@wraps.dev/cli 3.9.1 → 3.10.0

package/dist/cli.js

@@ -30451,17 +30451,31 @@ async function attachConsoleRoleInvoke(config2) {
     }
     new aws22.iam.RolePolicy(target.logicalName, {
       role: target.roleName,
-      policy: config2.enforcerArn.apply(
-        (arn) => JSON.stringify({
-          Version: "2012-10-17",
-          Statement: [
-            {
-              Effect: "Allow",
-              Action: "lambda:InvokeFunction",
-              Resource: arn
-            }
-          ]
-        })
+      policy: config2.policyTableArn.apply(
+        (tableArn) => config2.enforcerArn.apply(
+          (enforcerArn) => JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Action: "lambda:InvokeFunction",
+                Resource: enforcerArn
+              },
+              {
+                // syncAgentPolicy() assumes this role and writes the
+                // CONFIG#<agentId> item the enforcer reads to identify an
+                // agent. Without it every send returns "unknown agent" — the
+                // agent is created but permanently unusable.
+                // PutItem is the ONLY DynamoDB action the API performs against
+                // the customer account; policy edits and kills are full-item
+                // Puts through the same path.
+                Effect: "Allow",
+                Action: "dynamodb:PutItem",
+                Resource: tableArn
+              }
+            ]
+          })
+        )
       )
     });
     granted += 1;
@@ -39677,7 +39691,8 @@ async function deployEmailStack(config2) {
     });
     const { createAgentUser: createAgentUser2, attachConsoleRoleInvoke: attachConsoleRoleInvoke2 } = await Promise.resolve().then(() => (init_iam_agent_user(), iam_agent_user_exports));
     await attachConsoleRoleInvoke2({
-      enforcerArn: enforcer.lambdaFunction.arn
+      enforcerArn: enforcer.lambdaFunction.arn,
+      policyTableArn: policyTable.arn
     });
     agentCredentials = {};
     agentAliasArns = {};
@@ -40202,7 +40217,7 @@ ${suggestion}
     metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
     await saveConnectionMetadata(metadata);
   });
-  await progress.execute("Syncing agent policy", async () => {
+  const sync = await progress.execute("Syncing agent policy", async () => {
     const resp = await api.post(`/v1/agents/${created.id}/policy-sync`, {
       credentialUserArn: creds.userArn,
       enforcerFunctionArn,
@@ -40211,7 +40226,9 @@ ${suggestion}
     if (!resp.ok) {
       throw new Error(await parseAgentApiError(resp));
     }
+    return await resp.json();
   });
+  const syncFailed = sync.syncStatus === "failed";
   if (isJsonMode()) {
     jsonSuccess("email.agent.create", {
       id: created.id,
@@ -40226,13 +40243,23 @@ ${suggestion}
       policyTableName: outputs.agentPolicyTableName ?? null,
       accessKeyId: creds.accessKeyId,
       secretAccessKey: creds.secretAccessKey,
-      userArn: creds.userArn
+      userArn: creds.userArn,
+      // The command DID create the agent and mint a real credential even when
+      // the sync failed — jsonSuccess (not jsonError) is deliberate here so
+      // the credential doesn't have to be smuggled through an error payload a
+      // scripted caller isn't looking at. syncStatus is the field to branch on.
+      syncStatus: sync.syncStatus ?? "unknown",
+      warning: sync.warning ?? null
     });
     return;
   }
   progress.stop();
   console.log();
-  clack18.log.success(pc20.bold(`Agent "${name}" is ready.`));
+  if (syncFailed) {
+    clack18.log.warn(pc20.bold(`Agent "${name}" was created but CANNOT send yet.`));
+  } else {
+    clack18.log.success(pc20.bold(`Agent "${name}" is ready.`));
+  }
   console.log();
   console.log(`  ${pc20.dim("Address:")}     ${pc20.cyan(emailAddress)}`);
   console.log(`  ${pc20.dim("Agent ID:")}    ${pc20.cyan(created.id)}`);
@@ -40247,14 +40274,25 @@ ${suggestion}
   ].join("\n");
   clack18.note(mcpEnv, "MCP env \u2014 save now, the secret is shown only once");
   console.log();
-  console.log(pc20.bold("Next steps:"));
-  console.log(
-    `  1. Add the env above to your agent's ${pc20.cyan("@wraps.dev/mcp")} config`
-  );
-  console.log(
-    `  2. Review pending sends: ${pc20.cyan("wraps email agent list")}`
-  );
-  console.log();
+  if (syncFailed) {
+    console.log(pc20.bold("This agent cannot send until the sync succeeds:"));
+    if (sync.warning) {
+      console.log(`  ${pc20.yellow(sync.warning)}`);
+    }
+    console.log(
+      `  Still failing after that? Reach us: ${pc20.cyan("wraps support")}`
+    );
+    console.log();
+  } else {
+    console.log(pc20.bold("Next steps:"));
+    console.log(
+      `  1. Add the env above to your agent's ${pc20.cyan("@wraps.dev/mcp")} config`
+    );
+    console.log(
+      `  2. Review pending sends: ${pc20.cyan("wraps email agent list")}`
+    );
+    console.log();
+  }
 }
 async function agentList(options) {
   const api = await createAgentApiClient(options.token);