@wraps.dev/cli 2.12.0 → 2.12.1

package/dist/cli.js

@@ -69,6 +69,7 @@ var init_ci_detection = __esm({
 // src/utils/shared/s3-state.ts
 var s3_state_exports = {};
 __export(s3_state_exports, {
+  deleteMetadata: () => deleteMetadata,
   downloadMetadata: () => downloadMetadata,
   ensureStateBucket: () => ensureStateBucket,
   getS3BackendUrl: () => getS3BackendUrl,
@@ -188,6 +189,17 @@ async function uploadMetadata(bucketName, metadata) {
     })
   );
 }
+async function deleteMetadata(bucketName, accountId, region) {
+  const { S3Client: S3Client2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const key = `metadata/${accountId}-${region}.json`;
+  await client.send(
+    new DeleteObjectCommand({
+      Bucket: bucketName,
+      Key: key
+    })
+  );
+}
 async function downloadMetadata(bucketName, accountId, region) {
   const { S3Client: S3Client2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
   const client = new S3Client2({ region });
@@ -4156,6 +4168,17 @@ async function deleteConnectionMetadata(accountId, region) {
     const { unlink } = await import("fs/promises");
     await unlink(metadataPath);
   }
+  if (process.env.WRAPS_LOCAL_ONLY !== "1") {
+    try {
+      const { stateBucketExists: stateBucketExists2, deleteMetadata: deleteMetadata2, getStateBucketName: getStateBucketName2 } = await Promise.resolve().then(() => (init_s3_state(), s3_state_exports));
+      const bucketExists = await stateBucketExists2(accountId, region);
+      if (bucketExists) {
+        const bucketName = getStateBucketName2(accountId, region);
+        await deleteMetadata2(bucketName, accountId, region);
+      }
+    } catch {
+    }
+  }
 }
 async function listConnections() {
   const connectionsDir = getConnectionsDir();
@@ -7631,7 +7654,11 @@ var test_exports = {};
 __export(test_exports, {
   emailTest: () => emailTest
 });
-import { SESv2Client as SESv2Client5, SendEmailCommand } from "@aws-sdk/client-sesv2";
+import {
+  GetEmailIdentityCommand as GetEmailIdentityCommand3,
+  SESv2Client as SESv2Client5,
+  SendEmailCommand
+} from "@aws-sdk/client-sesv2";
 import * as clack21 from "@clack/prompts";
 import pc22 from "picocolors";
 async function emailTest(options) {
@@ -7736,11 +7763,35 @@ Run ${pc22.cyan("wraps email init")} to set up a domain.
     }
   }
   const fromEmail = `test@${domain}`;
+  const sesClient = new SESv2Client5({ region });
+  try {
+    const identityResponse = await sesClient.send(
+      new GetEmailIdentityCommand3({ EmailIdentity: domain })
+    );
+    if (!identityResponse.VerifiedForSendingStatus) {
+      progress.stop();
+      const dkimStatus = identityResponse.DkimAttributes?.Status || "PENDING";
+      clack21.log.error(
+        `Sending domain ${pc22.cyan(domain)} is not yet verified (DKIM: ${dkimStatus})`
+      );
+      console.log(
+        "\nDKIM DNS records need to propagate before you can send emails."
+      );
+      console.log("This typically takes a few minutes after deployment.\n");
+      console.log(
+        `Run ${pc22.cyan(`wraps email domains verify --domain ${domain}`)} to check DNS status.
+`
+      );
+      process.exit(1);
+      return;
+    }
+  } catch (identityError) {
+  }
   try {
     const messageId = await progress.execute(
       `Sending test email to ${toEmail}`,
       async () => {
-        const client = new SESv2Client5({ region });
+        const client = sesClient;
         const response = await client.send(
           new SendEmailCommand({
             FromEmailAddress: fromEmail,
@@ -7806,12 +7857,33 @@ Run ${pc22.cyan("wraps email init")} to set up a domain.
     });
     if (errorName === "MessageRejected" || errorMessage.includes("MessageRejected")) {
       if (errorMessage.includes("not verified")) {
-        clack21.log.error("Email address is not verified");
-        console.log("\nIn sandbox mode, recipient addresses must be verified.");
-        console.log(
-          `Simulator addresses always work: ${pc22.cyan("success@simulator.amazonses.com")}
-`
+        const failedIdentityMatch = errorMessage.match(
+          /identities failed the check.*?:\s*(.+)/i
         );
+        const failedIdentity = failedIdentityMatch?.[1]?.trim();
+        const isFromDomainFailure = failedIdentity && (failedIdentity === fromEmail || failedIdentity.endsWith(`@${domain}`) || failedIdentity === domain);
+        if (isFromDomainFailure) {
+          clack21.log.error(
+            `Sending domain ${pc22.cyan(domain)} is not yet verified`
+          );
+          console.log(
+            "\nDKIM DNS records need to propagate before you can send emails."
+          );
+          console.log("This typically takes a few minutes after deployment.\n");
+          console.log(
+            `Run ${pc22.cyan(`wraps email domains verify --domain ${domain}`)} to check DNS status.
+`
+          );
+        } else {
+          clack21.log.error("Email address is not verified");
+          console.log(
+            "\nIn sandbox mode, recipient addresses must be verified."
+          );
+          console.log(
+            `Simulator addresses always work: ${pc22.cyan("success@simulator.amazonses.com")}
+`
+          );
+        }
       } else {
         clack21.log.error(`Email rejected: ${errorMessage}`);
       }
@@ -8243,7 +8315,7 @@ var init_dynamodb_metrics = __esm({
 // src/cli.ts
 init_esm_shims();
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname3, join as join15 } from "path";
+import { dirname as dirname3, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import * as clack47 from "@clack/prompts";
 import args from "args";
@@ -15765,10 +15837,10 @@ async function eventDestinationExists(configSetName, eventDestName, region) {
 }
 async function emailIdentityExists(emailIdentity, region) {
   try {
-    const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand5 } = await import("@aws-sdk/client-sesv2");
+    const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand6 } = await import("@aws-sdk/client-sesv2");
     const ses = new SESv2Client8({ region });
     await ses.send(
-      new GetEmailIdentityCommand5({ EmailIdentity: emailIdentity })
+      new GetEmailIdentityCommand6({ EmailIdentity: emailIdentity })
     );
     return true;
   } catch (error) {
@@ -15808,9 +15880,8 @@ async function createSESResources(config2) {
   }
   const configSetName = "wraps-email-tracking";
   const exists = await configurationSetExists(configSetName, config2.region);
-  const configSet = exists ? new aws8.sesv2.ConfigurationSet(configSetName, configSetOptions, {
+  const configSet = exists && !config2.skipResourceImports ? new aws8.sesv2.ConfigurationSet(configSetName, configSetOptions, {
     import: configSetName
-    // Import existing configuration set
   }) : new aws8.sesv2.ConfigurationSet(configSetName, configSetOptions);
   const defaultEventBus = aws8.cloudwatch.getEventBusOutput({
     name: "default"
@@ -15843,9 +15914,9 @@ async function createSESResources(config2) {
         }
       },
       {
-        // Import existing resource if it already exists in AWS
-        // This prevents AlreadyExistsException when the resource exists but isn't in Pulumi state
-        import: config2.importExistingEventDestination ? `wraps-email-tracking|${eventDestName}` : void 0
+        // Import existing resource if it already exists in AWS but not in Pulumi state.
+        // Skip when skipResourceImports is true (resource already tracked in state).
+        import: config2.importExistingEventDestination && !config2.skipResourceImports ? `wraps-email-tracking|${eventDestName}` : void 0
       }
     );
   }
@@ -15857,12 +15928,11 @@ async function createSESResources(config2) {
       config2.domain,
       config2.region
     );
-    domainIdentity = identityExists ? new aws8.sesv2.EmailIdentity(
+    domainIdentity = identityExists && !config2.skipResourceImports ? new aws8.sesv2.EmailIdentity(
       "wraps-email-domain",
       {
         emailIdentity: config2.domain,
         configurationSetName: configSet.configurationSetName,
-        // Link configuration set to domain
         dkimSigningAttributes: {
           nextSigningKeyLength: "RSA_2048_BIT"
         },
@@ -15872,7 +15942,6 @@ async function createSESResources(config2) {
       },
       {
         import: config2.domain
-        // Import existing identity
       }
     ) : new aws8.sesv2.EmailIdentity("wraps-email-domain", {
       emailIdentity: config2.domain,
@@ -16106,7 +16175,7 @@ async function deployEmailStack(config2) {
   }
   let sesResources;
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
-    const shouldImportEventDest = emailConfig.eventTracking?.enabled && await eventDestinationExists(
+    const shouldImportEventDest = !config2.skipResourceImports && emailConfig.eventTracking?.enabled && await eventDestinationExists(
       "wraps-email-tracking",
       "wraps-email-eventbridge",
       config2.region
@@ -16133,8 +16202,10 @@ async function deployEmailStack(config2) {
       // Pass flag to create EventBridge destination
       tlsRequired: emailConfig.tlsRequired,
       // Require TLS encryption for all emails
-      importExistingEventDestination: shouldImportEventDest
+      importExistingEventDestination: shouldImportEventDest,
       // Import if exists to avoid AlreadyExistsException
+      skipResourceImports: config2.skipResourceImports
+      // Skip import flags when resources already in Pulumi state
     });
   }
   let dynamoTables;
@@ -16484,6 +16555,7 @@ ${pc17.bold("Current Configuration:")}
         await stack.setConfig("aws:region", { value: region });
         await stack.refresh({ onOutput: () => {
         } });
+        stackConfig.skipResourceImports = true;
         const upResult = await stack.up({ onOutput: () => {
         } });
         const pulumiOutputs = upResult.outputs;
@@ -17178,10 +17250,10 @@ async function withTimeout(promise, timeoutMs, operation) {
 // src/commands/email/destroy.ts
 async function getEmailIdentityInfo(domain, region) {
   try {
-    const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand5 } = await import("@aws-sdk/client-sesv2");
+    const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand6 } = await import("@aws-sdk/client-sesv2");
     const ses = new SESv2Client8({ region });
     const response = await ses.send(
-      new GetEmailIdentityCommand5({ EmailIdentity: domain })
+      new GetEmailIdentityCommand6({ EmailIdentity: domain })
     );
     return {
       dkimTokens: response.DkimAttributes?.Tokens || [],
@@ -17347,6 +17419,7 @@ async function emailDestroy(options) {
       clack18.log.info("You may need to delete them manually from Route53");
     }
   }
+  let destroyFailed = false;
   try {
     await progress.execute(
       "Destroying email infrastructure (this may take 2-3 minutes)",
@@ -17362,10 +17435,11 @@ async function emailDestroy(options) {
         } catch {
           throw new Error("No email infrastructure found to destroy");
         }
+        await stack.refresh({ onOutput: () => {
+        } });
         await withTimeout(
           stack.destroy({ onOutput: () => {
-          } }),
-          // Suppress Pulumi output
+          }, continueOnError: true }),
           DEFAULT_PULUMI_TIMEOUT_MS,
           "Pulumi destroy"
         );
@@ -17386,36 +17460,51 @@ async function emailDestroy(options) {
     }
     trackError("DESTROY_FAILED", "email destroy", { step: "destroy" });
     clack18.log.error("Email infrastructure destruction failed");
-    throw error;
+    destroyFailed = true;
+    clack18.log.warn(
+      "Some resources may not have been fully removed. You can re-run this command or clean up manually in the AWS console."
+    );
   }
   await deleteConnectionMetadata(identity.accountId, region);
   progress.stop();
-  const deletedItems = ["AWS infrastructure"];
-  if (shouldCleanDNS && hostedZone) {
-    deletedItems.push("Route53 DNS records");
-  }
-  clack18.outro(pc19.green("Email infrastructure has been removed"));
-  if (domain) {
-    console.log(`
+  if (destroyFailed) {
+    clack18.outro(
+      pc19.yellow("Email infrastructure partially removed. Metadata cleaned up.")
+    );
+    console.log(
+      `
+Run ${pc19.cyan("wraps email init")} to redeploy, or clean up remaining resources in the AWS console.
+`
+    );
+  } else {
+    const deletedItems = ["AWS infrastructure"];
+    if (shouldCleanDNS && hostedZone) {
+      deletedItems.push("Route53 DNS records");
+    }
+    clack18.outro(pc19.green("Email infrastructure has been removed"));
+    if (domain) {
+      console.log(`
 ${pc19.bold("Cleaned up:")}`);
-    for (const item of deletedItems) {
-      console.log(`  ${pc19.green("\u2713")} ${item}`);
+      for (const item of deletedItems) {
+        console.log(`  ${pc19.green("\u2713")} ${item}`);
+      }
+      console.log(
+        `
+${pc19.dim("Note: SPF record was not deleted. Remove 'include:amazonses.com' manually if needed.")}`
+      );
     }
     console.log(
       `
-${pc19.dim("Note: SPF record was not deleted. Remove 'include:amazonses.com' manually if needed.")}`
-    );
-  }
-  console.log(
-    `
 Run ${pc19.cyan("wraps email init")} to deploy infrastructure again.
 `
-  );
+    );
+  }
   trackServiceRemoved("email", {
     reason: "user_initiated",
     region,
     duration_ms: Date.now() - startTime,
-    dns_cleaned: shouldCleanDNS
+    dns_cleaned: shouldCleanDNS,
+    partial_failure: destroyFailed
   });
 }
 
@@ -19972,7 +20061,7 @@ Run ${pc25.cyan("wraps email init")} to deploy email infrastructure.
     throw error;
   }
   const domains = await listSESDomains(region);
-  const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand5 } = await import("@aws-sdk/client-sesv2");
+  const { SESv2Client: SESv2Client8, GetEmailIdentityCommand: GetEmailIdentityCommand6 } = await import("@aws-sdk/client-sesv2");
   const sesv2Client = new SESv2Client8({ region });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   const trackedDomains = metadata ? getAllTrackedDomains(metadata) : [];
@@ -19982,7 +20071,7 @@ Run ${pc25.cyan("wraps email init")} to deploy email infrastructure.
       const tracked = trackedMap.get(d.domain);
       try {
         const sesIdentity = await sesv2Client.send(
-          new GetEmailIdentityCommand5({ EmailIdentity: d.domain })
+          new GetEmailIdentityCommand6({ EmailIdentity: d.domain })
         );
         return {
           domain: d.domain,
@@ -20853,20 +20942,56 @@ function renderErrorPage(err) {
 init_esm_shims();
 init_events();
 import { createHash } from "crypto";
-import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
-import { join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile7 } from "fs/promises";
+import { join as join12 } from "path";
 import * as clack27 from "@clack/prompts";
 import pc28 from "picocolors";
 init_config();
 init_errors();
+
+// src/utils/shared/lockfile.ts
+init_esm_shims();
+import { existsSync as existsSync10 } from "fs";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
+import { join as join11 } from "path";
+function getLockfilePath(wrapsDir) {
+  return join11(wrapsDir, ".wraps", "lockfile.json");
+}
+async function loadLockfile(wrapsDir) {
+  const path3 = getLockfilePath(wrapsDir);
+  if (!existsSync10(path3)) {
+    return { version: "1.0.0", lastSync: "", templates: {}, workflows: {} };
+  }
+  try {
+    const content = await readFile4(path3, "utf-8");
+    const parsed = JSON.parse(content);
+    if (!parsed.templates) {
+      parsed.templates = {};
+    }
+    if (!parsed.workflows) {
+      parsed.workflows = {};
+    }
+    return parsed;
+  } catch {
+    return { version: "1.0.0", lastSync: "", templates: {}, workflows: {} };
+  }
+}
+async function saveLockfile(wrapsDir, lockfile) {
+  const path3 = getLockfilePath(wrapsDir);
+  const dir = join11(path3, "..");
+  await mkdir4(dir, { recursive: true });
+  await writeFile6(path3, JSON.stringify(lockfile, null, 2), "utf-8");
+}
+
+// src/commands/email/templates/push.ts
 init_output();
 async function templatesPush(options) {
   const startTime = Date.now();
   const cwd = process.cwd();
-  const wrapsDir = join11(cwd, "wraps");
-  const configPath = join11(wrapsDir, "wraps.config.ts");
-  if (!existsSync10(configPath)) {
+  const wrapsDir = join12(cwd, "wraps");
+  const configPath = join12(wrapsDir, "wraps.config.ts");
+  if (!existsSync11(configPath)) {
     throw errors.wrapsConfigNotFound();
   }
   if (!options.json) {
@@ -20876,8 +21001,8 @@ async function templatesPush(options) {
   progress.start("Loading configuration");
   const config2 = await loadWrapsConfig(wrapsDir);
   progress.succeed("Configuration loaded");
-  const templatesDir = join11(wrapsDir, config2.templatesDir || "./templates");
-  if (!existsSync10(templatesDir)) {
+  const templatesDir = join12(wrapsDir, config2.templatesDir || "./templates");
+  if (!existsSync11(templatesDir)) {
     throw errors.wrapsConfigNotFound();
   }
   const templateFiles = await discoverTemplates(templatesDir, options.template);
@@ -20887,8 +21012,7 @@ async function templatesPush(options) {
     }
     return;
   }
-  const lockfilePath = join11(wrapsDir, ".wraps", "lockfile.json");
-  const lockfile = await loadLockfile(lockfilePath);
+  const lockfile = await loadLockfile(wrapsDir);
   const token = await resolveTokenAsync({ token: options.token });
   const remoteTemplateSlugs = await fetchRemoteTemplateSlugs(token, progress);
   const compiled = [];
@@ -20896,8 +21020,8 @@ async function templatesPush(options) {
   const compileErrors = [];
   for (const file of templateFiles) {
     const slug = file.replace(/\.tsx?$/, "");
-    const filePath = join11(templatesDir, file);
-    const source = await readFile4(filePath, "utf-8");
+    const filePath = join12(templatesDir, file);
+    const source = await readFile5(filePath, "utf-8");
     const sourceHash = sha256(source);
     const localHashMatches = lockfile.templates[slug]?.localHash === sourceHash;
     const existsRemotely = remoteTemplateSlugs === null || remoteTemplateSlugs.has(slug);
@@ -20976,27 +21100,25 @@ async function templatesPush(options) {
     }
     return;
   }
-  await pushToSES(compiled, progress);
-  const apiResults = await pushToAPI(
-    compiled,
-    token,
-    config2.org,
-    progress,
-    options.force
-  );
+  const sesResults = await pushToSES(compiled, progress);
+  const apiResults = await pushToAPI(compiled, token, progress, options.force);
   for (const t of compiled) {
+    const sesOk = sesResults.find((r) => r.slug === t.slug)?.success;
     const apiResult = apiResults.find((r) => r.slug === t.slug);
-    lockfile.templates[t.slug] = {
-      id: apiResult?.id,
-      localHash: t.sourceHash,
-      remoteHash: t.sourceHash,
-      sesTemplateName: t.sesTemplateName,
-      lastPushed: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    const apiOk = apiResult?.success;
+    if (sesOk || apiOk) {
+      lockfile.templates[t.slug] = {
+        id: apiResult?.id,
+        localHash: t.sourceHash,
+        remoteHash: t.sourceHash,
+        sesTemplateName: t.sesTemplateName,
+        lastPushed: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
   }
   lockfile.lastSync = (/* @__PURE__ */ new Date()).toISOString();
   lockfile.org = config2.org;
-  await saveLockfile(lockfilePath, lockfile);
+  await saveLockfile(wrapsDir, lockfile);
   if (options.json) {
     console.log(
       JSON.stringify({
@@ -21054,11 +21176,11 @@ async function compileTemplate(filePath, slug, source, sourceHash, wrapsDir) {
     }
   });
   const bundledCode = result.outputFiles[0].text;
-  const projectRoot = join11(wrapsDir, "..");
-  const tmpDir = join11(projectRoot, "node_modules", ".wraps-compiled");
-  await mkdir4(tmpDir, { recursive: true });
-  const tmpPath = join11(tmpDir, `${slug}.mjs`);
-  await writeFile6(tmpPath, bundledCode, "utf-8");
+  const projectRoot = join12(wrapsDir, "..");
+  const tmpDir = join12(projectRoot, "node_modules", ".wraps-compiled");
+  await mkdir5(tmpDir, { recursive: true });
+  const tmpPath = join12(tmpDir, `${slug}.mjs`);
+  await writeFile7(tmpPath, bundledCode, "utf-8");
   const mod = await import(tmpPath);
   const Component = mod.default;
   const subject = mod.subject || slug;
@@ -21156,9 +21278,9 @@ async function pushToSES(templates, progress) {
     UpdateTemplateCommand
   } = await import("@aws-sdk/client-ses");
   const ses = new SESClient5({ region });
-  for (const t of templates) {
-    progress.start(`Pushing ${pc28.cyan(t.slug)} to SES`);
-    try {
+  const settled = await Promise.allSettled(
+    templates.map(async (t) => {
+      progress.start(`Pushing ${pc28.cyan(t.slug)} to SES`);
       const templateData = {
         TemplateName: t.sesTemplateName,
         SubjectPart: t.subject,
@@ -21182,12 +21304,18 @@ async function pushToSES(templates, progress) {
       } else {
         await ses.send(new CreateTemplateCommand({ Template: templateData }));
       }
-      results.push({ slug: t.slug, success: true });
       progress.succeed(`Pushed ${pc28.cyan(t.slug)} to SES`);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      results.push({ slug: t.slug, success: false });
-      progress.fail(`SES push failed for ${t.slug}: ${msg}`);
+      return { slug: t.slug };
+    })
+  );
+  for (let i = 0; i < templates.length; i++) {
+    const result = settled[i];
+    if (result.status === "fulfilled") {
+      results.push({ slug: result.value.slug, success: true });
+    } else {
+      const msg = result.reason instanceof Error ? result.reason.message : String(result.reason);
+      results.push({ slug: templates[i].slug, success: false });
+      progress.fail(`SES push failed for ${templates[i].slug}: ${msg}`);
     }
   }
   return results;
@@ -21219,7 +21347,7 @@ async function fetchRemoteTemplateSlugs(token, progress) {
     return null;
   }
 }
-async function pushToAPI(templates, token, _org, progress, force) {
+async function pushToAPI(templates, token, progress, force) {
   if (!token) {
     progress.info(
       "No API token \u2014 skipping dashboard sync. Run: wraps auth login"
@@ -21341,22 +21469,6 @@ async function pushToAPI(templates, token, _org, progress, force) {
   }
   return results;
 }
-async function loadLockfile(path3) {
-  if (!existsSync10(path3)) {
-    return { version: "1.0.0", lastSync: "", templates: {} };
-  }
-  try {
-    const content = await readFile4(path3, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return { version: "1.0.0", lastSync: "", templates: {} };
-  }
-}
-async function saveLockfile(path3, lockfile) {
-  const dir = join11(path3, "..");
-  await mkdir4(dir, { recursive: true });
-  await writeFile6(path3, JSON.stringify(lockfile, null, 2), "utf-8");
-}
 function sha256(content) {
   return createHash("sha256").update(content).digest("hex");
 }
@@ -22696,6 +22808,7 @@ ${pc29.bold("Cost Impact:")}`);
         await stack.setConfig("aws:region", { value: region });
         await stack.refresh({ onOutput: () => {
         } });
+        stackConfig.skipResourceImports = true;
         const upResult = await stack.up({ onOutput: () => {
         } });
         const pulumiOutputs = upResult.outputs;
@@ -23085,9 +23198,8 @@ ${pc29.green("\u2713")} ${pc29.bold("Upgrade complete!")}
 // src/commands/email/workflows/push.ts
 init_esm_shims();
 init_events();
-import { existsSync as existsSync12 } from "fs";
-import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
-import { join as join13 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join14 } from "path";
 import * as clack29 from "@clack/prompts";
 import pc30 from "picocolors";
 
@@ -23276,11 +23388,11 @@ function assignPositions(steps, transitions) {
 // src/utils/email/workflow-ts.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync11 } from "fs";
-import { mkdir as mkdir5, readdir as readdir3, readFile as readFile5, writeFile as writeFile7 } from "fs/promises";
-import { basename, join as join12 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { mkdir as mkdir6, readdir as readdir3, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
+import { basename, join as join13 } from "path";
 async function discoverWorkflows(dir, filter) {
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return [];
   }
   const entries = await readdir3(dir);
@@ -23300,11 +23412,11 @@ async function discoverWorkflows(dir, filter) {
 }
 async function parseWorkflowTs(filePath, wrapsDir) {
   const { build: build2 } = await import("esbuild");
-  const source = await readFile5(filePath, "utf-8");
+  const source = await readFile6(filePath, "utf-8");
   const sourceHash = createHash2("sha256").update(source).digest("hex");
   const slug = basename(filePath, ".ts");
-  const shimDir = join12(wrapsDir, ".wraps", "_shims");
-  await mkdir5(shimDir, { recursive: true });
+  const shimDir = join13(wrapsDir, ".wraps", "_shims");
+  await mkdir6(shimDir, { recursive: true });
   const clientShimContent = `
 // Identity functions for workflow definitions
 export const defineWorkflow = (def) => def;
@@ -23446,8 +23558,8 @@ function durationToSeconds(duration) {
   return seconds > 0 ? seconds : undefined;
 }
 `;
-  await writeFile7(
-    join12(shimDir, "wraps-client-shim.mjs"),
+  await writeFile8(
+    join13(shimDir, "wraps-client-shim.mjs"),
     clientShimContent,
     "utf-8"
   );
@@ -23459,14 +23571,14 @@ function durationToSeconds(duration) {
     platform: "node",
     target: "node20",
     alias: {
-      "@wraps.dev/client": join12(shimDir, "wraps-client-shim.mjs")
+      "@wraps.dev/client": join13(shimDir, "wraps-client-shim.mjs")
     }
   });
   const bundledCode = result.outputFiles[0].text;
-  const tmpDir = join12(wrapsDir, ".wraps", "_workflows");
-  await mkdir5(tmpDir, { recursive: true });
-  const tmpPath = join12(tmpDir, `${slug}.mjs`);
-  await writeFile7(tmpPath, bundledCode, "utf-8");
+  const tmpDir = join13(wrapsDir, ".wraps", "_workflows");
+  await mkdir6(tmpDir, { recursive: true });
+  const tmpPath = join13(tmpDir, `${slug}.mjs`);
+  await writeFile8(tmpPath, bundledCode, "utf-8");
   const mod = await import(`${tmpPath}?t=${Date.now()}`);
   const definition = mod.default;
   if (!definition || typeof definition !== "object") {
@@ -23817,9 +23929,9 @@ init_output();
 async function workflowsPush(options) {
   const startTime = Date.now();
   const cwd = process.cwd();
-  const wrapsDir = join13(cwd, "wraps");
-  const configPath = join13(wrapsDir, "wraps.config.ts");
-  if (!existsSync12(configPath)) {
+  const wrapsDir = join14(cwd, "wraps");
+  const configPath = join14(wrapsDir, "wraps.config.ts");
+  if (!existsSync13(configPath)) {
     throw errors.wrapsConfigNotFound();
   }
   if (!options.json) {
@@ -23829,8 +23941,8 @@ async function workflowsPush(options) {
   progress.start("Loading configuration");
   const config2 = await loadWrapsConfig(wrapsDir);
   progress.succeed("Configuration loaded");
-  const workflowsDir = join13(wrapsDir, config2.workflowsDir || "./workflows");
-  if (!existsSync12(workflowsDir)) {
+  const workflowsDir = join14(wrapsDir, config2.workflowsDir || "./workflows");
+  if (!existsSync13(workflowsDir)) {
     if (options.json) {
       console.log(
         JSON.stringify({
@@ -23859,11 +23971,10 @@ async function workflowsPush(options) {
     }
     return;
   }
-  const lockfilePath = join13(wrapsDir, ".wraps", "lockfile.json");
-  const lockfile = await loadLockfile2(lockfilePath);
-  const templatesDir = join13(wrapsDir, config2.templatesDir || "./templates");
+  const lockfile = await loadLockfile(wrapsDir);
+  const templatesDir = join14(wrapsDir, config2.templatesDir || "./templates");
   let localTemplateSlugs;
-  if (existsSync12(templatesDir)) {
+  if (existsSync13(templatesDir)) {
     const templateFiles = await discoverTemplates(templatesDir);
     localTemplateSlugs = new Set(
       templateFiles.map((f) => f.replace(/\.tsx?$/, ""))
@@ -23875,7 +23986,7 @@ async function workflowsPush(options) {
   const validationErrors = [];
   for (const file of workflowFiles) {
     const slug = file.replace(/\.ts$/, "");
-    const filePath = join13(workflowsDir, file);
+    const filePath = join14(workflowsDir, file);
     progress.start(`Processing ${pc30.cyan(slug)}`);
     try {
       const parsed = await parseWorkflowTs(filePath, wrapsDir);
@@ -23998,28 +24109,21 @@ async function workflowsPush(options) {
     return;
   }
   const token = await resolveTokenAsync({ token: options.token });
-  const apiResults = await pushToAPI2(
-    toProcess,
-    token,
-    config2.org,
-    progress,
-    options.force
-  );
-  if (!lockfile.workflows) {
-    lockfile.workflows = {};
-  }
+  const apiResults = await pushToAPI2(toProcess, token, progress, options.force);
   for (const w of toProcess) {
     const apiResult = apiResults.find((r) => r.slug === w.slug);
-    lockfile.workflows[w.slug] = {
-      id: apiResult?.id,
-      localHash: w.parsed.sourceHash,
-      remoteHash: w.parsed.sourceHash,
-      lastPushed: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    if (apiResult?.success) {
+      lockfile.workflows[w.slug] = {
+        id: apiResult?.id,
+        localHash: w.parsed.sourceHash,
+        remoteHash: w.parsed.sourceHash,
+        lastPushed: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
   }
   lockfile.lastSync = (/* @__PURE__ */ new Date()).toISOString();
   lockfile.org = config2.org;
-  await saveLockfile2(lockfilePath, lockfile);
+  await saveLockfile(wrapsDir, lockfile);
   const pushed = apiResults.filter((r) => r.success);
   const conflicts = apiResults.filter((r) => r.conflict);
   if (options.json) {
@@ -24068,7 +24172,7 @@ async function workflowsPush(options) {
     conflict_count: conflicts.length
   });
 }
-async function pushToAPI2(workflows, token, _org, progress, force) {
+async function pushToAPI2(workflows, token, progress, force) {
   if (!token) {
     progress.info(
       "No API token \u2014 skipping dashboard sync. Run: wraps auth login"
@@ -24192,32 +24296,12 @@ async function pushToAPI2(workflows, token, _org, progress, force) {
   }
   return results;
 }
-async function loadLockfile2(path3) {
-  if (!existsSync12(path3)) {
-    return { version: "1.0.0", lastSync: "", templates: {}, workflows: {} };
-  }
-  try {
-    const content = await readFile6(path3, "utf-8");
-    const parsed = JSON.parse(content);
-    if (!parsed.workflows) {
-      parsed.workflows = {};
-    }
-    return parsed;
-  } catch {
-    return { version: "1.0.0", lastSync: "", templates: {}, workflows: {} };
-  }
-}
-async function saveLockfile2(path3, lockfile) {
-  const dir = join13(path3, "..");
-  await mkdir6(dir, { recursive: true });
-  await writeFile8(path3, JSON.stringify(lockfile, null, 2), "utf-8");
-}
 
 // src/commands/email/workflows/validate.ts
 init_esm_shims();
 init_events();
-import { existsSync as existsSync13 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join15 } from "path";
 import * as clack30 from "@clack/prompts";
 import pc31 from "picocolors";
 init_errors();
@@ -24225,9 +24309,9 @@ init_output();
 async function workflowsValidate(options) {
   const startTime = Date.now();
   const cwd = process.cwd();
-  const wrapsDir = join14(cwd, "wraps");
-  const configPath = join14(wrapsDir, "wraps.config.ts");
-  if (!existsSync13(configPath)) {
+  const wrapsDir = join15(cwd, "wraps");
+  const configPath = join15(wrapsDir, "wraps.config.ts");
+  if (!existsSync14(configPath)) {
     throw errors.wrapsConfigNotFound();
   }
   if (!options.json) {
@@ -24237,8 +24321,8 @@ async function workflowsValidate(options) {
   progress.start("Loading configuration");
   const config2 = await loadWrapsConfig(wrapsDir);
   progress.succeed("Configuration loaded");
-  const workflowsDir = join14(wrapsDir, config2.workflowsDir || "./workflows");
-  if (!existsSync13(workflowsDir)) {
+  const workflowsDir = join15(wrapsDir, config2.workflowsDir || "./workflows");
+  if (!existsSync14(workflowsDir)) {
     if (options.json) {
       console.log(
         JSON.stringify({
@@ -24267,9 +24351,9 @@ async function workflowsValidate(options) {
     }
     return;
   }
-  const templatesDir = join14(wrapsDir, config2.templatesDir || "./templates");
+  const templatesDir = join15(wrapsDir, config2.templatesDir || "./templates");
   let localTemplateSlugs;
-  if (existsSync13(templatesDir)) {
+  if (existsSync14(templatesDir)) {
     const templateFiles = await discoverTemplates(templatesDir);
     localTemplateSlugs = new Set(
       templateFiles.map((f) => f.replace(/\.tsx?$/, ""))
@@ -24279,7 +24363,7 @@ async function workflowsValidate(options) {
   const parseErrors = [];
   for (const file of workflowFiles) {
     const slug = file.replace(/\.ts$/, "");
-    const filePath = join14(workflowsDir, file);
+    const filePath = join15(workflowsDir, file);
     progress.start(`Validating ${pc31.cyan(slug)}`);
     try {
       const parsed = await parseWorkflowTs(filePath, wrapsDir);
@@ -25155,6 +25239,11 @@ async function deployEventBridge(metadata, region, identity, webhookSecret, prog
     await stack.setConfig("aws:region", { value: region });
     await stack.refresh({ onOutput: () => {
     } });
+    const stackState = await stack.exportStack();
+    const resourceCount = stackState.deployment?.resources?.length ?? 0;
+    if (resourceCount > 1) {
+      stackConfig.skipResourceImports = true;
+    }
     await stack.up({ onOutput: () => {
     } });
   });
@@ -25626,6 +25715,11 @@ Run ${pc34.cyan("wraps email init")} or ${pc34.cyan("wraps sms init")} first.
         await stack.setConfig("aws:region", { value: region });
         await stack.refresh({ onOutput: () => {
         } });
+        const stackState = await stack.exportStack();
+        const resourceCount = stackState.deployment?.resources?.length ?? 0;
+        if (resourceCount > 1) {
+          stackConfig.skipResourceImports = true;
+        }
         await stack.up({ onOutput: () => {
         } });
       });
@@ -26629,7 +26723,7 @@ import { Router as createRouter2 } from "express";
 init_esm_shims();
 init_assume_role();
 import { GetSendQuotaCommand, SESClient as SESClient4 } from "@aws-sdk/client-ses";
-import { GetEmailIdentityCommand as GetEmailIdentityCommand3, SESv2Client as SESv2Client6 } from "@aws-sdk/client-sesv2";
+import { GetEmailIdentityCommand as GetEmailIdentityCommand4, SESv2Client as SESv2Client6 } from "@aws-sdk/client-sesv2";
 async function fetchSendQuota(roleArn, region) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
   const ses = new SESClient4({ region, credentials });
@@ -26644,7 +26738,7 @@ async function fetchDomainInfo(roleArn, region, domain) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
   const sesv22 = new SESv2Client6({ region, credentials });
   const response = await sesv22.send(
-    new GetEmailIdentityCommand3({
+    new GetEmailIdentityCommand4({
       EmailIdentity: domain
     })
   );
@@ -27470,7 +27564,7 @@ init_esm_shims();
 init_assume_role();
 import {
   GetConfigurationSetCommand,
-  GetEmailIdentityCommand as GetEmailIdentityCommand4,
+  GetEmailIdentityCommand as GetEmailIdentityCommand5,
   SESv2Client as SESv2Client7
 } from "@aws-sdk/client-sesv2";
 async function fetchConfigurationSet(roleArn, region, configSetName) {
@@ -27507,7 +27601,7 @@ async function fetchEmailIdentity(roleArn, region, identityName) {
   const credentials = roleArn ? await assumeRole(roleArn, region) : void 0;
   const sesv22 = new SESv2Client7({ region, credentials });
   const response = await sesv22.send(
-    new GetEmailIdentityCommand4({
+    new GetEmailIdentityCommand5({
       EmailIdentity: identityName
     })
   );
@@ -32950,7 +33044,7 @@ if (nodeMajorVersion < 20) {
 var __filename2 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname3(__filename2);
 var packageJson = JSON.parse(
-  readFileSync3(join15(__dirname3, "../package.json"), "utf-8")
+  readFileSync3(join16(__dirname3, "../package.json"), "utf-8")
 );
 var VERSION = packageJson.version;
 setupTabCompletion();