@wraps.dev/cli 3.5.1 → 3.5.2

package/dist/cli.js

@@ -2651,6 +2651,7 @@ __export(metadata_exports, {
   applyConfigUpdates: () => applyConfigUpdates,
   buildEmailStackConfig: () => buildEmailStackConfig,
   connectionExists: () => connectionExists,
+  createAdoptedConnectionMetadata: () => createAdoptedConnectionMetadata,
   createConnectionMetadata: () => createConnectionMetadata,
   deleteConnectionMetadata: () => deleteConnectionMetadata,
   findConnectionsForAccount: () => findConnectionsForAccount,
@@ -2885,6 +2886,16 @@ function createConnectionMetadata(accountId, region, provider, emailConfig, pres
     }
   };
 }
+function createAdoptedConnectionMetadata(accountId, region, provider) {
+  return {
+    version: "1.0.0",
+    accountId,
+    region,
+    provider,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    services: {}
+  };
+}
 function setConfigValue(config2, key, value) {
   config2[key] = value;
 }
@@ -32445,6 +32456,21 @@ var remediations = {
     id: "aws.env-vars-incomplete",
     level: "informational",
     summary: "AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must both be set, or neither."
+  }),
+  /**
+   * Resources exist in AWS but this machine has no connection record.
+   * `listConnections()` reads only the local ~/.wraps directory — it never
+   * syncs the S3 state bucket that `loadConnectionMetadata()` falls back to —
+   * so this fires for a CloudFormation-first connection AND for a second
+   * machine. `wraps platform connect` adopts the existing deployment: it
+   * registers the connection, repairs the trust policy and writes the local
+   * record, without deploying anything.
+   */
+  adoptConnection: (region) => ({
+    id: "platform.connect.adopt",
+    level: "auto",
+    command: withRegion("wraps platform connect", region),
+    summary: "Register this account and write a local connection record \u2014 adopts the existing AWS resources without deploying anything."
   })
 };
 function formatRemediation(remediation) {
@@ -37357,6 +37383,15 @@ async function wrapsDoctor(options) {
         })
       );
       findings.push(...email.findings);
+      if (email.totalResources > 0 && emailConnections.length === 0) {
+        findings.push({
+          status: "warn",
+          category: "Email",
+          name: "Wraps resources found in AWS, but no connection record on this machine",
+          details: `Found ${email.totalResources} wraps-* resource(s) in ${region}, with no local deployment record for account ${state2.accountId}. CLI commands that resolve connection metadata will not see this deployment.`,
+          remediation: remediations.adoptConnection(region)
+        });
+      }
     } catch (error) {
       findings.push({
         status: "warn",
@@ -56548,22 +56583,47 @@ async function validateAndLoadMetadata(options, progress) {
     optionRegion: options.region,
     label: "connection"
   });
-  const metadata = await loadConnectionMetadata(identity.accountId, region);
+  let metadata = await loadConnectionMetadata(identity.accountId, region);
+  let adopted = false;
   if (!metadata) {
-    progress.stop();
-    log41.error(
-      `No Wraps deployment found for account ${pc47.cyan(identity.accountId)} in region ${pc47.cyan(region)}`
-    );
-    console.log(
-      `
+    if (!isJsonMode()) {
+      progress.stop();
+      log41.warn(
+        `No Wraps deployment found for account ${pc47.cyan(identity.accountId)} in region ${pc47.cyan(region)}`
+      );
+      console.log(
+        `
+This is expected if infrastructure here was deployed another way \u2014 for example, through the dashboard's CloudFormation flow instead of ${pc47.cyan("wraps email init")}.
+`
+      );
+    }
+    const shouldAdopt = options.yes === true || isJsonMode() || await confirm21({
+      message: `Register AWS account ${identity.accountId} with Wraps without deploying new infrastructure?`,
+      initialValue: true
+    });
+    if (isCancel29(shouldAdopt) || !shouldAdopt) {
+      if (!isJsonMode()) {
+        log41.error(
+          `No Wraps deployment found for account ${identity.accountId}.`
+        );
+        console.log(
+          `
 Run ${pc47.cyan("wraps email init")} to deploy infrastructure first.
 `
+        );
+      }
+      process.exit(0);
+    }
+    metadata = createAdoptedConnectionMetadata(
+      identity.accountId,
+      region,
+      "other"
     );
-    process.exit(1);
+    adopted = true;
   }
   const hasEmail = !!metadata.services.email?.config;
   const hasSms = !!metadata.services.sms?.config;
-  if (!(hasEmail || hasSms)) {
+  if (!(adopted || hasEmail || hasSms)) {
     progress.stop();
     log41.error("No services deployed in this region.");
     console.log(
@@ -56573,10 +56633,16 @@ Run ${pc47.cyan("wraps email init")} or ${pc47.cyan("wraps sms init")} first.
     );
     process.exit(1);
   }
-  progress.info(
-    `Found services: ${[hasEmail && "email", hasSms && "sms"].filter(Boolean).join(", ")}`
-  );
-  return { identity, region, metadata };
+  if (adopted) {
+    progress.info(
+      "Adopting existing AWS infrastructure \u2014 no new resources will be deployed."
+    );
+  } else {
+    progress.info(
+      `Found services: ${[hasEmail && "email", hasSms && "sms"].filter(Boolean).join(", ")}`
+    );
+  }
+  return { identity, region, metadata, adopted };
 }
 async function deployEventBridge(metadata, region, identity, webhookSecret, progress, selfhostTarget) {
   if (metadata.provider === "vercel" && !metadata.vercel) {
@@ -56649,17 +56715,20 @@ async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
   }
   const emailConfig = metadata.services.email?.config;
   const smsConfig = metadata.services.sms?.config;
-  const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
+  const hasPolicySource = Boolean(emailConfig || smsConfig);
   if (roleExists2) {
-    await progress.execute("Updating platform access role", async () => {
-      await iam13.send(
-        new PutRolePolicyCommand({
-          RoleName: roleName,
-          PolicyName: "wraps-console-access-policy",
-          PolicyDocument: JSON.stringify(policy, null, 2)
-        })
-      );
-    });
+    if (hasPolicySource) {
+      const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
+      await progress.execute("Updating platform access role", async () => {
+        await iam13.send(
+          new PutRolePolicyCommand({
+            RoleName: roleName,
+            PolicyName: "wraps-console-access-policy",
+            PolicyDocument: JSON.stringify(policy, null, 2)
+          })
+        );
+      });
+    }
     if (externalId) {
       const trustPolicy = {
         Version: "2012-10-17",
@@ -56718,6 +56787,7 @@ async function updatePlatformRole(metadata, progress, externalId, selfhosted) {
           ]
         })
       );
+      const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
       await iam13.send(
         new PutRolePolicyCommand({
           RoleName: roleName,
@@ -56789,10 +56859,7 @@ async function authenticatedConnect(options, saasToken) {
   }
   const progress = new DeploymentProgress();
   try {
-    const { identity, region, metadata } = await validateAndLoadMetadata(
-      options,
-      progress
-    );
+    const { identity, region, metadata, adopted } = await validateAndLoadMetadata(options, progress);
     const selfhostService = metadata.services.selfhost;
     if (selfhosted && selfhostService) {
       await reconcileSelfhostApiUrl(metadata, region);
@@ -56961,7 +57028,7 @@ You can try the manual flow: ${pc47.cyan("wraps auth logout")} then ${pc47.cyan(
       }
     }
     await saveConnectionMetadata(metadata);
-    if (hasEmail) {
+    if (hasEmail && !adopted) {
       await deployEventBridge(
         metadata,
         region,
@@ -56995,9 +57062,25 @@ You can try the manual flow: ${pc47.cyan("wraps auth logout")} then ${pc47.cyan(
         region,
         organizationId: org.id,
         connectionId: result.connectionId,
-        webhookConnected: true,
-        selfhosted
+        webhookConnected: !adopted,
+        selfhosted,
+        adopted
       });
+    } else if (adopted) {
+      outro26(pc47.green("AWS account adopted!"));
+      console.log();
+      console.log(
+        pc47.dim(
+          "Registered this account and repaired the IAM trust policy so the dashboard can reach it."
+        )
+      );
+      console.log(
+        pc47.dim(
+          "No infrastructure was deployed and no event wiring was changed."
+        )
+      );
+      console.log(`  Dashboard: ${pc47.cyan(dashboardUrl)}`);
+      console.log();
     } else {
       outro26(
         pc47.green(