@wraps.dev/cli 2.26.1 → 2.27.0

package/dist/cli.js

@@ -2679,10 +2679,9 @@ var init_costs = __esm({
       // $0.20 per million API Destination invocations
     };
     FREE_TIER = {
-      // SES: 3,000 emails/month for first 12 months (new AWS accounts only)
-      // After 12 months or for existing accounts: NO free tier
+      // SES: no free sending tier (the 3,000/mo-for-12-months offer was retired
+      // 2026-07-21; new accounts get generic $200 AWS credits instead)
       SES_EMAILS: 0,
-      // Conservative: assume no free tier (most users are past 12 months)
       // Lambda: Permanently free tier
       LAMBDA_REQUESTS: 1e6,
       // 1M requests per month (always free)
@@ -6084,6 +6083,9 @@ async function findConnectionsWithService(accountId, service) {
   const accountConnections = await findConnectionsForAccount(accountId);
   return accountConnections.filter((conn) => hasService(conn, service));
 }
+function normalizeWebhookBaseUrl(webhookUrl) {
+  return webhookUrl.replace(/\/v1\/ses-events\/?$/, "").replace(/\/+$/, "");
+}
 function buildEmailStackConfig(metadata, region, overrides) {
   const emailService = metadata.services.email;
   let webhook;
@@ -6092,7 +6094,10 @@ function buildEmailStackConfig(metadata, region, overrides) {
   } else if (emailService?.webhookSecret) {
     webhook = {
       awsAccountNumber: metadata.accountId,
-      webhookSecret: emailService.webhookSecret
+      webhookSecret: emailService.webhookSecret,
+      ...emailService.webhookUrl && {
+        webhookUrl: normalizeWebhookBaseUrl(emailService.webhookUrl)
+      }
     };
   }
   const emailConfig = overrides?.emailConfig ?? emailService?.config;
@@ -11450,7 +11455,7 @@ async function runFullSetup() {
   console.log(`  ${pc9.cyan("https://aws.amazon.com/free")}`);
   console.log();
   console.log(
-    pc9.dim("  The AWS Free Tier includes 3,000 SES emails/month for 12 months")
+    pc9.dim("  New AWS accounts get $200 in Free Tier credits (6 months)")
   );
   console.log();
   const hasAccount = await clack7.confirm({
@@ -35326,6 +35331,128 @@ import { dirname as dirname5, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import * as clack45 from "@clack/prompts";
 import * as pulumi28 from "@pulumi/pulumi";
+
+// ../db/dist/connection-url.js
+init_esm_shims();
+
+// ../db/dist/connection-url-CJ0MYp2V.js
+init_esm_shims();
+var POSTGRES_SCHEMES = ["postgres:", "postgresql:"];
+var TRUST_STORE_SENTINELS = /* @__PURE__ */ new Set(["system", "os"]);
+var TLS_OPT_OUT = /* @__PURE__ */ new Set(["disable", "no-verify"]);
+function pinVerification(parsed) {
+  const modes = parsed.searchParams.getAll("sslmode");
+  const effective = modes.at(-1)?.toLowerCase();
+  const hadCompat = parsed.searchParams.has("uselibpqcompat");
+  if (effective && TLS_OPT_OUT.has(effective)) {
+    parsed.searchParams.set("sslmode", effective);
+    parsed.searchParams.delete("uselibpqcompat");
+    return;
+  }
+  const alreadyVerifying = modes.length === 1 && effective === "verify-full" && !hadCompat;
+  parsed.searchParams.set("sslmode", "verify-full");
+  parsed.searchParams.delete("uselibpqcompat");
+  return alreadyVerifying ? void 0 : "Pinned sslmode=verify-full \u2014 without the CA reference the original mode would have connected unverified (or in cleartext).";
+}
+function normalizeDatabaseUrl(raw) {
+  const url = raw.trim();
+  const notes = [];
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return {
+      url,
+      notes
+    };
+  }
+  const certKey = [...parsed.searchParams.keys()].find((key) => key.toLowerCase() === "sslrootcert");
+  const sslRootCert = certKey ? parsed.searchParams.get(certKey) : void 0;
+  if (!(sslRootCert && TRUST_STORE_SENTINELS.has(sslRootCert.toLowerCase()))) return {
+    url,
+    notes
+  };
+  parsed.searchParams.delete(certKey);
+  notes.push(`Dropped sslrootcert=${sslRootCert} \u2014 node-postgres would read it as a filename. TLS stays on and the certificate is verified against Node's bundled CA set (set NODE_EXTRA_CA_CERTS for a private CA).`);
+  const pinNote = pinVerification(parsed);
+  if (pinNote) notes.push(pinNote);
+  return {
+    url: parsed.toString(),
+    notes
+  };
+}
+function describeMigrationError(error) {
+  const parts = [];
+  let current = error;
+  const seen = /* @__PURE__ */ new Set();
+  while (current instanceof Error && !seen.has(current)) {
+    seen.add(current);
+    const code = current.code;
+    const message = current.message.startsWith("Failed query:") ? current.message.split("\n")[0] : current.message;
+    const described = code ? `${message} (${code})` : message;
+    if (!parts.includes(described)) parts.push(described);
+    current = current.cause;
+  }
+  return parts.length > 0 ? parts.join(" \u2014 ") : String(error);
+}
+var HINTS = [
+  {
+    match: /\b(ENOENT|EACCES)\b/,
+    hint: "A file named in DATABASE_URL (usually sslrootcert) is missing or unreadable. Point it at a readable CA file, or set NODE_EXTRA_CA_CERTS if the certificate chains to a private CA."
+  },
+  {
+    match: /password authentication failed|28P01|28000/i,
+    hint: "The credentials in DATABASE_URL were rejected. Check the user and password."
+  },
+  {
+    match: /CREATE SCHEMA|permission denied for database|must be owner of database/i,
+    hint: "The database user cannot create schemas. Grant it CREATE on the database (GRANT CREATE ON DATABASE <db> TO <user>), or use an owner role."
+  },
+  {
+    match: /permission denied|42501/i,
+    hint: "The database user lacks a privilege this migration needs. The failing statement above names the object \u2014 grant on that, or run migrations as the database owner."
+  },
+  {
+    match: /database .* does not exist|3D000/i,
+    hint: "The database named in DATABASE_URL does not exist. Create it first."
+  },
+  {
+    match: /no pg_hba\.conf entry|SSL|self[- ]signed|certificate/i,
+    hint: "TLS negotiation failed. Most managed Postgres requires ?sslmode=verify-full on DATABASE_URL."
+  },
+  {
+    match: /ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN/i,
+    hint: "Could not reach the database host. Check the host and port, and that this machine is allowed through the firewall or IP allowlist."
+  }
+];
+function migrationHint(description) {
+  return HINTS.find(({ match }) => match.test(description))?.hint;
+}
+function describeMigrationFailure(error) {
+  const description = describeMigrationError(error);
+  const hint = migrationHint(description);
+  return hint ? `Database migrations failed: ${description}
+${hint}` : `Database migrations failed: ${description}`;
+}
+function assertPostgresUrl(raw) {
+  const url = raw.trim();
+  if (!url) throw new Error("DATABASE_URL is empty.");
+  if (!url.includes("://")) {
+    if (/(^|\s)(host|dbname|user)=/.test(url)) throw new Error("DATABASE_URL is a libpq keyword/value connection string, which node-postgres cannot parse. Use the URI form instead: postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=verify-full");
+    throw new Error("DATABASE_URL is not a connection URI. Expected postgresql://USER:PASSWORD@HOST:5432/DATABASE");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("DATABASE_URL could not be parsed as a URI. If the password contains @ / : or ?, percent-encode it.");
+  }
+  if (POSTGRES_SCHEMES.includes(parsed.protocol)) return;
+  if (parsed.protocol === "mysql:" || parsed.protocol === "mysql2:") throw new Error(`DATABASE_URL points at MySQL (${parsed.protocol}//). Wraps requires PostgreSQL \u2014 its schema uses Postgres types, enums and partial indexes that have no MySQL equivalent.`);
+  throw new Error(`DATABASE_URL has an unsupported scheme (${parsed.protocol}//). Wraps requires PostgreSQL: postgresql://USER:PASSWORD@HOST:5432/DATABASE`);
+}
+
+// src/commands/selfhost/deploy.ts
 import pc48 from "picocolors";
 
 // src/infrastructure/selfhost-stack.ts
@@ -35582,6 +35709,29 @@ function buildNeonProjectName(accountId, region) {
   return `wraps-selfhost-${accountId}-${region}`;
 }
 
+// src/utils/selfhost/variant.ts
+init_esm_shims();
+var SHARED_SCHEDULER_ROLE = "wraps-selfhost-scheduler-role";
+async function detectSelfhostVariant(region) {
+  try {
+    const { LambdaClient: LambdaClient3, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
+    const lambda7 = new LambdaClient3({ region });
+    await lambda7.send(
+      new GetFunctionCommand({ FunctionName: SELFHOST_API_FUNCTION_NAME })
+    );
+    return "pulumi";
+  } catch {
+  }
+  try {
+    const { IAMClient: IAMClient5, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient5({ region });
+    await iam13.send(new GetRoleCommand3({ RoleName: SHARED_SCHEDULER_ROLE }));
+    return "sst";
+  } catch {
+    return null;
+  }
+}
+
 // src/commands/selfhost/deploy.ts
 init_aws();
 init_errors();
@@ -35639,17 +35789,42 @@ async function selfhostDeploy(options) {
     region
   );
   if (existingMetadata?.services?.selfhost) {
+    const existing = existingMetadata.services.selfhost;
     clack45.log.warn(
       `Self-hosted deployment already exists for account ${pc48.cyan(identity.accountId)} in region ${pc48.cyan(region)}`
     );
+    clack45.log.info(`API URL: ${pc48.cyan(existing.apiUrl)}`);
+    clack45.log.info(`Deployed: ${existing.deployedAt}`);
     clack45.log.info(
-      `API URL: ${pc48.cyan(existingMetadata.services.selfhost.apiUrl)}`
+      existing.variant === "sst" ? `This is a full-platform (SST) deployment. To update: run ${pc48.cyan("pnpm selfhost:upgrade")} from your fork.` : `To update: run ${pc48.cyan("wraps selfhost upgrade")}`
+    );
+    process.exit(0);
+  }
+  const deployedVariant = await progress.execute(
+    "Checking for existing selfhost deployments",
+    async () => detectSelfhostVariant(region)
+  );
+  if (deployedVariant === "sst") {
+    progress.stop();
+    clack45.log.error(
+      "A full-platform (SST) selfhost deployment already exists in this AWS account."
     );
     clack45.log.info(
-      `Deployed: ${existingMetadata.services.selfhost.deployedAt}`
+      `The two selfhost variants share IAM resources and cannot coexist.
+To update it: run ${pc48.cyan("pnpm selfhost:upgrade")} from your fork.
+To replace it with the API-only control plane: run ${pc48.cyan("pnpm selfhost:destroy")} from your fork first.`
     );
-    clack45.log.info(`To update: run ${pc48.cyan("wraps selfhost upgrade")}`);
-    process.exit(0);
+    process.exit(1);
+  }
+  if (deployedVariant === "pulumi") {
+    progress.stop();
+    clack45.log.error(
+      "An API-only selfhost control plane already exists in this AWS account, but no local metadata was found."
+    );
+    clack45.log.info(
+      `It was deployed from another machine. Run ${pc48.cyan("wraps selfhost upgrade")} there, or remove the existing stack before redeploying from this one.`
+    );
+    process.exit(1);
   }
   let resolvedDatabaseUrl = options.databaseUrl;
   let resolvedNeonProjectId;
@@ -35777,6 +35952,7 @@ async function selfhostDeploy(options) {
     );
   }
   const databaseUrl = resolvedDatabaseUrl;
+  assertPostgresUrl(databaseUrl);
   const unsubscribeSecret = randomBytes6(32).toString("hex");
   const betterAuthSecret = randomBytes6(32).toString("hex");
   const selfhostConfig = {
@@ -35802,19 +35978,26 @@ async function selfhostDeploy(options) {
     deployedAt,
     pulumiStackName: stackName,
     config: selfhostConfig,
-    apiUrl: priorApiUrl
+    apiUrl: priorApiUrl,
     // Refreshed from Pulumi outputs after deploy succeeds
+    variant: "pulumi"
   };
   savedMetadata.timestamp = deployedAt;
   await saveConnectionMetadata(savedMetadata);
+  const { url: migrationUrl, notes: connectionNotes } = normalizeDatabaseUrl(databaseUrl);
+  for (const note22 of connectionNotes) {
+    progress.info(note22);
+  }
   await progress.execute("Running database migrations", async () => {
     const { Pool } = await import("pg");
     const { drizzle } = await import("drizzle-orm/node-postgres");
     const { migrate } = await import("drizzle-orm/node-postgres/migrator");
-    const pool = new Pool({ connectionString: databaseUrl });
+    const pool = new Pool({ connectionString: migrationUrl });
     const db = drizzle(pool);
     try {
       await migrate(db, { migrationsFolder: bundledMigrationsDir });
+    } catch (error) {
+      throw new Error(describeMigrationFailure(error));
     } finally {
       await pool.end();
     }
@@ -36086,7 +36269,7 @@ Run ${pc50.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
     );
     console.log(
       `
-The deployment may have failed partway through. Re-run ${pc50.cyan("wraps selfhost deploy")} to complete it.
+The deployment may have failed partway through. Run ${pc50.cyan("pnpm selfhost:upgrade")} from your fork (SST deployments) or re-run ${pc50.cyan("wraps selfhost deploy")} (API-only deployments) to complete it.
 `
     );
     process.exit(1);
@@ -36397,15 +36580,30 @@ init_output();
 init_region_resolver();
 function displaySelfhostStatus(options) {
   const lines = [];
-  lines.push(pc53.bold(pc53.green("Self-Hosted Control Plane Active")));
+  const incomplete = !(options.apiUrl && options.appUrl);
+  lines.push(
+    incomplete ? pc53.bold(pc53.yellow("Self-Hosted Control Plane Incomplete")) : pc53.bold(pc53.green("Self-Hosted Control Plane Active"))
+  );
+  if (incomplete) {
+    lines.push(
+      pc53.yellow(
+        `A previous deploy did not finish. Run ${pc53.cyan("pnpm selfhost:upgrade")} from your fork to complete it.`
+      )
+    );
+  }
   lines.push("");
   lines.push(pc53.bold("API"));
-  lines.push(`  URL: ${pc53.cyan(options.apiUrl)}`);
+  lines.push(`  URL: ${pc53.cyan(options.apiUrl || "(not deployed)")}`);
   lines.push(`  Region: ${pc53.cyan(options.region)}`);
   lines.push(`  Deployed: ${pc53.dim(options.deployedAt)}`);
+  if (options.variant) {
+    lines.push(
+      `  Type: ${pc53.cyan(options.variant === "sst" ? "Full platform (SST, deployed from fork)" : "API-only control plane (CLI)")}`
+    );
+  }
   lines.push("");
   lines.push(pc53.bold("Configuration"));
-  lines.push(`  App URL: ${pc53.cyan(options.appUrl)}`);
+  lines.push(`  App URL: ${pc53.cyan(options.appUrl || "(not deployed)")}`);
   lines.push(`  License Key: ${pc53.dim(`${options.licenseKeyPrefix}...`)}`);
   if (options.neonProjectId) {
     lines.push(`  Neon Project: ${pc53.dim(options.neonProjectId)}`);
@@ -36434,7 +36632,8 @@ async function selfhostStatus(options) {
     clack50.log.error("No self-hosted deployment found");
     console.log(
       `
-Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plane.
+Run ${pc53.cyan("pnpm selfhost:deploy")} from your fork to deploy the full platform (API + dashboard),
+or ${pc53.cyan("wraps selfhost deploy")} for the API-only control plane.
 `
     );
     process.exit(1);
@@ -36443,13 +36642,23 @@ Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
   const selfhostService = metadata.services.selfhost;
   const config2 = selfhostService.config;
   const apiUrl = await reconcileSelfhostApiUrl(metadata, region) ?? selfhostService.apiUrl;
+  if (!selfhostService.variant) {
+    const inferred = await detectSelfhostVariant(region);
+    if (inferred) {
+      selfhostService.variant = inferred;
+      metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      await saveConnectionMetadata(metadata);
+    }
+  }
+  const variant = selfhostService.variant;
   const statusData = {
     region,
     apiUrl,
     deployedAt: selfhostService.deployedAt,
     neonProjectId: config2.neonProjectId,
     appUrl: config2.appUrl,
-    licenseKeyPrefix: config2.licenseKey.slice(0, 12)
+    licenseKeyPrefix: config2.licenseKey.slice(0, 12),
+    variant
   };
   if (isJsonMode()) {
     jsonSuccess("selfhost.status", statusData);
@@ -36459,7 +36668,7 @@ Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
   console.log("");
   clack50.log.info(pc53.bold("Commands:"));
   console.log(
-    `  ${pc53.cyan("wraps selfhost upgrade")} - Rebuild and redeploy the API Lambda`
+    variant === "sst" ? `  ${pc53.cyan("pnpm selfhost:upgrade")} (from your fork) - Redeploy the platform and run migrations` : `  ${pc53.cyan("wraps selfhost upgrade")} - Rebuild and redeploy the API Lambda`
   );
   trackCommand("selfhost:status", {
     success: true,