@wraps.dev/cli 3.14.0 → 3.16.0

package/dist/cli.js

@@ -12538,17 +12538,17 @@ var init_loadSso_W73U3YF2 = __esm({
   }
 });
 
-// ../core/dist/dist-es-IGT2EBTC.js
-var dist_es_IGT2EBTC_exports = {};
-__export(dist_es_IGT2EBTC_exports, {
+// ../core/dist/dist-es-NT54JC6T.js
+var dist_es_NT54JC6T_exports = {};
+__export(dist_es_NT54JC6T_exports, {
   fromSSO: () => fromSSO,
   isSsoProfile: () => isSsoProfile,
   validateSsoProfile: () => validateSsoProfile
 });
 import { promises as fsPromises } from "fs";
 var isSsoProfile, EXPIRE_WINDOW_MS, REFRESH_MESSAGE, getSsoOidcClient, getNewSsoOidcToken, validateTokenExpiry, validateTokenKey, writeFile, writeSSOTokenToFile, lastRefreshAttemptTime, fromSso, SHOULD_FAIL_CREDENTIAL_CHAIN, resolveSSOCredentials, validateSsoProfile, fromSSO;
-var init_dist_es_IGT2EBTC = __esm({
-  "../core/dist/dist-es-IGT2EBTC.js"() {
+var init_dist_es_NT54JC6T = __esm({
+  "../core/dist/dist-es-NT54JC6T.js"() {
     "use strict";
     init_esm_shims();
     init_chunk_VEAA7R3K();
@@ -12854,9 +12854,9 @@ var init_dist_es_DRZJXHTP = __esm({
   }
 });
 
-// ../core/dist/sts-CUYV6JJF.js
-var sts_CUYV6JJF_exports = {};
-__export(sts_CUYV6JJF_exports, {
+// ../core/dist/sts-M53DV675.js
+var sts_M53DV675_exports = {};
+__export(sts_M53DV675_exports, {
   $Command: () => Command,
   AssumeRole$: () => AssumeRole$,
   AssumeRoleCommand: () => AssumeRoleCommand,
@@ -12931,12 +12931,12 @@ function createSmithyApiNoAuthHttpAuthOption3(authParameters) {
   };
 }
 var q, a3, b3, c3, d3, e3, f3, g3, h3, i3, j3, k3, l, m, n, o, p, _data3, root3, r3, nodes3, bdd3, cache3, defaultEndpointResolver3, createEndpointRuleSetHttpAuthSchemeParametersProvider, _defaultSTSHttpAuthSchemeParametersProvider, defaultSTSHttpAuthSchemeParametersProvider, createEndpointRuleSetHttpAuthSchemeProvider, _defaultSTSHttpAuthSchemeProvider, defaultSTSHttpAuthSchemeProvider, resolveHttpAuthSchemeConfig3, resolveClientEndpointParameters3, commonParams3, STSServiceException, ExpiredTokenException2, MalformedPolicyDocumentException, PackedPolicyTooLargeException, RegionDisabledException, IDPRejectedClaimException, InvalidIdentityTokenException, IDPCommunicationErrorException, _A, _AKI, _AR, _ARI, _ARR, _ARRs, _ARU, _ARWWI, _ARWWIR, _ARWWIRs, _Au, _C, _CA, _DS, _E, _EI, _ETE2, _IDPCEE, _IDPRCE, _IITE, _K, _MPDE, _P, _PA, _PAr, _PC, _PCLT, _PCr, _PDT, _PI, _PPS, _PPTLE, _Pr, _RA, _RDE, _RSN, _SAK, _SFWIT, _SI, _SN, _ST, _T, _TC, _TTK, _Ta, _V, _WIT, _a, _aKST, _aQE, _c3, _cTT, _e3, _hE3, _m2, _pDLT, _s3, _tLT, n03, _s_registry3, STSServiceException$, n0_registry3, ExpiredTokenException$2, IDPCommunicationErrorException$, IDPRejectedClaimException$, InvalidIdentityTokenException$, MalformedPolicyDocumentException$, PackedPolicyTooLargeException$, RegionDisabledException$, errorTypeRegistries3, accessKeySecretType, clientTokenType, AssumedRoleUser$, AssumeRoleRequest$, AssumeRoleResponse$, AssumeRoleWithWebIdentityRequest$, AssumeRoleWithWebIdentityResponse$, Credentials$, PolicyDescriptorType$, ProvidedContext$, Tag$, policyDescriptorListType, ProvidedContextsListType, tagKeyListType, tagListType, AssumeRole$, AssumeRoleWithWebIdentity$, getRuntimeConfig4, getRuntimeConfig23, getHttpAuthExtensionConfiguration3, resolveHttpAuthRuntimeConfig3, resolveRuntimeExtensions3, STSClient2, command3, _ep03, _mw03, AssumeRoleCommand, AssumeRoleWithWebIdentityCommand, commands2, STS, getAccountIdFromAssumedRoleUser, resolveRegion, getDefaultRoleAssumer, getDefaultRoleAssumerWithWebIdentity, isH2, getCustomizableStsClientCtor, getDefaultRoleAssumer2, getDefaultRoleAssumerWithWebIdentity2, decorateDefaultCredentialProvider;
-var init_sts_CUYV6JJF = __esm({
-  "../core/dist/sts-CUYV6JJF.js"() {
+var init_sts_M53DV675 = __esm({
+  "../core/dist/sts-M53DV675.js"() {
     "use strict";
     init_esm_shims();
-    init_chunk_HXLHAPSY();
     init_chunk_6IJ7OJX6();
+    init_chunk_HXLHAPSY();
     init_chunk_66V6LKQ4();
     init_chunk_OD44264Z();
     init_chunk_TS237RHU();
@@ -14948,16 +14948,16 @@ var init_dist_es_BJ5Q5O5V = __esm({
   }
 });
 
-// ../core/dist/dist-es-FHTOZU7I.js
-var dist_es_FHTOZU7I_exports = {};
-__export(dist_es_FHTOZU7I_exports, {
+// ../core/dist/dist-es-STWOPB6S.js
+var dist_es_STWOPB6S_exports = {};
+__export(dist_es_STWOPB6S_exports, {
   fromTokenFile: () => fromTokenFile,
   fromWebToken: () => fromWebToken
 });
 import { readFileSync as readFileSync2 } from "fs";
 var fromWebToken, ENV_TOKEN_FILE, ENV_ROLE_ARN, ENV_ROLE_SESSION_NAME, fromTokenFile;
-var init_dist_es_FHTOZU7I = __esm({
-  "../core/dist/dist-es-FHTOZU7I.js"() {
+var init_dist_es_STWOPB6S = __esm({
+  "../core/dist/dist-es-STWOPB6S.js"() {
     "use strict";
     init_esm_shims();
     init_chunk_VEAA7R3K();
@@ -14968,7 +14968,7 @@ var init_dist_es_FHTOZU7I = __esm({
       const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init4;
       let { roleAssumerWithWebIdentity } = init4;
       if (!roleAssumerWithWebIdentity) {
-        const { getDefaultRoleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity3 } = await Promise.resolve().then(() => (init_sts_CUYV6JJF(), sts_CUYV6JJF_exports));
+        const { getDefaultRoleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity3 } = await Promise.resolve().then(() => (init_sts_M53DV675(), sts_M53DV675_exports));
         roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity3({
           ...init4.clientConfig,
           credentialProviderLogger: init4.logger,
@@ -15015,14 +15015,14 @@ var init_dist_es_FHTOZU7I = __esm({
   }
 });
 
-// ../core/dist/dist-es-QGKOUWAV.js
-var dist_es_QGKOUWAV_exports = {};
-__export(dist_es_QGKOUWAV_exports, {
+// ../core/dist/dist-es-VEUWLPOI.js
+var dist_es_VEUWLPOI_exports = {};
+__export(dist_es_VEUWLPOI_exports, {
   fromIni: () => fromIni
 });
 var resolveCredentialSource, setNamedProvider, isAssumeRoleProfile, isAssumeRoleWithSourceProfile, isCredentialSourceProfile, resolveAssumeRoleCredentials, isCredentialSourceWithoutRoleArn, isLoginProfile, resolveLoginCredentials, isProcessProfile, resolveProcessCredentials2, resolveSsoCredentials, isSsoProfile2, isStaticCredsProfile, resolveStaticCredentials, isWebIdentityProfile, resolveWebIdentityCredentials, resolveProfileData, fromIni;
-var init_dist_es_QGKOUWAV = __esm({
-  "../core/dist/dist-es-QGKOUWAV.js"() {
+var init_dist_es_VEUWLPOI = __esm({
+  "../core/dist/dist-es-VEUWLPOI.js"() {
     "use strict";
     init_esm_shims();
     init_chunk_VEAA7R3K();
@@ -15076,7 +15076,7 @@ var init_dist_es_QGKOUWAV = __esm({
       const profileData = profiles[profileName];
       const { source_profile, region } = profileData;
       if (!options.roleAssumer) {
-        const { getDefaultRoleAssumer: getDefaultRoleAssumer3 } = await Promise.resolve().then(() => (init_sts_CUYV6JJF(), sts_CUYV6JJF_exports));
+        const { getDefaultRoleAssumer: getDefaultRoleAssumer3 } = await Promise.resolve().then(() => (init_sts_M53DV675(), sts_M53DV675_exports));
         options.roleAssumer = getDefaultRoleAssumer3({
           ...options.clientConfig,
           credentialProviderLogger: options.logger,
@@ -15140,7 +15140,7 @@ var init_dist_es_QGKOUWAV = __esm({
       return setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
     };
     resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
-      const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es_IGT2EBTC(), dist_es_IGT2EBTC_exports));
+      const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es_NT54JC6T(), dist_es_NT54JC6T_exports));
       return fromSSO2({
         profile,
         logger: options.logger,
@@ -15171,7 +15171,7 @@ var init_dist_es_QGKOUWAV = __esm({
     };
     isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
     resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
-      const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es_FHTOZU7I(), dist_es_FHTOZU7I_exports));
+      const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es_STWOPB6S(), dist_es_STWOPB6S_exports));
       const credentials = await fromTokenFile2({
         webIdentityTokenFile: profile.web_identity_token_file,
         roleArn: profile.role_arn,
@@ -15741,9 +15741,9 @@ var init_dist = __esm({
     "use strict";
     init_esm_shims();
     init_chunk_HXLHAPSY();
-    init_chunk_2E2TCHT5();
     init_chunk_66V6LKQ4();
     init_chunk_OD44264Z();
+    init_chunk_2E2TCHT5();
     init_chunk_TS237RHU();
     init_chunk_VEAA7R3K();
     init_chunk_U4QICZVS();
@@ -16310,12 +16310,12 @@ This email was sent by Wraps.`,
         if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
           throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init4.logger });
         }
-        const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es_IGT2EBTC(), dist_es_IGT2EBTC_exports));
+        const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es_NT54JC6T(), dist_es_NT54JC6T_exports));
         return fromSSO2(init4)(awsIdentityProperties);
       },
       async (awsIdentityProperties) => {
         init4.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-        const { fromIni: fromIni2 } = await Promise.resolve().then(() => (init_dist_es_QGKOUWAV(), dist_es_QGKOUWAV_exports));
+        const { fromIni: fromIni2 } = await Promise.resolve().then(() => (init_dist_es_VEUWLPOI(), dist_es_VEUWLPOI_exports));
         return fromIni2(init4)(awsIdentityProperties);
       },
       async (awsIdentityProperties) => {
@@ -16325,7 +16325,7 @@ This email was sent by Wraps.`,
       },
       async (awsIdentityProperties) => {
         init4.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
-        const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es_FHTOZU7I(), dist_es_FHTOZU7I_exports));
+        const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es_STWOPB6S(), dist_es_STWOPB6S_exports));
         return fromTokenFile2(init4)(awsIdentityProperties);
       },
       async () => {
@@ -24886,7 +24886,7 @@ function calculateUserWebhookCost(config2, emailsPerMonth) {
     description: "User webhook (API Destination invocations)"
   };
 }
-function calculateCosts(config2, emailsPerMonth = 1e4) {
+function calculateCosts(config2, emailsPerMonth = 1e4, sesPlan = DEFAULT_SES_PLAN) {
   const tracking = calculateTrackingCost(config2);
   const reputationMetrics = calculateReputationMetricsCost(config2);
   const eventTracking = calculateEventTrackingCost(config2, emailsPerMonth);
@@ -24897,7 +24897,7 @@ function calculateCosts(config2, emailsPerMonth = 1e4) {
   const smtpCredentials = calculateSMTPCredentialsCost(config2);
   const alerts = calculateAlertingCost(config2);
   const userWebhook = calculateUserWebhookCost(config2, emailsPerMonth);
-  const sesEmailCost = Math.max(0, emailsPerMonth - FREE_TIER.SES_EMAILS) * AWS_PRICING.SES_PER_EMAIL;
+  const sesEmailCost = monthlyCostForPlan(sesPlan, emailsPerMonth);
   const totalMonthlyCost = sesEmailCost + (tracking?.monthly || 0) + (reputationMetrics?.monthly || 0) + (eventTracking?.monthly || 0) + (dynamoDBHistory?.monthly || 0) + (emailArchiving?.monthly || 0) + (dedicatedIp?.monthly || 0) + (waf?.monthly || 0) + (smtpCredentials?.monthly || 0) + (alerts?.monthly || 0) + (userWebhook?.monthly || 0);
   return {
     tracking,
@@ -24912,7 +24912,7 @@ function calculateCosts(config2, emailsPerMonth = 1e4) {
     userWebhook,
     total: {
       monthly: totalMonthlyCost,
-      perEmail: AWS_PRICING.SES_PER_EMAIL,
+      perEmail: SES_PLAN_RATES[sesPlan].tiers[0].per1K / 1e3,
       description: `Total estimated cost for ${emailsPerMonth.toLocaleString()} emails/month`
     }
   };
@@ -24926,14 +24926,14 @@ function formatCost(cost) {
   }
   return `$${cost.toFixed(2)}`;
 }
-function getCostSummary(config2, emailsPerMonth = 1e4) {
-  const costs = calculateCosts(config2, emailsPerMonth);
+function getCostSummary(config2, emailsPerMonth = 1e4, sesPlan = DEFAULT_SES_PLAN) {
+  const costs = calculateCosts(config2, emailsPerMonth, sesPlan);
   const lines = [];
   lines.push(
     `Estimated cost for ${emailsPerMonth.toLocaleString()} emails/month: ${formatCost(costs.total.monthly)}/mo`
   );
   lines.push(
-    `  (${formatCost((costs.total.perEmail ?? 0) * 1e3)}/1k emails + infrastructure)`
+    `  (${formatCost((costs.total.perEmail ?? 0) * 1e3)}/1k emails on the SES ${SES_PLAN_RATES[sesPlan].label} plan + infrastructure)`
   );
   if (costs.tracking) {
     lines.push(
@@ -24987,15 +24987,15 @@ function getCostSummary(config2, emailsPerMonth = 1e4) {
   }
   return lines.join("\n");
 }
-var AWS_PRICING, FREE_TIER;
+var DEFAULT_SES_PLAN, AWS_PRICING, FREE_TIER;
 var init_costs = __esm({
   "src/utils/email/costs.ts"() {
     "use strict";
     init_esm_shims();
+    init_ses_plans2();
+    DEFAULT_SES_PLAN = "ESSENTIALS";
     AWS_PRICING = {
       // SES pricing
-      SES_PER_EMAIL: 1e-4,
-      // $0.10 per 1,000 emails (outbound)
       SES_ATTACHMENT_PER_GB: 0.12,
       // $0.12 per GB of attachments
       // DynamoDB pricing (on-demand, Standard table class)
@@ -25042,9 +25042,6 @@ var init_costs = __esm({
       // $0.20 per million API Destination invocations
     };
     FREE_TIER = {
-      // SES: no free sending tier (the 3,000/mo-for-12-months offer was retired
-      // 2026-07-21; new accounts get generic $200 AWS credits instead)
-      SES_EMAILS: 0,
       // Lambda: Permanently free tier
       LAMBDA_REQUESTS: 1e6,
       // 1M requests per month (always free)
@@ -29548,11 +29545,7 @@ var init_constants = __esm({
   }
 });
 
-// src/utils/email/config-set-slug.ts
-var config_set_slug_exports = {};
-__export(config_set_slug_exports, {
-  domainToConfigSetName: () => domainToConfigSetName
-});
+// ../core/dist/config-set-name.js
 import { createHash as createHash4 } from "crypto";
 function domainToConfigSetName(domain) {
   const slug = domain.toLowerCase().replace(/\./g, "-");
@@ -29565,15 +29558,41 @@ function domainToConfigSetName(domain) {
   const slugPart = rawSlugPart.replace(/-+$/, "");
   return `${PREFIX}${slugPart}-${hash}`;
 }
-var PREFIX, MAX_LENGTH, MAX_SLUG, MAX_SLUG_WITH_HASH;
-var init_config_set_slug = __esm({
-  "src/utils/email/config-set-slug.ts"() {
+var PREFIX, MAX_LENGTH, MAX_SLUG, MAX_SLUG_WITH_HASH, DOMAIN_CONFIG_SET_EVENT_TYPES, DOMAIN_EVENT_DESTINATION_NAME;
+var init_config_set_name = __esm({
+  "../core/dist/config-set-name.js"() {
     "use strict";
     init_esm_shims();
     PREFIX = "wraps-email-";
     MAX_LENGTH = 64;
     MAX_SLUG = MAX_LENGTH - PREFIX.length;
     MAX_SLUG_WITH_HASH = MAX_SLUG - 9;
+    DOMAIN_CONFIG_SET_EVENT_TYPES = [
+      "SEND",
+      "DELIVERY",
+      "OPEN",
+      "CLICK",
+      "BOUNCE",
+      "COMPLAINT",
+      "REJECT",
+      "RENDERING_FAILURE",
+      "DELIVERY_DELAY",
+      "SUBSCRIPTION"
+    ];
+    DOMAIN_EVENT_DESTINATION_NAME = "wraps-email-eventbridge";
+  }
+});
+
+// src/utils/email/config-set-slug.ts
+var config_set_slug_exports = {};
+__export(config_set_slug_exports, {
+  domainToConfigSetName: () => domainToConfigSetName
+});
+var init_config_set_slug = __esm({
+  "src/utils/email/config-set-slug.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config_set_name();
   }
 });
 
@@ -38781,7 +38800,9 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       // Write, deliberately. verifyOwnEmailIdentity in
       // apps/web/src/actions/ses-onboarding.ts creates the operator's own
       // address as an SES identity so a sandboxed account can complete a
-      // real first send. This is the ONLY identity write the role grants.
+      // real first send. CreateEmailIdentity and
+      // PutEmailIdentityConfigurationSetAttributes (statement below) are the
+      // only identity writes the role grants.
       "ses:CreateEmailIdentity",
       // SES v2 API for configuration set scanning (needed by dashboard).
       // List is what makes Get reachable — Get takes a name only List can find.
@@ -38800,6 +38821,19 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
     ],
     Resource: "*"
   });
+  statements.push({
+    Effect: "Allow",
+    Action: [
+      "ses:CreateConfigurationSet",
+      "ses:CreateConfigurationSetEventDestination"
+    ],
+    Resource: "arn:aws:ses:*:*:configuration-set/wraps-email-*"
+  });
+  statements.push({
+    Effect: "Allow",
+    Action: ["ses:PutEmailIdentityConfigurationSetAttributes"],
+    Resource: "*"
+  });
   statements.push({
     Effect: "Allow",
     Action: ["s3:ListBucket"],
@@ -46661,6 +46695,7 @@ Run ${pc24.cyan("wraps email init")} to deploy infrastructure again.
 
 // src/commands/email/domains.ts
 init_esm_shims();
+init_config_set_name();
 init_client();
 init_events();
 init_dns();
@@ -49179,18 +49214,7 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
       opens: purpose === "marketing" || purpose === "notifications",
       clicks: purpose === "marketing" || purpose === "notifications"
     };
-    const matchingEventTypes = [
-      "SEND",
-      "DELIVERY",
-      "OPEN",
-      "CLICK",
-      "BOUNCE",
-      "COMPLAINT",
-      "REJECT",
-      "RENDERING_FAILURE",
-      "DELIVERY_DELAY",
-      "SUBSCRIPTION"
-    ];
+    const matchingEventTypes = [...DOMAIN_CONFIG_SET_EVENT_TYPES];
     const eventBusArn = `arn:aws:events:${region}:${identity.accountId}:event-bus/default`;
     await progress.execute("Creating tracking configuration", async () => {
       try {
@@ -49208,7 +49232,7 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
         await sesClient.send(
           new CreateConfigurationSetEventDestinationCommand({
             ConfigurationSetName: configSetName,
-            EventDestinationName: "wraps-email-eventbridge",
+            EventDestinationName: DOMAIN_EVENT_DESTINATION_NAME,
             EventDestination: {
               Enabled: true,
               MatchingEventTypes: matchingEventTypes,