@wraps.dev/cli 3.6.0 → 3.7.0

package/dist/cli.js

@@ -30520,20 +30520,21 @@ async function checkVercelDomain(token, domain, teamId) {
   }
 }
 async function validateCloudflareCredentials(token) {
-  try {
-    const response = await fetch(
-      "https://api.cloudflare.com/client/v4/user/tokens/verify",
-      {
-        headers: {
-          Authorization: `Bearer ${token}`
-        }
-      }
-    );
-    const data = await response.json();
-    return data.success === true;
-  } catch {
-    return false;
+  const probe = async (url) => {
+    try {
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${token}` }
+      });
+      const data = await response.json();
+      return data.success === true;
+    } catch {
+      return false;
+    }
+  };
+  if (await probe("https://api.cloudflare.com/client/v4/user/tokens/verify")) {
+    return true;
   }
+  return probe("https://api.cloudflare.com/client/v4/zones?per_page=1");
 }
 async function findCloudflareZoneId(token, domain) {
   try {
@@ -44911,10 +44912,14 @@ async function putTrackingDomain(sesv22, configSetName, trackingDomain, httpsPol
     new PutConfigurationSetTrackingOptionsCommand({
       ConfigurationSetName: configSetName,
       CustomRedirectDomain: trackingDomain,
-      ...httpsPolicy ? { HttpsPolicy: httpsPolicy } : {}
+      HttpsPolicy: httpsPolicy
     })
   );
 }
+function trackingHttpsPolicy(trackingHttps) {
+  return trackingHttps?.status === "active" ? "REQUIRE" : "OPTIONAL";
+}
+var HTTP_TRACKING_CONSEQUENCE = "Until then, https:// links in your emails will show recipients a certificate warning when clicked.";
 async function clearTrackingDomain(region, configSetName) {
   const ses = new SESClient4({ region });
   await ses.send(
@@ -45206,19 +45211,18 @@ async function provisionTrackingHttps(args) {
   );
   if (cert.status !== "ISSUED") {
     const dnsRecordsToShow = [];
+    let validationRecordPushed = false;
     if (cert.validationRecord) {
       dnsRecordsToShow.push(cert.validationRecord);
       if (metadataDnsProvider && metadataDnsProvider !== "manual") {
-        await progress.execute(
+        validationRecordPushed = await progress.execute(
           "Creating ACM validation DNS record",
-          async () => {
-            await pushValidationRecord(
-              metadataDnsProvider,
-              domain,
-              sesRegion,
-              cert.validationRecord
-            );
-          }
+          async () => pushValidationRecord(
+            metadataDnsProvider,
+            domain,
+            sesRegion,
+            cert.validationRecord
+          )
         );
       }
     }
@@ -45229,7 +45233,8 @@ async function provisionTrackingHttps(args) {
         validationRecord: cert.validationRecord
       },
       cnameTarget: awstrackTarget,
-      dnsRecordsToShow
+      dnsRecordsToShow,
+      validationRecordPushed
     };
   }
   const distribution = await progress.execute(
@@ -45252,7 +45257,8 @@ async function provisionTrackingHttps(args) {
       distributionDomain: distribution.domainName
     },
     cnameTarget: distribution.domainName,
-    dnsRecordsToShow: []
+    dnsRecordsToShow: [],
+    validationRecordPushed: true
   };
 }
 
@@ -45900,7 +45906,12 @@ async function applyTrackingDomain(ctx, value) {
   const host = value.toLowerCase();
   let appliedAt;
   try {
-    await putTrackingDomain(ctx.sesClient, ctx.candidate.configSetName, host);
+    await putTrackingDomain(
+      ctx.sesClient,
+      ctx.candidate.configSetName,
+      host,
+      trackingHttpsPolicy(ctx.candidate.trackingHttps)
+    );
     appliedAt = (/* @__PURE__ */ new Date()).toISOString();
   } catch (error) {
     if (!isTrackingDomainNotReady(error)) {
@@ -45924,6 +45935,7 @@ async function offerTrackingCname(ctx, trackingDomain, cnameTarget, replaceExist
     value: targetValue
   };
   const provider = ctx.metadata.services.email?.dnsProvider;
+  let degradedReason;
   if (provider && provider !== "manual") {
     const parts = ctx.candidate.domain.split(".");
     const rootDomain = parts.length > 2 ? parts.slice(-2).join(".") : ctx.candidate.domain;
@@ -45947,8 +45959,14 @@ async function offerTrackingCname(ctx, trackingDomain, cnameTarget, replaceExist
         );
         return;
       }
+      degradedReason = result.errors?.join("; ") ?? `${getDNSProviderDisplayName(provider)} created no record`;
+    } else {
+      degradedReason = cred.error ?? `${getDNSProviderDisplayName(provider)} credentials`;
     }
   }
+  if (degradedReason) {
+    clack24.log.warn(`Could not update DNS automatically: ${degradedReason}`);
+  }
   clack24.log.info(
     `Add this DNS record:
   ${pc26.cyan(record.name)}
@@ -46010,7 +46028,30 @@ async function applyTrackingHttps(ctx, enable) {
   if (result.trackingHttps.status === "active" && !wasActive) {
     await offerTrackingCname(ctx, trackingDomain, result.cnameTarget, true);
   }
-  return { pendingValidationRecord: result.dnsRecordsToShow[0] };
+  return {
+    pendingValidationRecord: result.dnsRecordsToShow[0],
+    validationRecordPushed: result.validationRecordPushed
+  };
+}
+function reportTrackingHttpsEnabled(candidate, httpsResult, reopenHint) {
+  if (candidate.trackingHttps?.status === "active") {
+    clack24.log.success(
+      `HTTPS active (${candidate.trackingHttps.distributionDomain})`
+    );
+    return;
+  }
+  clack24.log.info(
+    pc26.dim(
+      `Certificate validation usually takes 5\u201330 minutes. ${reopenHint} ${HTTP_TRACKING_CONSEQUENCE}`
+    )
+  );
+  if (httpsResult.pendingValidationRecord) {
+    clack24.log.info(
+      `${httpsResult.validationRecordPushed ? "Certificate validation record (created for you):" : "Add this DNS record to validate the certificate:"}
+  ${pc26.cyan(httpsResult.pendingValidationRecord.name)}
+    Type: ${httpsResult.pendingValidationRecord.type}  Value: ${httpsResult.pendingValidationRecord.value}`
+    );
+  }
 }
 async function applyFlagMode(args) {
   const {
@@ -46142,6 +46183,25 @@ async function applyFlagMode(args) {
     } else {
       clack24.log.success(`Tracking domain set to ${trackingDomainFlag}`);
       await offerTrackingCname(ctx, trackingDomainFlag.toLowerCase());
+      if (trackingHttpsFlag === void 0) {
+        try {
+          const httpsResult = await applyTrackingHttps(ctx, true);
+          reportTrackingHttpsEnabled(
+            candidate,
+            httpsResult,
+            `Re-run ${pc26.cyan(`wraps email domains config --domain ${candidate.domain} --tracking-https`)} once it's ISSUED.`
+          );
+        } catch (error) {
+          clack24.log.warn(
+            `Could not enable HTTPS for tracking links: ${describeTrackingHttpsError(error)}`
+          );
+          clack24.log.info(
+            pc26.dim(
+              `Retry later with: ${pc26.cyan(`wraps email domains config --domain ${candidate.domain} --tracking-https`)}. ${HTTP_TRACKING_CONSEQUENCE}`
+            )
+          );
+        }
+      }
     }
     trackCommand("email:domains:config", {
       success: true,
@@ -46183,7 +46243,7 @@ async function applyFlagMode(args) {
         );
         if (httpsResult.pendingValidationRecord) {
           clack24.log.info(
-            `Add this DNS record to validate the certificate:
+            `${httpsResult.validationRecordPushed ? "Certificate validation record (created for you):" : "Add this DNS record to validate the certificate:"}
   ${pc26.cyan(httpsResult.pendingValidationRecord.name)}
     Type: ${httpsResult.pendingValidationRecord.type}  Value: ${httpsResult.pendingValidationRecord.value}`
           );
@@ -46381,24 +46441,11 @@ async function applyInteractiveMode(args) {
           }
           httpsProgress.stop();
           if (enabling) {
-            if (candidate.trackingHttps?.status === "active") {
-              clack24.log.success(
-                `HTTPS active (${candidate.trackingHttps.distributionDomain})`
-              );
-            } else {
-              clack24.log.info(
-                pc26.dim(
-                  "Certificate validation usually takes 5\u201330 minutes. Reopen this menu once it's ISSUED."
-                )
-              );
-              if (httpsResult.pendingValidationRecord) {
-                clack24.log.info(
-                  `Add this DNS record to validate the certificate:
-  ${pc26.cyan(httpsResult.pendingValidationRecord.name)}
-    Type: ${httpsResult.pendingValidationRecord.type}  Value: ${httpsResult.pendingValidationRecord.value}`
-                );
-              }
-            }
+            reportTrackingHttpsEnabled(
+              candidate,
+              httpsResult,
+              "Reopen this menu once it's ISSUED."
+            );
           } else {
             clack24.log.success("HTTPS disabled for tracking links");
           }
@@ -46429,6 +46476,34 @@ async function applyInteractiveMode(args) {
           `Tracking domain set to ${value.toLowerCase()}`
         );
         await offerTrackingCname(ctx, value.toLowerCase());
+        if (!candidate.trackingHttps) {
+          const wantsHttps = await clack24.confirm({
+            message: `Enable HTTPS for tracking links? ${pc26.dim("(creates a CloudFront distribution + certificate in your account)")}`,
+            initialValue: true
+          });
+          if (!clack24.isCancel(wantsHttps) && wantsHttps) {
+            const setupHttpsProgress = new DeploymentProgress();
+            try {
+              const httpsResult = await setupHttpsProgress.execute(
+                "Enabling HTTPS",
+                async () => applyTrackingHttps(ctx, true)
+              );
+              setupHttpsProgress.stop();
+              reportTrackingHttpsEnabled(
+                candidate,
+                httpsResult,
+                "Reopen this menu once it's ISSUED."
+              );
+            } catch (error) {
+              setupHttpsProgress.stop();
+              if (error instanceof WrapsError) {
+                clack24.log.error(error.message);
+              } else {
+                throw error;
+              }
+            }
+          }
+        }
         break;
       }
       case "delivery": {
@@ -46862,7 +46937,8 @@ async function verifyDomain(options) {
         await putTrackingDomain(
           sesClient,
           targetConfigSetName,
-          trackedEntry.trackingDomain
+          trackedEntry.trackingDomain,
+          trackingHttpsPolicy(trackedEntry.trackingHttps)
         );
         trackedEntry.trackingDomainAppliedAt = (/* @__PURE__ */ new Date()).toISOString();
         addDomainToMetadata(metadata, trackedEntry);
@@ -47251,7 +47327,12 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
     if (trackingDomain) {
       await progress.execute("Setting custom tracking domain", async () => {
         try {
-          await putTrackingDomain(sesClient, configSetName, trackingDomain);
+          await putTrackingDomain(
+            sesClient,
+            configSetName,
+            trackingDomain,
+            "OPTIONAL"
+          );
           trackingDomainAppliedAt = (/* @__PURE__ */ new Date()).toISOString();
         } catch (error) {
           if (!isTrackingDomainNotReady(error)) throw error;
@@ -47305,7 +47386,7 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
             );
             clack25.log.info(
               pc27.dim(
-                `Retry later with: ${pc27.cyan(`wraps email domains config --domain ${domain} --tracking-https`)}`
+                `Retry later with: ${pc27.cyan(`wraps email domains config --domain ${domain} --tracking-https`)}. ${HTTP_TRACKING_CONSEQUENCE}`
               )
             );
           }
@@ -47313,7 +47394,7 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
         if (trackingHttpsResult?.trackingHttps.status === "pending" && !isJsonMode()) {
           clack25.log.info(
             pc27.dim(
-              `Certificate validation usually takes 5\u201330 minutes. Then run: ${pc27.cyan(`wraps email domains config --domain ${domain} --tracking-https`)}`
+              `Certificate validation usually takes 5\u201330 minutes. Then run: ${pc27.cyan(`wraps email domains config --domain ${domain} --tracking-https`)}. ${HTTP_TRACKING_CONSEQUENCE}`
             )
           );
         }
@@ -47396,7 +47477,9 @@ Run ${pc27.cyan("wraps email init")} first to deploy email infrastructure.
       progress.stop();
       console.log();
       clack25.log.info(
-        pc27.bold("Add this DNS record to validate the certificate:")
+        pc27.bold(
+          trackingHttpsResult.validationRecordPushed ? "Certificate validation record (created for you):" : "Add this DNS record to validate the certificate:"
+        )
       );
       console.log();
       for (const record of trackingHttpsResult.dnsRecordsToShow) {
@@ -47498,6 +47581,7 @@ async function listDomains() {
       (identity) => identity.IdentityType === "DOMAIN" || identity.IdentityName && !identity.IdentityName.includes("@")
     );
     let trackedDomains = [];
+    let trackingHttpsByDomain = /* @__PURE__ */ new Map();
     try {
       const awsIdentity = await validateAWSCredentials();
       const metadata = await loadConnectionMetadata(
@@ -47506,6 +47590,15 @@ async function listDomains() {
       );
       if (metadata) {
         trackedDomains = getAllTrackedDomains(metadata);
+        const emailConfig = metadata.services.email?.config;
+        trackingHttpsByDomain = new Map(
+          (emailConfig?.additionalDomains ?? []).map(
+            (d6) => [d6.domain, d6.trackingHttps]
+          )
+        );
+        if (emailConfig?.domain && emailConfig.tracking?.httpsEnabled) {
+          trackingHttpsByDomain.set(emailConfig.domain, { status: "active" });
+        }
       }
     } catch {
     }
@@ -47560,7 +47653,8 @@ Run ${pc27.cyan("wraps email domains add")} to add a domain.
             managed: !!tracked,
             isPrimary: tracked?.isPrimary ?? false,
             purpose: tracked?.purpose,
-            trackingDomain: tracked?.trackingDomain ?? null
+            trackingDomain: tracked?.trackingDomain ?? null,
+            trackingHttps: trackingHttpsByDomain.get(d6.name)?.status ?? null
           };
         }),
         totalCount: sesDomains.length,
@@ -47574,7 +47668,7 @@ Run ${pc27.cyan("wraps email domains add")} to add a domain.
         const statusIcon = d6.verified ? pc27.green("\u2713") : pc27.yellow("\u23F1");
         const dkimIcon = d6.dkimStatus === "SUCCESS" ? pc27.green("\u2713 SUCCESS") : pc27.yellow(`\u23F1 ${d6.dkimStatus}`);
         const label = tracked.isPrimary ? pc27.dim("Primary") : pc27.dim(PURPOSE_LABELS[tracked.purpose || "other"] || "General");
-        const trackingSuffix = tracked.trackingDomain ? ` ${pc27.dim("\u2192")} ${tracked.trackingDomain}` : "";
+        const trackingSuffix = tracked.trackingDomain ? ` ${pc27.dim("\u2192")} ${tracked.trackingDomain} ${trackingHttpsByDomain.get(d6.name)?.status === "active" ? pc27.dim("(https)") : pc27.yellow("(http)")}` : "";
         return `  ${statusIcon} ${pc27.bold(d6.name.padEnd(30))} ${label.padEnd(24)} DKIM: ${dkimIcon}${trackingSuffix}`;
       });
       clack25.note(managedLines.join("\n"), "Managed by Wraps");
@@ -68331,50 +68425,90 @@ function showHelp() {
   );
   console.log("Email Commands:");
   console.log(
-    `  ${pc72.cyan("email init")}           Deploy new email infrastructure`
+    `  ${pc72.cyan("email init")}              Deploy new email infrastructure`
+  );
+  console.log(
+    `  ${pc72.cyan("email check")}             Check email deliverability for a domain`
   );
   console.log(
-    `  ${pc72.cyan("email check")}          Check email deliverability for a domain`
+    `  ${pc72.cyan("email connect")}           Connect to existing AWS SES`
   );
   console.log(
-    `  ${pc72.cyan("email connect")}        Connect to existing AWS SES`
+    `  ${pc72.cyan("email status")}            Show email infrastructure details`
   );
   console.log(
-    `  ${pc72.cyan("email status")}         Show email infrastructure details`
+    `  ${pc72.cyan("email plan")}              Show SES pricing plan and cheaper options`
   );
+  console.log(`  ${pc72.cyan("email test")}              Send a test email`);
   console.log(
-    `  ${pc72.cyan("email plan")}           Show SES pricing plan and cheaper options`
+    `  ${pc72.cyan("email verify")}            Verify domain DNS records`
   );
-  console.log(`  ${pc72.cyan("email test")}           Send a test email`);
-  console.log(`  ${pc72.cyan("email verify")}         Verify domain DNS records`);
   console.log(
-    `  ${pc72.cyan("email sync")}           Apply CLI updates to infrastructure`
+    `  ${pc72.cyan("email sync")}              Apply CLI updates to infrastructure`
   );
-  console.log(`  ${pc72.cyan("email upgrade")}        Add features`);
+  console.log(`  ${pc72.cyan("email upgrade")}           Add features`);
   console.log(
-    `  ${pc72.cyan("email restore")}        Restore original configuration`
+    `  ${pc72.cyan("email restore")}           Restore original configuration`
   );
   console.log(
-    `  ${pc72.cyan("email destroy")}        Remove email infrastructure`
+    `  ${pc72.cyan("email destroy")}           Remove email infrastructure`
   );
   console.log(
-    `  ${pc72.cyan("email doctor")}         Diagnose and clean up email infrastructure`
+    `  ${pc72.cyan("email doctor")}            Diagnose and clean up email infrastructure`
   );
-  console.log(`  ${pc72.cyan("email domains add")}    Add a domain to SES`);
-  console.log(`  ${pc72.cyan("email domains list")}   List all domains`);
-  console.log(`  ${pc72.cyan("email domains remove")} Remove a domain`);
+  console.log(`  ${pc72.cyan("email domains add")}       Add a domain to SES`);
+  console.log(`  ${pc72.cyan("email domains list")}      List all domains`);
+  console.log(`  ${pc72.cyan("email domains remove")}    Remove a domain`);
   console.log(
-    `  ${pc72.cyan("email inbound init")}   Enable inbound email receiving`
+    `  ${pc72.cyan("email domains verify")}    Check domain verification status`
   );
-  console.log(`  ${pc72.cyan("email inbound status")} Show inbound email status`);
   console.log(
-    `  ${pc72.cyan("email inbound verify")} Verify inbound DNS records`
+    `  ${pc72.cyan("email domains get-dkim")}  Show DKIM tokens for a domain`
   );
   console.log(
-    `  ${pc72.cyan("email inbound test")}   Send test email and verify receipt`
+    `  ${pc72.cyan("email domains config")}    Configure domain tracking, TLS, and archiving`
   );
   console.log(
-    `  ${pc72.cyan("email inbound destroy")} Remove inbound email infrastructure
+    `  ${pc72.cyan("email inbound init")}      Enable inbound email receiving`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound status")}    Show inbound email status`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound verify")}    Verify inbound DNS records`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound test")}      Send test email and verify receipt`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound add")}       Add an inbound receiving domain`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound remove")}    Remove an inbound receiving domain`
+  );
+  console.log(
+    `  ${pc72.cyan("email inbound destroy")}   Remove inbound email infrastructure`
+  );
+  console.log(
+    `  ${pc72.cyan("email reply init")}        Set up signed reply-to threading`
+  );
+  console.log(
+    `  ${pc72.cyan("email reply rotate")}      Rotate the reply-threading signing secret`
+  );
+  console.log(
+    `  ${pc72.cyan("email reply status")}      Show reply-threading status`
+  );
+  console.log(
+    `  ${pc72.cyan("email reply destroy")}     Remove reply-threading infrastructure`
+  );
+  console.log(
+    `  ${pc72.cyan("email reply decode")}      Decode a reply-to address`
+  );
+  console.log(
+    `  ${pc72.cyan("email logs list")}         List recent email sends`
+  );
+  console.log(
+    `  ${pc72.cyan("email logs get")}          Show details for one message
 `
   );
   console.log("Agent Commands:");
@@ -68408,7 +68542,10 @@ function showHelp() {
     `  ${pc72.cyan("email workflows validate")}  Validate workflow files`
   );
   console.log(
-    `  ${pc72.cyan("email workflows push")}      Push workflows to dashboard
+    `  ${pc72.cyan("email workflows push")}      Push workflows to dashboard`
+  );
+  console.log(
+    `  ${pc72.cyan("workflow init")}             Scaffold a cross-channel workflow (email \u2192 SMS)
 `
   );
   console.log("SMS Commands:");