@wraps.dev/cli 1.1.3 → 1.1.5

package/dist/cli.js

@@ -77,6 +77,7 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
     }
   });
+  const dmarcReportEmail = mailFromDomain ? `postmaster@${mailFromDomain}` : `postmaster@${domain}`;
   changes.push({
     Action: "UPSERT",
     ResourceRecordSet: {
@@ -84,7 +85,7 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       Type: "TXT",
       TTL: 1800,
       ResourceRecords: [
-        { Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain}"` }
+        { Value: `"v=DMARC1; p=quarantine; rua=mailto:${dmarcReportEmail}"` }
       ]
     }
   });
@@ -755,6 +756,312 @@ var init_aws = __esm({
   }
 });
 
+// src/utils/shared/fs.ts
+import { existsSync as existsSync2 } from "fs";
+import { mkdir } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+function getWrapsDir() {
+  return join2(homedir(), ".wraps");
+}
+function getPulumiWorkDir() {
+  return join2(getWrapsDir(), "pulumi");
+}
+async function ensureWrapsDir() {
+  const wrapsDir = getWrapsDir();
+  if (!existsSync2(wrapsDir)) {
+    await mkdir(wrapsDir, { recursive: true });
+  }
+}
+async function ensurePulumiWorkDir() {
+  await ensureWrapsDir();
+  const pulumiDir = getPulumiWorkDir();
+  if (!existsSync2(pulumiDir)) {
+    await mkdir(pulumiDir, { recursive: true });
+  }
+  process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
+  process.env.PULUMI_CONFIG_PASSPHRASE = "";
+}
+var init_fs = __esm({
+  "src/utils/shared/fs.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/utils/shared/metadata.ts
+var metadata_exports = {};
+__export(metadata_exports, {
+  addServiceToConnection: () => addServiceToConnection,
+  applyConfigUpdates: () => applyConfigUpdates,
+  connectionExists: () => connectionExists,
+  createConnectionMetadata: () => createConnectionMetadata,
+  deleteConnectionMetadata: () => deleteConnectionMetadata,
+  getConfiguredServices: () => getConfiguredServices,
+  hasService: () => hasService,
+  listConnections: () => listConnections,
+  loadConnectionMetadata: () => loadConnectionMetadata,
+  removeServiceFromConnection: () => removeServiceFromConnection,
+  saveConnectionMetadata: () => saveConnectionMetadata,
+  updateEmailConfig: () => updateEmailConfig,
+  updateServiceConfig: () => updateServiceConfig
+});
+import { existsSync as existsSync3 } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { join as join3 } from "path";
+function getConnectionsDir() {
+  return join3(getWrapsDir(), "connections");
+}
+function getMetadataPath(accountId, region) {
+  return join3(getConnectionsDir(), `${accountId}-${region}.json`);
+}
+async function ensureConnectionsDir() {
+  await ensureWrapsDir();
+  const connectionsDir = getConnectionsDir();
+  if (!existsSync3(connectionsDir)) {
+    const { mkdir: mkdir2 } = await import("fs/promises");
+    await mkdir2(connectionsDir, { recursive: true });
+  }
+}
+function migrateLegacyMetadata(legacy) {
+  return {
+    version: "1.0.0",
+    accountId: legacy.accountId,
+    region: legacy.region,
+    provider: legacy.provider,
+    timestamp: legacy.timestamp,
+    vercel: legacy.vercel,
+    services: {
+      email: {
+        preset: legacy.preset,
+        config: legacy.emailConfig,
+        pulumiStackName: legacy.pulumiStackName,
+        deployedAt: legacy.timestamp
+      }
+    }
+  };
+}
+function isLegacyMetadata(data) {
+  return "emailConfig" in data && !("services" in data) && typeof data.emailConfig === "object";
+}
+async function loadConnectionMetadata(accountId, region) {
+  const metadataPath = getMetadataPath(accountId, region);
+  if (!existsSync3(metadataPath)) {
+    return null;
+  }
+  try {
+    const content = await readFile(metadataPath, "utf-8");
+    const data = JSON.parse(content);
+    if (isLegacyMetadata(data)) {
+      const migrated = migrateLegacyMetadata(data);
+      await saveConnectionMetadata(migrated);
+      return migrated;
+    }
+    if (!data.version) {
+      data.version = "1.0.0";
+      await saveConnectionMetadata(data);
+    }
+    return data;
+  } catch (error) {
+    console.error("Error loading connection metadata:", error.message);
+    return null;
+  }
+}
+async function saveConnectionMetadata(metadata) {
+  await ensureConnectionsDir();
+  const metadataPath = getMetadataPath(metadata.accountId, metadata.region);
+  try {
+    const content = JSON.stringify(metadata, null, 2);
+    await writeFile(metadataPath, content, "utf-8");
+  } catch (error) {
+    console.error("Error saving connection metadata:", error.message);
+    throw error;
+  }
+}
+async function deleteConnectionMetadata(accountId, region) {
+  const metadataPath = getMetadataPath(accountId, region);
+  if (existsSync3(metadataPath)) {
+    const { unlink } = await import("fs/promises");
+    await unlink(metadataPath);
+  }
+}
+async function listConnections() {
+  const connectionsDir = getConnectionsDir();
+  if (!existsSync3(connectionsDir)) {
+    return [];
+  }
+  try {
+    const { readdir } = await import("fs/promises");
+    const files = await readdir(connectionsDir);
+    const connections = [];
+    for (const file of files) {
+      if (file.endsWith(".json")) {
+        const content = await readFile(join3(connectionsDir, file), "utf-8");
+        try {
+          const metadata = JSON.parse(content);
+          connections.push(metadata);
+        } catch (error) {
+          console.error(`Error parsing ${file}:`, error);
+        }
+      }
+    }
+    return connections;
+  } catch (error) {
+    console.error("Error listing connections:", error.message);
+    return [];
+  }
+}
+async function connectionExists(accountId, region) {
+  const metadataPath = getMetadataPath(accountId, region);
+  return existsSync3(metadataPath);
+}
+function createConnectionMetadata(accountId, region, provider, emailConfig, preset) {
+  return {
+    version: "1.0.0",
+    accountId,
+    region,
+    provider,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    services: {
+      email: {
+        preset,
+        config: emailConfig,
+        deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    }
+  };
+}
+function applyConfigUpdates(existingConfig, updates) {
+  const result = { ...existingConfig };
+  for (const [key, value] of Object.entries(updates)) {
+    if (value === void 0) continue;
+    if (key === "tracking" && typeof value === "object") {
+      const trackingUpdate = value;
+      result.tracking = {
+        ...result.tracking,
+        ...trackingUpdate,
+        // Always preserve these if they exist in original
+        customRedirectDomain: result.tracking?.customRedirectDomain || trackingUpdate.customRedirectDomain,
+        httpsEnabled: result.tracking?.httpsEnabled ?? trackingUpdate.httpsEnabled
+      };
+    } else if (key === "eventTracking" && typeof value === "object") {
+      result.eventTracking = {
+        ...result.eventTracking,
+        ...value
+      };
+    } else if (key === "suppressionList" && typeof value === "object") {
+      result.suppressionList = {
+        ...result.suppressionList,
+        ...value
+      };
+    } else if (key === "emailArchiving" && typeof value === "object") {
+      result.emailArchiving = {
+        ...result.emailArchiving,
+        ...value
+      };
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function updateEmailConfig(metadata, emailConfig) {
+  if (!metadata.services.email) {
+    throw new Error("Email service not configured in metadata");
+  }
+  metadata.services.email.config = applyConfigUpdates(
+    metadata.services.email.config,
+    emailConfig
+  );
+  metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+}
+function addServiceToConnection(accountId, region, provider, service, config2, preset, existingMetadata) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  if (existingMetadata) {
+    if (service === "email") {
+      existingMetadata.services.email = {
+        preset,
+        config: config2,
+        deployedAt: timestamp
+      };
+    } else if (service === "sms") {
+      existingMetadata.services.sms = {
+        preset,
+        config: config2,
+        deployedAt: timestamp
+      };
+    }
+    existingMetadata.timestamp = timestamp;
+    return existingMetadata;
+  }
+  const metadata = {
+    version: "1.0.0",
+    accountId,
+    region,
+    provider,
+    timestamp,
+    services: {}
+  };
+  if (service === "email") {
+    metadata.services.email = {
+      preset,
+      config: config2,
+      deployedAt: timestamp
+    };
+  } else if (service === "sms") {
+    metadata.services.sms = {
+      preset,
+      config: config2,
+      deployedAt: timestamp
+    };
+  }
+  return metadata;
+}
+function updateServiceConfig(metadata, service, config2) {
+  if (service === "email" && metadata.services.email) {
+    metadata.services.email.config = {
+      ...metadata.services.email.config,
+      ...config2
+    };
+  } else if (service === "sms" && metadata.services.sms) {
+    metadata.services.sms.config = {
+      ...metadata.services.sms.config,
+      ...config2
+    };
+  } else {
+    throw new Error(`${service} service not configured in metadata`);
+  }
+  metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+}
+function removeServiceFromConnection(metadata, service) {
+  if (service === "email") {
+    const { email, ...rest } = metadata.services;
+    metadata.services = rest;
+  } else if (service === "sms") {
+    const { sms, ...rest } = metadata.services;
+    metadata.services = rest;
+  }
+  metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+}
+function hasService(metadata, service) {
+  if (service === "email") return metadata.services.email !== void 0;
+  if (service === "sms") return metadata.services.sms !== void 0;
+  return false;
+}
+function getConfiguredServices(metadata) {
+  const services = [];
+  if (metadata.services.email) services.push("email");
+  if (metadata.services.sms) services.push("sms");
+  return services;
+}
+var init_metadata = __esm({
+  "src/utils/shared/metadata.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_fs();
+  }
+});
+
 // src/utils/email/costs.ts
 function estimateStorageSize(emailsPerMonth, retention, numEventTypes = 8) {
   const avgRecordSizeKB = 2;
@@ -1712,12 +2019,12 @@ async function promptEmailArchiving() {
     retention
   };
 }
-async function promptCustomConfig() {
+async function promptCustomConfig(existingConfig) {
   clack4.log.info("Custom configuration builder");
   clack4.log.info("Configure each feature individually");
   const trackingEnabled = await clack4.confirm({
     message: "Enable open & click tracking?",
-    initialValue: true
+    initialValue: existingConfig?.tracking?.enabled ?? true
   });
   if (clack4.isCancel(trackingEnabled)) {
     clack4.cancel("Operation cancelled.");
@@ -1725,7 +2032,7 @@ async function promptCustomConfig() {
   }
   const eventTrackingEnabled = await clack4.confirm({
     message: "Enable real-time event tracking (EventBridge)?",
-    initialValue: true
+    initialValue: existingConfig?.eventTracking?.enabled ?? true
   });
   if (clack4.isCancel(eventTrackingEnabled)) {
     clack4.cancel("Operation cancelled.");
@@ -1736,7 +2043,7 @@ async function promptCustomConfig() {
   if (eventTrackingEnabled) {
     dynamoDBHistory = await clack4.confirm({
       message: "Store email history in DynamoDB?",
-      initialValue: true
+      initialValue: existingConfig?.eventTracking?.dynamoDBHistory ?? true
     });
     if (clack4.isCancel(dynamoDBHistory)) {
       clack4.cancel("Operation cancelled.");
@@ -1759,7 +2066,8 @@ async function promptCustomConfig() {
             label: "Indefinite",
             hint: "Higher storage cost"
           }
-        ]
+        ],
+        initialValue: existingConfig?.eventTracking?.archiveRetention || "90days"
       });
       if (clack4.isCancel(archiveRetention)) {
         clack4.cancel("Operation cancelled.");
@@ -1769,7 +2077,7 @@ async function promptCustomConfig() {
   }
   const tlsRequired = await clack4.confirm({
     message: "Require TLS encryption for all emails?",
-    initialValue: true
+    initialValue: existingConfig?.tlsRequired ?? true
   });
   if (clack4.isCancel(tlsRequired)) {
     clack4.cancel("Operation cancelled.");
@@ -1777,7 +2085,7 @@ async function promptCustomConfig() {
   }
   const reputationMetrics = await clack4.confirm({
     message: "Enable reputation metrics dashboard?",
-    initialValue: true
+    initialValue: existingConfig?.reputationMetrics ?? true
   });
   if (clack4.isCancel(reputationMetrics)) {
     clack4.cancel("Operation cancelled.");
@@ -1785,7 +2093,7 @@ async function promptCustomConfig() {
   }
   const dedicatedIp = await clack4.confirm({
     message: "Request dedicated IP address? (requires 100k+ emails/day)",
-    initialValue: false
+    initialValue: existingConfig?.dedicatedIp ?? false
   });
   if (clack4.isCancel(dedicatedIp)) {
     clack4.cancel("Operation cancelled.");
@@ -1793,7 +2101,7 @@ async function promptCustomConfig() {
   }
   const emailArchivingEnabled = await clack4.confirm({
     message: "Enable email archiving? (Store full email content with HTML for viewing)",
-    initialValue: false
+    initialValue: existingConfig?.emailArchiving?.enabled ?? false
   });
   if (clack4.isCancel(emailArchivingEnabled)) {
     clack4.cancel("Operation cancelled.");
@@ -1823,7 +2131,7 @@ async function promptCustomConfig() {
           hint: "~$35-60/mo for 10k emails"
         }
       ],
-      initialValue: "90days"
+      initialValue: existingConfig?.emailArchiving?.retention || "90days"
     });
     if (clack4.isCancel(emailArchiveRetention)) {
       clack4.cancel("Operation cancelled.");
@@ -2225,7 +2533,9 @@ import * as aws from "@pulumi/aws";
 async function tableExists(tableName) {
   try {
     const { DynamoDBClient: DynamoDBClient4, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
-    const dynamodb2 = new DynamoDBClient4({});
+    const dynamodb2 = new DynamoDBClient4({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
     await dynamodb2.send(new DescribeTableCommand2({ TableName: tableName }));
     return true;
   } catch (error) {
@@ -2362,7 +2672,9 @@ import * as pulumi2 from "@pulumi/pulumi";
 async function roleExists(roleName) {
   try {
     const { IAMClient: IAMClient2, GetRoleCommand } = await import("@aws-sdk/client-iam");
-    const iam4 = new IAMClient2({});
+    const iam4 = new IAMClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
     await iam4.send(new GetRoleCommand({ RoleName: roleName }));
     return true;
   } catch (error) {
@@ -2545,7 +2857,9 @@ function getPackageRoot() {
 async function lambdaFunctionExists(functionName) {
   try {
     const { LambdaClient: LambdaClient2, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
-    const lambda2 = new LambdaClient2({});
+    const lambda2 = new LambdaClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
     await lambda2.send(new GetFunctionCommand({ FunctionName: functionName }));
     return true;
   } catch (error) {
@@ -2559,7 +2873,9 @@ async function lambdaFunctionExists(functionName) {
 async function findEventSourceMapping(functionName, queueArn) {
   try {
     const { LambdaClient: LambdaClient2, ListEventSourceMappingsCommand } = await import("@aws-sdk/client-lambda");
-    const lambda2 = new LambdaClient2({});
+    const lambda2 = new LambdaClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
     const response = await lambda2.send(
       new ListEventSourceMappingsCommand({
         FunctionName: functionName,
@@ -2782,27 +3098,13 @@ async function emailIdentityExists(emailIdentity, region) {
     return false;
   }
 }
-async function eventDestinationExists(configSetName, eventDestName, region) {
-  try {
-    const { SESv2Client: SESv2Client5, GetConfigurationSetEventDestinationsCommand } = await import("@aws-sdk/client-sesv2");
-    const ses = new SESv2Client5({ region });
-    const response = await ses.send(
-      new GetConfigurationSetEventDestinationsCommand({
-        ConfigurationSetName: configSetName
-      })
-    );
-    return response.EventDestinations?.some((dest) => dest.Name === eventDestName) ?? false;
-  } catch (error) {
-    if (error.name === "NotFoundException") {
-      return false;
-    }
-    console.error("Error checking for existing event destination:", error);
-    return false;
-  }
-}
 async function createSESResources(config2) {
   const configSetOptions = {
     configurationSetName: "wraps-email-tracking",
+    deliveryOptions: config2.tlsRequired ? {
+      tlsPolicy: "REQUIRE"
+      // Require TLS 1.2+ for all emails
+    } : void 0,
     tags: {
       ManagedBy: "wraps-cli",
       Description: "Wraps email tracking configuration set"
@@ -2826,13 +3128,8 @@ async function createSESResources(config2) {
   const defaultEventBus = aws5.cloudwatch.getEventBusOutput({
     name: "default"
   });
-  const eventDestName = "wraps-email-eventbridge";
-  const eventDestExists = await eventDestinationExists(
-    configSetName,
-    eventDestName,
-    config2.region
-  );
-  if (!eventDestExists) {
+  if (config2.eventTrackingEnabled) {
+    const eventDestName = "wraps-email-eventbridge";
     new aws5.sesv2.ConfigurationSetEventDestination("wraps-email-all-events", {
       configurationSetName: configSet.configurationSetName,
       eventDestinationName: eventDestName,
@@ -2969,7 +3266,9 @@ import * as aws7 from "@pulumi/aws";
 async function getExistingOIDCProviderArn(url) {
   try {
     const { IAMClient: IAMClient2, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
-    const iam4 = new IAMClient2({});
+    const iam4 = new IAMClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
     const response = await iam4.send(new ListOpenIDConnectProvidersCommand({}));
     const expectedArnSuffix = url.replace("https://", "");
     const provider = response.OpenIDConnectProviderList?.find(
@@ -3058,7 +3357,9 @@ async function deployEmailStack(config2) {
     cloudFrontResources = await createCloudFrontTracking2({
       customTrackingDomain: emailConfig.tracking.customRedirectDomain,
       region: config2.region,
-      certificateArn
+      certificateArn,
+      hostedZoneId: hostedZone?.id
+      // Pass hosted zone ID for automatic DNS record creation
     });
   }
   let sesResources;
@@ -3068,7 +3369,11 @@ async function deployEmailStack(config2) {
       mailFromDomain: emailConfig.mailFromDomain,
       region: config2.region,
       trackingConfig: emailConfig.tracking,
-      eventTypes: emailConfig.eventTracking?.events
+      eventTypes: emailConfig.eventTracking?.events,
+      eventTrackingEnabled: emailConfig.eventTracking?.enabled,
+      // Pass flag to create EventBridge destination
+      tlsRequired: emailConfig.tlsRequired
+      // Require TLS encryption for all emails
     });
   }
   let dynamoTables;
@@ -3133,142 +3438,8 @@ async function deployEmailStack(config2) {
 
 // src/commands/email/config.ts
 init_aws();
-
-// src/utils/shared/fs.ts
-init_esm_shims();
-import { existsSync as existsSync2 } from "fs";
-import { mkdir } from "fs/promises";
-import { homedir } from "os";
-import { join as join2 } from "path";
-function getWrapsDir() {
-  return join2(homedir(), ".wraps");
-}
-function getPulumiWorkDir() {
-  return join2(getWrapsDir(), "pulumi");
-}
-async function ensureWrapsDir() {
-  const wrapsDir = getWrapsDir();
-  if (!existsSync2(wrapsDir)) {
-    await mkdir(wrapsDir, { recursive: true });
-  }
-}
-async function ensurePulumiWorkDir() {
-  await ensureWrapsDir();
-  const pulumiDir = getPulumiWorkDir();
-  if (!existsSync2(pulumiDir)) {
-    await mkdir(pulumiDir, { recursive: true });
-  }
-  process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
-  process.env.PULUMI_CONFIG_PASSPHRASE = "";
-}
-
-// src/utils/shared/metadata.ts
-init_esm_shims();
-import { existsSync as existsSync3 } from "fs";
-import { readFile, writeFile } from "fs/promises";
-import { join as join3 } from "path";
-function getConnectionsDir() {
-  return join3(getWrapsDir(), "connections");
-}
-function getMetadataPath(accountId, region) {
-  return join3(getConnectionsDir(), `${accountId}-${region}.json`);
-}
-async function ensureConnectionsDir() {
-  await ensureWrapsDir();
-  const connectionsDir = getConnectionsDir();
-  if (!existsSync3(connectionsDir)) {
-    const { mkdir: mkdir2 } = await import("fs/promises");
-    await mkdir2(connectionsDir, { recursive: true });
-  }
-}
-function migrateLegacyMetadata(legacy) {
-  return {
-    version: "1.0.0",
-    accountId: legacy.accountId,
-    region: legacy.region,
-    provider: legacy.provider,
-    timestamp: legacy.timestamp,
-    vercel: legacy.vercel,
-    services: {
-      email: {
-        preset: legacy.preset,
-        config: legacy.emailConfig,
-        pulumiStackName: legacy.pulumiStackName,
-        deployedAt: legacy.timestamp
-      }
-    }
-  };
-}
-function isLegacyMetadata(data) {
-  return "emailConfig" in data && !("services" in data) && typeof data.emailConfig === "object";
-}
-async function loadConnectionMetadata(accountId, region) {
-  const metadataPath = getMetadataPath(accountId, region);
-  if (!existsSync3(metadataPath)) {
-    return null;
-  }
-  try {
-    const content = await readFile(metadataPath, "utf-8");
-    const data = JSON.parse(content);
-    if (isLegacyMetadata(data)) {
-      const migrated = migrateLegacyMetadata(data);
-      await saveConnectionMetadata(migrated);
-      return migrated;
-    }
-    if (!data.version) {
-      data.version = "1.0.0";
-      await saveConnectionMetadata(data);
-    }
-    return data;
-  } catch (error) {
-    console.error("Error loading connection metadata:", error.message);
-    return null;
-  }
-}
-async function saveConnectionMetadata(metadata) {
-  await ensureConnectionsDir();
-  const metadataPath = getMetadataPath(metadata.accountId, metadata.region);
-  try {
-    const content = JSON.stringify(metadata, null, 2);
-    await writeFile(metadataPath, content, "utf-8");
-  } catch (error) {
-    console.error("Error saving connection metadata:", error.message);
-    throw error;
-  }
-}
-async function deleteConnectionMetadata(accountId, region) {
-  const metadataPath = getMetadataPath(accountId, region);
-  if (existsSync3(metadataPath)) {
-    const { unlink } = await import("fs/promises");
-    await unlink(metadataPath);
-  }
-}
-function createConnectionMetadata(accountId, region, provider, emailConfig, preset) {
-  return {
-    version: "1.0.0",
-    accountId,
-    region,
-    provider,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    services: {
-      email: {
-        preset,
-        config: emailConfig,
-        deployedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    }
-  };
-}
-function updateEmailConfig(metadata, emailConfig) {
-  if (!metadata.services.email) {
-    throw new Error("Email service not configured in metadata");
-  }
-  metadata.services.email.config = {
-    ...metadata.services.email.config,
-    ...emailConfig
-  };
-  metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
-}
+init_fs();
+init_metadata();
 
 // src/utils/shared/output.ts
 init_esm_shims();
@@ -3771,7 +3942,8 @@ ${pc3.bold("Current Configuration:")}
           {
             workDir: getPulumiWorkDir(),
             envVars: {
-              PULUMI_CONFIG_PASSPHRASE: ""
+              PULUMI_CONFIG_PASSPHRASE: "",
+              AWS_REGION: region
             },
             secretsProvider: "passphrase"
           }
@@ -3842,6 +4014,8 @@ import * as pulumi6 from "@pulumi/pulumi";
 import pc5 from "picocolors";
 init_presets();
 init_aws();
+init_fs();
+init_metadata();
 init_prompts();
 
 // src/utils/shared/scanner.ts
@@ -4146,6 +4320,10 @@ async function connect(options) {
   const emailConfig = preset === "custom" ? await Promise.resolve().then(() => (init_prompts(), prompts_exports)).then(
     (m) => m.promptCustomConfig()
   ) : getPreset(preset);
+  const domainIdentities = selectedIdentities.filter((id) => !id.includes("@"));
+  if (domainIdentities.length > 0) {
+    emailConfig.domain = domainIdentities[0];
+  }
   if (!options.yes) {
     const confirmed = await confirmConnect();
     if (!confirmed) {
@@ -4186,7 +4364,8 @@ async function connect(options) {
           {
             workDir: getPulumiWorkDir(),
             envVars: {
-              PULUMI_CONFIG_PASSPHRASE: ""
+              PULUMI_CONFIG_PASSPHRASE: "",
+              AWS_REGION: region
             },
             secretsProvider: "passphrase"
           }
@@ -4220,6 +4399,32 @@ async function connect(options) {
     }
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
+  if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
+    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone2(outputs.domain, region);
+    if (hostedZone) {
+      try {
+        progress.start("Creating DNS records in Route53");
+        const mailFromDomain = emailConfig.mailFromDomain || `mail.${outputs.domain}`;
+        await createDNSRecords2(
+          hostedZone.id,
+          outputs.domain,
+          outputs.dkimTokens,
+          region,
+          outputs.customTrackingDomain,
+          mailFromDomain
+        );
+        progress.succeed("DNS records created in Route53");
+      } catch (error) {
+        progress.fail(
+          `Failed to create DNS records automatically: ${error.message}`
+        );
+        progress.info(
+          "You can manually add the required DNS records shown below"
+        );
+      }
+    }
+  }
   const metadata = createConnectionMetadata(
     identity.accountId,
     region,
@@ -4688,6 +4893,8 @@ import pc7 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_fs();
+init_metadata();
 init_prompts();
 async function init(options) {
   clack7.intro(pc7.bold("Wraps Email Infrastructure Setup"));
@@ -4818,8 +5025,9 @@ ${pc7.yellow(pc7.bold("Configuration Warnings:"))}`);
             workDir: getPulumiWorkDir(),
             // Use local file-based backend (no Pulumi Cloud login required)
             envVars: {
-              PULUMI_CONFIG_PASSPHRASE: ""
+              PULUMI_CONFIG_PASSPHRASE: "",
               // Use empty passphrase for local state
+              AWS_REGION: region
             },
             secretsProvider: "passphrase"
           }
@@ -4910,6 +5118,8 @@ ${pc7.yellow(pc7.bold("Configuration Warnings:"))}`);
 // src/commands/email/restore.ts
 init_esm_shims();
 init_aws();
+init_fs();
+init_metadata();
 import * as clack8 from "@clack/prompts";
 import * as pulumi8 from "@pulumi/pulumi";
 import pc8 from "picocolors";
@@ -4988,7 +5198,8 @@ ${pc8.bold("The following Wraps resources will be removed:")}
           {
             workDir: getPulumiWorkDir(),
             envVars: {
-              PULUMI_CONFIG_PASSPHRASE: ""
+              PULUMI_CONFIG_PASSPHRASE: "",
+              AWS_REGION: region
             },
             secretsProvider: "passphrase"
           }
@@ -5025,6 +5236,8 @@ import pc9 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_fs();
+init_metadata();
 init_prompts();
 async function upgrade(options) {
   clack9.intro(pc9.bold("Wraps Upgrade - Enhance Your Email Infrastructure"));
@@ -5192,12 +5405,9 @@ ${pc9.bold("Current Configuration:")}
         clack9.cancel("Upgrade cancelled.");
         process.exit(0);
       }
+      const { applyConfigUpdates: applyConfigUpdates2 } = await Promise.resolve().then(() => (init_metadata(), metadata_exports));
       const presetConfig = getPreset(selectedPreset);
-      updatedConfig = {
-        ...presetConfig,
-        domain: config2.domain
-        // Preserve original domain
-      };
+      updatedConfig = applyConfigUpdates2(config2, presetConfig);
       newPreset = selectedPreset;
       break;
     }
@@ -5630,11 +5840,9 @@ ${pc9.bold("Current Configuration:")}
     }
     case "custom": {
       const { promptCustomConfig: promptCustomConfig2 } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
-      const customConfig = await promptCustomConfig2();
-      updatedConfig = {
-        ...customConfig,
-        domain: config2.domain
-      };
+      const { applyConfigUpdates: applyConfigUpdates2 } = await Promise.resolve().then(() => (init_metadata(), metadata_exports));
+      const customConfig = await promptCustomConfig2(config2);
+      updatedConfig = applyConfigUpdates2(config2, customConfig);
       newPreset = void 0;
       break;
     }
@@ -5712,7 +5920,8 @@ ${pc9.bold("Cost Impact:")}`);
           {
             workDir: getPulumiWorkDir(),
             envVars: {
-              PULUMI_CONFIG_PASSPHRASE: ""
+              PULUMI_CONFIG_PASSPHRASE: "",
+              AWS_REGION: region
             },
             secretsProvider: "passphrase"
           }
@@ -5754,6 +5963,33 @@ ${pc9.bold("Cost Impact:")}`);
     }
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
+  if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
+    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone2(outputs.domain, region);
+    if (hostedZone) {
+      try {
+        progress.start("Creating DNS records in Route53");
+        const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
+        await createDNSRecords2(
+          hostedZone.id,
+          outputs.domain,
+          outputs.dkimTokens,
+          region,
+          outputs.customTrackingDomain,
+          mailFromDomain,
+          outputs.cloudFrontDomain
+        );
+        progress.succeed("DNS records created in Route53");
+      } catch (error) {
+        progress.fail(
+          `Failed to create DNS records automatically: ${error.message}`
+        );
+        progress.info(
+          "You can manually add the required DNS records shown below"
+        );
+      }
+    }
+  }
   updateEmailConfig(metadata, updatedConfig);
   if (metadata.services.email) {
     metadata.services.email.preset = newPreset;
@@ -6573,6 +6809,7 @@ function createMetricsRouter(config2) {
 
 // src/console/routes/settings.ts
 init_esm_shims();
+init_metadata();
 import dns from "dns/promises";
 import { Router as createRouter4 } from "express";
 
@@ -6915,6 +7152,7 @@ function createSettingsRouter(config2) {
 
 // src/console/routes/user.ts
 init_esm_shims();
+init_metadata();
 import { Router as createRouter5 } from "express";
 function createUserRouter(config2) {
   const router = createRouter5();
@@ -7060,6 +7298,7 @@ async function startConsoleServer(config2) {
 
 // src/commands/shared/dashboard.ts
 init_aws();
+init_fs();
 async function dashboard(options) {
   clack10.intro(pc10.bold("Wraps Dashboard"));
   const progress = new DeploymentProgress();
@@ -7116,6 +7355,8 @@ async function dashboard(options) {
 // src/commands/shared/destroy.ts
 init_esm_shims();
 init_aws();
+init_fs();
+init_metadata();
 import * as clack11 from "@clack/prompts";
 import * as pulumi11 from "@pulumi/pulumi";
 import pc11 from "picocolors";
@@ -7182,6 +7423,7 @@ Run ${pc11.cyan("wraps email init")} to deploy infrastructure again.
 // src/commands/shared/status.ts
 init_esm_shims();
 init_aws();
+init_fs();
 import * as clack12 from "@clack/prompts";
 import * as pulumi12 from "@pulumi/pulumi";
 import pc12 from "picocolors";