@wraps.dev/cli 1.5.0 → 1.5.2

package/dist/cli.js

@@ -146,7 +146,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@wraps.dev/cli",
-      version: "1.5.0",
+      version: "1.5.2",
       description: "CLI for deploying Wraps email infrastructure to your AWS account",
       type: "module",
       main: "./dist/cli.js",
@@ -448,6 +448,21 @@ function trackCommand(command, metadata) {
   sanitized.email = void 0;
   client.track(`command:${command}`, sanitized);
 }
+function trackServiceInit(service, success, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:init", {
+    service,
+    success,
+    ...metadata
+  });
+}
+function trackServiceDeployed(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:deployed", {
+    service,
+    ...metadata
+  });
+}
 function trackError(errorCode, command, metadata) {
   const client = getTelemetryClient();
   client.track("error:occurred", {
@@ -456,6 +471,24 @@ function trackError(errorCode, command, metadata) {
     ...metadata
   });
 }
+function trackFeature(feature, metadata) {
+  const client = getTelemetryClient();
+  client.track(`feature:${feature}`, metadata || {});
+}
+function trackServiceUpgrade(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:upgraded", {
+    service,
+    ...metadata
+  });
+}
+function trackServiceRemoved(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:removed", {
+    service,
+    ...metadata
+  });
+}
 var init_events = __esm({
   "src/telemetry/events.ts"() {
     "use strict";
@@ -519,7 +552,7 @@ var init_errors = __esm({
       stackExists: (stackName) => new WrapsError(
         `Stack "${stackName}" already exists`,
         "STACK_EXISTS",
-        `To update: wraps upgrade
+        `To update: wraps email upgrade
 To remove: wraps destroy --stack ${stackName}`,
         "https://wraps.dev/docs/cli/upgrade"
       ),
@@ -1559,7 +1592,7 @@ function getPresetInfo(preset) {
       volume: "10k-500k emails/month",
       features: [
         "Everything in Starter",
-        "Reputation metrics dashboard",
+        "Reputation tracking",
         "Real-time event tracking (EventBridge)",
         "90-day email history storage",
         "Optional: Email archiving with rendered viewer",
@@ -1768,16 +1801,16 @@ async function promptProvider() {
   const provider = await clack4.select({
     message: "Where is your app hosted?",
     options: [
-      {
-        value: "vercel",
-        label: "Vercel",
-        hint: "Uses OIDC (no AWS credentials needed)"
-      },
       {
         value: "aws",
         label: "AWS (Lambda/ECS/EC2)",
         hint: "Uses IAM roles automatically"
       },
+      {
+        value: "vercel",
+        label: "Vercel",
+        hint: "Uses OIDC (no AWS credentials needed)"
+      },
       {
         value: "railway",
         label: "Railway",
@@ -2171,6 +2204,14 @@ async function promptEmailArchiving() {
 async function promptCustomConfig(existingConfig) {
   clack4.log.info("Custom configuration builder");
   clack4.log.info("Configure each feature individually");
+  const reputationMetrics = await clack4.confirm({
+    message: "Enable reputation tracking (recommended)?",
+    initialValue: existingConfig?.reputationMetrics ?? true
+  });
+  if (clack4.isCancel(reputationMetrics)) {
+    clack4.cancel("Operation cancelled.");
+    process.exit(0);
+  }
   const trackingEnabled = await clack4.confirm({
     message: "Enable open & click tracking?",
     initialValue: existingConfig?.tracking?.enabled ?? true
@@ -2180,49 +2221,38 @@ async function promptCustomConfig(existingConfig) {
     process.exit(0);
   }
   const eventTrackingEnabled = await clack4.confirm({
-    message: "Enable real-time event tracking (EventBridge)?",
+    message: "Store email events in DynamoDB?",
     initialValue: existingConfig?.eventTracking?.enabled ?? true
   });
   if (clack4.isCancel(eventTrackingEnabled)) {
     clack4.cancel("Operation cancelled.");
     process.exit(0);
   }
-  let dynamoDBHistory = false;
   let archiveRetention = "90days";
   if (eventTrackingEnabled) {
-    dynamoDBHistory = await clack4.confirm({
-      message: "Store email history in DynamoDB?",
-      initialValue: existingConfig?.eventTracking?.dynamoDBHistory ?? true
+    archiveRetention = await clack4.select({
+      message: "Event history retention period:",
+      options: [
+        { value: "7days", label: "7 days", hint: "Minimal storage cost" },
+        { value: "30days", label: "30 days", hint: "Development/testing" },
+        {
+          value: "90days",
+          label: "90 days (recommended)",
+          hint: "Standard retention"
+        },
+        { value: "1year", label: "1 year", hint: "Compliance requirements" },
+        {
+          value: "indefinite",
+          label: "Indefinite",
+          hint: "Higher storage cost"
+        }
+      ],
+      initialValue: existingConfig?.eventTracking?.archiveRetention || "90days"
     });
-    if (clack4.isCancel(dynamoDBHistory)) {
+    if (clack4.isCancel(archiveRetention)) {
       clack4.cancel("Operation cancelled.");
       process.exit(0);
     }
-    if (dynamoDBHistory) {
-      archiveRetention = await clack4.select({
-        message: "Email history retention period:",
-        options: [
-          { value: "7days", label: "7 days", hint: "Minimal storage cost" },
-          { value: "30days", label: "30 days", hint: "Development/testing" },
-          {
-            value: "90days",
-            label: "90 days (recommended)",
-            hint: "Standard retention"
-          },
-          { value: "1year", label: "1 year", hint: "Compliance requirements" },
-          {
-            value: "indefinite",
-            label: "Indefinite",
-            hint: "Higher storage cost"
-          }
-        ],
-        initialValue: existingConfig?.eventTracking?.archiveRetention || "90days"
-      });
-      if (clack4.isCancel(archiveRetention)) {
-        clack4.cancel("Operation cancelled.");
-        process.exit(0);
-      }
-    }
   }
   const tlsRequired = await clack4.confirm({
     message: "Require TLS encryption for all emails?",
@@ -2232,14 +2262,40 @@ async function promptCustomConfig(existingConfig) {
     clack4.cancel("Operation cancelled.");
     process.exit(0);
   }
-  const reputationMetrics = await clack4.confirm({
-    message: "Enable reputation metrics dashboard?",
-    initialValue: existingConfig?.reputationMetrics ?? true
+  const customMailFrom = await clack4.confirm({
+    message: "Configure custom MAIL FROM domain? (improves DMARC alignment)",
+    initialValue: existingConfig?.mailFromDomain !== void 0
   });
-  if (clack4.isCancel(reputationMetrics)) {
+  if (clack4.isCancel(customMailFrom)) {
     clack4.cancel("Operation cancelled.");
     process.exit(0);
   }
+  let mailFromSubdomain = "mail";
+  if (customMailFrom) {
+    mailFromSubdomain = await clack4.text({
+      message: "MAIL FROM subdomain:",
+      placeholder: "mail",
+      initialValue: existingConfig?.mailFromDomain?.split(".")[0] || "mail",
+      validate: (value) => {
+        if (!value || value.trim() === "") {
+          return "Subdomain is required";
+        }
+        if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i.test(value)) {
+          return "Invalid subdomain format";
+        }
+        return void 0;
+      }
+    });
+    if (clack4.isCancel(mailFromSubdomain)) {
+      clack4.cancel("Operation cancelled.");
+      process.exit(0);
+    }
+    clack4.log.info(
+      pc5.dim(
+        `MAIL FROM will be set to ${mailFromSubdomain}.yourdomain.com`
+      )
+    );
+  }
   const dedicatedIp = await clack4.confirm({
     message: "Request dedicated IP address? (requires 100k+ emails/day)",
     initialValue: existingConfig?.dedicatedIp ?? false
@@ -2303,6 +2359,7 @@ async function promptCustomConfig(existingConfig) {
     } : { enabled: false },
     tlsRequired,
     reputationMetrics,
+    mailFromSubdomain: customMailFrom ? typeof mailFromSubdomain === "string" ? mailFromSubdomain : "mail" : void 0,
     suppressionList: {
       enabled: true,
       reasons: ["BOUNCE", "COMPLAINT"]
@@ -2320,7 +2377,7 @@ async function promptCustomConfig(existingConfig) {
         "REJECT",
         "RENDERING_FAILURE"
       ],
-      dynamoDBHistory: Boolean(dynamoDBHistory),
+      dynamoDBHistory: true,
       archiveRetention: typeof archiveRetention === "string" ? archiveRetention : "90days"
     } : { enabled: false },
     emailArchiving: emailArchivingEnabled ? {
@@ -2661,9 +2718,9 @@ init_esm_shims();
 import { readFileSync } from "fs";
 import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import * as clack14 from "@clack/prompts";
+import * as clack16 from "@clack/prompts";
 import args from "args";
-import pc15 from "picocolors";
+import pc17 from "picocolors";
 
 // src/commands/dashboard/update-role.ts
 init_esm_shims();
@@ -2954,13 +3011,15 @@ Verification should complete within a few minutes.`,
       )
     ];
     if (domain) {
+      const dmarcRuaDomain = outputs.mailFromDomain || domain;
       dnsLines.push(
         "",
         pc2.bold("SPF Record (TXT):"),
         `  ${pc2.cyan(domain)} ${pc2.dim("TXT")} "v=spf1 include:amazonses.com ~all"`,
+        pc2.dim("  Note: If you have an existing SPF record, add 'include:amazonses.com' to it"),
         "",
         pc2.bold("DMARC Record (TXT):"),
-        `  ${pc2.cyan(`_dmarc.${domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain}"`
+        `  ${pc2.cyan(`_dmarc.${domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
       );
       if (outputs.mailFromDomain) {
         dnsLines.push(
@@ -3018,7 +3077,7 @@ Verification should complete within a few minutes.`,
     if (outputs.customTrackingDomain) {
       console.log(
         `
-${pc2.dim("Run:")} ${pc2.yellow(`wraps verify --domain ${outputs.customTrackingDomain}`)} ${pc2.dim(
+${pc2.dim("Run:")} ${pc2.yellow(`wraps email verify --domain ${outputs.customTrackingDomain}`)} ${pc2.dim(
           "(after DNS propagates)"
         )}
 `
@@ -3070,7 +3129,7 @@ ${domainStrings.join("\n")}`);
     );
   } else {
     featureLines.push(
-      `  ${pc2.dim("\u25CB")} Email Tracking ${pc2.dim("(run 'wraps upgrade' to enable)")}`
+      `  ${pc2.dim("\u25CB")} Email Tracking ${pc2.dim("(run 'wraps email upgrade' to enable)")}`
     );
   }
   if (status2.resources.lambdaFunctions && status2.resources.lambdaFunctions > 0) {
@@ -3079,7 +3138,7 @@ ${domainStrings.join("\n")}`);
     );
   } else {
     featureLines.push(
-      `  ${pc2.dim("\u25CB")} Bounce/Complaint Handling ${pc2.dim("(run 'wraps upgrade' to enable)")}`
+      `  ${pc2.dim("\u25CB")} Bounce/Complaint Handling ${pc2.dim("(run 'wraps email upgrade' to enable)")}`
     );
   }
   if (status2.resources.archivingEnabled) {
@@ -3096,7 +3155,7 @@ ${domainStrings.join("\n")}`);
     );
   } else {
     featureLines.push(
-      `  ${pc2.dim("\u25CB")} Email Archiving ${pc2.dim("(run 'wraps upgrade' to enable)")}`
+      `  ${pc2.dim("\u25CB")} Email Archiving ${pc2.dim("(run 'wraps email upgrade' to enable)")}`
     );
   }
   if (status2.tracking?.customTrackingDomain) {
@@ -3109,7 +3168,7 @@ ${domainStrings.join("\n")}`);
     featureLines.push(`      ${pc2.cyan(status2.tracking.customTrackingDomain)}`);
   } else {
     featureLines.push(
-      `  ${pc2.dim("\u25CB")} Custom Tracking Domain ${pc2.dim("(run 'wraps upgrade' to enable)")}`
+      `  ${pc2.dim("\u25CB")} Custom Tracking Domain ${pc2.dim("(run 'wraps email upgrade' to enable)")}`
     );
   }
   featureLines.push(
@@ -3157,6 +3216,7 @@ ${domainStrings.join("\n")}`);
     for (const domain of domainsNeedingDNS) {
       const dnsLines = [];
       if (domain.status === "pending" && domain.dkimTokens && domain.dkimTokens.length > 0) {
+        const dmarcRuaDomain = domain.mailFromDomain || domain.domain;
         dnsLines.push(
           pc2.bold("DKIM Records (CNAME):"),
           ...domain.dkimTokens.map(
@@ -3165,9 +3225,10 @@ ${domainStrings.join("\n")}`);
           "",
           pc2.bold("SPF Record (TXT):"),
           `  ${pc2.cyan(domain.domain)} ${pc2.dim("TXT")} "v=spf1 include:amazonses.com ~all"`,
+          pc2.dim("  Note: If you have an existing SPF record, add 'include:amazonses.com' to it"),
           "",
           pc2.bold("DMARC Record (TXT):"),
-          `  ${pc2.cyan(`_dmarc.${domain.domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain.domain}"`
+          `  ${pc2.cyan(`_dmarc.${domain.domain}`)} ${pc2.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
         );
       }
       if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
@@ -3187,7 +3248,7 @@ ${domainStrings.join("\n")}`);
     const exampleDomain = domainsNeedingDNS[0].domain;
     console.log(
       `
-${pc2.dim("Run:")} ${pc2.yellow(`wraps verify --domain ${exampleDomain}`)} ${pc2.dim(
+${pc2.dim("Run:")} ${pc2.yellow(`wraps email verify --domain ${exampleDomain}`)} ${pc2.dim(
         "(after DNS propagates)"
       )}
 `
@@ -4133,20 +4194,22 @@ async function createSESResources(config2) {
     dkimTokens = domainIdentity.dkimSigningAttributes.apply(
       (attrs) => attrs?.tokens || []
     );
-    mailFromDomain = config2.mailFromDomain || `mail.${config2.domain}`;
-    new aws5.sesv2.EmailIdentityMailFromAttributes(
-      "wraps-email-mail-from",
-      {
-        emailIdentity: config2.domain,
-        mailFromDomain,
-        behaviorOnMxFailure: "USE_DEFAULT_VALUE"
-        // Fallback to amazonses.com if MX record fails
-      },
-      {
-        dependsOn: [domainIdentity]
-        // Ensure domain identity exists first
-      }
-    );
+    if (config2.mailFromDomain) {
+      mailFromDomain = config2.mailFromDomain;
+      new aws5.sesv2.EmailIdentityMailFromAttributes(
+        "wraps-email-mail-from",
+        {
+          emailIdentity: config2.domain,
+          mailFromDomain,
+          behaviorOnMxFailure: "USE_DEFAULT_VALUE"
+          // Fallback to amazonses.com if MX record fails
+        },
+        {
+          dependsOn: [domainIdentity]
+          // Ensure domain identity exists first
+        }
+      );
+    }
   }
   return {
     configSet,
@@ -4282,8 +4345,8 @@ async function deployEmailStack(config2) {
   let cloudFrontResources;
   let acmResources;
   if (emailConfig.tracking?.enabled && emailConfig.tracking.customRedirectDomain && emailConfig.tracking.httpsEnabled) {
-    const { findHostedZone: findHostedZone2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(
+    const { findHostedZone: findHostedZone3 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone3(
       emailConfig.tracking.customRedirectDomain,
       config2.region
     );
@@ -4309,9 +4372,13 @@ async function deployEmailStack(config2) {
       "wraps-email-eventbridge",
       config2.region
     );
+    let mailFromDomain = emailConfig.mailFromDomain;
+    if (!mailFromDomain && emailConfig.mailFromSubdomain && emailConfig.domain) {
+      mailFromDomain = `${emailConfig.mailFromSubdomain}.${emailConfig.domain}`;
+    }
     sesResources = await createSESResources({
       domain: emailConfig.domain,
-      mailFromDomain: emailConfig.mailFromDomain,
+      mailFromDomain,
       region: config2.region,
       trackingConfig: emailConfig.tracking,
       eventTypes: emailConfig.eventTracking?.events,
@@ -4384,6 +4451,7 @@ async function deployEmailStack(config2) {
 }
 
 // src/commands/email/config.ts
+init_events();
 init_aws();
 init_errors();
 
@@ -4418,6 +4486,7 @@ async function ensurePulumiInstalled() {
 
 // src/commands/email/config.ts
 async function config(options) {
+  const startTime = Date.now();
   clack3.intro(
     pc4.bold(
       options.preview ? "Wraps Config Preview" : "Wraps Config - Apply CLI Updates to Infrastructure"
@@ -4566,8 +4635,14 @@ ${pc4.bold("Current Configuration:")}
       clack3.outro(
         pc4.green("Preview complete. Run without --preview to update.")
       );
+      trackCommand("email:config", {
+        success: true,
+        preview: true,
+        duration_ms: Date.now() - startTime
+      });
       return;
     } catch (error) {
+      trackError("PREVIEW_FAILED", "email:config", { step: "preview" });
       if (error.message?.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
@@ -4629,9 +4704,15 @@ ${pc4.bold("Current Configuration:")}
       }
     );
   } catch (error) {
+    trackCommand("email:config", {
+      success: false,
+      duration_ms: Date.now() - startTime
+    });
     if (error.message?.includes("stack is currently locked")) {
+      trackError("STACK_LOCKED", "email:config", { step: "update" });
       throw errors.stackLocked();
     }
+    trackError("UPDATE_FAILED", "email:config", { step: "update" });
     throw new Error(`Pulumi update failed: ${error.message}`);
   }
   metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -4662,6 +4743,10 @@ ${pc4.green("\u2713")} ${pc4.bold("Update complete!")}
     `  ${pc4.cyan("3.")} View analytics at ${pc4.cyan("wraps console")}
 `
   );
+  trackCommand("email:config", {
+    success: true,
+    duration_ms: Date.now() - startTime
+  });
 }
 
 // src/commands/email/connect.ts
@@ -4669,6 +4754,7 @@ init_esm_shims();
 import * as clack5 from "@clack/prompts";
 import * as pulumi6 from "@pulumi/pulumi";
 import pc6 from "picocolors";
+init_events();
 init_presets();
 init_aws();
 init_errors();
@@ -4902,6 +4988,7 @@ async function scanAWSResources(region) {
 
 // src/commands/email/connect.ts
 async function connect(options) {
+  const startTime = Date.now();
   clack5.intro(
     pc6.bold(
       options.preview ? "Wraps Connect Preview" : "Wraps Connect - Link Existing Infrastructure"
@@ -5042,8 +5129,16 @@ async function connect(options) {
       clack5.outro(
         pc6.green("Preview complete. Run without --preview to connect.")
       );
+      trackServiceInit("email", true, {
+        preset,
+        provider,
+        preview: true,
+        duration_ms: Date.now() - startTime,
+        existing_identities: selectedIdentities.length
+      });
       return;
     } catch (error) {
+      trackError("PREVIEW_FAILED", "email:connect", { step: "preview" });
       if (error.message?.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
@@ -5103,14 +5198,21 @@ async function connect(options) {
       }
     );
   } catch (error) {
+    trackServiceInit("email", false, {
+      preset,
+      provider,
+      duration_ms: Date.now() - startTime
+    });
     if (error.message?.includes("stack is currently locked")) {
+      trackError("STACK_LOCKED", "email:connect", { step: "deploy" });
       throw errors.stackLocked();
     }
+    trackError("DEPLOYMENT_FAILED", "email:connect", { step: "deploy" });
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
+    const { findHostedZone: findHostedZone3, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone3(outputs.domain, region);
     if (hostedZone) {
       try {
         progress.start("Creating DNS records in Route53");
@@ -5172,105 +5274,407 @@ ${pc6.dim("Example:")}`);
     );
     console.log("");
   }
+  const duration = Date.now() - startTime;
+  const enabledFeatures = [];
+  if (emailConfig.tracking?.enabled) enabledFeatures.push("tracking");
+  if (emailConfig.suppressionList?.enabled)
+    enabledFeatures.push("suppression_list");
+  if (emailConfig.eventTracking?.enabled)
+    enabledFeatures.push("event_tracking");
+  if (emailConfig.eventTracking?.dynamoDBHistory)
+    enabledFeatures.push("dynamodb_history");
+  trackServiceInit("email", true, {
+    preset,
+    provider,
+    features: enabledFeatures,
+    duration_ms: duration,
+    existing_identities: selectedIdentities.length
+  });
+  trackServiceDeployed("email", {
+    duration_ms: duration,
+    features: enabledFeatures,
+    preset
+  });
 }
 
-// src/commands/email/domains.ts
+// src/commands/email/destroy.ts
 init_esm_shims();
+init_events();
 init_aws();
-import { Resolver } from "dns/promises";
-import { GetEmailIdentityCommand, SESv2Client as SESv2Client2 } from "@aws-sdk/client-sesv2";
 import * as clack6 from "@clack/prompts";
+import * as pulumi7 from "@pulumi/pulumi";
 import pc7 from "picocolors";
-async function verifyDomain(options) {
-  clack6.intro(pc7.bold(`Verifying ${options.domain}`));
-  const progress = new DeploymentProgress();
-  const region = await getAWSRegion();
-  const sesClient = new SESv2Client2({ region });
-  let identity;
-  let dkimTokens = [];
-  let mailFromDomain;
+
+// src/utils/route53.ts
+init_esm_shims();
+import {
+  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand2,
+  ListHostedZonesByNameCommand as ListHostedZonesByNameCommand2,
+  ListResourceRecordSetsCommand,
+  Route53Client as Route53Client2
+} from "@aws-sdk/client-route-53";
+async function findHostedZone2(domain, region) {
+  const client = new Route53Client2({ region });
   try {
-    identity = await progress.execute(
-      "Checking SES verification status",
-      async () => {
-        const response = await sesClient.send(
-          new GetEmailIdentityCommand({ EmailIdentity: options.domain })
-        );
-        return response;
-      }
+    const response = await client.send(
+      new ListHostedZonesByNameCommand2({
+        DNSName: domain,
+        MaxItems: 1
+      })
     );
-    dkimTokens = identity.DkimAttributes?.Tokens || [];
-    mailFromDomain = identity.MailFromAttributes?.MailFromDomain;
+    const zone = response.HostedZones?.[0];
+    if (zone && zone.Name === `${domain}.` && zone.Id) {
+      return {
+        id: zone.Id.replace("/hostedzone/", ""),
+        name: zone.Name
+      };
+    }
+    return null;
   } catch (_error) {
-    progress.stop();
-    clack6.log.error(`Domain ${options.domain} not found in SES`);
-    console.log(
-      `
-Run ${pc7.cyan(`wraps email init --domain ${options.domain}`)} to add this domain.
-`
-    );
-    process.exit(1);
-    return;
+    return null;
   }
-  const resolver = new Resolver();
-  resolver.setServers(["8.8.8.8", "1.1.1.1"]);
-  const dnsResults = [];
-  for (const token of dkimTokens) {
-    const dkimRecord = `${token}._domainkey.${options.domain}`;
-    try {
-      const records = await resolver.resolveCname(dkimRecord);
-      const expected = `${token}.dkim.amazonses.com`;
-      const found = records.some((r) => r === expected || r === `${expected}.`);
-      dnsResults.push({
-        name: dkimRecord,
-        type: "CNAME",
-        status: found ? "verified" : "incorrect",
-        records
-      });
-    } catch (_error) {
-      dnsResults.push({
-        name: dkimRecord,
-        type: "CNAME",
-        status: "missing"
+}
+async function deleteDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
+  const client = new Route53Client2({ region });
+  const response = await client.send(
+    new ListResourceRecordSetsCommand({
+      HostedZoneId: hostedZoneId,
+      MaxItems: 500
+    })
+  );
+  const recordSets = response.ResourceRecordSets || [];
+  const changes = [];
+  const addDeletionIfExists = (name, type) => {
+    const normalizedName = name.endsWith(".") ? name : `${name}.`;
+    const record = recordSets.find(
+      (rs) => rs.Name === normalizedName && rs.Type === type
+    );
+    if (record && record.ResourceRecords) {
+      changes.push({
+        Action: "DELETE",
+        ResourceRecordSet: record
       });
     }
+  };
+  for (const token of dkimTokens) {
+    addDeletionIfExists(`${token}._domainkey.${domain}`, "CNAME");
   }
-  try {
-    const records = await resolver.resolveTxt(options.domain);
-    const spfRecord = records.flat().find((r) => r.startsWith("v=spf1"));
-    const hasAmazonSES = spfRecord?.includes("include:amazonses.com");
-    dnsResults.push({
-      name: options.domain,
-      type: "TXT (SPF)",
-      status: hasAmazonSES ? "verified" : spfRecord ? "incorrect" : "missing",
-      records: spfRecord ? [spfRecord] : void 0
-    });
-  } catch (_error) {
-    dnsResults.push({
-      name: options.domain,
-      type: "TXT (SPF)",
-      status: "missing"
-    });
+  addDeletionIfExists(`_dmarc.${domain}`, "TXT");
+  if (customTrackingDomain) {
+    addDeletionIfExists(customTrackingDomain, "CNAME");
+  }
+  if (mailFromDomain) {
+    addDeletionIfExists(mailFromDomain, "MX");
+    addDeletionIfExists(mailFromDomain, "TXT");
+  }
+  if (changes.length === 0) {
+    return;
   }
+  await client.send(
+    new ChangeResourceRecordSetsCommand2({
+      HostedZoneId: hostedZoneId,
+      ChangeBatch: {
+        Changes: changes
+      }
+    })
+  );
+}
+
+// src/commands/email/destroy.ts
+async function getDkimTokensFromSES(domain, region) {
   try {
-    const records = await resolver.resolveTxt(`_dmarc.${options.domain}`);
-    const dmarcRecord = records.flat().find((r) => r.startsWith("v=DMARC1"));
-    dnsResults.push({
-      name: `_dmarc.${options.domain}`,
-      type: "TXT (DMARC)",
-      status: dmarcRecord ? "verified" : "missing",
-      records: dmarcRecord ? [dmarcRecord] : void 0
-    });
+    const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
+    const ses = new SESv2Client5({ region });
+    const response = await ses.send(
+      new GetEmailIdentityCommand4({ EmailIdentity: domain })
+    );
+    return response.DkimAttributes?.Tokens || [];
   } catch (_error) {
-    dnsResults.push({
-      name: `_dmarc.${options.domain}`,
-      type: "TXT (DMARC)",
-      status: "missing"
+    return [];
+  }
+}
+async function emailDestroy(options) {
+  const startTime = Date.now();
+  clack6.intro(
+    pc7.bold(
+      options.preview ? "Email Infrastructure Destruction Preview" : "Email Infrastructure Teardown"
+    )
+  );
+  const progress = new DeploymentProgress();
+  const identity = await progress.execute(
+    "Validating AWS credentials",
+    async () => validateAWSCredentials()
+  );
+  const region = await getAWSRegion();
+  const metadata = await loadConnectionMetadata(identity.accountId, region);
+  const emailService = metadata?.services?.email;
+  const emailConfig = emailService?.config;
+  const domain = emailConfig?.domain;
+  const storedStackName = emailService?.pulumiStackName;
+  if (!(options.force || options.preview)) {
+    const confirmed = await clack6.confirm({
+      message: pc7.red(
+        "Are you sure you want to destroy all email infrastructure?"
+      ),
+      initialValue: false
     });
+    if (clack6.isCancel(confirmed) || !confirmed) {
+      clack6.cancel("Destruction cancelled.");
+      process.exit(0);
+    }
   }
-  if (mailFromDomain) {
+  let shouldCleanDNS = false;
+  let hostedZone = null;
+  let dkimTokens = [];
+  if (domain && !options.preview) {
+    hostedZone = await findHostedZone2(domain, region);
+    if (hostedZone) {
+      dkimTokens = await getDkimTokensFromSES(domain, region);
+      if (!options.force) {
+        const cleanDNS = await clack6.confirm({
+          message: `Found Route53 hosted zone for ${pc7.cyan(domain)}. Delete DNS records (DKIM, DMARC, MAIL FROM)?`,
+          initialValue: true
+        });
+        if (clack6.isCancel(cleanDNS)) {
+          clack6.cancel("Destruction cancelled.");
+          process.exit(0);
+        }
+        shouldCleanDNS = cleanDNS;
+      } else {
+        shouldCleanDNS = true;
+      }
+    }
+  }
+  if (options.preview) {
     try {
-      const mxRecords = await resolver.resolveMx(mailFromDomain);
+      const previewResult = await progress.execute(
+        "Generating destruction preview",
+        async () => {
+          await ensurePulumiWorkDir();
+          const stackName = storedStackName || `wraps-email-${identity.accountId}-${region}`;
+          let stack;
+          try {
+            stack = await pulumi7.automation.LocalWorkspace.selectStack({
+              stackName,
+              workDir: getPulumiWorkDir()
+            });
+          } catch (_error) {
+            throw new Error("No email infrastructure found to preview");
+          }
+          const result = await stack.preview({ diff: true });
+          return result;
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        costEstimate: "Monthly cost after destruction: $0.00",
+        commandName: "wraps email destroy"
+      });
+      if (domain) {
+        const previewHostedZone = await findHostedZone2(domain, region);
+        if (previewHostedZone) {
+          clack6.log.info(
+            `DNS records in Route53 for ${pc7.cyan(domain)} will also be deleted`
+          );
+        }
+      }
+      clack6.outro(
+        pc7.green("Preview complete. Run without --preview to destroy.")
+      );
+      trackServiceRemoved("email", {
+        preview: true,
+        duration_ms: Date.now() - startTime
+      });
+      return;
+    } catch (error) {
+      progress.stop();
+      if (error.message.includes("No email infrastructure found")) {
+        clack6.log.warn("No email infrastructure found to preview");
+        process.exit(0);
+      }
+      trackError("PREVIEW_FAILED", "email destroy", { step: "preview" });
+      throw new Error(`Preview failed: ${error.message}`);
+    }
+  }
+  if (shouldCleanDNS && hostedZone && domain && dkimTokens.length > 0) {
+    try {
+      await progress.execute(
+        `Deleting DNS records for ${domain}`,
+        async () => {
+          await deleteDNSRecords(
+            hostedZone.id,
+            domain,
+            dkimTokens,
+            region,
+            emailConfig?.tracking?.customRedirectDomain,
+            emailConfig?.mailFromDomain
+          );
+        }
+      );
+    } catch (error) {
+      clack6.log.warn(`Could not delete DNS records: ${error.message}`);
+      clack6.log.info("You may need to delete them manually from Route53");
+    }
+  }
+  try {
+    await progress.execute(
+      "Destroying email infrastructure (this may take 2-3 minutes)",
+      async () => {
+        await ensurePulumiWorkDir();
+        const stackName = storedStackName || `wraps-email-${identity.accountId}-${region}`;
+        let stack;
+        try {
+          stack = await pulumi7.automation.LocalWorkspace.selectStack({
+            stackName,
+            workDir: getPulumiWorkDir()
+          });
+        } catch (_error) {
+          throw new Error("No email infrastructure found to destroy");
+        }
+        await stack.destroy({ onOutput: () => {
+        } });
+        await stack.workspace.removeStack(stackName);
+      }
+    );
+  } catch (error) {
+    progress.stop();
+    if (error.message.includes("No email infrastructure found")) {
+      clack6.log.warn("No email infrastructure found");
+      await deleteConnectionMetadata(identity.accountId, region);
+      process.exit(0);
+    }
+    trackError("DESTROY_FAILED", "email destroy", { step: "destroy" });
+    clack6.log.error("Email infrastructure destruction failed");
+    throw error;
+  }
+  await deleteConnectionMetadata(identity.accountId, region);
+  progress.stop();
+  const deletedItems = ["AWS infrastructure"];
+  if (shouldCleanDNS && hostedZone) {
+    deletedItems.push("Route53 DNS records");
+  }
+  clack6.outro(pc7.green(`Email infrastructure has been removed`));
+  if (domain) {
+    console.log(`
+${pc7.bold("Cleaned up:")}`);
+    for (const item of deletedItems) {
+      console.log(`  ${pc7.green("\u2713")} ${item}`);
+    }
+    console.log(
+      `
+${pc7.dim("Note: SPF record was not deleted. Remove 'include:amazonses.com' manually if needed.")}`
+    );
+  }
+  console.log(
+    `
+Run ${pc7.cyan("wraps email init")} to deploy infrastructure again.
+`
+  );
+  trackServiceRemoved("email", {
+    reason: "user_initiated",
+    duration_ms: Date.now() - startTime,
+    dns_cleaned: shouldCleanDNS
+  });
+}
+
+// src/commands/email/domains.ts
+init_esm_shims();
+init_events();
+init_aws();
+import { Resolver } from "dns/promises";
+import { GetEmailIdentityCommand, SESv2Client as SESv2Client2 } from "@aws-sdk/client-sesv2";
+import * as clack7 from "@clack/prompts";
+import pc8 from "picocolors";
+async function verifyDomain(options) {
+  clack7.intro(pc8.bold(`Verifying ${options.domain}`));
+  const progress = new DeploymentProgress();
+  const region = await getAWSRegion();
+  const sesClient = new SESv2Client2({ region });
+  let identity;
+  let dkimTokens = [];
+  let mailFromDomain;
+  try {
+    identity = await progress.execute(
+      "Checking SES verification status",
+      async () => {
+        const response = await sesClient.send(
+          new GetEmailIdentityCommand({ EmailIdentity: options.domain })
+        );
+        return response;
+      }
+    );
+    dkimTokens = identity.DkimAttributes?.Tokens || [];
+    mailFromDomain = identity.MailFromAttributes?.MailFromDomain;
+  } catch (_error) {
+    progress.stop();
+    clack7.log.error(`Domain ${options.domain} not found in SES`);
+    console.log(
+      `
+Run ${pc8.cyan(`wraps email init --domain ${options.domain}`)} to add this domain.
+`
+    );
+    process.exit(1);
+    return;
+  }
+  const resolver = new Resolver();
+  resolver.setServers(["8.8.8.8", "1.1.1.1"]);
+  const dnsResults = [];
+  for (const token of dkimTokens) {
+    const dkimRecord = `${token}._domainkey.${options.domain}`;
+    try {
+      const records = await resolver.resolveCname(dkimRecord);
+      const expected = `${token}.dkim.amazonses.com`;
+      const found = records.some((r) => r === expected || r === `${expected}.`);
+      dnsResults.push({
+        name: dkimRecord,
+        type: "CNAME",
+        status: found ? "verified" : "incorrect",
+        records
+      });
+    } catch (_error) {
+      dnsResults.push({
+        name: dkimRecord,
+        type: "CNAME",
+        status: "missing"
+      });
+    }
+  }
+  try {
+    const records = await resolver.resolveTxt(options.domain);
+    const spfRecord = records.flat().find((r) => r.startsWith("v=spf1"));
+    const hasAmazonSES = spfRecord?.includes("include:amazonses.com");
+    dnsResults.push({
+      name: options.domain,
+      type: "TXT (SPF)",
+      status: hasAmazonSES ? "verified" : spfRecord ? "incorrect" : "missing",
+      records: spfRecord ? [spfRecord] : void 0
+    });
+  } catch (_error) {
+    dnsResults.push({
+      name: options.domain,
+      type: "TXT (SPF)",
+      status: "missing"
+    });
+  }
+  try {
+    const records = await resolver.resolveTxt(`_dmarc.${options.domain}`);
+    const dmarcRecord = records.flat().find((r) => r.startsWith("v=DMARC1"));
+    dnsResults.push({
+      name: `_dmarc.${options.domain}`,
+      type: "TXT (DMARC)",
+      status: dmarcRecord ? "verified" : "missing",
+      records: dmarcRecord ? [dmarcRecord] : void 0
+    });
+  } catch (_error) {
+    dnsResults.push({
+      name: `_dmarc.${options.domain}`,
+      type: "TXT (DMARC)",
+      status: "missing"
+    });
+  }
+  if (mailFromDomain) {
+    try {
+      const mxRecords = await resolver.resolveMx(mailFromDomain);
       const expectedMx = `feedback-smtp.${region}.amazonses.com`;
       const hasMx = mxRecords.some(
         (r) => r.exchange === expectedMx || r.exchange === `${expectedMx}.`
@@ -5311,63 +5715,69 @@ Run ${pc7.cyan(`wraps email init --domain ${options.domain}`)} to add this domai
   const dkimStatus = identity.DkimAttributes?.Status || "PENDING";
   const mailFromStatus = identity.MailFromAttributes?.MailFromDomainStatus || "NOT_CONFIGURED";
   const statusLines = [
-    `${pc7.bold("Domain:")} ${options.domain}`,
-    `${pc7.bold("Verification Status:")} ${verificationStatus === "verified" ? pc7.green("\u2713 Verified") : pc7.yellow("\u23F1 Pending")}`,
-    `${pc7.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc7.green("\u2713 Success") : pc7.yellow(`\u23F1 ${dkimStatus}`)}`
+    `${pc8.bold("Domain:")} ${options.domain}`,
+    `${pc8.bold("Verification Status:")} ${verificationStatus === "verified" ? pc8.green("\u2713 Verified") : pc8.yellow("\u23F1 Pending")}`,
+    `${pc8.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc8.green("\u2713 Success") : pc8.yellow(`\u23F1 ${dkimStatus}`)}`
   ];
   if (mailFromDomain) {
     statusLines.push(
-      `${pc7.bold("MAIL FROM Domain:")} ${mailFromDomain}`,
-      `${pc7.bold("MAIL FROM Status:")} ${mailFromStatus === "SUCCESS" ? pc7.green("\u2713 Success") : mailFromStatus === "NOT_CONFIGURED" ? pc7.yellow("\u23F1 Not Configured") : pc7.yellow(`\u23F1 ${mailFromStatus}`)}`
+      `${pc8.bold("MAIL FROM Domain:")} ${mailFromDomain}`,
+      `${pc8.bold("MAIL FROM Status:")} ${mailFromStatus === "SUCCESS" ? pc8.green("\u2713 Success") : mailFromStatus === "NOT_CONFIGURED" ? pc8.yellow("\u23F1 Not Configured") : pc8.yellow(`\u23F1 ${mailFromStatus}`)}`
     );
   }
-  clack6.note(statusLines.join("\n"), "SES Status");
+  clack7.note(statusLines.join("\n"), "SES Status");
   const dnsLines = dnsResults.map((record) => {
     let statusIcon;
     let statusColor;
     if (record.status === "verified") {
       statusIcon = "\u2713";
-      statusColor = pc7.green;
+      statusColor = pc8.green;
     } else if (record.status === "incorrect") {
       statusIcon = "\u2717";
-      statusColor = pc7.red;
+      statusColor = pc8.red;
     } else {
       statusIcon = "\u2717";
-      statusColor = pc7.red;
+      statusColor = pc8.red;
     }
     const recordInfo = record.records ? ` \u2192 ${record.records.join(", ")}` : "";
     return `  ${statusColor(statusIcon)} ${record.name} (${record.type}) ${statusColor(
       record.status
     )}${recordInfo}`;
   });
-  clack6.note(dnsLines.join("\n"), "DNS Records");
+  clack7.note(dnsLines.join("\n"), "DNS Records");
   const allVerified = dnsResults.every((r) => r.status === "verified");
   const someIncorrect = dnsResults.some((r) => r.status === "incorrect");
   if (verificationStatus === "verified" && allVerified) {
-    clack6.outro(
-      pc7.green("\u2713 Domain is fully verified and ready to send emails!")
+    clack7.outro(
+      pc8.green("\u2713 Domain is fully verified and ready to send emails!")
     );
+    trackFeature("domain_verified", { dns_auto_detected: true });
   } else if (someIncorrect) {
-    clack6.outro(
-      pc7.red("\u2717 Some DNS records are incorrect. Please update them.")
+    clack7.outro(
+      pc8.red("\u2717 Some DNS records are incorrect. Please update them.")
     );
     console.log(
       `
-Run ${pc7.cyan("wraps email status")} to see the correct DNS records.
+Run ${pc8.cyan("wraps email status")} to see the correct DNS records.
 `
     );
   } else {
-    clack6.outro(
-      pc7.yellow("\u23F1 Waiting for DNS propagation and SES verification")
+    clack7.outro(
+      pc8.yellow("\u23F1 Waiting for DNS propagation and SES verification")
     );
     console.log("\nDNS records can take up to 48 hours to propagate.");
     console.log(
       "SES verification usually completes within 72 hours after DNS propagation.\n"
     );
   }
+  trackCommand("email:domains:verify", {
+    success: true,
+    verified: verificationStatus === "verified" && allVerified,
+    dkim_status: dkimStatus
+  });
 }
 async function addDomain(options) {
-  clack6.intro(pc7.bold(`Adding domain ${options.domain} to SES`));
+  clack7.intro(pc8.bold(`Adding domain ${options.domain} to SES`));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
   const sesClient = new SESv2Client2({ region });
@@ -5377,10 +5787,10 @@ async function addDomain(options) {
         new GetEmailIdentityCommand({ EmailIdentity: options.domain })
       );
       progress.stop();
-      clack6.log.warn(`Domain ${options.domain} already exists in SES`);
+      clack7.log.warn(`Domain ${options.domain} already exists in SES`);
       console.log(
         `
-Run ${pc7.cyan(`wraps email domains verify --domain ${options.domain}`)} to check verification status.
+Run ${pc8.cyan(`wraps email domains verify --domain ${options.domain}`)} to check verification status.
 `
       );
       return;
@@ -5405,30 +5815,37 @@ Run ${pc7.cyan(`wraps email domains verify --domain ${options.domain}`)} to chec
     );
     const dkimTokens = identity.DkimAttributes?.Tokens || [];
     progress.stop();
-    clack6.outro(pc7.green(`\u2713 Domain ${options.domain} added successfully!`));
+    clack7.outro(pc8.green(`\u2713 Domain ${options.domain} added successfully!`));
     console.log(`
-${pc7.bold("Next steps:")}
+${pc8.bold("Next steps:")}
 `);
     console.log("1. Add the following DKIM records to your DNS:\n");
     for (const token of dkimTokens) {
-      console.log(`   ${pc7.cyan(`${token}._domainkey.${options.domain}`)}`);
+      console.log(`   ${pc8.cyan(`${token}._domainkey.${options.domain}`)}`);
       console.log(
-        `   ${pc7.dim("Type:")} CNAME  ${pc7.dim("Value:")} ${token}.dkim.amazonses.com
+        `   ${pc8.dim("Type:")} CNAME  ${pc8.dim("Value:")} ${token}.dkim.amazonses.com
 `
       );
     }
     console.log(
-      `2. Verify DNS propagation: ${pc7.cyan(`wraps email domains verify --domain ${options.domain}`)}`
+      `2. Verify DNS propagation: ${pc8.cyan(`wraps email domains verify --domain ${options.domain}`)}`
     );
-    console.log(`3. Check status: ${pc7.cyan("wraps email status")}
+    console.log(`3. Check status: ${pc8.cyan("wraps email status")}
 `);
+    trackCommand("email:domains:add", {
+      success: true
+    });
+    trackFeature("domain_added", {});
   } catch (error) {
     progress.stop();
+    trackCommand("email:domains:add", {
+      success: false
+    });
     throw error;
   }
 }
 async function listDomains() {
-  clack6.intro(pc7.bold("SES Email Domains"));
+  clack7.intro(pc8.bold("SES Email Domains"));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
   const sesClient = new SESv2Client2({ region });
@@ -5448,10 +5865,10 @@ async function listDomains() {
     );
     progress.stop();
     if (domains.length === 0) {
-      clack6.outro("No domains found in SES");
+      clack7.outro("No domains found in SES");
       console.log(
         `
-Run ${pc7.cyan("wraps email domains add <domain>")} to add a domain.
+Run ${pc8.cyan("wraps email domains add <domain>")} to add a domain.
 `
       );
       return;
@@ -5479,26 +5896,31 @@ Run ${pc7.cyan("wraps email domains add <domain>")} to add a domain.
       })
     );
     const domainLines = domainDetails.map((domain) => {
-      const statusIcon = domain.verified ? pc7.green("\u2713") : pc7.yellow("\u23F1");
-      const dkimIcon = domain.dkimStatus === "SUCCESS" ? pc7.green("\u2713") : pc7.yellow("\u23F1");
-      return `  ${statusIcon} ${pc7.bold(domain.name)}  DKIM: ${dkimIcon} ${domain.dkimStatus}`;
+      const statusIcon = domain.verified ? pc8.green("\u2713") : pc8.yellow("\u23F1");
+      const dkimIcon = domain.dkimStatus === "SUCCESS" ? pc8.green("\u2713") : pc8.yellow("\u23F1");
+      return `  ${statusIcon} ${pc8.bold(domain.name)}  DKIM: ${dkimIcon} ${domain.dkimStatus}`;
     });
-    clack6.note(
+    clack7.note(
       domainLines.join("\n"),
       `${domains.length} domain(s) in ${region}`
     );
-    clack6.outro(
-      pc7.dim(
-        `Run ${pc7.cyan("wraps email domains verify --domain <domain>")} for details`
+    clack7.outro(
+      pc8.dim(
+        `Run ${pc8.cyan("wraps email domains verify --domain <domain>")} for details`
       )
     );
+    trackCommand("email:domains:list", {
+      success: true,
+      domain_count: domains.length
+    });
   } catch (error) {
     progress.stop();
+    trackCommand("email:domains:list", { success: false });
     throw error;
   }
 }
 async function getDkim(options) {
-  clack6.intro(pc7.bold(`DKIM Tokens for ${options.domain}`));
+  clack7.intro(pc8.bold(`DKIM Tokens for ${options.domain}`));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
   const sesClient = new SESv2Client2({ region });
@@ -5516,33 +5938,38 @@ async function getDkim(options) {
     const dkimStatus = identity.DkimAttributes?.Status || "PENDING";
     progress.stop();
     if (dkimTokens.length === 0) {
-      clack6.outro(pc7.yellow("No DKIM tokens found for this domain"));
+      clack7.outro(pc8.yellow("No DKIM tokens found for this domain"));
       return;
     }
-    const statusLine = `${pc7.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc7.green("\u2713 Verified") : pc7.yellow(`\u23F1 ${dkimStatus}`)}`;
-    clack6.note(statusLine, "Status");
+    const statusLine = `${pc8.bold("DKIM Status:")} ${dkimStatus === "SUCCESS" ? pc8.green("\u2713 Verified") : pc8.yellow(`\u23F1 ${dkimStatus}`)}`;
+    clack7.note(statusLine, "Status");
     console.log(`
-${pc7.bold("DNS Records to add:")}
+${pc8.bold("DNS Records to add:")}
 `);
     for (const token of dkimTokens) {
-      console.log(`${pc7.cyan(`${token}._domainkey.${options.domain}`)}`);
-      console.log(`  ${pc7.dim("Type:")} CNAME`);
-      console.log(`  ${pc7.dim("Value:")} ${token}.dkim.amazonses.com
+      console.log(`${pc8.cyan(`${token}._domainkey.${options.domain}`)}`);
+      console.log(`  ${pc8.dim("Type:")} CNAME`);
+      console.log(`  ${pc8.dim("Value:")} ${token}.dkim.amazonses.com
 `);
     }
     if (dkimStatus !== "SUCCESS") {
       console.log(
-        `${pc7.dim("After adding these records, run:")} ${pc7.cyan(`wraps email domains verify --domain ${options.domain}`)}
+        `${pc8.dim("After adding these records, run:")} ${pc8.cyan(`wraps email domains verify --domain ${options.domain}`)}
 `
       );
     }
+    trackCommand("email:domains:get-dkim", {
+      success: true,
+      dkim_status: dkimStatus
+    });
   } catch (error) {
     progress.stop();
+    trackCommand("email:domains:get-dkim", { success: false });
     if (error.name === "NotFoundException") {
-      clack6.log.error(`Domain ${options.domain} not found in SES`);
+      clack7.log.error(`Domain ${options.domain} not found in SES`);
       console.log(
         `
-Run ${pc7.cyan(`wraps email domains add ${options.domain}`)} to add this domain.
+Run ${pc8.cyan(`wraps email domains add ${options.domain}`)} to add this domain.
 `
       );
       process.exit(1);
@@ -5552,7 +5979,7 @@ Run ${pc7.cyan(`wraps email domains add ${options.domain}`)} to add this domain.
   }
 }
 async function removeDomain(options) {
-  clack6.intro(pc7.bold(`Remove domain ${options.domain} from SES`));
+  clack7.intro(pc8.bold(`Remove domain ${options.domain} from SES`));
   const progress = new DeploymentProgress();
   const region = await getAWSRegion();
   const sesClient = new SESv2Client2({ region });
@@ -5564,12 +5991,12 @@ async function removeDomain(options) {
     });
     progress.stop();
     if (!options.force) {
-      const shouldContinue = await clack6.confirm({
-        message: `Are you sure you want to remove ${pc7.red(options.domain)} from SES?`,
+      const shouldContinue = await clack7.confirm({
+        message: `Are you sure you want to remove ${pc8.red(options.domain)} from SES?`,
         initialValue: false
       });
-      if (clack6.isCancel(shouldContinue) || !shouldContinue) {
-        clack6.cancel("Operation cancelled");
+      if (clack7.isCancel(shouldContinue) || !shouldContinue) {
+        clack7.cancel("Operation cancelled");
         process.exit(0);
       }
     }
@@ -5582,11 +6009,16 @@ async function removeDomain(options) {
       );
     });
     progress.stop();
-    clack6.outro(pc7.green(`\u2713 Domain ${options.domain} removed successfully`));
+    clack7.outro(pc8.green(`\u2713 Domain ${options.domain} removed successfully`));
+    trackCommand("email:domains:remove", {
+      success: true
+    });
+    trackFeature("domain_removed", {});
   } catch (error) {
     progress.stop();
+    trackCommand("email:domains:remove", { success: false });
     if (error.name === "NotFoundException") {
-      clack6.log.error(`Domain ${options.domain} not found in SES`);
+      clack7.log.error(`Domain ${options.domain} not found in SES`);
       process.exit(1);
       return;
     }
@@ -5596,17 +6028,19 @@ async function removeDomain(options) {
 
 // src/commands/email/init.ts
 init_esm_shims();
-import * as clack7 from "@clack/prompts";
-import * as pulumi7 from "@pulumi/pulumi";
-import pc8 from "picocolors";
+import * as clack8 from "@clack/prompts";
+import * as pulumi8 from "@pulumi/pulumi";
+import pc9 from "picocolors";
+init_events();
 init_costs();
 init_presets();
 init_aws();
 init_errors();
 init_prompts();
 async function init(options) {
-  clack7.intro(
-    pc8.bold(
+  const startTime = Date.now();
+  clack8.intro(
+    pc9.bold(
       options.preview ? "Wraps Email Infrastructure Preview" : "Wraps Email Infrastructure Setup"
     )
   );
@@ -5622,7 +6056,7 @@ async function init(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc8.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc9.cyan(identity.accountId)}`);
   let provider = options.provider;
   if (!provider) {
     provider = await promptProvider();
@@ -5645,12 +6079,12 @@ async function init(options) {
     region
   );
   if (existingConnection) {
-    clack7.log.warn(
-      `Connection already exists for account ${pc8.cyan(identity.accountId)} in region ${pc8.cyan(region)}`
+    clack8.log.warn(
+      `Connection already exists for account ${pc9.cyan(identity.accountId)} in region ${pc9.cyan(region)}`
     );
-    clack7.log.info(`Created: ${existingConnection.timestamp}`);
-    clack7.log.info(`Use ${pc8.cyan("wraps status")} to view current setup`);
-    clack7.log.info(`Use ${pc8.cyan("wraps upgrade")} to add more features`);
+    clack8.log.info(`Created: ${existingConnection.timestamp}`);
+    clack8.log.info(`Use ${pc9.cyan("wraps status")} to view current setup`);
+    clack8.log.info(`Use ${pc9.cyan("wraps upgrade")} to add more features`);
     process.exit(0);
   }
   let preset = options.preset;
@@ -5671,15 +6105,15 @@ async function init(options) {
   }
   const estimatedVolume = await promptEstimatedVolume();
   progress.info(`
-${pc8.bold("Cost Estimate:")}`);
+${pc9.bold("Cost Estimate:")}`);
   const costSummary = getCostSummary(emailConfig, estimatedVolume);
-  clack7.log.info(costSummary);
+  clack8.log.info(costSummary);
   const warnings = validateConfig(emailConfig);
   if (warnings.length > 0) {
     progress.info(`
-${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
+${pc9.yellow(pc9.bold("Configuration Warnings:"))}`);
     for (const warning of warnings) {
-      clack7.log.warn(warning);
+      clack8.log.warn(warning);
     }
   }
   const metadata = createConnectionMetadata(
@@ -5695,7 +6129,7 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
   if (!(options.yes || options.preview)) {
     const confirmed = await confirmDeploy();
     if (!confirmed) {
-      clack7.cancel("Deployment cancelled.");
+      clack8.cancel("Deployment cancelled.");
       process.exit(0);
     }
   }
@@ -5711,7 +6145,7 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
         "Generating infrastructure preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi7.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi8.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -5752,11 +6186,18 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
         costEstimate: costSummary,
         commandName: "wraps email init"
       });
-      clack7.outro(
-        pc8.green("Preview complete. Run without --preview to deploy.")
+      clack8.outro(
+        pc9.green("Preview complete. Run without --preview to deploy.")
       );
+      trackServiceInit("email", true, {
+        preset,
+        provider,
+        preview: true,
+        duration_ms: Date.now() - startTime
+      });
       return;
     } catch (error) {
+      trackError("PREVIEW_FAILED", "email:init", { step: "preview" });
       if (error.message?.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
@@ -5769,7 +6210,7 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
       "Deploying infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi7.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi8.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -5826,9 +6267,16 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
       }
     );
   } catch (error) {
+    trackServiceInit("email", false, {
+      preset,
+      provider,
+      duration_ms: Date.now() - startTime
+    });
     if (error.message?.includes("stack is currently locked")) {
+      trackError("STACK_LOCKED", "email:init", { step: "deploy" });
       throw errors.stackLocked();
     }
+    trackError("DEPLOYMENT_FAILED", "email:init", { step: "deploy" });
     throw new Error(`Pulumi deployment failed: ${error.message}`);
   }
   if (metadata.services.email) {
@@ -5838,8 +6286,8 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
   progress.info("Connection metadata saved for upgrade and restore capability");
   let dnsAutoCreated = false;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
+    const { findHostedZone: findHostedZone3, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone3(outputs.domain, region);
     if (hostedZone) {
       try {
         progress.start("Creating DNS records in Route53");
@@ -5855,7 +6303,7 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
         dnsAutoCreated = true;
       } catch (error) {
         progress.fail("Failed to create DNS records in Route53");
-        clack7.log.warn(`Could not auto-create DNS records: ${error.message}`);
+        clack8.log.warn(`Could not auto-create DNS records: ${error.message}`);
       }
     }
   }
@@ -5879,24 +6327,49 @@ ${pc8.yellow(pc8.bold("Configuration Warnings:"))}`);
     domain: outputs.domain,
     mailFromDomain: outputs.mailFromDomain
   });
+  const duration = Date.now() - startTime;
+  const enabledFeatures = [];
+  if (emailConfig.tracking?.enabled) enabledFeatures.push("tracking");
+  if (emailConfig.suppressionList?.enabled)
+    enabledFeatures.push("suppression_list");
+  if (emailConfig.eventTracking?.enabled)
+    enabledFeatures.push("event_tracking");
+  if (emailConfig.eventTracking?.dynamoDBHistory)
+    enabledFeatures.push("dynamodb_history");
+  if (emailConfig.dedicatedIp) enabledFeatures.push("dedicated_ip");
+  if (emailConfig.emailArchiving?.enabled)
+    enabledFeatures.push("email_archiving");
+  trackServiceInit("email", true, {
+    preset,
+    provider,
+    features: enabledFeatures,
+    duration_ms: duration
+  });
+  trackServiceDeployed("email", {
+    duration_ms: duration,
+    features: enabledFeatures,
+    preset
+  });
 }
 
 // src/commands/email/restore.ts
 init_esm_shims();
+init_events();
 init_aws();
-import * as clack8 from "@clack/prompts";
-import * as pulumi8 from "@pulumi/pulumi";
-import pc9 from "picocolors";
+import * as clack9 from "@clack/prompts";
+import * as pulumi9 from "@pulumi/pulumi";
+import pc10 from "picocolors";
 async function restore(options) {
-  clack8.intro(
-    pc9.bold(
+  const startTime = Date.now();
+  clack9.intro(
+    pc10.bold(
       options.preview ? "Wraps Restore Preview" : "Wraps Restore - Remove Wraps Infrastructure"
     )
   );
-  clack8.log.info(
-    `${pc9.yellow("Note:")} This will remove all Wraps-managed infrastructure.`
+  clack9.log.info(
+    `${pc10.yellow("Note:")} This will remove all Wraps-managed infrastructure.`
   );
-  clack8.log.info(
+  clack9.log.info(
     "Your original AWS resources remain untouched (Wraps never modifies them).\n"
   );
   const progress = new DeploymentProgress();
@@ -5904,7 +6377,7 @@ async function restore(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc9.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc10.cyan(identity.accountId)}`);
   let region = options.region;
   if (!region) {
     const defaultRegion = await getAWSRegion();
@@ -5912,40 +6385,40 @@ async function restore(options) {
   }
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
-    clack8.log.error(
-      `No Wraps connection found for account ${pc9.cyan(identity.accountId)} in region ${pc9.cyan(region)}`
+    clack9.log.error(
+      `No Wraps connection found for account ${pc10.cyan(identity.accountId)} in region ${pc10.cyan(region)}`
     );
-    clack8.log.info(
-      `Use ${pc9.cyan("wraps email init")} or ${pc9.cyan("wraps email connect")} to create a connection first.`
+    clack9.log.info(
+      `Use ${pc10.cyan("wraps email init")} or ${pc10.cyan("wraps email connect")} to create a connection first.`
     );
     process.exit(1);
   }
   progress.info(`Found connection created: ${metadata.timestamp}`);
   console.log(
     `
-${pc9.bold("The following Wraps resources will be removed:")}
+${pc10.bold("The following Wraps resources will be removed:")}
 `
   );
   if (metadata.services.email?.config.tracking?.enabled) {
-    console.log(`  ${pc9.cyan("\u2713")} Configuration Set (wraps-email-tracking)`);
+    console.log(`  ${pc10.cyan("\u2713")} Configuration Set (wraps-email-tracking)`);
   }
   if (metadata.services.email?.config.eventTracking?.dynamoDBHistory) {
-    console.log(`  ${pc9.cyan("\u2713")} DynamoDB Table (wraps-email-history)`);
+    console.log(`  ${pc10.cyan("\u2713")} DynamoDB Table (wraps-email-history)`);
   }
   if (metadata.services.email?.config.eventTracking?.enabled) {
-    console.log(`  ${pc9.cyan("\u2713")} EventBridge Rules`);
-    console.log(`  ${pc9.cyan("\u2713")} SQS Queues`);
-    console.log(`  ${pc9.cyan("\u2713")} Lambda Functions`);
+    console.log(`  ${pc10.cyan("\u2713")} EventBridge Rules`);
+    console.log(`  ${pc10.cyan("\u2713")} SQS Queues`);
+    console.log(`  ${pc10.cyan("\u2713")} Lambda Functions`);
   }
-  console.log(`  ${pc9.cyan("\u2713")} IAM Role (wraps-email-role)`);
+  console.log(`  ${pc10.cyan("\u2713")} IAM Role (wraps-email-role)`);
   console.log("");
   if (!(options.force || options.preview)) {
-    const confirmed = await clack8.confirm({
+    const confirmed = await clack9.confirm({
       message: "Proceed with removal? This cannot be undone.",
       initialValue: false
     });
-    if (clack8.isCancel(confirmed) || !confirmed) {
-      clack8.cancel("Removal cancelled.");
+    if (clack9.isCancel(confirmed) || !confirmed) {
+      clack9.cancel("Removal cancelled.");
       process.exit(0);
     }
   }
@@ -5955,7 +6428,7 @@ ${pc9.bold("The following Wraps resources will be removed:")}
         const previewResult = await progress.execute(
           "Generating removal preview",
           async () => {
-            const stack = await pulumi8.automation.LocalWorkspace.selectStack(
+            const stack = await pulumi9.automation.LocalWorkspace.selectStack(
               {
                 stackName: metadata.services.email.pulumiStackName,
                 projectName: "wraps-email",
@@ -5981,13 +6454,18 @@ ${pc9.bold("The following Wraps resources will be removed:")}
           costEstimate: "Monthly cost after removal: $0.00",
           commandName: "wraps email restore"
         });
-        clack8.outro(
-          pc9.green(
+        clack9.outro(
+          pc10.green(
             "Preview complete. Run without --preview to remove infrastructure."
           )
         );
+        trackServiceRemoved("email", {
+          preview: true,
+          duration_ms: Date.now() - startTime
+        });
         return;
       } catch (error) {
+        trackError("PREVIEW_FAILED", "email:restore", { step: "preview" });
         throw new Error(`Preview failed: ${error.message}`);
       }
     }
@@ -5999,7 +6477,7 @@ ${pc9.bold("The following Wraps resources will be removed:")}
         if (!metadata.services.email?.pulumiStackName) {
           throw new Error("No Pulumi stack name found in metadata");
         }
-        const stack = await pulumi8.automation.LocalWorkspace.selectStack(
+        const stack = await pulumi9.automation.LocalWorkspace.selectStack(
           {
             stackName: metadata.services.email.pulumiStackName,
             projectName: "wraps-email",
@@ -6022,6 +6500,7 @@ ${pc9.bold("The following Wraps resources will be removed:")}
           metadata.services.email.pulumiStackName
         );
       } catch (error) {
+        trackError("DESTROY_FAILED", "email:restore", { step: "destroy" });
         throw new Error(`Failed to destroy Pulumi stack: ${error.message}`);
       }
     });
@@ -6030,29 +6509,127 @@ ${pc9.bold("The following Wraps resources will be removed:")}
   progress.info("Connection metadata deleted");
   console.log(
     `
-${pc9.green("\u2713")} ${pc9.bold("Infrastructure removed successfully!")}
+${pc10.green("\u2713")} ${pc10.bold("Infrastructure removed successfully!")}
 `
   );
   console.log(
-    `${pc9.dim("All Wraps resources have been deleted from your AWS account.")}`
+    `${pc10.dim("All Wraps resources have been deleted from your AWS account.")}`
   );
-  console.log(`${pc9.dim("Your original AWS resources remain unchanged.")}
+  console.log(`${pc10.dim("Your original AWS resources remain unchanged.")}
 `);
+  trackServiceRemoved("email", {
+    reason: "user_initiated",
+    duration_ms: Date.now() - startTime
+  });
+}
+
+// src/commands/email/status.ts
+init_esm_shims();
+init_events();
+init_aws();
+import * as clack10 from "@clack/prompts";
+import * as pulumi10 from "@pulumi/pulumi";
+import pc11 from "picocolors";
+async function emailStatus(_options) {
+  const startTime = Date.now();
+  const progress = new DeploymentProgress();
+  clack10.intro(pc11.bold("Wraps Email Status"));
+  const identity = await progress.execute(
+    "Loading email infrastructure status",
+    async () => validateAWSCredentials()
+  );
+  const region = await getAWSRegion();
+  let stackOutputs = {};
+  try {
+    await ensurePulumiWorkDir();
+    const stack = await pulumi10.automation.LocalWorkspace.selectStack({
+      stackName: `wraps-${identity.accountId}-${region}`,
+      workDir: getPulumiWorkDir()
+    });
+    stackOutputs = await stack.outputs();
+  } catch (_error) {
+    progress.stop();
+    clack10.log.error("No email infrastructure found");
+    console.log(
+      `
+Run ${pc11.cyan("wraps email init")} to deploy email infrastructure.
+`
+    );
+    process.exit(1);
+  }
+  const domains = await listSESDomains(region);
+  const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
+  const sesv2Client = new SESv2Client5({ region });
+  const domainsWithTokens = await Promise.all(
+    domains.map(async (d) => {
+      try {
+        const identity2 = await sesv2Client.send(
+          new GetEmailIdentityCommand4({ EmailIdentity: d.domain })
+        );
+        return {
+          domain: d.domain,
+          status: d.verified ? "verified" : "pending",
+          dkimTokens: identity2.DkimAttributes?.Tokens || [],
+          mailFromDomain: identity2.MailFromAttributes?.MailFromDomain,
+          mailFromStatus: identity2.MailFromAttributes?.MailFromDomainStatus
+        };
+      } catch (_error) {
+        return {
+          domain: d.domain,
+          status: d.verified ? "verified" : "pending",
+          dkimTokens: void 0,
+          mailFromDomain: void 0,
+          mailFromStatus: void 0
+        };
+      }
+    })
+  );
+  const integrationLevel = stackOutputs.configSetName ? "enhanced" : "dashboard-only";
+  progress.stop();
+  displayStatus({
+    integrationLevel,
+    region,
+    domains: domainsWithTokens,
+    resources: {
+      roleArn: stackOutputs.roleArn?.value,
+      configSetName: stackOutputs.configSetName?.value,
+      tableName: stackOutputs.tableName?.value,
+      lambdaFunctions: stackOutputs.lambdaFunctions?.value?.length || 0,
+      snsTopics: integrationLevel === "enhanced" ? 1 : 0,
+      archiveArn: stackOutputs.archiveArn?.value,
+      archivingEnabled: stackOutputs.archivingEnabled?.value,
+      archiveRetention: stackOutputs.archiveRetention?.value
+    },
+    tracking: stackOutputs.customTrackingDomain?.value ? {
+      customTrackingDomain: stackOutputs.customTrackingDomain?.value,
+      httpsEnabled: stackOutputs.httpsTrackingEnabled?.value,
+      cloudFrontDomain: stackOutputs.cloudFrontDomain?.value
+    } : void 0
+  });
+  trackCommand("email:status", {
+    success: true,
+    domain_count: domainsWithTokens.length,
+    integration_level: integrationLevel,
+    duration_ms: Date.now() - startTime
+  });
 }
 
 // src/commands/email/upgrade.ts
 init_esm_shims();
-import * as clack9 from "@clack/prompts";
-import * as pulumi9 from "@pulumi/pulumi";
-import pc10 from "picocolors";
+import * as clack11 from "@clack/prompts";
+import * as pulumi11 from "@pulumi/pulumi";
+import pc12 from "picocolors";
+init_events();
 init_costs();
 init_presets();
 init_aws();
 init_errors();
 init_prompts();
 async function upgrade(options) {
-  clack9.intro(
-    pc10.bold(
+  const startTime = Date.now();
+  let upgradeAction = "";
+  clack11.intro(
+    pc12.bold(
       options.preview ? "Wraps Upgrade Preview" : "Wraps Upgrade - Enhance Your Email Infrastructure"
     )
   );
@@ -6068,7 +6645,7 @@ async function upgrade(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc10.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc12.cyan(identity.accountId)}`);
   let region = options.region;
   if (!region) {
     const defaultRegion = await getAWSRegion();
@@ -6076,55 +6653,55 @@ async function upgrade(options) {
   }
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
-    clack9.log.error(
-      `No Wraps connection found for account ${pc10.cyan(identity.accountId)} in region ${pc10.cyan(region)}`
+    clack11.log.error(
+      `No Wraps connection found for account ${pc12.cyan(identity.accountId)} in region ${pc12.cyan(region)}`
     );
-    clack9.log.info(
-      `Use ${pc10.cyan("wraps email init")} to create new infrastructure or ${pc10.cyan("wraps email connect")} to connect existing.`
+    clack11.log.info(
+      `Use ${pc12.cyan("wraps email init")} to create new infrastructure or ${pc12.cyan("wraps email connect")} to connect existing.`
     );
     process.exit(1);
   }
   progress.info(`Found existing connection created: ${metadata.timestamp}`);
   console.log(`
-${pc10.bold("Current Configuration:")}
+${pc12.bold("Current Configuration:")}
 `);
   if (metadata.services.email?.preset) {
-    console.log(`  Preset: ${pc10.cyan(metadata.services.email?.preset)}`);
+    console.log(`  Preset: ${pc12.cyan(metadata.services.email?.preset)}`);
   } else {
-    console.log(`  Preset: ${pc10.cyan("custom")}`);
+    console.log(`  Preset: ${pc12.cyan("custom")}`);
   }
   const config2 = metadata.services.email?.config;
   if (!config2) {
-    clack9.log.error("No email configuration found in metadata");
-    clack9.log.info(
-      `Use ${pc10.cyan("wraps email init")} to create new infrastructure.`
+    clack11.log.error("No email configuration found in metadata");
+    clack11.log.info(
+      `Use ${pc12.cyan("wraps email init")} to create new infrastructure.`
     );
     process.exit(1);
   }
   if (config2.domain) {
-    console.log(`  Sending Domain: ${pc10.cyan(config2.domain)}`);
+    console.log(`  Sending Domain: ${pc12.cyan(config2.domain)}`);
   }
   if (config2.tracking?.enabled) {
-    console.log(`  ${pc10.green("\u2713")} Open & Click Tracking`);
+    console.log(`  ${pc12.green("\u2713")} Open & Click Tracking`);
     if (config2.tracking.customRedirectDomain) {
       console.log(
-        `    ${pc10.dim("\u2514\u2500")} Custom domain: ${pc10.cyan(config2.tracking.customRedirectDomain)}`
+        `    ${pc12.dim("\u2514\u2500")} Custom domain: ${pc12.cyan(config2.tracking.customRedirectDomain)}`
       );
     }
   }
   if (config2.suppressionList?.enabled) {
-    console.log(`  ${pc10.green("\u2713")} Bounce/Complaint Suppression`);
+    console.log(`  ${pc12.green("\u2713")} Bounce/Complaint Suppression`);
   }
   if (config2.eventTracking?.enabled) {
-    console.log(`  ${pc10.green("\u2713")} Event Tracking (EventBridge)`);
+    console.log(`  ${pc12.green("\u2713")} Event Tracking (EventBridge)`);
     if (config2.eventTracking.dynamoDBHistory) {
       console.log(
-        `    ${pc10.dim("\u2514\u2500")} Email History: ${pc10.cyan(config2.eventTracking.archiveRetention || "90days")}`
+        `    ${pc12.dim("\u2514\u2500")} Email History: ${pc12.cyan(config2.eventTracking.archiveRetention || "90days")}`
       );
     }
   }
   if (config2.dedicatedIp) {
-    console.log(`  ${pc10.green("\u2713")} Dedicated IP Address`);
+    console.log(`  ${pc12.green("\u2713")} Dedicated IP Address`);
   }
   if (config2.emailArchiving?.enabled) {
     const retentionLabel = {
@@ -6149,15 +6726,15 @@ ${pc10.bold("Current Configuration:")}
       indefinite: "indefinite",
       permanent: "permanent"
     }[config2.emailArchiving.retention] || "90 days";
-    console.log(`  ${pc10.green("\u2713")} Email Archiving (${retentionLabel})`);
+    console.log(`  ${pc12.green("\u2713")} Email Archiving (${retentionLabel})`);
   }
   const currentCostData = calculateCosts(config2, 5e4);
   console.log(
     `
-  Estimated Cost: ${pc10.cyan(`~${formatCost(currentCostData.total.monthly)}/mo`)}`
+  Estimated Cost: ${pc12.cyan(`~${formatCost(currentCostData.total.monthly)}/mo`)}`
   );
   console.log("");
-  const upgradeAction = await clack9.select({
+  upgradeAction = await clack11.select({
     message: "What would you like to do?",
     options: [
       {
@@ -6197,8 +6774,8 @@ ${pc10.bold("Current Configuration:")}
       }
     ]
   });
-  if (clack9.isCancel(upgradeAction)) {
-    clack9.cancel("Upgrade cancelled.");
+  if (clack11.isCancel(upgradeAction)) {
+    clack11.cancel("Upgrade cancelled.");
     process.exit(0);
   }
   let updatedConfig = { ...config2 };
@@ -6216,15 +6793,15 @@ ${pc10.bold("Current Configuration:")}
         disabled: currentPresetIdx >= 0 && idx <= currentPresetIdx ? "Current or lower tier" : void 0
       })).filter((p) => !p.disabled);
       if (availablePresets.length === 0) {
-        clack9.log.warn("Already on highest preset (Enterprise)");
+        clack11.log.warn("Already on highest preset (Enterprise)");
         process.exit(0);
       }
-      const selectedPreset = await clack9.select({
+      const selectedPreset = await clack11.select({
         message: "Select new preset:",
         options: availablePresets
       });
-      if (clack9.isCancel(selectedPreset)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(selectedPreset)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       const presetConfig = getPreset(selectedPreset);
@@ -6234,7 +6811,7 @@ ${pc10.bold("Current Configuration:")}
     }
     case "archiving": {
       if (config2.emailArchiving?.enabled) {
-        const archivingAction = await clack9.select({
+        const archivingAction = await clack11.select({
           message: "What would you like to do with email archiving?",
           options: [
             {
@@ -6249,17 +6826,17 @@ ${pc10.bold("Current Configuration:")}
             }
           ]
         });
-        if (clack9.isCancel(archivingAction)) {
-          clack9.cancel("Upgrade cancelled.");
+        if (clack11.isCancel(archivingAction)) {
+          clack11.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (archivingAction === "disable") {
-          const confirmDisable = await clack9.confirm({
+          const confirmDisable = await clack11.confirm({
             message: "Are you sure? Existing archived emails will remain, but new emails won't be archived.",
             initialValue: false
           });
-          if (clack9.isCancel(confirmDisable) || !confirmDisable) {
-            clack9.cancel("Archiving not disabled.");
+          if (clack11.isCancel(confirmDisable) || !confirmDisable) {
+            clack11.cancel("Archiving not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -6270,7 +6847,7 @@ ${pc10.bold("Current Configuration:")}
             }
           };
         } else {
-          const retention = await clack9.select({
+          const retention = await clack11.select({
             message: "Email archive retention period:",
             options: [
               {
@@ -6306,8 +6883,8 @@ ${pc10.bold("Current Configuration:")}
             ],
             initialValue: config2.emailArchiving.retention
           });
-          if (clack9.isCancel(retention)) {
-            clack9.cancel("Upgrade cancelled.");
+          if (clack11.isCancel(retention)) {
+            clack11.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -6319,19 +6896,19 @@ ${pc10.bold("Current Configuration:")}
           };
         }
       } else {
-        const enableArchiving = await clack9.confirm({
+        const enableArchiving = await clack11.confirm({
           message: "Enable email archiving? (Store full email content with HTML for viewing)",
           initialValue: true
         });
-        if (clack9.isCancel(enableArchiving)) {
-          clack9.cancel("Upgrade cancelled.");
+        if (clack11.isCancel(enableArchiving)) {
+          clack11.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (!enableArchiving) {
-          clack9.log.info("Email archiving not enabled.");
+          clack11.log.info("Email archiving not enabled.");
           process.exit(0);
         }
-        const retention = await clack9.select({
+        const retention = await clack11.select({
           message: "Email archive retention period:",
           options: [
             {
@@ -6367,17 +6944,17 @@ ${pc10.bold("Current Configuration:")}
           ],
           initialValue: "90days"
         });
-        if (clack9.isCancel(retention)) {
-          clack9.cancel("Upgrade cancelled.");
+        if (clack11.isCancel(retention)) {
+          clack11.cancel("Upgrade cancelled.");
           process.exit(0);
         }
-        clack9.log.info(
-          pc10.dim(
+        clack11.log.info(
+          pc12.dim(
             "Archiving stores full RFC 822 emails with HTML, attachments, and headers"
           )
         );
-        clack9.log.info(
-          pc10.dim(
+        clack11.log.info(
+          pc12.dim(
             "Cost: $2/GB ingestion + $0.19/GB/month storage (~50KB per email)"
           )
         );
@@ -6394,11 +6971,11 @@ ${pc10.bold("Current Configuration:")}
     }
     case "tracking-domain": {
       if (!config2.domain) {
-        clack9.log.error(
+        clack11.log.error(
           "No sending domain configured. You must configure a sending domain before adding a custom tracking domain."
         );
-        clack9.log.info(
-          `Use ${pc10.cyan("wraps email init")} to set up a sending domain first.`
+        clack11.log.info(
+          `Use ${pc12.cyan("wraps email init")} to set up a sending domain first.`
         );
         process.exit(1);
       }
@@ -6409,21 +6986,21 @@ ${pc10.bold("Current Configuration:")}
       );
       const sendingDomain = domains.find((d) => d.domain === config2.domain);
       if (!sendingDomain?.verified) {
-        clack9.log.error(
-          `Sending domain ${pc10.cyan(config2.domain)} is not verified.`
+        clack11.log.error(
+          `Sending domain ${pc12.cyan(config2.domain)} is not verified.`
         );
-        clack9.log.info(
+        clack11.log.info(
           "You must verify your sending domain before adding a custom tracking domain."
         );
-        clack9.log.info(
-          `Use ${pc10.cyan("wraps verify")} to check DNS records and complete verification.`
+        clack11.log.info(
+          `Use ${pc12.cyan("wraps email verify")} to check DNS records and complete verification.`
         );
         process.exit(1);
       }
       progress.info(
-        `Sending domain ${pc10.cyan(config2.domain)} is verified ${pc10.green("\u2713")}`
+        `Sending domain ${pc12.cyan(config2.domain)} is verified ${pc12.green("\u2713")}`
       );
-      const trackingDomain = await clack9.text({
+      const trackingDomain = await clack11.text({
         message: "Custom tracking redirect domain:",
         placeholder: "track.yourdomain.com",
         initialValue: config2.tracking?.customRedirectDomain || "",
@@ -6433,62 +7010,62 @@ ${pc10.bold("Current Configuration:")}
           }
         }
       });
-      if (clack9.isCancel(trackingDomain)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(trackingDomain)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
-      const enableHttps = await clack9.confirm({
+      const enableHttps = await clack11.confirm({
         message: "Enable HTTPS tracking with CloudFront + SSL certificate?",
         initialValue: true
       });
-      if (clack9.isCancel(enableHttps)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(enableHttps)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (enableHttps) {
-        clack9.log.info(
-          pc10.dim(
+        clack11.log.info(
+          pc12.dim(
             "HTTPS tracking creates a CloudFront distribution with an SSL certificate."
           )
         );
-        clack9.log.info(
-          pc10.dim(
+        clack11.log.info(
+          pc12.dim(
             "This ensures all tracking links use secure HTTPS connections."
           )
         );
-        const { findHostedZone: findHostedZone2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+        const { findHostedZone: findHostedZone3 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
         const hostedZone = await progress.execute(
           "Checking for Route53 hosted zone",
-          async () => await findHostedZone2(trackingDomain || config2.domain, region)
+          async () => await findHostedZone3(trackingDomain || config2.domain, region)
         );
         if (hostedZone) {
           progress.info(
-            `Found Route53 hosted zone: ${pc10.cyan(hostedZone.name)} ${pc10.green("\u2713")}`
+            `Found Route53 hosted zone: ${pc12.cyan(hostedZone.name)} ${pc12.green("\u2713")}`
           );
-          clack9.log.info(
-            pc10.dim(
+          clack11.log.info(
+            pc12.dim(
               "DNS records (SSL certificate validation + CloudFront) will be created automatically."
             )
           );
         } else {
-          clack9.log.warn(
-            `No Route53 hosted zone found for ${pc10.cyan(trackingDomain || config2.domain)}`
+          clack11.log.warn(
+            `No Route53 hosted zone found for ${pc12.cyan(trackingDomain || config2.domain)}`
           );
-          clack9.log.info(
-            pc10.dim(
+          clack11.log.info(
+            pc12.dim(
               "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
             )
           );
-          clack9.log.info(
-            pc10.dim("DNS record details will be shown after deployment.")
+          clack11.log.info(
+            pc12.dim("DNS record details will be shown after deployment.")
           );
         }
-        const confirmHttps = await clack9.confirm({
+        const confirmHttps = await clack11.confirm({
           message: hostedZone ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
           initialValue: true
         });
-        if (clack9.isCancel(confirmHttps) || !confirmHttps) {
-          clack9.log.info("HTTPS tracking not enabled. Using HTTP tracking.");
+        if (clack11.isCancel(confirmHttps) || !confirmHttps) {
+          clack11.log.info("HTTPS tracking not enabled. Using HTTP tracking.");
           updatedConfig = {
             ...config2,
             tracking: {
@@ -6510,8 +7087,8 @@ ${pc10.bold("Current Configuration:")}
           };
         }
       } else {
-        clack9.log.info(
-          pc10.dim(
+        clack11.log.info(
+          pc12.dim(
             "Using HTTP tracking (standard). Links will use http:// protocol."
           )
         );
@@ -6529,7 +7106,7 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "retention": {
-      const retention = await clack9.select({
+      const retention = await clack11.select({
         message: "Email history retention period (event data in DynamoDB):",
         options: [
           { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -6553,17 +7130,17 @@ ${pc10.bold("Current Configuration:")}
         ],
         initialValue: config2.eventTracking?.archiveRetention || "90days"
       });
-      if (clack9.isCancel(retention)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(retention)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
-      clack9.log.info(
-        pc10.dim(
+      clack11.log.info(
+        pc12.dim(
           "Note: This is for event data (sent, delivered, opened, etc.) stored in DynamoDB."
         )
       );
-      clack9.log.info(
-        pc10.dim(
+      clack11.log.info(
+        pc12.dim(
           "For full email content storage, use 'Enable email archiving' option."
         )
       );
@@ -6580,7 +7157,7 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "events": {
-      const selectedEvents = await clack9.multiselect({
+      const selectedEvents = await clack11.multiselect({
         message: "Select SES event types to track:",
         options: [
           { value: "SEND", label: "Send", hint: "Email sent to SES" },
@@ -6624,8 +7201,8 @@ ${pc10.bold("Current Configuration:")}
         ],
         required: true
       });
-      if (clack9.isCancel(selectedEvents)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(selectedEvents)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -6640,16 +7217,16 @@ ${pc10.bold("Current Configuration:")}
       break;
     }
     case "dedicated-ip": {
-      const confirmed = await clack9.confirm({
+      const confirmed = await clack11.confirm({
         message: "Enable dedicated IP? (Requires 100k+ emails/day, adds ~$50-100/mo)",
         initialValue: false
       });
-      if (clack9.isCancel(confirmed)) {
-        clack9.cancel("Upgrade cancelled.");
+      if (clack11.isCancel(confirmed)) {
+        clack11.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (!confirmed) {
-        clack9.log.info("Dedicated IP not enabled.");
+        clack11.log.info("Dedicated IP not enabled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -6670,28 +7247,28 @@ ${pc10.bold("Current Configuration:")}
   const newCostData = calculateCosts(updatedConfig, 5e4);
   const costDiff = newCostData.total.monthly - currentCostData.total.monthly;
   console.log(`
-${pc10.bold("Cost Impact:")}`);
+${pc12.bold("Cost Impact:")}`);
   console.log(
-    `  Current: ${pc10.cyan(`${formatCost(currentCostData.total.monthly)}/mo`)}`
+    `  Current: ${pc12.cyan(`${formatCost(currentCostData.total.monthly)}/mo`)}`
   );
   console.log(
-    `  New:     ${pc10.cyan(`${formatCost(newCostData.total.monthly)}/mo`)}`
+    `  New:     ${pc12.cyan(`${formatCost(newCostData.total.monthly)}/mo`)}`
   );
   if (costDiff > 0) {
-    console.log(`  Change:  ${pc10.yellow(`+${formatCost(costDiff)}/mo`)}`);
+    console.log(`  Change:  ${pc12.yellow(`+${formatCost(costDiff)}/mo`)}`);
   } else if (costDiff < 0) {
     console.log(
-      `  Change:  ${pc10.green(`${formatCost(Math.abs(costDiff))}/mo`)}`
+      `  Change:  ${pc12.green(`${formatCost(Math.abs(costDiff))}/mo`)}`
     );
   }
   console.log("");
   if (!(options.yes || options.preview)) {
-    const confirmed = await clack9.confirm({
+    const confirmed = await clack11.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
     });
-    if (clack9.isCancel(confirmed) || !confirmed) {
-      clack9.cancel("Upgrade cancelled.");
+    if (clack11.isCancel(confirmed) || !confirmed) {
+      clack11.cancel("Upgrade cancelled.");
       process.exit(0);
     }
   }
@@ -6713,7 +7290,7 @@ ${pc10.bold("Cost Impact:")}`);
         "Generating upgrade preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi9.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi11.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -6763,11 +7340,19 @@ ${pc10.bold("Cost Impact:")}`);
         costEstimate: costComparison,
         commandName: "wraps email upgrade"
       });
-      clack9.outro(
-        pc10.green("Preview complete. Run without --preview to upgrade.")
+      clack11.outro(
+        pc12.green("Preview complete. Run without --preview to upgrade.")
       );
+      trackServiceUpgrade("email", {
+        from_preset: metadata.services.email?.preset,
+        to_preset: newPreset,
+        preview: true,
+        action: typeof upgradeAction === "string" ? upgradeAction : void 0,
+        duration_ms: Date.now() - startTime
+      });
       return;
     } catch (error) {
+      trackError("PREVIEW_FAILED", "email:upgrade", { step: "preview" });
       if (error.message?.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
@@ -6780,7 +7365,7 @@ ${pc10.bold("Cost Impact:")}`);
       "Updating Wraps infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi9.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi11.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -6841,14 +7426,22 @@ ${pc10.bold("Cost Impact:")}`);
       }
     );
   } catch (error) {
+    trackServiceUpgrade("email", {
+      from_preset: metadata.services.email?.preset,
+      to_preset: newPreset,
+      action: typeof upgradeAction === "string" ? upgradeAction : void 0,
+      duration_ms: Date.now() - startTime
+    });
     if (error.message?.includes("stack is currently locked")) {
+      trackError("STACK_LOCKED", "email:upgrade", { step: "deploy" });
       throw errors.stackLocked();
     }
+    trackError("UPGRADE_FAILED", "email:upgrade", { step: "deploy" });
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
+    const { findHostedZone: findHostedZone3, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    const hostedZone = await findHostedZone3(outputs.domain, region);
     if (hostedZone) {
       try {
         progress.start("Creating DNS records in Route53");
@@ -6913,21 +7506,21 @@ ${pc10.bold("Cost Impact:")}`);
     httpsTrackingEnabled: outputs.httpsTrackingEnabled
   });
   console.log(`
-${pc10.green("\u2713")} ${pc10.bold("Upgrade complete!")}
+${pc12.green("\u2713")} ${pc12.bold("Upgrade complete!")}
 `);
   if (upgradeAction === "preset" && newPreset) {
     console.log(
-      `Upgraded to ${pc10.cyan(newPreset)} preset (${pc10.green(`${formatCost(newCostData.total.monthly)}/mo`)})
+      `Upgraded to ${pc12.cyan(newPreset)} preset (${pc12.green(`${formatCost(newCostData.total.monthly)}/mo`)})
 `
     );
   } else {
     console.log(
-      `Updated configuration (${pc10.green(`${formatCost(newCostData.total.monthly)}/mo`)})
+      `Updated configuration (${pc12.green(`${formatCost(newCostData.total.monthly)}/mo`)})
 `
     );
   }
   if (needsCertificateValidation) {
-    console.log(pc10.bold("\u26A0\uFE0F  HTTPS Tracking - Next Steps:\n"));
+    console.log(pc12.bold("\u26A0\uFE0F  HTTPS Tracking - Next Steps:\n"));
     console.log(
       "  1. Add the SSL certificate validation DNS record shown above to your DNS provider"
     );
@@ -6935,28 +7528,46 @@ ${pc10.green("\u2713")} ${pc10.bold("Upgrade complete!")}
       "  2. Wait for DNS propagation and certificate validation (5-30 minutes)"
     );
     console.log(
-      `  3. Run ${pc10.cyan("wraps email upgrade")} again to complete CloudFront setup
+      `  3. Run ${pc12.cyan("wraps email upgrade")} again to complete CloudFront setup
 `
     );
     console.log(
-      pc10.dim(
+      pc12.dim(
         "  Note: CloudFront distribution will be created once the certificate is validated.\n"
       )
     );
   } else if (outputs.httpsTrackingEnabled && outputs.cloudFrontDomain) {
     console.log(
-      pc10.green("\u2713") + " " + pc10.bold("HTTPS tracking is fully configured and ready to use!\n")
+      pc12.green("\u2713") + " " + pc12.bold("HTTPS tracking is fully configured and ready to use!\n")
     );
   }
+  const enabledFeatures = [];
+  if (updatedConfig.tracking?.enabled) enabledFeatures.push("tracking");
+  if (updatedConfig.suppressionList?.enabled)
+    enabledFeatures.push("suppression_list");
+  if (updatedConfig.eventTracking?.enabled)
+    enabledFeatures.push("event_tracking");
+  if (updatedConfig.eventTracking?.dynamoDBHistory)
+    enabledFeatures.push("dynamodb_history");
+  if (updatedConfig.dedicatedIp) enabledFeatures.push("dedicated_ip");
+  if (updatedConfig.emailArchiving?.enabled)
+    enabledFeatures.push("email_archiving");
+  trackServiceUpgrade("email", {
+    from_preset: metadata.services.email?.preset,
+    to_preset: newPreset,
+    added_features: enabledFeatures,
+    action: typeof upgradeAction === "string" ? upgradeAction : void 0,
+    duration_ms: Date.now() - startTime
+  });
 }
 
 // src/commands/shared/dashboard.ts
 init_esm_shims();
-import * as clack10 from "@clack/prompts";
-import * as pulumi10 from "@pulumi/pulumi";
+import * as clack12 from "@clack/prompts";
+import * as pulumi12 from "@pulumi/pulumi";
 import getPort from "get-port";
 import open from "open";
-import pc11 from "picocolors";
+import pc13 from "picocolors";
 
 // src/console/server.ts
 init_esm_shims();
@@ -8178,9 +8789,10 @@ async function startConsoleServer(config2) {
 }
 
 // src/commands/shared/dashboard.ts
+init_events();
 init_aws();
 async function dashboard(options) {
-  clack10.intro(pc11.bold("Wraps Dashboard"));
+  clack12.intro(pc13.bold("Wraps Dashboard"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -8190,16 +8802,16 @@ async function dashboard(options) {
   let stackOutputs = {};
   try {
     await ensurePulumiWorkDir();
-    const stack = await pulumi10.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi12.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
     stackOutputs = await stack.outputs();
   } catch (_error) {
     progress.stop();
-    clack10.log.error("No Wraps infrastructure found");
+    clack12.log.error("No Wraps infrastructure found");
     console.log(
-      `\\nRun ${pc11.cyan("wraps email init")} to deploy infrastructure first.\\n`
+      `\\nRun ${pc13.cyan("wraps email init")} to deploy infrastructure first.\\n`
     );
     process.exit(1);
   }
@@ -8208,9 +8820,9 @@ async function dashboard(options) {
   const archivingEnabled = stackOutputs.archivingEnabled?.value ?? false;
   const port = options.port || await getPort({ port: [5555, 5556, 5557, 5558, 5559] });
   progress.stop();
-  clack10.log.success("Starting dashboard server...");
+  clack12.log.success("Starting dashboard server...");
   console.log(
-    `${pc11.dim("Using current AWS credentials (no role assumption)")}\\n`
+    `${pc13.dim("Using current AWS credentials (no role assumption)")}\\n`
   );
   const { url } = await startConsoleServer({
     port,
@@ -8223,11 +8835,16 @@ async function dashboard(options) {
     archiveArn,
     archivingEnabled
   });
-  console.log(`\\n${pc11.bold("Dashboard:")} ${pc11.cyan(url)}`);
-  console.log(`${pc11.dim("Press Ctrl+C to stop")}\\n`);
+  console.log(`\\n${pc13.bold("Dashboard:")} ${pc13.cyan(url)}`);
+  console.log(`${pc13.dim("Press Ctrl+C to stop")}\\n`);
   if (!options.noOpen) {
     await open(url);
   }
+  trackCommand("console", {
+    success: true,
+    port,
+    no_open: options.noOpen ?? false
+  });
   await new Promise(() => {
   });
 }
@@ -8235,246 +8852,203 @@ async function dashboard(options) {
 // src/commands/shared/destroy.ts
 init_esm_shims();
 init_aws();
-import * as clack11 from "@clack/prompts";
-import * as pulumi11 from "@pulumi/pulumi";
-import pc12 from "picocolors";
+import * as clack13 from "@clack/prompts";
+import pc14 from "picocolors";
 async function destroy(options) {
-  clack11.intro(
-    pc12.bold(
-      options.preview ? "Wraps Destruction Preview" : "Wraps Email Infrastructure Teardown"
-    )
-  );
-  const progress = new DeploymentProgress();
-  const identity = await progress.execute(
-    "Validating AWS credentials",
-    async () => validateAWSCredentials()
-  );
+  clack13.intro(pc14.bold("Wraps Infrastructure Teardown"));
+  const spinner3 = clack13.spinner();
+  spinner3.start("Validating AWS credentials");
+  let identity;
+  try {
+    identity = await validateAWSCredentials();
+    spinner3.stop("AWS credentials validated");
+  } catch (error) {
+    spinner3.stop("AWS credentials validation failed");
+    throw error;
+  }
   const region = await getAWSRegion();
-  if (!(options.force || options.preview)) {
-    const confirmed = await clack11.confirm({
-      message: pc12.red(
-        "Are you sure you want to destroy all Wraps infrastructure?"
-      ),
-      initialValue: false
-    });
-    if (clack11.isCancel(confirmed) || !confirmed) {
-      clack11.cancel("Destruction cancelled.");
-      process.exit(0);
-    }
+  const metadata = await loadConnectionMetadata(identity.accountId, region);
+  const deployedServices = [];
+  if (metadata?.services?.email) {
+    deployedServices.push("email");
   }
-  if (options.preview) {
-    try {
-      const previewResult = await progress.execute(
-        "Generating destruction preview",
-        async () => {
-          await ensurePulumiWorkDir();
-          const stackName = `wraps-${identity.accountId}-${region}`;
-          let stack;
-          try {
-            stack = await pulumi11.automation.LocalWorkspace.selectStack({
-              stackName,
-              workDir: getPulumiWorkDir()
-            });
-          } catch (_error) {
-            throw new Error("No Wraps infrastructure found to preview");
-          }
-          const result = await stack.preview({ diff: true });
-          return result;
-        }
-      );
-      displayPreview({
-        changeSummary: previewResult.changeSummary,
-        costEstimate: "Monthly cost after destruction: $0.00",
-        commandName: "wraps destroy"
-      });
-      clack11.outro(
-        pc12.green("Preview complete. Run without --preview to destroy.")
-      );
+  if (deployedServices.length === 0) {
+    clack13.log.warn("No Wraps services found in this region");
+    console.log(
+      `
+Run ${pc14.cyan("wraps email init")} to deploy infrastructure.
+`
+    );
+    process.exit(0);
+  }
+  if (deployedServices.length === 1) {
+    const service = deployedServices[0];
+    clack13.log.info(`Found ${pc14.cyan(service)} service deployed`);
+    if (service === "email") {
+      await emailDestroy(options);
       return;
-    } catch (error) {
-      progress.stop();
-      if (error.message.includes("No Wraps infrastructure found")) {
-        clack11.log.warn("No Wraps infrastructure found to preview");
-        process.exit(0);
-      }
-      throw new Error(`Preview failed: ${error.message}`);
     }
   }
-  try {
-    await progress.execute(
-      "Destroying infrastructure (this may take 2-3 minutes)",
-      async () => {
-        await ensurePulumiWorkDir();
-        const stackName = `wraps-${identity.accountId}-${region}`;
-        let stack;
-        try {
-          stack = await pulumi11.automation.LocalWorkspace.selectStack({
-            stackName,
-            workDir: getPulumiWorkDir()
-          });
-        } catch (_error) {
-          throw new Error("No Wraps infrastructure found to destroy");
-        }
-        await stack.destroy({ onOutput: () => {
-        } });
-        await stack.workspace.removeStack(stackName);
+  const serviceToDestroy = await clack13.select({
+    message: "Which service would you like to destroy?",
+    options: [
+      ...deployedServices.map((s) => ({
+        value: s,
+        label: s.charAt(0).toUpperCase() + s.slice(1),
+        hint: s === "email" ? "AWS SES email infrastructure" : void 0
+      })),
+      {
+        value: "all",
+        label: "All services",
+        hint: "Destroy all Wraps infrastructure"
       }
-    );
-  } catch (error) {
-    progress.stop();
-    if (error.message.includes("No Wraps infrastructure found")) {
-      clack11.log.warn("No Wraps infrastructure found");
-      await deleteConnectionMetadata(identity.accountId, region);
-      process.exit(0);
+    ]
+  });
+  if (clack13.isCancel(serviceToDestroy)) {
+    clack13.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  if (serviceToDestroy === "email" || serviceToDestroy === "all") {
+    if (deployedServices.includes("email")) {
+      await emailDestroy(options);
     }
-    clack11.log.error("Infrastructure destruction failed");
-    throw error;
   }
-  await deleteConnectionMetadata(identity.accountId, region);
-  progress.stop();
-  clack11.outro(pc12.green("All Wraps infrastructure has been removed"));
-  console.log(
-    `
-Run ${pc12.cyan("wraps email init")} to deploy infrastructure again.
-`
-  );
+  if (serviceToDestroy === "all") {
+    clack13.outro(pc14.green("All Wraps infrastructure has been removed"));
+  }
 }
 
 // src/commands/shared/status.ts
 init_esm_shims();
+init_events();
 init_aws();
-import * as clack12 from "@clack/prompts";
-import * as pulumi12 from "@pulumi/pulumi";
-import pc13 from "picocolors";
+import * as clack14 from "@clack/prompts";
+import * as pulumi13 from "@pulumi/pulumi";
+import pc15 from "picocolors";
 async function status(_options) {
+  const startTime = Date.now();
   const progress = new DeploymentProgress();
+  clack14.intro(pc15.bold("Wraps Infrastructure Status"));
   const identity = await progress.execute(
     "Loading infrastructure status",
     async () => validateAWSCredentials()
   );
+  progress.info(`AWS Account: ${pc15.cyan(identity.accountId)}`);
   const region = await getAWSRegion();
-  let stackOutputs = {};
+  progress.info(`Region: ${pc15.cyan(region)}`);
+  const services = [];
   try {
     await ensurePulumiWorkDir();
-    const stack = await pulumi12.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi13.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
-    stackOutputs = await stack.outputs();
+    const outputs = await stack.outputs();
+    if (outputs.roleArn?.value) {
+      const domainCount = outputs.domains?.value?.length || 0;
+      services.push({
+        name: "Email",
+        status: "deployed",
+        details: domainCount > 0 ? `${domainCount} domain(s)` : void 0
+      });
+    } else {
+      services.push({ name: "Email", status: "not_deployed" });
+    }
   } catch (_error) {
-    progress.stop();
-    clack12.log.error("No Wraps infrastructure found");
+    services.push({ name: "Email", status: "not_deployed" });
+  }
+  progress.stop();
+  console.log();
+  clack14.note(
+    services.map((s) => {
+      if (s.status === "deployed") {
+        const details = s.details ? pc15.dim(` (${s.details})`) : "";
+        return `  ${pc15.green("\u2713")} ${s.name}${details}`;
+      }
+      return `  ${pc15.dim("\u25CB")} ${s.name} ${pc15.dim("(not deployed)")}`;
+    }).join("\n"),
+    "Services"
+  );
+  const hasDeployedServices = services.some((s) => s.status === "deployed");
+  if (hasDeployedServices) {
+    console.log(`
+${pc15.bold("Details:")}`);
+    if (services.find((s) => s.name === "Email")?.status === "deployed") {
+      console.log(
+        `  ${pc15.dim("Email:")} ${pc15.cyan("wraps email status")}`
+      );
+    }
+  } else {
+    console.log(`
+${pc15.bold("Get started:")}`);
     console.log(
-      `
-Run ${pc13.cyan("wraps email init")} to deploy infrastructure.
-`
+      `  ${pc15.dim("Deploy email:")} ${pc15.cyan("wraps email init")}`
     );
-    process.exit(1);
   }
-  const domains = await listSESDomains(region);
-  const { SESv2Client: SESv2Client5, GetEmailIdentityCommand: GetEmailIdentityCommand4 } = await import("@aws-sdk/client-sesv2");
-  const sesv2Client = new SESv2Client5({ region });
-  const domainsWithTokens = await Promise.all(
-    domains.map(async (d) => {
-      try {
-        const identity2 = await sesv2Client.send(
-          new GetEmailIdentityCommand4({ EmailIdentity: d.domain })
-        );
-        return {
-          domain: d.domain,
-          status: d.verified ? "verified" : "pending",
-          dkimTokens: identity2.DkimAttributes?.Tokens || [],
-          mailFromDomain: identity2.MailFromAttributes?.MailFromDomain,
-          mailFromStatus: identity2.MailFromAttributes?.MailFromDomainStatus
-        };
-      } catch (_error) {
-        return {
-          domain: d.domain,
-          status: d.verified ? "verified" : "pending",
-          dkimTokens: void 0,
-          mailFromDomain: void 0,
-          mailFromStatus: void 0
-        };
-      }
-    })
-  );
-  const integrationLevel = stackOutputs.configSetName ? "enhanced" : "dashboard-only";
-  progress.stop();
-  displayStatus({
-    integrationLevel,
-    region,
-    domains: domainsWithTokens,
-    resources: {
-      roleArn: stackOutputs.roleArn?.value,
-      configSetName: stackOutputs.configSetName?.value,
-      tableName: stackOutputs.tableName?.value,
-      lambdaFunctions: stackOutputs.lambdaFunctions?.value?.length || 0,
-      snsTopics: integrationLevel === "enhanced" ? 1 : 0,
-      archiveArn: stackOutputs.archiveArn?.value,
-      archivingEnabled: stackOutputs.archivingEnabled?.value,
-      archiveRetention: stackOutputs.archiveRetention?.value
-    },
-    tracking: stackOutputs.customTrackingDomain?.value ? {
-      customTrackingDomain: stackOutputs.customTrackingDomain?.value,
-      httpsEnabled: stackOutputs.httpsTrackingEnabled?.value,
-      cloudFrontDomain: stackOutputs.cloudFrontDomain?.value
-    } : void 0
+  console.log(`
+${pc15.bold("Dashboard:")} ${pc15.blue("https://app.wraps.dev")}`);
+  console.log(`${pc15.bold("Docs:")} ${pc15.blue("https://wraps.dev/docs")}
+`);
+  trackCommand("status", {
+    success: true,
+    services_deployed: services.filter((s) => s.status === "deployed").length,
+    duration_ms: Date.now() - startTime
   });
 }
 
 // src/commands/telemetry.ts
 init_esm_shims();
 init_client();
-import * as clack13 from "@clack/prompts";
-import pc14 from "picocolors";
+import * as clack15 from "@clack/prompts";
+import pc16 from "picocolors";
 async function telemetryEnable() {
   const client = getTelemetryClient();
   client.enable();
-  clack13.log.success(pc14.green("Telemetry enabled"));
-  console.log(`   Config: ${pc14.dim(client.getConfigPath())}`);
+  clack15.log.success(pc16.green("Telemetry enabled"));
+  console.log(`   Config: ${pc16.dim(client.getConfigPath())}`);
   console.log(`
-   ${pc14.dim("Thank you for helping improve Wraps!")}
+   ${pc16.dim("Thank you for helping improve Wraps!")}
 `);
 }
 async function telemetryDisable() {
   const client = getTelemetryClient();
   client.disable();
-  clack13.log.success(pc14.green("Telemetry disabled"));
-  console.log(`   Config: ${pc14.dim(client.getConfigPath())}`);
+  clack15.log.success(pc16.green("Telemetry disabled"));
+  console.log(`   Config: ${pc16.dim(client.getConfigPath())}`);
   console.log(
     `
-   ${pc14.dim("You can re-enable with:")} wraps telemetry enable
+   ${pc16.dim("You can re-enable with:")} wraps telemetry enable
 `
   );
 }
 async function telemetryStatus() {
   const client = getTelemetryClient();
-  clack13.intro(pc14.bold("Telemetry Status"));
-  const status2 = client.isEnabled() ? pc14.green("Enabled") : pc14.red("Disabled");
+  clack15.intro(pc16.bold("Telemetry Status"));
+  const status2 = client.isEnabled() ? pc16.green("Enabled") : pc16.red("Disabled");
   console.log();
-  console.log(`  ${pc14.bold("Status:")} ${status2}`);
-  console.log(`  ${pc14.bold("Config file:")} ${pc14.dim(client.getConfigPath())}`);
+  console.log(`  ${pc16.bold("Status:")} ${status2}`);
+  console.log(`  ${pc16.bold("Config file:")} ${pc16.dim(client.getConfigPath())}`);
   if (client.isEnabled()) {
     console.log();
-    console.log(pc14.bold("  How to opt-out:"));
-    console.log(`    ${pc14.cyan("wraps telemetry disable")}`);
+    console.log(pc16.bold("  How to opt-out:"));
+    console.log(`    ${pc16.cyan("wraps telemetry disable")}`);
     console.log(
-      `    ${pc14.dim("Or set:")} ${pc14.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
+      `    ${pc16.dim("Or set:")} ${pc16.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
     );
-    console.log(`    ${pc14.dim("Or set:")} ${pc14.cyan("DO_NOT_TRACK=1")}`);
+    console.log(`    ${pc16.dim("Or set:")} ${pc16.cyan("DO_NOT_TRACK=1")}`);
   } else {
     console.log();
-    console.log(pc14.bold("  How to opt-in:"));
-    console.log(`    ${pc14.cyan("wraps telemetry enable")}`);
+    console.log(pc16.bold("  How to opt-in:"));
+    console.log(`    ${pc16.cyan("wraps telemetry enable")}`);
   }
   console.log();
-  console.log(pc14.bold("  Debug mode:"));
+  console.log(pc16.bold("  Debug mode:"));
   console.log(
-    `    ${pc14.dim("See what would be sent:")} ${pc14.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
+    `    ${pc16.dim("See what would be sent:")} ${pc16.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
   );
   console.log();
   console.log(
-    `  ${pc14.dim("Learn more:")} ${pc14.cyan("https://wraps.dev/docs/telemetry")}`
+    `  ${pc16.dim("Learn more:")} ${pc16.cyan("https://wraps.dev/docs/telemetry")}`
   );
   console.log();
 }
@@ -8492,19 +9066,41 @@ function printCompletionScript() {
   console.log("# ========================\n");
   console.log("# Tab completion will be available in a future release.\n");
   console.log("# For now, here are the available commands:\n");
-  console.log("# Commands:");
+  console.log("# Email Commands:");
   console.log(
     "#   wraps email init [--provider vercel|aws|railway|other] [--region <region>] [--domain <domain>]"
   );
-  console.log("#   wraps status [--account <account-id>]");
-  console.log("#   wraps completion\n");
+  console.log("#   wraps email connect [--region <region>]");
+  console.log("#   wraps email status [--account <account-id>]");
+  console.log("#   wraps email verify --domain <domain>");
+  console.log("#   wraps email sync");
+  console.log("#   wraps email upgrade");
+  console.log("#   wraps email restore [--region <region>] [--force]");
+  console.log("#   wraps email destroy [--force] [--preview]");
+  console.log("#   wraps email domains add --domain <domain>");
+  console.log("#   wraps email domains list");
+  console.log("#   wraps email domains verify --domain <domain>");
+  console.log("#   wraps email domains get-dkim --domain <domain>");
+  console.log("#   wraps email domains remove --domain <domain> [--force]\n");
+  console.log("# Global Commands:");
+  console.log("#   wraps status");
+  console.log("#   wraps destroy [--force] [--preview]");
+  console.log("#   wraps console [--port <port>] [--no-open]");
+  console.log("#   wraps completion");
+  console.log("#   wraps telemetry [enable|disable|status]\n");
+  console.log("# Dashboard Commands:");
+  console.log("#   wraps dashboard update-role [--region <region>] [--force]\n");
   console.log("# Flags:");
-  console.log("#   --provider  : vercel, aws, railway, other");
+  console.log("#   -p, --provider  : vercel, aws, railway, other");
   console.log(
-    "#   --region    : us-east-1, us-east-2, us-west-1, us-west-2, eu-west-1, eu-west-2, etc."
+    "#   -r, --region    : us-east-1, us-east-2, us-west-1, us-west-2, eu-west-1, eu-west-2, etc."
   );
-  console.log("#   --domain    : Your domain name (e.g., myapp.com)");
-  console.log("#   --account   : AWS account ID or alias\n");
+  console.log("#   -d, --domain    : Your domain name (e.g., myapp.com)");
+  console.log("#   --account       : AWS account ID or alias");
+  console.log("#   --preset        : starter, production, enterprise, custom");
+  console.log("#   -y, --yes       : Skip confirmation prompts");
+  console.log("#   -f, --force     : Force destructive operations");
+  console.log("#   --preview       : Preview changes without deploying\n");
 }
 
 // src/cli.ts
@@ -8521,62 +9117,66 @@ function showVersion() {
   process.exit(0);
 }
 function showHelp() {
-  clack14.intro(pc15.bold(`WRAPS CLI v${VERSION}`));
+  clack16.intro(pc17.bold(`WRAPS CLI v${VERSION}`));
   console.log("Deploy AWS infrastructure to your account\n");
   console.log("Usage: wraps [service] <command> [options]\n");
   console.log("Services:");
-  console.log(`  ${pc15.cyan("email")}       Email infrastructure (AWS SES)`);
+  console.log(`  ${pc17.cyan("email")}       Email infrastructure (AWS SES)
+`);
+  console.log("Email Commands:");
   console.log(
-    `  ${pc15.cyan("sms")}         SMS infrastructure (AWS End User Messaging) ${pc15.dim("[coming soon]")}
-`
+    `  ${pc17.cyan("email init")}           Deploy new email infrastructure`
   );
-  console.log("Email Commands:");
   console.log(
-    `  ${pc15.cyan("email init")}           Deploy new email infrastructure`
+    `  ${pc17.cyan("email connect")}        Connect to existing AWS SES`
   );
+  console.log(`  ${pc17.cyan("email status")}         Show email infrastructure details`);
+  console.log(`  ${pc17.cyan("email verify")}         Verify domain DNS records`);
   console.log(
-    `  ${pc15.cyan("email connect")}        Connect to existing AWS SES`
+    `  ${pc17.cyan("email sync")}           Apply CLI updates to infrastructure`
   );
-  console.log(`  ${pc15.cyan("email domains verify")} Verify domain DNS records`);
+  console.log(`  ${pc17.cyan("email upgrade")}        Add features`);
   console.log(
-    `  ${pc15.cyan("email sync")}           Apply CLI updates to infrastructure`
+    `  ${pc17.cyan("email restore")}        Restore original configuration`
   );
-  console.log(`  ${pc15.cyan("email upgrade")}        Add features`);
   console.log(
-    `  ${pc15.cyan("email restore")}        Restore original configuration
-`
+    `  ${pc17.cyan("email destroy")}        Remove email infrastructure`
   );
+  console.log(`  ${pc17.cyan("email domains add")}    Add a domain to SES`);
+  console.log(`  ${pc17.cyan("email domains list")}   List all domains`);
+  console.log(`  ${pc17.cyan("email domains remove")} Remove a domain
+`);
   console.log("Console & Dashboard:");
-  console.log(`  ${pc15.cyan("console")}               Start local web console`);
+  console.log(`  ${pc17.cyan("console")}               Start local web console`);
   console.log(
-    `  ${pc15.cyan("dashboard update-role")} Update hosted dashboard IAM permissions
+    `  ${pc17.cyan("dashboard update-role")} Update hosted dashboard IAM permissions
 `
   );
   console.log("Global Commands:");
-  console.log(`  ${pc15.cyan("status")}       Show all infrastructure status`);
-  console.log(`  ${pc15.cyan("destroy")}      Remove deployed infrastructure`);
-  console.log(`  ${pc15.cyan("completion")}   Generate shell completion script`);
+  console.log(`  ${pc17.cyan("status")}       Show overview of all services`);
+  console.log(`  ${pc17.cyan("destroy")}      Remove deployed infrastructure`);
+  console.log(`  ${pc17.cyan("completion")}   Generate shell completion script`);
   console.log(
-    `  ${pc15.cyan("telemetry")}    Manage anonymous telemetry settings
+    `  ${pc17.cyan("telemetry")}    Manage anonymous telemetry settings
 `
   );
   console.log("Options:");
   console.log(
-    `  ${pc15.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
+    `  ${pc17.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
   );
-  console.log(`  ${pc15.dim("-r, --region")}    AWS region`);
-  console.log(`  ${pc15.dim("-d, --domain")}    Domain name`);
-  console.log(`  ${pc15.dim("--account")}        AWS account ID or alias`);
-  console.log(`  ${pc15.dim("--preset")}         Configuration preset`);
-  console.log(`  ${pc15.dim("-y, --yes")}        Skip confirmation prompts`);
-  console.log(`  ${pc15.dim("-f, --force")}      Force destructive operations`);
+  console.log(`  ${pc17.dim("-r, --region")}    AWS region`);
+  console.log(`  ${pc17.dim("-d, --domain")}    Domain name`);
+  console.log(`  ${pc17.dim("--account")}        AWS account ID or alias`);
+  console.log(`  ${pc17.dim("--preset")}         Configuration preset`);
+  console.log(`  ${pc17.dim("-y, --yes")}        Skip confirmation prompts`);
+  console.log(`  ${pc17.dim("-f, --force")}      Force destructive operations`);
   console.log(
-    `  ${pc15.dim("--preview")}        Preview changes without deploying`
+    `  ${pc17.dim("--preview")}        Preview changes without deploying`
   );
-  console.log(`  ${pc15.dim("-v, --version")}    Show version number
+  console.log(`  ${pc17.dim("-v, --version")}    Show version number
 `);
   console.log(
-    `Run ${pc15.cyan("wraps <service> <command> --help")} for more information.
+    `Run ${pc17.cyan("wraps <service> <command> --help")} for more information.
 `
   );
   process.exit(0);
@@ -8643,37 +9243,9 @@ var flags = args.parse(process.argv);
 var [primaryCommand, subCommand] = args.sub;
 if (!primaryCommand) {
   async function selectService() {
-    clack14.intro(pc15.bold(`WRAPS CLI v${VERSION}`));
-    console.log("Welcome! Let's get started deploying your infrastructure.\n");
-    const service = await clack14.select({
-      message: "Which service would you like to set up?",
-      options: [
-        {
-          value: "email",
-          label: "Email",
-          hint: "AWS SES email infrastructure"
-        },
-        {
-          value: "sms",
-          label: "SMS",
-          hint: "Coming soon - AWS End User Messaging"
-        }
-      ]
-    });
-    if (clack14.isCancel(service)) {
-      clack14.cancel("Operation cancelled.");
-      process.exit(0);
-    }
-    if (service === "sms") {
-      clack14.log.warn("SMS infrastructure is coming soon!");
-      console.log(
-        `
-Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-team/wraps")}
-`
-      );
-      process.exit(0);
-    }
-    const action = await clack14.select({
+    clack16.intro(pc17.bold(`WRAPS CLI v${VERSION}`));
+    console.log("Welcome! Let's get started deploying your email infrastructure.\n");
+    const action = await clack16.select({
       message: "What would you like to do?",
       options: [
         {
@@ -8688,8 +9260,8 @@ Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-
         }
       ]
     });
-    if (clack14.isCancel(action)) {
-      clack14.cancel("Operation cancelled.");
+    if (clack16.isCancel(action)) {
+      clack16.cancel("Operation cancelled.");
       process.exit(0);
     }
     if (action === "init") {
@@ -8718,20 +9290,20 @@ async function run() {
   const telemetry = getTelemetryClient();
   if (telemetry.shouldShowNotification()) {
     console.log();
-    clack14.log.info(pc15.bold("Anonymous Telemetry"));
+    clack16.log.info(pc17.bold("Anonymous Telemetry"));
     console.log(
-      `  Wraps collects ${pc15.cyan("anonymous usage data")} to improve the CLI.`
+      `  Wraps collects ${pc17.cyan("anonymous usage data")} to improve the CLI.`
     );
     console.log(
-      `  We ${pc15.bold("never")} collect: domains, AWS credentials, email content, or PII.`
+      `  We ${pc17.bold("never")} collect: domains, AWS credentials, email content, or PII.`
     );
     console.log(
-      `  We ${pc15.bold("only")} collect: command names, success/failure, CLI version, OS.`
+      `  We ${pc17.bold("only")} collect: command names, success/failure, CLI version, OS.`
     );
     console.log();
-    console.log(`  Opt-out anytime: ${pc15.cyan("wraps telemetry disable")}`);
-    console.log(`  Or set: ${pc15.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
-    console.log(`  Learn more: ${pc15.cyan("https://wraps.dev/docs/telemetry")}`);
+    console.log(`  Opt-out anytime: ${pc17.cyan("wraps telemetry disable")}`);
+    console.log(`  Or set: ${pc17.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
+    console.log(`  Learn more: ${pc17.cyan("https://wraps.dev/docs/telemetry")}`);
     console.log();
     telemetry.markNotificationShown();
   }
@@ -8778,15 +9350,33 @@ async function run() {
             preview: flags.preview
           });
           break;
+        case "status":
+          await emailStatus({
+            account: flags.account
+          });
+          break;
+        case "verify": {
+          if (!flags.domain) {
+            clack16.log.error("--domain flag is required");
+            console.log(
+              `
+Usage: ${pc17.cyan("wraps email verify --domain yourapp.com")}
+`
+            );
+            process.exit(1);
+          }
+          await verifyDomain({ domain: flags.domain });
+          break;
+        }
         case "domains": {
           const domainsSubCommand = args.sub[2];
           switch (domainsSubCommand) {
             case "add": {
               if (!flags.domain) {
-                clack14.log.error("--domain flag is required");
+                clack16.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc15.cyan("wraps email domains add --domain yourapp.com")}
+Usage: ${pc17.cyan("wraps email domains add --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -8799,10 +9389,10 @@ Usage: ${pc15.cyan("wraps email domains add --domain yourapp.com")}
               break;
             case "verify": {
               if (!flags.domain) {
-                clack14.log.error("--domain flag is required");
+                clack16.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc15.cyan("wraps email domains verify --domain yourapp.com")}
+Usage: ${pc17.cyan("wraps email domains verify --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -8812,10 +9402,10 @@ Usage: ${pc15.cyan("wraps email domains verify --domain yourapp.com")}
             }
             case "get-dkim": {
               if (!flags.domain) {
-                clack14.log.error("--domain flag is required");
+                clack16.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc15.cyan("wraps email domains get-dkim --domain yourapp.com")}
+Usage: ${pc17.cyan("wraps email domains get-dkim --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -8825,10 +9415,10 @@ Usage: ${pc15.cyan("wraps email domains get-dkim --domain yourapp.com")}
             }
             case "remove": {
               if (!flags.domain) {
-                clack14.log.error("--domain flag is required");
+                clack16.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc15.cyan("wraps email domains remove --domain yourapp.com --force")}
+Usage: ${pc17.cyan("wraps email domains remove --domain yourapp.com --force")}
 `
                 );
                 process.exit(1);
@@ -8840,27 +9430,40 @@ Usage: ${pc15.cyan("wraps email domains remove --domain yourapp.com --force")}
               break;
             }
             default:
-              clack14.log.error(
+              clack16.log.error(
                 `Unknown domains command: ${domainsSubCommand || "(none)"}`
               );
               console.log(
                 `
-Available commands: ${pc15.cyan("add")}, ${pc15.cyan("list")}, ${pc15.cyan("verify")}, ${pc15.cyan("get-dkim")}, ${pc15.cyan("remove")}
+Available commands: ${pc17.cyan("add")}, ${pc17.cyan("list")}, ${pc17.cyan("verify")}, ${pc17.cyan("get-dkim")}, ${pc17.cyan("remove")}
 `
               );
               process.exit(1);
           }
           break;
         }
+        case "destroy":
+          await emailDestroy({
+            force: flags.force,
+            preview: flags.preview
+          });
+          break;
         default:
-          clack14.log.error(`Unknown email command: ${subCommand}`);
+          clack16.log.error(`Unknown email command: ${subCommand}`);
           console.log(
             `
-Run ${pc15.cyan("wraps --help")} for available commands.
+Run ${pc17.cyan("wraps --help")} for available commands.
 `
           );
           process.exit(1);
       }
+      const emailDuration = Date.now() - startTime;
+      const emailCommandName = `email:${subCommand}`;
+      trackCommand(emailCommandName, {
+        success: true,
+        duration_ms: emailDuration,
+        service: "email"
+      });
       return;
     }
     if (primaryCommand === "dashboard" && subCommand) {
@@ -8872,25 +9475,22 @@ Run ${pc15.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack14.log.error(`Unknown dashboard command: ${subCommand}`);
+          clack16.log.error(`Unknown dashboard command: ${subCommand}`);
           console.log(`
-Available commands: ${pc15.cyan("update-role")}
+Available commands: ${pc17.cyan("update-role")}
 `);
-          console.log(`Run ${pc15.cyan("wraps --help")} for more information.
+          console.log(`Run ${pc17.cyan("wraps --help")} for more information.
 `);
           process.exit(1);
       }
+      const dashboardDuration = Date.now() - startTime;
+      const dashboardCommandName = `dashboard:${subCommand}`;
+      trackCommand(dashboardCommandName, {
+        success: true,
+        duration_ms: dashboardDuration
+      });
       return;
     }
-    if (primaryCommand === "sms" && subCommand) {
-      clack14.log.warn("SMS infrastructure is coming soon!");
-      console.log(
-        `
-Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-team/wraps")}
-`
-      );
-      process.exit(0);
-    }
     switch (primaryCommand) {
       // Global commands (work across all services)
       case "status":
@@ -8906,8 +9506,8 @@ Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-
         break;
       case "dashboard":
         if (!subCommand) {
-          clack14.log.warn(
-            `'wraps dashboard' is deprecated. Use ${pc15.cyan("wraps console")} instead.`
+          clack16.log.warn(
+            `'wraps dashboard' is deprecated. Use ${pc17.cyan("wraps console")} instead.`
           );
           await dashboard({
             port: flags.port,
@@ -8937,10 +9537,10 @@ Check back soon or follow our progress at ${pc15.cyan("https://github.com/wraps-
             await telemetryStatus();
             break;
           default:
-            clack14.log.error(`Unknown telemetry command: ${subCommand}`);
+            clack16.log.error(`Unknown telemetry command: ${subCommand}`);
             console.log(
               `
-Available commands: ${pc15.cyan("enable")}, ${pc15.cyan("disable")}, ${pc15.cyan("status")}
+Available commands: ${pc17.cyan("enable")}, ${pc17.cyan("disable")}, ${pc17.cyan("status")}
 `
             );
             process.exit(1);
@@ -8949,7 +9549,6 @@ Available commands: ${pc15.cyan("enable")}, ${pc15.cyan("disable")}, ${pc15.cyan
       }
       // Show help for service without subcommand
       case "email":
-      case "sms":
         console.log(
           `
 Please specify a command for ${primaryCommand} service.
@@ -8958,10 +9557,10 @@ Please specify a command for ${primaryCommand} service.
         showHelp();
         break;
       default:
-        clack14.log.error(`Unknown command: ${primaryCommand}`);
+        clack16.log.error(`Unknown command: ${primaryCommand}`);
         console.log(
           `
-Run ${pc15.cyan("wraps --help")} for available commands.
+Run ${pc17.cyan("wraps --help")} for available commands.
 `
         );
         process.exit(1);