@wraps.dev/cli 2.21.11 → 2.21.13

package/dist/cli.js

@@ -33850,12 +33850,14 @@ Run ${pc47.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
     process.exit(1);
     return;
   }
-  const { config: config2 } = metadata.services.selfhost;
+  const { config: config2, apiUrl } = metadata.services.selfhost;
   const env = {
     DATABASE_URL: config2.databaseUrl,
     NEXT_PUBLIC_APP_URL: config2.appUrl,
+    NEXT_PUBLIC_API_URL: apiUrl,
     CORS_ORIGIN: config2.appUrl,
     BETTER_AUTH_SECRET: config2.betterAuthSecret,
+    UNSUBSCRIBE_SECRET: config2.unsubscribeSecret,
     WRAPS_LICENSE_KEY: config2.licenseKey,
     AWS_BACKEND_ACCOUNT_ID: identity.accountId
   };
@@ -33873,14 +33875,23 @@ Run ${pc47.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
     console.log(`${key}=${value}`);
   }
   console.log("");
-  console.log(
-    "# AWS credentials for role assumption \u2014 create an IAM user in your account"
-  );
-  console.log(
-    `# with sts:AssumeRole permission on arn:aws:iam::${identity.accountId}:role/wraps-console-access-role`
-  );
-  console.log("# AWS_ACCESS_KEY_ID=<fill-in>");
-  console.log("# AWS_SECRET_ACCESS_KEY=<fill-in>");
+  console.log("# =============================================================================");
+  console.log("# AWS Backend Credentials \u2014 Vercel OIDC (recommended)");
+  console.log("# =============================================================================");
+  console.log("#");
+  console.log("# 1. In Vercel: Project Settings \u2192 Cloud \u2192 Configure AWS");
+  console.log("#    Copy the OIDC Provider URL (looks like https://oidc.vercel.com/<team-id>)");
+  console.log("#");
+  console.log("# 2. In AWS IAM \u2192 Identity providers \u2192 Add provider:");
+  console.log("#    Provider type: OpenID Connect");
+  console.log("#    Provider URL:  <your Vercel OIDC URL from step 1>");
+  console.log("#    Audience:      sts.amazonaws.com");
+  console.log("#");
+  console.log("# 3. Create an IAM role that trusts that OIDC provider, with this permission:");
+  console.log(`#    sts:AssumeRole on arn:aws:iam::${identity.accountId}:role/wraps-console-access-role`);
+  console.log("#");
+  console.log("# 4. Set AWS_ROLE_ARN to that role's ARN in Vercel:");
+  console.log(`# AWS_ROLE_ARN=arn:aws:iam::${identity.accountId}:role/<your-vercel-backend-role>`);
   clack44.outro(
     pc47.dim(
       "Paste into Vercel \u2192 Settings \u2192 Environment Variables \u2192 Add from .env"