@wraps.dev/cli 3.14.0 → 3.16.0

package/dist/lambda/event-processor/index.test.ts

@@ -0,0 +1,223 @@
+import {
+  DynamoDBClient,
+  PutItemCommand,
+  UpdateItemCommand,
+} from "@aws-sdk/client-dynamodb";
+import type { Context } from "aws-lambda";
+import { mockClient } from "aws-sdk-client-mock";
+import { beforeEach, describe, expect, it } from "vitest";
+import { handler } from "./index.ts";
+
+const ddbMock = mockClient(DynamoDBClient);
+
+const MAIL = {
+  messageId: "ses-msg-1",
+  timestamp: "2026-09-01T00:00:00.000Z",
+  source: "a@wraps.dev",
+  destination: ["X@Example.com", "other@example.com"],
+  commonHeaders: { subject: "hi" },
+};
+
+const BOUNCE_TS = "2026-09-01T00:00:05.000Z";
+
+function bounceDetail(
+  overrides: Record<string, unknown> = {},
+  bounceOverrides: Record<string, unknown> = {}
+) {
+  return {
+    eventType: "Bounce",
+    mail: MAIL,
+    bounce: {
+      bounceType: "Permanent",
+      bounceSubType: "General",
+      timestamp: BOUNCE_TS,
+      feedbackId: "fb-1",
+      bouncedRecipients: [{ emailAddress: "X@Example.com " }],
+      ...bounceOverrides,
+    },
+    ...overrides,
+  };
+}
+
+function sqsEvent(...details: unknown[]) {
+  return {
+    Records: details.map((detail, i) => ({
+      messageId: `sqs-${i + 1}`,
+      body: JSON.stringify({ detail }),
+    })),
+  } as never;
+}
+
+const context = { awsRequestId: "req-1" } as Context;
+
+const updates = () => ddbMock.commandCalls(UpdateItemCommand);
+const puts = () => ddbMock.commandCalls(PutItemCommand);
+
+beforeEach(() => {
+  ddbMock.reset();
+  process.env.TABLE_NAME = "wraps-email-history";
+  process.env.AWS_ACCOUNT_ID = "123456789012";
+});
+
+describe("event-processor suppression ledger", () => {
+  it("writes one ledger item for a permanent bounce, normalised and recipient-scoped", async () => {
+    await handler(sqsEvent(bounceDetail()), context);
+
+    expect(updates()).toHaveLength(1);
+    const input = updates()[0].args[0].input;
+    expect(input.Key).toEqual({
+      messageId: { S: "SUPPRESSION#x@example.com" },
+      sentAt: { N: "0" },
+    });
+    expect(input.ExpressionAttributeValues?.[":r"]).toEqual({ S: "bounce" });
+    expect(input.ExpressionAttributeValues?.[":d"]).toEqual({ S: "General" });
+    expect(input.ExpressionAttributeValues?.[":sa"]).toEqual({
+      N: String(Date.parse(BOUNCE_TS)),
+    });
+    // other@example.com was in mail.destination but not in bouncedRecipients
+    expect(JSON.stringify(input)).not.toContain("other@example.com");
+  });
+
+  it("keeps ledger items out of the GSI and TTL, and preserves first-seen", async () => {
+    await handler(sqsEvent(bounceDetail()), context);
+
+    const input = updates()[0].args[0].input;
+    const serialised = JSON.stringify(input);
+    expect(serialised).not.toContain("accountId");
+    expect(serialised).not.toContain("expiresAt");
+    expect(input.UpdateExpression).toContain("if_not_exists(#fsa, :sa)");
+  });
+
+  it("skips the ledger for a transient bounce but still stores the event", async () => {
+    await handler(
+      sqsEvent(bounceDetail({}, { bounceType: "Transient" })),
+      context
+    );
+
+    expect(updates()).toHaveLength(0);
+    expect(puts()).toHaveLength(1);
+  });
+
+  it("records OnAccountSuppressionList as a bounce and keeps the Suppressed event row", async () => {
+    await handler(
+      sqsEvent(
+        bounceDetail(
+          {},
+          {
+            bounceType: "Permanent",
+            bounceSubType: "OnAccountSuppressionList",
+          }
+        )
+      ),
+      context
+    );
+
+    expect(updates()).toHaveLength(1);
+    const values = updates()[0].args[0].input.ExpressionAttributeValues;
+    expect(values?.[":r"]).toEqual({ S: "bounce" });
+    expect(values?.[":d"]).toEqual({ S: "OnAccountSuppressionList" });
+    expect(puts()[0].args[0].input.Item?.eventType).toEqual({
+      S: "Suppressed",
+    });
+  });
+
+  it("records EmailValidationSuppressed as validation", async () => {
+    await handler(
+      sqsEvent(
+        bounceDetail(
+          {},
+          {
+            bounceType: "Undetermined",
+            bounceSubType: "EmailValidationSuppressed",
+          }
+        )
+      ),
+      context
+    );
+
+    expect(updates()).toHaveLength(1);
+    expect(
+      updates()[0].args[0].input.ExpressionAttributeValues?.[":r"]
+    ).toEqual({ S: "validation" });
+  });
+
+  it("records a complaint with its feedback type", async () => {
+    await handler(
+      sqsEvent({
+        eventType: "Complaint",
+        mail: MAIL,
+        complaint: {
+          complainedRecipients: [{ emailAddress: "c@example.com" }],
+          complaintFeedbackType: "abuse",
+          timestamp: BOUNCE_TS,
+          feedbackId: "fb-2",
+        },
+      }),
+      context
+    );
+
+    expect(updates()).toHaveLength(1);
+    const values = updates()[0].args[0].input.ExpressionAttributeValues;
+    expect(values?.[":r"]).toEqual({ S: "complaint" });
+    expect(values?.[":d"]).toEqual({ S: "abuse" });
+  });
+
+  it("writes nothing when the recipient list is missing, ignoring mail.destination", async () => {
+    await handler(
+      sqsEvent(bounceDetail({}, { bouncedRecipients: undefined })),
+      context
+    );
+
+    expect(updates()).toHaveLength(0);
+  });
+
+  it("contains a ledger failure so the rest of the batch still stores", async () => {
+    ddbMock.on(UpdateItemCommand).rejects(new Error("boom"));
+
+    const result = await handler(
+      sqsEvent(bounceDetail(), bounceDetail()),
+      context
+    );
+
+    expect(result).toMatchObject({ statusCode: 200 });
+    expect(puts()).toHaveLength(2);
+  });
+
+  it("still records later recipients when an earlier ledger write fails", async () => {
+    ddbMock.on(UpdateItemCommand).rejectsOnce(new Error("boom")).resolves({});
+
+    await handler(
+      sqsEvent(
+        bounceDetail(
+          {},
+          {
+            bouncedRecipients: [
+              { emailAddress: "first@example.com" },
+              { emailAddress: "second@example.com" },
+            ],
+          }
+        )
+      ),
+      context
+    );
+
+    expect(updates()).toHaveLength(2);
+    expect(updates()[1].args[0].input.Key?.messageId).toEqual({
+      S: "SUPPRESSION#second@example.com",
+    });
+  });
+
+  it("does not write a ledger item for a delivery event", async () => {
+    await handler(
+      sqsEvent({
+        eventType: "Delivery",
+        mail: MAIL,
+        delivery: { timestamp: BOUNCE_TS, recipients: ["x@example.com"] },
+      }),
+      context
+    );
+
+    expect(updates()).toHaveLength(0);
+    expect(puts()).toHaveLength(1);
+  });
+});

package/dist/lambda/event-processor/index.ts

@@ -1,5 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBClient,
+  PutItemCommand,
+  UpdateItemCommand,
+} from "@aws-sdk/client-dynamodb";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
 import type { Context, SQSEvent } from "aws-lambda";
 
@@ -13,6 +17,54 @@ const awsDefaults = {
 
 const dynamodb = new DynamoDBClient(awsDefaults);
 
+type LedgerEntry = {
+  reason: "bounce" | "complaint" | "validation";
+  detail?: string;
+};
+
+/** Which SES events write a suppression-history item, and with what reason. */
+export function ledgerEntryFor(message: {
+  eventType?: string;
+  notificationType?: string;
+  bounce?: { bounceType?: string; bounceSubType?: string };
+  complaint?: { complaintFeedbackType?: string };
+}): LedgerEntry | null {
+  const type = message.eventType || message.notificationType;
+  if (type === "Bounce" && message.bounce) {
+    const sub = message.bounce.bounceSubType;
+    if (sub === "EmailValidationSuppressed") {
+      return { reason: "validation", detail: sub };
+    }
+    if (sub === "Suppressed" || sub === "OnAccountSuppressionList") {
+      return { reason: "bounce", detail: sub };
+    }
+    if (message.bounce.bounceType === "Permanent") {
+      return { reason: "bounce", detail: sub };
+    }
+    return null;
+  }
+  if (type === "Complaint" && message.complaint) {
+    return {
+      reason: "complaint",
+      detail: message.complaint.complaintFeedbackType,
+    };
+  }
+  return null;
+}
+
+export function recipientEmails(recipients: unknown): string[] {
+  if (!Array.isArray(recipients)) return [];
+  return recipients
+    .map((r) =>
+      r && typeof r === "object"
+        ? (r as { emailAddress?: unknown }).emailAddress
+        : undefined
+    )
+    .filter((e): e is string => typeof e === "string")
+    .map((e) => e.toLowerCase().trim())
+    .filter((e) => e.length > 0);
+}
+
 /**
  * Lambda handler for processing SES events from SQS (via EventBridge)
  * Stores all SES events in DynamoDB:
@@ -210,6 +262,70 @@ export async function handler(event: SQSEvent, context: Context) {
       );
 
       log("Stored event", { eventType, messageId });
+
+      const ledger = ledgerEntryFor(message);
+      if (ledger) {
+        const recipients = recipientEmails(
+          ledger.reason === "complaint"
+            ? message.complaint?.complainedRecipients
+            : message.bounce?.bouncedRecipients
+        );
+        const feedbackId: string | undefined =
+          message.bounce?.feedbackId || message.complaint?.feedbackId;
+        if (recipients.length === 0) {
+          log("No recipients for suppression ledger", {
+            messageId,
+            reason: ledger.reason,
+          });
+        }
+        for (const email of recipients) {
+          try {
+            await dynamodb.send(
+              new UpdateItemCommand({
+                TableName: tableName,
+                Key: {
+                  messageId: { S: `SUPPRESSION#${email}` },
+                  sentAt: { N: "0" },
+                },
+                UpdateExpression:
+                  "SET #et = :et, #em = :em, #r = :r, #src = :src, #sa = :sa, " +
+                  "#fsa = if_not_exists(#fsa, :sa)" +
+                  (ledger.detail ? ", #d = :d" : "") +
+                  (feedbackId ? ", #fid = :fid" : ""),
+                ExpressionAttributeNames: {
+                  "#et": "eventType",
+                  "#em": "email",
+                  "#r": "reason",
+                  "#src": "source",
+                  "#sa": "suppressedAt",
+                  "#fsa": "firstSuppressedAt",
+                  ...(ledger.detail ? { "#d": "detail" } : {}),
+                  ...(feedbackId ? { "#fid": "feedbackId" } : {}),
+                },
+                ExpressionAttributeValues: {
+                  ":et": { S: "Suppressed" },
+                  ":em": { S: email },
+                  ":r": { S: ledger.reason },
+                  ":src": { S: "ses_event" },
+                  ":sa": { N: eventTimestamp.toString() },
+                  ...(ledger.detail ? { ":d": { S: ledger.detail } } : {}),
+                  ...(feedbackId ? { ":fid": { S: feedbackId } } : {}),
+                },
+              })
+            );
+            log("Recorded suppression ledger entry", {
+              messageId,
+              reason: ledger.reason,
+            });
+          } catch (error) {
+            // Ledger write must never abort the SQS batch or skip other recipients.
+            logError("Error recording suppression ledger entry", error, {
+              messageId,
+              reason: ledger.reason,
+            });
+          }
+        }
+      }
     } catch (error) {
       logError("Error processing record", error, {
         sqsMessageId: record.messageId,

package/dist/lambda/inbound-processor/.bundled

@@ -1 +1 @@
-Built at: 2026-09-28T21:56:24.389Z
+Built at: 2026-09-30T17:20:07.414Z

package/dist/lambda/sms-event-processor/.bundled

@@ -1 +1 @@
-Built at: 2026-09-28T21:56:24.295Z
+Built at: 2026-09-30T17:20:07.323Z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wraps.dev/cli",
-  "version": "3.14.0",
+  "version": "3.16.0",
   "description": "Deploy email, SMS, and CDN infrastructure to your AWS account with one command. Sets up SES with DKIM/SPF/DMARC, event processing, and history automatically.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -105,8 +105,8 @@
     "typescript": "^5.9.3",
     "vitest": "4.1.9",
     "@wraps.dev/email-check": "1.2.0",
-    "@wraps.dev/pulumi": "0.5.0",
     "@wraps/core": "0.1.2",
+    "@wraps.dev/pulumi": "0.6.0",
     "@wraps/db": "0.0.0",
     "@wraps/template-render": "0.1.0"
   },