@wraps.dev/cli 3.11.2 → 3.12.0

package/dist/cli.js

@@ -660,6 +660,9 @@ function parsePulumiError(error) {
   if (message.includes("stack is currently locked")) {
     return { code: "STACK_LOCKED" };
   }
+  if (message.includes("pending operations") || message.includes("pending_operations")) {
+    return { code: "PENDING_OPERATIONS" };
+  }
   if (/ENOENT[:\s].*\bpulumi\b|spawn pulumi ENOENT/.test(message)) {
     return { code: "NOT_INSTALLED" };
   }
@@ -955,6 +958,8 @@ function pulumiErrorToWrapsError(code, iamAction, service, resourceName, resourc
       );
     case "STACK_LOCKED":
       return errors.stackLocked();
+    case "PENDING_OPERATIONS":
+      return errors.pendingOperations();
     case "NOT_INSTALLED":
       return errors.pulumiNotInstalled();
     case "SES_PERMISSION_DENIED":
@@ -1071,7 +1076,7 @@ Saved regions: ${savedRegions.join(", ")}` : "Pass --region or set AWS_REGION.\n
       pulumiError: (message) => new WrapsError(
         `Infrastructure deployment failed: ${message}`,
         "PULUMI_ERROR",
-        "Check your AWS permissions and try again",
+        "The message above is Pulumi's own output. If it is not self-explanatory, re-run the command \u2014 some failures are transient \u2014 and see the troubleshooting guide if it persists.",
         "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
       noStack: () => new WrapsError(
@@ -1092,6 +1097,12 @@ Saved regions: ${savedRegions.join(", ")}` : "Pass --region or set AWS_REGION.\n
         "This happens when a previous deployment was interrupted.\n\nFor local state, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nFor S3 state, delete the lock object in your wraps-state-* bucket under .pulumi/locks/\n\nThen try your command again.",
         "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
+      pendingOperations: () => new WrapsError(
+        "The Pulumi stack has unresolved operations from a previous deployment",
+        "PENDING_OPERATIONS",
+        "This happens when a previous deployment was interrupted (Ctrl-C, a crashed CI job, lost network) before it could record whether its changes finished.\n\nThose operations may have partially completed, so the safe first move is to reconcile state against what actually exists in AWS:\n  pulumi refresh\n\nTo inspect what Pulumi thinks is pending before doing anything:\n  pulumi stack export\n\nThen try your command again.\n\nIf a deployment is genuinely still running elsewhere, wait for it to finish instead of clearing anything.",
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
+      ),
       // SMS-specific errors
       smsNotConfigured: () => new WrapsError(
         "SMS infrastructure not found",
@@ -32844,6 +32855,7 @@ var init_dynamodb_metrics = __esm({
 // src/commands/update.ts
 var update_exports = {};
 __export(update_exports, {
+  installRelease: () => installRelease,
   update: () => update
 });
 import { execFileSync } from "child_process";
@@ -32852,6 +32864,7 @@ import {
   createWriteStream,
   mkdirSync as mkdirSync3,
   mkdtempSync,
+  readdirSync as readdirSync3,
   rmSync
 } from "fs";
 import { homedir as homedir6, tmpdir as tmpdir2 } from "os";
@@ -32882,6 +32895,15 @@ async function fetchLatestVersion() {
   }
   return null;
 }
+function installRelease(source, installDir) {
+  for (const entry of readdirSync3(source)) {
+    const target = join24(installDir, entry);
+    rmSync(target, { recursive: true, force: true });
+    execFileSync("cp", ["-R", join24(source, entry), target]);
+  }
+  chmodSync(join24(installDir, "bin", "wraps"), 493);
+  chmodSync(join24(installDir, "runtime", "node"), 493);
+}
 function detectPlatformArch() {
   const platform3 = process.platform === "darwin" ? "darwin" : "linux";
   const arch = process.arch === "arm64" ? "arm64" : "x64";
@@ -32978,13 +33000,7 @@ async function update(currentVersion) {
       const extractDir = join24(tmp, "extract");
       mkdirSync3(extractDir, { recursive: true });
       execFileSync("tar", ["xzf", tarballPath, "-C", extractDir]);
-      const source = join24(extractDir, "wraps");
-      for (const dir of ["bin", "runtime", "lib"]) {
-        rmSync(join24(INSTALL_DIR, dir), { recursive: true, force: true });
-        execFileSync("cp", ["-R", join24(source, dir), join24(INSTALL_DIR, dir)]);
-      }
-      chmodSync(join24(INSTALL_DIR, "bin", "wraps"), 493);
-      chmodSync(join24(INSTALL_DIR, "runtime", "node"), 493);
+      installRelease(join24(extractDir, "wraps"), INSTALL_DIR);
     });
     console.log();
     progress.succeed(
@@ -38204,7 +38220,7 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
       `IAM role ${pc17.cyan(roleName)} not found \u2014 will create it using stored externalId`
     );
   }
-  if (!options.force) {
+  if (!(options.force || options.yes)) {
     progress.stop();
     const actionLabel = roleExists2 ? "Update" : "Create";
     const shouldContinue = await confirm6({
@@ -38224,6 +38240,8 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
   const smsEnabled = !!smsConfig;
   const smsSendingEnabled = smsConfig && smsConfig.sendingEnabled !== false;
   const smsEventTracking = smsConfig?.eventTracking;
+  let permissionsUpdated = false;
+  let trustPolicyRepaired = false;
   if (!roleExists2 && externalId) {
     await progress.execute("Creating IAM role", async () => {
       const trustPolicy = {
@@ -38263,6 +38281,8 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
         })
       );
     });
+    permissionsUpdated = true;
+    trustPolicyRepaired = true;
   } else {
     await progress.execute("Updating IAM role permissions", async () => {
       const { PutRolePolicyCommand: PutRolePolicyCommand2 } = await import("@aws-sdk/client-iam");
@@ -38274,6 +38294,7 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
         })
       );
     });
+    permissionsUpdated = true;
     if (externalId) {
       const trustPolicy = {
         Version: "2012-10-17",
@@ -38300,10 +38321,19 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
           })
         );
       });
+      trustPolicyRepaired = true;
+    } else {
+      log15.warn(
+        `Trust policy was ${pc17.bold("not")} touched: no stored externalId found for this control plane.`
+      );
+      console.log(
+        `  If ${pc17.cyan(selfhosted ? "wraps selfhost connect" : "wraps platform connect")} still cannot assume ${pc17.cyan(roleName)}, re-run it to repair the trust policy.`
+      );
     }
   }
   progress.stop();
   const actionVerb = roleExists2 ? "updated" : "created";
+  const externalIdPresent = !!externalId;
   trackCommand("platform:update-role", {
     success: true,
     duration_ms: Date.now() - startTime,
@@ -38313,12 +38343,23 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
     jsonSuccess("platform.update-role", {
       updated: true,
       action: actionVerb,
-      roleName
+      roleName,
+      permissionsUpdated,
+      trustPolicyRepaired,
+      externalIdPresent
     });
     return;
   }
   outro10(pc17.green(`\u2713 Platform access role ${actionVerb} successfully`));
   console.log(`
+${pc17.bold("Summary:")}`);
+  console.log(
+    `  ${pc17.green("\u2713")} permissions: ${permissionsUpdated ? "updated" : "unchanged"}`
+  );
+  console.log(
+    trustPolicyRepaired ? `  ${pc17.green("\u2713")} trust policy: repaired` : `  ${pc17.yellow("!")} trust policy: unchanged (no stored externalId)`
+  );
+  console.log(`
 ${pc17.bold("Permissions:")}`);
   console.log(`
   ${pc17.bold(pc17.cyan("Email:"))}`);
@@ -39338,6 +39379,7 @@ async function wrapsDoctor(options) {
 
 // src/commands/email/agent.ts
 init_esm_shims();
+import { promises as dns } from "dns";
 import * as clack18 from "@clack/prompts";
 import * as pulumi16 from "@pulumi/pulumi";
 import pc20 from "picocolors";
@@ -40770,7 +40812,12 @@ async function createAgentApiClient(tokenFlag) {
     },
     ...body ? { body: JSON.stringify(body) } : {}
   });
-  return { ok: true, get: call("GET"), post: call("POST") };
+  return {
+    ok: true,
+    get: call("GET"),
+    post: call("POST"),
+    patch: call("PATCH")
+  };
 }
 async function parseAgentApiError(resp) {
   const data = await resp.json().catch(() => ({}));
@@ -40825,6 +40872,31 @@ var DEFAULT_AGENT_POLICY = {
   allowedRecipientDomains: []
 };
 var AGENT_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,51}$/;
+var MX_LOOKUP_TIMEOUT_MS = 3e3;
+async function domainAcceptsMail(domain) {
+  let timer;
+  const timedOut = /* @__PURE__ */ Symbol("mx-lookup-timeout");
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(timedOut), MX_LOOKUP_TIMEOUT_MS);
+  });
+  try {
+    const result = await Promise.race([dns.resolveMx(domain), timeout]);
+    if (result === timedOut) {
+      return null;
+    }
+    return result.length > 0;
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENODATA" || code === "ENOTFOUND") {
+      return false;
+    }
+    return null;
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
 async function agentCreate(options) {
   if (!isJsonMode()) {
     clack18.intro(pc20.bold("Create Agent Mailbox"));
@@ -41202,6 +41274,12 @@ ${suggestion}
     return await resp.json();
   });
   const syncFailed = sync.syncStatus === "failed";
+  let mailAccepted = null;
+  try {
+    mailAccepted = await domainAcceptsMail(domain);
+  } catch {
+    mailAccepted = null;
+  }
   if (isJsonMode()) {
     jsonSuccess("email.agent.create", {
       id: created.id,
@@ -41222,7 +41300,11 @@ ${suggestion}
       // the credential doesn't have to be smuggled through an error payload a
       // scripted caller isn't looking at. syncStatus is the field to branch on.
       syncStatus: sync.syncStatus ?? "unknown",
-      warning: sync.warning ?? null
+      warning: sync.warning ?? null,
+      // true/false when the apex MX lookup resolved definitively, null when it
+      // could not be determined (timeout, network issue, …) — null must never
+      // be read as "no MX".
+      domainAcceptsMail: mailAccepted
     });
     return;
   }
@@ -41238,6 +41320,15 @@ ${suggestion}
   console.log(`  ${pc20.dim("Agent ID:")}    ${pc20.cyan(created.id)}`);
   console.log(`  ${pc20.dim("Enforcer:")}    ${pc20.cyan(aliasArn)}`);
   console.log();
+  if (mailAccepted === false) {
+    clack18.log.warn(
+      `Replies to ${pc20.cyan(emailAddress)} will bounce \u2014 ${pc20.cyan(domain)} has no MX record.`
+    );
+    console.log(
+      `  Set ${pc20.cyan("replyTo")} on every send to a mailbox that can receive, or run ${pc20.cyan("wraps email inbound")} to make ${domain} receive mail.`
+    );
+    console.log();
+  }
   const mcpEnv = [
     `WRAPS_AGENT_ID=${created.id}`,
     `WRAPS_AGENT_ENFORCER_ARN=${aliasArn}`,
@@ -41400,6 +41491,166 @@ async function agentKill(options) {
   }
   clack18.log.success(`Killed ${pc20.cyan(target.emailAddress)}.`);
 }
+function toList(value) {
+  if (value === void 0) {
+    return [];
+  }
+  return Array.isArray(value) ? value.map(String) : [String(value)];
+}
+function dedupePreserveOrder(base, additions) {
+  const seen = new Set(base);
+  const result = [...base];
+  for (const item of additions) {
+    if (!seen.has(item)) {
+      seen.add(item);
+      result.push(item);
+    }
+  }
+  return result;
+}
+function sameStringArray(a6, b6) {
+  return a6.length === b6.length && a6.every((v, i6) => v === b6[i6]);
+}
+async function agentPolicy(options) {
+  const api = await createAgentApiClient(options.token);
+  if (!api.ok) {
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", {
+        code: "NOT_AUTHENTICATED",
+        message: "No API token found.",
+        suggestion: "Run: wraps auth login"
+      });
+    } else {
+      clack18.log.error("No API token found. Run: wraps auth login");
+    }
+    return;
+  }
+  const listResp = await api.get("/v1/agents");
+  if (!listResp.ok) {
+    const message = await parseAgentApiError(listResp);
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "API_ERROR", message });
+    } else {
+      clack18.log.error(`Failed to list agents: ${message}`);
+    }
+    return;
+  }
+  const { agents } = await listResp.json();
+  const target = options.name ? agents.find((a6) => a6.name === options.name || a6.id === options.name) : void 0;
+  if (!target) {
+    const message = options.name ? `No agent named "${options.name}".` : "Agent name is required.";
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "NOT_FOUND", message });
+    } else {
+      clack18.log.error(message);
+    }
+    return;
+  }
+  if (target.status === "KILLED") {
+    const message = `Agent "${target.name}" is killed \u2014 its policy can no longer be changed.`;
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "AGENT_KILLED", message });
+    } else {
+      clack18.log.error(message);
+    }
+    return;
+  }
+  const clearAllowlist = options.clearAllowlist === true;
+  const allowRecipientAdditions = toList(options.allowRecipient);
+  const allowDomainAdditions = toList(options.allowDomain);
+  if (clearAllowlist && (allowRecipientAdditions.length > 0 || allowDomainAdditions.length > 0)) {
+    const message = "--clear-allowlist cannot be combined with --allow-recipient or --allow-domain.";
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "VALIDATION", message });
+    } else {
+      clack18.log.error(message);
+    }
+    return;
+  }
+  const current = target.policy;
+  const maxPerHour = options.maxPerHour === void 0 ? current.maxPerHour : Number(options.maxPerHour);
+  const maxPerDay = options.maxPerDay === void 0 ? current.maxPerDay : Number(options.maxPerDay);
+  if (!(Number.isInteger(maxPerHour) && maxPerHour >= 0)) {
+    const message = "--max-per-hour must be a whole number >= 0.";
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "VALIDATION", message });
+    } else {
+      clack18.log.error(message);
+    }
+    return;
+  }
+  if (!(Number.isInteger(maxPerDay) && maxPerDay >= 0)) {
+    const message = "--max-per-day must be a whole number >= 0.";
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "VALIDATION", message });
+    } else {
+      clack18.log.error(message);
+    }
+    return;
+  }
+  const allowedRecipients = clearAllowlist ? [] : dedupePreserveOrder(current.allowedRecipients, allowRecipientAdditions);
+  const allowedRecipientDomains = clearAllowlist ? [] : dedupePreserveOrder(
+    current.allowedRecipientDomains,
+    allowDomainAdditions
+  );
+  const nextPolicy = {
+    maxPerHour,
+    maxPerDay,
+    allowedRecipients,
+    allowedRecipientDomains
+  };
+  const noChange = nextPolicy.maxPerHour === current.maxPerHour && nextPolicy.maxPerDay === current.maxPerDay && sameStringArray(nextPolicy.allowedRecipients, current.allowedRecipients) && sameStringArray(
+    nextPolicy.allowedRecipientDomains,
+    current.allowedRecipientDomains
+  );
+  if (noChange) {
+    if (isJsonMode()) {
+      jsonSuccess("email.agent.policy", {
+        agent: target,
+        syncStatus: "skipped",
+        noChange: true
+      });
+    } else {
+      clack18.log.info("No changes.");
+    }
+    return;
+  }
+  const resp = await api.patch(`/v1/agents/${target.id}/policy`, nextPolicy);
+  if (!resp.ok) {
+    const message = await parseAgentApiError(resp);
+    if (isJsonMode()) {
+      jsonError("email.agent.policy", { code: "API_ERROR", message });
+    } else {
+      clack18.log.error(`Failed to update policy: ${message}`);
+    }
+    return;
+  }
+  const body = await resp.json();
+  const syncFailed = body.syncStatus === "failed";
+  if (isJsonMode()) {
+    jsonSuccess("email.agent.policy", {
+      agent: body.agent,
+      syncStatus: body.syncStatus,
+      warning: body.warning ?? null
+    });
+    if (syncFailed) {
+      process.exit(1);
+    }
+    return;
+  }
+  const before = `${current.maxPerHour}/hr \xB7 ${current.maxPerDay}/day`;
+  const after = `${body.agent.policy.maxPerHour}/hr \xB7 ${body.agent.policy.maxPerDay}/day`;
+  clack18.log.success(`${before} \u2192 ${after}`);
+  console.log(
+    `  Allowlist: ${body.agent.policy.allowedRecipients.length} recipient(s), ${body.agent.policy.allowedRecipientDomains.length} domain(s)`
+  );
+  if (syncFailed) {
+    if (body.warning) {
+      clack18.log.warn(body.warning);
+    }
+    process.exit(1);
+  }
+}
 
 // src/commands/email/check.ts
 init_esm_shims();
@@ -41408,7 +41659,7 @@ import * as clack19 from "@clack/prompts";
 
 // ../email-check/dist/index.js
 init_esm_shims();
-import { promises as dns, Resolver } from "dns";
+import { promises as dns2, Resolver } from "dns";
 import { URL as URL2 } from "url";
 import * as net from "net";
 import * as tls from "tls";
@@ -41731,7 +41982,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveTxt(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolveTxt(domain),
+        dns2.resolveTxt(domain),
         `TXT lookup for ${domain}`
       );
       return records;
@@ -41745,7 +41996,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveMx(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolveMx(domain),
+        dns2.resolveMx(domain),
         `MX lookup for ${domain}`
       );
       return records.sort((a6, b6) => a6.priority - b6.priority);
@@ -41759,7 +42010,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveA(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolve4(domain),
+        dns2.resolve4(domain),
         `A lookup for ${domain}`
       );
       return records;
@@ -41773,7 +42024,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveAaaa(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolve6(domain),
+        dns2.resolve6(domain),
         `AAAA lookup for ${domain}`
       );
       return records;
@@ -41787,7 +42038,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolvePtr(ip) {
     try {
       const records = await withTimeout2(
-        dns.reverse(ip),
+        dns2.reverse(ip),
         `PTR lookup for ${ip}`
       );
       return records;
@@ -41801,7 +42052,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveCaa(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolveCaa(domain),
+        dns2.resolveCaa(domain),
         `CAA lookup for ${domain}`
       );
       return records.map((r6) => {
@@ -41833,7 +42084,7 @@ function createNodeDnsProvider(options = {}) {
   async function resolveCname(domain) {
     try {
       const records = await withTimeout2(
-        dns.resolveCname(domain),
+        dns2.resolveCname(domain),
         `CNAME lookup for ${domain}`
       );
       return records;
@@ -48939,7 +49190,7 @@ ${pc27.dim(`Distribution ${trackingDistributionId} is disabled; delete it from t
 // src/commands/email/inbound.ts
 init_esm_shims();
 import { randomBytes as randomBytes4 } from "crypto";
-import { promises as dns2 } from "dns";
+import { promises as dns3 } from "dns";
 import * as clack27 from "@clack/prompts";
 import * as pulumi20 from "@pulumi/pulumi";
 import pc28 from "picocolors";
@@ -49837,7 +50088,7 @@ Enable it: ${pc28.cyan("wraps email inbound init")}
       `Checking MX record for ${receivingDomain}`,
       async () => {
         try {
-          const records = await dns2.resolveMx(receivingDomain);
+          const records = await dns3.resolveMx(receivingDomain);
           const hasSES = records.some(
             (r6) => r6.exchange.includes("inbound-smtp")
           );
@@ -49866,7 +50117,7 @@ Enable it: ${pc28.cyan("wraps email inbound init")}
       `Checking SPF record for ${receivingDomain}`,
       async () => {
         try {
-          const records = await dns2.resolveTxt(receivingDomain);
+          const records = await dns3.resolveTxt(receivingDomain);
           const flat = records.map((r6) => r6.join(""));
           const spf = flat.find((r6) => r6.startsWith("v=spf1"));
           const hasSES = spf?.includes("amazonses.com") ?? false;
@@ -51863,7 +52114,7 @@ async function emailPlan(options) {
 init_esm_shims();
 init_dist();
 import { randomBytes as randomBytes5 } from "crypto";
-import { promises as dns3 } from "dns";
+import { promises as dns4 } from "dns";
 import {
   GetParameterCommand,
   ParameterNotFound,
@@ -52486,7 +52737,7 @@ Enable it: ${pc35.cyan("wraps email reply init --domain yourapp.com")}
     const receiptRuleHasDomain = ruleDomains.includes(`r.mail.${entry.domain}`);
     let mxResolves = false;
     try {
-      const records = await dns3.resolveMx(`r.mail.${entry.domain}`);
+      const records = await dns4.resolveMx(`r.mail.${entry.domain}`);
       mxResolves = records.some((r6) => r6.exchange.includes("inbound-smtp"));
     } catch (err) {
       const code = err?.code;
@@ -59916,6 +60167,50 @@ async function deployEventBridge(metadata, region, identity, webhookSecret, prog
   progress.succeed("Event streaming configured");
 }
 var WRAPS_PLATFORM_ACCOUNT_ID = "905130073023";
+async function verifyTrustPolicyExternalId(iam13, roleName, externalId, progress) {
+  const readCurrentExternalId = async () => {
+    const roleResult = await iam13.send(
+      new GetRoleCommand2({ RoleName: roleName })
+    );
+    const rawDocument = roleResult.Role?.AssumeRolePolicyDocument;
+    if (!rawDocument) {
+      throw new Error(
+        "GetRole response did not include AssumeRolePolicyDocument"
+      );
+    }
+    const parsed = JSON.parse(decodeURIComponent(rawDocument));
+    return parsed.Statement?.[0]?.Condition?.StringEquals?.["sts:ExternalId"];
+  };
+  const reportUnverifiable = (error) => {
+    const errName = error && typeof error === "object" && "name" in error ? error.name : "Unknown";
+    const errMsg = error instanceof Error ? error.message : String(error);
+    progress.info(
+      `Could not verify the trust policy write (${errName}: ${errMsg}) \u2014 assuming it succeeded.`
+    );
+  };
+  let current;
+  try {
+    current = await readCurrentExternalId();
+  } catch (error) {
+    reportUnverifiable(error);
+    return;
+  }
+  if (current === externalId) {
+    return;
+  }
+  await new Promise((resolve) => setTimeout(resolve, 1e3));
+  try {
+    current = await readCurrentExternalId();
+  } catch (error) {
+    reportUnverifiable(error);
+    return;
+  }
+  if (current !== externalId) {
+    throw new Error(
+      `Trust policy verification failed: role ${roleName} does not carry the expected externalId after the write.`
+    );
+  }
+}
 async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
   const roleName = selfhosted ? SELFHOST_CONSOLE_ACCESS_ROLE_NAME : CONSOLE_ACCESS_ROLE_NAME;
   const iam13 = new IAMClient4({ region: "us-east-1" });
@@ -59972,6 +60267,10 @@ async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
           })
         );
       });
+      await progress.execute(
+        "Verifying trust policy",
+        () => verifyTrustPolicyExternalId(iam13, roleName, externalId, progress)
+      );
     }
     progress.succeed("Platform access role updated");
   } else if (externalId) {
@@ -60013,6 +60312,10 @@ async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
         })
       );
     });
+    await progress.execute(
+      "Verifying trust policy",
+      () => verifyTrustPolicyExternalId(iam13, roleName, externalId, progress)
+    );
     progress.succeed("Platform access role created");
   } else {
     progress.info(
@@ -60020,13 +60323,52 @@ async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
     );
   }
 }
-async function resolveOrganization(orgs) {
+async function resolveOrganization(orgs, options) {
   if (!orgs || orgs.length === 0) {
     return null;
   }
+  if (options.org) {
+    const needle = options.org.toLowerCase();
+    const match = orgs.find((o3) => o3.slug.toLowerCase() === needle) || orgs.find((o3) => o3.id.toLowerCase() === needle);
+    if (match) {
+      return match;
+    }
+    const available = orgs.map((o3) => o3.slug).join(", ");
+    if (isJsonMode()) {
+      jsonError("platform.connect", {
+        code: "ORG_NOT_FOUND",
+        message: `No organization matches "${options.org}".`,
+        suggestion: `Available organizations: ${available}`
+      });
+    } else {
+      log43.error(`No organization matches ${pc48.cyan(options.org)}.`);
+      console.log(`
+Available organizations: ${available}
+`);
+    }
+    process.exit(1);
+  }
   if (orgs.length === 1) {
     return orgs[0];
   }
+  if (options.json || options.yes) {
+    const available = orgs.map((o3) => o3.slug).join(", ");
+    if (isJsonMode()) {
+      jsonError("platform.connect", {
+        code: "ORG_AMBIGUOUS",
+        message: "Multiple organizations found \u2014 pass --org <slug> to choose one non-interactively.",
+        suggestion: `Available organizations: ${available}`
+      });
+    } else {
+      log43.error(
+        "Multiple organizations found. Pass --org <slug> to choose one non-interactively."
+      );
+      console.log(`
+Available organizations: ${available}
+`);
+    }
+    process.exit(1);
+  }
   const selected = await select21({
     message: "Which organization should this AWS account connect to?",
     options: orgs.map((org) => ({
@@ -60135,7 +60477,11 @@ Run ${pc48.cyan("wraps selfhost login")} first.
       token = saasToken;
       organizations = (await readAuthConfig())?.auth?.organizations;
     }
-    const org = await resolveOrganization(organizations);
+    const org = await resolveOrganization(organizations, {
+      org: options.org,
+      json: options.json,
+      yes: options.yes
+    });
     if (!org) {
       progress.stop();
       log43.error(
@@ -60213,6 +60559,7 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
       process.exit(1);
     }
     progress.succeed("Connection registered");
+    const connectionRegistered = true;
     if (selfhosted) {
       metadata.selfhostPlatform = {
         externalId: result.externalId,
@@ -60245,16 +60592,7 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
       }
     }
     await saveConnectionMetadata(metadata);
-    if (hasEmail && !adopted) {
-      await deployEventBridge(
-        metadata,
-        region,
-        identity,
-        result.webhookSecret,
-        progress,
-        selfhosted ? { url: apiBaseUrl } : void 0
-      );
-    }
+    let roleUpdated = false;
     try {
       await updatePlatformRole(
         metadata,
@@ -60262,6 +60600,7 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
         result.externalId,
         selfhosted
       );
+      roleUpdated = true;
     } catch (error) {
       const errName = error && typeof error === "object" && "name" in error ? error.name : "Unknown";
       const errMsg = error instanceof Error ? error.message : String(error);
@@ -60271,6 +60610,29 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
   Run ${pc48.cyan("wraps platform update-role")} to retry.`
       );
     }
+    let eventStreamingOk = null;
+    if (hasEmail && !adopted) {
+      try {
+        await deployEventBridge(
+          metadata,
+          region,
+          identity,
+          result.webhookSecret,
+          progress,
+          selfhosted ? { url: apiBaseUrl } : void 0
+        );
+        eventStreamingOk = true;
+      } catch (error) {
+        eventStreamingOk = false;
+        const errName = error && typeof error === "object" && "name" in error ? error.name : "Unknown";
+        const errMsg = error instanceof Error ? error.message : String(error);
+        log43.warn(
+          `Could not configure event streaming (${errName}): ${errMsg}
+  The connection is registered and the access role is up to date \u2014 the dashboard will work.
+  Only SES event delivery is missing. Run ${pc48.cyan("wraps email config")} to retry.`
+        );
+      }
+    }
     await saveConnectionMetadata(metadata);
     progress.stop();
     if (isJsonMode()) {
@@ -60281,16 +60643,32 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
         connectionId: result.connectionId,
         webhookConnected: !adopted,
         selfhosted,
-        adopted
+        adopted,
+        connectionRegistered,
+        roleUpdated,
+        eventStreamingOk
       });
     } else if (adopted) {
-      outro27(pc48.green("AWS account adopted!"));
-      console.log();
-      console.log(
-        pc48.dim(
-          "Registered this account and repaired the IAM trust policy so the dashboard can reach it."
-        )
-      );
+      if (roleUpdated) {
+        outro27(pc48.green("AWS account adopted!"));
+        console.log();
+        console.log(
+          pc48.dim(
+            "Registered this account and repaired the IAM trust policy so the dashboard can reach it."
+          )
+        );
+      } else {
+        outro27(
+          pc48.yellow("AWS account adopted, but the IAM role was NOT repaired.")
+        );
+        console.log();
+        console.log(
+          pc48.dim(
+            "Registered this account, but the dashboard CANNOT reach it yet \u2014 the IAM trust policy was not repaired."
+          )
+        );
+        console.log(`  Run ${pc48.cyan("wraps platform update-role")} to retry.`);
+      }
       console.log(
         pc48.dim(
           "No infrastructure was deployed and no event wiring was changed."
@@ -60299,17 +60677,38 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
       console.log(`  Dashboard: ${pc48.cyan(dashboardUrl)}`);
       console.log();
     } else {
+      const fullySucceeded = roleUpdated && eventStreamingOk !== false;
       outro27(
-        pc48.green(
+        fullySucceeded ? pc48.green(
           selfhosted ? "Self-hosted connection complete!" : "Platform connection complete!"
+        ) : pc48.yellow(
+          selfhosted ? "Self-hosted connection registered, with issues." : "Platform connection registered, with issues."
         )
       );
       console.log();
       console.log(
-        pc48.dim(
-          "Events from your AWS infrastructure will stream to the dashboard."
-        )
+        `  ${roleUpdated ? pc48.green("\u2713") : pc48.red("\u2717")} Access role: ${roleUpdated ? "up to date" : "NOT updated \u2014 dashboard cannot reach this account"}`
       );
+      if (eventStreamingOk !== null) {
+        console.log(
+          `  ${eventStreamingOk ? pc48.green("\u2713") : pc48.yellow("!")} Event streaming: ${eventStreamingOk ? "configured" : "not configured"}`
+        );
+      }
+      if (!roleUpdated) {
+        console.log(`  Run ${pc48.cyan("wraps platform update-role")} to retry.`);
+      }
+      if (eventStreamingOk === false) {
+        console.log(
+          `  Run ${pc48.cyan("wraps email config")} to retry event streaming.`
+        );
+      }
+      if (fullySucceeded) {
+        console.log(
+          pc48.dim(
+            "Events from your AWS infrastructure will stream to the dashboard."
+          )
+        );
+      }
       console.log(`  Dashboard: ${pc48.cyan(dashboardUrl)}`);
       console.log();
     }
@@ -60319,6 +60718,9 @@ You can try the manual flow: ${pc48.cyan("wraps auth logout")} then ${pc48.cyan(
       duration_ms: duration,
       authenticated: true
     });
+    if (!roleUpdated) {
+      process.exit(1);
+    }
   } catch (error) {
     progress.stop();
     const duration = Date.now() - startTime;
@@ -63413,7 +63815,7 @@ function createMetricsRouter(config2) {
 init_esm_shims();
 init_config_set_slug();
 init_metadata();
-import dns4 from "dns/promises";
+import dns5 from "dns/promises";
 import { Router as createRouter6 } from "express";
 
 // src/console/services/settings-service.ts
@@ -63577,7 +63979,7 @@ function createSettingsRouter(config2) {
       }
       console.log(`[Verify] Checking CNAME for: ${domain}`);
       console.log(`[Verify] Expected target: ${expectedTarget}`);
-      const records = await dns4.resolveCname(domain);
+      const records = await dns5.resolveCname(domain);
       console.log("[Verify] CNAME records found:", records);
       const verified = records.some(
         (record) => record.toLowerCase().includes(expectedTarget.toLowerCase())
@@ -63610,7 +64012,7 @@ function createSettingsRouter(config2) {
       }
       const dmarcDomain = `_dmarc.${domain}`;
       console.log(`[Verify] Checking DMARC for: ${dmarcDomain}`);
-      const records = await dns4.resolveTxt(dmarcDomain);
+      const records = await dns5.resolveTxt(dmarcDomain);
       console.log("[Verify] TXT records found:", records);
       const hasDmarc = records.some((record) => {
         const value = record.join("");
@@ -69818,7 +70220,10 @@ function showHelp() {
   );
   console.log(`  ${pc72.cyan("email agent list")}     List agents`);
   console.log(
-    `  ${pc72.cyan("email agent kill")}     Kill an agent (revoke sending)
+    `  ${pc72.cyan("email agent kill")}     Kill an agent (revoke sending)`
+  );
+  console.log(
+    `  ${pc72.cyan("email agent policy")}   Change an agent's caps or allowlist
 `
   );
   console.log("Template Commands:");
@@ -70377,11 +70782,24 @@ async function run() {
                 json: flags.json
               });
               break;
+            case "policy":
+              await agentPolicy({
+                // baseline:allow-no-region — API-backed like agentList/agentKill, not direct AWS
+                name: sub[3] || flags.name,
+                maxPerHour: flags["max-per-hour"],
+                maxPerDay: flags["max-per-day"],
+                allowRecipient: flags["allow-recipient"],
+                allowDomain: flags["allow-domain"],
+                clearAllowlist: flags["clear-allowlist"] === true,
+                token: flags.token,
+                json: flags.json
+              });
+              break;
             default:
               throw errors.unknownCommand(
                 "agent command",
                 agentSubCommand,
-                "Available commands: create, list, kill"
+                "Available commands: create, list, kill, policy"
               );
           }
           break;
@@ -70734,13 +71152,15 @@ async function run() {
             force: flags.force,
             yes: flags.yes,
             json: flags.json,
-            selfhosted: true
+            selfhosted: true,
+            org: flags.org
           });
           break;
         case "update-role":
           await updateRole({
             region: flags.region,
             force: flags.force,
+            yes: flags.yes,
             json: flags.json,
             selfhosted: true
           });
@@ -70946,7 +71366,8 @@ async function run() {
             region: flags.region,
             force: flags.force,
             yes: flags.yes,
-            json: flags.json
+            json: flags.json,
+            org: flags.org
           });
           break;
         case "disconnect":
@@ -70961,6 +71382,7 @@ async function run() {
           await updateRole({
             region: flags.region,
             force: flags.force,
+            yes: flags.yes,
             json: flags.json
           });
           break;