@wraps.dev/cli 3.9.0 → 3.10.0

package/dist/cli.js

@@ -30451,17 +30451,31 @@ async function attachConsoleRoleInvoke(config2) {
     }
     new aws22.iam.RolePolicy(target.logicalName, {
       role: target.roleName,
-      policy: config2.enforcerArn.apply(
-        (arn) => JSON.stringify({
-          Version: "2012-10-17",
-          Statement: [
-            {
-              Effect: "Allow",
-              Action: "lambda:InvokeFunction",
-              Resource: arn
-            }
-          ]
-        })
+      policy: config2.policyTableArn.apply(
+        (tableArn) => config2.enforcerArn.apply(
+          (enforcerArn) => JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Action: "lambda:InvokeFunction",
+                Resource: enforcerArn
+              },
+              {
+                // syncAgentPolicy() assumes this role and writes the
+                // CONFIG#<agentId> item the enforcer reads to identify an
+                // agent. Without it every send returns "unknown agent" — the
+                // agent is created but permanently unusable.
+                // PutItem is the ONLY DynamoDB action the API performs against
+                // the customer account; policy edits and kills are full-item
+                // Puts through the same path.
+                Effect: "Allow",
+                Action: "dynamodb:PutItem",
+                Resource: tableArn
+              }
+            ]
+          })
+        )
       )
     });
     granted += 1;
@@ -37233,7 +37247,6 @@ Run ${pc17.cyan("wraps email init")} to deploy infrastructure first.
   const smsConfig = metadata.services.sms?.config;
   const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
   const sendingEnabled = !emailConfig || emailConfig.sendingEnabled !== false;
-  const eventTracking = emailConfig?.eventTracking;
   const emailArchiving = emailConfig?.emailArchiving;
   const smsEnabled = !!smsConfig;
   const smsSendingEnabled = smsConfig && smsConfig.sendingEnabled !== false;
@@ -37347,9 +37360,6 @@ ${pc17.bold("Permissions:")}`);
   console.log(
     `  ${pc17.green("\u2713")} DynamoDB read access (including DescribeTable)`
   );
-  if (eventTracking?.enabled) {
-    console.log(`  ${pc17.green("\u2713")} EventBridge and SQS access`);
-  }
   if (emailArchiving?.enabled) {
     console.log(`  ${pc17.green("\u2713")} Mail Manager Archive access`);
   }
@@ -37411,7 +37421,7 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
   });
   statements.push({
     Effect: "Allow",
-    Action: ["s3:HeadBucket"],
+    Action: ["s3:ListBucket"],
     Resource: "arn:aws:s3:::wraps-inbound-*"
   });
   statements.push({
@@ -37473,26 +37483,6 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
       "arn:aws:dynamodb:*:*:table/wraps-email-*/index/*"
     ]
   });
-  const eventTracking = emailConfig?.eventTracking;
-  if (eventTracking?.enabled) {
-    statements.push({
-      Effect: "Allow",
-      Action: ["events:PutEvents", "events:DescribeEventBus"],
-      Resource: "arn:aws:events:*:*:event-bus/wraps-email-*"
-    });
-  }
-  if (eventTracking?.enabled) {
-    statements.push({
-      Effect: "Allow",
-      Action: [
-        "sqs:SendMessage",
-        "sqs:ReceiveMessage",
-        "sqs:DeleteMessage",
-        "sqs:GetQueueAttributes"
-      ],
-      Resource: "arn:aws:sqs:*:*:wraps-email-*"
-    });
-  }
   const emailArchiving = emailConfig?.emailArchiving;
   if (emailArchiving?.enabled) {
     statements.push({
@@ -37514,12 +37504,7 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
   if (inbound?.enabled) {
     statements.push({
       Effect: "Allow",
-      Action: [
-        "s3:HeadBucket",
-        "s3:ListBucket",
-        "s3:GetObject",
-        "s3:GetObjectTagging"
-      ],
+      Action: ["s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"],
       Resource: [
         "arn:aws:s3:::wraps-inbound-*",
         "arn:aws:s3:::wraps-inbound-*/*"
@@ -39706,7 +39691,8 @@ async function deployEmailStack(config2) {
     });
     const { createAgentUser: createAgentUser2, attachConsoleRoleInvoke: attachConsoleRoleInvoke2 } = await Promise.resolve().then(() => (init_iam_agent_user(), iam_agent_user_exports));
     await attachConsoleRoleInvoke2({
-      enforcerArn: enforcer.lambdaFunction.arn
+      enforcerArn: enforcer.lambdaFunction.arn,
+      policyTableArn: policyTable.arn
     });
     agentCredentials = {};
     agentAliasArns = {};
@@ -40231,7 +40217,7 @@ ${suggestion}
     metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
     await saveConnectionMetadata(metadata);
   });
-  await progress.execute("Syncing agent policy", async () => {
+  const sync = await progress.execute("Syncing agent policy", async () => {
     const resp = await api.post(`/v1/agents/${created.id}/policy-sync`, {
       credentialUserArn: creds.userArn,
       enforcerFunctionArn,
@@ -40240,7 +40226,9 @@ ${suggestion}
     if (!resp.ok) {
       throw new Error(await parseAgentApiError(resp));
     }
+    return await resp.json();
   });
+  const syncFailed = sync.syncStatus === "failed";
   if (isJsonMode()) {
     jsonSuccess("email.agent.create", {
       id: created.id,
@@ -40255,13 +40243,23 @@ ${suggestion}
       policyTableName: outputs.agentPolicyTableName ?? null,
       accessKeyId: creds.accessKeyId,
       secretAccessKey: creds.secretAccessKey,
-      userArn: creds.userArn
+      userArn: creds.userArn,
+      // The command DID create the agent and mint a real credential even when
+      // the sync failed — jsonSuccess (not jsonError) is deliberate here so
+      // the credential doesn't have to be smuggled through an error payload a
+      // scripted caller isn't looking at. syncStatus is the field to branch on.
+      syncStatus: sync.syncStatus ?? "unknown",
+      warning: sync.warning ?? null
     });
     return;
   }
   progress.stop();
   console.log();
-  clack18.log.success(pc20.bold(`Agent "${name}" is ready.`));
+  if (syncFailed) {
+    clack18.log.warn(pc20.bold(`Agent "${name}" was created but CANNOT send yet.`));
+  } else {
+    clack18.log.success(pc20.bold(`Agent "${name}" is ready.`));
+  }
   console.log();
   console.log(`  ${pc20.dim("Address:")}     ${pc20.cyan(emailAddress)}`);
   console.log(`  ${pc20.dim("Agent ID:")}    ${pc20.cyan(created.id)}`);
@@ -40276,14 +40274,25 @@ ${suggestion}
   ].join("\n");
   clack18.note(mcpEnv, "MCP env \u2014 save now, the secret is shown only once");
   console.log();
-  console.log(pc20.bold("Next steps:"));
-  console.log(
-    `  1. Add the env above to your agent's ${pc20.cyan("@wraps.dev/mcp")} config`
-  );
-  console.log(
-    `  2. Review pending sends: ${pc20.cyan("wraps email agent list")}`
-  );
-  console.log();
+  if (syncFailed) {
+    console.log(pc20.bold("This agent cannot send until the sync succeeds:"));
+    if (sync.warning) {
+      console.log(`  ${pc20.yellow(sync.warning)}`);
+    }
+    console.log(
+      `  Still failing after that? Reach us: ${pc20.cyan("wraps support")}`
+    );
+    console.log();
+  } else {
+    console.log(pc20.bold("Next steps:"));
+    console.log(
+      `  1. Add the env above to your agent's ${pc20.cyan("@wraps.dev/mcp")} config`
+    );
+    console.log(
+      `  2. Review pending sends: ${pc20.cyan("wraps email agent list")}`
+    );
+    console.log();
+  }
 }
 async function agentList(options) {
   const api = await createAgentApiClient(options.token);