@wraps.dev/cli 2.11.2 → 2.11.4

package/dist/cli.js

@@ -18,6 +18,54 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/utils/shared/ci-detection.ts
+function isCI() {
+  if (process.env.CI === "true" || process.env.CI === "1") {
+    return true;
+  }
+  const ciEnvVars = [
+    "GITHUB_ACTIONS",
+    // GitHub Actions
+    "GITLAB_CI",
+    // GitLab CI
+    "CIRCLECI",
+    // CircleCI
+    "TRAVIS",
+    // Travis CI
+    "JENKINS_URL",
+    // Jenkins
+    "BUILDKITE",
+    // Buildkite
+    "DRONE",
+    // Drone
+    "SEMAPHORE",
+    // Semaphore
+    "TEAMCITY_VERSION",
+    // TeamCity
+    "TF_BUILD",
+    // Azure Pipelines
+    "CODEBUILD_BUILD_ID",
+    // AWS CodeBuild
+    "NETLIFY",
+    // Netlify
+    "VERCEL",
+    // Vercel
+    "HEROKU_TEST_RUN_ID",
+    // Heroku CI
+    "BUDDY",
+    // Buddy
+    "BITBUCKET_BUILD_NUMBER"
+    // Bitbucket Pipelines
+  ];
+  return ciEnvVars.some((envVar) => process.env[envVar] !== void 0);
+}
+var init_ci_detection = __esm({
+  "src/utils/shared/ci-detection.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/utils/shared/s3-state.ts
 var s3_state_exports = {};
 __export(s3_state_exports, {
@@ -369,414 +417,46 @@ var init_config = __esm({
   }
 });
 
-// src/utils/shared/aws-detection.ts
-import { execSync } from "child_process";
-import { existsSync as existsSync4, readdirSync, readFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
-import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-async function isAWSCLIInstalled() {
-  try {
-    execSync("aws --version", { stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function getAWSCLIVersion() {
-  try {
-    const output4 = execSync("aws --version", { encoding: "utf-8" });
-    const match = output4.match(/aws-cli\/(\d+\.\d+\.\d+)/);
-    return match ? match[1] : null;
-  } catch {
-    return null;
-  }
-}
-function detectCredentialSource() {
-  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
-    return "environment";
-  }
-  if (process.env.AWS_SSO_ACCOUNT_ID || process.env.AWS_SSO_SESSION) {
-    return "sso";
-  }
-  if (process.env.AWS_PROFILE) {
-    return "profile";
-  }
-  const credentialsPath = join4(homedir2(), ".aws", "credentials");
-  if (existsSync4(credentialsPath)) {
-    const content = readFileSync(credentialsPath, "utf-8");
-    if (content.includes("[default]")) {
-      return "profile";
-    }
-  }
-  const ssoCachePath = join4(homedir2(), ".aws", "sso", "cache");
-  if (existsSync4(ssoCachePath)) {
-    return "sso";
-  }
-  if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_EXECUTION_ENV) {
-    return "instance";
-  }
-  return null;
-}
-function detectHostingProvider() {
-  if (process.env.VERCEL || process.env.VERCEL_ENV) {
-    return "vercel";
-  }
-  if (process.env.RAILWAY_ENVIRONMENT || process.env.RAILWAY_PROJECT_ID) {
-    return "railway";
-  }
-  if (process.env.NETLIFY || process.env.NETLIFY_DEV) {
-    return "netlify";
-  }
-  if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_EXECUTION_ENV || process.env.ECS_CONTAINER_METADATA_URI || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
-    return "aws";
-  }
-  return null;
-}
-async function validateCredentials() {
-  try {
-    const sts = new STSClient({ region: "us-east-1" });
-    const identity = await sts.send(new GetCallerIdentityCommand({}));
-    return identity.Account || null;
-  } catch {
-    return null;
-  }
-}
-function getCurrentProfile() {
-  return process.env.AWS_PROFILE || "default";
-}
-function getCurrentRegion() {
-  if (process.env.AWS_REGION) {
-    return process.env.AWS_REGION;
-  }
-  if (process.env.AWS_DEFAULT_REGION) {
-    return process.env.AWS_DEFAULT_REGION;
-  }
-  try {
-    const region = execSync("aws configure get region", {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    return region || null;
-  } catch {
-    return null;
-  }
-}
-function parseSSOProfiles() {
-  const configPath = join4(homedir2(), ".aws", "config");
-  if (!existsSync4(configPath)) {
-    return [];
-  }
-  const content = readFileSync(configPath, "utf-8");
-  const profiles = [];
-  const sessionMap = /* @__PURE__ */ new Map();
-  const sessionSections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sessionSections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (header?.startsWith("sso-session ")) {
-      const sessionName = header.replace("sso-session ", "");
-      const config2 = {};
-      for (const line of lines.slice(1)) {
-        const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-        if (match) {
-          config2[match[1]] = match[2];
-        }
+// src/telemetry/config.ts
+import Conf from "conf";
+import { v4 as uuidv4 } from "uuid";
+var CONFIG_DEFAULTS, TelemetryConfigManager;
+var init_config2 = __esm({
+  "src/telemetry/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    CONFIG_DEFAULTS = {
+      enabled: true,
+      anonymousId: uuidv4(),
+      notificationShown: false
+    };
+    TelemetryConfigManager = class {
+      config;
+      constructor(options) {
+        this.config = new Conf({
+          projectName: "wraps",
+          configName: "telemetry",
+          defaults: CONFIG_DEFAULTS,
+          cwd: options?.cwd
+        });
       }
-      sessionMap.set(sessionName, {
-        startUrl: config2.sso_start_url || "",
-        region: config2.sso_region || ""
-      });
-    }
-  }
-  const sections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (!header?.startsWith("profile ") && header !== "default") {
-      continue;
-    }
-    const profileName = header === "default" ? "default" : header.replace("profile ", "");
-    const config2 = {};
-    for (const line of lines.slice(1)) {
-      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-      if (match) {
-        config2[match[1]] = match[2];
+      /**
+       * Check if telemetry is enabled
+       */
+      isEnabled() {
+        return this.config.get("enabled");
       }
-    }
-    if (config2.sso_start_url || config2.sso_session) {
-      let ssoStartUrl = config2.sso_start_url || "";
-      let ssoRegion = config2.sso_region || "";
-      if (config2.sso_session) {
-        const session = sessionMap.get(config2.sso_session);
-        if (session) {
-          ssoStartUrl = ssoStartUrl || session.startUrl;
-          ssoRegion = ssoRegion || session.region;
-        }
+      /**
+       * Enable or disable telemetry
+       */
+      setEnabled(enabled) {
+        this.config.set("enabled", enabled);
       }
-      profiles.push({
-        name: profileName,
-        ssoStartUrl,
-        ssoRegion,
-        ssoAccountId: config2.sso_account_id || "",
-        ssoRoleName: config2.sso_role_name || "",
-        region: config2.region,
-        ssoSession: config2.sso_session
-      });
-    }
-  }
-  return profiles;
-}
-function parseSSOSessions() {
-  const configPath = join4(homedir2(), ".aws", "config");
-  if (!existsSync4(configPath)) {
-    return [];
-  }
-  const content = readFileSync(configPath, "utf-8");
-  const sessions = [];
-  const sections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (!header?.startsWith("sso-session ")) {
-      continue;
-    }
-    const sessionName = header.replace("sso-session ", "");
-    const config2 = {};
-    for (const line of lines.slice(1)) {
-      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-      if (match) {
-        config2[match[1]] = match[2];
-      }
-    }
-    sessions.push({
-      name: sessionName,
-      ssoStartUrl: config2.sso_start_url || "",
-      ssoRegion: config2.sso_region || "",
-      ssoRegistrationScopes: config2.sso_registration_scopes?.split(",").map((s) => s.trim())
-    });
-  }
-  return sessions;
-}
-function checkSSOTokenStatus(startUrl) {
-  const ssoCachePath = join4(homedir2(), ".aws", "sso", "cache");
-  if (!existsSync4(ssoCachePath)) {
-    return {
-      valid: false,
-      expiresAt: null,
-      expired: true,
-      minutesRemaining: null,
-      startUrl: null
-    };
-  }
-  try {
-    const cacheFiles = readdirSync(ssoCachePath).filter(
-      (f) => f.endsWith(".json")
-    );
-    for (const file of cacheFiles) {
-      const content = readFileSync(join4(ssoCachePath, file), "utf-8");
-      const token = JSON.parse(content);
-      if (!(token.accessToken && token.expiresAt)) {
-        continue;
-      }
-      if (startUrl && token.startUrl !== startUrl) {
-        continue;
-      }
-      const expiresAt = new Date(token.expiresAt);
-      const now = /* @__PURE__ */ new Date();
-      const expired = expiresAt <= now;
-      const minutesRemaining = Math.floor(
-        (expiresAt.getTime() - now.getTime()) / 6e4
-      );
-      return {
-        valid: !expired,
-        expiresAt,
-        expired,
-        minutesRemaining,
-        startUrl: token.startUrl || null
-      };
-    }
-  } catch {
-  }
-  return {
-    valid: false,
-    expiresAt: null,
-    expired: true,
-    minutesRemaining: null,
-    startUrl: null
-  };
-}
-function getActiveSSOProfile(profiles) {
-  const currentProfile = process.env.AWS_PROFILE || "default";
-  return profiles.find((p) => p.name === currentProfile) || null;
-}
-function getSSOLoginCommand(profile) {
-  if (profile && profile !== "default") {
-    return `aws sso login --profile ${profile}`;
-  }
-  return "aws sso login";
-}
-function formatSSOProfile(profile) {
-  return `${profile.name} (${profile.ssoAccountId} / ${profile.ssoRoleName})`;
-}
-async function detectAWSState() {
-  const [cliInstalled, cliVersion, accountId] = await Promise.all([
-    isAWSCLIInstalled(),
-    getAWSCLIVersion(),
-    validateCredentials()
-  ]);
-  const credentialSource = detectCredentialSource();
-  const detectedProvider = detectHostingProvider();
-  const region = getCurrentRegion();
-  const profileName = getCurrentProfile();
-  const ssoProfiles = parseSSOProfiles();
-  const ssoSessions = parseSSOSessions();
-  const activeProfile = getActiveSSOProfile(ssoProfiles);
-  const tokenStatus = ssoProfiles.length > 0 ? checkSSOTokenStatus(activeProfile?.ssoStartUrl) : null;
-  const isUsingSSO = credentialSource === "sso" || activeProfile !== null && accountId !== null;
-  return {
-    cliInstalled,
-    cliVersion,
-    credentialsConfigured: accountId !== null,
-    credentialSource: isUsingSSO ? "sso" : accountId !== null ? credentialSource : null,
-    profileName,
-    accountId,
-    detectedProvider,
-    region,
-    sso: {
-      configured: ssoProfiles.length > 0,
-      profiles: ssoProfiles,
-      sessions: ssoSessions,
-      tokenStatus,
-      activeProfile: isUsingSSO ? activeProfile : null
-    }
-  };
-}
-function hasCredentialsFile() {
-  const credentialsPath = join4(homedir2(), ".aws", "credentials");
-  return existsSync4(credentialsPath);
-}
-function hasConfigFile() {
-  const configPath = join4(homedir2(), ".aws", "config");
-  return existsSync4(configPath);
-}
-function getConfiguredProfiles() {
-  const profiles = [];
-  const credentialsPath = join4(homedir2(), ".aws", "credentials");
-  if (existsSync4(credentialsPath)) {
-    const content = readFileSync(credentialsPath, "utf-8");
-    const matches = content.matchAll(/\[([^\]]+)\]/g);
-    for (const match of matches) {
-      profiles.push(match[1]);
-    }
-  }
-  const configPath = join4(homedir2(), ".aws", "config");
-  if (existsSync4(configPath)) {
-    const content = readFileSync(configPath, "utf-8");
-    const matches = content.matchAll(/\[profile ([^\]]+)\]/g);
-    for (const match of matches) {
-      if (!profiles.includes(match[1])) {
-        profiles.push(match[1]);
-      }
-    }
-  }
-  return profiles;
-}
-var init_aws_detection = __esm({
-  "src/utils/shared/aws-detection.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
-// src/utils/shared/ci-detection.ts
-function isCI() {
-  if (process.env.CI === "true" || process.env.CI === "1") {
-    return true;
-  }
-  const ciEnvVars = [
-    "GITHUB_ACTIONS",
-    // GitHub Actions
-    "GITLAB_CI",
-    // GitLab CI
-    "CIRCLECI",
-    // CircleCI
-    "TRAVIS",
-    // Travis CI
-    "JENKINS_URL",
-    // Jenkins
-    "BUILDKITE",
-    // Buildkite
-    "DRONE",
-    // Drone
-    "SEMAPHORE",
-    // Semaphore
-    "TEAMCITY_VERSION",
-    // TeamCity
-    "TF_BUILD",
-    // Azure Pipelines
-    "CODEBUILD_BUILD_ID",
-    // AWS CodeBuild
-    "NETLIFY",
-    // Netlify
-    "VERCEL",
-    // Vercel
-    "HEROKU_TEST_RUN_ID",
-    // Heroku CI
-    "BUDDY",
-    // Buddy
-    "BITBUCKET_BUILD_NUMBER"
-    // Bitbucket Pipelines
-  ];
-  return ciEnvVars.some((envVar) => process.env[envVar] !== void 0);
-}
-var init_ci_detection = __esm({
-  "src/utils/shared/ci-detection.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
-// src/telemetry/config.ts
-import Conf from "conf";
-import { v4 as uuidv4 } from "uuid";
-var CONFIG_DEFAULTS, TelemetryConfigManager;
-var init_config2 = __esm({
-  "src/telemetry/config.ts"() {
-    "use strict";
-    init_esm_shims();
-    CONFIG_DEFAULTS = {
-      enabled: true,
-      anonymousId: uuidv4(),
-      notificationShown: false
-    };
-    TelemetryConfigManager = class {
-      config;
-      constructor(options) {
-        this.config = new Conf({
-          projectName: "wraps",
-          configName: "telemetry",
-          defaults: CONFIG_DEFAULTS,
-          cwd: options?.cwd
-        });
-      }
-      /**
-       * Check if telemetry is enabled
-       */
-      isEnabled() {
-        return this.config.get("enabled");
-      }
-      /**
-       * Enable or disable telemetry
-       */
-      setEnabled(enabled) {
-        this.config.set("enabled", enabled);
-      }
-      /**
-       * Get the anonymous user ID
-       */
-      getAnonymousId() {
-        return this.config.get("anonymousId");
+      /**
+       * Get the anonymous user ID
+       */
+      getAnonymousId() {
+        return this.config.get("anonymousId");
       }
       /**
        * Check if the first-run notification has been shown
@@ -811,10 +491,10 @@ var init_config2 = __esm({
 });
 
 // src/telemetry/client.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join5 } from "path";
+import { readFileSync } from "fs";
+import { dirname, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import pc4 from "picocolors";
+import pc from "picocolors";
 function getTelemetryClient() {
   if (!telemetryInstance) {
     telemetryInstance = new TelemetryClient();
@@ -1041,91 +721,411 @@ var init_client = __esm({
         if (this.hasShownFooter) {
           return false;
         }
-        this.hasShownFooter = true;
-        console.log();
-        console.log(pc4.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-        console.log("\u{1F4CA} Wraps Platform \u2014 analytics, templates, automations");
-        console.log(`   From $10/mo \u2192 ${pc4.cyan("https://wraps.dev/platform")}`);
-        console.log();
-        console.log(`\u{1F4AC} ${pc4.cyan("hey@wraps.sh")}`);
-        console.log(pc4.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-        return true;
+        this.hasShownFooter = true;
+        console.log();
+        console.log(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        console.log("\u{1F4CA} Wraps Platform \u2014 analytics, templates, automations");
+        console.log(`   From $10/mo \u2192 ${pc.cyan("https://wraps.dev/platform")}`);
+        console.log();
+        console.log(`\u{1F4AC} ${pc.cyan("hey@wraps.sh")}`);
+        console.log(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        return true;
+      }
+      /**
+       * Get CLI version from package.json
+       */
+      getCLIVersion() {
+        try {
+          const __filename3 = fileURLToPath2(import.meta.url);
+          const __dirname4 = dirname(__filename3);
+          const pkg = JSON.parse(
+            readFileSync(join4(__dirname4, "../package.json"), "utf-8")
+          );
+          return pkg.version;
+        } catch {
+          return "unknown";
+        }
+      }
+    };
+    telemetryInstance = null;
+  }
+});
+
+// src/telemetry/events.ts
+function trackCommand(command, metadata) {
+  const client = getTelemetryClient();
+  const sanitized = metadata ? { ...metadata } : {};
+  sanitized.domain = void 0;
+  sanitized.accountId = void 0;
+  sanitized.email = void 0;
+  client.track(`command:${command}`, sanitized);
+}
+function trackServiceInit(service, success, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:init", {
+    service,
+    success,
+    ...metadata
+  });
+}
+function trackServiceDeployed(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:deployed", {
+    service,
+    ...metadata
+  });
+}
+function trackError(errorCode, command, metadata) {
+  const client = getTelemetryClient();
+  client.track("error:occurred", {
+    error_code: errorCode,
+    command,
+    ...metadata
+  });
+}
+function trackFeature(feature, metadata) {
+  const client = getTelemetryClient();
+  client.track(`feature:${feature}`, metadata || {});
+}
+function trackServiceUpgrade(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:upgraded", {
+    service,
+    ...metadata
+  });
+}
+function trackServiceRemoved(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:removed", {
+    service,
+    ...metadata
+  });
+}
+var init_events = __esm({
+  "src/telemetry/events.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_client();
+  }
+});
+
+// src/utils/shared/aws-detection.ts
+import { execSync } from "child_process";
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+async function isAWSCLIInstalled() {
+  try {
+    execSync("aws --version", { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getAWSCLIVersion() {
+  try {
+    const output4 = execSync("aws --version", { encoding: "utf-8" });
+    const match = output4.match(/aws-cli\/(\d+\.\d+\.\d+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+function detectCredentialSource() {
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+    return "environment";
+  }
+  if (process.env.AWS_SSO_ACCOUNT_ID || process.env.AWS_SSO_SESSION) {
+    return "sso";
+  }
+  if (process.env.AWS_PROFILE) {
+    return "profile";
+  }
+  const credentialsPath = join5(homedir2(), ".aws", "credentials");
+  if (existsSync4(credentialsPath)) {
+    const content = readFileSync2(credentialsPath, "utf-8");
+    if (content.includes("[default]")) {
+      return "profile";
+    }
+  }
+  const ssoCachePath = join5(homedir2(), ".aws", "sso", "cache");
+  if (existsSync4(ssoCachePath)) {
+    return "sso";
+  }
+  if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_EXECUTION_ENV) {
+    return "instance";
+  }
+  return null;
+}
+function detectHostingProvider() {
+  if (process.env.VERCEL || process.env.VERCEL_ENV) {
+    return "vercel";
+  }
+  if (process.env.RAILWAY_ENVIRONMENT || process.env.RAILWAY_PROJECT_ID) {
+    return "railway";
+  }
+  if (process.env.NETLIFY || process.env.NETLIFY_DEV) {
+    return "netlify";
+  }
+  if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_EXECUTION_ENV || process.env.ECS_CONTAINER_METADATA_URI || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
+    return "aws";
+  }
+  return null;
+}
+async function validateCredentials() {
+  try {
+    const sts = new STSClient({ region: "us-east-1" });
+    const identity = await sts.send(new GetCallerIdentityCommand({}));
+    return identity.Account || null;
+  } catch {
+    return null;
+  }
+}
+function getCurrentProfile() {
+  return process.env.AWS_PROFILE || "default";
+}
+function getCurrentRegion() {
+  if (process.env.AWS_REGION) {
+    return process.env.AWS_REGION;
+  }
+  if (process.env.AWS_DEFAULT_REGION) {
+    return process.env.AWS_DEFAULT_REGION;
+  }
+  try {
+    const region = execSync("aws configure get region", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    return region || null;
+  } catch {
+    return null;
+  }
+}
+function parseSSOProfiles() {
+  const configPath = join5(homedir2(), ".aws", "config");
+  if (!existsSync4(configPath)) {
+    return [];
+  }
+  const content = readFileSync2(configPath, "utf-8");
+  const profiles = [];
+  const sessionMap = /* @__PURE__ */ new Map();
+  const sessionSections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sessionSections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (header?.startsWith("sso-session ")) {
+      const sessionName = header.replace("sso-session ", "");
+      const config2 = {};
+      for (const line of lines.slice(1)) {
+        const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+        if (match) {
+          config2[match[1]] = match[2];
+        }
       }
-      /**
-       * Get CLI version from package.json
-       */
-      getCLIVersion() {
-        try {
-          const __filename3 = fileURLToPath2(import.meta.url);
-          const __dirname4 = dirname(__filename3);
-          const pkg = JSON.parse(
-            readFileSync2(join5(__dirname4, "../package.json"), "utf-8")
-          );
-          return pkg.version;
-        } catch {
-          return "unknown";
+      sessionMap.set(sessionName, {
+        startUrl: config2.sso_start_url || "",
+        region: config2.sso_region || ""
+      });
+    }
+  }
+  const sections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (!header?.startsWith("profile ") && header !== "default") {
+      continue;
+    }
+    const profileName = header === "default" ? "default" : header.replace("profile ", "");
+    const config2 = {};
+    for (const line of lines.slice(1)) {
+      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+      if (match) {
+        config2[match[1]] = match[2];
+      }
+    }
+    if (config2.sso_start_url || config2.sso_session) {
+      let ssoStartUrl = config2.sso_start_url || "";
+      let ssoRegion = config2.sso_region || "";
+      if (config2.sso_session) {
+        const session = sessionMap.get(config2.sso_session);
+        if (session) {
+          ssoStartUrl = ssoStartUrl || session.startUrl;
+          ssoRegion = ssoRegion || session.region;
         }
       }
+      profiles.push({
+        name: profileName,
+        ssoStartUrl,
+        ssoRegion,
+        ssoAccountId: config2.sso_account_id || "",
+        ssoRoleName: config2.sso_role_name || "",
+        region: config2.region,
+        ssoSession: config2.sso_session
+      });
+    }
+  }
+  return profiles;
+}
+function parseSSOSessions() {
+  const configPath = join5(homedir2(), ".aws", "config");
+  if (!existsSync4(configPath)) {
+    return [];
+  }
+  const content = readFileSync2(configPath, "utf-8");
+  const sessions = [];
+  const sections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (!header?.startsWith("sso-session ")) {
+      continue;
+    }
+    const sessionName = header.replace("sso-session ", "");
+    const config2 = {};
+    for (const line of lines.slice(1)) {
+      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+      if (match) {
+        config2[match[1]] = match[2];
+      }
+    }
+    sessions.push({
+      name: sessionName,
+      ssoStartUrl: config2.sso_start_url || "",
+      ssoRegion: config2.sso_region || "",
+      ssoRegistrationScopes: config2.sso_registration_scopes?.split(",").map((s) => s.trim())
+    });
+  }
+  return sessions;
+}
+function checkSSOTokenStatus(startUrl) {
+  const ssoCachePath = join5(homedir2(), ".aws", "sso", "cache");
+  if (!existsSync4(ssoCachePath)) {
+    return {
+      valid: false,
+      expiresAt: null,
+      expired: true,
+      minutesRemaining: null,
+      startUrl: null
     };
-    telemetryInstance = null;
   }
-});
-
-// src/telemetry/events.ts
-function trackCommand(command, metadata) {
-  const client = getTelemetryClient();
-  const sanitized = metadata ? { ...metadata } : {};
-  sanitized.domain = void 0;
-  sanitized.accountId = void 0;
-  sanitized.email = void 0;
-  client.track(`command:${command}`, sanitized);
+  try {
+    const cacheFiles = readdirSync(ssoCachePath).filter(
+      (f) => f.endsWith(".json")
+    );
+    for (const file of cacheFiles) {
+      const content = readFileSync2(join5(ssoCachePath, file), "utf-8");
+      const token = JSON.parse(content);
+      if (!(token.accessToken && token.expiresAt)) {
+        continue;
+      }
+      if (startUrl && token.startUrl !== startUrl) {
+        continue;
+      }
+      const expiresAt = new Date(token.expiresAt);
+      const now = /* @__PURE__ */ new Date();
+      const expired = expiresAt <= now;
+      const minutesRemaining = Math.floor(
+        (expiresAt.getTime() - now.getTime()) / 6e4
+      );
+      return {
+        valid: !expired,
+        expiresAt,
+        expired,
+        minutesRemaining,
+        startUrl: token.startUrl || null
+      };
+    }
+  } catch {
+  }
+  return {
+    valid: false,
+    expiresAt: null,
+    expired: true,
+    minutesRemaining: null,
+    startUrl: null
+  };
 }
-function trackServiceInit(service, success, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:init", {
-    service,
-    success,
-    ...metadata
-  });
+function getActiveSSOProfile(profiles) {
+  const currentProfile = process.env.AWS_PROFILE || "default";
+  return profiles.find((p) => p.name === currentProfile) || null;
 }
-function trackServiceDeployed(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:deployed", {
-    service,
-    ...metadata
-  });
+function getSSOLoginCommand(profile) {
+  if (profile && profile !== "default") {
+    return `aws sso login --profile ${profile}`;
+  }
+  return "aws sso login";
 }
-function trackError(errorCode, command, metadata) {
-  const client = getTelemetryClient();
-  client.track("error:occurred", {
-    error_code: errorCode,
-    command,
-    ...metadata
-  });
+function formatSSOProfile(profile) {
+  return `${profile.name} (${profile.ssoAccountId} / ${profile.ssoRoleName})`;
 }
-function trackFeature(feature, metadata) {
-  const client = getTelemetryClient();
-  client.track(`feature:${feature}`, metadata || {});
+async function detectAWSState() {
+  const [cliInstalled, cliVersion, accountId] = await Promise.all([
+    isAWSCLIInstalled(),
+    getAWSCLIVersion(),
+    validateCredentials()
+  ]);
+  const credentialSource = detectCredentialSource();
+  const detectedProvider = detectHostingProvider();
+  const region = getCurrentRegion();
+  const profileName = getCurrentProfile();
+  const ssoProfiles = parseSSOProfiles();
+  const ssoSessions = parseSSOSessions();
+  const activeProfile = getActiveSSOProfile(ssoProfiles);
+  const tokenStatus = ssoProfiles.length > 0 ? checkSSOTokenStatus(activeProfile?.ssoStartUrl) : null;
+  const isUsingSSO = credentialSource === "sso" || activeProfile !== null && accountId !== null;
+  return {
+    cliInstalled,
+    cliVersion,
+    credentialsConfigured: accountId !== null,
+    credentialSource: isUsingSSO ? "sso" : accountId !== null ? credentialSource : null,
+    profileName,
+    accountId,
+    detectedProvider,
+    region,
+    sso: {
+      configured: ssoProfiles.length > 0,
+      profiles: ssoProfiles,
+      sessions: ssoSessions,
+      tokenStatus,
+      activeProfile: isUsingSSO ? activeProfile : null
+    }
+  };
 }
-function trackServiceUpgrade(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:upgraded", {
-    service,
-    ...metadata
-  });
+function hasCredentialsFile() {
+  const credentialsPath = join5(homedir2(), ".aws", "credentials");
+  return existsSync4(credentialsPath);
 }
-function trackServiceRemoved(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:removed", {
-    service,
-    ...metadata
-  });
+function hasConfigFile() {
+  const configPath = join5(homedir2(), ".aws", "config");
+  return existsSync4(configPath);
 }
-var init_events = __esm({
-  "src/telemetry/events.ts"() {
+function getConfiguredProfiles() {
+  const profiles = [];
+  const credentialsPath = join5(homedir2(), ".aws", "credentials");
+  if (existsSync4(credentialsPath)) {
+    const content = readFileSync2(credentialsPath, "utf-8");
+    const matches = content.matchAll(/\[([^\]]+)\]/g);
+    for (const match of matches) {
+      profiles.push(match[1]);
+    }
+  }
+  const configPath = join5(homedir2(), ".aws", "config");
+  if (existsSync4(configPath)) {
+    const content = readFileSync2(configPath, "utf-8");
+    const matches = content.matchAll(/\[profile ([^\]]+)\]/g);
+    for (const match of matches) {
+      if (!profiles.includes(match[1])) {
+        profiles.push(match[1]);
+      }
+    }
+  }
+  return profiles;
+}
+var init_aws_detection = __esm({
+  "src/utils/shared/aws-detection.ts"() {
     "use strict";
     init_esm_shims();
-    init_client();
   }
 });
 
@@ -4880,9 +4880,36 @@ var init_lambda = __esm({
 // src/infrastructure/resources/acm.ts
 var acm_exports = {};
 __export(acm_exports, {
+  checkCertificateValidation: () => checkCertificateValidation,
   createACMCertificate: () => createACMCertificate
 });
+import { ACMClient as ACMClient2, DescribeCertificateCommand as DescribeCertificateCommand2 } from "@aws-sdk/client-acm";
 import * as aws12 from "@pulumi/aws";
+async function checkCertificateValidation(domain) {
+  try {
+    const acm3 = new ACMClient2({ region: "us-east-1" });
+    const { ListCertificatesCommand } = await import("@aws-sdk/client-acm");
+    const listResponse = await acm3.send(
+      new ListCertificatesCommand({
+        CertificateStatuses: ["ISSUED"]
+      })
+    );
+    const cert = listResponse.CertificateSummaryList?.find(
+      (c) => c.DomainName === domain
+    );
+    if (cert?.CertificateArn) {
+      const describeResponse = await acm3.send(
+        new DescribeCertificateCommand2({
+          CertificateArn: cert.CertificateArn
+        })
+      );
+      return describeResponse.Certificate?.Status === "ISSUED";
+    }
+    return false;
+  } catch (error) {
+    return false;
+  }
+}
 async function createACMCertificate(config2) {
   const usEast1Provider = new aws12.Provider("acm-us-east-1", {
     region: "us-east-1"
@@ -5618,6 +5645,10 @@ var init_eventbridge_inbound = __esm({
 });
 
 // src/utils/dns/cloudflare.ts
+var cloudflare_exports = {};
+__export(cloudflare_exports, {
+  CloudflareDNSClient: () => CloudflareDNSClient
+});
 var CLOUDFLARE_API_BASE, CloudflareDNSClient;
 var init_cloudflare = __esm({
   "src/utils/dns/cloudflare.ts"() {
@@ -5844,6 +5875,92 @@ var init_cloudflare = __esm({
           };
         }
       }
+      /**
+       * Get the zone name (domain) for this zone ID
+       */
+      async getZoneName() {
+        try {
+          const response = await fetch(
+            `${CLOUDFLARE_API_BASE}/zones/${this.zoneId}`,
+            {
+              headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                "Content-Type": "application/json"
+              }
+            }
+          );
+          const data = await response.json();
+          return data.success ? data.result.name : null;
+        } catch {
+          return null;
+        }
+      }
+      /**
+       * Get all CAA records for the zone
+       */
+      async getCAARecords() {
+        const zoneName = await this.getZoneName();
+        if (!zoneName) return [];
+        const result = await this.request(
+          "/dns_records?type=CAA"
+        );
+        if (!(result.success && result.result)) {
+          return [];
+        }
+        return result.result.filter((r) => r.type === "CAA").map((r) => {
+          const match = r.content.match(/^(\d+)\s+(\w+)\s+"?([^"]+)"?$/);
+          if (match) {
+            return {
+              flags: Number.parseInt(match[1], 10),
+              tag: match[2],
+              value: match[3]
+            };
+          }
+          return null;
+        }).filter(
+          (r) => r !== null
+        );
+      }
+      /**
+       * Check if Amazon is allowed to issue certificates based on CAA records
+       */
+      async isAmazonCAAAllowed() {
+        const caaRecords = await this.getCAARecords();
+        const issueRecords = caaRecords.filter(
+          (r) => r.tag === "issue" || r.tag === "issuewild"
+        );
+        if (issueRecords.length === 0) {
+          return { allowed: true, hasCAA: false, existingCAs: [] };
+        }
+        const existingCAs = issueRecords.map((r) => r.value);
+        const amazonAllowed = existingCAs.some(
+          (ca) => ca.includes("amazon.com") || ca.includes("amazontrust.com")
+        );
+        return { allowed: amazonAllowed, hasCAA: true, existingCAs };
+      }
+      /**
+       * Add a CAA record to allow Amazon to issue certificates
+       */
+      async addAmazonCAARecord() {
+        const zoneName = await this.getZoneName();
+        if (!zoneName) return false;
+        const body = {
+          name: zoneName,
+          type: "CAA",
+          data: {
+            flags: 0,
+            tag: "issue",
+            value: "amazon.com"
+          },
+          ttl: 1800
+        };
+        const result = await this.request(
+          "/dns_records",
+          "POST",
+          body
+        );
+        return result.success;
+      }
       async verifyRecords(data) {
         const { domain, dkimTokens, mailFromDomain, region } = data;
         const missing = [];
@@ -5891,6 +6008,10 @@ var init_cloudflare = __esm({
 });
 
 // src/utils/dns/vercel.ts
+var vercel_exports = {};
+__export(vercel_exports, {
+  VercelDNSClient: () => VercelDNSClient
+});
 var VERCEL_API_BASE, VercelDNSClient;
 var init_vercel = __esm({
   "src/utils/dns/vercel.ts"() {
@@ -6122,6 +6243,68 @@ var init_vercel = __esm({
           };
         }
       }
+      /**
+       * Get all CAA records for the domain
+       */
+      async getCAARecords() {
+        const result = await this.request(
+          `/v4/domains/${this.domain}/records`
+        );
+        if (result.error || !result.records) {
+          return [];
+        }
+        return result.records.filter((r) => r.type === "CAA").map((r) => {
+          const match = r.value.match(/^(\d+)\s+(\w+)\s+"?([^"]+)"?$/);
+          if (match) {
+            return {
+              flags: Number.parseInt(match[1], 10),
+              tag: match[2],
+              value: match[3]
+            };
+          }
+          return null;
+        }).filter(
+          (r) => r !== null
+        );
+      }
+      /**
+       * Check if Amazon is allowed to issue certificates based on CAA records
+       * Returns true if:
+       * - No CAA records exist (any CA can issue)
+       * - CAA records exist and include amazon.com or amazontrust.com
+       */
+      async isAmazonCAAAllowed() {
+        const caaRecords = await this.getCAARecords();
+        const issueRecords = caaRecords.filter(
+          (r) => r.tag === "issue" || r.tag === "issuewild"
+        );
+        if (issueRecords.length === 0) {
+          return { allowed: true, hasCAA: false, existingCAs: [] };
+        }
+        const existingCAs = issueRecords.map((r) => r.value);
+        const amazonAllowed = existingCAs.some(
+          (ca) => ca.includes("amazon.com") || ca.includes("amazontrust.com")
+        );
+        return { allowed: amazonAllowed, hasCAA: true, existingCAs };
+      }
+      /**
+       * Add a CAA record to allow Amazon to issue certificates
+       */
+      async addAmazonCAARecord() {
+        const body = {
+          name: "@",
+          // Root domain
+          type: "CAA",
+          value: '0 issue "amazon.com"',
+          ttl: 1800
+        };
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records`,
+          "POST",
+          body
+        );
+        return !result.error;
+      }
       async verifyRecords(data) {
         const { domain, dkimTokens, mailFromDomain, region } = data;
         const missing = [];
@@ -6687,6 +6870,76 @@ var init_dns = __esm({
   }
 });
 
+// src/utils/dns/caa.ts
+var caa_exports = {};
+__export(caa_exports, {
+  ensureAmazonCAAAllowed: () => ensureAmazonCAAAllowed
+});
+async function ensureAmazonCAAAllowed(credentials, domain) {
+  if (credentials.provider === "manual" || credentials.provider === "route53") {
+    return { success: true, wasAlreadyAllowed: true, recordCreated: false };
+  }
+  try {
+    if (credentials.provider === "vercel") {
+      const { VercelDNSClient: VercelDNSClient2 } = await Promise.resolve().then(() => (init_vercel(), vercel_exports));
+      const client = new VercelDNSClient2(
+        domain,
+        credentials.token,
+        credentials.teamId
+      );
+      const caaStatus = await client.isAmazonCAAAllowed();
+      if (caaStatus.hasCAA && caaStatus.allowed) {
+        return { success: true, wasAlreadyAllowed: true, recordCreated: false };
+      }
+      const added = await client.addAmazonCAARecord();
+      if (added) {
+        return { success: true, wasAlreadyAllowed: false, recordCreated: true };
+      }
+      return {
+        success: false,
+        wasAlreadyAllowed: false,
+        recordCreated: false,
+        error: "Failed to create CAA record in Vercel DNS"
+      };
+    }
+    if (credentials.provider === "cloudflare") {
+      const { CloudflareDNSClient: CloudflareDNSClient2 } = await Promise.resolve().then(() => (init_cloudflare(), cloudflare_exports));
+      const client = new CloudflareDNSClient2(
+        credentials.zoneId,
+        credentials.token
+      );
+      const caaStatus = await client.isAmazonCAAAllowed();
+      if (caaStatus.allowed) {
+        return { success: true, wasAlreadyAllowed: true, recordCreated: false };
+      }
+      const added = await client.addAmazonCAARecord();
+      if (added) {
+        return { success: true, wasAlreadyAllowed: false, recordCreated: true };
+      }
+      return {
+        success: false,
+        wasAlreadyAllowed: false,
+        recordCreated: false,
+        error: "Failed to create CAA record in Cloudflare DNS"
+      };
+    }
+    return { success: true, wasAlreadyAllowed: true, recordCreated: false };
+  } catch (error) {
+    return {
+      success: false,
+      wasAlreadyAllowed: false,
+      recordCreated: false,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
+var init_caa = __esm({
+  "src/utils/dns/caa.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/utils/shared/assume-role.ts
 var assume_role_exports = {};
 __export(assume_role_exports, {
@@ -7016,6 +7269,7 @@ import pc49 from "picocolors";
 
 // src/commands/auth/login.ts
 init_esm_shims();
+init_events();
 init_config();
 import * as clack from "@clack/prompts";
 import { createAuthClient } from "better-auth/client";
@@ -7024,7 +7278,7 @@ import {
   organizationClient
 } from "better-auth/client/plugins";
 import open from "open";
-import pc from "picocolors";
+import pc2 from "picocolors";
 function createCliAuthClient(baseURL) {
   return createAuthClient({
     baseURL,
@@ -7052,6 +7306,7 @@ async function fetchOrganizations(baseURL, token) {
   }
 }
 async function login(options) {
+  const startTime = Date.now();
   if (options.token) {
     await saveAuthConfig({
       auth: {
@@ -7059,6 +7314,11 @@ async function login(options) {
         tokenType: "api-key"
       }
     });
+    trackCommand("auth:login", {
+      success: true,
+      duration_ms: Date.now() - startTime,
+      method: "api-key"
+    });
     if (options.json) {
       console.log(JSON.stringify({ success: true, tokenType: "api-key" }));
     } else {
@@ -7066,7 +7326,7 @@ async function login(options) {
     }
     return;
   }
-  clack.intro(pc.bold("Wraps \u203A Sign In"));
+  clack.intro(pc2.bold("Wraps \u203A Sign In"));
   const baseURL = process.env.WRAPS_API_URL || "https://app.wraps.dev";
   const authClient = createCliAuthClient(baseURL);
   const spinner8 = clack.spinner();
@@ -7074,6 +7334,8 @@ async function login(options) {
     client_id: "wraps-cli"
   });
   if (codeError || !codeData) {
+    trackCommand("auth:login", { success: false, duration_ms: Date.now() - startTime, method: "device" });
+    trackError("DEVICE_AUTH_FAILED", "auth:login", { step: "request_code" });
     clack.log.error("Failed to start device authorization.");
     process.exit(1);
   }
@@ -7085,8 +7347,8 @@ async function login(options) {
     expires_in
   } = codeData;
   const formatted = `${user_code.slice(0, 4)}-${user_code.slice(4)}`;
-  clack.log.info(`Your code:  ${pc.bold(pc.cyan(formatted))}`);
-  clack.log.info(`Visit: ${pc.underline(`${baseURL}/device`)}`);
+  clack.log.info(`Your code:  ${pc2.bold(pc2.cyan(formatted))}`);
+  clack.log.info(`Visit: ${pc2.underline(`${baseURL}/device`)}`);
   try {
     await open(`${baseURL}/device?user_code=${user_code}`);
     clack.log.info("Opening browser...");
@@ -7116,9 +7378,14 @@ async function login(options) {
           organizations: organizations.length > 0 ? organizations : void 0
         }
       });
+      trackCommand("auth:login", {
+        success: true,
+        duration_ms: Date.now() - startTime,
+        method: "device"
+      });
       clack.log.success("Signed in successfully.");
       if (organizations.length === 1) {
-        clack.log.info(`Organization: ${pc.cyan(organizations[0].name)}`);
+        clack.log.info(`Organization: ${pc2.cyan(organizations[0].name)}`);
       } else if (organizations.length > 1) {
         clack.log.info(`${organizations.length} organizations available`);
       }
@@ -7143,6 +7410,8 @@ async function login(options) {
         continue;
       }
       if (errorCode === "access_denied") {
+        trackCommand("auth:login", { success: false, duration_ms: Date.now() - startTime, method: "device" });
+        trackError("ACCESS_DENIED", "auth:login", { step: "poll_token" });
         spinner8.stop("Denied.");
         clack.log.error("Authorization was denied.");
         process.exit(1);
@@ -7152,6 +7421,8 @@ async function login(options) {
       }
     }
   }
+  trackCommand("auth:login", { success: false, duration_ms: Date.now() - startTime, method: "device" });
+  trackError("DEVICE_CODE_EXPIRED", "auth:login", { step: "poll_token" });
   spinner8.stop("Expired.");
   clack.log.error("Device code expired. Run `wraps auth login` to try again.");
   process.exit(1);
@@ -7159,32 +7430,37 @@ async function login(options) {
 
 // src/commands/auth/logout.ts
 init_esm_shims();
+init_events();
 init_config();
 import * as clack2 from "@clack/prompts";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 async function logout() {
-  clack2.intro(pc2.bold("Wraps \u203A Sign Out"));
+  clack2.intro(pc3.bold("Wraps \u203A Sign Out"));
   const config2 = await readAuthConfig();
   if (!config2?.auth?.token) {
+    trackCommand("auth:logout", { success: true, already_logged_out: true });
     clack2.log.info("Not signed in.");
     return;
   }
   await clearAuthConfig();
+  trackCommand("auth:logout", { success: true });
   clack2.log.success("Signed out. Token removed from ~/.wraps/config.json");
 }
 
 // src/commands/auth/status.ts
 init_esm_shims();
+init_events();
 init_config();
 import * as clack3 from "@clack/prompts";
-import pc3 from "picocolors";
+import pc4 from "picocolors";
 async function authStatus(options) {
   const config2 = await readAuthConfig();
   if (!config2?.auth?.token) {
+    trackCommand("auth:status", { success: true, authenticated: false });
     if (options.json) {
       console.log(JSON.stringify({ authenticated: false }));
     } else {
-      clack3.intro(pc3.bold("Wraps \u203A Auth Status"));
+      clack3.intro(pc4.bold("Wraps \u203A Auth Status"));
       clack3.log.info("Not signed in. Run `wraps auth login` to authenticate.");
     }
     return;
@@ -7201,16 +7477,18 @@ async function authStatus(options) {
       })
     );
   } else {
-    clack3.intro(pc3.bold("Wraps \u203A Auth Status"));
+    clack3.intro(pc4.bold("Wraps \u203A Auth Status"));
     clack3.log.info(`Token:   ${masked} (${tokenType})`);
     if (expiresAt) {
       clack3.log.info(`Expires: ${new Date(expiresAt).toLocaleDateString()}`);
     }
   }
+  trackCommand("auth:status", { success: true, authenticated: true });
 }
 
 // src/commands/aws/doctor.ts
 init_esm_shims();
+init_events();
 init_aws();
 init_aws_detection();
 import * as clack5 from "@clack/prompts";
@@ -7501,6 +7779,7 @@ function generateSuggestions(results, state) {
   return suggestions;
 }
 async function doctor() {
+  const startTime = Date.now();
   clack5.intro(pc6.bold("AWS Setup Diagnostics"));
   const spinner8 = clack5.spinner();
   spinner8.start("Running diagnostics...");
@@ -7528,6 +7807,13 @@ async function doctor() {
       console.log(`  ${pc6.dim("-")} ${suggestion}`);
     }
   }
+  trackCommand("aws:doctor", {
+    success: true,
+    duration_ms: Date.now() - startTime,
+    pass_count: passCount,
+    fail_count: failCount,
+    warn_count: warnCount
+  });
   console.log();
   clack5.outro(
     failCount > 0 ? pc6.dim("Run `wraps aws setup` to fix issues") : pc6.dim("Ready to deploy: wraps email init")
@@ -7536,6 +7822,7 @@ async function doctor() {
 
 // src/commands/aws/setup.ts
 init_esm_shims();
+init_events();
 init_aws_detection();
 init_prompts();
 import * as clack7 from "@clack/prompts";
@@ -8087,6 +8374,7 @@ function showNextSteps(_state) {
   console.log();
 }
 async function setup(_options = {}) {
+  const startTime = Date.now();
   clack7.intro(pc8.bold("AWS Setup Wizard"));
   const spinner8 = clack7.spinner();
   spinner8.start("Checking your AWS setup...");
@@ -8106,6 +8394,10 @@ async function setup(_options = {}) {
       await runCredentialSetup();
     }
   }
+  trackCommand("aws:setup", {
+    success: true,
+    duration_ms: Date.now() - startTime
+  });
   clack7.outro(pc8.dim("Run `wraps aws doctor` to verify your setup"));
 }
 
@@ -10753,10 +11045,10 @@ async function cdnSync(options) {
       });
       const stackOutputs = await checkStack.outputs();
       if (stackOutputs.acmCertificateArn?.value) {
-        const { ACMClient: ACMClient2, DescribeCertificateCommand: DescribeCertificateCommand2 } = await import("@aws-sdk/client-acm");
-        const acmClient = new ACMClient2({ region: "us-east-1" });
+        const { ACMClient: ACMClient3, DescribeCertificateCommand: DescribeCertificateCommand3 } = await import("@aws-sdk/client-acm");
+        const acmClient = new ACMClient3({ region: "us-east-1" });
         const certResponse = await acmClient.send(
-          new DescribeCertificateCommand2({
+          new DescribeCertificateCommand3({
             CertificateArn: stackOutputs.acmCertificateArn.value
           })
         );
@@ -10941,12 +11233,12 @@ Current configuration:
     process.exit(0);
   }
   progress.start("Checking certificate validation status");
-  const { ACMClient: ACMClient2, DescribeCertificateCommand: DescribeCertificateCommand2 } = await import("@aws-sdk/client-acm");
-  const acmClient = new ACMClient2({ region: "us-east-1" });
+  const { ACMClient: ACMClient3, DescribeCertificateCommand: DescribeCertificateCommand3 } = await import("@aws-sdk/client-acm");
+  const acmClient = new ACMClient3({ region: "us-east-1" });
   let certStatus;
   try {
     const certResponse = await acmClient.send(
-      new DescribeCertificateCommand2({
+      new DescribeCertificateCommand3({
         CertificateArn: stackOutputs.acmCertificateArn.value
       })
     );
@@ -11142,10 +11434,10 @@ async function checkDNSRecord(hostname, expectedValue) {
 }
 async function checkCertificateStatus(certificateArn) {
   try {
-    const { ACMClient: ACMClient2, DescribeCertificateCommand: DescribeCertificateCommand2 } = await import("@aws-sdk/client-acm");
-    const acm3 = new ACMClient2({ region: "us-east-1" });
+    const { ACMClient: ACMClient3, DescribeCertificateCommand: DescribeCertificateCommand3 } = await import("@aws-sdk/client-acm");
+    const acm3 = new ACMClient3({ region: "us-east-1" });
     const result = await acm3.send(
-      new DescribeCertificateCommand2({ CertificateArn: certificateArn })
+      new DescribeCertificateCommand3({ CertificateArn: certificateArn })
     );
     const cert = result.Certificate;
     const validationStatus = cert?.DomainValidationOptions?.[0]?.ValidationStatus;
@@ -15296,6 +15588,7 @@ async function deployEmailStack(config2) {
   });
   let cloudFrontResources;
   let acmResources;
+  let skipCloudFront = false;
   if (emailConfig.tracking?.enabled && emailConfig.tracking.customRedirectDomain && emailConfig.tracking.httpsEnabled) {
     const { findHostedZone: findHostedZone2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
     const hostedZone = await findHostedZone2(
@@ -15307,16 +15600,27 @@ async function deployEmailStack(config2) {
       domain: emailConfig.tracking.customRedirectDomain,
       hostedZoneId: hostedZone?.id
     });
-    const { createCloudFrontTracking: createCloudFrontTracking2 } = await Promise.resolve().then(() => (init_cloudfront(), cloudfront_exports));
-    const certificateArn = acmResources.certificateValidation ? acmResources.certificateValidation.certificateArn : acmResources.certificate.arn;
-    cloudFrontResources = await createCloudFrontTracking2({
-      customTrackingDomain: emailConfig.tracking.customRedirectDomain,
-      region: config2.region,
-      certificateArn,
-      hostedZoneId: hostedZone?.id,
-      // Pass hosted zone ID for automatic DNS record creation
-      wafEnabled: emailConfig.tracking.wafEnabled
-    });
+    if (!hostedZone) {
+      const { checkCertificateValidation: checkCertificateValidation2 } = await Promise.resolve().then(() => (init_acm(), acm_exports));
+      const isValidated = await checkCertificateValidation2(
+        emailConfig.tracking.customRedirectDomain
+      );
+      if (!isValidated) {
+        skipCloudFront = true;
+      }
+    }
+    if (!skipCloudFront) {
+      const { createCloudFrontTracking: createCloudFrontTracking2 } = await Promise.resolve().then(() => (init_cloudfront(), cloudfront_exports));
+      const certificateArn = acmResources.certificateValidation ? acmResources.certificateValidation.certificateArn : acmResources.certificate.arn;
+      cloudFrontResources = await createCloudFrontTracking2({
+        customTrackingDomain: emailConfig.tracking.customRedirectDomain,
+        region: config2.region,
+        certificateArn,
+        hostedZoneId: hostedZone?.id,
+        // Pass hosted zone ID for automatic DNS record creation
+        wafEnabled: emailConfig.tracking.wafEnabled
+      });
+    }
   }
   let sesResources;
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
@@ -15329,11 +15633,19 @@ async function deployEmailStack(config2) {
     if (!mailFromDomain && emailConfig.mailFromSubdomain && emailConfig.domain) {
       mailFromDomain = `${emailConfig.mailFromSubdomain}.${emailConfig.domain}`;
     }
+    const effectiveTrackingConfig = skipCloudFront && emailConfig.tracking ? {
+      enabled: emailConfig.tracking.enabled,
+      opens: emailConfig.tracking.opens,
+      clicks: emailConfig.tracking.clicks,
+      customRedirectDomain: emailConfig.tracking.customRedirectDomain,
+      httpsEnabled: false
+      // Use OPTIONAL until CloudFront is ready
+    } : emailConfig.tracking;
     sesResources = await createSESResources({
       domain: emailConfig.domain,
       mailFromDomain,
       region: config2.region,
-      trackingConfig: emailConfig.tracking,
+      trackingConfig: effectiveTrackingConfig,
       eventTypes: emailConfig.eventTracking?.events,
       eventTrackingEnabled: emailConfig.eventTracking?.enabled,
       // Pass flag to create EventBridge destination
@@ -15461,6 +15773,8 @@ async function deployEmailStack(config2) {
     dlqUrl: sqsResources?.dlq.url,
     customTrackingDomain: sesResources?.customTrackingDomain,
     httpsTrackingEnabled: emailConfig.tracking?.httpsEnabled,
+    httpsTrackingPending: skipCloudFront,
+    // True if HTTPS requested but cert not validated yet
     cloudFrontDomain: cloudFrontResources?.domainName,
     acmCertificateValidationRecords: acmResources?.validationRecords,
     mailFromDomain: sesResources?.mailFromDomain,
@@ -18987,6 +19301,7 @@ Run ${pc24.cyan("wraps email init")} to deploy email infrastructure.
 
 // src/commands/email/templates/init.ts
 init_esm_shims();
+init_events();
 init_config();
 init_errors();
 import { existsSync as existsSync7 } from "fs";
@@ -18995,6 +19310,7 @@ import { join as join8 } from "path";
 import * as clack24 from "@clack/prompts";
 import pc25 from "picocolors";
 async function templatesInit(options) {
+  const startTime = Date.now();
   const cwd = process.cwd();
   const wrapsDir = join8(cwd, "wraps");
   if (!options.json) {
@@ -19130,6 +19446,10 @@ wraps/.wraps/
     );
     return;
   }
+  trackCommand("email:templates:init", {
+    success: true,
+    duration_ms: Date.now() - startTime
+  });
   console.log();
   clack24.log.success(pc25.green("Templates as Code initialized!"));
   console.log();
@@ -19336,6 +19656,7 @@ const unsubscribeLink = {
 
 // src/commands/email/templates/preview.ts
 init_esm_shims();
+init_events();
 import { existsSync as existsSync9, watch } from "fs";
 import { join as join10 } from "path";
 import * as clack25 from "@clack/prompts";
@@ -19582,6 +19903,10 @@ async function templatesPreview(options) {
   const port = options.port || await getPort2({ port: [3333, 3334, 3335, 3336, 3337] });
   const server = app.listen(port, () => {
     const url = `http://localhost:${port}`;
+    trackCommand("email:templates:preview", {
+      success: true,
+      template_count: templateFiles.length
+    });
     clack25.log.success(`Preview server running at ${pc26.cyan(url)}`);
     if (options.template) {
       clack25.log.info(`Previewing: ${pc26.cyan(options.template)}`);
@@ -19781,6 +20106,7 @@ function renderErrorPage(err) {
 
 // src/commands/email/templates/push.ts
 init_esm_shims();
+init_events();
 import { createHash } from "crypto";
 import { existsSync as existsSync10 } from "fs";
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
@@ -19790,6 +20116,7 @@ import pc27 from "picocolors";
 init_config();
 init_errors();
 async function templatesPush(options) {
+  const startTime = Date.now();
   const cwd = process.cwd();
   const wrapsDir = join11(cwd, "wraps");
   const configPath = join11(wrapsDir, "wraps.config.ts");
@@ -19955,6 +20282,13 @@ async function templatesPush(options) {
     }
     console.log();
   }
+  trackCommand("email:templates:push", {
+    success: compileErrors.length === 0,
+    duration_ms: Date.now() - startTime,
+    pushed_count: compiled.length,
+    unchanged_count: unchanged.length,
+    error_count: compileErrors.length
+  });
 }
 async function compileTemplate(filePath, slug, source, sourceHash, wrapsDir) {
   const { build: build2 } = await import("esbuild");
@@ -21408,6 +21742,56 @@ ${pc28.bold("Cost Impact:")}`);
   const stackConfig = buildEmailStackConfig(metadata, region, {
     emailConfig: updatedConfig
   });
+  if (updatedConfig.tracking?.httpsEnabled && updatedConfig.tracking.customRedirectDomain) {
+    const trackingDomainParts = updatedConfig.tracking.customRedirectDomain.split(".");
+    const parentDomain = trackingDomainParts.length > 2 ? trackingDomainParts.slice(-2).join(".") : updatedConfig.tracking.customRedirectDomain;
+    let dnsProvider = metadata.services.email?.dnsProvider;
+    if (!dnsProvider) {
+      const availableProviders = await progress.execute(
+        "Detecting DNS provider for CAA check",
+        async () => await detectAvailableDNSProviders(parentDomain, region)
+      );
+      const detectedProvider = availableProviders.find(
+        (p) => p.detected && p.provider !== "manual"
+      );
+      if (detectedProvider) {
+        dnsProvider = detectedProvider.provider;
+        if (metadata.services.email) {
+          metadata.services.email.dnsProvider = dnsProvider;
+        }
+      }
+    }
+    if (dnsProvider && dnsProvider !== "manual" && dnsProvider !== "route53") {
+      const credResult = await getDNSCredentials(
+        dnsProvider,
+        parentDomain,
+        region
+      );
+      if (credResult.valid && credResult.credentials) {
+        const { ensureAmazonCAAAllowed: ensureAmazonCAAAllowed2 } = await Promise.resolve().then(() => (init_caa(), caa_exports));
+        const caaResult = await progress.execute(
+          "Checking CAA records for certificate issuance",
+          async () => await ensureAmazonCAAAllowed2(credResult.credentials, parentDomain)
+        );
+        if (caaResult.recordCreated) {
+          progress.info(
+            `Added CAA record to allow Amazon certificate issuance for ${pc28.cyan(parentDomain)}`
+          );
+          await new Promise((resolve) => setTimeout(resolve, 2e3));
+        } else if (!caaResult.success) {
+          clack27.log.warn(
+            `Could not verify CAA records: ${caaResult.error || "Unknown error"}`
+          );
+          clack27.log.info(
+            pc28.dim(
+              "If certificate issuance fails, you may need to add a CAA record manually:"
+            )
+          );
+          clack27.log.info(pc28.dim(`  ${parentDomain} CAA 0 issue "amazon.com"`));
+        }
+      }
+    }
+  }
   if (options.preview) {
     try {
       const previewResult = await progress.execute(
@@ -21508,6 +21892,7 @@ ${pc28.bold("Cost Impact:")}`);
                 dkimTokens: result.dkimTokens,
                 customTrackingDomain: result.customTrackingDomain,
                 httpsTrackingEnabled: result.httpsTrackingEnabled,
+                httpsTrackingPending: result.httpsTrackingPending,
                 cloudFrontDomain: result.cloudFrontDomain,
                 acmCertificateValidationRecords: result.acmCertificateValidationRecords,
                 archiveArn: result.archiveArn,
@@ -21549,6 +21934,7 @@ ${pc28.bold("Cost Impact:")}`);
           dkimTokens: pulumiOutputs.dkimTokens?.value,
           customTrackingDomain: pulumiOutputs.customTrackingDomain?.value,
           httpsTrackingEnabled: pulumiOutputs.httpsTrackingEnabled?.value,
+          httpsTrackingPending: pulumiOutputs.httpsTrackingPending?.value,
           cloudFrontDomain: pulumiOutputs.cloudFrontDomain?.value,
           acmCertificateValidationRecords: pulumiOutputs.acmCertificateValidationRecords?.value,
           archiveArn: pulumiOutputs.archiveArn?.value,
@@ -21703,14 +22089,92 @@ ${pc28.bold("Add these DNS records to your DNS provider:")}
   if (outputs.httpsTrackingEnabled && outputs.acmCertificateValidationRecords) {
     acmValidationRecords.push(...outputs.acmCertificateValidationRecords);
   }
-  const needsCertificateValidation = outputs.httpsTrackingEnabled && acmValidationRecords.length > 0 && !outputs.cloudFrontDomain;
+  let acmDnsAutoCreated = false;
+  if (outputs.httpsTrackingPending && acmValidationRecords.length > 0 && outputs.customTrackingDomain) {
+    const trackingDnsProvider = metadata.services.email?.dnsProvider;
+    if (trackingDnsProvider && trackingDnsProvider !== "manual") {
+      const trackingDomainParts = outputs.customTrackingDomain.split(".");
+      const parentDomain = trackingDomainParts.length > 2 ? trackingDomainParts.slice(-2).join(".") : outputs.customTrackingDomain;
+      const credResult = await progress.execute(
+        `Validating ${getDNSProviderDisplayName(trackingDnsProvider)} credentials for ACM validation`,
+        async () => await getDNSCredentials(trackingDnsProvider, parentDomain, region)
+      );
+      if (credResult.valid && credResult.credentials) {
+        try {
+          progress.start(
+            `Creating ACM validation DNS record in ${getDNSProviderDisplayName(trackingDnsProvider)}`
+          );
+          if (credResult.credentials.provider === "vercel") {
+            const { VercelDNSClient: VercelDNSClient2 } = await Promise.resolve().then(() => (init_vercel(), vercel_exports));
+            const client = new VercelDNSClient2(
+              parentDomain,
+              credResult.credentials.token,
+              credResult.credentials.teamId
+            );
+            const result = await client.createRecords(
+              acmValidationRecords.map((r) => ({
+                name: r.name,
+                type: r.type,
+                value: r.value
+              }))
+            );
+            if (result.success) {
+              progress.succeed(
+                `Created ACM validation DNS record in ${getDNSProviderDisplayName(trackingDnsProvider)}`
+              );
+              acmDnsAutoCreated = true;
+              progress.info(
+                "Certificate validation usually takes 5-30 minutes. Run this command again after validation completes."
+              );
+            } else {
+              progress.fail(
+                `Failed to create ACM validation record: ${result.errors?.join(", ")}`
+              );
+            }
+          } else if (credResult.credentials.provider === "cloudflare") {
+            const { CloudflareDNSClient: CloudflareDNSClient2 } = await Promise.resolve().then(() => (init_cloudflare(), cloudflare_exports));
+            const client = new CloudflareDNSClient2(
+              credResult.credentials.zoneId,
+              credResult.credentials.token
+            );
+            const result = await client.createRecords(
+              acmValidationRecords.map((r) => ({
+                name: r.name,
+                type: r.type,
+                value: r.value
+              }))
+            );
+            if (result.success) {
+              progress.succeed(
+                `Created ACM validation DNS record in ${getDNSProviderDisplayName(trackingDnsProvider)}`
+              );
+              acmDnsAutoCreated = true;
+              progress.info(
+                "Certificate validation usually takes 5-30 minutes. Run this command again after validation completes."
+              );
+            } else {
+              progress.fail(
+                `Failed to create ACM validation record: ${result.errors?.join(", ")}`
+              );
+            }
+          }
+        } catch (error) {
+          progress.fail(
+            `Failed to create ACM validation record: ${error.message}`
+          );
+        }
+      }
+    }
+  }
+  const needsCertificateValidation = outputs.httpsTrackingPending || outputs.httpsTrackingEnabled && acmValidationRecords.length > 0 && !outputs.cloudFrontDomain;
   displaySuccess({
     roleArn: outputs.roleArn,
     configSetName: outputs.configSetName,
     region: outputs.region,
     tableName: outputs.tableName,
     trackingDomainDnsRecords: trackingDomainDnsRecords.length > 0 ? trackingDomainDnsRecords : void 0,
-    acmValidationRecords: acmValidationRecords.length > 0 ? acmValidationRecords : void 0,
+    // Only show ACM validation records if they weren't auto-created
+    acmValidationRecords: acmValidationRecords.length > 0 && !acmDnsAutoCreated ? acmValidationRecords : void 0,
     customTrackingDomain: outputs.customTrackingDomain,
     httpsTrackingEnabled: outputs.httpsTrackingEnabled
   });
@@ -21730,16 +22194,27 @@ ${pc28.green("\u2713")} ${pc28.bold("Upgrade complete!")}
   }
   if (needsCertificateValidation) {
     console.log(pc28.bold("\u26A0\uFE0F  HTTPS Tracking - Next Steps:\n"));
-    console.log(
-      "  1. Add the SSL certificate validation DNS record shown above to your DNS provider"
-    );
-    console.log(
-      "  2. Wait for DNS propagation and certificate validation (5-30 minutes)"
-    );
-    console.log(
-      `  3. Run ${pc28.cyan("wraps email upgrade")} again to complete CloudFront setup
+    if (acmDnsAutoCreated) {
+      console.log(
+        `  1. ${pc28.green("\u2713")} ACM validation DNS record created automatically`
+      );
+      console.log("  2. Wait for certificate validation (5-30 minutes)");
+      console.log(
+        `  3. Run ${pc28.cyan("wraps email upgrade")} again to complete CloudFront setup
 `
-    );
+      );
+    } else {
+      console.log(
+        "  1. Add the SSL certificate validation DNS record shown above to your DNS provider"
+      );
+      console.log(
+        "  2. Wait for DNS propagation and certificate validation (5-30 minutes)"
+      );
+      console.log(
+        `  3. Run ${pc28.cyan("wraps email upgrade")} again to complete CloudFront setup
+`
+      );
+    }
     console.log(
       pc28.dim(
         "  Note: CloudFront distribution will be created once the certificate is validated.\n"
@@ -21835,6 +22310,7 @@ ${pc28.green("\u2713")} ${pc28.bold("Upgrade complete!")}
 
 // src/commands/email/workflows/push.ts
 init_esm_shims();
+init_events();
 import { existsSync as existsSync12 } from "fs";
 import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
 import { join as join13 } from "path";
@@ -22564,6 +23040,7 @@ function validateTemplateReferences(steps, localTemplateSlugs) {
 init_config();
 init_errors();
 async function workflowsPush(options) {
+  const startTime = Date.now();
   const cwd = process.cwd();
   const wrapsDir = join13(cwd, "wraps");
   const configPath = join13(wrapsDir, "wraps.config.ts");
@@ -22808,6 +23285,13 @@ async function workflowsPush(options) {
     }
     console.log();
   }
+  trackCommand("email:workflows:push", {
+    success: conflicts.length === 0 && pushed.length > 0,
+    duration_ms: Date.now() - startTime,
+    pushed_count: pushed.length,
+    unchanged_count: unchanged.length,
+    conflict_count: conflicts.length
+  });
 }
 async function pushToAPI2(workflows, token, _org, progress, force) {
   if (!token) {
@@ -22956,12 +23440,14 @@ async function saveLockfile2(path3, lockfile) {
 
 // src/commands/email/workflows/validate.ts
 init_esm_shims();
+init_events();
 import { existsSync as existsSync13 } from "fs";
 import { join as join14 } from "path";
 import * as clack29 from "@clack/prompts";
 import pc30 from "picocolors";
 init_errors();
 async function workflowsValidate(options) {
+  const startTime = Date.now();
   const cwd = process.cwd();
   const wrapsDir = join14(cwd, "wraps");
   const configPath = join14(wrapsDir, "wraps.config.ts");
@@ -23110,13 +23596,22 @@ async function workflowsValidate(options) {
     }
     console.log();
   }
+  trackCommand("email:workflows:validate", {
+    success: parseErrors.length === 0 && validationResults.every((r) => r.valid),
+    duration_ms: Date.now() - startTime,
+    valid_count: validationResults.filter((r) => r.valid).length,
+    invalid_count: validationResults.filter((r) => !r.valid).length,
+    parse_error_count: parseErrors.length
+  });
 }
 
 // src/commands/news.ts
 init_esm_shims();
+init_events();
 import * as clack30 from "@clack/prompts";
 import pc31 from "picocolors";
 async function news() {
+  trackCommand("news", { success: true });
   clack30.intro(pc31.bold("What's New in Wraps"));
   console.log();
   console.log("  See the latest updates, features, and improvements:");
@@ -24496,6 +24991,7 @@ async function platform() {
 
 // src/commands/platform/update-role.ts
 init_esm_shims();
+init_events();
 init_aws();
 init_metadata();
 import {
@@ -24506,6 +25002,7 @@ import {
 import { confirm as confirm13, intro as intro32, isCancel as isCancel19, log as log31, outro as outro19 } from "@clack/prompts";
 import pc35 from "picocolors";
 async function updateRole(options) {
+  const startTime = Date.now();
   intro32(pc35.bold("Update Platform Access Role"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -24633,6 +25130,11 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
   }
   progress.stop();
   const actionVerb = roleExists4 ? "updated" : "created";
+  trackCommand("platform:update-role", {
+    success: true,
+    duration_ms: Date.now() - startTime,
+    action: actionVerb
+  });
   outro19(pc35.green(`\u2713 Platform access role ${actionVerb} successfully`));
   console.log(`
 ${pc35.bold("Permissions:")}`);
@@ -27637,11 +28139,13 @@ async function dashboard(options) {
 
 // src/commands/shared/destroy.ts
 init_esm_shims();
+init_events();
 init_aws();
 init_metadata();
 import * as clack34 from "@clack/prompts";
 import pc37 from "picocolors";
 async function destroy(options) {
+  trackCommand("destroy", { success: true });
   clack34.intro(pc37.bold("Wraps Infrastructure Teardown"));
   const spinner8 = clack34.spinner();
   spinner8.start("Validating AWS credentials");
@@ -29712,6 +30216,7 @@ ${pc40.yellow(pc40.bold("Important Notes:"))}`);
 
 // src/commands/sms/register.ts
 init_esm_shims();
+init_events();
 init_aws();
 init_metadata();
 import * as clack38 from "@clack/prompts";
@@ -29753,6 +30258,7 @@ async function getRegistrationStatus(region, registrationId) {
   }
 }
 async function smsRegister(options) {
+  const startTime = Date.now();
   clack38.intro(pc41.bold("Wraps SMS - Toll-Free Registration"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -29871,6 +30377,10 @@ async function smsRegister(options) {
     console.log("When you're ready, go to:");
     console.log(`  ${pc41.cyan(consoleUrl)}`);
   }
+  trackCommand("sms:register", {
+    success: true,
+    duration_ms: Date.now() - startTime
+  });
   clack38.outro(pc41.dim("Good luck with your registration!"));
 }
 
@@ -31646,9 +32156,11 @@ Run ${pc46.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
 
 // src/commands/support.ts
 init_esm_shims();
+init_events();
 import * as clack44 from "@clack/prompts";
 import pc47 from "picocolors";
 async function support() {
+  trackCommand("support", { success: true });
   clack44.intro(pc47.bold("Get Help with Wraps"));
   console.log();
   console.log(`  ${pc47.bold("Email:")}   ${pc47.cyan("hey@wraps.sh")}`);