@wraps.dev/cli 1.4.0 → 1.5.0

package/dist/cli.js

@@ -146,7 +146,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@wraps.dev/cli",
-      version: "1.4.0",
+      version: "1.5.0",
       description: "CLI for deploying Wraps email infrastructure to your AWS account",
       type: "module",
       main: "./dist/cli.js",
@@ -546,6 +546,12 @@ To remove: wraps destroy --stack ${stackName}`,
         "PULUMI_NOT_INSTALLED",
         "Install Pulumi:\n  macOS: brew install pulumi/tap/pulumi\n  Linux: curl -fsSL https://get.pulumi.com | sh\n  Windows: choco install pulumi\n\nOr download from: https://www.pulumi.com/docs/install/",
         "https://www.pulumi.com/docs/install/"
+      ),
+      stackLocked: () => new WrapsError(
+        "The Pulumi stack is locked from a previous run",
+        "STACK_LOCKED",
+        "This happens when a previous deployment was interrupted.\n\nTo unlock, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nThen try your command again.",
+        "https://wraps.dev/docs/troubleshooting"
       )
     };
   }
@@ -3192,6 +3198,35 @@ ${pc2.bold("Dashboard:")} ${pc2.blue("https://app.wraps.dev")}`);
   console.log(`${pc2.bold("Docs:")} ${pc2.blue("https://wraps.dev/docs")}
 `);
 }
+function displayPreview(outputs) {
+  console.log(pc2.yellow("\n--- PREVIEW MODE (no changes will be made) ---\n"));
+  const changes = outputs.changeSummary;
+  const summaryLines = [];
+  if (changes.create && changes.create > 0) {
+    summaryLines.push(`  ${pc2.green("+")} ${changes.create} to create`);
+  }
+  if (changes.update && changes.update > 0) {
+    summaryLines.push(`  ${pc2.yellow("~")} ${changes.update} to update`);
+  }
+  if (changes.delete && changes.delete > 0) {
+    summaryLines.push(`  ${pc2.red("-")} ${changes.delete} to destroy`);
+  }
+  if (changes.same && changes.same > 0) {
+    summaryLines.push(`  ${pc2.dim("=")} ${changes.same} unchanged`);
+  }
+  if (changes.replace && changes.replace > 0) {
+    summaryLines.push(`  ${pc2.magenta("+-")} ${changes.replace} to replace`);
+  }
+  if (summaryLines.length > 0) {
+    clack2.note(summaryLines.join("\n"), "Resource Changes");
+  } else {
+    clack2.note("No changes detected", "Resource Changes");
+  }
+  if (outputs.costEstimate) {
+    clack2.note(outputs.costEstimate, "Estimated Monthly Cost");
+  }
+  console.log(pc2.yellow("\n--- END PREVIEW (no changes were made) ---\n"));
+}
 
 // src/commands/dashboard/update-role.ts
 async function updateRole(options) {
@@ -3792,7 +3827,7 @@ Try running: pnpm build`
     entryPoints: [sourcePath],
     bundle: true,
     platform: "node",
-    target: "node20",
+    target: "node24",
     format: "esm",
     outfile: join3(outdir, "index.mjs"),
     external: ["@aws-sdk/*"],
@@ -3864,7 +3899,7 @@ async function deployLambdaFunctions(config2) {
     functionName,
     {
       name: functionName,
-      runtime: aws4.lambda.Runtime.NodeJS20dX,
+      runtime: "nodejs24.x",
       handler: "index.handler",
       role: lambdaRole.arn,
       code: new pulumi3.asset.FileArchive(eventProcessorCode),
@@ -3888,7 +3923,7 @@ async function deployLambdaFunctions(config2) {
     }
   ) : new aws4.lambda.Function(functionName, {
     name: functionName,
-    runtime: aws4.lambda.Runtime.NodeJS20dX,
+    runtime: "nodejs24.x",
     handler: "index.handler",
     role: lambdaRole.arn,
     code: new pulumi3.asset.FileArchive(eventProcessorCode),
@@ -3957,6 +3992,23 @@ async function configurationSetExists(configSetName, region) {
     return false;
   }
 }
+async function eventDestinationExists(configSetName, eventDestName, region) {
+  try {
+    const { SESv2Client: SESv2Client5, GetConfigurationSetEventDestinationsCommand } = await import("@aws-sdk/client-sesv2");
+    const ses = new SESv2Client5({ region });
+    const response = await ses.send(
+      new GetConfigurationSetEventDestinationsCommand({
+        ConfigurationSetName: configSetName
+      })
+    );
+    return response.EventDestinations?.some((dest) => dest.Name === eventDestName) ?? false;
+  } catch (error) {
+    if (error.name === "NotFoundException") {
+      return false;
+    }
+    return false;
+  }
+}
 async function emailIdentityExists(emailIdentity, region) {
   try {
     const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
@@ -4010,29 +4062,37 @@ async function createSESResources(config2) {
   });
   if (config2.eventTrackingEnabled) {
     const eventDestName = "wraps-email-eventbridge";
-    new aws5.sesv2.ConfigurationSetEventDestination("wraps-email-all-events", {
-      configurationSetName: configSet.configurationSetName,
-      eventDestinationName: eventDestName,
-      eventDestination: {
-        enabled: true,
-        matchingEventTypes: [
-          "SEND",
-          "DELIVERY",
-          "OPEN",
-          "CLICK",
-          "BOUNCE",
-          "COMPLAINT",
-          "REJECT",
-          "RENDERING_FAILURE",
-          "DELIVERY_DELAY",
-          "SUBSCRIPTION"
-        ],
-        eventBridgeDestination: {
-          // SES requires default bus - cannot use custom bus
-          eventBusArn: defaultEventBus.arn
+    new aws5.sesv2.ConfigurationSetEventDestination(
+      "wraps-email-all-events",
+      {
+        configurationSetName: configSet.configurationSetName,
+        eventDestinationName: eventDestName,
+        eventDestination: {
+          enabled: true,
+          matchingEventTypes: [
+            "SEND",
+            "DELIVERY",
+            "OPEN",
+            "CLICK",
+            "BOUNCE",
+            "COMPLAINT",
+            "REJECT",
+            "RENDERING_FAILURE",
+            "DELIVERY_DELAY",
+            "SUBSCRIPTION"
+          ],
+          eventBridgeDestination: {
+            // SES requires default bus - cannot use custom bus
+            eventBusArn: defaultEventBus.arn
+          }
         }
+      },
+      {
+        // Import existing resource if it already exists in AWS
+        // This prevents AlreadyExistsException when the resource exists but isn't in Pulumi state
+        import: config2.importExistingEventDestination ? `wraps-email-tracking|${eventDestName}` : void 0
       }
-    });
+    );
   }
   let domainIdentity;
   let dkimTokens;
@@ -4244,6 +4304,11 @@ async function deployEmailStack(config2) {
   }
   let sesResources;
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
+    const shouldImportEventDest = emailConfig.eventTracking?.enabled && await eventDestinationExists(
+      "wraps-email-tracking",
+      "wraps-email-eventbridge",
+      config2.region
+    );
     sesResources = await createSESResources({
       domain: emailConfig.domain,
       mailFromDomain: emailConfig.mailFromDomain,
@@ -4252,8 +4317,10 @@ async function deployEmailStack(config2) {
       eventTypes: emailConfig.eventTracking?.events,
       eventTrackingEnabled: emailConfig.eventTracking?.enabled,
       // Pass flag to create EventBridge destination
-      tlsRequired: emailConfig.tlsRequired
+      tlsRequired: emailConfig.tlsRequired,
       // Require TLS encryption for all emails
+      importExistingEventDestination: shouldImportEventDest
+      // Import if exists to avoid AlreadyExistsException
     });
   }
   let dynamoTables;
@@ -4318,6 +4385,7 @@ async function deployEmailStack(config2) {
 
 // src/commands/email/config.ts
 init_aws();
+init_errors();
 
 // src/utils/shared/pulumi.ts
 init_esm_shims();
@@ -4350,7 +4418,11 @@ async function ensurePulumiInstalled() {
 
 // src/commands/email/config.ts
 async function config(options) {
-  clack3.intro(pc4.bold("Wraps Config - Apply CLI Updates to Infrastructure"));
+  clack3.intro(
+    pc4.bold(
+      options.preview ? "Wraps Config Preview" : "Wraps Config - Apply CLI Updates to Infrastructure"
+    )
+  );
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -4427,7 +4499,7 @@ ${pc4.bold("Current Configuration:")}
     "Your current configuration will be preserved - no features will be added or removed"
   );
   console.log("");
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await clack3.confirm({
       message: "Proceed with update?",
       initialValue: true
@@ -4447,6 +4519,61 @@ ${pc4.bold("Current Configuration:")}
     vercel: vercelConfig,
     emailConfig: config2
   };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating update preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stack = await pulumi5.automation.LocalWorkspace.createOrSelectStack(
+            {
+              stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
+              projectName: "wraps-email",
+              program: async () => {
+                const result2 = await deployEmailStack(stackConfig);
+                return {
+                  roleArn: result2.roleArn,
+                  configSetName: result2.configSetName,
+                  tableName: result2.tableName,
+                  region: result2.region,
+                  lambdaFunctions: result2.lambdaFunctions,
+                  domain: result2.domain,
+                  dkimTokens: result2.dkimTokens,
+                  customTrackingDomain: result2.customTrackingDomain
+                };
+              }
+            },
+            {
+              workDir: getPulumiWorkDir(),
+              envVars: {
+                PULUMI_CONFIG_PASSPHRASE: "",
+                AWS_REGION: region
+              },
+              secretsProvider: "passphrase"
+            }
+          );
+          await stack.setConfig("aws:region", { value: region });
+          await stack.refresh({ onOutput: () => {
+          } });
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        commandName: "wraps email config"
+      });
+      clack3.outro(
+        pc4.green("Preview complete. Run without --preview to update.")
+      );
+      return;
+    } catch (error) {
+      if (error.message?.includes("stack is currently locked")) {
+        throw errors.stackLocked();
+      }
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
   let outputs;
   try {
     outputs = await progress.execute(
@@ -4484,6 +4611,8 @@ ${pc4.bold("Current Configuration:")}
           metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
+        await stack.refresh({ onOutput: () => {
+        } });
         const upResult = await stack.up({ onOutput: () => {
         } });
         const pulumiOutputs = upResult.outputs;
@@ -4500,12 +4629,8 @@ ${pc4.bold("Current Configuration:")}
       }
     );
   } catch (error) {
-    clack3.log.error("Infrastructure update failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack3.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack3.log.info("To fix this, run:");
-      clack3.log.info(`  ${pc4.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack3.log.info("\nThen try running wraps update again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi update failed: ${error.message}`);
   }
@@ -4546,6 +4671,7 @@ import * as pulumi6 from "@pulumi/pulumi";
 import pc6 from "picocolors";
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 
 // src/utils/shared/scanner.ts
@@ -4776,7 +4902,11 @@ async function scanAWSResources(region) {
 
 // src/commands/email/connect.ts
 async function connect(options) {
-  clack5.intro(pc6.bold("Wraps Connect - Link Existing Infrastructure"));
+  clack5.intro(
+    pc6.bold(
+      options.preview ? "Wraps Connect Preview" : "Wraps Connect - Link Existing Infrastructure"
+    )
+  );
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -4854,7 +4984,7 @@ async function connect(options) {
   if (domainIdentities.length > 0) {
     emailConfig.domain = domainIdentities[0];
   }
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await confirmConnect();
     if (!confirmed) {
       clack5.cancel("Connection cancelled.");
@@ -4867,6 +4997,59 @@ async function connect(options) {
     vercel: vercelConfig,
     emailConfig
   };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating infrastructure preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stack = await pulumi6.automation.LocalWorkspace.createOrSelectStack(
+            {
+              stackName: `wraps-${identity.accountId}-${region}`,
+              projectName: "wraps-email",
+              program: async () => {
+                const result2 = await deployEmailStack(stackConfig);
+                return {
+                  roleArn: result2.roleArn,
+                  configSetName: result2.configSetName,
+                  tableName: result2.tableName,
+                  region: result2.region,
+                  lambdaFunctions: result2.lambdaFunctions,
+                  domain: result2.domain,
+                  dkimTokens: result2.dkimTokens,
+                  customTrackingDomain: result2.customTrackingDomain
+                };
+              }
+            },
+            {
+              workDir: getPulumiWorkDir(),
+              envVars: {
+                PULUMI_CONFIG_PASSPHRASE: "",
+                AWS_REGION: region
+              },
+              secretsProvider: "passphrase"
+            }
+          );
+          await stack.setConfig("aws:region", { value: region });
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        commandName: "wraps email connect"
+      });
+      clack5.outro(
+        pc6.green("Preview complete. Run without --preview to connect.")
+      );
+      return;
+    } catch (error) {
+      if (error.message?.includes("stack is currently locked")) {
+        throw errors.stackLocked();
+      }
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
   let outputs;
   try {
     outputs = await progress.execute(
@@ -4920,12 +5103,8 @@ async function connect(options) {
       }
     );
   } catch (error) {
-    clack5.log.error("Infrastructure deployment failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack5.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack5.log.info("To fix this, run:");
-      clack5.log.info(`  ${pc6.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack5.log.info("\nThen try running wraps email connect again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
@@ -5423,9 +5602,14 @@ import pc8 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 async function init(options) {
-  clack7.intro(pc8.bold("Wraps Email Infrastructure Setup"));
+  clack7.intro(
+    pc8.bold(
+      options.preview ? "Wraps Email Infrastructure Preview" : "Wraps Email Infrastructure Setup"
+    )
+  );
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -5508,7 +5692,7 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
   if (vercelConfig) {
     metadata.vercel = vercelConfig;
   }
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await confirmDeploy();
     if (!confirmed) {
       clack7.cancel("Deployment cancelled.");
@@ -5521,6 +5705,64 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
     vercel: vercelConfig,
     emailConfig
   };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating infrastructure preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stack = await pulumi7.automation.LocalWorkspace.createOrSelectStack(
+            {
+              stackName: `wraps-${identity.accountId}-${region}`,
+              projectName: "wraps-email",
+              program: async () => {
+                const result2 = await deployEmailStack(stackConfig);
+                return {
+                  roleArn: result2.roleArn,
+                  configSetName: result2.configSetName,
+                  tableName: result2.tableName,
+                  region: result2.region,
+                  lambdaFunctions: result2.lambdaFunctions,
+                  domain: result2.domain,
+                  dkimTokens: result2.dkimTokens,
+                  customTrackingDomain: result2.customTrackingDomain,
+                  mailFromDomain: result2.mailFromDomain,
+                  archiveArn: result2.archiveArn,
+                  archivingEnabled: result2.archivingEnabled,
+                  archiveRetention: result2.archiveRetention
+                };
+              }
+            },
+            {
+              workDir: getPulumiWorkDir(),
+              envVars: {
+                PULUMI_CONFIG_PASSPHRASE: "",
+                AWS_REGION: region
+              },
+              secretsProvider: "passphrase"
+            }
+          );
+          await stack.setConfig("aws:region", { value: region });
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        costEstimate: costSummary,
+        commandName: "wraps email init"
+      });
+      clack7.outro(
+        pc8.green("Preview complete. Run without --preview to deploy.")
+      );
+      return;
+    } catch (error) {
+      if (error.message?.includes("stack is currently locked")) {
+        throw errors.stackLocked();
+      }
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
   let outputs;
   try {
     outputs = await progress.execute(
@@ -5584,12 +5826,8 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
       }
     );
   } catch (error) {
-    clack7.log.error("Infrastructure deployment failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack7.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack7.log.info("To fix this, run:");
-      clack7.log.info(`  ${pc8.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack7.log.info("\nThen try running wraps email init again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
@@ -5650,7 +5888,11 @@ import * as clack8 from "@clack/prompts";
 import * as pulumi8 from "@pulumi/pulumi";
 import pc9 from "picocolors";
 async function restore(options) {
-  clack8.intro(pc9.bold("Wraps Restore - Remove Wraps Infrastructure"));
+  clack8.intro(
+    pc9.bold(
+      options.preview ? "Wraps Restore Preview" : "Wraps Restore - Remove Wraps Infrastructure"
+    )
+  );
   clack8.log.info(
     `${pc9.yellow("Note:")} This will remove all Wraps-managed infrastructure.`
   );
@@ -5697,7 +5939,7 @@ ${pc9.bold("The following Wraps resources will be removed:")}
   }
   console.log(`  ${pc9.cyan("\u2713")} IAM Role (wraps-email-role)`);
   console.log("");
-  if (!options.force) {
+  if (!(options.force || options.preview)) {
     const confirmed = await clack8.confirm({
       message: "Proceed with removal? This cannot be undone.",
       initialValue: false
@@ -5707,6 +5949,50 @@ ${pc9.bold("The following Wraps resources will be removed:")}
       process.exit(0);
     }
   }
+  if (options.preview) {
+    if (metadata.services.email?.pulumiStackName) {
+      try {
+        const previewResult = await progress.execute(
+          "Generating removal preview",
+          async () => {
+            const stack = await pulumi8.automation.LocalWorkspace.selectStack(
+              {
+                stackName: metadata.services.email.pulumiStackName,
+                projectName: "wraps-email",
+                program: async () => {
+                }
+                // Empty program for destroy
+              },
+              {
+                workDir: getPulumiWorkDir(),
+                envVars: {
+                  PULUMI_CONFIG_PASSPHRASE: "",
+                  AWS_REGION: region
+                },
+                secretsProvider: "passphrase"
+              }
+            );
+            const result = await stack.preview({ diff: true });
+            return result;
+          }
+        );
+        displayPreview({
+          changeSummary: previewResult.changeSummary,
+          costEstimate: "Monthly cost after removal: $0.00",
+          commandName: "wraps email restore"
+        });
+        clack8.outro(
+          pc9.green(
+            "Preview complete. Run without --preview to remove infrastructure."
+          )
+        );
+        return;
+      } catch (error) {
+        throw new Error(`Preview failed: ${error.message}`);
+      }
+    }
+    return;
+  }
   if (metadata.services.email?.pulumiStackName) {
     await progress.execute("Removing Wraps infrastructure", async () => {
       try {
@@ -5762,9 +6048,14 @@ import pc10 from "picocolors";
 init_costs();
 init_presets();
 init_aws();
+init_errors();
 init_prompts();
 async function upgrade(options) {
-  clack9.intro(pc10.bold("Wraps Upgrade - Enhance Your Email Infrastructure"));
+  clack9.intro(
+    pc10.bold(
+      options.preview ? "Wraps Upgrade Preview" : "Wraps Upgrade - Enhance Your Email Infrastructure"
+    )
+  );
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -6394,7 +6685,7 @@ ${pc10.bold("Cost Impact:")}`);
     );
   }
   console.log("");
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await clack9.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
@@ -6416,6 +6707,73 @@ ${pc10.bold("Cost Impact:")}`);
     vercel: vercelConfig,
     emailConfig: updatedConfig
   };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating upgrade preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stack = await pulumi9.automation.LocalWorkspace.createOrSelectStack(
+            {
+              stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
+              projectName: "wraps-email",
+              program: async () => {
+                const result2 = await deployEmailStack(stackConfig);
+                return {
+                  roleArn: result2.roleArn,
+                  configSetName: result2.configSetName,
+                  tableName: result2.tableName,
+                  region: result2.region,
+                  lambdaFunctions: result2.lambdaFunctions,
+                  domain: result2.domain,
+                  dkimTokens: result2.dkimTokens,
+                  customTrackingDomain: result2.customTrackingDomain,
+                  httpsTrackingEnabled: result2.httpsTrackingEnabled,
+                  cloudFrontDomain: result2.cloudFrontDomain,
+                  acmCertificateValidationRecords: result2.acmCertificateValidationRecords,
+                  archiveArn: result2.archiveArn,
+                  archivingEnabled: result2.archivingEnabled,
+                  archiveRetention: result2.archiveRetention
+                };
+              }
+            },
+            {
+              workDir: getPulumiWorkDir(),
+              envVars: {
+                PULUMI_CONFIG_PASSPHRASE: "",
+                AWS_REGION: region
+              },
+              secretsProvider: "passphrase"
+            }
+          );
+          await stack.setConfig("aws:region", { value: region });
+          await stack.refresh({ onOutput: () => {
+          } });
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      const costComparison = [
+        `Current: ${formatCost(currentCostData.total.monthly)}/mo`,
+        `After upgrade: ${formatCost(newCostData.total.monthly)}/mo`,
+        costDiff > 0 ? `Change: +${formatCost(costDiff)}/mo` : costDiff < 0 ? `Change: -${formatCost(Math.abs(costDiff))}/mo` : "Change: No cost difference"
+      ].join("\n");
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        costEstimate: costComparison,
+        commandName: "wraps email upgrade"
+      });
+      clack9.outro(
+        pc10.green("Preview complete. Run without --preview to upgrade.")
+      );
+      return;
+    } catch (error) {
+      if (error.message?.includes("stack is currently locked")) {
+        throw errors.stackLocked();
+      }
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
   let outputs;
   try {
     outputs = await progress.execute(
@@ -6483,12 +6841,8 @@ ${pc10.bold("Cost Impact:")}`);
       }
     );
   } catch (error) {
-    clack9.log.error("Infrastructure upgrade failed");
     if (error.message?.includes("stack is currently locked")) {
-      clack9.log.warn("\nThe Pulumi stack is locked from a previous run.");
-      clack9.log.info("To fix this, run:");
-      clack9.log.info(`  ${pc10.cyan("rm -rf ~/.wraps/pulumi/.pulumi/locks")}`);
-      clack9.log.info("\nThen try running wraps upgrade again.");
+      throw errors.stackLocked();
     }
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
@@ -7885,14 +8239,18 @@ import * as clack11 from "@clack/prompts";
 import * as pulumi11 from "@pulumi/pulumi";
 import pc12 from "picocolors";
 async function destroy(options) {
-  clack11.intro(pc12.bold("Wraps Email Infrastructure Teardown"));
+  clack11.intro(
+    pc12.bold(
+      options.preview ? "Wraps Destruction Preview" : "Wraps Email Infrastructure Teardown"
+    )
+  );
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
   const region = await getAWSRegion();
-  if (!options.force) {
+  if (!(options.force || options.preview)) {
     const confirmed = await clack11.confirm({
       message: pc12.red(
         "Are you sure you want to destroy all Wraps infrastructure?"
@@ -7904,6 +8262,44 @@ async function destroy(options) {
       process.exit(0);
     }
   }
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating destruction preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stackName = `wraps-${identity.accountId}-${region}`;
+          let stack;
+          try {
+            stack = await pulumi11.automation.LocalWorkspace.selectStack({
+              stackName,
+              workDir: getPulumiWorkDir()
+            });
+          } catch (_error) {
+            throw new Error("No Wraps infrastructure found to preview");
+          }
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        costEstimate: "Monthly cost after destruction: $0.00",
+        commandName: "wraps destroy"
+      });
+      clack11.outro(
+        pc12.green("Preview complete. Run without --preview to destroy.")
+      );
+      return;
+    } catch (error) {
+      progress.stop();
+      if (error.message.includes("No Wraps infrastructure found")) {
+        clack11.log.warn("No Wraps infrastructure found to preview");
+        process.exit(0);
+      }
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
   try {
     await progress.execute(
       "Destroying infrastructure (this may take 2-3 minutes)",
@@ -8142,7 +8538,9 @@ function showHelp() {
     `  ${pc15.cyan("email connect")}        Connect to existing AWS SES`
   );
   console.log(`  ${pc15.cyan("email domains verify")} Verify domain DNS records`);
-  console.log(`  ${pc15.cyan("email config")}         Update infrastructure`);
+  console.log(
+    `  ${pc15.cyan("email sync")}           Apply CLI updates to infrastructure`
+  );
   console.log(`  ${pc15.cyan("email upgrade")}        Add features`);
   console.log(
     `  ${pc15.cyan("email restore")}        Restore original configuration
@@ -8172,6 +8570,9 @@ function showHelp() {
   console.log(`  ${pc15.dim("--preset")}         Configuration preset`);
   console.log(`  ${pc15.dim("-y, --yes")}        Skip confirmation prompts`);
   console.log(`  ${pc15.dim("-f, --force")}      Force destructive operations`);
+  console.log(
+    `  ${pc15.dim("--preview")}        Preview changes without deploying`
+  );
   console.log(`  ${pc15.dim("-v, --version")}    Show version number
 `);
   console.log(
@@ -8231,6 +8632,11 @@ args.options([
     name: "noOpen",
     description: "Don't open browser automatically",
     defaultValue: false
+  },
+  {
+    name: "preview",
+    description: "Preview changes without deploying",
+    defaultValue: false
   }
 ]);
 var flags = args.parse(process.argv);
@@ -8292,13 +8698,15 @@ Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-
         region: flags.region,
         domain: flags.domain,
         preset: flags.preset,
-        yes: flags.yes
+        yes: flags.yes,
+        preview: flags.preview
       });
     } else {
       await connect({
         provider: flags.provider,
         region: flags.region,
-        yes: flags.yes
+        yes: flags.yes,
+        preview: flags.preview
       });
     }
   }
@@ -8336,32 +8744,38 @@ async function run() {
             region: flags.region,
             domain: flags.domain,
             preset: flags.preset,
-            yes: flags.yes
+            yes: flags.yes,
+            preview: flags.preview
           });
           break;
         case "connect":
           await connect({
             provider: flags.provider,
             region: flags.region,
-            yes: flags.yes
+            yes: flags.yes,
+            preview: flags.preview
           });
           break;
         case "config":
+        case "sync":
           await config({
             region: flags.region,
-            yes: flags.yes
+            yes: flags.yes,
+            preview: flags.preview
           });
           break;
         case "upgrade":
           await upgrade({
             region: flags.region,
-            yes: flags.yes
+            yes: flags.yes,
+            preview: flags.preview
           });
           break;
         case "restore":
           await restore({
             region: flags.region,
-            force: flags.force
+            force: flags.force,
+            preview: flags.preview
           });
           break;
         case "domains": {
@@ -8503,7 +8917,8 @@ Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-
         break;
       case "destroy":
         await destroy({
-          force: flags.force
+          force: flags.force,
+          preview: flags.preview
         });
         break;
       case "completion":