@wraps.dev/cli 3.8.0 → 3.9.1

package/dist/cli.js

@@ -37233,7 +37233,6 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
   const smsConfig = metadata.services.sms?.config;
   const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
   const sendingEnabled = !emailConfig || emailConfig.sendingEnabled !== false;
-  const eventTracking = emailConfig?.eventTracking;
   const emailArchiving = emailConfig?.emailArchiving;
   const smsEnabled = !!smsConfig;
   const smsSendingEnabled = smsConfig && smsConfig.sendingEnabled !== false;
@@ -37347,9 +37346,6 @@ ${pc17.bold("Permissions:")}`);
   console.log(
     `  ${pc17.green("\u2713")} DynamoDB read access (including DescribeTable)`
   );
-  if (eventTracking?.enabled) {
-    console.log(`  ${pc17.green("\u2713")} EventBridge and SQS access`);
-  }
   if (emailArchiving?.enabled) {
     console.log(`  ${pc17.green("\u2713")} Mail Manager Archive access`);
   }
@@ -37392,6 +37388,11 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       // SES v2 API for listing/getting email identities (domains)
       "ses:ListEmailIdentities",
       "ses:GetEmailIdentity",
+      // Write, deliberately. verifyOwnEmailIdentity in
+      // apps/web/src/actions/ses-onboarding.ts creates the operator's own
+      // address as an SES identity so a sandboxed account can complete a
+      // real first send. This is the ONLY identity write the role grants.
+      "ses:CreateEmailIdentity",
       // SES v2 API for configuration set scanning (needed by dashboard).
       // List is what makes Get reachable — Get takes a name only List can find.
       "ses:ListConfigurationSets",
@@ -37406,7 +37407,7 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
   });
   statements.push({
     Effect: "Allow",
-    Action: ["s3:HeadBucket"],
+    Action: ["s3:ListBucket"],
     Resource: "arn:aws:s3:::wraps-inbound-*"
   });
   statements.push({
@@ -37442,6 +37443,18 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       Resource: "*"
     });
   }
+  const suppressionList = emailConfig?.suppressionList;
+  if (suppressionList?.enabled !== false) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "ses:ListSuppressedDestinations",
+        "ses:GetSuppressedDestination",
+        "ses:DeleteSuppressedDestination"
+      ],
+      Resource: "*"
+    });
+  }
   statements.push({
     Effect: "Allow",
     Action: [
@@ -37456,26 +37469,6 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       "arn:aws:dynamodb:*:*:table/wraps-email-*/index/*"
     ]
   });
-  const eventTracking = emailConfig?.eventTracking;
-  if (eventTracking?.enabled) {
-    statements.push({
-      Effect: "Allow",
-      Action: ["events:PutEvents", "events:DescribeEventBus"],
-      Resource: "arn:aws:events:*:*:event-bus/wraps-email-*"
-    });
-  }
-  if (eventTracking?.enabled) {
-    statements.push({
-      Effect: "Allow",
-      Action: [
-        "sqs:SendMessage",
-        "sqs:ReceiveMessage",
-        "sqs:DeleteMessage",
-        "sqs:GetQueueAttributes"
-      ],
-      Resource: "arn:aws:sqs:*:*:wraps-email-*"
-    });
-  }
   const emailArchiving = emailConfig?.emailArchiving;
   if (emailArchiving?.enabled) {
     statements.push({
@@ -37497,12 +37490,7 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
   if (inbound?.enabled) {
     statements.push({
       Effect: "Allow",
-      Action: [
-        "s3:HeadBucket",
-        "s3:ListBucket",
-        "s3:GetObject",
-        "s3:GetObjectTagging"
-      ],
+      Action: ["s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"],
       Resource: [
         "arn:aws:s3:::wraps-inbound-*",
         "arn:aws:s3:::wraps-inbound-*/*"