@wraps.dev/cli 2.24.0 → 2.25.1

package/README.md

@@ -2,6 +2,8 @@
 
 > Deploy email, SMS, and CDN infrastructure to your AWS account.
 
+**AI agents:** fetch [wraps.dev/llms-full.txt](https://wraps.dev/llms-full.txt) for the complete documentation in one file, or [wraps.dev/llms.txt](https://wraps.dev/llms.txt) for an agent-oriented index.
+
 ## What It Creates
 
 ### Email (`wraps email init`)
@@ -502,7 +504,7 @@ DMARC (TXT)
 Policy for how receivers handle emails failing DKIM/SPF checks
 
   TXT    _dmarc.example.com
-  →      v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com
+  →      v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@example.com
 ```
 
 ## Hosting Provider Integration

package/dist/cli.js

@@ -822,7 +822,7 @@ function pulumiErrorToWrapsError(code, iamAction, service, resourceName, resourc
       );
   }
 }
-var WrapsError, errors;
+var WrapsError, CREDENTIAL_OPTIONS, errors;
 var init_errors = __esm({
   "src/utils/shared/errors.ts"() {
     "use strict";
@@ -838,11 +838,12 @@ var init_errors = __esm({
         this.name = "WrapsError";
       }
     };
+    CREDENTIAL_OPTIONS = "Wraps couldn't find working AWS credentials. Any of these work:\n\nAWS SSO:\n  aws configure sso\n  aws sso login\n\nIAM access keys:\n  aws configure\n\nEnvironment variables:\n  export AWS_ACCESS_KEY_ID=<your-key>\n  export AWS_SECRET_ACCESS_KEY=<your-secret>\n\nExisting profile:\n  export AWS_PROFILE=<profile-name>";
     errors = {
       noAWSCredentials: () => new WrapsError(
         "AWS credentials not found",
         "NO_AWS_CREDENTIALS",
-        "Run: aws configure\nOr set AWS_PROFILE environment variable",
+        CREDENTIAL_OPTIONS,
         "https://wraps.dev/docs/guides/aws-setup"
       ),
       stackExists: (stackName) => new WrapsError(
@@ -966,7 +967,7 @@ Or configure a new profile:
       credentialsFileMissing: () => new WrapsError(
         "AWS credentials file not found",
         "CREDENTIALS_FILE_MISSING",
-        "Configure AWS credentials:\n  aws configure\n\nOr set environment variables:\n  export AWS_ACCESS_KEY_ID=<your-key>\n  export AWS_SECRET_ACCESS_KEY=<your-secret>",
+        CREDENTIAL_OPTIONS,
         "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       accessKeyInvalid: () => new WrapsError(
@@ -1191,22 +1192,27 @@ async function validateAWSCredentials() {
 async function validateAWSCredentialsWithDetails() {
   const state = await detectAWSState();
   const warnings = [];
-  if (state.sso.configured && state.sso.tokenStatus?.expired) {
-    const profile = state.sso.activeProfile?.name;
-    throw errors.ssoSessionExpired(profile);
-  }
-  if (state.sso.configured && state.sso.tokenStatus?.valid && state.sso.tokenStatus.minutesRemaining !== null && state.sso.tokenStatus.minutesRemaining < 15) {
-    const minutes = state.sso.tokenStatus.minutesRemaining;
-    const loginCmd = getSSOLoginCommand(state.sso.activeProfile?.name);
-    warnings.push(
-      `SSO session expires in ${minutes} minute${minutes !== 1 ? "s" : ""}. Run "${loginCmd}" to refresh.`
-    );
-  }
-  const currentProfile = getCurrentProfile();
-  if (currentProfile && currentProfile !== "default") {
-    const availableProfiles = getConfiguredProfiles();
-    if (!availableProfiles.includes(currentProfile)) {
-      throw errors.profileNotFound(currentProfile, availableProfiles);
+  const hasStaticEnvCredentials = Boolean(
+    process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY
+  );
+  if (!hasStaticEnvCredentials) {
+    if (state.sso.configured && state.sso.tokenStatus?.expired) {
+      const profile = state.sso.activeProfile?.name;
+      throw errors.ssoSessionExpired(profile);
+    }
+    if (state.sso.configured && state.sso.tokenStatus?.valid && state.sso.tokenStatus.minutesRemaining !== null && state.sso.tokenStatus.minutesRemaining < 15) {
+      const minutes = state.sso.tokenStatus.minutesRemaining;
+      const loginCmd = getSSOLoginCommand(state.sso.activeProfile?.name);
+      warnings.push(
+        `SSO session expires in ${minutes} minute${minutes !== 1 ? "s" : ""}. Run "${loginCmd}" to refresh.`
+      );
+    }
+    const currentProfile = getCurrentProfile();
+    if (currentProfile && currentProfile !== "default") {
+      const availableProfiles = getConfiguredProfiles();
+      if (!availableProfiles.includes(currentProfile)) {
+        throw errors.profileNotFound(currentProfile, availableProfiles);
+      }
     }
   }
   const sts = new STSClient2({ region: "us-east-1" });
@@ -3047,7 +3053,7 @@ async function previewDNSChanges(hostedZoneId, domain, dkimTokens, region, custo
   });
   const dmarcName = `_dmarc.${domain}`;
   const dmarcRuaDomain = mailFromDomain || domain;
-  const proposedDMARC = `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`;
+  const proposedDMARC = `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`;
   const existingDMARC = findExistingRecord(existingRecords, dmarcName, "TXT");
   const existingDMARCValue = getRecordValue(existingDMARC);
   let dmarcStatus = "new";
@@ -3209,7 +3215,7 @@ async function createSelectedDNSRecords(hostedZoneId, domain, dkimTokens, region
         TTL: 1800,
         ResourceRecords: [
           {
-            Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+            Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
           }
         ]
       }
@@ -3332,7 +3338,7 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       TTL: 1800,
       ResourceRecords: [
         {
-          Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         }
       ]
     }
@@ -3556,7 +3562,7 @@ var init_cloudflare = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -3942,7 +3948,7 @@ var init_vercel = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -4211,7 +4217,7 @@ function buildEmailDNSRecords(data) {
   records.push({
     name: `_dmarc.${domain}`,
     type: "TXT",
-    value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
+    value: `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}`,
     category: "dmarc"
   });
   if (customTrackingDomain) {
@@ -6263,7 +6269,7 @@ Verification should complete within a few minutes.`,
         ),
         "",
         pc10.bold("DMARC Record (TXT):"),
-        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
       );
       if (outputs.mailFromDomain) {
         dnsLines.push(
@@ -6492,7 +6498,7 @@ ${domainStrings.join("\n")}`);
           ),
           "",
           pc10.bold("DMARC Record (TXT):"),
-          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         );
       }
       if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
@@ -13020,6 +13026,11 @@ async function init(options) {
     );
   }
   const progress = new DeploymentProgress();
+  const identity = await progress.execute(
+    "Validating AWS credentials",
+    async () => validateAWSCredentials()
+  );
+  progress.info(`Connected to AWS account: ${pc12.cyan(identity.accountId)}`);
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
     async () => await ensurePulumiInstalled()
@@ -13027,11 +13038,6 @@ async function init(options) {
   if (wasAutoInstalled) {
     progress.info("Pulumi CLI was automatically installed");
   }
-  const identity = await progress.execute(
-    "Validating AWS credentials",
-    async () => validateAWSCredentials()
-  );
-  progress.info(`Connected to AWS account: ${pc12.cyan(identity.accountId)}`);
   let provider = options.provider;
   if (!provider) {
     provider = await promptProvider();
@@ -15408,6 +15414,9 @@ async function checkDmarc(domain) {
     valid: false,
     policy: null,
     subdomainPolicy: null,
+    nonExistentSubdomainPolicy: null,
+    testing: false,
+    psd: null,
     percentage: 100,
     reportingEnabled: false,
     ruaAddresses: [],
@@ -15460,6 +15469,21 @@ function parseDmarcRecord(record, result) {
   } else {
     result.subdomainPolicy = result.policy;
   }
+  const np = tags.get("np");
+  if (np) {
+    if (["none", "quarantine", "reject"].includes(np)) {
+      result.nonExistentSubdomainPolicy = np;
+    } else {
+      result.warnings.push(`Invalid non-existent subdomain policy (np): ${np}`);
+    }
+  }
+  if (tags.get("t") === "y") {
+    result.testing = true;
+  }
+  const psd = tags.get("psd");
+  if (psd && ["y", "n", "u"].includes(psd)) {
+    result.psd = psd;
+  }
   const pct = tags.get("pct");
   if (pct) {
     const pctNum = Number.parseInt(pct, 10);
@@ -15468,7 +15492,9 @@ function parseDmarcRecord(record, result) {
     } else {
       result.percentage = pctNum;
       if (pctNum < 100) {
-        result.warnings.push(`Only ${pctNum}% of messages subject to policy`);
+        result.warnings.push(
+          `pct=${pctNum} is deprecated (DMARCbis receivers ignore it; enforcement is all-or-nothing). Use t=y while testing instead.`
+        );
       }
     }
   }
@@ -15533,6 +15559,17 @@ function parseDmarcRecord(record, result) {
   if (result.subdomainPolicy === "none" && result.policy !== "none") {
     result.warnings.push("Subdomain policy is less strict than domain policy");
   }
+  const enforcing = result.policy === "quarantine" || result.policy === "reject";
+  if (result.testing && result.policy !== "none") {
+    result.warnings.push(
+      "t=y (testing) is set \u2014 receivers will not enforce the policy"
+    );
+  }
+  if (enforcing && !result.nonExistentSubdomainPolicy) {
+    result.warnings.push(
+      "No np= set \u2014 add np=reject to block spoofing from non-existent subdomains (DMARCbis)"
+    );
+  }
   if (!result.reportingEnabled) {
     result.warnings.push("No aggregate reporting configured (rua=)");
   }
@@ -16686,11 +16723,18 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC policy is none (not enforcing)"
     });
   }
-  if (dmarc.percentage < 100) {
+  if (dmarc.testing && dmarc.policy !== "none") {
     deductions.push({
       check: "dmarc",
       points: 2,
-      reason: `DMARC pct=${dmarc.percentage} (not 100%)`
+      reason: "DMARC testing mode (t=y) \u2014 receivers won't enforce the policy"
+    });
+  }
+  if (dmarc.percentage < 100) {
+    deductions.push({
+      check: "dmarc",
+      points: 1,
+      reason: `DMARC pct=${dmarc.percentage} is deprecated (DMARCbis receivers ignore it; enforcement is inconsistent)`
     });
   }
   if (!dmarc.reportingEnabled) {
@@ -16707,6 +16751,13 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC strict alignment configured"
     });
   }
+  if ((dmarc.policy === "quarantine" || dmarc.policy === "reject") && dmarc.nonExistentSubdomainPolicy === "reject") {
+    bonuses.push({
+      check: "dmarc",
+      points: 1,
+      reason: "np=reject blocks non-existent subdomain spoofing (DMARCbis)"
+    });
+  }
 }
 function collectInfraIssues(checks, deductions, bonuses) {
   if (checks.mx.exists) {
@@ -24043,13 +24094,6 @@ async function init2(options) {
     );
   }
   const progress = new DeploymentProgress();
-  const wasAutoInstalled = await progress.execute(
-    "Checking Pulumi CLI installation",
-    async () => await ensurePulumiInstalled()
-  );
-  if (wasAutoInstalled) {
-    progress.info("Pulumi CLI was automatically installed");
-  }
   const credentialResult = await progress.execute(
     "Validating AWS credentials",
     async () => validateAWSCredentialsWithDetails()
@@ -24064,6 +24108,13 @@ async function init2(options) {
       `Using credentials from: ${pc29.dim(credentialResult.credentialSource)}`
     );
   }
+  const wasAutoInstalled = await progress.execute(
+    "Checking Pulumi CLI installation",
+    async () => await ensurePulumiInstalled()
+  );
+  if (wasAutoInstalled) {
+    progress.info("Pulumi CLI was automatically installed");
+  }
   let provider = options.provider;
   if (!provider) {
     provider = options.quick ? "other" : await promptProvider();
@@ -40168,6 +40219,11 @@ async function init3(options) {
     clack55.intro(pc58.bold("Wraps SMS Infrastructure Setup"));
   }
   const progress = new DeploymentProgress();
+  const identity = await progress.execute(
+    "Validating AWS credentials",
+    async () => validateAWSCredentials()
+  );
+  progress.info(`Connected to AWS account: ${pc58.cyan(identity.accountId)}`);
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
     async () => await ensurePulumiInstalled()
@@ -40175,11 +40231,6 @@ async function init3(options) {
   if (wasAutoInstalled) {
     progress.info("Pulumi CLI was automatically installed");
   }
-  const identity = await progress.execute(
-    "Validating AWS credentials",
-    async () => validateAWSCredentials()
-  );
-  progress.info(`Connected to AWS account: ${pc58.cyan(identity.accountId)}`);
   const provider = options.provider || await promptProvider();
   const region = options.region || await promptRegion(await getAWSRegion());
   let vercelConfig;
@@ -42712,6 +42763,9 @@ async function support() {
     `  ${pc65.bold("GitHub:")}  ${pc65.cyan("https://github.com/wraps-dev/wraps/issues")}`
   );
   console.log(`  ${pc65.bold("Docs:")}    ${pc65.cyan("https://wraps.dev/docs")}`);
+  console.log(
+    `  ${pc65.bold("AI docs:")} ${pc65.cyan("https://wraps.dev/llms-full.txt")} ${pc65.dim("(complete docs, one file)")}`
+  );
   console.log();
   console.log(pc65.dim("  Response time: Usually within 24 hours"));
   console.log();
@@ -43363,7 +43417,10 @@ function showHelp() {
   console.log(`  ${pc69.dim("-v, --version")}    Show version number
 `);
   console.log(
-    `Run ${pc69.cyan("wraps <service> <command> --help")} for more information.
+    `Run ${pc69.cyan("wraps <service> <command> --help")} for more information.`
+  );
+  console.log(
+    `AI agents: complete docs at ${pc69.cyan("https://wraps.dev/llms-full.txt")}
 `
   );
 }