@wraps.dev/cli 3.17.3 → 3.17.5

package/dist/lambda/inbound-processor/index.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
   EventBridgeClient,
   PutEventsCommand,
@@ -38,6 +38,205 @@ const INBOUND_EVENT_SOURCE =
 /** Max HTML size in EventBridge detail (200KB) */
 const MAX_HTML_SIZE = 200 * 1024;
 
+const EMAIL_RECEIVED_DETAIL_TYPE = "email.received";
+
+/**
+ * EventBridge PutEvents size limits. AWS raised the limit from 256 KB to
+ * 1 MB on 2026-01-29 ("the total request size … must be less than 1 MB
+ * (1,048,576 bytes)"), except in the Regions listed below, which keep the
+ * old 256 KB limit. GovCloud was not part of that announcement.
+ * https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-putevents.html#eb-putevent-size
+ * https://aws.amazon.com/about-aws/whats-new/2026/01/amazon-eventbridge-increases-event-payload-size-256-kb-1-mb
+ */
+const EVENTBRIDGE_LIMIT_BYTES = 1024 * 1024;
+const EVENTBRIDGE_LEGACY_LIMIT_BYTES = 256 * 1024;
+const LEGACY_LIMIT_REGIONS = new Set([
+  "ap-southeast-5", // Asia Pacific (Malaysia)
+  "ap-southeast-6", // Asia Pacific (New Zealand)
+  "ap-southeast-7", // Asia Pacific (Thailand)
+  "ap-east-2", // Asia Pacific (Taipei)
+  "mx-central-1", // Mexico (Central)
+]);
+/** Headroom below the hard limit, so the entry is strictly smaller. */
+const EVENT_SIZE_MARGIN_BYTES = 1024;
+
+/** Longest subject kept in the minimal fallback detail. */
+const MAX_FALLBACK_SUBJECT_LENGTH = 1000;
+
+export function maxEventEntryBytes(
+  region = process.env.AWS_REGION ?? ""
+): number {
+  const limit =
+    LEGACY_LIMIT_REGIONS.has(region) || region.startsWith("us-gov-")
+      ? EVENTBRIDGE_LEGACY_LIMIT_BYTES
+      : EVENTBRIDGE_LIMIT_BYTES;
+  return limit - EVENT_SIZE_MARGIN_BYTES;
+}
+
+/**
+ * Size of a PutEvents entry as EventBridge counts it: the UTF-8 bytes of
+ * Source, DetailType and Detail (no Time or Resources are sent).
+ */
+export function putEventsEntrySize(entry: {
+  Source: string;
+  DetailType: string;
+  Detail: string;
+}): number {
+  return (
+    Buffer.byteLength(entry.Source, "utf8") +
+    Buffer.byteLength(entry.DetailType, "utf8") +
+    Buffer.byteLength(entry.Detail, "utf8")
+  );
+}
+
+type TrimmableEmail = {
+  emailId: string;
+  messageId: string;
+  receivingDomain: string | null;
+  from: unknown;
+  to: unknown[];
+  cc: unknown[];
+  subject: string;
+  date: string;
+  html: string | null;
+  htmlTruncated: boolean;
+  text: string | null;
+  headers: Record<string, unknown>;
+  attachments: unknown[];
+  spamVerdict: unknown;
+  virusVerdict: unknown;
+  rawS3Key: string;
+  receivedAt: string;
+  replyToken: unknown;
+  autoReply: boolean;
+};
+
+/**
+ * Build the `email.received` Detail string so the entry fits under `maxBytes`.
+ *
+ * If the full parsed email fits, it is sent unchanged. Otherwise the large
+ * fields are dropped one at a time until it fits:
+ *   1. html, text and headers, largest first
+ *      (html → null with htmlTruncated: true, text → null, headers → {})
+ *   2. attachments → [] (attachmentCount keeps the number)
+ *   3. to/cc → [] (toCount/ccCount kept), subject cut to 1000 characters
+ *   4. last resort ("envelope"): only emailId, rawS3Key, parsedS3Key,
+ *      receivedAt, replyToken and autoReply, which are all bounded
+ * Ties keep the html, text, headers order; fields that are already empty
+ * are skipped. A trimmed detail carries
+ * `truncated: true`, `truncatedFields`, and `parsedS3Key`, the key of the
+ * full parsed JSON in the same bucket as `rawS3Key`.
+ */
+export function buildEventDetail(
+  email: TrimmableEmail,
+  parsedS3Key: string,
+  source: string,
+  maxBytes: number
+): { detail: string; truncatedFields: string[]; fullBytes: number } {
+  const sizeOf = (candidate: string) =>
+    putEventsEntrySize({
+      Source: source,
+      DetailType: EMAIL_RECEIVED_DETAIL_TYPE,
+      Detail: candidate,
+    });
+
+  const full = JSON.stringify(email);
+  const fullBytes = sizeOf(full);
+  if (fullBytes <= maxBytes) {
+    return { detail: full, truncatedFields: [], fullBytes };
+  }
+
+  const truncatedFields: string[] = [];
+  const trimmed: Record<string, unknown> = {
+    ...email,
+    truncated: true,
+    truncatedFields,
+    parsedS3Key,
+  };
+  const bodySteps: [string, number, () => void][] = [
+    [
+      "html",
+      Buffer.byteLength(JSON.stringify(email.html), "utf8"),
+      () => {
+        trimmed.html = null;
+        trimmed.htmlTruncated = true;
+      },
+    ],
+    [
+      "text",
+      Buffer.byteLength(JSON.stringify(email.text), "utf8"),
+      () => {
+        trimmed.text = null;
+      },
+    ],
+    [
+      "headers",
+      Buffer.byteLength(JSON.stringify(email.headers), "utf8"),
+      () => {
+        trimmed.headers = {};
+      },
+    ],
+  ];
+  const present: Record<string, boolean> = {
+    html: email.html !== null,
+    text: email.text !== null,
+    headers: Object.keys(email.headers).length > 0,
+  };
+  // Stable sort: equal sizes keep the html, text, headers order. Fields
+  // that are already empty are skipped so they are not reported as dropped.
+  bodySteps.sort((a, b) => b[1] - a[1]);
+  const steps: [string, () => void][] = [
+    ...bodySteps
+      .filter(([field]) => present[field])
+      .map(([field, , drop]): [string, () => void] => [field, drop]),
+    [
+      "attachments",
+      () => {
+        trimmed.attachmentCount = email.attachments.length;
+        trimmed.attachments = [];
+      },
+    ],
+    [
+      "recipients",
+      () => {
+        trimmed.toCount = email.to.length;
+        trimmed.ccCount = email.cc.length;
+        trimmed.to = [];
+        trimmed.cc = [];
+        trimmed.subject = email.subject.slice(0, MAX_FALLBACK_SUBJECT_LENGTH);
+      },
+    ],
+  ];
+
+  let detail = JSON.stringify(trimmed);
+  for (const [field, drop] of steps) {
+    if (sizeOf(detail) <= maxBytes) {
+      break;
+    }
+    drop();
+    truncatedFields.push(field);
+    detail = JSON.stringify(trimmed);
+  }
+
+  // Sender-controlled fields that are left (from.name, messageId, verdict
+  // headers) are unbounded. If they alone are too big, send an envelope of
+  // bounded fields only, so the event can never exceed the limit.
+  if (sizeOf(detail) > maxBytes) {
+    truncatedFields.push("envelope");
+    detail = JSON.stringify({
+      emailId: email.emailId,
+      rawS3Key: email.rawS3Key,
+      parsedS3Key,
+      receivedAt: email.receivedAt,
+      replyToken: email.replyToken,
+      autoReply: email.autoReply,
+      truncated: true,
+      truncatedFields,
+    });
+  }
+  return { detail, truncatedFields, fullBytes };
+}
+
 type CachedSecret = {
   kid: number;
   current: Buffer;
@@ -217,7 +416,9 @@ function detectAutoReply(headers: Record<string, unknown>): boolean {
  * 3. Parse MIME → extract headers, body, attachments
  * 4. Store attachments → S3 (attachments/{emailId}/{attId}-{filename})
  * 5. Store parsed JSON → S3 (parsed/{emailId}.json)
- * 6. Put event → EventBridge (source: "wraps.inbound", detail-type: "email.received")
+ * 6. Put event → EventBridge (source: "wraps.inbound", detail-type: "email.received").
+ *    If the full parsed email does not fit the PutEvents size limit, the
+ *    detail is trimmed (see buildEventDetail) and points at parsed/{emailId}.json.
  */
 export async function handler(event: S3Event, context: Context) {
   const requestId = context.awsRequestId;
@@ -249,6 +450,10 @@ export async function handler(event: S3Event, context: Context) {
   for (const record of event.Records) {
     const s3Key = decodeURIComponent(record.s3.object.key.replace(/\+/g, " "));
     const bucket = record.s3.bucket.name;
+    // S3 event time is identical across retries; new Date() would differ per attempt.
+    const receivedAt = record.eventTime
+      ? new Date(record.eventTime).toISOString()
+      : new Date().toISOString();
 
     try {
       log("Processing raw email", { bucket, key: s3Key });
@@ -265,8 +470,9 @@ export async function handler(event: S3Event, context: Context) {
       // 2. Parse MIME
       const parsed = await simpleParser(rawBody);
 
-      // Generate email ID
-      const emailId = `inb_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+      // Deterministic per raw object: a Lambda retry re-processes the same S3 key,
+      // so it must produce the same id (parsed JSON, attachments, event all key off it).
+      const emailId = `inb_${createHash("sha256").update(s3Key).digest("hex").slice(0, 16)}`;
 
       // 3. Extract headers as key-value pairs
       // mailparser returns most headers as strings, but some (list, received,
@@ -461,7 +667,7 @@ export async function handler(event: S3Event, context: Context) {
         to: toAddresses,
         cc: ccAddresses,
         subject: parsed.subject || "",
-        date: parsed.date?.toISOString() || new Date().toISOString(),
+        date: parsed.date?.toISOString() || receivedAt,
         html,
         htmlTruncated,
         text: parsed.text || null,
@@ -470,16 +676,17 @@ export async function handler(event: S3Event, context: Context) {
         spamVerdict,
         virusVerdict,
         rawS3Key: s3Key,
-        receivedAt: new Date().toISOString(),
+        receivedAt,
         replyToken,
         autoReply,
       };
 
       // 7. Store parsed JSON at parsed/{emailId}.json
+      const parsedS3Key = `parsed/${emailId}.json`;
       await s3.send(
         new PutObjectCommand({
           Bucket: BUCKET_NAME,
-          Key: `parsed/${emailId}.json`,
+          Key: parsedS3Key,
           Body: JSON.stringify(parsedEmail),
           ContentType: "application/json",
         })
@@ -490,19 +697,50 @@ export async function handler(event: S3Event, context: Context) {
         attachmentCount: attachments.length,
       });
 
-      // 8. Put event to EventBridge
-      await eventbridge.send(
+      // 8. Put event to EventBridge, trimmed to fit the PutEvents size limit
+      const maxBytes = maxEventEntryBytes();
+      const { detail, truncatedFields, fullBytes } = buildEventDetail(
+        parsedEmail,
+        parsedS3Key,
+        INBOUND_EVENT_SOURCE,
+        maxBytes
+      );
+      if (truncatedFields.length > 0) {
+        log("Trimmed email.received detail to fit EventBridge limit", {
+          emailId,
+          fullBytes,
+          trimmedBytes: putEventsEntrySize({
+            Source: INBOUND_EVENT_SOURCE,
+            DetailType: EMAIL_RECEIVED_DETAIL_TYPE,
+            Detail: detail,
+          }),
+          maxBytes,
+          truncatedFields,
+          parsedS3Key,
+        });
+      }
+
+      const putResult = await eventbridge.send(
         new PutEventsCommand({
           Entries: [
             {
               Source: INBOUND_EVENT_SOURCE,
-              DetailType: "email.received",
-              Detail: JSON.stringify(parsedEmail),
+              DetailType: EMAIL_RECEIVED_DETAIL_TYPE,
+              Detail: detail,
             },
           ],
         })
       );
 
+      // PutEvents reports per-entry failures in a 200 response, so a
+      // failed entry must be surfaced explicitly to trigger a retry.
+      if ((putResult.FailedEntryCount ?? 0) > 0) {
+        const failed = (putResult.Entries ?? []).find((e) => e.ErrorCode);
+        throw new Error(
+          `EventBridge PutEvents failed for ${emailId}: ${failed?.ErrorCode ?? "UnknownError"} ${failed?.ErrorMessage ?? ""}`.trim()
+        );
+      }
+
       log("Processed inbound", {
         emailId,
         sendingDomain: replyRecipient?.sendingDomain ?? null,

package/dist/lambda/sms-event-processor/.bundled

@@ -1 +1 @@
-Built at: 2026-10-12T05:04:39.515Z
+Built at: 2026-10-27T16:59:11.639Z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wraps.dev/cli",
-  "version": "3.17.3",
+  "version": "3.17.5",
   "description": "Deploy email, SMS, and CDN infrastructure to your AWS account with one command. Sets up SES with DKIM/SPF/DMARC, event processing, and history automatically.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -46,32 +46,32 @@
   "author": "Wraps",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@aws-sdk/client-acm": "3.1074.0",
-    "@aws-sdk/client-cloudformation": "3.1074.0",
-    "@aws-sdk/client-cloudfront": "3.1074.0",
-    "@aws-sdk/client-cloudwatch": "3.1074.0",
-    "@aws-sdk/client-cloudwatch-logs": "3.1074.0",
-    "@aws-sdk/client-dynamodb": "3.1074.0",
-    "@aws-sdk/client-eventbridge": "3.1074.0",
-    "@aws-sdk/client-iam": "3.1074.0",
-    "@aws-sdk/client-lambda": "3.1074.0",
-    "@aws-sdk/client-mailmanager": "3.1074.0",
-    "@aws-sdk/client-pinpoint-sms-voice-v2": "3.1074.0",
-    "@aws-sdk/client-route-53": "3.1074.0",
-    "@aws-sdk/client-s3": "3.1074.0",
-    "@aws-sdk/client-ses": "3.1074.0",
-    "@aws-sdk/client-sesv2": "3.1091.0",
-    "@aws-sdk/client-sns": "3.1074.0",
-    "@aws-sdk/client-sqs": "3.1074.0",
-    "@aws-sdk/client-ssm": "3.1074.0",
-    "@aws-sdk/client-sts": "3.1074.0",
-    "@aws-sdk/s3-request-presigner": "3.1074.0",
-    "@aws-sdk/util-dynamodb": "3.996.5",
+    "@aws-sdk/client-acm": "3.1152.0",
+    "@aws-sdk/client-cloudformation": "3.1152.0",
+    "@aws-sdk/client-cloudfront": "3.1152.0",
+    "@aws-sdk/client-cloudwatch": "3.1152.0",
+    "@aws-sdk/client-cloudwatch-logs": "3.1152.0",
+    "@aws-sdk/client-dynamodb": "3.1152.0",
+    "@aws-sdk/client-eventbridge": "3.1152.0",
+    "@aws-sdk/client-iam": "3.1152.0",
+    "@aws-sdk/client-lambda": "3.1152.0",
+    "@aws-sdk/client-mailmanager": "3.1152.0",
+    "@aws-sdk/client-pinpoint-sms-voice-v2": "3.1152.0",
+    "@aws-sdk/client-route-53": "3.1152.0",
+    "@aws-sdk/client-s3": "3.1152.0",
+    "@aws-sdk/client-ses": "3.1152.0",
+    "@aws-sdk/client-sesv2": "3.1152.0",
+    "@aws-sdk/client-sns": "3.1152.0",
+    "@aws-sdk/client-sqs": "3.1152.0",
+    "@aws-sdk/client-ssm": "3.1152.0",
+    "@aws-sdk/client-sts": "3.1152.0",
+    "@aws-sdk/s3-request-presigner": "3.1152.0",
+    "@aws-sdk/util-dynamodb": "3.996.9",
     "@clack/prompts": "^0.11.0",
     "@pulumi/aws": "^7.39.0",
     "@pulumi/pulumi": "^3.254.0",
     "@react-email/render": "2.1.0",
-    "better-auth": "1.7.5",
+    "better-auth": "1.7.11",
     "conf": "^15.1.0",
     "cosmiconfig": "^9.0.2",
     "drizzle-orm": "^0.45.2",
@@ -99,13 +99,13 @@
     "@vitest/coverage-v8": "4.1.11",
     "aws-sdk-client-mock": "4.1.0",
     "aws-sdk-client-mock-vitest": "7.0.1",
-    "handlebars": "4.7.9",
+    "handlebars": "4.7.10",
     "tsup": "^8.5.1",
     "tsx": "4.20.6",
     "typescript": "^5.9.3",
     "vitest": "4.1.11",
+    "@wraps.dev/email-check": "1.3.0",
     "@wraps.dev/pulumi": "0.6.0",
-    "@wraps.dev/email-check": "1.2.0",
     "@wraps/core": "0.1.2",
     "@wraps/db": "0.0.0",
     "@wraps/template-render": "0.1.0"