@wraps.dev/cli 2.23.3 → 2.25.0

package/dist/cli.js

@@ -9,12 +9,12 @@ var __export = (target, all6) => {
     __defProp(target, name, { get: all6[name], enumerable: true });
 };
 
-// ../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.14_tsx@4.20.6_typescript@5.9.3_yaml@2.8.4/node_modules/tsup/assets/esm_shims.js
+// ../../node_modules/.pnpm/tsup@8.5.1_jiti@2.7.0_postcss@8.5.15_tsx@4.20.6_typescript@5.9.3_yaml@2.8.4/node_modules/tsup/assets/esm_shims.js
 import path from "path";
 import { fileURLToPath } from "url";
 var getFilename, getDirname, __dirname;
 var init_esm_shims = __esm({
-  "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.14_tsx@4.20.6_typescript@5.9.3_yaml@2.8.4/node_modules/tsup/assets/esm_shims.js"() {
+  "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.7.0_postcss@8.5.15_tsx@4.20.6_typescript@5.9.3_yaml@2.8.4/node_modules/tsup/assets/esm_shims.js"() {
     "use strict";
     getFilename = () => fileURLToPath(import.meta.url);
     getDirname = () => path.dirname(getFilename());
@@ -3047,7 +3047,7 @@ async function previewDNSChanges(hostedZoneId, domain, dkimTokens, region, custo
   });
   const dmarcName = `_dmarc.${domain}`;
   const dmarcRuaDomain = mailFromDomain || domain;
-  const proposedDMARC = `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`;
+  const proposedDMARC = `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`;
   const existingDMARC = findExistingRecord(existingRecords, dmarcName, "TXT");
   const existingDMARCValue = getRecordValue(existingDMARC);
   let dmarcStatus = "new";
@@ -3209,7 +3209,7 @@ async function createSelectedDNSRecords(hostedZoneId, domain, dkimTokens, region
         TTL: 1800,
         ResourceRecords: [
           {
-            Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+            Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
           }
         ]
       }
@@ -3332,7 +3332,7 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       TTL: 1800,
       ResourceRecords: [
         {
-          Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         }
       ]
     }
@@ -3556,7 +3556,7 @@ var init_cloudflare = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -3942,7 +3942,7 @@ var init_vercel = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -4211,7 +4211,7 @@ function buildEmailDNSRecords(data) {
   records.push({
     name: `_dmarc.${domain}`,
     type: "TXT",
-    value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
+    value: `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}`,
     category: "dmarc"
   });
   if (customTrackingDomain) {
@@ -6263,7 +6263,7 @@ Verification should complete within a few minutes.`,
         ),
         "",
         pc10.bold("DMARC Record (TXT):"),
-        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
       );
       if (outputs.mailFromDomain) {
         dnsLines.push(
@@ -6492,7 +6492,7 @@ ${domainStrings.join("\n")}`);
           ),
           "",
           pc10.bold("DMARC Record (TXT):"),
-          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         );
       }
       if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
@@ -15408,6 +15408,9 @@ async function checkDmarc(domain) {
     valid: false,
     policy: null,
     subdomainPolicy: null,
+    nonExistentSubdomainPolicy: null,
+    testing: false,
+    psd: null,
     percentage: 100,
     reportingEnabled: false,
     ruaAddresses: [],
@@ -15460,6 +15463,21 @@ function parseDmarcRecord(record, result) {
   } else {
     result.subdomainPolicy = result.policy;
   }
+  const np = tags.get("np");
+  if (np) {
+    if (["none", "quarantine", "reject"].includes(np)) {
+      result.nonExistentSubdomainPolicy = np;
+    } else {
+      result.warnings.push(`Invalid non-existent subdomain policy (np): ${np}`);
+    }
+  }
+  if (tags.get("t") === "y") {
+    result.testing = true;
+  }
+  const psd = tags.get("psd");
+  if (psd && ["y", "n", "u"].includes(psd)) {
+    result.psd = psd;
+  }
   const pct = tags.get("pct");
   if (pct) {
     const pctNum = Number.parseInt(pct, 10);
@@ -15468,7 +15486,9 @@ function parseDmarcRecord(record, result) {
     } else {
       result.percentage = pctNum;
       if (pctNum < 100) {
-        result.warnings.push(`Only ${pctNum}% of messages subject to policy`);
+        result.warnings.push(
+          `pct=${pctNum} is deprecated (DMARCbis receivers ignore it; enforcement is all-or-nothing). Use t=y while testing instead.`
+        );
       }
     }
   }
@@ -15533,6 +15553,17 @@ function parseDmarcRecord(record, result) {
   if (result.subdomainPolicy === "none" && result.policy !== "none") {
     result.warnings.push("Subdomain policy is less strict than domain policy");
   }
+  const enforcing = result.policy === "quarantine" || result.policy === "reject";
+  if (result.testing && result.policy !== "none") {
+    result.warnings.push(
+      "t=y (testing) is set \u2014 receivers will not enforce the policy"
+    );
+  }
+  if (enforcing && !result.nonExistentSubdomainPolicy) {
+    result.warnings.push(
+      "No np= set \u2014 add np=reject to block spoofing from non-existent subdomains (DMARCbis)"
+    );
+  }
   if (!result.reportingEnabled) {
     result.warnings.push("No aggregate reporting configured (rua=)");
   }
@@ -16686,11 +16717,18 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC policy is none (not enforcing)"
     });
   }
-  if (dmarc.percentage < 100) {
+  if (dmarc.testing && dmarc.policy !== "none") {
     deductions.push({
       check: "dmarc",
       points: 2,
-      reason: `DMARC pct=${dmarc.percentage} (not 100%)`
+      reason: "DMARC testing mode (t=y) \u2014 receivers won't enforce the policy"
+    });
+  }
+  if (dmarc.percentage < 100) {
+    deductions.push({
+      check: "dmarc",
+      points: 1,
+      reason: `DMARC pct=${dmarc.percentage} is deprecated (DMARCbis receivers ignore it; enforcement is inconsistent)`
     });
   }
   if (!dmarc.reportingEnabled) {
@@ -16707,6 +16745,13 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC strict alignment configured"
     });
   }
+  if ((dmarc.policy === "quarantine" || dmarc.policy === "reject") && dmarc.nonExistentSubdomainPolicy === "reject") {
+    bonuses.push({
+      check: "dmarc",
+      points: 1,
+      reason: "np=reject blocks non-existent subdomain spoofing (DMARCbis)"
+    });
+  }
 }
 function collectInfraIssues(checks, deductions, bonuses) {
   if (checks.mx.exists) {
@@ -17839,8 +17884,19 @@ async function createEventBridgeResources(config2) {
   const target = new aws7.cloudwatch.EventTarget("wraps-email-events-target", {
     rule: rule.name,
     eventBusName,
-    arn: config2.queueArn
+    arn: config2.queueArn,
+    deadLetterConfig: { arn: config2.dlqArn }
   });
+  const archive = new aws7.cloudwatch.EventArchive(
+    "wraps-email-events-archive",
+    {
+      name: "wraps-email-events-archive",
+      eventSourceArn: config2.eventBusArn,
+      description: "Wraps: 30-day archive of SES events for outage replay (see wraps email doctor)",
+      retentionDays: 30,
+      eventPattern: JSON.stringify({ source: ["aws.ses"] })
+    }
+  );
   let webhookConnection;
   let webhookApiDestination;
   let webhookTarget;
@@ -17911,7 +17967,8 @@ async function createEventBridgeResources(config2) {
       rule: rule.name,
       eventBusName,
       arn: webhookApiDestination.arn,
-      roleArn: webhookRole.arn
+      roleArn: webhookRole.arn,
+      deadLetterConfig: { arn: config2.dlqArn }
     });
   }
   let userWebhookConnection;
@@ -17929,9 +17986,33 @@ async function createEventBridgeResources(config2) {
     userWebhookApiDestination = userWebhookResources.apiDestination;
     userWebhookTarget = userWebhookResources.target;
   }
+  const alarmActions = config2.alertTopicArn ? [config2.alertTopicArn] : void 0;
+  const failedInvocationsAlarm = new aws7.cloudwatch.MetricAlarm(
+    "wraps-email-events-delivery-failures",
+    {
+      name: "wraps-email-events-delivery-failures",
+      namespace: "AWS/Events",
+      metricName: "FailedInvocations",
+      dimensions: { RuleName: "wraps-email-events-to-sqs" },
+      statistic: "Sum",
+      period: 300,
+      evaluationPeriods: 3,
+      threshold: 1,
+      comparisonOperator: "GreaterThanOrEqualToThreshold",
+      treatMissingData: "notBreaching",
+      alarmDescription: "SES event delivery from EventBridge is failing (dead target or deauthorized webhook). Event history is being lost \u2014 run `wraps email doctor`.",
+      ...alarmActions ? { alarmActions, okActions: alarmActions } : {},
+      tags: {
+        ManagedBy: "wraps-cli",
+        Service: "email"
+      }
+    }
+  );
   return {
     rule,
     target,
+    failedInvocationsAlarm,
+    archive,
     webhookConnection,
     webhookApiDestination,
     webhookTarget,
@@ -18376,6 +18457,30 @@ async function createSQSResources(config2) {
     ...SQS_TIMEOUTS,
     ...dlqUrl ? { import: dlqUrl } : {}
   });
+  const ruleArn = `arn:aws:events:${config2.region}:${config2.accountId}:rule/wraps-email-events-to-sqs`;
+  new aws11.sqs.QueuePolicy("wraps-email-events-dlq-policy", {
+    queueUrl: dlq.url,
+    policy: dlq.arn.apply(
+      (dlqArn) => JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Service: "events.amazonaws.com"
+            },
+            Action: "sqs:SendMessage",
+            Resource: dlqArn,
+            Condition: {
+              ArnEquals: {
+                "aws:SourceArn": ruleArn
+              }
+            }
+          }
+        ]
+      })
+    )
+  });
   const queueConfig = {
     name: queueName,
     visibilityTimeoutSeconds: 300,
@@ -18505,13 +18610,27 @@ async function deployEmailStack(config2) {
   }
   let sqsResources;
   if (emailConfig.eventTracking?.enabled) {
-    sqsResources = await createSQSResources({ region: config2.region });
+    sqsResources = await createSQSResources({
+      region: config2.region,
+      accountId
+    });
+  }
+  let alertingResources;
+  if (emailConfig.alerts?.enabled) {
+    alertingResources = await createAlertingResources({
+      alertConfig: emailConfig.alerts,
+      configSetName: sesResources?.configSet.configurationSetName,
+      dlqName: sqsResources ? "wraps-email-events-dlq" : void 0,
+      region: config2.region
+    });
   }
   if (emailConfig.eventTracking?.enabled && sesResources && sqsResources) {
     await createEventBridgeResources({
       eventBusArn: sesResources.eventBus.arn,
       queueArn: sqsResources.queue.arn,
       queueUrl: sqsResources.queue.url,
+      dlqArn: sqsResources.dlq.arn,
+      alertTopicArn: alertingResources?.topic.arn,
       // Include webhook config if provided (for Wraps platform integration)
       webhook: config2.webhook,
       // Include user webhook config if provided
@@ -18552,15 +18671,6 @@ async function deployEmailStack(config2) {
       region: config2.region
     });
   }
-  let alertingResources;
-  if (emailConfig.alerts?.enabled) {
-    alertingResources = await createAlertingResources({
-      alertConfig: emailConfig.alerts,
-      configSetName: sesResources?.configSet.configurationSetName,
-      dlqName: sqsResources ? "wraps-email-events-dlq" : void 0,
-      region: config2.region
-    });
-  }
   let inboundResources;
   let replySecretsOutput;
   if (emailConfig.inbound?.enabled) {
@@ -19509,6 +19619,26 @@ async function emailDestroy(options) {
   const domain = emailConfig?.domain;
   const storedStackName = emailService?.pulumiStackName;
   if (!(options.force || options.preview)) {
+    const additionalDomainNames = (emailConfig?.additionalDomains ?? []).map((d) => d.domain).filter(Boolean);
+    const domainList = [domain, ...additionalDomainNames].filter(Boolean);
+    const summaryLines = [
+      domainList.length > 0 ? `Domain(s): ${domainList.join(", ")}` : "Domain(s): none configured",
+      "SES configuration sets and event destinations for the above domain(s)",
+      "Event pipeline: wraps-email-events / wraps-email-events-dlq queues, wraps-email-event-processor Lambda, EventBridge rule wraps-email-events-to-sqs",
+      "",
+      pc20.yellow(
+        "Event streaming stops: the Wraps dashboard email timeline and event history for THIS ENTIRE AWS ACCOUNT stop receiving events. Historical events in DynamoDB are destroyed with the table. This cannot be undone."
+      )
+    ];
+    if (emailService?.webhookSecret) {
+      summaryLines.push(
+        "",
+        pc20.yellow(
+          "This account is connected to the Wraps platform \u2014 the dashboard will stop receiving events for it."
+        )
+      );
+    }
+    clack18.note(summaryLines.join("\n"), "What will be destroyed");
     const confirmed = await clack18.confirm({
       message: pc20.red(
         "Are you sure you want to destroy all email infrastructure?"
@@ -19519,6 +19649,19 @@ async function emailDestroy(options) {
       clack18.cancel("Destruction cancelled.");
       process.exit(0);
     }
+    if (emailService?.webhookSecret) {
+      const typed = await clack18.text({
+        message: `Type the AWS account id (${identity.accountId}) to confirm destruction of a platform-connected account:`
+      });
+      if (clack18.isCancel(typed) || typed !== identity.accountId) {
+        clack18.cancel("Destruction cancelled \u2014 account id did not match.");
+        process.exit(0);
+      }
+    }
+  } else if (options.force && emailService?.webhookSecret) {
+    clack18.log.warn(
+      `--force skipped the typed account-id confirmation for platform-connected account ${identity.accountId}.`
+    );
   }
   let shouldCleanDNS = false;
   let hostedZone = null;
@@ -19764,12 +19907,6 @@ Run ${pc20.cyan("wraps email init")} to deploy infrastructure again.
 // src/commands/email/doctor.ts
 init_esm_shims();
 init_events();
-init_aws();
-init_fs();
-init_json_output();
-init_metadata();
-init_output();
-init_scanner();
 import { DeleteTableCommand, DynamoDBClient as DynamoDBClient2 } from "@aws-sdk/client-dynamodb";
 import {
   DeleteRoleCommand,
@@ -19785,6 +19922,458 @@ import { DeleteTopicCommand, SNSClient as SNSClient2 } from "@aws-sdk/client-sns
 import * as clack19 from "@clack/prompts";
 import * as pulumi17 from "@pulumi/pulumi";
 import pc21 from "picocolors";
+
+// src/utils/email/event-pipeline-check.ts
+init_esm_shims();
+init_errors();
+init_config_set_slug();
+var EVENT_DESTINATION_NAME = "wraps-email-eventbridge";
+var CONFIG_SET_FALLBACK = "wraps-email-tracking";
+var RULE_NAME = "wraps-email-events-to-sqs";
+var QUEUE_NAME = "wraps-email-events";
+var DLQ_NAME = "wraps-email-events-dlq";
+var LAMBDA_FUNCTION_NAME = "wraps-email-event-processor";
+var WEBHOOK_DESTINATION_NAME = "wraps-webhook-destination";
+var WEBHOOK_CONNECTION_NAME = "wraps-webhook-connection";
+var HISTORY_TABLE_NAME = "wraps-email-history";
+var UPGRADE_HINT = "wraps email upgrade";
+function summarizeError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isQueueNotFoundError(error) {
+  return isAWSNotFoundError(error) || error instanceof Error && error.name === "QueueDoesNotExist";
+}
+async function checkConfigSet(configSetName, region, optional) {
+  const hop = `SES config set ${configSetName}`;
+  try {
+    const { SESv2Client: SESv2Client10, GetConfigurationSetEventDestinationsCommand: GetConfigurationSetEventDestinationsCommand2 } = await import("@aws-sdk/client-sesv2");
+    const client = new SESv2Client10({ region });
+    const response = await client.send(
+      new GetConfigurationSetEventDestinationsCommand2({
+        ConfigurationSetName: configSetName
+      })
+    );
+    const destination = response.EventDestinations?.find(
+      (d) => d.Name === EVENT_DESTINATION_NAME
+    );
+    if (destination?.Enabled) {
+      return {
+        hop,
+        status: "pass",
+        details: `${EVENT_DESTINATION_NAME} enabled`
+      };
+    }
+    return {
+      hop,
+      status: "fail",
+      details: `SES emits no events for ${configSetName} \u2014 redeploy with \`${UPGRADE_HINT}\``
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      if (optional) {
+        return null;
+      }
+      return {
+        hop,
+        status: "fail",
+        details: `Configuration set not found \u2014 redeploy with \`${UPGRADE_HINT}\``
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check event destinations: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkRule(region) {
+  const hop = `EventBridge rule ${RULE_NAME}`;
+  try {
+    const { EventBridgeClient, DescribeRuleCommand } = await import("@aws-sdk/client-eventbridge");
+    const client = new EventBridgeClient({ region });
+    const response = await client.send(
+      new DescribeRuleCommand({ Name: RULE_NAME })
+    );
+    if (response.State === "ENABLED") {
+      return {
+        exists: true,
+        check: { hop, status: "pass", details: "Rule enabled" }
+      };
+    }
+    return {
+      exists: true,
+      check: {
+        hop,
+        status: "fail",
+        details: `Rule is ${response.State ?? "in an unknown state"} \u2014 run \`${UPGRADE_HINT}\` to re-enable`
+      }
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return {
+        exists: false,
+        check: {
+          hop,
+          status: "fail",
+          details: `Rule not found \u2014 SES events have nowhere to go; run \`${UPGRADE_HINT}\``
+        }
+      };
+    }
+    return {
+      exists: false,
+      check: {
+        hop,
+        status: "warn",
+        details: `Could not check rule: ${summarizeError(error)}`
+      }
+    };
+  }
+}
+async function checkQueueExists(queueName, region, failDetails) {
+  const hop = `SQS queue ${queueName}`;
+  try {
+    const { SQSClient, GetQueueUrlCommand } = await import("@aws-sdk/client-sqs");
+    const client = new SQSClient({ region });
+    await client.send(new GetQueueUrlCommand({ QueueName: queueName }));
+    return { hop, status: "pass", details: "Queue exists" };
+  } catch (error) {
+    if (isQueueNotFoundError(error)) {
+      return { hop, status: "fail", details: failDetails };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check queue: ${summarizeError(error)}`
+    };
+  }
+}
+function findDuplicateTargetChecks(targets) {
+  const idsByArn = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    if (!target.Arn) {
+      continue;
+    }
+    const ids = idsByArn.get(target.Arn) ?? [];
+    ids.push(target.Id ?? "unknown");
+    idsByArn.set(target.Arn, ids);
+  }
+  const checks = [];
+  for (const [arn, ids] of idsByArn) {
+    if (ids.length > 1) {
+      checks.push({
+        hop: "EventBridge rule targets",
+        status: "warn",
+        details: `Duplicate targets for ${arn}: ${ids.join(", ")}`
+      });
+    }
+  }
+  return checks;
+}
+function checkSqsTargetOnRule(targets, region) {
+  const failDetails = `events are being dropped \u2014 run \`${UPGRADE_HINT}\` to recreate the queue`;
+  const sqsTarget = targets.find((t) => t.Arn?.split(":")[2] === "sqs");
+  if (!sqsTarget) {
+    return Promise.resolve({
+      hop: `SQS queue ${QUEUE_NAME}`,
+      status: "fail",
+      details: `No SQS target on rule \u2014 ${failDetails}`
+    });
+  }
+  return checkQueueExists(QUEUE_NAME, region, failDetails);
+}
+function checkPlatformWebhookTargetPresence(webhookTargetPresent, expectPlatformWebhook) {
+  if (expectPlatformWebhook && !webhookTargetPresent) {
+    return {
+      hop: "Platform webhook target",
+      status: "fail",
+      details: `platform webhook target missing but metadata says connected \u2014 dashboard receives no events; run \`${UPGRADE_HINT}\``
+    };
+  }
+  if (!expectPlatformWebhook && webhookTargetPresent) {
+    return {
+      hop: "Platform webhook target",
+      status: "warn",
+      details: "Webhook target exists on the rule but metadata has no webhookSecret \u2014 stack/metadata mismatch, possibly a lost metadata file"
+    };
+  }
+  if (expectPlatformWebhook && webhookTargetPresent) {
+    return {
+      hop: "Platform webhook target",
+      status: "pass",
+      details: "Platform webhook target present"
+    };
+  }
+  return null;
+}
+async function checkRuleTargets(region, expectPlatformWebhook) {
+  try {
+    const { EventBridgeClient, ListTargetsByRuleCommand } = await import("@aws-sdk/client-eventbridge");
+    const client = new EventBridgeClient({ region });
+    const response = await client.send(
+      new ListTargetsByRuleCommand({ Rule: RULE_NAME })
+    );
+    const targets = response.Targets ?? [];
+    const checks = [...findDuplicateTargetChecks(targets)];
+    checks.push(await checkSqsTargetOnRule(targets, region));
+    const webhookTargetPresent = targets.some(
+      (t) => t.Arn?.includes(WEBHOOK_DESTINATION_NAME)
+    );
+    const webhookCheck = checkPlatformWebhookTargetPresence(
+      webhookTargetPresent,
+      expectPlatformWebhook
+    );
+    if (webhookCheck) {
+      checks.push(webhookCheck);
+    }
+    return { checks, webhookTargetPresent };
+  } catch (error) {
+    return {
+      checks: [
+        {
+          hop: "EventBridge rule targets",
+          status: "warn",
+          details: `Could not list rule targets: ${summarizeError(error)}`
+        }
+      ],
+      webhookTargetPresent: false
+    };
+  }
+}
+async function checkWebhookDestination(region) {
+  const hop = `EventBridge API destination ${WEBHOOK_DESTINATION_NAME}`;
+  try {
+    const { EventBridgeClient, DescribeApiDestinationCommand } = await import("@aws-sdk/client-eventbridge");
+    const client = new EventBridgeClient({ region });
+    const response = await client.send(
+      new DescribeApiDestinationCommand({ Name: WEBHOOK_DESTINATION_NAME })
+    );
+    if (response.ApiDestinationState === "ACTIVE") {
+      return { hop, status: "pass", details: "Active" };
+    }
+    return {
+      hop,
+      status: "fail",
+      details: `API destination is ${response.ApiDestinationState ?? "in an unknown state"} \u2014 re-run \`${UPGRADE_HINT}\` to re-authorize`
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return {
+        hop,
+        status: "fail",
+        details: `API destination not found \u2014 re-run \`${UPGRADE_HINT}\``
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check API destination: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkWebhookConnection(region) {
+  const hop = `EventBridge connection ${WEBHOOK_CONNECTION_NAME}`;
+  try {
+    const { EventBridgeClient, DescribeConnectionCommand } = await import("@aws-sdk/client-eventbridge");
+    const client = new EventBridgeClient({ region });
+    const response = await client.send(
+      new DescribeConnectionCommand({ Name: WEBHOOK_CONNECTION_NAME })
+    );
+    if (response.ConnectionState === "AUTHORIZED") {
+      return { hop, status: "pass", details: "Authorized" };
+    }
+    return {
+      hop,
+      status: "fail",
+      details: `Connection is ${response.ConnectionState ?? "in an unknown state"} \u2014 re-run \`${UPGRADE_HINT}\` to re-authorize`
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return {
+        hop,
+        status: "fail",
+        details: `Connection not found \u2014 re-run \`${UPGRADE_HINT}\``
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check connection: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkDLQ(region) {
+  const hop = `SQS DLQ ${DLQ_NAME}`;
+  try {
+    const { SQSClient, GetQueueUrlCommand, GetQueueAttributesCommand } = await import("@aws-sdk/client-sqs");
+    const client = new SQSClient({ region });
+    const urlResponse = await client.send(
+      new GetQueueUrlCommand({ QueueName: DLQ_NAME })
+    );
+    const attrResponse = await client.send(
+      new GetQueueAttributesCommand({
+        QueueUrl: urlResponse.QueueUrl,
+        AttributeNames: ["ApproximateNumberOfMessages"]
+      })
+    );
+    const count = Number(
+      attrResponse.Attributes?.ApproximateNumberOfMessages ?? "0"
+    );
+    if (count > 0) {
+      return {
+        hop,
+        status: "warn",
+        details: `${count} dead-lettered event(s) \u2014 investigate before they age out`
+      };
+    }
+    return { hop, status: "pass", details: "Empty" };
+  } catch (error) {
+    if (isQueueNotFoundError(error)) {
+      return {
+        hop,
+        status: "fail",
+        details: `Dead-letter queue missing \u2014 run \`${UPGRADE_HINT}\` to recreate it`
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check DLQ: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkEventSourceMapping(region) {
+  const hop = `Lambda event source mapping ${LAMBDA_FUNCTION_NAME}`;
+  try {
+    const { LambdaClient: LambdaClient3, ListEventSourceMappingsCommand } = await import("@aws-sdk/client-lambda");
+    const client = new LambdaClient3({ region });
+    const response = await client.send(
+      new ListEventSourceMappingsCommand({ FunctionName: LAMBDA_FUNCTION_NAME })
+    );
+    const mapping = response.EventSourceMappings?.find(
+      (m) => m.EventSourceArn?.endsWith(`:${QUEUE_NAME}`)
+    );
+    if (!mapping) {
+      return {
+        hop,
+        status: "fail",
+        details: `No event source mapping from ${QUEUE_NAME} \u2014 Lambda never runs; run \`${UPGRADE_HINT}\``
+      };
+    }
+    if (mapping.State === "Enabled") {
+      return { hop, status: "pass", details: "Mapping enabled" };
+    }
+    return {
+      hop,
+      status: "fail",
+      details: `Mapping is ${mapping.State ?? "in an unknown state"} \u2014 run \`${UPGRADE_HINT}\` to re-enable`
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return {
+        hop,
+        status: "fail",
+        details: `Lambda function not found \u2014 run \`${UPGRADE_HINT}\``
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check event source mapping: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkHistoryTable(region) {
+  const hop = `DynamoDB table ${HISTORY_TABLE_NAME}`;
+  try {
+    const { DynamoDBClient: DynamoDBClient7, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
+    const client = new DynamoDBClient7({ region });
+    const response = await client.send(
+      new DescribeTableCommand2({ TableName: HISTORY_TABLE_NAME })
+    );
+    const status2 = response.Table?.TableStatus;
+    if (status2 === "ACTIVE") {
+      return { hop, status: "pass", details: "Active" };
+    }
+    return {
+      hop,
+      status: "fail",
+      details: `Table status is ${status2 ?? "unknown"} \u2014 event log may be unavailable; run \`${UPGRADE_HINT}\``
+    };
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return {
+        hop,
+        status: "fail",
+        details: `Table not found \u2014 event history is not being recorded; run \`${UPGRADE_HINT}\``
+      };
+    }
+    return {
+      hop,
+      status: "warn",
+      details: `Could not check table: ${summarizeError(error)}`
+    };
+  }
+}
+async function checkEventPipeline(params) {
+  const { region, domains, expectPlatformWebhook } = params;
+  const checks = [];
+  const uniqueConfigSetNames = Array.from(
+    new Set(domains.map((d) => domainToConfigSetName(d)))
+  );
+  if (uniqueConfigSetNames.length === 0) {
+    const check2 = await checkConfigSet(CONFIG_SET_FALLBACK, region, false);
+    if (check2) {
+      checks.push(check2);
+    }
+  } else {
+    for (const name of uniqueConfigSetNames) {
+      const check2 = await checkConfigSet(name, region, false);
+      if (check2) {
+        checks.push(check2);
+      }
+    }
+    const fallbackCheck = await checkConfigSet(
+      CONFIG_SET_FALLBACK,
+      region,
+      true
+    );
+    if (fallbackCheck) {
+      checks.push(fallbackCheck);
+    }
+  }
+  const ruleResult = await checkRule(region);
+  checks.push(ruleResult.check);
+  let webhookTargetPresent = false;
+  if (ruleResult.exists) {
+    const targetsResult = await checkRuleTargets(region, expectPlatformWebhook);
+    checks.push(...targetsResult.checks);
+    webhookTargetPresent = targetsResult.webhookTargetPresent;
+  }
+  if (webhookTargetPresent) {
+    checks.push(await checkWebhookDestination(region));
+    checks.push(await checkWebhookConnection(region));
+  }
+  checks.push(await checkDLQ(region));
+  checks.push(await checkEventSourceMapping(region));
+  checks.push(await checkHistoryTable(region));
+  return checks;
+}
+
+// src/commands/email/doctor.ts
+init_aws();
+init_fs();
+init_json_output();
+init_metadata();
+init_output();
+init_scanner();
+function pipelineChecksToDoctorResults(pipelineChecks) {
+  return pipelineChecks.map((check2) => ({
+    status: check2.status,
+    category: "Event Pipeline",
+    name: check2.hop,
+    details: check2.details
+  }));
+}
 function runResourceDiagnostics(wrapsResources, hasStack) {
   const results = [];
   const orphanSuffix = hasStack ? void 0 : " (orphan \u2014 no Pulumi state)";
@@ -19880,11 +20469,11 @@ async function emailDoctor(options) {
     async () => validateAWSCredentials()
   );
   let region = options.region || await getAWSRegion();
+  const emailConnections = await findConnectionsWithService(
+    identity.accountId,
+    "email"
+  );
   if (!(options.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION)) {
-    const emailConnections = await findConnectionsWithService(
-      identity.accountId,
-      "email"
-    );
     if (emailConnections.length === 1) {
       region = emailConnections[0].region;
     } else if (emailConnections.length > 1 && !isJsonMode()) {
@@ -19919,8 +20508,23 @@ async function emailDoctor(options) {
   } catch (_error) {
     hasStack = false;
   }
+  const emailConnection = emailConnections.find((c) => c.region === region);
+  let pipelineResults = [];
+  if (emailConnection) {
+    const emailService = emailConnection.services.email;
+    const domains = emailService?.config ? getAllTrackedDomains(emailConnection).map((d) => d.domain) : [];
+    const expectPlatformWebhook = Boolean(emailService?.webhookSecret);
+    const pipelineChecks = await progress.execute(
+      "Checking event pipeline",
+      async () => checkEventPipeline({ region, domains, expectPlatformWebhook })
+    );
+    pipelineResults = pipelineChecksToDoctorResults(pipelineChecks);
+  }
   progress.stop();
-  const results = runResourceDiagnostics(wrapsResources, hasStack);
+  const results = [
+    ...runResourceDiagnostics(wrapsResources, hasStack),
+    ...pipelineResults
+  ];
   if (isJsonMode()) {
     jsonSuccess("email.doctor", {
       region,
@@ -19935,7 +20539,7 @@ async function emailDoctor(options) {
     });
     return;
   }
-  if (totalResources === 0) {
+  if (results.length === 0) {
     clack19.log.info("No wraps-* resources found in this region.");
     clack19.outro(pc21.dim("Your AWS account is clean."));
   } else {
@@ -21922,7 +22526,7 @@ import {
   UpdateReceiptRuleCommand
 } from "@aws-sdk/client-ses";
 var RULE_SET_NAME = "wraps-inbound-rules";
-var RULE_NAME = "wraps-inbound-catch-all";
+var RULE_NAME2 = "wraps-inbound-catch-all";
 function createSESClient(region) {
   return new SESClient4({ region });
 }
@@ -21947,13 +22551,13 @@ async function createReceiptRule(region, receivingDomain, s3BucketName) {
     await ses.send(
       new DescribeReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
     await ses.send(
       new DeleteReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
   } catch (error) {
@@ -21965,7 +22569,7 @@ async function createReceiptRule(region, receivingDomain, s3BucketName) {
     new CreateReceiptRuleCommand({
       RuleSetName: RULE_SET_NAME,
       Rule: {
-        Name: RULE_NAME,
+        Name: RULE_NAME2,
         Enabled: true,
         ScanEnabled: true,
         // Enable spam and virus scanning
@@ -22013,7 +22617,7 @@ async function deleteReceiptRule(region) {
     await ses.send(
       new DeleteReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
   } catch (error) {
@@ -22048,7 +22652,7 @@ async function addDomainToReceiptRule(region, domain, s3BucketName) {
     const response = await ses.send(
       new DescribeReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
     const existingRecipients = response.Rule?.Recipients ?? [];
@@ -22059,7 +22663,7 @@ async function addDomainToReceiptRule(region, domain, s3BucketName) {
       new UpdateReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
         Rule: {
-          Name: RULE_NAME,
+          Name: RULE_NAME2,
           Enabled: response.Rule?.Enabled,
           ScanEnabled: response.Rule?.ScanEnabled,
           TlsPolicy: response.Rule?.TlsPolicy,
@@ -22084,7 +22688,7 @@ async function removeDomainFromReceiptRule(region, domain) {
     const response = await ses.send(
       new DescribeReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
     const existingRecipients = response.Rule?.Recipients ?? [];
@@ -22097,7 +22701,7 @@ async function removeDomainFromReceiptRule(region, domain) {
       new UpdateReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
         Rule: {
-          Name: RULE_NAME,
+          Name: RULE_NAME2,
           Enabled: response.Rule?.Enabled,
           ScanEnabled: response.Rule?.ScanEnabled,
           TlsPolicy: response.Rule?.TlsPolicy,
@@ -22119,7 +22723,7 @@ async function getReceiptRuleDomains(region) {
     const response = await ses.send(
       new DescribeReceiptRuleCommand({
         RuleSetName: RULE_SET_NAME,
-        RuleName: RULE_NAME
+        RuleName: RULE_NAME2
       })
     );
     return response.Rule?.Recipients ?? [];
@@ -26840,7 +27444,7 @@ init_esm_shims();
 // src/utils/email/template-mustache-case.ts
 init_esm_shims();
 var HANDLEBARS_BLOCK_HELPERS = /* @__PURE__ */ new Set(["if", "unless", "each", "with"]);
-function normalizePlainTextMustaches(text12, canonicalVars) {
+function normalizePlainTextMustaches(text13, canonicalVars) {
   const canonicalByLower = /* @__PURE__ */ new Map();
   for (const name of canonicalVars) {
     canonicalByLower.set(name.toLowerCase(), name);
@@ -26848,7 +27452,7 @@ function normalizePlainTextMustaches(text12, canonicalVars) {
   function restoreIdentifier(name) {
     return canonicalByLower.get(name.toLowerCase()) ?? name;
   }
-  return text12.replace(
+  return text13.replace(
     /\{\{([#/]?)([A-Z][A-Z0-9_]*(?:\.[A-Z0-9_]+)*)((?:\s+[A-Z0-9_.]+)*)\s*\}\}/g,
     (match, sigil, name, args) => {
       const lower = name.toLowerCase();
@@ -26898,8 +27502,8 @@ async function renderTemplateWithProxy(Component) {
     match = regex.exec(html);
   }
   const canonicalVars = /* @__PURE__ */ new Set([...htmlVarNames, ...accessedProps]);
-  const text12 = normalizePlainTextMustaches(rawText, canonicalVars);
-  return { html, text: text12, accessedProps };
+  const text13 = normalizePlainTextMustaches(rawText, canonicalVars);
+  return { html, text: text13, accessedProps };
 }
 
 // src/commands/email/templates/push.ts
@@ -27138,11 +27742,11 @@ async function compileTemplate(filePath, slug, source, sourceHash, wrapsDir) {
       "Template must have a default export (React component function)"
     );
   }
-  const { html, text: text12, accessedProps } = await renderTemplateWithProxy(Component);
+  const { html, text: text13, accessedProps } = await renderTemplateWithProxy(Component);
   const variables = mergeVariables(extractVariables(html), accessedProps);
   const sesSubject = transformVariablesForSes(subject);
   const sesHtml = transformVariablesForSes(html);
-  const sesText = transformVariablesForSes(text12);
+  const sesText = transformVariablesForSes(text13);
   const sesTemplateName = slug.replace(/[^a-zA-Z0-9-_]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").substring(0, 64);
   return {
     slug,
@@ -29545,6 +30149,28 @@ ${pc37.green("\u2713")} ${pc37.bold("Upgrade complete!")}
     }
   }
   await saveConnectionMetadata(metadata);
+  try {
+    const domains = getAllTrackedDomains(metadata).map((d) => d.domain);
+    const pipelineChecks = await checkEventPipeline({
+      region: outputs.region ?? region,
+      domains,
+      expectPlatformWebhook: Boolean(metadata.services.email?.webhookSecret)
+    });
+    const issues = pipelineChecks.filter((check2) => check2.status !== "pass");
+    if (issues.length > 0 && !isJsonMode()) {
+      for (const issue of issues) {
+        clack36.log.warn(
+          `Post-deploy pipeline check: ${issue.hop} \u2014 ${issue.details}`
+        );
+      }
+    }
+  } catch (error) {
+    if (!isJsonMode()) {
+      clack36.log.warn(
+        `Post-deploy pipeline check failed to run: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
   if (isJsonMode()) {
     jsonSuccess("email.upgrade", {
       upgraded: true,