@wraps.dev/cli 2.11.5 → 2.11.7

package/dist/cli.js

@@ -1133,9 +1133,11 @@ var init_aws_detection = __esm({
 var errors_exports = {};
 __export(errors_exports, {
   WrapsError: () => WrapsError,
+  classifyDNSError: () => classifyDNSError,
   errors: () => errors,
   handleCLIError: () => handleCLIError,
   isAWSError: () => isAWSError,
+  isAWSNotFoundError: () => isAWSNotFoundError,
   isPulumiError: () => isPulumiError,
   parseAWSError: () => parseAWSError,
   parsePulumiError: () => parsePulumiError,
@@ -1162,6 +1164,23 @@ function isAWSError(error) {
   ];
   return awsErrorNames.includes(error.name) || "$metadata" in error;
 }
+function classifyDNSError(error) {
+  if (!(error instanceof Error)) {
+    return "unknown";
+  }
+  const code = error.code;
+  if (code === "ENOTFOUND" || code === "ENODATA") {
+    return "missing";
+  }
+  if (code === "ETIMEOUT" || code === "ESERVFAIL" || code === "ECONNREFUSED") {
+    return "network";
+  }
+  return "unknown";
+}
+function isAWSNotFoundError(error) {
+  if (!(error instanceof Error)) return false;
+  return error.name === "NotFoundException" || error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.name === "ResourceNotFoundException" || error.$metadata?.httpStatusCode === 404;
+}
 function isPulumiError(error) {
   if (!(error instanceof Error)) {
     return false;
@@ -4444,6 +4463,100 @@ var init_metadata = __esm({
   }
 });
 
+// src/infrastructure/shared/resource-checks.ts
+async function roleExists(roleName) {
+  try {
+    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam10 = new IAMClient4({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
+    await iam10.send(new GetRoleCommand3({ RoleName: roleName }));
+    return true;
+  } catch (error) {
+    if (error instanceof Error && (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity")) {
+      return false;
+    }
+    console.error("Error checking for existing IAM role:", error);
+    return false;
+  }
+}
+async function tableExists(tableName) {
+  try {
+    const { DynamoDBClient: DynamoDBClient6, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
+    const dynamodb3 = new DynamoDBClient6({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
+    await dynamodb3.send(new DescribeTableCommand2({ TableName: tableName }));
+    return true;
+  } catch (error) {
+    if (error instanceof Error && error.name === "ResourceNotFoundException") {
+      return false;
+    }
+    console.error("Error checking for existing DynamoDB table:", error);
+    return false;
+  }
+}
+async function sqsQueueExists(queueName) {
+  try {
+    const { SQSClient, GetQueueUrlCommand } = await import("@aws-sdk/client-sqs");
+    const sqs5 = new SQSClient({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
+    const response = await sqs5.send(
+      new GetQueueUrlCommand({ QueueName: queueName })
+    );
+    return response.QueueUrl || null;
+  } catch {
+    return null;
+  }
+}
+async function snsTopicExists(topicName) {
+  try {
+    const { SNSClient: SNSClient2, ListTopicsCommand: ListTopicsCommand2 } = await import("@aws-sdk/client-sns");
+    const sns3 = new SNSClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
+    let nextToken;
+    do {
+      const response = await sns3.send(
+        new ListTopicsCommand2({ NextToken: nextToken })
+      );
+      const found = response.Topics?.find(
+        (t) => t.TopicArn?.endsWith(`:${topicName}`)
+      );
+      if (found?.TopicArn) {
+        return found.TopicArn;
+      }
+      nextToken = response.NextToken;
+    } while (nextToken);
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function lambdaFunctionExists(functionName) {
+  try {
+    const { LambdaClient: LambdaClient2, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
+    const lambda4 = new LambdaClient2({
+      region: process.env.AWS_REGION || "us-east-1"
+    });
+    await lambda4.send(new GetFunctionCommand({ FunctionName: functionName }));
+    return true;
+  } catch (error) {
+    if (error instanceof Error && error.name === "ResourceNotFoundException") {
+      return false;
+    }
+    console.error("Error checking for existing Lambda function:", error);
+    return false;
+  }
+}
+var init_resource_checks = __esm({
+  "src/infrastructure/shared/resource-checks.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // ../core/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -4661,22 +4774,6 @@ function getPackageRoot() {
   }
   throw new Error("Could not find package.json");
 }
-async function lambdaFunctionExists(functionName) {
-  try {
-    const { LambdaClient: LambdaClient2, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
-    const lambda4 = new LambdaClient2({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await lambda4.send(new GetFunctionCommand({ FunctionName: functionName }));
-    return true;
-  } catch (error) {
-    if (error.name === "ResourceNotFoundException") {
-      return false;
-    }
-    console.error("Error checking for existing Lambda function:", error);
-    return false;
-  }
-}
 async function findEventSourceMapping(functionName, queueArn) {
   try {
     const { LambdaClient: LambdaClient2, ListEventSourceMappingsCommand } = await import("@aws-sdk/client-lambda");
@@ -4873,6 +4970,7 @@ var init_lambda = __esm({
   "src/infrastructure/resources/lambda.ts"() {
     "use strict";
     init_esm_shims();
+    init_resource_checks();
     nodeBuiltins = builtinModules.flatMap((m) => [m, `node:${m}`]);
   }
 });
@@ -9146,12 +9244,13 @@ async function cdnDestroy(options) {
       return;
     } catch (error) {
       progress.stop();
-      if (error.message.includes("No CDN infrastructure found")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("No CDN infrastructure found")) {
         clack9.log.warn("No CDN infrastructure found to preview");
         process.exit(0);
       }
       trackError("PREVIEW_FAILED", "storage destroy", { step: "preview" });
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   if (shouldCleanDNS && hostedZone && customDomain) {
@@ -9163,7 +9262,8 @@ async function cdnDestroy(options) {
         }
       );
     } catch (error) {
-      clack9.log.warn(`Could not delete DNS records: ${error.message}`);
+      const msg = error instanceof Error ? error.message : String(error);
+      clack9.log.warn(`Could not delete DNS records: ${msg}`);
       clack9.log.info("You may need to delete them manually from Route53");
     }
   }
@@ -9176,7 +9276,8 @@ async function cdnDestroy(options) {
       }
     );
   } catch (error) {
-    clack9.log.info(`Note: ${error.message}`);
+    const msg = error instanceof Error ? error.message : String(error);
+    clack9.log.info(`Note: ${msg}`);
   }
   try {
     await progress.execute(
@@ -9200,7 +9301,8 @@ async function cdnDestroy(options) {
     );
   } catch (error) {
     progress.stop();
-    if (error.message.includes("No CDN infrastructure found")) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg.includes("No CDN infrastructure found")) {
       clack9.log.warn("No CDN infrastructure found");
       if (metadata) {
         removeServiceFromConnection(metadata, "cdn");
@@ -9208,7 +9310,7 @@ async function cdnDestroy(options) {
       }
       process.exit(0);
     }
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "storage destroy", { step: "destroy" });
       throw errors.stackLocked();
     }
@@ -9647,6 +9749,9 @@ async function createCdnACMCertificate(config2) {
   };
 }
 
+// src/infrastructure/cdn-stack.ts
+init_resource_checks();
+
 // src/infrastructure/vercel-oidc.ts
 init_esm_shims();
 import * as aws2 from "@pulumi/aws";
@@ -9708,22 +9813,6 @@ async function createVercelOIDC(config2) {
 }
 
 // src/infrastructure/cdn-stack.ts
-async function roleExists(roleName) {
-  try {
-    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
-    const iam10 = new IAMClient4({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await iam10.send(new GetRoleCommand3({ RoleName: roleName }));
-    return true;
-  } catch (error) {
-    if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
-      return false;
-    }
-    console.error("Error checking for existing IAM role:", error);
-    return false;
-  }
-}
 async function createCdnIAMRole(config2) {
   let assumeRolePolicy;
   if (config2.provider === "vercel" && config2.oidcProvider) {
@@ -10492,10 +10581,11 @@ ${pc11.yellow(pc11.bold("Configuration Notes:"))}`);
       return;
     } catch (error) {
       trackError("PREVIEW_FAILED", "storage:init", { step: "preview" });
-      if (error.message?.includes("stack is currently locked")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   let outputs;
@@ -10559,18 +10649,19 @@ ${pc11.yellow(pc11.bold("Configuration Notes:"))}`);
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackServiceInit("cdn", false, {
       preset,
       provider,
       region,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "storage:init", { step: "deploy" });
       throw errors.stackLocked();
     }
     trackError("DEPLOYMENT_FAILED", "storage:init", { step: "deploy" });
-    throw new Error(`Pulumi deployment failed: ${error.message}`);
+    throw new Error(`Pulumi deployment failed: ${msg}`);
   }
   if (metadata.services.cdn) {
     metadata.services.cdn.pulumiStackName = `wraps-cdn-${identity.accountId}-${region}`;
@@ -10703,7 +10794,8 @@ ${pc11.yellow(pc11.bold("Configuration Notes:"))}`);
           }
         } catch (error) {
           progress.stop();
-          clack10.log.warn(`Could not manage DNS records: ${error.message}`);
+          const msg = error instanceof Error ? error.message : String(error);
+          clack10.log.warn(`Could not manage DNS records: ${msg}`);
         }
       }
     }
@@ -11127,13 +11219,14 @@ async function cdnSync(options) {
       return result.summary;
     });
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackCommand("storage:sync", {
       success: false,
-      error: error.message,
+      error: msg,
       region,
       duration_ms: Date.now() - startTime
     });
-    clack12.log.error(`Sync failed: ${error.message}`);
+    clack12.log.error(`Sync failed: ${msg}`);
     process.exit(1);
   }
   clack12.log.success(pc13.green("CDN infrastructure synced!"));
@@ -11257,7 +11350,8 @@ Current configuration:
     certStatus = certResponse.Certificate?.Status || "UNKNOWN";
   } catch (error) {
     progress.fail("Failed to check certificate status");
-    clack13.log.error(`Error: ${error.message}`);
+    const msg = error instanceof Error ? error.message : String(error);
+    clack13.log.error(`Error: ${msg}`);
     process.exit(1);
   }
   progress.stop();
@@ -11381,13 +11475,14 @@ Ready to add custom domain: ${pc14.cyan(pendingDomain)}`);
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackCommand("storage:upgrade", {
       success: false,
-      error: error.message,
+      error: msg,
       region,
       duration_ms: Date.now() - startTime
     });
-    clack13.log.error(`Upgrade failed: ${error.message}`);
+    clack13.log.error(`Upgrade failed: ${msg}`);
     process.exit(1);
   }
   if (metadata.services.cdn) {
@@ -14236,16 +14331,17 @@ async function check(options) {
     process.exit(getExitCode(result.score.grade));
   } catch (error) {
     spinner8?.stop("Check failed");
+    const msg = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      console.log(JSON.stringify({ error: error.message }));
+      console.log(JSON.stringify({ error: msg }));
     } else {
-      clack15.log.error(error.message);
+      clack15.log.error(msg);
     }
     const duration = Date.now() - startTime;
     trackCommand("email:check", {
       success: false,
       duration_ms: duration,
-      error: error.message
+      error: msg
     });
     process.exit(4);
   }
@@ -14855,23 +14951,8 @@ async function createAlertingResources(config2) {
 
 // src/infrastructure/resources/dynamodb.ts
 init_esm_shims();
+init_resource_checks();
 import * as aws5 from "@pulumi/aws";
-async function tableExists(tableName) {
-  try {
-    const { DynamoDBClient: DynamoDBClient6, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
-    const dynamodb3 = new DynamoDBClient6({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await dynamodb3.send(new DescribeTableCommand2({ TableName: tableName }));
-    return true;
-  } catch (error) {
-    if (error.name === "ResourceNotFoundException") {
-      return false;
-    }
-    console.error("Error checking for existing DynamoDB table:", error);
-    return false;
-  }
-}
 async function createDynamoDBTables(_config) {
   const tableName = "wraps-email-history";
   const exists = await tableExists(tableName);
@@ -15068,24 +15149,9 @@ async function createEventBridgeResources(config2) {
 
 // src/infrastructure/resources/iam.ts
 init_esm_shims();
+init_resource_checks();
 import * as aws7 from "@pulumi/aws";
 import * as pulumi10 from "@pulumi/pulumi";
-async function roleExists2(roleName) {
-  try {
-    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
-    const iam10 = new IAMClient4({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await iam10.send(new GetRoleCommand3({ RoleName: roleName }));
-    return true;
-  } catch (error) {
-    if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
-      return false;
-    }
-    console.error("Error checking for existing IAM role:", error);
-    return false;
-  }
-}
 async function createIAMRole(config2) {
   let assumeRolePolicy;
   if (config2.provider === "vercel" && config2.oidcProvider) {
@@ -15122,7 +15188,7 @@ async function createIAMRole(config2) {
     throw new Error("Other providers not yet implemented");
   }
   const roleName = "wraps-email-role";
-  const exists = await roleExists2(roleName);
+  const exists = await roleExists(roleName);
   const role = exists ? new aws7.iam.Role(
     roleName,
     {
@@ -15967,10 +16033,11 @@ ${pc17.bold("Current Configuration:")}
       return;
     } catch (error) {
       trackError("PREVIEW_FAILED", "email:config", { step: "preview" });
-      if (error.message?.includes("stack is currently locked")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   let outputs;
@@ -16028,16 +16095,17 @@ ${pc17.bold("Current Configuration:")}
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackCommand("email:config", {
       success: false,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "email:config", { step: "update" });
       throw errors.stackLocked();
     }
     trackError("UPDATE_FAILED", "email:config", { step: "update" });
-    throw new Error(`Pulumi update failed: ${error.message}`);
+    throw new Error(`Pulumi update failed: ${msg}`);
   }
   metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
   await saveConnectionMetadata(metadata);
@@ -16468,10 +16536,11 @@ async function connect2(options) {
       return;
     } catch (error) {
       trackError("PREVIEW_FAILED", "email:connect", { step: "preview" });
-      if (error.message?.includes("stack is currently locked")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   let outputs;
@@ -16527,17 +16596,18 @@ async function connect2(options) {
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackServiceInit("email", false, {
       preset,
       provider,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "email:connect", { step: "deploy" });
       throw errors.stackLocked();
     }
     trackError("DEPLOYMENT_FAILED", "email:connect", { step: "deploy" });
-    throw new Error(`Pulumi deployment failed: ${error.message}`);
+    throw new Error(`Pulumi deployment failed: ${msg}`);
   }
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
     const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
@@ -16556,9 +16626,8 @@ async function connect2(options) {
         );
         progress.succeed("DNS records created in Route53");
       } catch (error) {
-        progress.fail(
-          `Failed to create DNS records automatically: ${error.message}`
-        );
+        const msg = error instanceof Error ? error.message : String(error);
+        progress.fail(`Failed to create DNS records automatically: ${msg}`);
         progress.info(
           "You can manually add the required DNS records shown below"
         );
@@ -16687,8 +16756,11 @@ async function getEmailIdentityInfo(domain, region) {
       dkimTokens: response.DkimAttributes?.Tokens || [],
       mailFromDomain: response.MailFromAttributes?.MailFromDomain
     };
-  } catch (_error) {
-    return { dkimTokens: [] };
+  } catch (error) {
+    if (isAWSError(error)) {
+      return { dkimTokens: [] };
+    }
+    throw error;
   }
 }
 async function emailDestroy(options) {
@@ -16783,7 +16855,7 @@ async function emailDestroy(options) {
               stackName,
               workDir: getPulumiWorkDir()
             });
-          } catch (_error) {
+          } catch {
             throw new Error("No email infrastructure found to preview");
           }
           const result = await previewWithResourceChanges(stack, {
@@ -16817,12 +16889,13 @@ async function emailDestroy(options) {
       return;
     } catch (error) {
       progress.stop();
-      if (error.message.includes("No email infrastructure found")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("No email infrastructure found")) {
         clack18.log.warn("No email infrastructure found to preview");
         process.exit(0);
       }
       trackError("PREVIEW_FAILED", "email destroy", { step: "preview" });
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   if (shouldCleanDNS && hostedZone && domain && dkimTokens.length > 0) {
@@ -16838,7 +16911,8 @@ async function emailDestroy(options) {
         );
       });
     } catch (error) {
-      clack18.log.warn(`Could not delete DNS records: ${error.message}`);
+      const msg = error instanceof Error ? error.message : String(error);
+      clack18.log.warn(`Could not delete DNS records: ${msg}`);
       clack18.log.info("You may need to delete them manually from Route53");
     }
   }
@@ -16854,7 +16928,7 @@ async function emailDestroy(options) {
             stackName,
             workDir: getPulumiWorkDir()
           });
-        } catch (_error) {
+        } catch {
           throw new Error("No email infrastructure found to destroy");
         }
         await withTimeout(
@@ -16869,12 +16943,13 @@ async function emailDestroy(options) {
     );
   } catch (error) {
     progress.stop();
-    if (error.message.includes("No email infrastructure found")) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg.includes("No email infrastructure found")) {
       clack18.log.warn("No email infrastructure found");
       await deleteConnectionMetadata(identity.accountId, region);
       process.exit(0);
     }
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "email destroy", { step: "destroy" });
       throw errors.stackLocked();
     }
@@ -16919,6 +16994,7 @@ init_client();
 init_events();
 init_dns();
 init_aws();
+init_errors();
 init_metadata();
 import { Resolver as Resolver2 } from "dns/promises";
 import { GetEmailIdentityCommand as GetEmailIdentityCommand2, SESv2Client as SESv2Client3 } from "@aws-sdk/client-sesv2";
@@ -16945,16 +17021,19 @@ async function verifyDomain(options) {
     );
     dkimTokens = identity.DkimAttributes?.Tokens || [];
     mailFromDomain = identity.MailFromAttributes?.MailFromDomain;
-  } catch (_error) {
-    progress.stop();
-    clack19.log.error(`Domain ${options.domain} not found in SES`);
-    console.log(
-      `
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      progress.stop();
+      clack19.log.error(`Domain ${options.domain} not found in SES`);
+      console.log(
+        `
 Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this domain.
 `
-    );
-    process.exit(1);
-    return;
+      );
+      process.exit(1);
+      return;
+    }
+    throw error;
   }
   const resolver = new Resolver2();
   resolver.setServers(["8.8.8.8", "1.1.1.1"]);
@@ -16971,12 +17050,24 @@ Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this doma
         status: found ? "verified" : "incorrect",
         records
       });
-    } catch (_error) {
-      dnsResults.push({
-        name: dkimRecord,
-        type: "CNAME",
-        status: "missing"
-      });
+    } catch (error) {
+      const dnsClass = classifyDNSError(error);
+      if (dnsClass === "missing") {
+        dnsResults.push({
+          name: dkimRecord,
+          type: "CNAME",
+          status: "missing"
+        });
+      } else if (dnsClass === "network") {
+        dnsResults.push({
+          name: dkimRecord,
+          type: "CNAME",
+          status: "missing",
+          records: ["DNS lookup failed (network issue)"]
+        });
+      } else {
+        throw error;
+      }
     }
   }
   try {
@@ -16989,12 +17080,24 @@ Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this doma
       status: hasAmazonSES ? "verified" : spfRecord ? "incorrect" : "missing",
       records: spfRecord ? [spfRecord] : void 0
     });
-  } catch (_error) {
-    dnsResults.push({
-      name: options.domain,
-      type: "TXT (SPF)",
-      status: "missing"
-    });
+  } catch (error) {
+    const dnsClass = classifyDNSError(error);
+    if (dnsClass === "missing") {
+      dnsResults.push({
+        name: options.domain,
+        type: "TXT (SPF)",
+        status: "missing"
+      });
+    } else if (dnsClass === "network") {
+      dnsResults.push({
+        name: options.domain,
+        type: "TXT (SPF)",
+        status: "missing",
+        records: ["DNS lookup failed (network issue)"]
+      });
+    } else {
+      throw error;
+    }
   }
   try {
     const records = await resolver.resolveTxt(`_dmarc.${options.domain}`);
@@ -17005,12 +17108,24 @@ Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this doma
       status: dmarcRecord ? "verified" : "missing",
       records: dmarcRecord ? [dmarcRecord] : void 0
     });
-  } catch (_error) {
-    dnsResults.push({
-      name: `_dmarc.${options.domain}`,
-      type: "TXT (DMARC)",
-      status: "missing"
-    });
+  } catch (error) {
+    const dnsClass = classifyDNSError(error);
+    if (dnsClass === "missing") {
+      dnsResults.push({
+        name: `_dmarc.${options.domain}`,
+        type: "TXT (DMARC)",
+        status: "missing"
+      });
+    } else if (dnsClass === "network") {
+      dnsResults.push({
+        name: `_dmarc.${options.domain}`,
+        type: "TXT (DMARC)",
+        status: "missing",
+        records: ["DNS lookup failed (network issue)"]
+      });
+    } else {
+      throw error;
+    }
   }
   if (mailFromDomain) {
     try {
@@ -17025,12 +17140,24 @@ Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this doma
         status: hasMx ? "verified" : mxRecords.length > 0 ? "incorrect" : "missing",
         records: mxRecords.map((r) => `${r.priority} ${r.exchange}`)
       });
-    } catch (_error) {
-      dnsResults.push({
-        name: mailFromDomain,
-        type: "MX",
-        status: "missing"
-      });
+    } catch (error) {
+      const dnsClass = classifyDNSError(error);
+      if (dnsClass === "missing") {
+        dnsResults.push({
+          name: mailFromDomain,
+          type: "MX",
+          status: "missing"
+        });
+      } else if (dnsClass === "network") {
+        dnsResults.push({
+          name: mailFromDomain,
+          type: "MX",
+          status: "missing",
+          records: ["DNS lookup failed (network issue)"]
+        });
+      } else {
+        throw error;
+      }
     }
     try {
       const records = await resolver.resolveTxt(mailFromDomain);
@@ -17042,12 +17169,24 @@ Run ${pc20.cyan(`wraps email init --domain ${options.domain}`)} to add this doma
         status: hasAmazonSES ? "verified" : spfRecord ? "incorrect" : "missing",
         records: spfRecord ? [spfRecord] : void 0
       });
-    } catch (_error) {
-      dnsResults.push({
-        name: mailFromDomain,
-        type: "TXT (SPF)",
-        status: "missing"
-      });
+    } catch (error) {
+      const dnsClass = classifyDNSError(error);
+      if (dnsClass === "missing") {
+        dnsResults.push({
+          name: mailFromDomain,
+          type: "TXT (SPF)",
+          status: "missing"
+        });
+      } else if (dnsClass === "network") {
+        dnsResults.push({
+          name: mailFromDomain,
+          type: "TXT (SPF)",
+          status: "missing",
+          records: ["DNS lookup failed (network issue)"]
+        });
+      } else {
+        throw error;
+      }
     }
   }
   progress.stop();
@@ -17189,7 +17328,7 @@ Run ${pc20.cyan(`wraps email domains verify --domain ${domain}`)} to check verif
       );
       return;
     } catch (error) {
-      if (error.name !== "NotFoundException") {
+      if (!isAWSNotFoundError(error)) {
         throw error;
       }
     }
@@ -17502,7 +17641,7 @@ ${pc20.bold("DNS Records to add:")}
   } catch (error) {
     progress.stop();
     trackCommand("email:domains:get-dkim", { success: false });
-    if (error.name === "NotFoundException") {
+    if (isAWSNotFoundError(error)) {
       clack19.log.error(`Domain ${options.domain} not found in SES`);
       console.log(
         `
@@ -17583,7 +17722,7 @@ Use ${pc20.cyan(`wraps email domains remove --domain ${options.domain} --force`)
   } catch (error) {
     progress.stop();
     trackCommand("email:domains:remove", { success: false });
-    if (error.name === "NotFoundException") {
+    if (isAWSNotFoundError(error)) {
       clack19.log.error(`Domain ${options.domain} not found in SES`);
       process.exit(1);
       return;
@@ -18682,10 +18821,11 @@ ${pc22.yellow(pc22.bold("Configuration Warnings:"))}`);
       return;
     } catch (error) {
       trackError("PREVIEW_FAILED", "email:init", { step: "preview" });
-      if (error.message?.includes("stack is currently locked")) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (msg.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   let outputs;
@@ -18756,13 +18896,14 @@ ${pc22.yellow(pc22.bold("Configuration Warnings:"))}`);
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackServiceInit("email", false, {
       preset,
       provider,
       region,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "email:init", { step: "deploy" });
       throw errors.stackLocked();
     }
@@ -18793,7 +18934,7 @@ ${pc22.yellow(pc22.bold("Configuration Warnings:"))}`);
       }
     }
     trackError("DEPLOYMENT_FAILED", "email:init", { step: "deploy" });
-    throw new Error(`Pulumi deployment failed: ${error.message}`);
+    throw new Error(`Pulumi deployment failed: ${msg}`);
   }
   if (metadata.services.email) {
     metadata.services.email.pulumiStackName = `wraps-${identity.accountId}-${region}`;
@@ -18891,7 +19032,8 @@ ${pc22.yellow(pc22.bold("Configuration Warnings:"))}`);
             }
           } catch (error) {
             progress.stop();
-            clack21.log.warn(`Could not manage DNS records: ${error.message}`);
+            const msg = error instanceof Error ? error.message : String(error);
+            clack21.log.warn(`Could not manage DNS records: ${msg}`);
           }
         } else {
           const recordData = {
@@ -19126,7 +19268,8 @@ ${pc23.bold("The following Wraps resources will be removed:")}
         return;
       } catch (error) {
         trackError("PREVIEW_FAILED", "email:restore", { step: "preview" });
-        throw new Error(`Preview failed: ${error.message}`);
+        const msg = error instanceof Error ? error.message : String(error);
+        throw new Error(`Preview failed: ${msg}`);
       }
     }
     return;
@@ -19161,7 +19304,8 @@ ${pc23.bold("The following Wraps resources will be removed:")}
         );
       } catch (error) {
         trackError("DESTROY_FAILED", "email:restore", { step: "destroy" });
-        throw new Error(`Failed to destroy Pulumi stack: ${error.message}`);
+        const msg = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to destroy Pulumi stack: ${msg}`);
       }
     });
   }
@@ -19188,6 +19332,7 @@ init_esm_shims();
 init_client();
 init_events();
 init_aws();
+init_errors();
 init_fs();
 init_metadata();
 import * as clack23 from "@clack/prompts";
@@ -19232,15 +19377,19 @@ async function emailStatus(options) {
       workDir: getPulumiWorkDir()
     });
     stackOutputs = await stack.outputs();
-  } catch (_error) {
-    progress.stop();
-    clack23.log.error("No email infrastructure found");
-    console.log(
-      `
+  } catch (error) {
+    if (error instanceof Error && (error.message.includes("no stack named") || error.message.includes("not found"))) {
+      progress.stop();
+      clack23.log.error("No email infrastructure found");
+      console.log(
+        `
 Run ${pc24.cyan("wraps email init")} to deploy email infrastructure.
 `
-    );
-    process.exit(1);
+      );
+      process.exit(1);
+      return;
+    }
+    throw error;
   }
   const domains = await listSESDomains(region);
   const { SESv2Client: SESv2Client6, GetEmailIdentityCommand: GetEmailIdentityCommand5 } = await import("@aws-sdk/client-sesv2");
@@ -19265,17 +19414,20 @@ Run ${pc24.cyan("wraps email init")} to deploy email infrastructure.
           isPrimary: tracked?.isPrimary,
           purpose: tracked?.purpose
         };
-      } catch (_error) {
-        return {
-          domain: d.domain,
-          status: d.verified ? "verified" : "pending",
-          dkimTokens: void 0,
-          mailFromDomain: void 0,
-          mailFromStatus: void 0,
-          managed: tracked?.managed,
-          isPrimary: tracked?.isPrimary,
-          purpose: tracked?.purpose
-        };
+      } catch (error) {
+        if (isAWSError(error)) {
+          return {
+            domain: d.domain,
+            status: d.verified ? "verified" : "pending",
+            dkimTokens: void 0,
+            mailFromDomain: void 0,
+            mailFromStatus: void 0,
+            managed: tracked?.managed,
+            isPrimary: tracked?.isPrimary,
+            purpose: tracked?.purpose
+          };
+        }
+        throw error;
       }
     })
   );
@@ -20069,7 +20221,7 @@ function renderViewerPage(compiled, allSlugs) {
       try {
         const doc = iframe.contentDocument || iframe.contentWindow.document;
         iframe.style.height = doc.documentElement.scrollHeight + 'px';
-      } catch {}
+      } catch {} // guardrail:allow-swallowed-error \u2014 cross-origin iframe resize
     }
     iframe.addEventListener('load', resizeIframe);
 
@@ -20080,7 +20232,7 @@ function renderViewerPage(compiled, allSlugs) {
         const data = JSON.parse(e.data);
         // Reload iframe (and toolbar metadata by reloading the page)
         iframe.src = '/${compiled.slug}/render?t=' + Date.now();
-      } catch {
+      } catch { // guardrail:allow-swallowed-error \u2014 SSE parse error is expected
         // "connected" message or parse error \u2014 ignore
       }
     };
@@ -21899,11 +22051,12 @@ ${pc28.bold("Cost Impact:")}`);
       });
       return;
     } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
       trackError("PREVIEW_FAILED", "email:upgrade", { step: "preview" });
-      if (error.message?.includes("stack is currently locked")) {
+      if (msg.includes("stack is currently locked")) {
         throw errors.stackLocked();
       }
-      throw new Error(`Preview failed: ${error.message}`);
+      throw new Error(`Preview failed: ${msg}`);
     }
   }
   let outputs;
@@ -21985,18 +22138,19 @@ ${pc28.bold("Cost Impact:")}`);
       }
     );
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackServiceUpgrade("email", {
       from_preset: metadata.services.email?.preset,
       to_preset: newPreset,
       action: typeof upgradeAction === "string" ? upgradeAction : void 0,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "email:upgrade", { step: "deploy" });
       throw errors.stackLocked();
     }
     trackError("UPGRADE_FAILED", "email:upgrade", { step: "deploy" });
-    throw new Error(`Pulumi upgrade failed: ${error.message}`);
+    throw new Error(`Pulumi upgrade failed: ${msg}`);
   }
   let dnsAutoCreated = false;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
@@ -22054,9 +22208,8 @@ ${pc28.bold("Cost Impact:")}`);
             );
           }
         } catch (error) {
-          progress.fail(
-            `Failed to create DNS records automatically: ${error.message}`
-          );
+          const msg = error instanceof Error ? error.message : String(error);
+          progress.fail(`Failed to create DNS records automatically: ${msg}`);
           progress.info(
             "You can manually add the required DNS records shown below"
           );
@@ -22195,9 +22348,8 @@ ${pc28.bold("Add these DNS records to your DNS provider:")}
             }
           }
         } catch (error) {
-          progress.fail(
-            `Failed to create ACM validation record: ${error.message}`
-          );
+          const msg = error instanceof Error ? error.message : String(error);
+          progress.fail(`Failed to create ACM validation record: ${msg}`);
         }
       }
     }
@@ -24423,10 +24575,10 @@ var WRAPS_PLATFORM_ACCOUNT_ID = "905130073023";
 async function updatePlatformRole(metadata, progress, externalId) {
   const roleName = "wraps-console-access-role";
   const iam10 = new IAMClient2({ region: "us-east-1" });
-  let roleExists4 = false;
+  let roleExists2 = false;
   try {
     await iam10.send(new GetRoleCommand({ RoleName: roleName }));
-    roleExists4 = true;
+    roleExists2 = true;
   } catch (error) {
     const isNotFound = error instanceof Error && (error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.message.includes("NoSuchEntity"));
     if (!isNotFound) {
@@ -24436,7 +24588,7 @@ async function updatePlatformRole(metadata, progress, externalId) {
   const emailConfig = metadata.services.email?.config;
   const smsConfig = metadata.services.sms?.config;
   const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
-  if (roleExists4) {
+  if (roleExists2) {
     await progress.execute("Updating platform access role", async () => {
       await iam10.send(
         new PutRolePolicyCommand({
@@ -24894,17 +25046,17 @@ Run ${pc33.cyan("wraps email init")} or ${pc33.cyan("wraps sms init")} first.
     }
     const roleName = "wraps-console-access-role";
     const iam10 = new IAMClient2({ region: "us-east-1" });
-    let roleExists4 = false;
+    let roleExists2 = false;
     try {
       await iam10.send(new GetRoleCommand({ RoleName: roleName }));
-      roleExists4 = true;
+      roleExists2 = true;
     } catch (error) {
       const isNotFound = error instanceof Error && (error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.message.includes("NoSuchEntity"));
       if (!isNotFound) {
         throw error;
       }
     }
-    if (roleExists4) {
+    if (roleExists2) {
       const emailConfig = metadata.services.email?.config;
       const smsConfig = metadata.services.sms?.config;
       const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
@@ -25061,10 +25213,10 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
   }
   const roleName = "wraps-console-access-role";
   const iam10 = new IAMClient3({ region: "us-east-1" });
-  let roleExists4 = false;
+  let roleExists2 = false;
   try {
     await iam10.send(new GetRoleCommand2({ RoleName: roleName }));
-    roleExists4 = true;
+    roleExists2 = true;
   } catch (error) {
     const isNotFound = error instanceof Error && (error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.message.includes("NoSuchEntity"));
     if (!isNotFound) {
@@ -25072,7 +25224,7 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
     }
   }
   const externalId = metadata.platform?.externalId;
-  if (!(roleExists4 || externalId)) {
+  if (!(roleExists2 || externalId)) {
     progress.stop();
     log31.warn(`IAM role ${pc35.cyan(roleName)} does not exist`);
     console.log(
@@ -25084,7 +25236,7 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
     );
     process.exit(0);
   }
-  if (roleExists4) {
+  if (roleExists2) {
     progress.info(`Found IAM role: ${pc35.cyan(roleName)}`);
   } else {
     progress.info(
@@ -25093,7 +25245,7 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
   }
   if (!options.force) {
     progress.stop();
-    const actionLabel = roleExists4 ? "Update" : "Create";
+    const actionLabel = roleExists2 ? "Update" : "Create";
     const shouldContinue = await confirm13({
       message: `${actionLabel} IAM role ${pc35.cyan(roleName)} with latest permissions?`,
       initialValue: true
@@ -25112,7 +25264,7 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
   const smsEnabled = !!smsConfig;
   const smsSendingEnabled = smsConfig && smsConfig.sendingEnabled !== false;
   const smsEventTracking = smsConfig?.eventTracking;
-  if (!roleExists4 && externalId) {
+  if (!roleExists2 && externalId) {
     const WRAPS_PLATFORM_ACCOUNT_ID2 = "905130073023";
     await progress.execute("Creating IAM role", async () => {
       const trustPolicy = {
@@ -25165,7 +25317,7 @@ Run ${pc35.cyan("wraps email init")} to deploy infrastructure first.
     });
   }
   progress.stop();
-  const actionVerb = roleExists4 ? "updated" : "created";
+  const actionVerb = roleExists2 ? "updated" : "created";
   trackCommand("platform:update-role", {
     success: true,
     duration_ms: Date.now() - startTime,
@@ -28349,38 +28501,9 @@ import pc39 from "picocolors";
 
 // src/infrastructure/sms-stack.ts
 init_esm_shims();
+init_resource_checks();
 import * as aws19 from "@pulumi/aws";
 import * as pulumi24 from "@pulumi/pulumi";
-async function roleExists3(roleName) {
-  try {
-    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
-    const iam10 = new IAMClient4({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await iam10.send(new GetRoleCommand3({ RoleName: roleName }));
-    return true;
-  } catch (error) {
-    if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
-      return false;
-    }
-    return false;
-  }
-}
-async function tableExists2(tableName) {
-  try {
-    const { DynamoDBClient: DynamoDBClient6, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
-    const dynamodb3 = new DynamoDBClient6({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    await dynamodb3.send(new DescribeTableCommand2({ TableName: tableName }));
-    return true;
-  } catch (error) {
-    if (error instanceof Error && "name" in error && error.name === "ResourceNotFoundException") {
-      return false;
-    }
-    return false;
-  }
-}
 async function createSMSIAMRole(config2) {
   let assumeRolePolicy;
   if (config2.provider === "vercel" && config2.oidcProvider) {
@@ -28426,7 +28549,7 @@ async function createSMSIAMRole(config2) {
     throw new Error("Other providers not yet implemented");
   }
   const roleName = "wraps-sms-role";
-  const exists = await roleExists3(roleName);
+  const exists = await roleExists(roleName);
   const role = exists ? new aws19.iam.Role(
     roleName,
     {
@@ -28644,20 +28767,6 @@ async function createSMSPhoneNumber(phoneNumberType, optOutList) {
     }
   );
 }
-async function sqsQueueExists(queueName) {
-  try {
-    const { SQSClient, GetQueueUrlCommand } = await import("@aws-sdk/client-sqs");
-    const sqs5 = new SQSClient({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    const response = await sqs5.send(
-      new GetQueueUrlCommand({ QueueName: queueName })
-    );
-    return response.QueueUrl || null;
-  } catch {
-    return null;
-  }
-}
 async function createSMSSQSResources() {
   const dlqName = "wraps-sms-events-dlq";
   const queueName = "wraps-sms-events";
@@ -28707,30 +28816,6 @@ async function createSMSSQSResources() {
   });
   return { queue, dlq };
 }
-async function snsTopicExists(topicName) {
-  try {
-    const { SNSClient: SNSClient2, ListTopicsCommand: ListTopicsCommand2 } = await import("@aws-sdk/client-sns");
-    const sns3 = new SNSClient2({
-      region: process.env.AWS_REGION || "us-east-1"
-    });
-    let nextToken;
-    do {
-      const response = await sns3.send(
-        new ListTopicsCommand2({ NextToken: nextToken })
-      );
-      const found = response.Topics?.find(
-        (t) => t.TopicArn?.endsWith(`:${topicName}`)
-      );
-      if (found?.TopicArn) {
-        return found.TopicArn;
-      }
-      nextToken = response.NextToken;
-    } while (nextToken);
-    return null;
-  } catch {
-    return null;
-  }
-}
 async function createSMSSNSResources(config2) {
   const topicName = "wraps-sms-events";
   const topicArn = await snsTopicExists(topicName);
@@ -28798,7 +28883,7 @@ async function createSMSSNSResources(config2) {
 }
 async function createSMSDynamoDBTable() {
   const tableName = "wraps-sms-history";
-  const exists = await tableExists2(tableName);
+  const exists = await tableExists(tableName);
   const tableConfig = {
     name: tableName,
     billingMode: "PAY_PER_REQUEST",
@@ -31734,18 +31819,19 @@ ${pc45.bold("Cost Impact:")}`);
       });
     }
   } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     trackServiceUpgrade("sms", {
       from_preset: metadata.services.sms?.preset,
       to_preset: newPreset,
       action: typeof upgradeAction === "string" ? upgradeAction : void 0,
       duration_ms: Date.now() - startTime
     });
-    if (error.message?.includes("stack is currently locked")) {
+    if (msg.includes("stack is currently locked")) {
       trackError("STACK_LOCKED", "sms:upgrade", { step: "deploy" });
       throw errors.stackLocked();
     }
     trackError("UPGRADE_FAILED", "sms:upgrade", { step: "deploy" });
-    throw new Error(`SMS upgrade failed: ${error.message}`);
+    throw new Error(`SMS upgrade failed: ${msg}`);
   }
   updateServiceConfig(metadata, "sms", updatedConfig);
   if (metadata.services.sms) {