@wraps.dev/cli 3.19.0 → 3.20.0

package/dist/cli.js

@@ -61495,17 +61495,22 @@ Run ${pc45.cyan("wraps email init")} to deploy email infrastructure.
 
 // src/commands/email/suppressions.ts
 init_esm_shims();
+import { readFile as readFile6 } from "fs/promises";
 import { log as log49, note as note21 } from "@clack/prompts";
 init_json_output();
 var LIST_COMMAND3 = "email.suppressions.list";
 var REMOVE_COMMAND = "email.suppressions.remove";
 var LIST_USAGE3 = "wraps email suppressions list --json";
 var REMOVE_USAGE = "wraps email suppressions remove <email> --account <awsAccountId> --yes";
+var ADD_COMMAND = "email.suppressions.add";
+var ADD_USAGE = "wraps email suppressions add <email...> --account <awsAccountId> --reason bounce|complaint --yes";
+var MAX_BATCH = 100;
 var MAX_LIMIT3 = 100;
 var MAX_CURSOR_LENGTH3 = 8192;
 var MAX_EMAIL_LENGTH = 320;
 var MAX_ACCOUNT_ID_LENGTH2 = 128;
 var DIGITS_ONLY4 = /^\d+$/;
+var LINE_BREAK = /\r?\n/;
 var PERMISSION_TEXT = /update-role|permission/i;
 var DENIED_SUGGESTION2 = "Wraps cannot read or change the suppression list on these accounts: their AWS role lacks SES permission. Run `wraps platform update-role` to refresh the permissions, then retry.";
 var UNREACHABLE_SUGGESTION2 = "Wraps could not reach these accounts (an AWS error, or the assume-role failed). Run `wraps email health` to see each account's SES status, then retry.";
@@ -61643,11 +61648,15 @@ function httpFailure4(action, status2, text15, remove) {
     };
   }
   if (status2 >= 500) {
-    return {
-      code: "API_ERROR",
-      message: text15,
-      suggestion: action === "list" ? "The Wraps API failed. Retry shortly; to find a failing account, run `wraps email health`." : `The Wraps API failed. Retry shortly; check the address is still listed with \`${LIST_USAGE3}\` first.`
-    };
+    let suggestion;
+    if (action === "list") {
+      suggestion = "The Wraps API failed. Retry shortly; to find a failing account, run `wraps email health`.";
+    } else if (action === "add") {
+      suggestion = "The Wraps API failed. Retry shortly; adding an address twice is safe, so re-running the same command is fine.";
+    } else {
+      suggestion = `The Wraps API failed. Retry shortly; check the address is still listed with \`${LIST_USAGE3}\` first.`;
+    }
+    return { code: "API_ERROR", message: text15, suggestion };
   }
   return {
     code: "API_ERROR",
@@ -61656,14 +61665,21 @@ function httpFailure4(action, status2, text15, remove) {
   };
 }
 async function callApi8(request) {
-  const { target, method, path: path3, query, onFailure } = request;
+  const { target, method, path: path3, query, body: payload, onFailure } = request;
   const qs = query.toString();
   const url = `${target.apiBase}${path3}${qs ? `?${qs}` : ""}`;
+  const headers = {
+    Authorization: `Bearer ${target.token}`
+  };
+  if (payload !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
   let resp;
   try {
     resp = await fetch(url, {
       method,
-      headers: { Authorization: `Bearer ${target.token}` }
+      headers,
+      body: payload === void 0 ? void 0 : JSON.stringify(payload)
     });
   } catch (err) {
     return {
@@ -61951,6 +61967,320 @@ async function suppressionsRemove(options) {
     );
   }
 }
+function addFailure(status2, text15) {
+  if (status2 === 400) {
+    return {
+      code: "VALIDATION_FAILED",
+      message: text15,
+      suggestion: `Check the arguments, then re-run: ${ADD_USAGE}`
+    };
+  }
+  if (status2 === 404) {
+    return {
+      code: "NOT_FOUND",
+      message: text15,
+      suggestion: "Check that --account is the awsAccountId of a connected account. `wraps email health` lists each account's SES status."
+    };
+  }
+  return httpFailure4("add", status2, text15);
+}
+function undoHint(accountId, reason) {
+  const ack = reason === "COMPLAINT" ? " --acknowledge-complaint" : "";
+  return `wraps email suppressions remove <email> --account ${accountId} --yes${ack}`;
+}
+function uniqueAddresses2(raw) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const item of raw) {
+    const email = item.trim();
+    if (email !== "" && !seen.has(email.toLowerCase())) {
+      seen.set(email.toLowerCase(), email);
+    }
+  }
+  return [...seen.values()];
+}
+async function readAddressFile(path3) {
+  try {
+    const text15 = await readFile6(path3, "utf8");
+    const lines = text15.split(LINE_BREAK).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
+    return { ok: true, value: lines };
+  } catch (err) {
+    return {
+      ok: false,
+      failure: {
+        code: "INVALID_FLAG_VALUE",
+        message: `Could not read --file ${path3} (${errorText10(err)})`,
+        suggestion: "Check the path, then pass --file <path> to a text file with one address per line."
+      }
+    };
+  }
+}
+function bulkResult(email, item) {
+  if (item !== null && typeof item === "object") {
+    const row = item;
+    if (row.success === true) {
+      return {
+        email,
+        success: true,
+        alreadyPresent: row.alreadyPresent === true
+      };
+    }
+    if (row.success === false) {
+      return {
+        email,
+        success: false,
+        error: typeof row.error === "string" ? row.error : "Failed to add suppression"
+      };
+    }
+  }
+  return {
+    email,
+    success: false,
+    error: "The API returned no result for this address"
+  };
+}
+async function collectAddresses(options) {
+  const file = optionalText(
+    "--file",
+    options.file,
+    `Pass --file <path> to a text file with one address per line, or give the addresses as arguments: ${ADD_USAGE}`
+  );
+  if (!file.ok) {
+    return file;
+  }
+  let fromFile = [];
+  if (file.value !== void 0) {
+    const read = await readAddressFile(file.value);
+    if (!read.ok) {
+      return read;
+    }
+    fromFile = read.value;
+  }
+  const fromArgs = Array.isArray(options.emails) ? options.emails.filter((item) => typeof item === "string") : [];
+  const emails = uniqueAddresses2([...fromArgs, ...fromFile]);
+  if (emails.length === 0) {
+    return {
+      ok: false,
+      failure: {
+        code: "MISSING_REQUIRED_FLAG",
+        message: "No email addresses given",
+        suggestion: `Usage: ${ADD_USAGE}, or pass --file <path>`
+      }
+    };
+  }
+  if (emails.length > MAX_BATCH) {
+    return {
+      ok: false,
+      failure: {
+        code: "VALIDATION_FAILED",
+        message: `${emails.length} addresses given; one command adds at most ${MAX_BATCH}`,
+        suggestion: `Split the list into files of ${MAX_BATCH} or fewer, then run the command once per file with --file <path>.`
+      }
+    };
+  }
+  return { ok: true, value: emails };
+}
+function parseAccount2(raw) {
+  const account = optionalText(
+    "--account",
+    raw,
+    `Find the awsAccountId with \`${LIST_USAGE3}\`, then re-run: ${ADD_USAGE}`
+  );
+  if (!account.ok) {
+    return account;
+  }
+  if (account.value === void 0) {
+    return {
+      ok: false,
+      failure: {
+        code: "VALIDATION_FAILED",
+        message: "Missing --account <awsAccountId>",
+        suggestion: `Find the awsAccountId with \`${LIST_USAGE3}\`, then re-run: ${ADD_USAGE}`
+      }
+    };
+  }
+  if (account.value.length > MAX_ACCOUNT_ID_LENGTH2) {
+    return {
+      ok: false,
+      failure: {
+        code: "INVALID_FLAG_VALUE",
+        message: "--account is longer than 128 characters",
+        suggestion: `Copy the awsAccountId exactly from \`${LIST_USAGE3}\`.`
+      }
+    };
+  }
+  return { ok: true, value: account.value };
+}
+function parseAddReason(raw) {
+  const text15 = typeof raw === "string" ? raw.trim().toLowerCase() : "";
+  if (text15 === "bounce") {
+    return { ok: true, value: "BOUNCE" };
+  }
+  if (text15 === "complaint") {
+    return { ok: true, value: "COMPLAINT" };
+  }
+  return {
+    ok: false,
+    failure: {
+      code: raw === void 0 ? "MISSING_REQUIRED_FLAG" : "INVALID_FLAG_VALUE",
+      message: "--reason must be bounce or complaint",
+      suggestion: `Re-run with --reason bounce or --reason complaint: ${ADD_USAGE}`
+    }
+  };
+}
+async function sendAdds(target, accountId, reason, emails) {
+  const only = emails.length === 1 ? emails[0] : void 0;
+  if (only !== void 0) {
+    const outcome2 = await callApi8({
+      target,
+      method: "POST",
+      path: "/v1/suppressions",
+      query: new URLSearchParams(),
+      body: { awsAccountId: accountId, email: only, reason },
+      onFailure: addFailure
+    });
+    if (!outcome2.ok) {
+      return outcome2;
+    }
+    return {
+      ok: true,
+      value: [
+        {
+          email: only,
+          success: true,
+          alreadyPresent: outcome2.body.alreadyPresent === true
+        }
+      ]
+    };
+  }
+  const outcome = await callApi8({
+    target,
+    method: "POST",
+    path: "/v1/suppressions/bulk",
+    query: new URLSearchParams(),
+    body: {
+      entries: emails.map((email) => ({
+        awsAccountId: accountId,
+        email,
+        reason
+      }))
+    },
+    onFailure: addFailure
+  });
+  if (!outcome.ok) {
+    return outcome;
+  }
+  const rows = Array.isArray(outcome.body.results) ? outcome.body.results : [];
+  return {
+    ok: true,
+    value: emails.map((email, index) => bulkResult(email, rows[index]))
+  };
+}
+function printAddHuman(accountId, reason, results, counts) {
+  for (const r6 of results) {
+    if (!r6.success) {
+      log49.error(`${r6.email}: ${r6.error ?? "Failed to add suppression"}`);
+    } else if (r6.alreadyPresent === true) {
+      log49.info(
+        `${r6.email} was already suppressed on account ${accountId}; nothing changed.`
+      );
+    } else {
+      log49.success(
+        `Suppressed ${r6.email} on account ${accountId} as ${reason}.`
+      );
+    }
+  }
+  log49.info(
+    `${counts.added} added, ${counts.alreadyPresent} already suppressed, ${counts.failed} failed.`
+  );
+  if (counts.added > 0) {
+    log49.info(`Undo with: ${undoHint(accountId, reason)}`);
+  }
+}
+async function suppressionsAdd(options) {
+  const command6 = ADD_COMMAND;
+  const addresses = await collectAddresses(options);
+  if (!addresses.ok) {
+    emitError5(command6, addresses.failure);
+    return;
+  }
+  const account = parseAccount2(options.account);
+  if (!account.ok) {
+    emitError5(command6, account.failure);
+    return;
+  }
+  const parsedReason = parseAddReason(options.reason);
+  if (!parsedReason.ok) {
+    emitError5(command6, parsedReason.failure);
+    return;
+  }
+  const emails = addresses.value;
+  const accountId = account.value;
+  const reason = parsedReason.value;
+  if (options.dryRun) {
+    const data = {
+      awsAccountId: accountId,
+      reason,
+      dryRun: true,
+      emails,
+      results: [],
+      added: 0,
+      alreadyPresent: 0,
+      failed: 0
+    };
+    if (isJsonMode()) {
+      jsonSuccess(command6, data);
+      return;
+    }
+    note21(
+      emails.join("\n"),
+      `Dry run: ${emails.length} address(es) on account ${accountId} as ${reason}`
+    );
+    log49.info("No request was sent.");
+    return;
+  }
+  if (!options.yes) {
+    const shown = emails.length === 1 ? emails[0] : "<email...>";
+    emitError5(command6, {
+      code: "CONFIRMATION_REQUIRED",
+      message: "Suppressing an address stops Wraps from sending to it. Nothing was added because --yes was not passed.",
+      suggestion: `Re-run with --yes to confirm: wraps email suppressions add ${shown} --account ${accountId} --reason ${reason.toLowerCase()} --yes. Undo later with: ${undoHint(accountId, reason)}`
+    });
+    return;
+  }
+  const target = await connect5(command6, options.token);
+  if (!target) {
+    return;
+  }
+  const sent = await sendAdds(target, accountId, reason, emails);
+  if (!sent.ok) {
+    emitError5(command6, sent.failure);
+    return;
+  }
+  const results = sent.value;
+  const added = results.filter(
+    (r6) => r6.success && r6.alreadyPresent !== true
+  ).length;
+  const alreadyPresent = results.filter(
+    (r6) => r6.success && r6.alreadyPresent === true
+  ).length;
+  const failed = results.filter((r6) => !r6.success).length;
+  if (failed > 0) {
+    process.exitCode = 1;
+  }
+  if (isJsonMode()) {
+    jsonSuccess(command6, {
+      awsAccountId: accountId,
+      reason,
+      dryRun: false,
+      results,
+      added,
+      alreadyPresent,
+      failed
+    });
+    return;
+  }
+  printAddHuman(accountId, reason, results, { added, alreadyPresent, failed });
+}
 
 // src/commands/email/templates/init.ts
 init_esm_shims();
@@ -61960,7 +62290,7 @@ init_errors();
 init_json_output();
 init_output();
 import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir3, readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile8, writeFile as writeFile8 } from "fs/promises";
 import { join as join15 } from "path";
 import * as clack43 from "@clack/prompts";
 import pc46 from "picocolors";
@@ -61968,7 +62298,7 @@ import pc46 from "picocolors";
 // src/utils/shared/scaffold-claude.ts
 init_esm_shims();
 import { existsSync as existsSync9 } from "fs";
-import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile7, writeFile as writeFile7 } from "fs/promises";
 import { join as join14 } from "path";
 var CLAUDE_MD_HEADER = `# Wraps
 
@@ -61997,7 +62327,7 @@ ${wrappedContent}
     );
     return;
   }
-  let existing = await readFile6(claudeMdPath, "utf-8");
+  let existing = await readFile7(claudeMdPath, "utf-8");
   const markerRegex = new RegExp(
     `${escapeRegex(startMarker)}[\\s\\S]*?${escapeRegex(endMarker)}`,
     "g"
@@ -62449,7 +62779,7 @@ async function templatesInit(options) {
   try {
     const pkgPath = join15(cwd, "package.json");
     if (existsSync10(pkgPath)) {
-      const pkg = JSON.parse(await readFile7(pkgPath, "utf-8"));
+      const pkg = JSON.parse(await readFile8(pkgPath, "utf-8"));
       if (pkg.homepage) {
         try {
           const url = new URL(pkg.homepage);
@@ -62506,7 +62836,7 @@ async function templatesInit(options) {
   await writeFile8(gitignorePath, ".wraps/\n", "utf-8");
   const rootGitignorePath = join15(cwd, ".gitignore");
   if (existsSync10(rootGitignorePath)) {
-    const gitignoreContent = await readFile7(rootGitignorePath, "utf-8");
+    const gitignoreContent = await readFile8(rootGitignorePath, "utf-8");
     if (!gitignoreContent.includes("wraps/.wraps")) {
       await writeFile8(
         rootGitignorePath,
@@ -63281,7 +63611,7 @@ init_esm_shims();
 init_events();
 import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync14 } from "fs";
-import { mkdir as mkdir6, readFile as readFile9, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile10, writeFile as writeFile11 } from "fs/promises";
 import { join as join19 } from "path";
 import * as clack46 from "@clack/prompts";
 import pc49 from "picocolors";
@@ -63382,7 +63712,7 @@ init_json_output();
 // src/utils/shared/lockfile.ts
 init_esm_shims();
 import { existsSync as existsSync13 } from "fs";
-import { mkdir as mkdir5, readFile as readFile8, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
 import { join as join18 } from "path";
 function getLockfilePath(wrapsDir) {
   return join18(wrapsDir, ".wraps", "lockfile.json");
@@ -63393,7 +63723,7 @@ async function loadLockfile(wrapsDir) {
     return { version: "1.0.0", lastSync: "", templates: {}, workflows: {} };
   }
   try {
-    const content = await readFile8(path3, "utf-8");
+    const content = await readFile9(path3, "utf-8");
     const parsed = JSON.parse(content);
     if (!parsed.templates) {
       parsed.templates = {};
@@ -63543,7 +63873,7 @@ async function templatesPush(options) {
   for (const file of templateFiles) {
     const slug = file.replace(/\.tsx?$/, "");
     const filePath = join19(templatesDir, file);
-    const source = await readFile9(filePath, "utf-8");
+    const source = await readFile10(filePath, "utf-8");
     const sourceHash = sha256(source);
     const existsRemotely = remoteTemplateSlugs === null || remoteTemplateSlugs.has(slug);
     if (isTemplateUnchanged({
@@ -64094,10 +64424,12 @@ var CMD3 = {
   get: "email.templates.get",
   pull: "email.templates.pull",
   publish: "email.templates.publish",
-  duplicate: "email.templates.duplicate"
+  duplicate: "email.templates.duplicate",
+  delete: "email.templates.delete"
 };
 var TEMPLATE_STATUSES = ["DRAFT", "PUBLISHED", "ARCHIVED"];
 var TEMPLATE_CHANNELS = ["email", "sms"];
+var DELETE_BULK_MAX = 100;
 var PULL_PAGE_SIZE = 200;
 var PULL_MAX_PAGES = 1e3;
 var SAFE_SLUG = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
@@ -64547,6 +64879,154 @@ async function templatesDuplicate(options) {
   }
   log54.success(`Created draft copy ${copy.id} (${copy.name}).`);
 }
+async function deleteFailure(resp, singleId) {
+  if (resp.status === 409) {
+    const body = await resp.json().catch(() => null);
+    const blockingIds = Array.isArray(body?.blockingIds) ? body.blockingIds.filter((id) => typeof id === "string") : [];
+    return {
+      code: "CONFLICT",
+      message: `${firstText(body?.error) ?? "A broadcast or workflow still uses one of these templates."} Blocking template ids: ${blockingIds.join(", ") || "none reported"}.`,
+      suggestion: "Finish or cancel each scheduled, queued or processing broadcast that uses a blocking template (`wraps broadcasts cancel <id> --yes`), or disable each enabled workflow that sends it (`wraps workflows disable <workflow-id>`). Find the workflows with `wraps workflows list` and the broadcasts in the dashboard. Then re-run the delete. Nothing was deleted."
+    };
+  }
+  if (resp.status === 404 && singleId !== void 0) {
+    return {
+      code: "NOT_FOUND",
+      message: `Template ${singleId} was not found in this organization. Nothing was deleted.`,
+      suggestion: "Check the id with `wraps email templates list`, then re-run the delete."
+    };
+  }
+  return apiFailure2(resp);
+}
+function deleteIds(options) {
+  return [
+    ...new Set(
+      (options.ids ?? []).map((id) => id.trim()).filter((id) => id !== "")
+    )
+  ];
+}
+function printDeleteDryRun(command6, ids, route) {
+  if (isJsonMode()) {
+    jsonSuccess(command6, {
+      dryRun: true,
+      route,
+      wouldDelete: ids,
+      deleted: [],
+      notFound: [],
+      count: 0
+    });
+    return;
+  }
+  log54.info(
+    `Dry run: would delete ${ids.length} template(s) via the ${route} route: ${ids.join(", ")}. Nothing was deleted.`
+  );
+}
+function sendDelete(command6, target, ids, singleId) {
+  const confirm35 = new URLSearchParams({ confirm: "true" });
+  if (singleId === void 0) {
+    return call(command6, target, withQuery("/v1/templates", confirm35), {
+      method: "DELETE",
+      body: { ids }
+    });
+  }
+  return call(
+    command6,
+    target,
+    withQuery(`/v1/templates/${encodeURIComponent(singleId)}`, confirm35),
+    { method: "DELETE" }
+  );
+}
+async function readDeleteResult(command6, resp, ids, singleId) {
+  if (singleId !== void 0) {
+    const body2 = await readBody(resp);
+    if (!body2 || body2.success !== true) {
+      failUnexpected(command6);
+      return null;
+    }
+    return { deleted: [singleId], notFound: [] };
+  }
+  const body = await readBody(resp);
+  if (!(body && Array.isArray(body.notFound))) {
+    failUnexpected(command6);
+    return null;
+  }
+  const notFound = body.notFound.filter(
+    (id) => typeof id === "string"
+  );
+  return {
+    deleted: ids.filter((id) => !notFound.includes(id)),
+    notFound
+  };
+}
+function printDeleteResult(route, result) {
+  const { deleted, notFound } = result;
+  log54.success(
+    route === "single" ? `Deleted template ${deleted[0]}.` : `Deleted ${deleted.length} template(s).`
+  );
+  if (notFound.length > 0) {
+    log54.warn(
+      `Not found in this organization, so skipped: ${notFound.join(", ")}.`
+    );
+  }
+}
+async function templatesDelete(options) {
+  const command6 = CMD3.delete;
+  const ids = deleteIds(options);
+  if (ids.length === 0) {
+    failMissingId(command6, "wraps email templates delete <id...> --yes");
+    return;
+  }
+  if (ids.length > DELETE_BULK_MAX) {
+    failValidation(
+      command6,
+      `${ids.length} template ids were given, but one delete accepts at most ${DELETE_BULK_MAX}. Nothing was deleted.`,
+      `Split the ids into batches of ${DELETE_BULK_MAX} or fewer, and run one delete per batch with --yes.`
+    );
+    return;
+  }
+  const [first] = ids;
+  const singleId = ids.length === 1 ? first : void 0;
+  const route = singleId === void 0 ? "bulk" : "single";
+  if (options.dryRun) {
+    printDeleteDryRun(command6, ids, route);
+    return;
+  }
+  if (!options.yes) {
+    fail9(command6, {
+      code: "CONFIRMATION_REQUIRED",
+      message: `Deleting ${ids.length} template(s) removes them and their versions. A published SES copy is removed too, unless another template still uses that name. If any template is still used by a scheduled, queued or processing broadcast, or an enabled workflow, the whole delete is refused. Nothing was deleted.`,
+      suggestion: `Preview with \`wraps email templates delete ${ids.join(" ")} --dry-run\`, then re-run with --yes.`
+    });
+    return;
+  }
+  const target = await connect6(command6, options.token);
+  if (!target) {
+    return;
+  }
+  const resp = await sendDelete(command6, target, ids, singleId);
+  if (!resp) {
+    return;
+  }
+  if (!resp.ok) {
+    fail9(command6, await deleteFailure(resp, singleId));
+    return;
+  }
+  const result = await readDeleteResult(command6, resp, ids, singleId);
+  if (!result) {
+    return;
+  }
+  if (isJsonMode()) {
+    jsonSuccess(command6, {
+      dryRun: false,
+      route,
+      deleted: result.deleted,
+      notFound: result.notFound,
+      count: result.deleted.length
+    });
+    return;
+  }
+  printDeleteResult(route, result);
+}
 async function fetchAllPullRows(command6, target) {
   const rows = [];
   const seenCursors = /* @__PURE__ */ new Set();
@@ -67110,7 +67590,7 @@ init_events();
 init_json_output();
 init_output();
 import { existsSync as existsSync16 } from "fs";
-import { mkdir as mkdir8, readFile as readFile10, writeFile as writeFile13 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile13 } from "fs/promises";
 import { join as join21 } from "path";
 import * as clack50 from "@clack/prompts";
 import pc53 from "picocolors";
@@ -67523,7 +68003,7 @@ async function workflowsInit(options) {
   await mkdir8(workflowsDir, { recursive: true });
   const configPath = join21(cwd, "wraps", "wraps.config.ts");
   if (existsSync16(configPath)) {
-    const configContent = await readFile10(configPath, "utf-8");
+    const configContent = await readFile11(configPath, "utf-8");
     if (!configContent.includes("workflowsDir")) {
       const updated = configContent.replace(
         /}\);(\s*)$/,
@@ -67843,7 +68323,7 @@ function assignPositions(steps, transitions) {
 init_esm_shims();
 import { createHash as createHash6 } from "crypto";
 import { existsSync as existsSync17 } from "fs";
-import { mkdir as mkdir9, readdir as readdir4, readFile as readFile11, writeFile as writeFile14 } from "fs/promises";
+import { mkdir as mkdir9, readdir as readdir4, readFile as readFile12, writeFile as writeFile14 } from "fs/promises";
 import { basename as basename2, join as join23 } from "path";
 async function discoverWorkflows(dir, filter) {
   if (!existsSync17(dir)) {
@@ -67866,7 +68346,7 @@ async function discoverWorkflows(dir, filter) {
 }
 async function parseWorkflowTs(filePath, wrapsDir) {
   const { build: build2 } = await import("esbuild");
-  const source = await readFile11(filePath, "utf-8");
+  const source = await readFile12(filePath, "utf-8");
   const sourceHash = createHash6("sha256").update(source).digest("hex");
   const slug = basename2(filePath, ".ts");
   const shimDir = join23(wrapsDir, ".wraps", "_shims");
@@ -82708,6 +83188,9 @@ function showHelp() {
   console.log(
     `  ${pc87.cyan("email suppressions list")}  List the SES suppression list (--account <awsAccountId>, --reason bounce|complaint, --limit, --cursor). A page can be empty while hasMore is true.`
   );
+  console.log(
+    `  ${pc87.cyan("email suppressions add <email...>")}  Suppress addresses (needs --account, --reason bounce|complaint and --yes; --file for a list; --dry-run previews)`
+  );
   console.log(
     `  ${pc87.cyan("email suppressions remove")}  Remove one address (needs --account and --yes; --dry-run previews; --acknowledge-complaint for complaint suppressions)
 `
@@ -82757,6 +83240,9 @@ function showHelp() {
   console.log(
     `  ${pc87.cyan("email templates duplicate")} <id>  Copy a template as a new draft`
   );
+  console.log(
+    `  ${pc87.cyan("email templates delete")} <id...>  Delete templates (--yes; --dry-run previews; refuses in-use templates)`
+  );
   console.log(
     `  ${pc87.cyan("email templates init")}  Initialize templates-as-code`
   );
@@ -83133,6 +83619,10 @@ var parsedCli = parseCliArgs(process.argv);
 var flags = parsedCli.flags;
 var { sub, extraPositionals } = parsedCli;
 var [primaryCommand, subCommand] = sub;
+var VARIADIC_COMMANDS = /* @__PURE__ */ new Set([
+  "email templates delete",
+  "email suppressions add"
+]);
 setJsonMode(flags.json === true);
 if (!primaryCommand) {
   async function interactiveMenu() {
@@ -83315,7 +83805,7 @@ async function run() {
     telemetry.markNotificationShown();
   }
   try {
-    if (extraPositionals.length > 0) {
+    if (extraPositionals.length > 0 && !VARIADIC_COMMANDS.has(sub.slice(0, 3).join(" "))) {
       throw errors.invalidFlagUsage(
         `Unrecognized argument${extraPositionals.length > 1 ? "s" : ""}: ${extraPositionals.join(" ")}`,
         "A boolean flag (such as --root or --json) takes no value, so a value after it is discarded. Check the flags before these arguments, or run the command with --help."
@@ -83837,6 +84327,16 @@ async function run() {
                 region: flags.region
               });
               break;
+            case "delete":
+              await templatesDelete({
+                ids: sub.slice(3),
+                yes: flags.yes,
+                dryRun: flags.dryRun,
+                json: flags.json,
+                token: flags.token,
+                region: flags.region
+              });
+              break;
             case "preview":
               await templatesPreview({
                 port: flags.port,
@@ -83848,7 +84348,7 @@ async function run() {
               throw errors.unknownCommand(
                 "templates command",
                 templatesSubCommand,
-                "Available commands: init, push, preview, list, get, pull, publish, duplicate"
+                "Available commands: init, push, preview, list, get, pull, publish, duplicate, delete"
               );
           }
           break;
@@ -83935,6 +84435,19 @@ async function run() {
                 region: flags.region
               });
               break;
+            case "add":
+              await suppressionsAdd({
+                emails: sub.slice(3),
+                file: flags.file,
+                account: flags.account,
+                reason: flags.reason,
+                yes: flags.yes,
+                dryRun: flags.dryRun,
+                json: flags.json,
+                token: flags.token,
+                region: flags.region
+              });
+              break;
             case "remove":
               await suppressionsRemove({
                 email: sub[3],
@@ -83951,7 +84464,7 @@ async function run() {
               throw errors.unknownCommand(
                 "suppressions command",
                 suppressionsSubCommand,
-                "Available commands: list, remove <email>"
+                "Available commands: list, add <email...>, remove <email>"
               );
           }
           break;