@wraps.dev/cli 0.2.0 → 0.3.3

package/dist/cli.js

@@ -18,6 +18,165 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/infrastructure/resources/mail-manager.ts
+var mail_manager_exports = {};
+__export(mail_manager_exports, {
+  createMailManagerArchive: () => createMailManagerArchive
+});
+import {
+  CreateArchiveCommand,
+  GetArchiveCommand,
+  ListArchivesCommand,
+  MailManagerClient
+} from "@aws-sdk/client-mailmanager";
+import {
+  PutConfigurationSetArchivingOptionsCommand,
+  SESv2Client
+} from "@aws-sdk/client-sesv2";
+function retentionToAWSPeriod(retention) {
+  switch (retention) {
+    case "3months":
+      return "THREE_MONTHS";
+    case "6months":
+      return "SIX_MONTHS";
+    case "9months":
+      return "NINE_MONTHS";
+    case "1year":
+      return "ONE_YEAR";
+    case "18months":
+      return "EIGHTEEN_MONTHS";
+    case "2years":
+      return "TWO_YEARS";
+    case "30months":
+      return "THIRTY_MONTHS";
+    case "3years":
+      return "THREE_YEARS";
+    case "4years":
+      return "FOUR_YEARS";
+    case "5years":
+      return "FIVE_YEARS";
+    case "6years":
+      return "SIX_YEARS";
+    case "7years":
+      return "SEVEN_YEARS";
+    case "8years":
+      return "EIGHT_YEARS";
+    case "9years":
+      return "NINE_YEARS";
+    case "10years":
+      return "TEN_YEARS";
+    case "permanent":
+      return "PERMANENT";
+    default:
+      return "THREE_MONTHS";
+  }
+}
+async function createMailManagerArchive(config) {
+  const region = config.region || process.env.AWS_REGION || "us-east-1";
+  const archiveName = `wraps-${config.name}-archive`;
+  const mailManagerClient = new MailManagerClient({ region });
+  const sesClient = new SESv2Client({ region });
+  const kmsKeyArn = config.kmsKeyArn;
+  if (!kmsKeyArn) {
+  }
+  const awsRetention = retentionToAWSPeriod(config.retention);
+  let archiveId;
+  let archiveArn;
+  try {
+    const listCommand = new ListArchivesCommand({});
+    const listResult = await mailManagerClient.send(listCommand);
+    const existingArchive = listResult.Archives?.find(
+      (archive) => archive.ArchiveName === archiveName
+    );
+    if (existingArchive?.ArchiveId) {
+      console.log(`Using existing Mail Manager archive: ${archiveName}`);
+      archiveId = existingArchive.ArchiveId;
+      const getCommand = new GetArchiveCommand({ ArchiveId: archiveId });
+      const getResult = await mailManagerClient.send(getCommand);
+      archiveArn = getResult.ArchiveArn;
+    }
+  } catch (error) {
+    console.log("Error checking for existing archive:", error);
+  }
+  if (!archiveId) {
+    try {
+      const createArchiveCommand = new CreateArchiveCommand({
+        ArchiveName: archiveName,
+        Retention: {
+          RetentionPeriod: awsRetention
+        },
+        ...kmsKeyArn && { KmsKeyArn: kmsKeyArn },
+        Tags: [
+          { Key: "ManagedBy", Value: "wraps-cli" },
+          { Key: "Name", Value: archiveName },
+          { Key: "Retention", Value: config.retention }
+        ]
+      });
+      const archiveResult = await mailManagerClient.send(createArchiveCommand);
+      archiveId = archiveResult.ArchiveId;
+      if (!archiveId) {
+        throw new Error(
+          "Failed to create Mail Manager Archive: No ArchiveId returned"
+        );
+      }
+      console.log(`Created new Mail Manager archive: ${archiveName}`);
+    } catch (error) {
+      if (error instanceof Error && error.name === "ConflictException" && error.message.includes("Archive already exists")) {
+        console.log(
+          "Archive was created concurrently, fetching existing archive..."
+        );
+        const listCommand = new ListArchivesCommand({});
+        const listResult = await mailManagerClient.send(listCommand);
+        const existingArchive = listResult.Archives?.find(
+          (archive) => archive.ArchiveName === archiveName
+        );
+        if (!existingArchive?.ArchiveId) {
+          throw new Error(
+            `Archive exists but couldn't find it: ${archiveName}`
+          );
+        }
+        archiveId = existingArchive.ArchiveId;
+        const getCommand = new GetArchiveCommand({ ArchiveId: archiveId });
+        const getResult = await mailManagerClient.send(getCommand);
+        archiveArn = getResult.ArchiveArn;
+      } else {
+        throw error;
+      }
+    }
+  }
+  if (!archiveArn) {
+    const identity = await import("@aws-sdk/client-sts").then(
+      (m) => new m.STSClient({ region }).send(new m.GetCallerIdentityCommand({}))
+    );
+    const accountId = identity.Account;
+    archiveArn = `arn:aws:ses:${region}:${accountId}:mailmanager-archive/${archiveId}`;
+  }
+  const configSetName = await new Promise((resolve) => {
+    config.configSetName.apply((name) => {
+      resolve(name);
+    });
+  });
+  const putArchivingOptionsCommand = new PutConfigurationSetArchivingOptionsCommand({
+    ConfigurationSetName: configSetName,
+    ArchiveArn: archiveArn
+  });
+  await sesClient.send(putArchivingOptionsCommand);
+  if (!(archiveId && archiveArn)) {
+    throw new Error("Failed to get archive ID or ARN");
+  }
+  return {
+    archiveId,
+    archiveArn,
+    kmsKeyArn
+  };
+}
+var init_mail_manager = __esm({
+  "src/infrastructure/resources/mail-manager.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/utils/errors.ts
 import * as clack from "@clack/prompts";
 import pc from "picocolors";
@@ -221,14 +380,49 @@ var init_aws = __esm({
 function estimateStorageSize(emailsPerMonth, retention, numEventTypes = 8) {
   const avgRecordSizeKB = 2;
   const retentionMonths = {
-    "7days": 0.25,
-    "30days": 1,
-    "90days": 3,
+    "3months": 3,
+    "6months": 6,
+    "9months": 9,
+    "1year": 12,
+    "18months": 18,
+    "2years": 24,
+    "30months": 30,
+    "3years": 36,
+    "4years": 48,
+    "5years": 60,
+    "6years": 72,
+    "7years": 84,
+    "8years": 96,
+    "9years": 108,
+    "10years": 120,
+    permanent: 120
+    // Assume 10 years for cost estimation
+  }[retention];
+  const totalKB = emailsPerMonth * numEventTypes * (retentionMonths ?? 12) * avgRecordSizeKB;
+  return totalKB / 1024 / 1024;
+}
+function estimateArchiveStorageSize(emailsPerMonth, retention) {
+  const avgEmailSizeKB = 50;
+  const retentionMonths = {
+    "3months": 3,
+    "6months": 6,
+    "9months": 9,
     "1year": 12,
-    indefinite: 24
-    // Assume 2 years for cost estimation
+    "18months": 18,
+    "2years": 24,
+    "30months": 30,
+    "3years": 36,
+    "4years": 48,
+    "5years": 60,
+    "6years": 72,
+    "7years": 84,
+    "8years": 96,
+    "9years": 108,
+    "10years": 120,
+    permanent: 120
+    // Assume 10 years for cost estimation
   }[retention];
-  const totalKB = emailsPerMonth * numEventTypes * retentionMonths * avgRecordSizeKB;
+  const totalKB = emailsPerMonth * (retentionMonths ?? 12) * avgEmailSizeKB;
   return totalKB / 1024 / 1024;
 }
 function calculateEventTrackingCost(config, emailsPerMonth) {
@@ -265,7 +459,7 @@ function calculateDynamoDBCost(config, emailsPerMonth) {
   if (!config.eventTracking?.dynamoDBHistory) {
     return;
   }
-  const retention = config.eventTracking.archiveRetention || "90days";
+  const retention = config.eventTracking.archiveRetention || "3months";
   const numEventTypes = config.eventTracking.events?.length || 8;
   const totalEvents = emailsPerMonth * numEventTypes;
   const writeCost = Math.max(0, totalEvents - FREE_TIER.DYNAMODB_WRITES) / 1e6 * AWS_PRICING.DYNAMODB_WRITE_PER_MILLION;
@@ -307,19 +501,35 @@ function calculateDedicatedIpCost(config) {
     description: "Dedicated IP address (requires 100k+ emails/day for warmup)"
   };
 }
+function calculateEmailArchivingCost(config, emailsPerMonth) {
+  if (!config.emailArchiving?.enabled) {
+    return;
+  }
+  const retention = config.emailArchiving.retention;
+  const storageGB = estimateArchiveStorageSize(emailsPerMonth, retention);
+  const monthlyDataGB = emailsPerMonth * 50 / 1024 / 1024;
+  const ingestionCost = monthlyDataGB * AWS_PRICING.MAIL_MANAGER_INGESTION_PER_GB;
+  const storageCost = storageGB * AWS_PRICING.MAIL_MANAGER_STORAGE_PER_GB;
+  return {
+    monthly: ingestionCost + storageCost,
+    description: `Email archiving (${retention}, ~${storageGB.toFixed(2)} GB at steady-state)`
+  };
+}
 function calculateCosts(config, emailsPerMonth = 1e4) {
   const tracking = calculateTrackingCost(config);
   const reputationMetrics = calculateReputationMetricsCost(config);
   const eventTracking = calculateEventTrackingCost(config, emailsPerMonth);
   const dynamoDBHistory = calculateDynamoDBCost(config, emailsPerMonth);
+  const emailArchiving = calculateEmailArchivingCost(config, emailsPerMonth);
   const dedicatedIp = calculateDedicatedIpCost(config);
   const sesEmailCost = Math.max(0, emailsPerMonth - FREE_TIER.SES_EMAILS) * AWS_PRICING.SES_PER_EMAIL;
-  const totalMonthlyCost = sesEmailCost + (tracking?.monthly || 0) + (reputationMetrics?.monthly || 0) + (eventTracking?.monthly || 0) + (dynamoDBHistory?.monthly || 0) + (dedicatedIp?.monthly || 0);
+  const totalMonthlyCost = sesEmailCost + (tracking?.monthly || 0) + (reputationMetrics?.monthly || 0) + (eventTracking?.monthly || 0) + (dynamoDBHistory?.monthly || 0) + (emailArchiving?.monthly || 0) + (dedicatedIp?.monthly || 0);
   return {
     tracking,
     reputationMetrics,
     eventTracking,
     dynamoDBHistory,
+    emailArchiving,
     dedicatedIp,
     total: {
       monthly: totalMonthlyCost,
@@ -366,6 +576,11 @@ function getCostSummary(config, emailsPerMonth = 1e4) {
       `  - ${costs.dynamoDBHistory.description}: ${formatCost(costs.dynamoDBHistory.monthly)}`
     );
   }
+  if (costs.emailArchiving) {
+    lines.push(
+      `  - ${costs.emailArchiving.description}: ${formatCost(costs.emailArchiving.monthly)}`
+    );
+  }
   if (costs.dedicatedIp) {
     lines.push(
       `  - ${costs.dedicatedIp.description}: ${formatCost(costs.dedicatedIp.monthly)}`
@@ -408,8 +623,13 @@ var init_costs = __esm({
       // CloudWatch pricing
       CLOUDWATCH_LOGS_PER_GB: 0.5,
       // $0.50 per GB ingested
-      CLOUDWATCH_LOGS_STORAGE_PER_GB: 0.03
+      CLOUDWATCH_LOGS_STORAGE_PER_GB: 0.03,
       // $0.03 per GB-month
+      // SES Mail Manager Archiving
+      MAIL_MANAGER_INGESTION_PER_GB: 2,
+      // $2.00 per GB ingested
+      MAIL_MANAGER_STORAGE_PER_GB: 0.19
+      // $0.19 per GB-month
     };
     FREE_TIER = {
       // SES: 3,000 emails/month for first 12 months (new AWS accounts only)
@@ -487,7 +707,8 @@ function getPresetInfo(preset) {
       features: [
         "Open & click tracking",
         "TLS encryption required",
-        "Automatic bounce/complaint suppression"
+        "Automatic bounce/complaint suppression",
+        "Optional: Email archiving (full content storage)"
       ]
     },
     production: {
@@ -499,7 +720,8 @@ function getPresetInfo(preset) {
         "Everything in Starter",
         "Reputation metrics dashboard",
         "Real-time event tracking (EventBridge)",
-        "90-day email history storage",
+        "3-month email history storage",
+        "Optional: Email archiving with rendered viewer",
         "Complete event visibility"
       ]
     },
@@ -512,6 +734,7 @@ function getPresetInfo(preset) {
         "Everything in Production",
         "Dedicated IP address",
         "1-year email history",
+        "Optional: 1-year+ email archiving",
         "All event types tracked",
         "Priority support eligibility"
       ]
@@ -566,9 +789,9 @@ function validateConfig(config) {
       "\u{1F4A1} Event tracking is enabled but history storage is disabled. Events will only be available in real-time."
     );
   }
-  if (config.eventTracking?.archiveRetention === "indefinite") {
+  if (config.eventTracking?.archiveRetention === "permanent") {
     warnings.push(
-      "\u26A0\uFE0F  Indefinite retention can become expensive. Consider 90-day or 1-year retention."
+      "\u26A0\uFE0F  Permanent retention can become expensive. Consider 3-month or 1-year retention."
     );
   }
   return warnings;
@@ -594,6 +817,11 @@ var init_presets = __esm({
       eventTracking: {
         enabled: false
       },
+      // Email archiving disabled by default
+      emailArchiving: {
+        enabled: false,
+        retention: "3months"
+      },
       sendingEnabled: true
     };
     PRODUCTION_PRESET = {
@@ -622,7 +850,13 @@ var init_presets = __esm({
           "RENDERING_FAILURE"
         ],
         dynamoDBHistory: true,
-        archiveRetention: "90days"
+        archiveRetention: "3months"
+      },
+      // Email archiving with 3-month retention
+      emailArchiving: {
+        enabled: false,
+        // User can opt-in
+        retention: "3months"
       },
       sendingEnabled: true
     };
@@ -656,6 +890,12 @@ var init_presets = __esm({
         dynamoDBHistory: true,
         archiveRetention: "1year"
       },
+      // Email archiving with 1-year retention
+      emailArchiving: {
+        enabled: false,
+        // User can opt-in
+        retention: "1year"
+      },
       dedicatedIp: true,
       sendingEnabled: true
     };
@@ -672,6 +912,7 @@ __export(prompts_exports, {
   promptConflictResolution: () => promptConflictResolution,
   promptCustomConfig: () => promptCustomConfig,
   promptDomain: () => promptDomain,
+  promptEmailArchiving: () => promptEmailArchiving,
   promptEstimatedVolume: () => promptEstimatedVolume,
   promptFeatureSelection: () => promptFeatureSelection,
   promptIntegrationLevel: () => promptIntegrationLevel,
@@ -1033,6 +1274,59 @@ async function promptEstimatedVolume() {
   }
   return volume;
 }
+async function promptEmailArchiving() {
+  const enabled = await clack3.confirm({
+    message: "Enable email archiving? (Store full email content with HTML for viewing in dashboard)",
+    initialValue: false
+  });
+  if (clack3.isCancel(enabled)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  if (!enabled) {
+    return { enabled: false, retention: "3months" };
+  }
+  const retention = await clack3.select({
+    message: "Email archive retention period:",
+    options: [
+      { value: "7days", label: "7 days", hint: "~$1-2/mo for 10k emails" },
+      { value: "30days", label: "30 days", hint: "~$2-4/mo for 10k emails" },
+      {
+        value: "3months",
+        label: "90 days (recommended)",
+        hint: "~$5-10/mo for 10k emails"
+      },
+      {
+        value: "6months",
+        label: "6 months",
+        hint: "~$15-25/mo for 10k emails"
+      },
+      { value: "1year", label: "1 year", hint: "~$25-40/mo for 10k emails" },
+      {
+        value: "18months",
+        label: "18 months",
+        hint: "~$35-60/mo for 10k emails"
+      }
+    ],
+    initialValue: "3months"
+  });
+  if (clack3.isCancel(retention)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  clack3.log.info(
+    pc3.dim(
+      "Archiving stores full RFC 822 emails with HTML, attachments, and headers"
+    )
+  );
+  clack3.log.info(
+    pc3.dim("Cost: $2/GB ingestion + $0.19/GB/month storage (~50KB per email)")
+  );
+  return {
+    enabled: true,
+    retention
+  };
+}
 async function promptCustomConfig() {
   clack3.log.info("Custom configuration builder");
   clack3.log.info("Configure each feature individually");
@@ -1053,7 +1347,7 @@ async function promptCustomConfig() {
     process.exit(0);
   }
   let dynamoDBHistory = false;
-  let archiveRetention = "90days";
+  let archiveRetention = "3months";
   if (eventTrackingEnabled) {
     dynamoDBHistory = await clack3.confirm({
       message: "Store email history in DynamoDB?",
@@ -1070,7 +1364,7 @@ async function promptCustomConfig() {
           { value: "7days", label: "7 days", hint: "Minimal storage cost" },
           { value: "30days", label: "30 days", hint: "Development/testing" },
           {
-            value: "90days",
+            value: "3months",
             label: "90 days (recommended)",
             hint: "Standard retention"
           },
@@ -1112,6 +1406,53 @@ async function promptCustomConfig() {
     clack3.cancel("Operation cancelled.");
     process.exit(0);
   }
+  const emailArchivingEnabled = await clack3.confirm({
+    message: "Enable email archiving? (Store full email content with HTML for viewing)",
+    initialValue: false
+  });
+  if (clack3.isCancel(emailArchivingEnabled)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  let emailArchiveRetention = "3months";
+  if (emailArchivingEnabled) {
+    emailArchiveRetention = await clack3.select({
+      message: "Email archive retention period:",
+      options: [
+        { value: "7days", label: "7 days", hint: "~$1-2/mo for 10k emails" },
+        { value: "30days", label: "30 days", hint: "~$2-4/mo for 10k emails" },
+        {
+          value: "3months",
+          label: "90 days (recommended)",
+          hint: "~$5-10/mo for 10k emails"
+        },
+        {
+          value: "6months",
+          label: "6 months",
+          hint: "~$15-25/mo for 10k emails"
+        },
+        { value: "1year", label: "1 year", hint: "~$25-40/mo for 10k emails" },
+        {
+          value: "18months",
+          label: "18 months",
+          hint: "~$35-60/mo for 10k emails"
+        }
+      ],
+      initialValue: "3months"
+    });
+    if (clack3.isCancel(emailArchiveRetention)) {
+      clack3.cancel("Operation cancelled.");
+      process.exit(0);
+    }
+    clack3.log.info(
+      pc3.dim(
+        "Note: Archiving stores full RFC 822 emails with HTML, attachments, and headers"
+      )
+    );
+    clack3.log.info(
+      pc3.dim("Cost: $2/GB ingestion + $0.19/GB/month storage (~50KB per email)")
+    );
+  }
   return {
     tracking: trackingEnabled ? {
       enabled: true,
@@ -1138,8 +1479,12 @@ async function promptCustomConfig() {
         "RENDERING_FAILURE"
       ],
       dynamoDBHistory: Boolean(dynamoDBHistory),
-      archiveRetention: typeof archiveRetention === "string" ? archiveRetention : "90days"
+      archiveRetention: typeof archiveRetention === "string" ? archiveRetention : "3months"
     } : { enabled: false },
+    emailArchiving: emailArchivingEnabled ? {
+      enabled: true,
+      retention: typeof emailArchiveRetention === "string" ? emailArchiveRetention : "3months"
+    } : { enabled: false, retention: "3months" },
     dedicatedIp,
     sendingEnabled: true
   };
@@ -1184,6 +1529,219 @@ var init_assume_role = __esm({
   }
 });
 
+// src/utils/archive.ts
+import {
+  GetArchiveMessageCommand,
+  GetArchiveSearchResultsCommand,
+  MailManagerClient as MailManagerClient2,
+  StartArchiveSearchCommand
+} from "@aws-sdk/client-mailmanager";
+import { simpleParser } from "mailparser";
+function extractArchiveId(archiveArnOrId) {
+  if (archiveArnOrId.startsWith("arn:")) {
+    const parts = archiveArnOrId.split("/");
+    return parts.at(-1);
+  }
+  return archiveArnOrId;
+}
+async function getArchivedEmail(archiveArnOrId, searchCriteria, region) {
+  const client = new MailManagerClient2({ region });
+  const archiveId = extractArchiveId(archiveArnOrId);
+  const searchTime = searchCriteria.timestamp || /* @__PURE__ */ new Date();
+  const dayBefore = new Date(searchTime.getTime() - 24 * 60 * 60 * 1e3);
+  const dayAfter = new Date(searchTime.getTime() + 24 * 60 * 60 * 1e3);
+  const filters = [];
+  if (searchCriteria.from) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "FROM"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.from]
+      }
+    });
+  }
+  if (searchCriteria.to) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "TO"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.to]
+      }
+    });
+  }
+  if (searchCriteria.subject) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "SUBJECT"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.subject]
+      }
+    });
+  }
+  if (filters.length === 0) {
+    throw new Error(
+      "At least one search criterion (from, to, or subject) is required"
+    );
+  }
+  const searchCommand = new StartArchiveSearchCommand({
+    ArchiveId: archiveId,
+    FromTimestamp: dayBefore,
+    ToTimestamp: dayAfter,
+    Filters: {
+      Include: filters
+    },
+    MaxResults: 10
+    // Get a few results in case there are multiple matches
+  });
+  const searchResponse = await client.send(searchCommand);
+  const searchId = searchResponse.SearchId;
+  if (!searchId) {
+    throw new Error("Failed to start archive search");
+  }
+  let archivedMessageId;
+  let attempts = 0;
+  const maxAttempts = 20;
+  const pollInterval = 1e3;
+  await new Promise((resolve) => setTimeout(resolve, 1e3));
+  while (attempts < maxAttempts) {
+    try {
+      const resultsCommand = new GetArchiveSearchResultsCommand({
+        SearchId: searchId
+      });
+      const resultsResponse = await client.send(resultsCommand);
+      if (resultsResponse.Rows && resultsResponse.Rows.length > 0) {
+        archivedMessageId = resultsResponse.Rows[0].ArchivedMessageId;
+        break;
+      }
+      if (resultsResponse.Rows && resultsResponse.Rows.length === 0) {
+        break;
+      }
+    } catch (error) {
+      if (error instanceof Error && error.name === "ConflictException" && error.message.includes("still in progress")) {
+        console.log(`Search still in progress, attempt ${attempts + 1}...`);
+      } else {
+        throw error;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    attempts++;
+  }
+  if (!archivedMessageId) {
+    throw new Error(
+      "Email not found in archive with the provided search criteria. It may have been sent before archiving was enabled."
+    );
+  }
+  const command2 = new GetArchiveMessageCommand({
+    ArchivedMessageId: archivedMessageId
+  });
+  const response = await client.send(command2);
+  if (!response.MessageDownloadLink) {
+    throw new Error("No download link available for archived message");
+  }
+  const emailResponse = await fetch(response.MessageDownloadLink);
+  if (!emailResponse.ok) {
+    throw new Error(`Failed to download email: ${emailResponse.statusText}`);
+  }
+  const emailRaw = await emailResponse.text();
+  const parsed = await simpleParser(emailRaw);
+  const attachments = parsed.attachments?.map((att) => ({
+    filename: att.filename,
+    contentType: att.contentType,
+    size: att.size
+  })) || [];
+  const headers = {};
+  if (parsed.headers) {
+    for (const [key, value] of parsed.headers) {
+      if (value instanceof Date) {
+        headers[key] = value.toISOString();
+      } else if (typeof value === "string") {
+        headers[key] = value;
+      } else if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        headers[key] = value;
+      } else {
+        headers[key] = JSON.stringify(value);
+      }
+    }
+  }
+  const getAddressText = (addr) => {
+    if (!addr) return "";
+    if (Array.isArray(addr)) {
+      return addr.map((a) => a.text).join(", ");
+    }
+    return addr.text || "";
+  };
+  return {
+    messageId: parsed.messageId || headers["message-id"]?.toString() || "",
+    from: getAddressText(parsed.from),
+    to: getAddressText(parsed.to),
+    subject: parsed.subject || "",
+    html: parsed.html || void 0,
+    text: parsed.text || void 0,
+    attachments,
+    headers,
+    timestamp: parsed.date || /* @__PURE__ */ new Date(),
+    // Note: MessageMetadata is not available in GetArchiveMessageCommandOutput
+    // These fields would need to be retrieved separately if needed
+    metadata: {}
+  };
+}
+var init_archive = __esm({
+  "src/utils/archive.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/console/services/email-archive.ts
+var email_archive_exports = {};
+__export(email_archive_exports, {
+  fetchArchivedEmail: () => fetchArchivedEmail
+});
+async function fetchArchivedEmail(messageId, options) {
+  const { region, archiveArn, from, to, subject, timestamp } = options;
+  try {
+    console.log("Fetching archived email:", {
+      messageId,
+      archiveArn,
+      region
+    });
+    const searchCriteria = {
+      from,
+      to,
+      subject,
+      timestamp
+    };
+    const email = await getArchivedEmail(archiveArn, searchCriteria, region);
+    console.log("Archived email fetched successfully:", {
+      messageId: email.messageId,
+      hasHtml: !!email.html,
+      hasText: !!email.text,
+      attachmentCount: email.attachments.length
+    });
+    return email;
+  } catch (error) {
+    if (error instanceof Error && (error.message.includes("not found") || error.message.includes("ResourceNotFoundException"))) {
+      console.log("Archived email not found:", messageId);
+      return null;
+    }
+    console.error("Error fetching archived email:", error);
+    throw error;
+  }
+}
+var init_email_archive = __esm({
+  "src/console/services/email-archive.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_archive();
+  }
+});
+
 // src/console/services/dynamodb-metrics.ts
 var dynamodb_metrics_exports = {};
 __export(dynamodb_metrics_exports, {
@@ -1582,6 +2140,26 @@ async function createIAMRole(config) {
       Resource: "arn:aws:sqs:*:*:wraps-email-*"
     });
   }
+  if (config.emailConfig.emailArchiving?.enabled) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        // Archive search operations
+        "ses:StartArchiveSearch",
+        "ses:GetArchiveSearchResults",
+        // Archive message retrieval
+        "ses:GetArchiveMessage",
+        "ses:GetArchiveMessageContent",
+        // Archive metadata
+        "ses:GetArchive",
+        "ses:ListArchives",
+        // Archive export (for future use)
+        "ses:StartArchiveExport",
+        "ses:GetArchiveExport"
+      ],
+      Resource: "arn:aws:ses:*:*:mailmanager-archive/*"
+    });
+  }
   new aws3.iam.RolePolicy("wraps-email-policy", {
     role: role.name,
     policy: JSON.stringify({
@@ -1764,8 +2342,9 @@ async function createSESResources(config) {
   if (config.trackingConfig?.customRedirectDomain) {
     configSetOptions.trackingOptions = {
       customRedirectDomain: config.trackingConfig.customRedirectDomain,
-      httpsPolicy: "REQUIRE"
-      // Always require HTTPS for security
+      // Use OPTIONAL because custom domains don't have SSL certificates by default
+      // AWS's tracking domain (r.{region}.awstrack.me) doesn't have certs for custom domains
+      httpsPolicy: "OPTIONAL"
     };
   }
   const configSet = new aws5.sesv2.ConfigurationSet(
@@ -1957,6 +2536,16 @@ async function deployEmailStack(config) {
       accountId
     });
   }
+  let archiveResources;
+  if (emailConfig.emailArchiving?.enabled && sesResources) {
+    const { createMailManagerArchive: createMailManagerArchive2 } = await Promise.resolve().then(() => (init_mail_manager(), mail_manager_exports));
+    archiveResources = await createMailManagerArchive2({
+      name: "email",
+      retention: emailConfig.emailArchiving.retention,
+      configSetName: sesResources.configSet.configurationSetName,
+      region: config.region
+    });
+  }
   return {
     roleArn: role.arn,
     configSetName: sesResources?.configSet.configurationSetName,
@@ -1970,7 +2559,11 @@ async function deployEmailStack(config) {
     queueUrl: sqsResources?.queue.url,
     dlqUrl: sqsResources?.dlq.url,
     customTrackingDomain: sesResources?.customTrackingDomain,
-    mailFromDomain: sesResources?.mailFromDomain
+    mailFromDomain: sesResources?.mailFromDomain,
+    archiveId: archiveResources?.archiveId,
+    archiveArn: archiveResources?.archiveArn,
+    archivingEnabled: emailConfig.emailArchiving?.enabled,
+    archiveRetention: emailConfig.emailArchiving?.enabled ? emailConfig.emailArchiving.retention : void 0
   };
 }
 
@@ -2282,6 +2875,23 @@ ${domainStrings.join("\n")}`);
       `  ${pc2.dim("\u25CB")} Bounce/Complaint Handling ${pc2.dim("(run 'wraps upgrade' to enable)")}`
     );
   }
+  if (status2.resources.archivingEnabled) {
+    const retentionLabel = {
+      "7days": "7 days",
+      "30days": "30 days",
+      "3months": "90 days",
+      "6months": "6 months",
+      "1year": "1 year",
+      "18months": "18 months"
+    }[status2.resources.archiveRetention || "3months"] || "90 days";
+    featureLines.push(
+      `  ${pc2.green("\u2713")} Email Archiving ${pc2.dim(`(${retentionLabel} retention)`)}`
+    );
+  } else {
+    featureLines.push(
+      `  ${pc2.dim("\u25CB")} Email Archiving ${pc2.dim("(run 'wraps upgrade' to enable)")}`
+    );
+  }
   featureLines.push(
     `  ${pc2.green("\u2713")} Console Dashboard ${pc2.dim("(run 'wraps console')")}`
   );
@@ -2314,6 +2924,11 @@ ${domainStrings.join("\n")}`);
       `  ${pc2.green("\u2713")} SNS Topics: ${pc2.cyan(`${status2.resources.snsTopics} configured`)}`
     );
   }
+  if (status2.resources.archiveArn) {
+    resourceLines.push(
+      `  ${pc2.green("\u2713")} Mail Manager Archive: ${pc2.cyan(status2.resources.archiveArn)}`
+    );
+  }
   clack2.note(resourceLines.join("\n"), "Resources");
   const domainsNeedingDNS = status2.domains.filter(
     (d) => d.status === "pending" && d.dkimTokens || d.mailFromDomain && d.mailFromStatus !== "SUCCESS"
@@ -2336,7 +2951,9 @@ ${domainStrings.join("\n")}`);
         );
       }
       if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
-        if (dnsLines.length > 0) dnsLines.push("");
+        if (dnsLines.length > 0) {
+          dnsLines.push("");
+        }
         dnsLines.push(
           pc2.bold("MAIL FROM Domain Records (for DMARC alignment):"),
           `  ${pc2.cyan(domain.mailFromDomain)} ${pc2.dim("MX")} "10 feedback-smtp.${status2.region}.amazonses.com"`,
@@ -2855,7 +3472,7 @@ import { Router as createRouter } from "express";
 init_esm_shims();
 init_assume_role();
 import { GetSendQuotaCommand, SESClient as SESClient3 } from "@aws-sdk/client-ses";
-import { GetEmailIdentityCommand, SESv2Client } from "@aws-sdk/client-sesv2";
+import { GetEmailIdentityCommand, SESv2Client as SESv2Client2 } from "@aws-sdk/client-sesv2";
 async function fetchSendQuota(roleArn, region) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
   const ses = new SESClient3({ region, credentials });
@@ -2868,7 +3485,7 @@ async function fetchSendQuota(roleArn, region) {
 }
 async function fetchDomainInfo(roleArn, region, domain) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
-  const sesv22 = new SESv2Client({ region, credentials });
+  const sesv22 = new SESv2Client2({ region, credentials });
   const response = await sesv22.send(
     new GetEmailIdentityCommand({
       EmailIdentity: domain
@@ -3271,6 +3888,68 @@ function createEmailsRouter(config) {
       res.status(500).json({ error: errorMessage });
     }
   });
+  router.get("/:id/archive", async (req, res) => {
+    try {
+      const { id } = req.params;
+      console.log("Archived email request received for message ID:", id);
+      if (!config.archivingEnabled) {
+        console.log("Email archiving not enabled");
+        return res.status(400).json({
+          error: "Email archiving not enabled for this deployment."
+        });
+      }
+      if (!config.archiveArn) {
+        console.log("No archive ARN configured");
+        return res.status(400).json({
+          error: "Archive ARN not configured."
+        });
+      }
+      if (!config.tableName) {
+        console.log("No table name configured");
+        return res.status(400).json({
+          error: "Email tracking not enabled. Need email metadata to search archive."
+        });
+      }
+      console.log("Fetching email metadata from DynamoDB...");
+      const emailDetails = await fetchEmailById(id, {
+        region: config.region,
+        tableName: config.tableName
+      });
+      if (!emailDetails) {
+        console.log("Email metadata not found in DynamoDB for ID:", id);
+        return res.status(404).json({
+          error: "Email metadata not found. Cannot search archive."
+        });
+      }
+      console.log("Fetching archived email from Mail Manager...");
+      const { fetchArchivedEmail: fetchArchivedEmail2 } = await Promise.resolve().then(() => (init_email_archive(), email_archive_exports));
+      const archivedEmail = await fetchArchivedEmail2(id, {
+        region: config.region,
+        archiveArn: config.archiveArn,
+        from: emailDetails.from,
+        to: emailDetails.to[0],
+        // Use first recipient for search
+        subject: emailDetails.subject,
+        timestamp: new Date(emailDetails.sentAt)
+      });
+      if (!archivedEmail) {
+        console.log("Archived email not found for message ID:", id);
+        return res.status(404).json({
+          error: "Archived email not found. It may have been sent before archiving was enabled."
+        });
+      }
+      console.log("Archived email found:", archivedEmail.messageId);
+      res.json(archivedEmail);
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      console.error("Error fetching archived email:", error);
+      console.error(
+        "Stack trace:",
+        error instanceof Error ? error.stack : "N/A"
+      );
+      res.status(500).json({ error: errorMessage });
+    }
+  });
   return router;
 }
 
@@ -3498,11 +4177,11 @@ init_assume_role();
 import {
   GetConfigurationSetCommand,
   GetEmailIdentityCommand as GetEmailIdentityCommand2,
-  SESv2Client as SESv2Client2
+  SESv2Client as SESv2Client3
 } from "@aws-sdk/client-sesv2";
 async function fetchConfigurationSet(roleArn, region, configSetName) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
-  const sesv22 = new SESv2Client2({ region, credentials });
+  const sesv22 = new SESv2Client3({ region, credentials });
   const response = await sesv22.send(
     new GetConfigurationSetCommand({
       ConfigurationSetName: configSetName
@@ -3532,7 +4211,7 @@ async function fetchConfigurationSet(roleArn, region, configSetName) {
 }
 async function fetchEmailIdentity(roleArn, region, identityName) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
-  const sesv22 = new SESv2Client2({ region, credentials });
+  const sesv22 = new SESv2Client3({ region, credentials });
   const response = await sesv22.send(
     new GetEmailIdentityCommand2({
       EmailIdentity: identityName
@@ -3557,7 +4236,9 @@ async function fetchEmailIdentity(roleArn, region, identityName) {
     verifiedForSendingStatus: response.VerifiedForSendingStatus ?? false,
     tags: response.Tags?.reduce(
       (acc, tag) => {
-        if (tag.Key) acc[tag.Key] = tag.Value || "";
+        if (tag.Key) {
+          acc[tag.Key] = tag.Value || "";
+        }
         return acc;
       },
       {}
@@ -3590,6 +4271,20 @@ async function fetchEmailSettings(roleArn, region, configSetName, domain) {
 // src/console/routes/settings.ts
 function createSettingsRouter(config) {
   const router = createRouter4();
+  router.get("/deployment", async (_req, res) => {
+    try {
+      res.json({
+        archivingEnabled: config.archivingEnabled ?? false,
+        archiveArn: config.archiveArn,
+        tableName: config.tableName,
+        region: config.region
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      console.error("Error fetching deployment config:", error);
+      res.status(500).json({ error: errorMessage });
+    }
+  });
   router.get("/", async (_req, res) => {
     try {
       const metadata = await loadConnectionMetadata(
@@ -3708,10 +4403,10 @@ function createSettingsRouter(config) {
       console.log(
         `[Settings] Updating sending options for ${configSetName}: ${enabled}`
       );
-      const { SESv2Client: SESv2Client4, PutConfigurationSetSendingOptionsCommand } = await import("@aws-sdk/client-sesv2");
+      const { SESv2Client: SESv2Client5, PutConfigurationSetSendingOptionsCommand } = await import("@aws-sdk/client-sesv2");
       const { assumeRole: assumeRole2 } = await Promise.resolve().then(() => (init_assume_role(), assume_role_exports));
       const credentials = config.roleArn ? await assumeRole2(config.roleArn, config.region) : void 0;
-      const sesClient = new SESv2Client4({ region: config.region, credentials });
+      const sesClient = new SESv2Client5({ region: config.region, credentials });
       await sesClient.send(
         new PutConfigurationSetSendingOptionsCommand({
           ConfigurationSetName: configSetName,
@@ -3745,10 +4440,10 @@ function createSettingsRouter(config) {
       console.log(
         `[Settings] Updating reputation options for ${configSetName}: ${enabled}`
       );
-      const { SESv2Client: SESv2Client4, PutConfigurationSetReputationOptionsCommand } = await import("@aws-sdk/client-sesv2");
+      const { SESv2Client: SESv2Client5, PutConfigurationSetReputationOptionsCommand } = await import("@aws-sdk/client-sesv2");
       const { assumeRole: assumeRole2 } = await Promise.resolve().then(() => (init_assume_role(), assume_role_exports));
       const credentials = config.roleArn ? await assumeRole2(config.roleArn, config.region) : void 0;
-      const sesClient = new SESv2Client4({ region: config.region, credentials });
+      const sesClient = new SESv2Client5({ region: config.region, credentials });
       await sesClient.send(
         new PutConfigurationSetReputationOptionsCommand({
           ConfigurationSetName: configSetName,
@@ -3788,10 +4483,10 @@ function createSettingsRouter(config) {
         console.log(
           `[Settings] Updating tracking domain for ${configSetName}: ${domain}`
         );
-        const { SESv2Client: SESv2Client4, PutConfigurationSetTrackingOptionsCommand } = await import("@aws-sdk/client-sesv2");
+        const { SESv2Client: SESv2Client5, PutConfigurationSetTrackingOptionsCommand } = await import("@aws-sdk/client-sesv2");
         const { assumeRole: assumeRole2 } = await Promise.resolve().then(() => (init_assume_role(), assume_role_exports));
         const credentials = config.roleArn ? await assumeRole2(config.roleArn, config.region) : void 0;
-        const sesClient = new SESv2Client4({
+        const sesClient = new SESv2Client5({
           region: config.region,
           credentials
         });
@@ -3965,6 +4660,8 @@ async function runConsole(options) {
     process.exit(1);
   }
   const tableName = stackOutputs.tableName?.value;
+  const archiveArn = stackOutputs.archiveArn?.value;
+  const archivingEnabled = stackOutputs.archivingEnabled?.value ?? false;
   const port = options.port || await getPort({ port: [5555, 5556, 5557, 5558, 5559] });
   progress.stop();
   clack5.log.success("Starting console server...");
@@ -3978,7 +4675,9 @@ async function runConsole(options) {
     region,
     tableName,
     accountId: identity.accountId,
-    noOpen: options.noOpen ?? false
+    noOpen: options.noOpen ?? false,
+    archiveArn,
+    archivingEnabled
   });
   console.log(`\\n${pc5.bold("Console:")} ${pc5.cyan(url)}`);
   console.log(`${pc5.dim("Press Ctrl+C to stop")}\\n`);
@@ -4118,17 +4817,22 @@ async function init(options) {
     emailConfig = await promptCustomConfig();
   } else {
     emailConfig = getPreset(preset);
+    const { promptEmailArchiving: promptEmailArchiving2 } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
+    const archivingConfig = await promptEmailArchiving2();
+    emailConfig.emailArchiving = archivingConfig;
   }
   if (domain) {
     emailConfig.domain = domain;
   }
   const estimatedVolume = await promptEstimatedVolume();
-  progress.info("\n" + pc7.bold("Cost Estimate:"));
+  progress.info(`
+${pc7.bold("Cost Estimate:")}`);
   const costSummary = getCostSummary(emailConfig, estimatedVolume);
   clack7.log.info(costSummary);
   const warnings = validateConfig(emailConfig);
   if (warnings.length > 0) {
-    progress.info("\n" + pc7.yellow(pc7.bold("Configuration Warnings:")));
+    progress.info(`
+${pc7.yellow(pc7.bold("Configuration Warnings:"))}`);
     for (const warning of warnings) {
       clack7.log.warn(warning);
     }
@@ -4176,7 +4880,11 @@ async function init(options) {
                 lambdaFunctions: result.lambdaFunctions,
                 domain: result.domain,
                 dkimTokens: result.dkimTokens,
-                customTrackingDomain: result.customTrackingDomain
+                customTrackingDomain: result.customTrackingDomain,
+                mailFromDomain: result.mailFromDomain,
+                archiveArn: result.archiveArn,
+                archivingEnabled: result.archivingEnabled,
+                archiveRetention: result.archiveRetention
               };
             }
           },
@@ -4205,7 +4913,11 @@ async function init(options) {
           lambdaFunctions: pulumiOutputs.lambdaFunctions?.value,
           domain: pulumiOutputs.domain?.value,
           dkimTokens: pulumiOutputs.dkimTokens?.value,
-          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value
+          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value,
+          mailFromDomain: pulumiOutputs.mailFromDomain?.value,
+          archiveArn: pulumiOutputs.archiveArn?.value,
+          archivingEnabled: pulumiOutputs.archivingEnabled?.value,
+          archiveRetention: pulumiOutputs.archiveRetention?.value
         };
       }
     );
@@ -4402,8 +5114,8 @@ Run ${pc9.cyan("wraps init")} to deploy infrastructure.
     process.exit(1);
   }
   const domains = await listSESDomains(region);
-  const { SESv2Client: SESv2Client4, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
-  const sesv2Client = new SESv2Client4({ region });
+  const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
+  const sesv2Client = new SESv2Client5({ region });
   const domainsWithTokens = await Promise.all(
     domains.map(async (d) => {
       try {
@@ -4439,7 +5151,10 @@ Run ${pc9.cyan("wraps init")} to deploy infrastructure.
       configSetName: stackOutputs.configSetName?.value,
       tableName: stackOutputs.tableName?.value,
       lambdaFunctions: stackOutputs.lambdaFunctions?.value?.length || 0,
-      snsTopics: integrationLevel === "enhanced" ? 1 : 0
+      snsTopics: integrationLevel === "enhanced" ? 1 : 0,
+      archiveArn: stackOutputs.archiveArn?.value,
+      archivingEnabled: stackOutputs.archivingEnabled?.value,
+      archiveRetention: stackOutputs.archiveRetention?.value
     }
   });
 }
@@ -4561,7 +5276,11 @@ ${pc10.bold("Current Configuration:")}
                 lambdaFunctions: result.lambdaFunctions,
                 domain: result.domain,
                 dkimTokens: result.dkimTokens,
-                customTrackingDomain: result.customTrackingDomain
+                customTrackingDomain: result.customTrackingDomain,
+                mailFromDomain: result.mailFromDomain,
+                archiveArn: result.archiveArn,
+                archivingEnabled: result.archivingEnabled,
+                archiveRetention: result.archiveRetention
               };
             }
           },
@@ -4588,7 +5307,11 @@ ${pc10.bold("Current Configuration:")}
           lambdaFunctions: pulumiOutputs.lambdaFunctions?.value,
           domain: pulumiOutputs.domain?.value,
           dkimTokens: pulumiOutputs.dkimTokens?.value,
-          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value
+          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value,
+          mailFromDomain: pulumiOutputs.mailFromDomain?.value,
+          archiveArn: pulumiOutputs.archiveArn?.value,
+          archivingEnabled: pulumiOutputs.archivingEnabled?.value,
+          archiveRetention: pulumiOutputs.archiveRetention?.value
         };
       }
     );
@@ -4699,13 +5422,34 @@ ${pc11.bold("Current Configuration:")}
     console.log(`  ${pc11.green("\u2713")} Event Tracking (EventBridge)`);
     if (config.eventTracking.dynamoDBHistory) {
       console.log(
-        `    ${pc11.dim("\u2514\u2500")} Email History: ${pc11.cyan(config.eventTracking.archiveRetention || "90days")}`
+        `    ${pc11.dim("\u2514\u2500")} Email History: ${pc11.cyan(config.eventTracking.archiveRetention || "3months")}`
       );
     }
   }
   if (config.dedicatedIp) {
     console.log(`  ${pc11.green("\u2713")} Dedicated IP Address`);
   }
+  if (config.emailArchiving?.enabled) {
+    const retentionLabel = {
+      "3months": "3 months",
+      "6months": "6 months",
+      "9months": "9 months",
+      "1year": "1 year",
+      "18months": "18 months",
+      "2years": "2 years",
+      "30months": "30 months",
+      "3years": "3 years",
+      "4years": "4 years",
+      "5years": "5 years",
+      "6years": "6 years",
+      "7years": "7 years",
+      "8years": "8 years",
+      "9years": "9 years",
+      "10years": "10 years",
+      permanent: "permanent"
+    }[config.emailArchiving.retention] || "3 months";
+    console.log(`  ${pc11.green("\u2713")} Email Archiving (${retentionLabel})`);
+  }
   const currentCostData = calculateCosts(config, 5e4);
   console.log(
     `
@@ -4720,6 +5464,11 @@ ${pc11.bold("Current Configuration:")}
         label: "Upgrade to a different preset",
         hint: "Starter \u2192 Production \u2192 Enterprise"
       },
+      {
+        value: "archiving",
+        label: config.emailArchiving?.enabled ? "Change email archiving settings" : "Enable email archiving",
+        hint: config.emailArchiving?.enabled ? "Update retention or disable" : "Store full email content with HTML"
+      },
       {
         value: "tracking-domain",
         label: "Add/change custom tracking domain",
@@ -4728,7 +5477,7 @@ ${pc11.bold("Current Configuration:")}
       {
         value: "retention",
         label: "Change email history retention",
-        hint: "7 days, 30 days, 90 days, 1 year, indefinite"
+        hint: "7 days, 30 days, 90 days, 6 months, 1 year, 18 months"
       },
       {
         value: "events",
@@ -4786,6 +5535,196 @@ ${pc11.bold("Current Configuration:")}
       newPreset = selectedPreset;
       break;
     }
+    case "archiving": {
+      if (config.emailArchiving?.enabled) {
+        const archivingAction = await clack11.select({
+          message: "What would you like to do with email archiving?",
+          options: [
+            {
+              value: "change-retention",
+              label: "Change retention period",
+              hint: `Current: ${config.emailArchiving.retention}`
+            },
+            {
+              value: "disable",
+              label: "Disable email archiving",
+              hint: "Stop storing full email content"
+            }
+          ]
+        });
+        if (clack11.isCancel(archivingAction)) {
+          clack11.cancel("Upgrade cancelled.");
+          process.exit(0);
+        }
+        if (archivingAction === "disable") {
+          const confirmDisable = await clack11.confirm({
+            message: "Are you sure? Existing archived emails will remain, but new emails won't be archived.",
+            initialValue: false
+          });
+          if (clack11.isCancel(confirmDisable) || !confirmDisable) {
+            clack11.cancel("Archiving not disabled.");
+            process.exit(0);
+          }
+          updatedConfig = {
+            ...config,
+            emailArchiving: {
+              enabled: false,
+              retention: config.emailArchiving.retention
+            }
+          };
+        } else {
+          const retention = await clack11.select({
+            message: "Email archive retention period:",
+            options: [
+              {
+                value: "3months",
+                label: "3 months (minimum)",
+                hint: "~$5-10/mo for 10k emails"
+              },
+              {
+                value: "6months",
+                label: "6 months",
+                hint: "~$15-25/mo for 10k emails"
+              },
+              {
+                value: "1year",
+                label: "1 year (recommended)",
+                hint: "~$25-40/mo for 10k emails"
+              },
+              {
+                value: "2years",
+                label: "2 years",
+                hint: "~$50-80/mo for 10k emails"
+              },
+              {
+                value: "3years",
+                label: "3 years",
+                hint: "~$75-120/mo for 10k emails"
+              },
+              {
+                value: "5years",
+                label: "5 years",
+                hint: "~$125-200/mo for 10k emails"
+              },
+              {
+                value: "7years",
+                label: "7 years",
+                hint: "~$175-280/mo for 10k emails"
+              },
+              {
+                value: "10years",
+                label: "10 years",
+                hint: "~$250-400/mo for 10k emails"
+              },
+              {
+                value: "permanent",
+                label: "Permanent",
+                hint: "Expensive, not recommended"
+              }
+            ],
+            initialValue: config.emailArchiving.retention
+          });
+          if (clack11.isCancel(retention)) {
+            clack11.cancel("Upgrade cancelled.");
+            process.exit(0);
+          }
+          updatedConfig = {
+            ...config,
+            emailArchiving: {
+              enabled: true,
+              retention
+            }
+          };
+        }
+      } else {
+        const enableArchiving = await clack11.confirm({
+          message: "Enable email archiving? (Store full email content with HTML for viewing)",
+          initialValue: true
+        });
+        if (clack11.isCancel(enableArchiving)) {
+          clack11.cancel("Upgrade cancelled.");
+          process.exit(0);
+        }
+        if (!enableArchiving) {
+          clack11.log.info("Email archiving not enabled.");
+          process.exit(0);
+        }
+        const retention = await clack11.select({
+          message: "Email archive retention period:",
+          options: [
+            {
+              value: "3months",
+              label: "3 months (minimum)",
+              hint: "~$5-10/mo for 10k emails"
+            },
+            {
+              value: "6months",
+              label: "6 months",
+              hint: "~$15-25/mo for 10k emails"
+            },
+            {
+              value: "1year",
+              label: "1 year (recommended)",
+              hint: "~$25-40/mo for 10k emails"
+            },
+            {
+              value: "2years",
+              label: "2 years",
+              hint: "~$50-80/mo for 10k emails"
+            },
+            {
+              value: "3years",
+              label: "3 years",
+              hint: "~$75-120/mo for 10k emails"
+            },
+            {
+              value: "5years",
+              label: "5 years",
+              hint: "~$125-200/mo for 10k emails"
+            },
+            {
+              value: "7years",
+              label: "7 years",
+              hint: "~$175-280/mo for 10k emails"
+            },
+            {
+              value: "10years",
+              label: "10 years",
+              hint: "~$250-400/mo for 10k emails"
+            },
+            {
+              value: "permanent",
+              label: "Permanent",
+              hint: "Expensive, not recommended"
+            }
+          ],
+          initialValue: "3months"
+        });
+        if (clack11.isCancel(retention)) {
+          clack11.cancel("Upgrade cancelled.");
+          process.exit(0);
+        }
+        clack11.log.info(
+          pc11.dim(
+            "Archiving stores full RFC 822 emails with HTML, attachments, and headers"
+          )
+        );
+        clack11.log.info(
+          pc11.dim(
+            "Cost: $2/GB ingestion + $0.19/GB/month storage (~50KB per email)"
+          )
+        );
+        updatedConfig = {
+          ...config,
+          emailArchiving: {
+            enabled: true,
+            retention
+          }
+        };
+      }
+      newPreset = void 0;
+      break;
+    }
     case "tracking-domain": {
       if (!config.domain) {
         clack11.log.error(
@@ -4844,28 +5783,51 @@ ${pc11.bold("Current Configuration:")}
     }
     case "retention": {
       const retention = await clack11.select({
-        message: "Email history retention period:",
+        message: "Email history retention period (event data in DynamoDB):",
         options: [
-          { value: "7days", label: "7 days", hint: "Minimal storage cost" },
-          { value: "30days", label: "30 days", hint: "Development/testing" },
           {
-            value: "90days",
-            label: "90 days (recommended)",
+            value: "3months",
+            label: "3 months (recommended)",
             hint: "Standard retention"
           },
+          {
+            value: "6months",
+            label: "6 months",
+            hint: "Extended retention"
+          },
           { value: "1year", label: "1 year", hint: "Compliance requirements" },
           {
-            value: "indefinite",
-            label: "Indefinite",
-            hint: "Higher storage cost"
+            value: "18months",
+            label: "18 months",
+            hint: "Long-term retention"
+          },
+          {
+            value: "2years",
+            label: "2 years",
+            hint: "Extended compliance"
+          },
+          {
+            value: "permanent",
+            label: "Permanent",
+            hint: "Not recommended (expensive)"
           }
         ],
-        initialValue: config.eventTracking?.archiveRetention || "90days"
+        initialValue: config.eventTracking?.archiveRetention || "3months"
       });
       if (clack11.isCancel(retention)) {
         clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
+      clack11.log.info(
+        pc11.dim(
+          "Note: This is for event data (sent, delivered, opened, etc.) stored in DynamoDB."
+        )
+      );
+      clack11.log.info(
+        pc11.dim(
+          "For full email content storage, use 'Enable email archiving' option."
+        )
+      );
       updatedConfig = {
         ...config,
         eventTracking: {
@@ -5029,7 +5991,10 @@ ${pc11.bold("Cost Impact:")}`);
                 lambdaFunctions: result.lambdaFunctions,
                 domain: result.domain,
                 dkimTokens: result.dkimTokens,
-                customTrackingDomain: result.customTrackingDomain
+                customTrackingDomain: result.customTrackingDomain,
+                archiveArn: result.archiveArn,
+                archivingEnabled: result.archivingEnabled,
+                archiveRetention: result.archiveRetention
               };
             }
           },
@@ -5056,7 +6021,10 @@ ${pc11.bold("Cost Impact:")}`);
           lambdaFunctions: pulumiOutputs.lambdaFunctions?.value,
           domain: pulumiOutputs.domain?.value,
           dkimTokens: pulumiOutputs.dkimTokens?.value,
-          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value
+          customTrackingDomain: pulumiOutputs.customTrackingDomain?.value,
+          archiveArn: pulumiOutputs.archiveArn?.value,
+          archivingEnabled: pulumiOutputs.archivingEnabled?.value,
+          archiveRetention: pulumiOutputs.archiveRetention?.value
         };
       }
     );
@@ -5095,12 +6063,12 @@ ${pc11.green("\u2713")} ${pc11.bold("Upgrade complete!")}
 `);
   if (upgradeAction === "preset" && newPreset) {
     console.log(
-      `Upgraded to ${pc11.cyan(newPreset)} preset (${pc11.green(formatCost(newCostData.total.monthly) + "/mo")})
+      `Upgraded to ${pc11.cyan(newPreset)} preset (${pc11.green(`${formatCost(newCostData.total.monthly)}/mo`)})
 `
     );
   } else {
     console.log(
-      `Updated configuration (${pc11.green(formatCost(newCostData.total.monthly) + "/mo")})
+      `Updated configuration (${pc11.green(`${formatCost(newCostData.total.monthly)}/mo`)})
 `
     );
   }
@@ -5110,14 +6078,14 @@ ${pc11.green("\u2713")} ${pc11.bold("Upgrade complete!")}
 init_esm_shims();
 init_aws();
 import { Resolver } from "dns/promises";
-import { GetEmailIdentityCommand as GetEmailIdentityCommand3, SESv2Client as SESv2Client3 } from "@aws-sdk/client-sesv2";
+import { GetEmailIdentityCommand as GetEmailIdentityCommand3, SESv2Client as SESv2Client4 } from "@aws-sdk/client-sesv2";
 import * as clack12 from "@clack/prompts";
 import pc12 from "picocolors";
 async function verify(options) {
   clack12.intro(pc12.bold(`Verifying ${options.domain}`));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
-  const sesClient = new SESv2Client3({ region });
+  const sesClient = new SESv2Client4({ region });
   let identity;
   let dkimTokens = [];
   let mailFromDomain;