@wraps.dev/cli 2.22.3 → 2.22.5

package/dist/cli.js

@@ -32099,6 +32099,9 @@ init_events();
 init_esm_shims();
 init_metadata();
 var SELFHOST_API_FUNCTION_NAME = "wraps-selfhost-api";
+function normalizeApiUrl(url) {
+  return url.replace(/\/+$/, "");
+}
 async function resolveSelfhostApiUrl(region) {
   try {
     const { LambdaClient: LambdaClient3, GetFunctionUrlConfigCommand } = await import("@aws-sdk/client-lambda");
@@ -32108,7 +32111,7 @@ async function resolveSelfhostApiUrl(region) {
         FunctionName: SELFHOST_API_FUNCTION_NAME
       })
     );
-    return result.FunctionUrl ?? null;
+    return result.FunctionUrl ? normalizeApiUrl(result.FunctionUrl) : null;
   } catch {
     return null;
   }
@@ -32119,7 +32122,7 @@ async function reconcileSelfhostApiUrl(metadata, region) {
     return null;
   }
   if (selfhost.apiUrl) {
-    return selfhost.apiUrl;
+    return normalizeApiUrl(selfhost.apiUrl);
   }
   const recovered = await resolveSelfhostApiUrl(region);
   if (!recovered) {
@@ -32576,7 +32579,7 @@ Run ${pc44.cyan("wraps selfhost deploy")} to finish deploying the self-hosted co
       );
       process.exit(1);
     }
-    const apiBaseUrl = selfhosted && selfhostService ? selfhostService.apiUrl : getApiBaseUrl();
+    const apiBaseUrl = selfhosted && selfhostService ? normalizeApiUrl(selfhostService.apiUrl) : getApiBaseUrl();
     const dashboardUrl = selfhosted && selfhostService ? selfhostService.config.appUrl : getAppBaseUrl();
     const hasEmail = !!metadata.services.email?.config;
     let token;
@@ -34306,22 +34309,51 @@ The deployment may have failed partway through. Re-run ${pc48.cyan("wraps selfho
     "# ============================================================================="
   );
   console.log("#");
-  console.log("# 1. In Vercel: Project Settings \u2192 Cloud \u2192 Configure AWS");
+  console.log("# 1. In AWS IAM \u2192 Identity providers \u2192 Add provider:");
+  console.log("#    Provider type: OpenID Connect");
+  console.log("#    Provider URL:  https://oidc.vercel.com/<team-slug>");
+  console.log("#    Audience:      https://vercel.com/<team-slug>");
+  console.log("#");
   console.log(
-    "#    Copy the OIDC Provider URL (looks like https://oidc.vercel.com/<team-id>)"
+    "# 3. Create an IAM role in this account with the following trust policy,"
   );
+  console.log("#    replacing <team-slug> with your Vercel team slug:");
   console.log("#");
-  console.log("# 2. In AWS IAM \u2192 Identity providers \u2192 Add provider:");
-  console.log("#    Provider type: OpenID Connect");
-  console.log("#    Provider URL:  <your Vercel OIDC URL from step 1>");
-  console.log("#    Audience:      sts.amazonaws.com");
-  console.log("#");
+  console.log("#    {");
+  console.log(`#      "Version": "2012-10-17",`);
+  console.log(`#      "Statement": [{`);
+  console.log(`#        "Effect": "Allow",`);
+  console.log(`#        "Principal": {`);
   console.log(
-    "# 3. Create an IAM role that trusts that OIDC provider, with this permission:"
+    `#          "Federated": "arn:aws:iam::${identity.accountId}:oidc-provider/oidc.vercel.com/<team-slug>"`
   );
+  console.log("#        },");
+  console.log(`#        "Action": "sts:AssumeRoleWithWebIdentity",`);
+  console.log(`#        "Condition": {`);
+  console.log(`#          "StringEquals": {`);
+  console.log(
+    `#            "oidc.vercel.com/<team-slug>:aud": "https://vercel.com/<team-slug>",`
+  );
+  console.log(
+    `#            "oidc.vercel.com/<team-slug>:sub": "owner:<team-slug>:project:<project-name>:environment:production"`
+  );
+  console.log("#          }");
+  console.log("#        }");
+  console.log("#      }]");
+  console.log("#    }");
+  console.log("#");
+  console.log("#    Attach this permission policy to the role:");
+  console.log("#");
+  console.log("#    {");
+  console.log(`#      "Version": "2012-10-17",`);
+  console.log(`#      "Statement": [{`);
+  console.log(`#        "Effect": "Allow",`);
+  console.log(`#        "Action": "sts:AssumeRole",`);
   console.log(
-    `#    sts:AssumeRole on arn:aws:iam::${identity.accountId}:role/wraps-console-access-role`
+    `#        "Resource": "arn:aws:iam::*:role/wraps-console-access-role"`
   );
+  console.log("#      }]");
+  console.log("#    }");
   console.log("#");
   console.log("# 4. Set AWS_ROLE_ARN to that role's ARN in Vercel:");
   console.log(