@wraps.dev/cli 2.19.0 → 2.19.1

package/dist/cli.js

@@ -842,7 +842,7 @@ To remove: wraps destroy --stack ${stackName}`,
         "The Pulumi stack is locked from a previous run",
         "STACK_LOCKED",
         "This happens when a previous deployment was interrupted.\n\nFor local state, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nFor S3 state, delete the lock object in your wraps-state-* bucket under .pulumi/locks/\n\nThen try your command again.",
-        "https://wraps.dev/docs/guides/aws-setup/permissions/troubleshooting"
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
       // SMS-specific errors
       smsNotConfigured: () => new WrapsError(
@@ -958,7 +958,7 @@ View required SES permissions:
         `SES rejected the message: ${detail}`,
         "SES_MESSAGE_REJECTED",
         "Common causes:\n  \u2022 Account is in the SES sandbox and the recipient is not a verified address\n  \u2022 Sender identity (domain or email) is not verified for sending\n  \u2022 The sender domain is verified for receiving but not for sending\n\nCheck status:\n  wraps email status\n  wraps email doctor\n\nRequest production access (exit sandbox):\n  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html",
-        "https://wraps.dev/docs/guides/email/troubleshooting"
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
       sesMailFromNotVerified: (detail) => new WrapsError(
         `SES MAIL FROM domain is not verified: ${detail}`,
@@ -1088,25 +1088,25 @@ You may need to merge your existing rules into the wraps rule set.`,
         "wraps/wraps.config.ts not found",
         "WRAPS_CONFIG_NOT_FOUND",
         "Initialize templates first:\n  wraps email templates init",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       ),
       templateCompilationFailed: (name, error) => new WrapsError(
         `Failed to compile template "${name}": ${error}`,
         "TEMPLATE_COMPILATION_FAILED",
         "Check your template for syntax errors and ensure all imports are valid.",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       ),
       notAuthenticated: () => new WrapsError(
         "Not authenticated to Wraps Platform",
         "NOT_AUTHENTICATED",
         "Sign in first:\n  wraps auth login\n\nOr provide an API key:\n  wraps push --token wraps_...\n  WRAPS_API_KEY=wraps_... wraps push",
-        "https://wraps.dev/docs/auth"
+        "https://wraps.dev/docs/cli-reference/auth"
       ),
       templatePushFailed: (name, error) => new WrapsError(
         `Failed to push template "${name}": ${error}`,
         "TEMPLATE_PUSH_FAILED",
         "Check your API key and network connection.",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       )
     };
   }
@@ -11812,6 +11812,7 @@ async function createCdnBucket(config2) {
   const corsOrigins = [
     "https://wraps.dev",
     "https://*.wraps.dev",
+    "https://*.wraps.localhost",
     "http://localhost:3000",
     "http://localhost:3001",
     "http://localhost:3002",
@@ -21245,6 +21246,8 @@ async function inboundInit(options) {
       subdomain,
       bucketName: `wraps-inbound-${identity.accountId}-${region}`,
       webhookUrl: webhookUrl || null,
+      webhookSecret: webhookUrl ? webhookSecret : null,
+      webhookHeader: webhookUrl ? "X-Wraps-Inbound-Key" : null,
       dnsAutoCreated,
       region
     });
@@ -21263,6 +21266,27 @@ async function inboundInit(options) {
   if (dnsAutoCreated) {
     console.log(`  ${pc24.dim("DNS:")}              ${pc24.green("Auto-created")}`);
   }
+  if (webhookUrl) {
+    const setupLines = [
+      `EventBridge will POST every ${pc24.cyan("email.received")} event to:`,
+      `  ${pc24.cyan(webhookUrl)}`,
+      "",
+      "Verify the request by checking this header on every POST:",
+      `  ${pc24.bold("X-Wraps-Inbound-Key")}: ${pc24.yellow(webhookSecret)}`,
+      "",
+      pc24.bold("Save this secret now \u2014 it is only shown once."),
+      `Retrieve it later with: ${pc24.cyan("wraps email inbound status --reveal-secret")}`,
+      "",
+      "Body shape (JSON):",
+      pc24.dim(
+        '  { "emailId", "from", "to", "subject", "html", "text", "attachments", "headers", ... }'
+      ),
+      "",
+      `Docs: ${pc24.cyan("https://wraps.dev/docs/quickstart/email/inbound")}`
+    ].join("\n");
+    console.log();
+    clack22.note(setupLines, "Webhook setup");
+  }
   console.log();
   console.log(pc24.bold("Next steps:"));
   if (dnsAutoCreated) {
@@ -21413,6 +21437,8 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
       bucketName: inbound.bucketName || "",
       region,
       webhookUrl: inbound.webhookUrl || null,
+      webhookHeader: inbound.webhookUrl ? "X-Wraps-Inbound-Key" : null,
+      webhookSecret: options.revealSecret && inbound.webhookUrl ? inbound.webhookSecret || null : null,
       receiptRuleSetActive: activeRuleSet === RULE_SET_NAME,
       retention: inbound.retention || null
     });
@@ -21436,6 +21462,20 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   console.log(
     `  ${pc24.dim("Webhook URL:")}       ${inbound.webhookUrl ? pc24.cyan(inbound.webhookUrl) : pc24.dim("not configured")}`
   );
+  if (inbound.webhookUrl) {
+    console.log(
+      `  ${pc24.dim("Webhook header:")}    ${pc24.cyan("X-Wraps-Inbound-Key")}`
+    );
+    if (options.revealSecret) {
+      console.log(
+        `  ${pc24.dim("Webhook secret:")}    ${inbound.webhookSecret ? pc24.yellow(inbound.webhookSecret) : pc24.dim("not set")}`
+      );
+    } else {
+      console.log(
+        `  ${pc24.dim("Webhook secret:")}    ${pc24.dim("hidden \u2014 pass --reveal-secret to show")}`
+      );
+    }
+  }
   console.log(
     `  ${pc24.dim("Receipt rule set:")}  ${activeRuleSet === RULE_SET_NAME ? pc24.green("active") : pc24.yellow("inactive")}`
   );
@@ -21571,7 +21611,7 @@ function mapInboundTestSendError(error, ctx) {
       `Failed to send inbound test email to ${ctx.recipient}`,
       "INBOUND_TEST_SEND_FAILED",
       "An unexpected error occurred while sending the test email.\n\nCheck infrastructure status:\n  wraps email status\n  wraps email doctor",
-      "https://wraps.dev/docs/guides/email/troubleshooting"
+      "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
     );
   }
   const name = error.name;
@@ -21608,7 +21648,7 @@ Or remove the custom MAIL FROM domain in the SES console and retry.`,
         "Exit the SES sandbox to send to any address:",
         "  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html"
       ].join("\n"),
-      "https://wraps.dev/docs/guides/email/troubleshooting"
+      "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
     );
   }
   if (name === "AccountSendingPausedException" || name === "ConfigurationSetSendingPausedException") {
@@ -23049,7 +23089,7 @@ async function replyInitForSingleDomain(params) {
       `The Pulumi deploy completed but the SSM parameter ${ssmParameterName(domain)} was not found. Run:
   wraps email reply status
 to diagnose, or retry the init.`,
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const finalEntry = {
@@ -23162,7 +23202,7 @@ async function replyInit(options) {
       "Reply threading requires inbound email infrastructure",
       "REPLY_REQUIRES_INBOUND",
       "Deploy inbound first:\n  wraps email inbound init\n\nThen enable reply threading:\n  wraps email reply init --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const emailService = metadata.services.email;
@@ -23178,7 +23218,7 @@ async function replyInit(options) {
       "No inbound domains configured",
       "REPLY_NO_INBOUND_DOMAINS",
       "Add an inbound domain first:\n  wraps email inbound add --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   let targetDomains;
@@ -23207,7 +23247,7 @@ async function replyInit(options) {
         "REPLY_INBOUND_DOMAIN_NOT_FOUND",
         `Add it to inbound first:
   wraps email inbound add ${target}`,
-        "https://wraps.dev/docs/guides/email/reply-threading"
+        "https://wraps.dev/docs/guides/reply-threading"
       );
     }
     if (isReplyEnabledFor(metadata, target)) {
@@ -23216,7 +23256,7 @@ async function replyInit(options) {
         "REPLY_ALREADY_ENABLED",
         `To rotate the signing secret, run:
   wraps email reply rotate --domain ${target}`,
-        "https://wraps.dev/docs/guides/email/reply-threading"
+        "https://wraps.dev/docs/guides/reply-threading"
       );
     }
     targetDomains = [target];
@@ -23225,7 +23265,7 @@ async function replyInit(options) {
       "Specify a domain or use --all",
       "REPLY_MISSING_DOMAIN",
       "Use one of:\n  wraps email reply init --domain yourapp.com\n  wraps email reply init --all",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
@@ -23277,7 +23317,7 @@ async function replyRotate(options) {
       "--domain is required for rotate",
       "REPLY_ROTATE_MISSING_DOMAIN",
       "Usage:\n  wraps email reply rotate --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const identity = await progress.execute(
@@ -23291,7 +23331,7 @@ async function replyRotate(options) {
       "Reply threading is not enabled",
       "REPLY_NOT_ENABLED",
       "Enable it first:\n  wraps email reply init --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const rt = metadata.services.email.config.replyThreading;
@@ -23302,7 +23342,7 @@ async function replyRotate(options) {
       "REPLY_DOMAIN_NOT_ENABLED",
       `Enable it first:
   wraps email reply init --domain ${options.domain}`,
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const parameterName = entry.parameterName || ssmParameterName(options.domain);
@@ -23327,7 +23367,7 @@ async function replyRotate(options) {
           "REPLY_SECRET_PARAMETER_MISSING",
           `The signing secret for ${options.domain} has not been created yet. Run:
   wraps email reply init --domain ${options.domain}`,
-          "https://wraps.dev/docs/guides/email/reply-threading"
+          "https://wraps.dev/docs/guides/reply-threading"
         );
       }
       throw error;
@@ -23567,7 +23607,7 @@ async function replyDestroy(options) {
       "Specify a domain or use --all",
       "REPLY_DESTROY_MISSING_DOMAIN",
       "Usage:\n  wraps email reply destroy --domain yourapp.com\n  wraps email reply destroy --all",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   if (!(options.force || isJsonMode())) {
@@ -23622,7 +23662,7 @@ async function replyDecode(addressInput, options) {
       "Usage: wraps email reply decode <token>@r.mail.yourapp.com",
       "REPLY_DECODE_MISSING_ADDRESS",
       "Provide a signed reply address like:\n  wraps email reply decode abcDEF123@r.mail.yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const at = addressInput.lastIndexOf("@");
@@ -23632,7 +23672,7 @@ async function replyDecode(addressInput, options) {
       "Address must be in the form <token>@r.mail.example.com",
       "REPLY_DECODE_MALFORMED_ADDRESS",
       "Pass a full signed reply address:\n  wraps email reply decode abcDEF123@r.mail.yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const local = addressInput.slice(0, at);
@@ -38968,6 +39008,7 @@ var BOOLEAN_FLAGS = [
   "draft",
   "root",
   "cleanup",
+  "reveal-secret",
   "help",
   "version"
 ];
@@ -39591,7 +39632,8 @@ Usage: ${pc59.cyan("wraps email verify --domain yourapp.com")}
             case "status":
               await inboundStatus({
                 region: flags.region,
-                json: flags.json
+                json: flags.json,
+                revealSecret: flags.revealSecret
               });
               break;
             case "verify":