@wraps.dev/cli 3.8.0 → 3.9.0

package/dist/cli.js

@@ -37392,6 +37392,11 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       // SES v2 API for listing/getting email identities (domains)
       "ses:ListEmailIdentities",
       "ses:GetEmailIdentity",
+      // Write, deliberately. verifyOwnEmailIdentity in
+      // apps/web/src/actions/ses-onboarding.ts creates the operator's own
+      // address as an SES identity so a sandboxed account can complete a
+      // real first send. This is the ONLY identity write the role grants.
+      "ses:CreateEmailIdentity",
       // SES v2 API for configuration set scanning (needed by dashboard).
       // List is what makes Get reachable — Get takes a name only List can find.
       "ses:ListConfigurationSets",
@@ -37442,6 +37447,18 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       Resource: "*"
     });
   }
+  const suppressionList = emailConfig?.suppressionList;
+  if (suppressionList?.enabled !== false) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "ses:ListSuppressedDestinations",
+        "ses:GetSuppressedDestination",
+        "ses:DeleteSuppressedDestination"
+      ],
+      Resource: "*"
+    });
+  }
   statements.push({
     Effect: "Allow",
     Action: [