@wraps.dev/cli 2.15.0 → 2.16.0

package/dist/cli.js

@@ -65,6 +65,7 @@ var init_ci_detection = __esm({
 // src/utils/shared/s3-state.ts
 var s3_state_exports = {};
 __export(s3_state_exports, {
+  clearS3StackLocks: () => clearS3StackLocks,
   deleteMetadata: () => deleteMetadata,
   downloadMetadata: () => downloadMetadata,
   ensureStateBucket: () => ensureStateBucket,
@@ -196,6 +197,27 @@ async function deleteMetadata(bucketName, accountId, region) {
     })
   );
 }
+async function clearS3StackLocks(accountId, region) {
+  const { S3Client: S3Client2, ListObjectsV2Command: ListObjectsV2Command2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const bucketName = getStateBucketName(accountId, region);
+  const prefix = ".pulumi/locks/";
+  const response = await client.send(
+    new ListObjectsV2Command2({ Bucket: bucketName, Prefix: prefix })
+  );
+  const lockObjects = response.Contents ?? [];
+  if (lockObjects.length === 0) {
+    return 0;
+  }
+  for (const obj of lockObjects) {
+    if (obj.Key) {
+      await client.send(
+        new DeleteObjectCommand({ Bucket: bucketName, Key: obj.Key })
+      );
+    }
+  }
+  return lockObjects.length;
+}
 async function downloadMetadata(bucketName, accountId, region) {
   const { S3Client: S3Client2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
   const client = new S3Client2({ region });
@@ -302,8 +324,16 @@ var init_s3_state = __esm({
 });
 
 // src/utils/shared/fs.ts
+var fs_exports = {};
+__export(fs_exports, {
+  clearLocalStackLocks: () => clearLocalStackLocks,
+  ensurePulumiWorkDir: () => ensurePulumiWorkDir,
+  ensureWrapsDir: () => ensureWrapsDir,
+  getPulumiWorkDir: () => getPulumiWorkDir,
+  getWrapsDir: () => getWrapsDir
+});
 import { existsSync as existsSync2 } from "fs";
-import { mkdir } from "fs/promises";
+import { mkdir, readdir as readdir2, rm } from "fs/promises";
 import { homedir } from "os";
 import { join as join2 } from "path";
 function getWrapsDir() {
@@ -318,6 +348,27 @@ async function ensureWrapsDir() {
     await mkdir(wrapsDir, { recursive: true });
   }
 }
+async function clearLocalStackLocks() {
+  const locksDir = join2(getPulumiWorkDir(), ".pulumi", "locks");
+  if (!existsSync2(locksDir)) {
+    return 0;
+  }
+  let count = 0;
+  async function walkAndDelete(dir) {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join2(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walkAndDelete(fullPath);
+      } else if (entry.name.endsWith(".json")) {
+        await rm(fullPath);
+        count++;
+      }
+    }
+  }
+  await walkAndDelete(locksDir);
+  return count;
+}
 async function ensurePulumiWorkDir(options) {
   await ensureWrapsDir();
   const pulumiDir = getPulumiWorkDir();
@@ -4296,8 +4347,8 @@ async function listConnections() {
     return [];
   }
   try {
-    const { readdir: readdir4 } = await import("fs/promises");
-    const files = await readdir4(connectionsDir);
+    const { readdir: readdir5 } = await import("fs/promises");
+    const files = await readdir5(connectionsDir);
     const connections = [];
     for (const file of files) {
       if (file.endsWith(".json")) {
@@ -6728,7 +6779,7 @@ var init_cloudflare = __esm({
         };
       }
       async createEmailRecords(data) {
-        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const { domain, dkimTokens, mailFromDomain, customTrackingDomain, region } = data;
         const errors2 = [];
         let recordsCreated = 0;
         try {
@@ -6765,6 +6816,20 @@ var init_cloudflare = __esm({
           } else {
             errors2.push(`Failed to create DMARC record for ${domain}`);
           }
+          if (customTrackingDomain) {
+            const trackingSuccess = await this.createRecord(
+              customTrackingDomain,
+              "CNAME",
+              `r.${region}.awstrack.me`
+            );
+            if (trackingSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(
+                `Failed to create tracking CNAME for ${customTrackingDomain}`
+              );
+            }
+          }
           if (mailFromDomain) {
             const mxSuccess = await this.createRecord(
               mailFromDomain,
@@ -7096,7 +7161,7 @@ var init_vercel = __esm({
         };
       }
       async createEmailRecords(data) {
-        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const { domain, dkimTokens, mailFromDomain, customTrackingDomain, region } = data;
         const errors2 = [];
         let recordsCreated = 0;
         try {
@@ -7133,6 +7198,20 @@ var init_vercel = __esm({
           } else {
             errors2.push(`Failed to create DMARC record for ${domain}`);
           }
+          if (customTrackingDomain) {
+            const trackingSuccess = await this.createRecord(
+              customTrackingDomain,
+              "CNAME",
+              `r.${region}.awstrack.me`
+            );
+            if (trackingSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(
+                `Failed to create tracking CNAME for ${customTrackingDomain}`
+              );
+            }
+          }
           if (mailFromDomain) {
             const mxSuccess = await this.createRecord(
               mailFromDomain,
@@ -7348,7 +7427,7 @@ import {
   Route53Client as Route53Client2
 } from "@aws-sdk/client-route-53";
 function buildEmailDNSRecords(data) {
-  const { domain, dkimTokens, mailFromDomain, region } = data;
+  const { domain, dkimTokens, mailFromDomain, customTrackingDomain, region } = data;
   const records = [];
   for (const token of dkimTokens) {
     records.push({
@@ -7371,6 +7450,14 @@ function buildEmailDNSRecords(data) {
     value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
     category: "dmarc"
   });
+  if (customTrackingDomain) {
+    records.push({
+      name: customTrackingDomain,
+      type: "CNAME",
+      value: `r.${region}.awstrack.me`,
+      category: "tracking"
+    });
+  }
   if (mailFromDomain) {
     records.push({
       name: mailFromDomain,
@@ -7431,8 +7518,7 @@ async function createDNSRecordsForProvider(credentials, data, selectedCategories
           data.dkimTokens,
           data.region,
           categories,
-          void 0,
-          // customTrackingDomain - not used here
+          data.customTrackingDomain,
           data.mailFromDomain
         );
         let recordsCreated = 0;
@@ -10078,6 +10164,48 @@ async function previewWithResourceChanges(stack, options) {
     resourceChanges
   };
 }
+async function clearStackLocks(accountId, region) {
+  const backendUrl = process.env.PULUMI_BACKEND_URL || "";
+  if (backendUrl.startsWith("s3://")) {
+    const { clearS3StackLocks: clearS3StackLocks2 } = await Promise.resolve().then(() => (init_s3_state(), s3_state_exports));
+    return clearS3StackLocks2(accountId, region);
+  }
+  const { clearLocalStackLocks: clearLocalStackLocks2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
+  return clearLocalStackLocks2();
+}
+async function withLockRetry(fn, options) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (!(error instanceof Error)) {
+      throw error;
+    }
+    const parsed = parsePulumiError(error);
+    if (parsed.code !== "STACK_LOCKED") {
+      throw error;
+    }
+    const clack51 = await import("@clack/prompts");
+    const pc54 = (await import("picocolors")).default;
+    if (options.autoConfirm) {
+      clack51.log.warn(
+        "Stack is locked from a previous interrupted run. Auto-clearing..."
+      );
+    } else {
+      const shouldClear = await clack51.confirm({
+        message: `Stack is locked from a previous interrupted run. ${pc54.yellow("Clear the stale lock and retry?")}`,
+        initialValue: true
+      });
+      if (clack51.isCancel(shouldClear) || !shouldClear) {
+        throw errors.stackLocked();
+      }
+    }
+    const cleared = await clearStackLocks(options.accountId, options.region);
+    clack51.log.info(
+      `Cleared ${cleared} lock file${cleared === 1 ? "" : "s"}. Retrying...`
+    );
+    return fn();
+  }
+}
 
 // src/commands/cdn/destroy.ts
 async function cdnDestroy(options) {
@@ -10268,8 +10396,12 @@ async function cdnDestroy(options) {
         } catch (_error) {
           throw new Error("No CDN infrastructure found to destroy");
         }
-        await stack.destroy({ onOutput: () => {
-        } });
+        await withLockRetry(() => stack.destroy({ onOutput: () => {
+        } }), {
+          accountId: identity.accountId,
+          region,
+          autoConfirm: options.force
+        });
         await stack.workspace.removeStack(stackName);
       }
     );
@@ -10284,10 +10416,6 @@ async function cdnDestroy(options) {
       }
       process.exit(0);
     }
-    if (msg.includes("stack is currently locked")) {
-      trackError("STACK_LOCKED", "storage destroy", { step: "destroy" });
-      throw errors.stackLocked();
-    }
     trackError("DESTROY_FAILED", "storage destroy", { step: "destroy" });
     clack9.log.error("CDN infrastructure destruction failed");
     throw error;
@@ -11677,8 +11805,11 @@ ${pc11.yellow(pc11.bold("Configuration Notes:"))}`);
           `wraps-cdn-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
-        const upResult = await stack.up({ onOutput: () => {
-        } });
+        const upResult = await withLockRetry(
+          () => stack.up({ onOutput: () => {
+          } }),
+          { accountId: identity.accountId, region, autoConfirm: options.yes }
+        );
         const pulumiOutputs = upResult.outputs;
         return {
           roleArn: pulumiOutputs.roleArn?.value,
@@ -11704,10 +11835,6 @@ ${pc11.yellow(pc11.bold("Configuration Notes:"))}`);
       region,
       duration_ms: Date.now() - startTime
     });
-    if (msg.includes("stack is currently locked")) {
-      trackError("STACK_LOCKED", "storage:init", { step: "deploy" });
-      throw errors.stackLocked();
-    }
     trackError("DEPLOYMENT_FAILED", "storage:init", { step: "deploy" });
     throw new Error(`Pulumi deployment failed: ${msg}`);
   }
@@ -18155,11 +18282,14 @@ async function emailDestroy(options) {
         }
         await stack.refresh({ onOutput: () => {
         } });
-        await withTimeout(
-          stack.destroy({ onOutput: () => {
-          }, continueOnError: true }),
-          DEFAULT_PULUMI_TIMEOUT_MS,
-          "Pulumi destroy"
+        await withLockRetry(
+          () => withTimeout(
+            stack.destroy({ onOutput: () => {
+            }, continueOnError: true }),
+            DEFAULT_PULUMI_TIMEOUT_MS,
+            "Pulumi destroy"
+          ),
+          { accountId: identity.accountId, region, autoConfirm: options.force }
         );
         await stack.workspace.removeStack(stackName);
       }
@@ -18172,10 +18302,6 @@ async function emailDestroy(options) {
       await deleteConnectionMetadata(identity.accountId, region);
       process.exit(0);
     }
-    if (msg.includes("stack is currently locked")) {
-      trackError("STACK_LOCKED", "email destroy", { step: "destroy" });
-      throw errors.stackLocked();
-    }
     trackError("DESTROY_FAILED", "email destroy", { step: "destroy" });
     clack18.log.error("Email infrastructure destruction failed");
     destroyFailed = true;
@@ -19425,8 +19551,8 @@ async function inboundInit(options) {
   if (!domain) {
     throw errors.inboundRequiresOutbound();
   }
-  const subdomain = options.subdomain || (options.yes ? "inbound" : await promptInboundSubdomain(domain));
-  const receivingDomain = `${subdomain}.${domain}`;
+  const subdomain = options.root ? "" : options.subdomain ?? (options.yes ? "inbound" : await promptInboundSubdomain(domain));
+  const receivingDomain = subdomain ? `${subdomain}.${domain}` : domain;
   clack20.log.info(`Receiving domain: ${pc21.cyan(receivingDomain)}`);
   const webhookUrl = options.webhookUrl || (options.yes ? void 0 : await promptWebhookUrl());
   const webhookSecret = randomBytes3(32).toString("hex");
@@ -19490,22 +19616,25 @@ async function inboundInit(options) {
     );
     await stack.setConfig("aws:region", { value: region });
     const pulumiOutput = [];
-    await withTimeout(
-      stack.up({
-        onOutput: (msg) => {
-          pulumiOutput.push(msg);
+    await withLockRetry(
+      () => withTimeout(
+        stack.up({
+          onOutput: (msg) => {
+            pulumiOutput.push(msg);
+          }
+        }),
+        DEFAULT_PULUMI_TIMEOUT_MS,
+        "Pulumi deployment"
+      ).catch((error) => {
+        if (pulumiOutput.length > 0) {
+          const fullOutput = pulumiOutput.join("");
+          clack20.log.error("Pulumi deployment output:");
+          console.error(fullOutput);
         }
+        throw error;
       }),
-      DEFAULT_PULUMI_TIMEOUT_MS,
-      "Pulumi deployment"
-    ).catch((error) => {
-      if (pulumiOutput.length > 0) {
-        const fullOutput = pulumiOutput.join("");
-        clack20.log.error("Pulumi deployment output:");
-        console.error(fullOutput);
-      }
-      throw error;
-    });
+      { accountId: identity.accountId, region, autoConfirm: options.yes }
+    );
   });
   await progress.execute("Creating SES receipt rules", async () => {
     await createReceiptRuleSet(region);
@@ -19731,11 +19860,14 @@ Deploy first: ${pc21.cyan("wraps email inbound init")}
       }
     );
     await stack.setConfig("aws:region", { value: region });
-    await withTimeout(
-      stack.up({ onOutput: () => {
-      } }),
-      DEFAULT_PULUMI_TIMEOUT_MS,
-      "Pulumi deployment"
+    await withLockRetry(
+      () => withTimeout(
+        stack.up({ onOutput: () => {
+        } }),
+        DEFAULT_PULUMI_TIMEOUT_MS,
+        "Pulumi deployment"
+      ),
+      { accountId: identity.accountId, region, autoConfirm: options.force }
     );
   });
   await progress.execute("Saving configuration", async () => {
@@ -19785,7 +19917,7 @@ Enable it: ${pc21.cyan("wraps email inbound init")}
   const inboundDomains = emailConfig.inboundDomains ?? [];
   const activeRuleSet = await getActiveReceiptRuleSet(region);
   const domainList = inboundDomains.length > 0 ? inboundDomains.map((d) => d.receivingDomain) : [
-    inbound.receivingDomain || `${inbound.subdomain}.${emailConfig.domain}`
+    inbound.receivingDomain || (inbound.subdomain ? `${inbound.subdomain}.${emailConfig.domain}` : emailConfig.domain || "")
   ];
   if (isJsonMode()) {
     jsonSuccess("email.inbound.status", {
@@ -19804,9 +19936,7 @@ Enable it: ${pc21.cyan("wraps email inbound init")}
   console.log(pc21.bold("  Inbound Email Configuration"));
   console.log();
   if (domainList.length === 1) {
-    console.log(
-      `  ${pc21.dim("Receiving domain:")}  ${pc21.cyan(domainList[0])}`
-    );
+    console.log(`  ${pc21.dim("Receiving domain:")}  ${pc21.cyan(domainList[0])}`);
   } else {
     console.log(`  ${pc21.dim("Receiving domains:")}`);
     for (const d of domainList) {
@@ -19850,7 +19980,7 @@ Enable it: ${pc21.cyan("wraps email inbound init")}
   const inbound = emailConfig.inbound;
   const inboundDomains = emailConfig.inboundDomains ?? [];
   const domainList = inboundDomains.length > 0 ? inboundDomains.map((d) => d.receivingDomain) : [
-    inbound.receivingDomain || `${inbound.subdomain}.${emailConfig.domain}`
+    inbound.receivingDomain || (inbound.subdomain ? `${inbound.subdomain}.${emailConfig.domain}` : emailConfig.domain || "")
   ];
   let allPassed = true;
   const domainChecks = {};
@@ -19965,7 +20095,7 @@ Enable it: ${pc21.cyan("wraps email inbound init")}
   }
   const emailConfig = metadata.services.email.config;
   const inbound = emailConfig.inbound;
-  const receivingDomain = inbound.receivingDomain || `${inbound.subdomain}.${emailConfig.domain}`;
+  const receivingDomain = inbound.receivingDomain || (inbound.subdomain ? `${inbound.subdomain}.${emailConfig.domain}` : emailConfig.domain || "");
   const bucketName = inbound.bucketName || `wraps-inbound-${identity.accountId}-${region}`;
   const testRecipient = `test@${receivingDomain}`;
   const testSubject = `Wraps Inbound Test - ${(/* @__PURE__ */ new Date()).toISOString()}`;
@@ -20108,11 +20238,9 @@ async function inboundAdd(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.email?.config?.inbound?.enabled) {
     clack20.log.error("Inbound email infrastructure is not deployed.");
-    console.log(
-      `
+    console.log(`
 Deploy first: ${pc21.cyan("wraps email inbound init")}
-`
-    );
+`);
     process.exit(1);
   }
   const emailConfig = metadata.services.email.config;
@@ -20145,8 +20273,8 @@ Deploy first: ${pc21.cyan("wraps email inbound init")}
       parentDomain = selected;
     }
   }
-  const subdomain = options.subdomain || (options.yes ? "inbound" : await promptInboundSubdomain(parentDomain));
-  const receivingDomain = `${subdomain}.${parentDomain}`;
+  const subdomain = options.root ? "" : options.subdomain ?? (options.yes ? "inbound" : await promptInboundSubdomain(parentDomain));
+  const receivingDomain = subdomain ? `${subdomain}.${parentDomain}` : parentDomain;
   const existingDomains = emailConfig.inboundDomains ?? [];
   if (existingDomains.some((d) => d.receivingDomain === receivingDomain)) {
     clack20.log.warn(
@@ -20279,16 +20407,12 @@ Deploy first: ${pc21.cyan("wraps email inbound init")}
     `${pc21.bold("Added inbound domain:")} ${pc21.cyan(receivingDomain)}`
   );
   console.log();
-  if (!dnsAutoCreated) {
-    console.log(
-      `  ${pc21.dim("1.")} Add DNS records above to your DNS provider`
-    );
-    console.log(
-      `  ${pc21.dim("2.")} Verify: ${pc21.cyan("wraps email inbound verify")}`
-    );
+  if (dnsAutoCreated) {
+    console.log(`  Verify: ${pc21.cyan("wraps email inbound verify")}`);
   } else {
+    console.log(`  ${pc21.dim("1.")} Add DNS records above to your DNS provider`);
     console.log(
-      `  Verify: ${pc21.cyan("wraps email inbound verify")}`
+      `  ${pc21.dim("2.")} Verify: ${pc21.cyan("wraps email inbound verify")}`
     );
   }
   console.log();
@@ -20306,11 +20430,9 @@ async function inboundRemove(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.email?.config?.inbound?.enabled) {
     clack20.log.error("Inbound email infrastructure is not deployed.");
-    console.log(
-      `
+    console.log(`
 Deploy first: ${pc21.cyan("wraps email inbound init")}
-`
-    );
+`);
     process.exit(1);
   }
   const emailConfig = metadata.services.email.config;
@@ -20803,12 +20925,19 @@ ${pc24.yellow(pc24.bold("Configuration Warnings:"))}`);
           `wraps-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
-        const upResult = await withTimeout(
-          stack.up({ onOutput: () => {
-          } }),
-          // Suppress Pulumi output
-          DEFAULT_PULUMI_TIMEOUT_MS,
-          "Pulumi deployment"
+        const upResult = await withLockRetry(
+          () => withTimeout(
+            stack.up({ onOutput: () => {
+            } }),
+            // Suppress Pulumi output
+            DEFAULT_PULUMI_TIMEOUT_MS,
+            "Pulumi deployment"
+          ),
+          {
+            accountId: identity.accountId,
+            region,
+            autoConfirm: options.yes || options.quick
+          }
         );
         const pulumiOutputs = upResult.outputs;
         return {
@@ -20835,10 +20964,6 @@ ${pc24.yellow(pc24.bold("Configuration Warnings:"))}`);
       region,
       duration_ms: Date.now() - startTime
     });
-    if (msg.includes("stack is currently locked")) {
-      trackError("STACK_LOCKED", "email:init", { step: "deploy" });
-      throw errors.stackLocked();
-    }
     if (isPulumiError(error)) {
       const { code, iamAction, service } = parsePulumiError(error);
       trackError(`PULUMI_${code}`, "email:init", {
@@ -20956,6 +21081,7 @@ ${pc24.yellow(pc24.bold("Configuration Warnings:"))}`);
                   domain: outputs.domain,
                   dkimTokens: outputs.dkimTokens,
                   mailFromDomain: outputs.mailFromDomain,
+                  customTrackingDomain: outputs.customTrackingDomain,
                   region
                 },
                 selectedCategories
@@ -20988,6 +21114,7 @@ ${pc24.yellow(pc24.bold("Configuration Warnings:"))}`);
             domain: outputs.domain,
             dkimTokens: outputs.dkimTokens,
             mailFromDomain: outputs.mailFromDomain,
+            customTrackingDomain: outputs.customTrackingDomain,
             region
           };
           const records = buildEmailDNSRecords2(recordData);
@@ -22001,8 +22128,8 @@ async function templatesInit(options) {
     const { homedir: homedir3 } = await import("os");
     const connectionsDir = join9(homedir3(), ".wraps", "connections");
     if (existsSync8(connectionsDir)) {
-      const { readdir: readdir4 } = await import("fs/promises");
-      const files = await readdir4(connectionsDir);
+      const { readdir: readdir5 } = await import("fs/promises");
+      const files = await readdir5(connectionsDir);
       if (files.length > 0) {
         const firstFile = files[0];
         const match = firstFile.match(/\d+-(.+)\.json$/);
@@ -22321,7 +22448,7 @@ import pc28 from "picocolors";
 // src/utils/email/template-compiler.ts
 init_esm_shims();
 import { existsSync as existsSync9 } from "fs";
-import { mkdir as mkdir4, readdir as readdir2, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir3, writeFile as writeFile6 } from "fs/promises";
 import { join as join10 } from "path";
 async function loadWrapsConfig(wrapsDir) {
   const configPath = join10(wrapsDir, "wraps.config.ts");
@@ -22356,7 +22483,7 @@ async function loadWrapsConfig(wrapsDir) {
   return config2;
 }
 async function discoverTemplates(dir, filter) {
-  const entries = await readdir2(dir);
+  const entries = await readdir3(dir);
   const templates = entries.filter(
     (f) => (f.endsWith(".tsx") || f.endsWith(".ts")) && !f.startsWith("_") && !f.endsWith(".d.ts")
   );
@@ -24864,6 +24991,7 @@ ${pc30.bold("Cost Impact:")}`);
           domain: outputs.domain,
           dkimTokens: outputs.dkimTokens,
           mailFromDomain,
+          customTrackingDomain: outputs.customTrackingDomain,
           region
         };
         try {
@@ -24914,6 +25042,7 @@ ${pc30.bold("Cost Impact:")}`);
         domain: outputs.domain,
         dkimTokens: outputs.dkimTokens,
         mailFromDomain,
+        customTrackingDomain: outputs.customTrackingDomain,
         region
       };
       const dnsRecords = buildEmailDNSRecords(dnsData);
@@ -25630,8 +25759,8 @@ async function workflowsInit(options) {
   }
   const progress = new DeploymentProgress();
   if (existsSync13(workflowsDir) && !options.force) {
-    const { readdir: readdir4 } = await import("fs/promises");
-    const files = await readdir4(workflowsDir);
+    const { readdir: readdir5 } = await import("fs/promises");
+    const files = await readdir5(workflowsDir);
     const tsFiles = files.filter(
       (f) => f.endsWith(".ts") && !f.startsWith("_")
     );
@@ -25965,13 +26094,13 @@ function assignPositions(steps, transitions) {
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync14 } from "fs";
-import { mkdir as mkdir8, readdir as readdir3, readFile as readFile8, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir8, readdir as readdir4, readFile as readFile8, writeFile as writeFile10 } from "fs/promises";
 import { basename, join as join15 } from "path";
 async function discoverWorkflows(dir, filter) {
   if (!existsSync14(dir)) {
     return [];
   }
-  const entries = await readdir3(dir);
+  const entries = await readdir4(dir);
   const workflows = entries.filter(
     (f) => (
       // Include .ts files only (not .tsx for workflows)
@@ -32946,7 +33075,6 @@ import * as pulumi26 from "@pulumi/pulumi";
 import pc43 from "picocolors";
 init_events();
 init_aws();
-init_errors();
 init_fs();
 init_json_output();
 init_metadata();
@@ -33624,7 +33752,10 @@ ${pc43.yellow(pc43.bold("Important Notes:"))}`);
           }
         );
         await stack.setConfig("aws:region", { value: region });
-        const upResult = await stack.up({ onOutput: console.log });
+        const upResult = await withLockRetry(
+          () => stack.up({ onOutput: console.log }),
+          { accountId: identity.accountId, region, autoConfirm: options.yes }
+        );
         const pulumiOutputs = upResult.outputs;
         return {
           roleArn: pulumiOutputs.roleArn?.value,
@@ -33707,10 +33838,6 @@ ${pc43.yellow(pc43.bold("Important Notes:"))}`);
       duration_ms: Date.now() - startTime
     });
     const errorMessage = error instanceof Error ? error.message : String(error);
-    if (errorMessage.includes("stack is currently locked")) {
-      trackError("STACK_LOCKED", "sms:init", { step: "deploy" });
-      throw errors.stackLocked();
-    }
     trackError("DEPLOYMENT_FAILED", "sms:init", { step: "deploy" });
     throw new Error(`SMS deployment failed: ${errorMessage}`);
   }