email was sent to verify inbound email processing is working correctly.</p>"
+              }
             }
           }
-        }
-      })
-    );
+        })
+      );
+    } catch (error) {
+      throw mapInboundTestSendError(error, {
+        source: testSource,
+        recipient: testRecipient,
+        domain: emailConfig.domain || "",
+        receivingDomain,
+        region
+      });
+    }
   });
-  const spinner10 = clack22.spinner();
-  spinner10.start("Waiting for email to be processed...");
   const { S3Client: S3Client2, ListObjectsV2Command: ListObjectsV2Command2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
   const s34 = new S3Client2({ region });
+  const spinner10 = clack22.spinner();
+  spinner10.start("Waiting for email to be processed...");
   let found = false;
   const startTime = Date.now();
   const timeout = 3e4;