@wraps.dev/cli 0.1.4 → 0.2.0

package/dist/cli.js

@@ -1285,7 +1285,7 @@ async function findHostedZone(domain, region) {
     return null;
   }
 }
-async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain) {
+async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
   const client = new Route53Client({ region });
   const changes = [];
   for (const token of dkimTokens) {
@@ -1330,6 +1330,28 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       }
     });
   }
+  if (mailFromDomain) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "MX",
+        TTL: 1800,
+        ResourceRecords: [
+          { Value: `10 feedback-smtp.${region}.amazonses.com` }
+        ]
+      }
+    });
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "TXT",
+        TTL: 1800,
+        ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
+      }
+    });
+  }
   await client.send(
     new ChangeResourceRecordSetsCommand({
       HostedZoneId: hostedZoneId,
@@ -1348,9 +1370,12 @@ var init_route53 = __esm({
 
 // src/cli.ts
 init_esm_shims();
-import * as clack12 from "@clack/prompts";
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import * as clack13 from "@clack/prompts";
 import args from "args";
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 
 // src/commands/connect.ts
 init_esm_shims();
@@ -1775,6 +1800,7 @@ async function createSESResources(config) {
   });
   let domainIdentity;
   let dkimTokens;
+  let mailFromDomain;
   if (config.domain) {
     domainIdentity = new aws5.sesv2.EmailIdentity("wraps-email-domain", {
       emailIdentity: config.domain,
@@ -1790,6 +1816,20 @@ async function createSESResources(config) {
     dkimTokens = domainIdentity.dkimSigningAttributes.apply(
       (attrs) => attrs?.tokens || []
     );
+    mailFromDomain = config.mailFromDomain || `mail.${config.domain}`;
+    new aws5.sesv2.EmailIdentityMailFromAttributes(
+      "wraps-email-mail-from",
+      {
+        emailIdentity: config.domain,
+        mailFromDomain,
+        behaviorOnMxFailure: "USE_DEFAULT_VALUE"
+        // Fallback to amazonses.com if MX record fails
+      },
+      {
+        dependsOn: [domainIdentity]
+        // Ensure domain identity exists first
+      }
+    );
   }
   return {
     configSet,
@@ -1799,7 +1839,8 @@ async function createSESResources(config) {
     dkimTokens,
     dnsAutoCreated: false,
     // Will be set after deployment
-    customTrackingDomain: config.trackingConfig?.customRedirectDomain
+    customTrackingDomain: config.trackingConfig?.customRedirectDomain,
+    mailFromDomain
   };
 }
 
@@ -1884,6 +1925,7 @@ async function deployEmailStack(config) {
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
     sesResources = await createSESResources({
       domain: emailConfig.domain,
+      mailFromDomain: emailConfig.mailFromDomain,
       region: config.region,
       trackingConfig: emailConfig.tracking,
       eventTypes: emailConfig.eventTracking?.events
@@ -1927,7 +1969,8 @@ async function deployEmailStack(config) {
     eventBusName: sesResources?.eventBus.name,
     queueUrl: sqsResources?.queue.url,
     dlqUrl: sqsResources?.dlq.url,
-    customTrackingDomain: sesResources?.customTrackingDomain
+    customTrackingDomain: sesResources?.customTrackingDomain,
+    mailFromDomain: sesResources?.mailFromDomain
   };
 }
 
@@ -2146,6 +2189,14 @@ Verification should complete within a few minutes.`,
         pc2.bold("DMARC Record (TXT):"),
         `  ${pc2.cyan(`_dmarc.${domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain}"`
       );
+      if (outputs.mailFromDomain) {
+        dnsLines.push(
+          "",
+          pc2.bold("MAIL FROM Domain Records (for DMARC alignment):"),
+          `  ${pc2.cyan(outputs.mailFromDomain)} ${pc2.dim("MX")} "10 feedback-smtp.${outputs.region}.amazonses.com"`,
+          `  ${pc2.cyan(outputs.mailFromDomain)} ${pc2.dim("TXT")} "v=spf1 include:amazonses.com ~all"`
+        );
+      }
     }
     clack2.note(dnsLines.join("\n"), "DNS Records to add:");
   }
@@ -2198,7 +2249,14 @@ function displayStatus(status2) {
     const domainStrings = status2.domains.map((d) => {
       const statusIcon = d.status === "verified" ? "\u2713" : d.status === "pending" ? "\u23F1" : "\u2717";
       const statusColor = d.status === "verified" ? pc2.green : d.status === "pending" ? pc2.yellow : pc2.red;
-      return `    ${d.domain} ${statusColor(`${statusIcon} ${d.status}`)}`;
+      let domainLine = `    ${d.domain} ${statusColor(`${statusIcon} ${d.status}`)}`;
+      if (d.mailFromDomain) {
+        const mailFromStatusIcon = d.mailFromStatus === "SUCCESS" ? "\u2713" : "\u23F1";
+        const mailFromColor = d.mailFromStatus === "SUCCESS" ? pc2.green : pc2.yellow;
+        domainLine += `
+      ${pc2.dim("MAIL FROM:")} ${d.mailFromDomain} ${mailFromColor(mailFromStatusIcon)}`;
+      }
+      return domainLine;
     });
     infoLines.push(`${pc2.bold("Domains:")}
 ${domainStrings.join("\n")}`);
@@ -2257,13 +2315,14 @@ ${domainStrings.join("\n")}`);
     );
   }
   clack2.note(resourceLines.join("\n"), "Resources");
-  const pendingDomains = status2.domains.filter(
-    (d) => d.status === "pending" && d.dkimTokens
+  const domainsNeedingDNS = status2.domains.filter(
+    (d) => d.status === "pending" && d.dkimTokens || d.mailFromDomain && d.mailFromStatus !== "SUCCESS"
   );
-  if (pendingDomains.length > 0) {
-    for (const domain of pendingDomains) {
-      if (domain.dkimTokens && domain.dkimTokens.length > 0) {
-        const dnsLines = [
+  if (domainsNeedingDNS.length > 0) {
+    for (const domain of domainsNeedingDNS) {
+      const dnsLines = [];
+      if (domain.status === "pending" && domain.dkimTokens && domain.dkimTokens.length > 0) {
+        dnsLines.push(
           pc2.bold("DKIM Records (CNAME):"),
           ...domain.dkimTokens.map(
             (token) => `  ${pc2.cyan(`${token}._domainkey.${domain.domain}`)} ${pc2.dim("CNAME")} "${token}.dkim.amazonses.com"`
@@ -2274,11 +2333,21 @@ ${domainStrings.join("\n")}`);
           "",
           pc2.bold("DMARC Record (TXT):"),
           `  ${pc2.cyan(`_dmarc.${domain.domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain.domain}"`
-        ];
+        );
+      }
+      if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
+        if (dnsLines.length > 0) dnsLines.push("");
+        dnsLines.push(
+          pc2.bold("MAIL FROM Domain Records (for DMARC alignment):"),
+          `  ${pc2.cyan(domain.mailFromDomain)} ${pc2.dim("MX")} "10 feedback-smtp.${status2.region}.amazonses.com"`,
+          `  ${pc2.cyan(domain.mailFromDomain)} ${pc2.dim("TXT")} "v=spf1 include:amazonses.com ~all"`
+        );
+      }
+      if (dnsLines.length > 0) {
         clack2.note(dnsLines.join("\n"), `DNS Records for ${domain.domain}`);
       }
     }
-    const exampleDomain = pendingDomains[0].domain;
+    const exampleDomain = domainsNeedingDNS[0].domain;
     console.log(
       `
 ${pc2.dim("Run:")} ${pc2.yellow(`wraps verify --domain ${exampleDomain}`)} ${pc2.dim(
@@ -4165,7 +4234,8 @@ async function init(options) {
           outputs.domain,
           outputs.dkimTokens,
           region,
-          outputs.customTrackingDomain
+          outputs.customTrackingDomain,
+          outputs.mailFromDomain
         );
         progress.succeed("DNS records created in Route53");
         dnsAutoCreated = true;
@@ -4192,7 +4262,8 @@ async function init(options) {
     tableName: outputs.tableName,
     dnsRecords: dnsRecords.length > 0 ? dnsRecords : void 0,
     dnsAutoCreated,
-    domain: outputs.domain
+    domain: outputs.domain,
+    mailFromDomain: outputs.mailFromDomain
   });
 }
 
@@ -4342,13 +4413,17 @@ Run ${pc9.cyan("wraps init")} to deploy infrastructure.
         return {
           domain: d.domain,
           status: d.verified ? "verified" : "pending",
-          dkimTokens: identity2.DkimAttributes?.Tokens || []
+          dkimTokens: identity2.DkimAttributes?.Tokens || [],
+          mailFromDomain: identity2.MailFromAttributes?.MailFromDomain,
+          mailFromStatus: identity2.MailFromAttributes?.MailFromDomainStatus
         };
       } catch (_error) {
         return {
           domain: d.domain,
           status: d.verified ? "verified" : "pending",
-          dkimTokens: void 0
+          dkimTokens: void 0,
+          mailFromDomain: void 0,
+          mailFromStatus: void 0
         };
       }
     })
@@ -4369,17 +4444,14 @@ Run ${pc9.cyan("wraps init")} to deploy infrastructure.
   });
 }
 
-// src/commands/upgrade.ts
+// src/commands/update.ts
 init_esm_shims();
 import * as clack10 from "@clack/prompts";
 import * as pulumi11 from "@pulumi/pulumi";
 import pc10 from "picocolors";
 init_aws();
-init_costs();
-init_presets();
-init_prompts();
-async function upgrade(options) {
-  clack10.intro(pc10.bold("Wraps Upgrade - Enhance Your Email Infrastructure"));
+async function update(options) {
+  clack10.intro(pc10.bold("Wraps Update - Apply CLI Updates to Infrastructure"));
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -4423,33 +4495,224 @@ ${pc10.bold("Current Configuration:")}
   }
   if (config.tracking?.enabled) {
     console.log(`  ${pc10.green("\u2713")} Open & Click Tracking`);
+  }
+  if (config.suppressionList?.enabled) {
+    console.log(`  ${pc10.green("\u2713")} Bounce/Complaint Suppression`);
+  }
+  if (config.eventTracking?.enabled) {
+    console.log(`  ${pc10.green("\u2713")} Event Tracking (EventBridge)`);
+  }
+  if (config.dedicatedIp) {
+    console.log(`  ${pc10.green("\u2713")} Dedicated IP Address`);
+  }
+  console.log("");
+  console.log(`${pc10.bold("What will be updated:")}
+`);
+  console.log(
+    `  ${pc10.cyan("\u2022")} Lambda function code (if event tracking enabled)`
+  );
+  console.log(
+    `  ${pc10.cyan("\u2022")} EventBridge rules (if event tracking enabled)`
+  );
+  console.log(`  ${pc10.cyan("\u2022")} IAM policies (security improvements)`);
+  console.log(`  ${pc10.cyan("\u2022")} SES configuration set (feature updates)`);
+  console.log("");
+  progress.info(
+    "Your current configuration will be preserved - no features will be added or removed"
+  );
+  console.log("");
+  if (!options.yes) {
+    const confirmed = await clack10.confirm({
+      message: "Proceed with update?",
+      initialValue: true
+    });
+    if (clack10.isCancel(confirmed) || !confirmed) {
+      clack10.cancel("Update cancelled.");
+      process.exit(0);
+    }
+  }
+  let vercelConfig;
+  if (metadata.provider === "vercel" && metadata.vercel) {
+    vercelConfig = metadata.vercel;
+  }
+  const stackConfig = {
+    provider: metadata.provider,
+    region,
+    vercel: vercelConfig,
+    emailConfig: config
+  };
+  let outputs;
+  try {
+    outputs = await progress.execute(
+      "Updating Wraps infrastructure (this may take 2-3 minutes)",
+      async () => {
+        await ensurePulumiWorkDir();
+        const stack = await pulumi11.automation.LocalWorkspace.createOrSelectStack(
+          {
+            stackName: metadata.pulumiStackName || `wraps-${identity.accountId}-${region}`,
+            projectName: "wraps-email",
+            program: async () => {
+              const result = await deployEmailStack(stackConfig);
+              return {
+                roleArn: result.roleArn,
+                configSetName: result.configSetName,
+                tableName: result.tableName,
+                region: result.region,
+                lambdaFunctions: result.lambdaFunctions,
+                domain: result.domain,
+                dkimTokens: result.dkimTokens,
+                customTrackingDomain: result.customTrackingDomain
+              };
+            }
+          },
+          {
+            workDir: getPulumiWorkDir(),
+            envVars: {
+              PULUMI_CONFIG_PASSPHRASE: ""
+            },
+            secretsProvider: "passphrase"
+          }
+        );
+        await stack.workspace.selectStack(
+          metadata.pulumiStackName || `wraps-${identity.accountId}-${region}`
+        );
+        await stack.setConfig("aws:region", { value: region });
+        const upResult = await stack.up({ onOutput: () => {
+        } });
+        const pulumiOutputs = upResult.outputs;
+        return {
+          roleArn: pulumiOutputs.roleArn?.value,
+          configSetName: pulumiOutputs.configSetName?.value,
+          tableName: pulumiOutputs.tableName?.value,
+          region: pulumiOutputs.region?.value,
+          lambdaFunctions: pulumiOutputs.lambdaFunctions?.value,
+          domain: pulumiOutputs.domain?.value,
+          dkimTokens: pulumiOutputs.dkimTokens?.value,
+          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value
+        };
+      }
+    );
+  } catch (error) {
+    clack10.log.error("Infrastructure update failed");
+    if (error.message?.includes("stack is currently locked")) {
+      clack10.log.warn("\nThe Pulumi stack is locked from a previous run.");
+      clack10.log.info("To fix this, run:");
+      clack10.log.info(`  ${pc10.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
+      clack10.log.info("\nThen try running wraps update again.");
+    }
+    throw new Error(`Pulumi update failed: ${error.message}`);
+  }
+  metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  await saveConnectionMetadata(metadata);
+  progress.info("Connection metadata updated");
+  displaySuccess({
+    roleArn: outputs.roleArn,
+    configSetName: outputs.configSetName,
+    region: outputs.region,
+    tableName: outputs.tableName,
+    customTrackingDomain: outputs.customTrackingDomain
+  });
+  console.log(`
+${pc10.green("\u2713")} ${pc10.bold("Update complete!")}
+`);
+  console.log(
+    "Infrastructure has been updated with the latest CLI improvements.\n"
+  );
+  console.log(`${pc10.bold("Next steps:")}
+`);
+  console.log(
+    `  ${pc10.cyan("1.")} No code changes needed - your existing SDK integration continues to work`
+  );
+  console.log(
+    `  ${pc10.cyan("2.")} Check ${pc10.cyan("wraps status")} to verify all resources are healthy`
+  );
+  console.log(
+    `  ${pc10.cyan("3.")} View analytics at ${pc10.cyan("wraps console")}
+`
+  );
+}
+
+// src/commands/upgrade.ts
+init_esm_shims();
+import * as clack11 from "@clack/prompts";
+import * as pulumi12 from "@pulumi/pulumi";
+import pc11 from "picocolors";
+init_aws();
+init_costs();
+init_presets();
+init_prompts();
+async function upgrade(options) {
+  clack11.intro(pc11.bold("Wraps Upgrade - Enhance Your Email Infrastructure"));
+  const progress = new DeploymentProgress();
+  const wasAutoInstalled = await progress.execute(
+    "Checking Pulumi CLI installation",
+    async () => await ensurePulumiInstalled()
+  );
+  if (wasAutoInstalled) {
+    progress.info("Pulumi CLI was automatically installed");
+  }
+  const identity = await progress.execute(
+    "Validating AWS credentials",
+    async () => validateAWSCredentials()
+  );
+  progress.info(`Connected to AWS account: ${pc11.cyan(identity.accountId)}`);
+  let region = options.region;
+  if (!region) {
+    const defaultRegion = await getAWSRegion();
+    region = defaultRegion;
+  }
+  const metadata = await loadConnectionMetadata(identity.accountId, region);
+  if (!metadata) {
+    clack11.log.error(
+      `No Wraps connection found for account ${pc11.cyan(identity.accountId)} in region ${pc11.cyan(region)}`
+    );
+    clack11.log.info(
+      `Use ${pc11.cyan("wraps init")} to create new infrastructure or ${pc11.cyan("wraps connect")} to connect existing.`
+    );
+    process.exit(1);
+  }
+  progress.info(`Found existing connection created: ${metadata.timestamp}`);
+  console.log(`
+${pc11.bold("Current Configuration:")}
+`);
+  if (metadata.preset) {
+    console.log(`  Preset: ${pc11.cyan(metadata.preset)}`);
+  } else {
+    console.log(`  Preset: ${pc11.cyan("custom")}`);
+  }
+  const config = metadata.emailConfig;
+  if (config.domain) {
+    console.log(`  Sending Domain: ${pc11.cyan(config.domain)}`);
+  }
+  if (config.tracking?.enabled) {
+    console.log(`  ${pc11.green("\u2713")} Open & Click Tracking`);
     if (config.tracking.customRedirectDomain) {
       console.log(
-        `    ${pc10.dim("\u2514\u2500")} Custom domain: ${pc10.cyan(config.tracking.customRedirectDomain)}`
+        `    ${pc11.dim("\u2514\u2500")} Custom domain: ${pc11.cyan(config.tracking.customRedirectDomain)}`
       );
     }
   }
   if (config.suppressionList?.enabled) {
-    console.log(`  ${pc10.green("\u2713")} Bounce/Complaint Suppression`);
+    console.log(`  ${pc11.green("\u2713")} Bounce/Complaint Suppression`);
   }
   if (config.eventTracking?.enabled) {
-    console.log(`  ${pc10.green("\u2713")} Event Tracking (EventBridge)`);
+    console.log(`  ${pc11.green("\u2713")} Event Tracking (EventBridge)`);
     if (config.eventTracking.dynamoDBHistory) {
       console.log(
-        `    ${pc10.dim("\u2514\u2500")} Email History: ${pc10.cyan(config.eventTracking.archiveRetention || "90days")}`
+        `    ${pc11.dim("\u2514\u2500")} Email History: ${pc11.cyan(config.eventTracking.archiveRetention || "90days")}`
       );
     }
   }
   if (config.dedicatedIp) {
-    console.log(`  ${pc10.green("\u2713")} Dedicated IP Address`);
+    console.log(`  ${pc11.green("\u2713")} Dedicated IP Address`);
   }
   const currentCostData = calculateCosts(config, 5e4);
   console.log(
     `
-  Estimated Cost: ${pc10.cyan(`~${formatCost(currentCostData.total.monthly)}/mo`)}`
+  Estimated Cost: ${pc11.cyan(`~${formatCost(currentCostData.total.monthly)}/mo`)}`
   );
   console.log("");
-  const upgradeAction = await clack10.select({
+  const upgradeAction = await clack11.select({
     message: "What would you like to do?",
     options: [
       {
@@ -4484,8 +4747,8 @@ ${pc10.bold("Current Configuration:")}
       }
     ]
   });
-  if (clack10.isCancel(upgradeAction)) {
-    clack10.cancel("Upgrade cancelled.");
+  if (clack11.isCancel(upgradeAction)) {
+    clack11.cancel("Upgrade cancelled.");
     process.exit(0);
   }
   let updatedConfig = { ...config };
@@ -4503,15 +4766,15 @@ ${pc10.bold("Current Configuration:")}
         disabled: currentPresetIdx >= 0 && idx <= currentPresetIdx ? "Current or lower tier" : void 0
       })).filter((p) => !p.disabled);
       if (availablePresets.length === 0) {
-        clack10.log.warn("Already on highest preset (Enterprise)");
+        clack11.log.warn("Already on highest preset (Enterprise)");
         process.exit(0);
       }
-      const selectedPreset = await clack10.select({
+      const selectedPreset = await clack11.select({
         message: "Select new preset:",
         options: availablePresets
       });
-      if (clack10.isCancel(selectedPreset)) {
-        clack10.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(selectedPreset)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       const presetConfig = getPreset(selectedPreset);
@@ -4525,11 +4788,11 @@ ${pc10.bold("Current Configuration:")}
     }
     case "tracking-domain": {
       if (!config.domain) {
-        clack10.log.error(
+        clack11.log.error(
           "No sending domain configured. You must configure a sending domain before adding a custom tracking domain."
         );
-        clack10.log.info(
-          `Use ${pc10.cyan("wraps init")} to set up a sending domain first.`
+        clack11.log.info(
+          `Use ${pc11.cyan("wraps init")} to set up a sending domain first.`
         );
         process.exit(1);
       }
@@ -4540,21 +4803,21 @@ ${pc10.bold("Current Configuration:")}
       );
       const sendingDomain = domains.find((d) => d.domain === config.domain);
       if (!sendingDomain?.verified) {
-        clack10.log.error(
-          `Sending domain ${pc10.cyan(config.domain)} is not verified.`
+        clack11.log.error(
+          `Sending domain ${pc11.cyan(config.domain)} is not verified.`
         );
-        clack10.log.info(
+        clack11.log.info(
           "You must verify your sending domain before adding a custom tracking domain."
         );
-        clack10.log.info(
-          `Use ${pc10.cyan("wraps verify")} to check DNS records and complete verification.`
+        clack11.log.info(
+          `Use ${pc11.cyan("wraps verify")} to check DNS records and complete verification.`
         );
         process.exit(1);
       }
       progress.info(
-        `Sending domain ${pc10.cyan(config.domain)} is verified ${pc10.green("\u2713")}`
+        `Sending domain ${pc11.cyan(config.domain)} is verified ${pc11.green("\u2713")}`
       );
-      const trackingDomain = await clack10.text({
+      const trackingDomain = await clack11.text({
         message: "Custom tracking redirect domain:",
         placeholder: "track.yourdomain.com",
         initialValue: config.tracking?.customRedirectDomain || "",
@@ -4564,8 +4827,8 @@ ${pc10.bold("Current Configuration:")}
           }
         }
       });
-      if (clack10.isCancel(trackingDomain)) {
-        clack10.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(trackingDomain)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -4580,7 +4843,7 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "retention": {
-      const retention = await clack10.select({
+      const retention = await clack11.select({
         message: "Email history retention period:",
         options: [
           { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -4599,8 +4862,8 @@ ${pc10.bold("Current Configuration:")}
         ],
         initialValue: config.eventTracking?.archiveRetention || "90days"
       });
-      if (clack10.isCancel(retention)) {
-        clack10.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(retention)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -4616,7 +4879,7 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "events": {
-      const selectedEvents = await clack10.multiselect({
+      const selectedEvents = await clack11.multiselect({
         message: "Select SES event types to track:",
         options: [
           { value: "SEND", label: "Send", hint: "Email sent to SES" },
@@ -4660,8 +4923,8 @@ ${pc10.bold("Current Configuration:")}
         ],
         required: true
       });
-      if (clack10.isCancel(selectedEvents)) {
-        clack10.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(selectedEvents)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -4676,16 +4939,16 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "dedicated-ip": {
-      const confirmed = await clack10.confirm({
+      const confirmed = await clack11.confirm({
         message: "Enable dedicated IP? (Requires 100k+ emails/day, adds ~$50-100/mo)",
         initialValue: false
       });
-      if (clack10.isCancel(confirmed)) {
-        clack10.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(confirmed)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (!confirmed) {
-        clack10.log.info("Dedicated IP not enabled.");
+        clack11.log.info("Dedicated IP not enabled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -4709,28 +4972,28 @@ ${pc10.bold("Current Configuration:")}
   const newCostData = calculateCosts(updatedConfig, 5e4);
   const costDiff = newCostData.total.monthly - currentCostData.total.monthly;
   console.log(`
-${pc10.bold("Cost Impact:")}`);
+${pc11.bold("Cost Impact:")}`);
   console.log(
-    `  Current: ${pc10.cyan(`${formatCost(currentCostData.total.monthly)}/mo`)}`
+    `  Current: ${pc11.cyan(`${formatCost(currentCostData.total.monthly)}/mo`)}`
   );
   console.log(
-    `  New:     ${pc10.cyan(`${formatCost(newCostData.total.monthly)}/mo`)}`
+    `  New:     ${pc11.cyan(`${formatCost(newCostData.total.monthly)}/mo`)}`
   );
   if (costDiff > 0) {
-    console.log(`  Change:  ${pc10.yellow(`+${formatCost(costDiff)}/mo`)}`);
+    console.log(`  Change:  ${pc11.yellow(`+${formatCost(costDiff)}/mo`)}`);
   } else if (costDiff < 0) {
     console.log(
-      `  Change:  ${pc10.green(`${formatCost(Math.abs(costDiff))}/mo`)}`
+      `  Change:  ${pc11.green(`${formatCost(Math.abs(costDiff))}/mo`)}`
     );
   }
   console.log("");
   if (!options.yes) {
-    const confirmed = await clack10.confirm({
+    const confirmed = await clack11.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
     });
-    if (clack10.isCancel(confirmed) || !confirmed) {
-      clack10.cancel("Upgrade cancelled.");
+    if (clack11.isCancel(confirmed) || !confirmed) {
+      clack11.cancel("Upgrade cancelled.");
       process.exit(0);
     }
   }
@@ -4752,7 +5015,7 @@ ${pc10.bold("Cost Impact:")}`);
       "Updating Wraps infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi11.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi12.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.pulumiStackName || `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -4798,12 +5061,12 @@ ${pc10.bold("Cost Impact:")}`);
       }
     );
   } catch (error) {
-    clack10.log.error("Infrastructure upgrade failed");
+    clack11.log.error("Infrastructure upgrade failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack10.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack10.log.info("To fix this, run:");
-      clack10.log.info(`  ${pc10.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack10.log.info("\nThen try running wraps upgrade again.");
+      clack11.log.warn("\nThe Pulumi stack is locked from a previous run.");
+      clack11.log.info("To fix this, run:");
+      clack11.log.info(`  ${pc11.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
+      clack11.log.info("\nThen try running wraps upgrade again.");
     }
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
@@ -4828,16 +5091,16 @@ ${pc10.bold("Cost Impact:")}`);
     customTrackingDomain: outputs.customTrackingDomain
   });
   console.log(`
-${pc10.green("\u2713")} ${pc10.bold("Upgrade complete!")}
+${pc11.green("\u2713")} ${pc11.bold("Upgrade complete!")}
 `);
   if (upgradeAction === "preset" && newPreset) {
     console.log(
-      `Upgraded to ${pc10.cyan(newPreset)} preset (${pc10.green(formatCost(newCostData.total.monthly) + "/mo")})
+      `Upgraded to ${pc11.cyan(newPreset)} preset (${pc11.green(formatCost(newCostData.total.monthly) + "/mo")})
 `
     );
   } else {
     console.log(
-      `Updated configuration (${pc10.green(formatCost(newCostData.total.monthly) + "/mo")})
+      `Updated configuration (${pc11.green(formatCost(newCostData.total.monthly) + "/mo")})
 `
     );
   }
@@ -4848,15 +5111,16 @@ init_esm_shims();
 init_aws();
 import { Resolver } from "dns/promises";
 import { GetEmailIdentityCommand as GetEmailIdentityCommand3, SESv2Client as SESv2Client3 } from "@aws-sdk/client-sesv2";
-import * as clack11 from "@clack/prompts";
-import pc11 from "picocolors";
+import * as clack12 from "@clack/prompts";
+import pc12 from "picocolors";
 async function verify(options) {
-  clack11.intro(pc11.bold(`Verifying ${options.domain}`));
+  clack12.intro(pc12.bold(`Verifying ${options.domain}`));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
   const sesClient = new SESv2Client3({ region });
   let identity;
   let dkimTokens = [];
+  let mailFromDomain;
   try {
     identity = await progress.execute(
       "Checking SES verification status",
@@ -4868,17 +5132,19 @@ async function verify(options) {
       }
     );
     dkimTokens = identity.DkimAttributes?.Tokens || [];
+    mailFromDomain = identity.MailFromAttributes?.MailFromDomain;
   } catch (_error) {
     progress.stop();
-    clack11.log.error(`Domain ${options.domain} not found in SES`);
+    clack12.log.error(`Domain ${options.domain} not found in SES`);
     console.log(
       `
-Run ${pc11.cyan(`wraps init --domain ${options.domain}`)} to add this domain.
+Run ${pc12.cyan(`wraps init --domain ${options.domain}`)} to add this domain.
 `
     );
     process.exit(1);
   }
   const resolver = new Resolver();
+  resolver.setServers(["8.8.8.8", "1.1.1.1"]);
   const dnsResults = [];
   for (const token of dkimTokens) {
     const dkimRecord = `${token}._domainkey.${options.domain}`;
@@ -4933,54 +5199,97 @@ Run ${pc11.cyan(`wraps init --domain ${options.domain}`)} to add this domain.
       status: "missing"
     });
   }
+  if (mailFromDomain) {
+    try {
+      const mxRecords = await resolver.resolveMx(mailFromDomain);
+      const expectedMx = `feedback-smtp.${region}.amazonses.com`;
+      const hasMx = mxRecords.some(
+        (r) => r.exchange === expectedMx || r.exchange === `${expectedMx}.`
+      );
+      dnsResults.push({
+        name: mailFromDomain,
+        type: "MX",
+        status: hasMx ? "verified" : mxRecords.length > 0 ? "incorrect" : "missing",
+        records: mxRecords.map((r) => `${r.priority} ${r.exchange}`)
+      });
+    } catch (_error) {
+      dnsResults.push({
+        name: mailFromDomain,
+        type: "MX",
+        status: "missing"
+      });
+    }
+    try {
+      const records = await resolver.resolveTxt(mailFromDomain);
+      const spfRecord = records.flat().find((r) => r.startsWith("v=spf1"));
+      const hasAmazonSES = spfRecord?.includes("include:amazonses.com");
+      dnsResults.push({
+        name: mailFromDomain,
+        type: "TXT (SPF)",
+        status: hasAmazonSES ? "verified" : spfRecord ? "incorrect" : "missing",
+        records: spfRecord ? [spfRecord] : void 0
+      });
+    } catch (_error) {
+      dnsResults.push({
+        name: mailFromDomain,
+        type: "TXT (SPF)",
+        status: "missing"
+      });
+    }
+  }
   progress.stop();
   const verificationStatus = identity.VerifiedForSendingStatus ? "verified" : "pending";
   const dkimStatus = identity.DkimAttributes?.Status || "PENDING";
-  clack11.note(
-    [
-      `${pc11.bold("Domain:")} ${options.domain}`,
-      `${pc11.bold("Verification Status:")} ${verificationStatus === "verified" ? pc11.green("\u2713 Verified") : pc11.yellow("\u23F1 Pending")}`,
-      `${pc11.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc11.green("\u2713 Success") : pc11.yellow(`\u23F1 ${dkimStatus}`)}`
-    ].join("\n"),
-    "SES Status"
-  );
+  const mailFromStatus = identity.MailFromAttributes?.MailFromDomainStatus || "NOT_CONFIGURED";
+  const statusLines = [
+    `${pc12.bold("Domain:")} ${options.domain}`,
+    `${pc12.bold("Verification Status:")} ${verificationStatus === "verified" ? pc12.green("\u2713 Verified") : pc12.yellow("\u23F1 Pending")}`,
+    `${pc12.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc12.green("\u2713 Success") : pc12.yellow(`\u23F1 ${dkimStatus}`)}`
+  ];
+  if (mailFromDomain) {
+    statusLines.push(
+      `${pc12.bold("MAIL FROM Domain:")} ${mailFromDomain}`,
+      `${pc12.bold("MAIL FROM Status:")} ${mailFromStatus === "SUCCESS" ? pc12.green("\u2713 Success") : mailFromStatus === "NOT_CONFIGURED" ? pc12.yellow("\u23F1 Not Configured") : pc12.yellow(`\u23F1 ${mailFromStatus}`)}`
+    );
+  }
+  clack12.note(statusLines.join("\n"), "SES Status");
   const dnsLines = dnsResults.map((record) => {
     let statusIcon;
     let statusColor;
     if (record.status === "verified") {
       statusIcon = "\u2713";
-      statusColor = pc11.green;
+      statusColor = pc12.green;
     } else if (record.status === "incorrect") {
       statusIcon = "\u2717";
-      statusColor = pc11.red;
+      statusColor = pc12.red;
     } else {
       statusIcon = "\u2717";
-      statusColor = pc11.red;
+      statusColor = pc12.red;
     }
     const recordInfo = record.records ? ` \u2192 ${record.records.join(", ")}` : "";
     return `  ${statusColor(statusIcon)} ${record.name} (${record.type}) ${statusColor(
       record.status
     )}${recordInfo}`;
   });
-  clack11.note(dnsLines.join("\n"), "DNS Records");
+  clack12.note(dnsLines.join("\n"), "DNS Records");
   const allVerified = dnsResults.every((r) => r.status === "verified");
   const someIncorrect = dnsResults.some((r) => r.status === "incorrect");
   if (verificationStatus === "verified" && allVerified) {
-    clack11.outro(
-      pc11.green("\u2713 Domain is fully verified and ready to send emails!")
+    clack12.outro(
+      pc12.green("\u2713 Domain is fully verified and ready to send emails!")
     );
   } else if (someIncorrect) {
-    clack11.outro(
-      pc11.red("\u2717 Some DNS records are incorrect. Please update them.")
+    clack12.outro(
+      pc12.red("\u2717 Some DNS records are incorrect. Please update them.")
     );
     console.log(
       `
-Run ${pc11.cyan("wraps status")} to see the correct DNS records.
+Run ${pc12.cyan("wraps status")} to see the correct DNS records.
 `
     );
   } else {
-    clack11.outro(
-      pc11.yellow("\u23F1 Waiting for DNS propagation and SES verification")
+    clack12.outro(
+      pc12.yellow("\u23F1 Waiting for DNS propagation and SES verification")
     );
     console.log("\nDNS records can take up to 48 hours to propagate.");
     console.log(
@@ -5015,44 +5324,61 @@ function printCompletionScript() {
 
 // src/cli.ts
 init_errors();
+var __filename2 = fileURLToPath4(import.meta.url);
+var __dirname3 = dirname2(__filename2);
+var packageJson = JSON.parse(
+  readFileSync(join4(__dirname3, "../package.json"), "utf-8")
+);
+var VERSION = packageJson.version;
 setupTabCompletion();
+function showVersion() {
+  console.log(`wraps v${VERSION}`);
+  process.exit(0);
+}
 function showHelp() {
-  clack12.intro(pc12.bold("WRAPS CLI"));
+  clack13.intro(pc13.bold(`WRAPS CLI v${VERSION}`));
   console.log("Deploy email infrastructure to your AWS account\n");
   console.log("Usage: wraps <command> [options]\n");
   console.log("Commands:");
-  console.log(`  ${pc12.cyan("init")}        Deploy new email infrastructure`);
+  console.log(`  ${pc13.cyan("init")}        Deploy new email infrastructure`);
   console.log(
-    `  ${pc12.cyan("connect")}     Connect to existing AWS SES infrastructure`
+    `  ${pc13.cyan("connect")}     Connect to existing AWS SES infrastructure`
   );
   console.log(
-    `  ${pc12.cyan("console")}     Start local web dashboard for monitoring`
+    `  ${pc13.cyan("console")}     Start local web dashboard for monitoring`
   );
   console.log(
-    `  ${pc12.cyan("upgrade")}     Add features to existing connection`
+    `  ${pc13.cyan("update")}      Update infrastructure with latest CLI changes`
   );
-  console.log(`  ${pc12.cyan("status")}      Show current infrastructure status`);
   console.log(
-    `  ${pc12.cyan("verify")}      Verify domain DNS records and SES status`
+    `  ${pc13.cyan("upgrade")}     Add features to existing connection`
   );
-  console.log(`  ${pc12.cyan("restore")}     Restore original AWS configuration`);
-  console.log(`  ${pc12.cyan("destroy")}     Remove all deployed infrastructure`);
-  console.log(`  ${pc12.cyan("completion")}  Generate shell completion script
+  console.log(`  ${pc13.cyan("status")}      Show current infrastructure status`);
+  console.log(
+    `  ${pc13.cyan("verify")}      Verify domain DNS records and SES status`
+  );
+  console.log(`  ${pc13.cyan("restore")}     Restore original AWS configuration`);
+  console.log(`  ${pc13.cyan("destroy")}     Remove all deployed infrastructure`);
+  console.log(`  ${pc13.cyan("completion")}  Generate shell completion script
 `);
   console.log("Options:");
   console.log(
-    `  ${pc12.dim("--provider")}  Hosting provider (vercel, aws, railway, other)`
+    `  ${pc13.dim("--provider")}  Hosting provider (vercel, aws, railway, other)`
   );
-  console.log(`  ${pc12.dim("--region")}    AWS region`);
-  console.log(`  ${pc12.dim("--domain")}    Domain to verify`);
-  console.log(`  ${pc12.dim("--account")}   AWS account ID or alias
+  console.log(`  ${pc13.dim("--region")}    AWS region`);
+  console.log(`  ${pc13.dim("--domain")}    Domain to verify`);
+  console.log(`  ${pc13.dim("--account")}   AWS account ID or alias`);
+  console.log(`  ${pc13.dim("--version, -v")}  Show version number
 `);
   console.log(
-    `Run ${pc12.cyan("wraps <command> --help")} for more information on a command.
+    `Run ${pc13.cyan("wraps <command> --help")} for more information on a command.
 `
   );
   process.exit(0);
 }
+if (process.argv.includes("--version") || process.argv.includes("-v")) {
+  showVersion();
+}
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
   showHelp();
 }
@@ -5122,10 +5448,10 @@ async function run() {
         break;
       case "verify":
         if (!flags.domain) {
-          clack12.log.error("--domain flag is required");
+          clack13.log.error("--domain flag is required");
           console.log(
             `
-Usage: ${pc12.cyan("wraps verify --domain yourapp.com")}
+Usage: ${pc13.cyan("wraps verify --domain yourapp.com")}
 `
           );
           process.exit(1);
@@ -5147,6 +5473,12 @@ Usage: ${pc12.cyan("wraps verify --domain yourapp.com")}
           noOpen: flags.noOpen
         });
         break;
+      case "update":
+        await update({
+          region: flags.region,
+          yes: flags.yes
+        });
+        break;
       case "upgrade":
         await upgrade({
           region: flags.region,
@@ -5168,10 +5500,10 @@ Usage: ${pc12.cyan("wraps verify --domain yourapp.com")}
         printCompletionScript();
         break;
       default:
-        clack12.log.error(`Unknown command: ${command}`);
+        clack13.log.error(`Unknown command: ${command}`);
         console.log(
           `
-Run ${pc12.cyan("wraps --help")} for available commands.
+Run ${pc13.cyan("wraps --help")} for available commands.
 `
         );
         process.exit(1);