@wraps.dev/cli 2.18.6 → 2.18.8

package/dist/cli.js

@@ -66,1533 +66,736 @@ var init_ci_detection = __esm({
   }
 });
 
-// src/utils/shared/s3-state.ts
-var s3_state_exports = {};
-__export(s3_state_exports, {
-  clearS3StackLocks: () => clearS3StackLocks,
-  deleteMetadata: () => deleteMetadata,
-  downloadMetadata: () => downloadMetadata,
-  ensureStateBucket: () => ensureStateBucket,
-  getS3BackendUrl: () => getS3BackendUrl,
-  getStateBucketName: () => getStateBucketName,
-  migrateLocalPulumiState: () => migrateLocalPulumiState,
-  needsMigration: () => needsMigration,
-  stateBucketExists: () => stateBucketExists,
-  uploadMetadata: () => uploadMetadata
-});
-import { existsSync, statSync } from "fs";
-import { readdir, writeFile } from "fs/promises";
+// src/utils/shared/aws-detection.ts
+import { execSync } from "child_process";
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { homedir } from "os";
 import { join } from "path";
-function has404StatusCode(error) {
-  if (!(error instanceof Error)) {
+import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+async function isAWSCLIInstalled() {
+  try {
+    execSync("aws --version", { stdio: "pipe" });
+    return true;
+  } catch {
     return false;
   }
-  const metadataError = error;
-  return metadataError.$metadata?.httpStatusCode === 404;
-}
-function getStateBucketName(accountId, region) {
-  return `wraps-state-${accountId}-${region}`;
-}
-function getS3BackendUrl(accountId, region) {
-  return `s3://${getStateBucketName(accountId, region)}`;
 }
-async function stateBucketExists(accountId, region) {
-  const { S3Client: S3Client2, HeadBucketCommand } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region });
-  const bucketName = getStateBucketName(accountId, region);
+async function getAWSCLIVersion() {
   try {
-    await client.send(new HeadBucketCommand({ Bucket: bucketName }));
-    return true;
-  } catch (error) {
-    if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchBucket" || has404StatusCode(error))) {
-      return false;
-    }
-    throw error;
+    const output3 = execSync("aws --version", { encoding: "utf-8" });
+    const match = output3.match(/aws-cli\/(\d+\.\d+\.\d+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
   }
 }
-async function ensureStateBucket(accountId, region) {
-  const {
-    S3Client: S3Client2,
-    HeadBucketCommand,
-    CreateBucketCommand,
-    PutBucketEncryptionCommand,
-    PutBucketVersioningCommand,
-    PutPublicAccessBlockCommand,
-    PutBucketTaggingCommand
-  } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region });
-  const bucketName = getStateBucketName(accountId, region);
-  try {
-    await client.send(new HeadBucketCommand({ Bucket: bucketName }));
-    return bucketName;
-  } catch (error) {
-    const isNotFound = error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchBucket" || has404StatusCode(error));
-    if (!isNotFound) {
-      throw error;
+function detectCredentialSource() {
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+    return "environment";
+  }
+  if (process.env.AWS_SSO_ACCOUNT_ID || process.env.AWS_SSO_SESSION) {
+    return "sso";
+  }
+  if (process.env.AWS_PROFILE) {
+    return "profile";
+  }
+  const credentialsPath = join(homedir(), ".aws", "credentials");
+  if (existsSync(credentialsPath)) {
+    const content = readFileSync(credentialsPath, "utf-8");
+    if (content.includes("[default]")) {
+      return "profile";
     }
   }
-  const createParams = { Bucket: bucketName };
-  if (region !== "us-east-1") {
-    createParams.CreateBucketConfiguration = {
-      LocationConstraint: region
-    };
+  const ssoCachePath = join(homedir(), ".aws", "sso", "cache");
+  if (existsSync(ssoCachePath)) {
+    return "sso";
   }
-  await client.send(new CreateBucketCommand(createParams));
-  await client.send(
-    new PutBucketEncryptionCommand({
-      Bucket: bucketName,
-      ServerSideEncryptionConfiguration: {
-        Rules: [
-          {
-            ApplyServerSideEncryptionByDefault: {
-              SSEAlgorithm: "AES256"
-            }
-          }
-        ]
-      }
-    })
-  );
-  await client.send(
-    new PutBucketVersioningCommand({
-      Bucket: bucketName,
-      VersioningConfiguration: {
-        Status: "Enabled"
-      }
-    })
-  );
-  await client.send(
-    new PutPublicAccessBlockCommand({
-      Bucket: bucketName,
-      PublicAccessBlockConfiguration: {
-        BlockPublicAcls: true,
-        BlockPublicPolicy: true,
-        IgnorePublicAcls: true,
-        RestrictPublicBuckets: true
-      }
-    })
-  );
-  await client.send(
-    new PutBucketTaggingCommand({
-      Bucket: bucketName,
-      Tagging: {
-        TagSet: [
-          { Key: "ManagedBy", Value: "wraps-cli" },
-          { Key: "Purpose", Value: "state" }
-        ]
-      }
-    })
-  );
-  return bucketName;
-}
-async function uploadMetadata(bucketName, metadata) {
-  const { S3Client: S3Client2, PutObjectCommand } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region: metadata.region });
-  const key = `metadata/${metadata.accountId}-${metadata.region}.json`;
-  await client.send(
-    new PutObjectCommand({
-      Bucket: bucketName,
-      Key: key,
-      Body: JSON.stringify(metadata, null, 2),
-      ContentType: "application/json"
-    })
-  );
-}
-async function deleteMetadata(bucketName, accountId, region) {
-  const { S3Client: S3Client2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region });
-  const key = `metadata/${accountId}-${region}.json`;
-  await client.send(
-    new DeleteObjectCommand({
-      Bucket: bucketName,
-      Key: key
-    })
-  );
+  if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_EXECUTION_ENV) {
+    return "instance";
+  }
+  return null;
 }
-async function clearS3StackLocks(accountId, region) {
-  const { S3Client: S3Client2, ListObjectsV2Command: ListObjectsV2Command2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region });
-  const bucketName = getStateBucketName(accountId, region);
-  const prefix = ".pulumi/locks/";
-  const response = await client.send(
-    new ListObjectsV2Command2({ Bucket: bucketName, Prefix: prefix })
-  );
-  const lockObjects = response.Contents ?? [];
-  if (lockObjects.length === 0) {
-    return 0;
+function detectHostingProvider() {
+  if (process.env.VERCEL || process.env.VERCEL_ENV) {
+    return "vercel";
   }
-  for (const obj of lockObjects) {
-    if (obj.Key) {
-      await client.send(
-        new DeleteObjectCommand({ Bucket: bucketName, Key: obj.Key })
-      );
-    }
+  if (process.env.RAILWAY_ENVIRONMENT || process.env.RAILWAY_PROJECT_ID) {
+    return "railway";
   }
-  return lockObjects.length;
+  if (process.env.NETLIFY || process.env.NETLIFY_DEV) {
+    return "netlify";
+  }
+  if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_EXECUTION_ENV || process.env.ECS_CONTAINER_METADATA_URI || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
+    return "aws";
+  }
+  return null;
 }
-async function downloadMetadata(bucketName, accountId, region) {
-  const { S3Client: S3Client2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
-  const client = new S3Client2({ region });
-  const key = `metadata/${accountId}-${region}.json`;
+async function validateCredentials() {
   try {
-    const response = await client.send(
-      new GetObjectCommand2({
-        Bucket: bucketName,
-        Key: key
-      })
-    );
-    const body = await response.Body?.transformToString();
-    if (!body) {
-      return null;
-    }
-    return JSON.parse(body);
-  } catch (error) {
-    if (error instanceof Error && (error.name === "NoSuchKey" || has404StatusCode(error))) {
-      return null;
-    }
-    throw error;
+    const sts = new STSClient({ region: "us-east-1" });
+    const identity = await sts.send(new GetCallerIdentityCommand({}));
+    return identity.Account || null;
+  } catch {
+    return null;
   }
 }
-async function needsMigration(localPulumiDir, accountId, region) {
-  const markerPath = join(localPulumiDir, `.migrated-${accountId}-${region}`);
-  if (existsSync(markerPath)) {
-    return false;
+function getCurrentProfile() {
+  return process.env.AWS_PROFILE || "default";
+}
+function getCurrentRegion() {
+  if (process.env.AWS_REGION) {
+    return process.env.AWS_REGION;
   }
-  const stacksDir = join(localPulumiDir, ".pulumi", "stacks");
-  if (!existsSync(stacksDir)) {
-    return false;
+  if (process.env.AWS_DEFAULT_REGION) {
+    return process.env.AWS_DEFAULT_REGION;
   }
   try {
-    const entries = await readdir(stacksDir);
-    for (const entry of entries) {
-      const entryPath = join(stacksDir, entry);
-      if (statSync(entryPath).isDirectory()) {
-        const files = await readdir(entryPath);
-        const matching = files.filter(
-          (f) => f.includes(accountId) && f.includes(region) && f.endsWith(".json")
-        );
-        if (matching.length > 0) {
-          return true;
-        }
-      }
-    }
-    return false;
+    const region = execSync("aws configure get region", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    return region || null;
   } catch {
-    return false;
+    return null;
   }
 }
-async function migrateLocalPulumiState(localPulumiDir, bucketName, accountId, region) {
-  const pulumi31 = await import("@pulumi/pulumi/automation/index.js");
-  const stacksDir = join(localPulumiDir, ".pulumi", "stacks");
-  const entries = await readdir(stacksDir);
-  for (const entry of entries) {
-    const entryPath = join(stacksDir, entry);
-    if (!statSync(entryPath).isDirectory()) {
-      continue;
-    }
-    const projectName = entry;
-    const files = await readdir(entryPath);
-    const stackFiles = files.filter(
-      (f) => f.includes(accountId) && f.includes(region) && f.endsWith(".json")
-    );
-    for (const stackFile of stackFiles) {
-      const stackName = stackFile.replace(".json", "");
-      try {
-        const localStack = await pulumi31.LocalWorkspace.selectStack({
-          stackName,
-          workDir: localPulumiDir
-        });
-        const state = await localStack.exportStack();
-        const s3Stack = await pulumi31.LocalWorkspace.createOrSelectStack(
-          {
-            stackName,
-            projectName,
-            program: async () => ({})
-          },
-          {
-            workDir: localPulumiDir,
-            envVars: {
-              PULUMI_BACKEND_URL: `s3://${bucketName}`,
-              PULUMI_CONFIG_PASSPHRASE: ""
-            }
-          }
-        );
-        await s3Stack.importStack(state);
-      } catch (error) {
-        console.error(
-          `Warning: Failed to migrate stack ${stackName}: ${error instanceof Error ? error.message : error}`
-        );
+function parseSSOProfiles() {
+  const configPath = join(homedir(), ".aws", "config");
+  if (!existsSync(configPath)) {
+    return [];
+  }
+  const content = readFileSync(configPath, "utf-8");
+  const profiles = [];
+  const sessionMap = /* @__PURE__ */ new Map();
+  const sessionSections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sessionSections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (header?.startsWith("sso-session ")) {
+      const sessionName = header.replace("sso-session ", "");
+      const config2 = {};
+      for (const line of lines.slice(1)) {
+        const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+        if (match) {
+          config2[match[1]] = match[2];
+        }
       }
+      sessionMap.set(sessionName, {
+        startUrl: config2.sso_start_url || "",
+        region: config2.sso_region || ""
+      });
     }
   }
-  const markerPath = join(localPulumiDir, `.migrated-${accountId}-${region}`);
-  await writeFile(markerPath, (/* @__PURE__ */ new Date()).toISOString(), "utf-8");
-}
-var init_s3_state = __esm({
-  "src/utils/shared/s3-state.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
-// src/utils/shared/fs.ts
-var fs_exports = {};
-__export(fs_exports, {
-  clearLocalStackLocks: () => clearLocalStackLocks,
-  ensurePulumiWorkDir: () => ensurePulumiWorkDir,
-  ensureWrapsDir: () => ensureWrapsDir,
-  getPulumiWorkDir: () => getPulumiWorkDir,
-  getWrapsDir: () => getWrapsDir
-});
-import { existsSync as existsSync2 } from "fs";
-import { mkdir, readdir as readdir2, rm } from "fs/promises";
-import { homedir } from "os";
-import { join as join2 } from "path";
-function getWrapsDir() {
-  return join2(homedir(), ".wraps");
-}
-function getPulumiWorkDir() {
-  return join2(getWrapsDir(), "pulumi");
-}
-async function ensureWrapsDir() {
-  const wrapsDir = getWrapsDir();
-  if (!existsSync2(wrapsDir)) {
-    await mkdir(wrapsDir, { recursive: true });
+  const sections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (!header?.startsWith("profile ") && header !== "default") {
+      continue;
+    }
+    const profileName = header === "default" ? "default" : header.replace("profile ", "");
+    const config2 = {};
+    for (const line of lines.slice(1)) {
+      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+      if (match) {
+        config2[match[1]] = match[2];
+      }
+    }
+    if (config2.sso_start_url || config2.sso_session) {
+      let ssoStartUrl = config2.sso_start_url || "";
+      let ssoRegion = config2.sso_region || "";
+      if (config2.sso_session) {
+        const session = sessionMap.get(config2.sso_session);
+        if (session) {
+          ssoStartUrl = ssoStartUrl || session.startUrl;
+          ssoRegion = ssoRegion || session.region;
+        }
+      }
+      profiles.push({
+        name: profileName,
+        ssoStartUrl,
+        ssoRegion,
+        ssoAccountId: config2.sso_account_id || "",
+        ssoRoleName: config2.sso_role_name || "",
+        region: config2.region,
+        ssoSession: config2.sso_session
+      });
+    }
   }
+  return profiles;
 }
-async function clearLocalStackLocks() {
-  const locksDir = join2(getPulumiWorkDir(), ".pulumi", "locks");
-  if (!existsSync2(locksDir)) {
-    return 0;
+function parseSSOSessions() {
+  const configPath = join(homedir(), ".aws", "config");
+  if (!existsSync(configPath)) {
+    return [];
   }
-  let count = 0;
-  async function walkAndDelete(dir) {
-    const entries = await readdir2(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = join2(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walkAndDelete(fullPath);
-      } else if (entry.name.endsWith(".json")) {
-        await rm(fullPath);
-        count++;
+  const content = readFileSync(configPath, "utf-8");
+  const sessions = [];
+  const sections = content.split(/^\[/m).filter(Boolean);
+  for (const section of sections) {
+    const lines = section.split("\n");
+    const header = lines[0]?.replace("]", "").trim();
+    if (!header?.startsWith("sso-session ")) {
+      continue;
+    }
+    const sessionName = header.replace("sso-session ", "");
+    const config2 = {};
+    for (const line of lines.slice(1)) {
+      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
+      if (match) {
+        config2[match[1]] = match[2];
       }
     }
+    sessions.push({
+      name: sessionName,
+      ssoStartUrl: config2.sso_start_url || "",
+      ssoRegion: config2.sso_region || "",
+      ssoRegistrationScopes: config2.sso_registration_scopes?.split(",").map((s) => s.trim())
+    });
   }
-  await walkAndDelete(locksDir);
-  return count;
+  return sessions;
 }
-async function ensurePulumiWorkDir(options) {
-  await ensureWrapsDir();
-  const pulumiDir = getPulumiWorkDir();
-  if (!existsSync2(pulumiDir)) {
-    await mkdir(pulumiDir, { recursive: true });
+function checkSSOTokenStatus(startUrl) {
+  const ssoCachePath = join(homedir(), ".aws", "sso", "cache");
+  if (!existsSync(ssoCachePath)) {
+    return {
+      valid: false,
+      expiresAt: null,
+      expired: true,
+      minutesRemaining: null,
+      startUrl: null
+    };
   }
-  process.env.PULUMI_CONFIG_PASSPHRASE = "";
-  const useS3 = options?.accountId && options?.region && process.env.WRAPS_LOCAL_ONLY !== "1";
-  if (useS3) {
-    try {
-      const {
-        ensureStateBucket: ensureStateBucket2,
-        getS3BackendUrl: getS3BackendUrl2,
-        needsMigration: needsMigration2,
-        migrateLocalPulumiState: migrateLocalPulumiState2
-      } = await Promise.resolve().then(() => (init_s3_state(), s3_state_exports));
-      const bucketName = await ensureStateBucket2(
-        options.accountId,
-        options.region
-      );
-      const shouldMigrate = await needsMigration2(
-        pulumiDir,
-        options.accountId,
-        options.region
-      );
-      if (shouldMigrate) {
-        process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
-        await migrateLocalPulumiState2(
-          pulumiDir,
-          bucketName,
-          options.accountId,
-          options.region
-        );
+  try {
+    const cacheFiles = readdirSync(ssoCachePath).filter(
+      (f) => f.endsWith(".json")
+    );
+    for (const file of cacheFiles) {
+      const content = readFileSync(join(ssoCachePath, file), "utf-8");
+      const token = JSON.parse(content);
+      if (!(token.accessToken && token.expiresAt)) {
+        continue;
       }
-      process.env.PULUMI_BACKEND_URL = getS3BackendUrl2(
-        options.accountId,
-        options.region
-      );
-      return;
-    } catch (error) {
-      const clack54 = await import("@clack/prompts");
-      clack54.log.warn(
-        `S3 state backend unavailable (${error instanceof Error ? error.message : error}). Using local state.`
+      if (startUrl && token.startUrl !== startUrl) {
+        continue;
+      }
+      const expiresAt = new Date(token.expiresAt);
+      const now = /* @__PURE__ */ new Date();
+      const expired = expiresAt <= now;
+      const minutesRemaining = Math.floor(
+        (expiresAt.getTime() - now.getTime()) / 6e4
       );
+      return {
+        valid: !expired,
+        expiresAt,
+        expired,
+        minutesRemaining,
+        startUrl: token.startUrl || null
+      };
     }
+  } catch {
   }
-  process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
+  return {
+    valid: false,
+    expiresAt: null,
+    expired: true,
+    minutesRemaining: null,
+    startUrl: null
+  };
 }
-var init_fs = __esm({
-  "src/utils/shared/fs.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
-// src/utils/shared/config.ts
-import { existsSync as existsSync3 } from "fs";
-import { chmod, readFile, writeFile as writeFile2 } from "fs/promises";
-import { join as join3 } from "path";
-function getApiBaseUrl() {
-  return process.env.WRAPS_API_URL || "https://api.wraps.dev";
+function getActiveSSOProfile(profiles) {
+  const currentProfile = process.env.AWS_PROFILE || "default";
+  return profiles.find((p) => p.name === currentProfile) || null;
 }
-function getAppBaseUrl() {
-  return process.env.WRAPS_APP_URL || "https://app.wraps.dev";
+function getSSOLoginCommand(profile) {
+  if (profile && profile !== "default") {
+    return `aws sso login --profile ${profile}`;
+  }
+  return "aws sso login";
 }
-function getConfigPath() {
-  return join3(getWrapsDir(), CONFIG_FILE);
-}
-async function readAuthConfig() {
-  const path3 = getConfigPath();
-  if (!existsSync3(path3)) {
-    return null;
-  }
-  try {
-    const content = await readFile(path3, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
+function formatSSOProfile(profile) {
+  return `${profile.name} (${profile.ssoAccountId} / ${profile.ssoRoleName})`;
 }
-async function saveAuthConfig(config2) {
-  await ensureWrapsDir();
-  const path3 = getConfigPath();
-  const existing = await readAuthConfig();
-  const merged = existing ? { ...existing, ...config2 } : config2;
-  await writeFile2(path3, JSON.stringify(merged, null, 2), "utf-8");
-  await chmod(path3, 384);
+async function detectAWSState() {
+  const [cliInstalled, cliVersion, accountId] = await Promise.all([
+    isAWSCLIInstalled(),
+    getAWSCLIVersion(),
+    validateCredentials()
+  ]);
+  const credentialSource = detectCredentialSource();
+  const detectedProvider = detectHostingProvider();
+  const region = getCurrentRegion();
+  const profileName = getCurrentProfile();
+  const ssoProfiles = parseSSOProfiles();
+  const ssoSessions = parseSSOSessions();
+  const activeProfile = getActiveSSOProfile(ssoProfiles);
+  const tokenStatus = ssoProfiles.length > 0 ? checkSSOTokenStatus(activeProfile?.ssoStartUrl) : null;
+  const isUsingSSO = credentialSource === "sso" || activeProfile !== null && accountId !== null;
+  return {
+    cliInstalled,
+    cliVersion,
+    credentialsConfigured: accountId !== null,
+    credentialSource: isUsingSSO ? "sso" : accountId !== null ? credentialSource : null,
+    profileName,
+    accountId,
+    detectedProvider,
+    region,
+    sso: {
+      configured: ssoProfiles.length > 0,
+      profiles: ssoProfiles,
+      sessions: ssoSessions,
+      tokenStatus,
+      activeProfile: isUsingSSO ? activeProfile : null
+    }
+  };
 }
-async function clearAuthConfig() {
-  const existing = await readAuthConfig();
-  if (existing) {
-    existing.auth = void 0;
-    await saveAuthConfig(existing);
-  }
+function hasCredentialsFile() {
+  const credentialsPath = join(homedir(), ".aws", "credentials");
+  return existsSync(credentialsPath);
 }
-function resolveToken(flags2) {
-  return flags2?.token || process.env.WRAPS_API_KEY || null;
+function hasConfigFile() {
+  const configPath = join(homedir(), ".aws", "config");
+  return existsSync(configPath);
 }
-async function resolveTokenAsync(flags2) {
-  const sync = resolveToken(flags2);
-  if (sync) {
-    return sync;
-  }
-  const config2 = await readAuthConfig();
-  if (!config2?.auth?.token) {
-    return null;
+function getConfiguredProfiles() {
+  const profiles = [];
+  const credentialsPath = join(homedir(), ".aws", "credentials");
+  if (existsSync(credentialsPath)) {
+    const content = readFileSync(credentialsPath, "utf-8");
+    const matches = content.matchAll(/\[([^\]]+)\]/g);
+    for (const match of matches) {
+      profiles.push(match[1]);
+    }
   }
-  if (config2.auth.expiresAt && new Date(config2.auth.expiresAt) <= /* @__PURE__ */ new Date()) {
-    return null;
+  const configPath = join(homedir(), ".aws", "config");
+  if (existsSync(configPath)) {
+    const content = readFileSync(configPath, "utf-8");
+    const matches = content.matchAll(/\[profile ([^\]]+)\]/g);
+    for (const match of matches) {
+      if (!profiles.includes(match[1])) {
+        profiles.push(match[1]);
+      }
+    }
   }
-  return config2.auth.token;
+  return profiles;
 }
-var CONFIG_FILE;
-var init_config = __esm({
-  "src/utils/shared/config.ts"() {
+var init_aws_detection = __esm({
+  "src/utils/shared/aws-detection.ts"() {
     "use strict";
     init_esm_shims();
-    init_fs();
-    CONFIG_FILE = "config.json";
   }
 });
 
-// src/telemetry/config.ts
-import Conf from "conf";
-import { v4 as uuidv4 } from "uuid";
-var CONFIG_DEFAULTS, TelemetryConfigManager;
-var init_config2 = __esm({
-  "src/telemetry/config.ts"() {
+// src/utils/shared/json-output.ts
+function isJsonMode() {
+  return _jsonMode;
+}
+function setJsonMode(enabled) {
+  _jsonMode = enabled;
+}
+function jsonSuccess(command, data) {
+  const output3 = { success: true, command, data };
+  console.log(JSON.stringify(output3));
+}
+function jsonError(command, error) {
+  const output3 = { success: false, command, error };
+  console.log(JSON.stringify(output3));
+}
+var _jsonMode;
+var init_json_output = __esm({
+  "src/utils/shared/json-output.ts"() {
     "use strict";
     init_esm_shims();
-    CONFIG_DEFAULTS = {
-      enabled: true,
-      anonymousId: uuidv4(),
-      notificationShown: false
-    };
-    TelemetryConfigManager = class {
-      config;
-      constructor(options) {
-        this.config = new Conf({
-          projectName: "wraps",
-          configName: "telemetry",
-          defaults: CONFIG_DEFAULTS,
-          cwd: options?.cwd
-        });
-      }
-      /**
-       * Check if telemetry is enabled
-       */
-      isEnabled() {
-        return this.config.get("enabled");
-      }
-      /**
-       * Enable or disable telemetry
-       */
-      setEnabled(enabled) {
-        this.config.set("enabled", enabled);
-      }
-      /**
-       * Get the anonymous user ID
-       */
-      getAnonymousId() {
-        return this.config.get("anonymousId");
-      }
-      /**
-       * Check if the first-run notification has been shown
-       */
-      hasShownNotification() {
-        return this.config.get("notificationShown");
-      }
-      /**
-       * Mark the first-run notification as shown
-       */
-      markNotificationShown() {
-        this.config.set("notificationShown", true);
-      }
-      /**
-       * Get the full path to the configuration file
-       */
-      getConfigPath() {
-        return this.config.path;
-      }
-      /**
-       * Reset configuration to defaults
-       */
-      reset() {
-        this.config.clear();
-        this.config.set({
-          ...CONFIG_DEFAULTS,
-          anonymousId: uuidv4()
-        });
-      }
-    };
+    _jsonMode = false;
   }
 });
 
-// src/telemetry/client.ts
-import { readFileSync } from "fs";
-import { dirname, join as join4 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+// src/utils/shared/errors.ts
+var errors_exports = {};
+__export(errors_exports, {
+  WrapsError: () => WrapsError,
+  awsErrorToWrapsError: () => awsErrorToWrapsError,
+  classifyDNSError: () => classifyDNSError,
+  errors: () => errors,
+  handleCLIError: () => handleCLIError,
+  isAWSError: () => isAWSError,
+  isAWSNotFoundError: () => isAWSNotFoundError,
+  isPulumiError: () => isPulumiError,
+  parseAWSError: () => parseAWSError,
+  parsePulumiError: () => parsePulumiError,
+  redactSensitiveValues: () => redactSensitiveValues,
+  sanitizeErrorMessage: () => sanitizeErrorMessage
+});
+import * as clack from "@clack/prompts";
 import pc from "picocolors";
-function getTelemetryClient() {
-  if (!telemetryInstance) {
-    telemetryInstance = new TelemetryClient();
+function isAWSError(error) {
+  if (!(error instanceof Error)) {
+    return false;
   }
-  return telemetryInstance;
+  const awsErrorNames = [
+    "ExpiredTokenException",
+    "InvalidClientTokenId",
+    "AccessDenied",
+    "AccessDeniedException",
+    "UnauthorizedAccess",
+    "InvalidAccessKeyId",
+    "SignatureDoesNotMatch",
+    "UnrecognizedClientException",
+    "CredentialsError",
+    "TokenRefreshRequired",
+    "SSOTokenExpired"
+  ];
+  return awsErrorNames.includes(error.name) || "$metadata" in error;
 }
-var DEFAULT_ENDPOINT, DEFAULT_TIMEOUT, TelemetryClient, telemetryInstance;
-var init_client = __esm({
-  "src/telemetry/client.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_ci_detection();
-    init_config();
-    init_config2();
-    DEFAULT_ENDPOINT = process.env.WRAPS_TELEMETRY_URL || "https://wraps.dev/api/telemetry";
-    DEFAULT_TIMEOUT = 2e3;
-    TelemetryClient = class {
-      config;
-      endpoint;
-      timeout;
-      debug;
-      enabled;
-      eventQueue = [];
-      flushTimer;
-      hasShownFooter = false;
-      userId;
-      userIdResolved = false;
-      constructor(options = {}) {
-        this.config = new TelemetryConfigManager();
-        this.endpoint = options.endpoint || DEFAULT_ENDPOINT;
-        this.timeout = options.timeout || DEFAULT_TIMEOUT;
-        this.debug = options.debug || process.env.WRAPS_TELEMETRY_DEBUG === "1";
-        this.enabled = this.shouldBeEnabled();
-        this.resolveUserId();
-      }
-      /**
-       * Resolve authenticated user identity from CLI auth config.
-       * Uses the first organization ID as the user identifier,
-       * linking CLI telemetry to the same org tracked on the web dashboard.
-       */
-      async resolveUserId() {
-        try {
-          const config2 = await readAuthConfig();
-          if (config2?.auth?.token && config2.auth.organizations?.length) {
-            this.userId = config2.auth.organizations[0].id;
-          }
-        } catch {
-        } finally {
-          this.userIdResolved = true;
-        }
-      }
-      /**
-       * Determine if telemetry should be enabled based on environment and config
-       */
-      shouldBeEnabled() {
-        if (process.env.DO_NOT_TRACK === "1") {
-          return false;
-        }
-        if (process.env.WRAPS_TELEMETRY_DISABLED === "1") {
-          return false;
-        }
-        if (isCI()) {
-          return false;
-        }
-        if (!this.config.isEnabled()) {
-          return false;
-        }
-        return true;
-      }
-      /**
-       * Track an event
-       *
-       * @param event - Event name in format "category:action" (e.g., "command:init")
-       * @param properties - Additional event properties (no PII)
-       */
-      track(event, properties) {
-        const telemetryEvent = {
-          event,
-          properties: {
-            ...properties,
-            cli_version: this.getCLIVersion(),
-            os: process.platform,
-            node_version: process.version,
-            ci: isCI()
-          },
-          anonymousId: this.config.getAnonymousId(),
-          ...this.userId ? { userId: this.userId } : {},
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        if (this.debug) {
-          console.log(
-            "[Telemetry Debug] Event:",
-            JSON.stringify(telemetryEvent, null, 2)
-          );
-          return;
-        }
-        if (!this.enabled) {
-          return;
-        }
-        this.eventQueue.push(telemetryEvent);
-        if (this.flushTimer) {
-          clearTimeout(this.flushTimer);
-        }
-        this.flushTimer = setTimeout(() => this.flush(), 100);
-      }
-      /**
-       * Flush queued events to server
-       */
-      async flush() {
-        if (this.eventQueue.length === 0) {
-          return;
-        }
-        const eventsToSend = [...this.eventQueue];
-        this.eventQueue = [];
-        try {
-          const controller = new AbortController();
-          const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-          const requestBody = {
-            events: eventsToSend,
-            batch: true
-          };
-          await fetch(this.endpoint, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json"
-            },
-            body: JSON.stringify(requestBody),
-            signal: controller.signal
-          });
-          clearTimeout(timeoutId);
-        } catch (error) {
-          if (this.debug) {
-            console.error("[Telemetry Debug] Failed to send events:", error);
-          }
-        }
-      }
-      /**
-       * Flush and wait for all events to be sent
-       * Should be called before CLI exits
-       */
-      async shutdown() {
-        if (this.flushTimer) {
-          clearTimeout(this.flushTimer);
-        }
-        if (!this.userIdResolved) {
-          await new Promise((resolve) => {
-            const check2 = () => {
-              if (this.userIdResolved) {
-                return resolve();
-              }
-              setTimeout(check2, 10);
-            };
-            check2();
-            setTimeout(resolve, 100);
-          });
-        }
-        if (this.userId) {
-          for (const evt of this.eventQueue) {
-            if (!evt.userId) {
-              evt.userId = this.userId;
-            }
-          }
-        }
-        await this.flush();
-      }
-      /**
-       * Enable telemetry.
-       * Returns null if enabled, or a string describing why an env override prevented it.
-       */
-      enable() {
-        this.config.setEnabled(true);
-        const override = this.getEnvOverride();
-        if (override) {
-          this.enabled = false;
-          return override;
-        }
-        this.enabled = true;
-        return null;
-      }
-      /**
-       * Check if an environment variable is overriding the config.
-       * Returns a human-readable reason, or null if no override.
-       */
-      getEnvOverride() {
-        if (process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true") {
-          return "DO_NOT_TRACK environment variable is set";
-        }
-        if (process.env.WRAPS_TELEMETRY_DISABLED === "1") {
-          return "WRAPS_TELEMETRY_DISABLED environment variable is set";
-        }
-        if (isCI()) {
-          return "CI environment detected";
-        }
-        return null;
-      }
-      /**
-       * Disable telemetry
-       */
-      disable() {
-        this.config.setEnabled(false);
-        this.enabled = false;
-        this.eventQueue = [];
-      }
-      /**
-       * Check if telemetry is enabled
-       */
-      isEnabled() {
-        return this.enabled;
-      }
-      /**
-       * Get config file path
-       */
-      getConfigPath() {
-        return this.config.getConfigPath();
-      }
-      /**
-       * Show first-run notification
-       */
-      shouldShowNotification() {
-        return this.enabled && !this.config.hasShownNotification();
-      }
-      /**
-       * Mark notification as shown
-       */
-      markNotificationShown() {
-        this.config.markNotificationShown();
-      }
-      /**
-       * Show promotional footer once per CLI session.
-       * Call this after successful completion of status/list commands.
-       * Returns true if footer was shown, false if already shown this session.
-       */
-      showFooterOnce() {
-        if (this.hasShownFooter) {
-          return false;
-        }
-        this.hasShownFooter = true;
-        console.log();
-        console.log(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-        console.log("\u{1F4CA} Wraps Platform \u2014 analytics, templates, automations");
-        console.log(`   From $10/mo \u2192 ${pc.cyan("https://wraps.dev/platform")}`);
-        console.log();
-        console.log(`\u{1F4AC} ${pc.cyan("hey@wraps.sh")}`);
-        console.log(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-        return true;
-      }
-      /**
-       * Get CLI version from package.json
-       */
-      getCLIVersion() {
-        try {
-          const __filename3 = fileURLToPath2(import.meta.url);
-          const __dirname4 = dirname(__filename3);
-          const pkg = JSON.parse(
-            readFileSync(join4(__dirname4, "../package.json"), "utf-8")
-          );
-          return pkg.version;
-        } catch {
-          return "unknown";
-        }
-      }
-    };
-    telemetryInstance = null;
+function classifyDNSError(error) {
+  if (!(error instanceof Error)) {
+    return "unknown";
   }
-});
-
-// src/telemetry/events.ts
-function trackCommand(command, metadata) {
-  const client = getTelemetryClient();
-  const sanitized = metadata ? { ...metadata } : {};
-  sanitized.domain = void 0;
-  sanitized.accountId = void 0;
-  sanitized.email = void 0;
-  client.track(`command:${command}`, sanitized);
-}
-function trackServiceInit(service, success, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:init", {
-    service,
-    success,
-    ...metadata
-  });
+  const code = error.code;
+  if (code === "ENOTFOUND" || code === "ENODATA") {
+    return "missing";
+  }
+  if (code === "ETIMEOUT" || code === "ESERVFAIL" || code === "ECONNREFUSED") {
+    return "network";
+  }
+  return "unknown";
 }
-function trackServiceDeployed(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:deployed", {
-    service,
-    ...metadata
-  });
+function isAWSNotFoundError(error) {
+  if (!(error instanceof Error)) return false;
+  const awsError = error;
+  return error.name === "NotFoundException" || error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.name === "ResourceNotFoundException" || awsError.$metadata?.httpStatusCode === 404;
 }
-function trackError(errorCode, command, metadata) {
-  const client = getTelemetryClient();
-  client.track("error:occurred", {
-    error_code: errorCode,
-    command,
-    ...metadata
-  });
-}
-function trackFeature(feature, metadata) {
-  const client = getTelemetryClient();
-  client.track(`feature:${feature}`, metadata || {});
-}
-function trackServiceUpgrade(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:upgraded", {
-    service,
-    ...metadata
-  });
-}
-function trackServiceRemoved(service, metadata) {
-  const client = getTelemetryClient();
-  client.track("service:removed", {
-    service,
-    ...metadata
-  });
-}
-var init_events = __esm({
-  "src/telemetry/events.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_client();
-  }
-});
-
-// src/utils/shared/json-output.ts
-function isJsonMode() {
-  return _jsonMode;
-}
-function setJsonMode(enabled) {
-  _jsonMode = enabled;
-}
-function jsonSuccess(command, data) {
-  const output3 = { success: true, command, data };
-  console.log(JSON.stringify(output3));
-}
-function jsonError(command, error) {
-  const output3 = { success: false, command, error };
-  console.log(JSON.stringify(output3));
-}
-var _jsonMode;
-var init_json_output = __esm({
-  "src/utils/shared/json-output.ts"() {
-    "use strict";
-    init_esm_shims();
-    _jsonMode = false;
-  }
-});
-
-// src/utils/shared/aws-detection.ts
-import { execSync } from "child_process";
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
-import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-async function isAWSCLIInstalled() {
-  try {
-    execSync("aws --version", { stdio: "pipe" });
-    return true;
-  } catch {
+function isPulumiError(error) {
+  if (!(error instanceof Error)) {
     return false;
   }
+  return error.message?.includes("pulumi") || error.message?.includes("Pulumi") || error.message?.includes("resource") || error.message?.includes("creating") || error.message?.includes("AccessDenied");
 }
-async function getAWSCLIVersion() {
-  try {
-    const output3 = execSync("aws --version", { encoding: "utf-8" });
-    const match = output3.match(/aws-cli\/(\d+\.\d+\.\d+)/);
-    return match ? match[1] : null;
-  } catch {
-    return null;
-  }
+function parseAWSError(error) {
+  const errorName = error.name || "UnknownError";
+  const actionMatch = error.message?.match(/when calling the (\w+) operation/i);
+  const action = actionMatch?.[1];
+  const resourceMatch = error.message?.match(/resource[:\s]+([^\s,]+)/i);
+  const resource = resourceMatch?.[1];
+  return { code: errorName, action, resource };
 }
-function detectCredentialSource() {
-  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
-    return "environment";
-  }
-  if (process.env.AWS_SSO_ACCOUNT_ID || process.env.AWS_SSO_SESSION) {
-    return "sso";
-  }
-  if (process.env.AWS_PROFILE) {
-    return "profile";
-  }
-  const credentialsPath = join5(homedir2(), ".aws", "credentials");
-  if (existsSync4(credentialsPath)) {
-    const content = readFileSync2(credentialsPath, "utf-8");
-    if (content.includes("[default]")) {
-      return "profile";
+function parsePulumiError(error) {
+  const message = error.message || "";
+  if (message.includes("AccessDenied") || message.includes("access denied")) {
+    const actionMatch = message.match(
+      /(?:action|operation)[:\s]+["']?(\w+:\w+)["']?/i
+    );
+    if (actionMatch) {
+      const [service] = actionMatch[1].split(":");
+      return {
+        code: "IAM_PERMISSION_DENIED",
+        iamAction: actionMatch[1],
+        service
+      };
     }
+    if (message.includes("ses:") || message.includes("SES")) {
+      return { code: "SES_PERMISSION_DENIED", service: "ses" };
+    }
+    if (message.includes("dynamodb:") || message.includes("DynamoDB")) {
+      return { code: "DYNAMODB_PERMISSION_DENIED", service: "dynamodb" };
+    }
+    if (message.includes("lambda:") || message.includes("Lambda")) {
+      return { code: "LAMBDA_PERMISSION_DENIED", service: "lambda" };
+    }
+    if (message.includes("events:") || message.includes("EventBridge")) {
+      return { code: "EVENTBRIDGE_PERMISSION_DENIED", service: "events" };
+    }
+    if (message.includes("sqs:") || message.includes("SQS")) {
+      return { code: "SQS_PERMISSION_DENIED", service: "sqs" };
+    }
+    if (message.includes("iam:") || message.includes("IAM")) {
+      return { code: "IAM_PERMISSION_DENIED", service: "iam" };
+    }
+    return { code: "IAM_PERMISSION_DENIED" };
   }
-  const ssoCachePath = join5(homedir2(), ".aws", "sso", "cache");
-  if (existsSync4(ssoCachePath)) {
-    return "sso";
-  }
-  if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_EXECUTION_ENV) {
-    return "instance";
-  }
-  return null;
-}
-function detectHostingProvider() {
-  if (process.env.VERCEL || process.env.VERCEL_ENV) {
-    return "vercel";
-  }
-  if (process.env.RAILWAY_ENVIRONMENT || process.env.RAILWAY_PROJECT_ID) {
-    return "railway";
-  }
-  if (process.env.NETLIFY || process.env.NETLIFY_DEV) {
-    return "netlify";
-  }
-  if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_EXECUTION_ENV || process.env.ECS_CONTAINER_METADATA_URI || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
-    return "aws";
+  if (message.includes("AlreadyExists") || message.includes("already exists") || message.includes("already exist") || message.includes("ResourceConflictException") || message.includes("ResourceInUse") || message.includes("EntityAlreadyExists")) {
+    const nameMatch = message.match(/error creating '([^']+)'/);
+    const typeMatch = message.match(/\((aws:[^)]+)\)/);
+    return {
+      code: "RESOURCE_CONFLICT",
+      resourceName: nameMatch?.[1],
+      resourceType: typeMatch?.[1]
+    };
   }
-  return null;
-}
-async function validateCredentials() {
-  try {
-    const sts = new STSClient({ region: "us-east-1" });
-    const identity = await sts.send(new GetCallerIdentityCommand({}));
-    return identity.Account || null;
-  } catch {
-    return null;
+  if (message.includes("stack is currently locked")) {
+    return { code: "STACK_LOCKED" };
   }
+  return { code: "PULUMI_ERROR" };
 }
-function getCurrentProfile() {
-  return process.env.AWS_PROFILE || "default";
+function redactSensitiveValues(input) {
+  let message = input;
+  message = message.replace(/\b\d{12}\b/g, "[ACCOUNT_ID]");
+  message = message.replace(
+    /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+    "[EMAIL]"
+  );
+  message = message.replace(
+    /(?<!\.amazonaws\.com|\.aws\.amazon\.com)\b[a-zA-Z0-9][a-zA-Z0-9-]+\.[a-zA-Z]{2,}\b/g,
+    (match) => {
+      if (match.includes("amazonaws") || match.includes("aws.amazon")) {
+        return match;
+      }
+      return "[DOMAIN]";
+    }
+  );
+  message = message.replace(
+    /arn:aws:[^:]+:[^:]*:\d{12}:/g,
+    "arn:aws:[SERVICE]:[REGION]:[ACCOUNT_ID]:"
+  );
+  return message;
 }
-function getCurrentRegion() {
-  if (process.env.AWS_REGION) {
-    return process.env.AWS_REGION;
-  }
-  if (process.env.AWS_DEFAULT_REGION) {
-    return process.env.AWS_DEFAULT_REGION;
+function sanitizeErrorMessage(error) {
+  if (!error) {
+    return "Unknown error";
   }
-  try {
-    const region = execSync("aws configure get region", {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    return region || null;
-  } catch {
-    return null;
+  const raw = error instanceof Error ? error.message : String(error);
+  const redacted = redactSensitiveValues(raw);
+  if (redacted.length > 500) {
+    return `${redacted.slice(0, 500)}...`;
   }
+  return redacted;
 }
-function parseSSOProfiles() {
-  const configPath = join5(homedir2(), ".aws", "config");
-  if (!existsSync4(configPath)) {
-    return [];
-  }
-  const content = readFileSync2(configPath, "utf-8");
-  const profiles = [];
-  const sessionMap = /* @__PURE__ */ new Map();
-  const sessionSections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sessionSections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (header?.startsWith("sso-session ")) {
-      const sessionName = header.replace("sso-session ", "");
-      const config2 = {};
-      for (const line of lines.slice(1)) {
-        const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-        if (match) {
-          config2[match[1]] = match[2];
-        }
-      }
-      sessionMap.set(sessionName, {
-        startUrl: config2.sso_start_url || "",
-        region: config2.sso_region || ""
+function handleCLIError(error, command) {
+  const cmdContext = command || "unknown";
+  if (isJsonMode()) {
+    let code = "UNKNOWN_ERROR";
+    let message = "An unexpected error occurred";
+    let suggestion;
+    let docsUrl;
+    if (error instanceof WrapsError) {
+      trackError(error.code, cmdContext);
+      code = error.code;
+      message = error.message;
+      suggestion = error.suggestion;
+      docsUrl = error.docsUrl;
+    } else if (isAWSError(error)) {
+      const parsed = parseAWSError(error);
+      code = `AWS_${parsed.code}`;
+      trackError(code, cmdContext, { action: parsed.action });
+      const wrapsErr = awsErrorToWrapsError(parsed.code, parsed.action, error);
+      message = wrapsErr.message;
+      suggestion = wrapsErr.suggestion;
+      docsUrl = wrapsErr.docsUrl;
+    } else if (isPulumiError(error)) {
+      const parsed = parsePulumiError(error);
+      code = `PULUMI_${parsed.code}`;
+      trackError(code, cmdContext, {
+        iamAction: parsed.iamAction,
+        service: parsed.service,
+        errorType: error?.constructor?.name
       });
+      const wrapsErr = pulumiErrorToWrapsError(
+        parsed.code,
+        parsed.iamAction,
+        parsed.service,
+        parsed.resourceName,
+        parsed.resourceType,
+        error?.message
+      );
+      message = wrapsErr.message;
+      suggestion = wrapsErr.suggestion;
+      docsUrl = wrapsErr.docsUrl;
+    } else {
+      trackError("UNHANDLED_ERROR", cmdContext, {
+        errorType: error instanceof Error ? error.constructor.name : typeof error,
+        message: sanitizeErrorMessage(error)
+      });
+      message = error instanceof Error ? error.message : String(error || message);
     }
-  }
-  const sections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (!header?.startsWith("profile ") && header !== "default") {
-      continue;
-    }
-    const profileName = header === "default" ? "default" : header.replace("profile ", "");
-    const config2 = {};
-    for (const line of lines.slice(1)) {
-      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-      if (match) {
-        config2[match[1]] = match[2];
+    jsonError(cmdContext, { code, message, suggestion, docsUrl });
+    process.exit(1);
+  }
+  console.error("");
+  if (error instanceof WrapsError) {
+    trackError(error.code, cmdContext);
+    clack.log.error(error.message);
+    if (error.suggestion) {
+      console.log(`
+${pc.yellow("Suggestion:")}`);
+      const lines = error.suggestion.split("\n");
+      for (const line of lines) {
+        console.log(`  ${pc.white(line)}`);
       }
+      console.log();
     }
-    if (config2.sso_start_url || config2.sso_session) {
-      let ssoStartUrl = config2.sso_start_url || "";
-      let ssoRegion = config2.sso_region || "";
-      if (config2.sso_session) {
-        const session = sessionMap.get(config2.sso_session);
-        if (session) {
-          ssoStartUrl = ssoStartUrl || session.startUrl;
-          ssoRegion = ssoRegion || session.region;
-        }
-      }
-      profiles.push({
-        name: profileName,
-        ssoStartUrl,
-        ssoRegion,
-        ssoAccountId: config2.sso_account_id || "",
-        ssoRoleName: config2.sso_role_name || "",
-        region: config2.region,
-        ssoSession: config2.sso_session
-      });
+    if (error.docsUrl) {
+      console.log(`${pc.dim("Documentation:")}`);
+      console.log(`  ${pc.blue(error.docsUrl)}
+`);
     }
+    process.exit(1);
   }
-  return profiles;
-}
-function parseSSOSessions() {
-  const configPath = join5(homedir2(), ".aws", "config");
-  if (!existsSync4(configPath)) {
-    return [];
-  }
-  const content = readFileSync2(configPath, "utf-8");
-  const sessions = [];
-  const sections = content.split(/^\[/m).filter(Boolean);
-  for (const section of sections) {
-    const lines = section.split("\n");
-    const header = lines[0]?.replace("]", "").trim();
-    if (!header?.startsWith("sso-session ")) {
-      continue;
-    }
-    const sessionName = header.replace("sso-session ", "");
-    const config2 = {};
-    for (const line of lines.slice(1)) {
-      const match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)\s*$/);
-      if (match) {
-        config2[match[1]] = match[2];
+  if (isAWSError(error)) {
+    const { code, action } = parseAWSError(error);
+    trackError(`AWS_${code}`, cmdContext, { action });
+    const wrapsError = awsErrorToWrapsError(code, action, error);
+    clack.log.error(wrapsError.message);
+    if (wrapsError.suggestion) {
+      console.log(`
+${pc.yellow("Suggestion:")}`);
+      const lines = wrapsError.suggestion.split("\n");
+      for (const line of lines) {
+        console.log(`  ${pc.white(line)}`);
       }
+      console.log();
     }
-    sessions.push({
-      name: sessionName,
-      ssoStartUrl: config2.sso_start_url || "",
-      ssoRegion: config2.sso_region || "",
-      ssoRegistrationScopes: config2.sso_registration_scopes?.split(",").map((s) => s.trim())
-    });
-  }
-  return sessions;
-}
-function checkSSOTokenStatus(startUrl) {
-  const ssoCachePath = join5(homedir2(), ".aws", "sso", "cache");
-  if (!existsSync4(ssoCachePath)) {
-    return {
-      valid: false,
-      expiresAt: null,
-      expired: true,
-      minutesRemaining: null,
-      startUrl: null
-    };
+    if (wrapsError.docsUrl) {
+      console.log(`${pc.dim("Documentation:")}`);
+      console.log(`  ${pc.blue(wrapsError.docsUrl)}
+`);
+    }
+    process.exit(1);
   }
-  try {
-    const cacheFiles = readdirSync(ssoCachePath).filter(
-      (f) => f.endsWith(".json")
+  if (isPulumiError(error)) {
+    const { code, iamAction, service, resourceName, resourceType } = parsePulumiError(error);
+    trackError(`PULUMI_${code}`, cmdContext, {
+      iamAction,
+      service,
+      errorType: error?.constructor?.name
+    });
+    const wrapsError = pulumiErrorToWrapsError(
+      code,
+      iamAction,
+      service,
+      resourceName,
+      resourceType,
+      error?.message
     );
-    for (const file of cacheFiles) {
-      const content = readFileSync2(join5(ssoCachePath, file), "utf-8");
-      const token = JSON.parse(content);
-      if (!(token.accessToken && token.expiresAt)) {
-        continue;
-      }
-      if (startUrl && token.startUrl !== startUrl) {
-        continue;
+    clack.log.error(wrapsError.message);
+    if (wrapsError.suggestion) {
+      console.log(`
+${pc.yellow("Suggestion:")}`);
+      const lines = wrapsError.suggestion.split("\n");
+      for (const line of lines) {
+        console.log(`  ${pc.white(line)}`);
       }
-      const expiresAt = new Date(token.expiresAt);
-      const now = /* @__PURE__ */ new Date();
-      const expired = expiresAt <= now;
-      const minutesRemaining = Math.floor(
-        (expiresAt.getTime() - now.getTime()) / 6e4
-      );
-      return {
-        valid: !expired,
-        expiresAt,
-        expired,
-        minutesRemaining,
-        startUrl: token.startUrl || null
-      };
-    }
-  } catch {
-  }
-  return {
-    valid: false,
-    expiresAt: null,
-    expired: true,
-    minutesRemaining: null,
-    startUrl: null
-  };
-}
-function getActiveSSOProfile(profiles) {
-  const currentProfile = process.env.AWS_PROFILE || "default";
-  return profiles.find((p) => p.name === currentProfile) || null;
-}
-function getSSOLoginCommand(profile) {
-  if (profile && profile !== "default") {
-    return `aws sso login --profile ${profile}`;
-  }
-  return "aws sso login";
-}
-function formatSSOProfile(profile) {
-  return `${profile.name} (${profile.ssoAccountId} / ${profile.ssoRoleName})`;
-}
-async function detectAWSState() {
-  const [cliInstalled, cliVersion, accountId] = await Promise.all([
-    isAWSCLIInstalled(),
-    getAWSCLIVersion(),
-    validateCredentials()
-  ]);
-  const credentialSource = detectCredentialSource();
-  const detectedProvider = detectHostingProvider();
-  const region = getCurrentRegion();
-  const profileName = getCurrentProfile();
-  const ssoProfiles = parseSSOProfiles();
-  const ssoSessions = parseSSOSessions();
-  const activeProfile = getActiveSSOProfile(ssoProfiles);
-  const tokenStatus = ssoProfiles.length > 0 ? checkSSOTokenStatus(activeProfile?.ssoStartUrl) : null;
-  const isUsingSSO = credentialSource === "sso" || activeProfile !== null && accountId !== null;
-  return {
-    cliInstalled,
-    cliVersion,
-    credentialsConfigured: accountId !== null,
-    credentialSource: isUsingSSO ? "sso" : accountId !== null ? credentialSource : null,
-    profileName,
-    accountId,
-    detectedProvider,
-    region,
-    sso: {
-      configured: ssoProfiles.length > 0,
-      profiles: ssoProfiles,
-      sessions: ssoSessions,
-      tokenStatus,
-      activeProfile: isUsingSSO ? activeProfile : null
+      console.log();
     }
-  };
-}
-function hasCredentialsFile() {
-  const credentialsPath = join5(homedir2(), ".aws", "credentials");
-  return existsSync4(credentialsPath);
-}
-function hasConfigFile() {
-  const configPath = join5(homedir2(), ".aws", "config");
-  return existsSync4(configPath);
-}
-function getConfiguredProfiles() {
-  const profiles = [];
-  const credentialsPath = join5(homedir2(), ".aws", "credentials");
-  if (existsSync4(credentialsPath)) {
-    const content = readFileSync2(credentialsPath, "utf-8");
-    const matches = content.matchAll(/\[([^\]]+)\]/g);
-    for (const match of matches) {
-      profiles.push(match[1]);
+    if (wrapsError.docsUrl) {
+      console.log(`${pc.dim("Documentation:")}`);
+      console.log(`  ${pc.blue(wrapsError.docsUrl)}
+`);
     }
+    process.exit(1);
   }
-  const configPath = join5(homedir2(), ".aws", "config");
-  if (existsSync4(configPath)) {
-    const content = readFileSync2(configPath, "utf-8");
-    const matches = content.matchAll(/\[profile ([^\]]+)\]/g);
-    for (const match of matches) {
-      if (!profiles.includes(match[1])) {
-        profiles.push(match[1]);
-      }
-    }
+  trackError("UNHANDLED_ERROR", cmdContext, {
+    errorType: error instanceof Error ? error.constructor.name : typeof error,
+    message: sanitizeErrorMessage(error)
+  });
+  clack.log.error("An unexpected error occurred");
+  if (error instanceof Error) {
+    console.error(pc.dim(error.message));
+  } else if (typeof error === "string") {
+    console.error(error);
   }
-  return profiles;
+  console.log(`
+${pc.dim("If this persists, please report at:")}`);
+  console.log(`  ${pc.blue("https://github.com/wraps-team/wraps/issues")}
+`);
+  process.exit(1);
 }
-var init_aws_detection = __esm({
-  "src/utils/shared/aws-detection.ts"() {
-    "use strict";
-    init_esm_shims();
+function awsErrorToWrapsError(code, action, originalError) {
+  switch (code) {
+    // Credential / token errors — these mean the request never reached the API
+    case "ExpiredTokenException":
+    case "TokenRefreshRequired":
+    case "SSOTokenExpired":
+      return errors.sessionTokenExpired();
+    case "InvalidClientTokenId":
+    case "InvalidAccessKeyId":
+    case "SignatureDoesNotMatch":
+    case "UnrecognizedClientException":
+      return errors.accessKeyInvalid();
+    // IAM permission errors — request reached AWS but was denied
+    case "AccessDenied":
+    case "AccessDeniedException":
+    case "UnauthorizedAccess":
+      return errors.iamPermissionDenied(
+        action || "unknown",
+        "AWS resource",
+        "Ensure your IAM user/role has the required permissions."
+      );
+    // SES SendEmail errors — request reached SES but was rejected
+    case "MessageRejected":
+      return errors.sesMessageRejected(sanitizeErrorMessage(originalError));
+    case "MailFromDomainNotVerifiedException":
+      return errors.sesMailFromNotVerified(sanitizeErrorMessage(originalError));
+    case "AccountSendingPausedException":
+      return errors.sesAccountSendingPaused();
+    case "ConfigurationSetSendingPausedException":
+      return errors.sesConfigSetSendingPaused();
+    case "ConfigurationSetDoesNotExistException":
+      return errors.sesConfigSetMissing(sanitizeErrorMessage(originalError));
+    // Throughput / quota errors
+    case "Throttling":
+    case "ThrottlingException":
+    case "TooManyRequestsException":
+      return errors.awsThrottled(action);
+    case "LimitExceededException":
+    case "ServiceQuotaExceededException":
+      return errors.awsLimitExceeded(
+        action,
+        sanitizeErrorMessage(originalError)
+      );
+    // Anything else — surface the real error instead of lying about credentials
+    default:
+      return errors.awsUnknownError(
+        code,
+        action,
+        sanitizeErrorMessage(originalError)
+      );
   }
-});
-
-// src/utils/shared/errors.ts
-var errors_exports = {};
-__export(errors_exports, {
-  WrapsError: () => WrapsError,
-  classifyDNSError: () => classifyDNSError,
-  errors: () => errors,
-  handleCLIError: () => handleCLIError,
-  isAWSError: () => isAWSError,
-  isAWSNotFoundError: () => isAWSNotFoundError,
-  isPulumiError: () => isPulumiError,
-  parseAWSError: () => parseAWSError,
-  parsePulumiError: () => parsePulumiError,
-  sanitizeErrorMessage: () => sanitizeErrorMessage
-});
-import * as clack4 from "@clack/prompts";
-import pc5 from "picocolors";
-function isAWSError(error) {
-  if (!(error instanceof Error)) {
-    return false;
-  }
-  const awsErrorNames = [
-    "ExpiredTokenException",
-    "InvalidClientTokenId",
-    "AccessDenied",
-    "AccessDeniedException",
-    "UnauthorizedAccess",
-    "InvalidAccessKeyId",
-    "SignatureDoesNotMatch",
-    "UnrecognizedClientException",
-    "CredentialsError",
-    "TokenRefreshRequired",
-    "SSOTokenExpired"
-  ];
-  return awsErrorNames.includes(error.name) || "$metadata" in error;
-}
-function classifyDNSError(error) {
-  if (!(error instanceof Error)) {
-    return "unknown";
-  }
-  const code = error.code;
-  if (code === "ENOTFOUND" || code === "ENODATA") {
-    return "missing";
-  }
-  if (code === "ETIMEOUT" || code === "ESERVFAIL" || code === "ECONNREFUSED") {
-    return "network";
-  }
-  return "unknown";
-}
-function isAWSNotFoundError(error) {
-  if (!(error instanceof Error)) return false;
-  const awsError = error;
-  return error.name === "NotFoundException" || error.name === "NoSuchEntityException" || error.name === "NoSuchEntity" || error.name === "ResourceNotFoundException" || awsError.$metadata?.httpStatusCode === 404;
-}
-function isPulumiError(error) {
-  if (!(error instanceof Error)) {
-    return false;
-  }
-  return error.message?.includes("pulumi") || error.message?.includes("Pulumi") || error.message?.includes("resource") || error.message?.includes("creating") || error.message?.includes("AccessDenied");
-}
-function parseAWSError(error) {
-  const errorName = error.name || "UnknownError";
-  const actionMatch = error.message?.match(/when calling the (\w+) operation/i);
-  const action = actionMatch?.[1];
-  const resourceMatch = error.message?.match(/resource[:\s]+([^\s,]+)/i);
-  const resource = resourceMatch?.[1];
-  return { code: errorName, action, resource };
-}
-function parsePulumiError(error) {
-  const message = error.message || "";
-  if (message.includes("AccessDenied") || message.includes("access denied")) {
-    const actionMatch = message.match(
-      /(?:action|operation)[:\s]+["']?(\w+:\w+)["']?/i
-    );
-    if (actionMatch) {
-      const [service] = actionMatch[1].split(":");
-      return {
-        code: "IAM_PERMISSION_DENIED",
-        iamAction: actionMatch[1],
-        service
-      };
-    }
-    if (message.includes("ses:") || message.includes("SES")) {
-      return { code: "SES_PERMISSION_DENIED", service: "ses" };
-    }
-    if (message.includes("dynamodb:") || message.includes("DynamoDB")) {
-      return { code: "DYNAMODB_PERMISSION_DENIED", service: "dynamodb" };
-    }
-    if (message.includes("lambda:") || message.includes("Lambda")) {
-      return { code: "LAMBDA_PERMISSION_DENIED", service: "lambda" };
-    }
-    if (message.includes("events:") || message.includes("EventBridge")) {
-      return { code: "EVENTBRIDGE_PERMISSION_DENIED", service: "events" };
-    }
-    if (message.includes("sqs:") || message.includes("SQS")) {
-      return { code: "SQS_PERMISSION_DENIED", service: "sqs" };
-    }
-    if (message.includes("iam:") || message.includes("IAM")) {
-      return { code: "IAM_PERMISSION_DENIED", service: "iam" };
-    }
-    return { code: "IAM_PERMISSION_DENIED" };
-  }
-  if (message.includes("AlreadyExists") || message.includes("already exists") || message.includes("already exist") || message.includes("ResourceConflictException") || message.includes("ResourceInUse") || message.includes("EntityAlreadyExists")) {
-    const nameMatch = message.match(/error creating '([^']+)'/);
-    const typeMatch = message.match(/\((aws:[^)]+)\)/);
-    return {
-      code: "RESOURCE_CONFLICT",
-      resourceName: nameMatch?.[1],
-      resourceType: typeMatch?.[1]
-    };
-  }
-  if (message.includes("stack is currently locked")) {
-    return { code: "STACK_LOCKED" };
-  }
-  return { code: "PULUMI_ERROR" };
-}
-function sanitizeErrorMessage(error) {
-  if (!error) {
-    return "Unknown error";
-  }
-  let message = error instanceof Error ? error.message : String(error);
-  message = message.replace(/\b\d{12}\b/g, "[ACCOUNT_ID]");
-  message = message.replace(
-    /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
-    "[EMAIL]"
-  );
-  message = message.replace(
-    /(?<!\.amazonaws\.com|\.aws\.amazon\.com)\b[a-zA-Z0-9][a-zA-Z0-9-]+\.[a-zA-Z]{2,}\b/g,
-    (match) => {
-      if (match.includes("amazonaws") || match.includes("aws.amazon")) {
-        return match;
-      }
-      return "[DOMAIN]";
-    }
-  );
-  message = message.replace(
-    /arn:aws:[^:]+:[^:]*:\d{12}:/g,
-    "arn:aws:[SERVICE]:[REGION]:[ACCOUNT_ID]:"
-  );
-  if (message.length > 500) {
-    message = `${message.slice(0, 500)}...`;
-  }
-  return message;
 }
-function handleCLIError(error, command) {
-  const cmdContext = command || "unknown";
-  if (isJsonMode()) {
-    let code = "UNKNOWN_ERROR";
-    let message = "An unexpected error occurred";
-    let suggestion;
-    let docsUrl;
-    if (error instanceof WrapsError) {
-      trackError(error.code, cmdContext);
-      code = error.code;
-      message = error.message;
-      suggestion = error.suggestion;
-      docsUrl = error.docsUrl;
-    } else if (isAWSError(error)) {
-      const parsed = parseAWSError(error);
-      code = `AWS_${parsed.code}`;
-      trackError(code, cmdContext, { action: parsed.action });
-      const wrapsErr = awsErrorToWrapsError(parsed.code, parsed.action);
-      message = wrapsErr.message;
-      suggestion = wrapsErr.suggestion;
-      docsUrl = wrapsErr.docsUrl;
-    } else if (isPulumiError(error)) {
-      const parsed = parsePulumiError(error);
-      code = `PULUMI_${parsed.code}`;
-      trackError(code, cmdContext, {
-        iamAction: parsed.iamAction,
-        service: parsed.service,
-        errorType: error?.constructor?.name
-      });
-      const wrapsErr = pulumiErrorToWrapsError(
-        parsed.code,
-        parsed.iamAction,
-        parsed.service,
-        parsed.resourceName,
-        parsed.resourceType
+function pulumiErrorToWrapsError(code, iamAction, service, resourceName, resourceType, originalMessage) {
+  switch (code) {
+    case "RESOURCE_CONFLICT":
+      return errors.resourceConflict(
+        resourceName || "unknown resource",
+        resourceType
+      );
+    case "STACK_LOCKED":
+      return errors.stackLocked();
+    case "SES_PERMISSION_DENIED":
+      return errors.sesPermissionDenied(iamAction || "unknown");
+    case "DYNAMODB_PERMISSION_DENIED":
+      return errors.dynamoDBPermissionDenied();
+    case "LAMBDA_PERMISSION_DENIED":
+      return errors.lambdaPermissionDenied();
+    case "EVENTBRIDGE_PERMISSION_DENIED":
+      return errors.eventBridgePermissionDenied();
+    case "SQS_PERMISSION_DENIED":
+      return errors.sqsPermissionDenied();
+    case "IAM_PERMISSION_DENIED":
+      return errors.iamPermissionDenied(
+        iamAction || "unknown",
+        "AWS resource",
+        service ? `Your IAM user/role needs ${service.toUpperCase()} permissions.` : "Ensure your IAM user/role has the required permissions."
+      );
+    default:
+      return errors.pulumiError(
+        originalMessage ? sanitizeErrorMessage(originalMessage) : "Deployment failed"
       );
-      message = wrapsErr.message;
-      suggestion = wrapsErr.suggestion;
-      docsUrl = wrapsErr.docsUrl;
-    } else {
-      trackError("UNHANDLED_ERROR", cmdContext, {
-        errorType: error instanceof Error ? error.constructor.name : typeof error,
-        message: sanitizeErrorMessage(error)
-      });
-      message = error instanceof Error ? error.message : String(error || message);
-    }
-    jsonError(cmdContext, { code, message, suggestion, docsUrl });
-    process.exit(1);
-  }
-  console.error("");
-  if (error instanceof WrapsError) {
-    trackError(error.code, cmdContext);
-    clack4.log.error(error.message);
-    if (error.suggestion) {
-      console.log(`
-${pc5.yellow("Suggestion:")}`);
-      const lines = error.suggestion.split("\n");
-      for (const line of lines) {
-        console.log(`  ${pc5.white(line)}`);
-      }
-      console.log();
-    }
-    if (error.docsUrl) {
-      console.log(`${pc5.dim("Documentation:")}`);
-      console.log(`  ${pc5.blue(error.docsUrl)}
-`);
-    }
-    process.exit(1);
   }
-  if (isAWSError(error)) {
-    const { code, action } = parseAWSError(error);
-    trackError(`AWS_${code}`, cmdContext, { action });
-    const wrapsError = awsErrorToWrapsError(code, action);
-    clack4.log.error(wrapsError.message);
-    if (wrapsError.suggestion) {
-      console.log(`
-${pc5.yellow("Suggestion:")}`);
-      const lines = wrapsError.suggestion.split("\n");
-      for (const line of lines) {
-        console.log(`  ${pc5.white(line)}`);
-      }
-      console.log();
-    }
-    if (wrapsError.docsUrl) {
-      console.log(`${pc5.dim("Documentation:")}`);
-      console.log(`  ${pc5.blue(wrapsError.docsUrl)}
-`);
-    }
-    process.exit(1);
-  }
-  if (isPulumiError(error)) {
-    const { code, iamAction, service, resourceName, resourceType } = parsePulumiError(error);
-    trackError(`PULUMI_${code}`, cmdContext, {
-      iamAction,
-      service,
-      errorType: error?.constructor?.name
-    });
-    const wrapsError = pulumiErrorToWrapsError(
-      code,
-      iamAction,
-      service,
-      resourceName,
-      resourceType
-    );
-    clack4.log.error(wrapsError.message);
-    if (wrapsError.suggestion) {
-      console.log(`
-${pc5.yellow("Suggestion:")}`);
-      const lines = wrapsError.suggestion.split("\n");
-      for (const line of lines) {
-        console.log(`  ${pc5.white(line)}`);
-      }
-      console.log();
-    }
-    if (wrapsError.docsUrl) {
-      console.log(`${pc5.dim("Documentation:")}`);
-      console.log(`  ${pc5.blue(wrapsError.docsUrl)}
-`);
-    }
-    process.exit(1);
-  }
-  trackError("UNHANDLED_ERROR", cmdContext, {
-    errorType: error instanceof Error ? error.constructor.name : typeof error,
-    message: sanitizeErrorMessage(error)
-  });
-  clack4.log.error("An unexpected error occurred");
-  if (error instanceof Error) {
-    console.error(pc5.dim(error.message));
-  } else if (typeof error === "string") {
-    console.error(error);
-  }
-  console.log(`
-${pc5.dim("If this persists, please report at:")}`);
-  console.log(`  ${pc5.blue("https://github.com/wraps-team/wraps/issues")}
-`);
-  process.exit(1);
-}
-function awsErrorToWrapsError(code, action) {
-  switch (code) {
-    case "ExpiredTokenException":
-    case "TokenRefreshRequired":
-    case "SSOTokenExpired":
-      return errors.sessionTokenExpired();
-    case "InvalidClientTokenId":
-    case "InvalidAccessKeyId":
-    case "SignatureDoesNotMatch":
-      return errors.accessKeyInvalid();
-    case "AccessDenied":
-    case "AccessDeniedException":
-    case "UnauthorizedAccess":
-      return errors.iamPermissionDenied(
-        action || "unknown",
-        "AWS resource",
-        "Ensure your IAM user/role has the required permissions."
-      );
-    default:
-      return errors.noAWSCredentials();
-  }
-}
-function pulumiErrorToWrapsError(code, iamAction, service, resourceName, resourceType) {
-  switch (code) {
-    case "RESOURCE_CONFLICT":
-      return errors.resourceConflict(
-        resourceName || "unknown resource",
-        resourceType
-      );
-    case "STACK_LOCKED":
-      return errors.stackLocked();
-    case "SES_PERMISSION_DENIED":
-      return errors.sesPermissionDenied(iamAction || "unknown");
-    case "DYNAMODB_PERMISSION_DENIED":
-      return errors.dynamoDBPermissionDenied();
-    case "LAMBDA_PERMISSION_DENIED":
-      return errors.lambdaPermissionDenied();
-    case "EVENTBRIDGE_PERMISSION_DENIED":
-      return errors.eventBridgePermissionDenied();
-    case "SQS_PERMISSION_DENIED":
-      return errors.sqsPermissionDenied();
-    case "IAM_PERMISSION_DENIED":
-      return errors.iamPermissionDenied(
-        iamAction || "unknown",
-        "AWS resource",
-        service ? `Your IAM user/role needs ${service.toUpperCase()} permissions.` : "Ensure your IAM user/role has the required permissions."
-      );
-    default:
-      return errors.pulumiError("Deployment failed");
-  }
-}
-var WrapsError, errors;
-var init_errors = __esm({
-  "src/utils/shared/errors.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_events();
-    init_json_output();
-    WrapsError = class extends Error {
-      constructor(message, code, suggestion, docsUrl) {
-        super(message);
-        this.code = code;
-        this.suggestion = suggestion;
-        this.docsUrl = docsUrl;
-        this.name = "WrapsError";
+}
+var WrapsError, errors;
+var init_errors = __esm({
+  "src/utils/shared/errors.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_events();
+    init_json_output();
+    WrapsError = class extends Error {
+      constructor(message, code, suggestion, docsUrl) {
+        super(message);
+        this.code = code;
+        this.suggestion = suggestion;
+        this.docsUrl = docsUrl;
+        this.name = "WrapsError";
       }
     };
     errors = {
@@ -1747,6 +950,61 @@ View required SES permissions:
   wraps permissions --service email --json`,
         "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
+      // SES SendEmail rejection errors — request reached SES but the send failed
+      // for a reason unrelated to credentials.
+      sesMessageRejected: (detail) => new WrapsError(
+        `SES rejected the message: ${detail}`,
+        "SES_MESSAGE_REJECTED",
+        "Common causes:\n  \u2022 Account is in the SES sandbox and the recipient is not a verified address\n  \u2022 Sender identity (domain or email) is not verified for sending\n  \u2022 The sender domain is verified for receiving but not for sending\n\nCheck status:\n  wraps email status\n  wraps email doctor\n\nRequest production access (exit sandbox):\n  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html",
+        "https://wraps.dev/docs/guides/email/troubleshooting"
+      ),
+      sesMailFromNotVerified: (detail) => new WrapsError(
+        `SES MAIL FROM domain is not verified: ${detail}`,
+        "SES_MAIL_FROM_NOT_VERIFIED",
+        "The custom MAIL FROM domain configured for this identity is not fully verified.\n\nCheck DNS records:\n  wraps email verify\n\nOr remove the custom MAIL FROM domain in the SES console and retry.",
+        "https://docs.aws.amazon.com/ses/latest/dg/mail-from.html"
+      ),
+      sesAccountSendingPaused: () => new WrapsError(
+        "SES account-level sending is paused",
+        "SES_ACCOUNT_SENDING_PAUSED",
+        "Your SES account is currently paused from sending email. This is usually caused by:\n  \u2022 A high bounce or complaint rate\n  \u2022 An AWS-initiated review\n\nCheck the SES console \u2192 Reputation Dashboard for details, then resume sending once the issue is resolved.",
+        "https://docs.aws.amazon.com/ses/latest/dg/reputationdashboard.html"
+      ),
+      sesConfigSetSendingPaused: () => new WrapsError(
+        "SES configuration set sending is paused",
+        "SES_CONFIG_SET_SENDING_PAUSED",
+        "The configuration set used for this send has sending paused. Resume it in the SES console under Configuration Sets, or send without specifying the paused configuration set.",
+        "https://docs.aws.amazon.com/ses/latest/dg/using-configuration-sets.html"
+      ),
+      sesConfigSetMissing: (detail) => new WrapsError(
+        `SES configuration set does not exist: ${detail}`,
+        "SES_CONFIG_SET_MISSING",
+        "The configuration set referenced by this send does not exist in the current region. Create it in the SES console, switch regions, or remove the ConfigurationSetName from the request.",
+        "https://docs.aws.amazon.com/ses/latest/dg/using-configuration-sets.html"
+      ),
+      // Generic AWS error fallbacks — used by awsErrorToWrapsError when no specific
+      // mapping exists. These NEVER claim credentials are missing.
+      awsThrottled: (action) => new WrapsError(
+        `AWS request was throttled${action ? ` (${action})` : ""}`,
+        "AWS_THROTTLED",
+        "AWS is rate-limiting requests to this API. Wait a moment and retry.\n\nIf this happens repeatedly, request a service quota increase in the AWS console.",
+        "https://docs.aws.amazon.com/general/latest/gr/api-retries.html"
+      ),
+      awsLimitExceeded: (action, detail) => new WrapsError(
+        `AWS service limit exceeded${action ? ` (${action})` : ""}${detail ? `: ${detail}` : ""}`,
+        "AWS_LIMIT_EXCEEDED",
+        "You've hit a service quota for this AWS API.\n\nRequest a quota increase in the AWS console:\n  Service Quotas \u2192 AWS Services \u2192 (your service)",
+        "https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html"
+      ),
+      awsUnknownError: (code, action, detail) => new WrapsError(
+        `AWS API error: ${code}${action ? ` (${action})` : ""}${detail ? ` \u2014 ${detail}` : ""}`,
+        `AWS_${code}`,
+        `This is an AWS API error, not a credentials problem. Look up "${code}" in the AWS documentation for the failing service.
+
+If you believe this is a Wraps bug, report it at:
+  https://github.com/wraps-team/wraps/issues`,
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
+      ),
       dynamoDBPermissionDenied: () => new WrapsError(
         "DynamoDB permission denied",
         "DYNAMODB_PERMISSION_DENIED",
@@ -1862,6 +1120,7 @@ __export(aws_exports, {
   getSESAccountStatus: () => getSESAccountStatus,
   isSESSandbox: () => isSESSandbox,
   listSESDomains: () => listSESDomains,
+  resolveAWSCredentialsToEnv: () => resolveAWSCredentialsToEnv,
   validateAWSCredentials: () => validateAWSCredentials,
   validateAWSCredentialsWithDetails: () => validateAWSCredentialsWithDetails
 });
@@ -1929,127 +1188,999 @@ async function validateAWSCredentialsWithDetails() {
         case "UnrecognizedClientException":
           throw errors.accessKeyInvalid();
       }
-    }
-    throw errors.noAWSCredentials();
+    }
+    throw errors.noAWSCredentials();
+  }
+}
+async function resolveAWSCredentialsToEnv() {
+  delete process.env.AWS_PROFILE;
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+    return;
+  }
+  const sts = new STSClient2({});
+  const provider = sts.config.credentials;
+  if (!provider) {
+    throw errors.noAWSCredentials();
+  }
+  let creds;
+  try {
+    creds = typeof provider === "function" ? await provider() : provider;
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.name === "ExpiredTokenException" || error.name === "TokenRefreshRequired" || error.name === "SSOTokenExpired") {
+        throw errors.sessionTokenExpired();
+      }
+      if (error.message?.includes("Could not load credentials")) {
+        throw errors.credentialsFileMissing();
+      }
+    }
+    throw errors.noAWSCredentials();
+  }
+  process.env.AWS_ACCESS_KEY_ID = creds.accessKeyId;
+  process.env.AWS_SECRET_ACCESS_KEY = creds.secretAccessKey;
+  if (creds.sessionToken) {
+    process.env.AWS_SESSION_TOKEN = creds.sessionToken;
+  }
+}
+async function checkRegion(region) {
+  return SES_REGIONS.includes(region);
+}
+async function getAWSRegion() {
+  if (process.env.AWS_REGION) {
+    return process.env.AWS_REGION;
+  }
+  if (process.env.AWS_DEFAULT_REGION) {
+    return process.env.AWS_DEFAULT_REGION;
+  }
+  return "us-east-1";
+}
+async function listSESDomains(region) {
+  const ses = new SESClient({ region });
+  try {
+    const identitiesResponse = await ses.send(
+      new ListIdentitiesCommand({
+        IdentityType: "Domain"
+      })
+    );
+    const identities = identitiesResponse.Identities || [];
+    if (identities.length === 0) {
+      return [];
+    }
+    const attributesResponse = await ses.send(
+      new GetIdentityVerificationAttributesCommand({
+        Identities: identities
+      })
+    );
+    const attributes = attributesResponse.VerificationAttributes || {};
+    return identities.map((domain) => ({
+      domain,
+      verified: attributes[domain]?.VerificationStatus === "Success"
+    }));
+  } catch {
+    return [];
+  }
+}
+async function getSESAccountStatus(region) {
+  const sesv22 = new SESv2Client({ region });
+  try {
+    const response = await sesv22.send(new GetAccountCommand({}));
+    return {
+      isSandbox: !response.ProductionAccessEnabled,
+      sendQuota: response.SendQuota ? {
+        max24HourSend: response.SendQuota.Max24HourSend ?? 0,
+        maxSendRate: response.SendQuota.MaxSendRate ?? 0,
+        sentLast24Hours: response.SendQuota.SentLast24Hours ?? 0
+      } : void 0,
+      enforcementStatus: response.EnforcementStatus
+    };
+  } catch {
+    return { isSandbox: true, sandboxUncertain: true };
+  }
+}
+async function isSESSandbox(region) {
+  const status2 = await getSESAccountStatus(region);
+  return status2.isSandbox;
+}
+async function getACMCertificateStatus(certificateArn) {
+  const acm3 = new ACMClient({ region: "us-east-1" });
+  try {
+    const response = await acm3.send(
+      new DescribeCertificateCommand({
+        CertificateArn: certificateArn
+      })
+    );
+    const certificate = response.Certificate;
+    if (!certificate) {
+      return null;
+    }
+    const validationRecords = certificate.DomainValidationOptions?.map((option) => ({
+      name: option.ResourceRecord?.Name || "",
+      type: option.ResourceRecord?.Type || "",
+      value: option.ResourceRecord?.Value || ""
+    })) || [];
+    return {
+      status: certificate.Status || "UNKNOWN",
+      domainName: certificate.DomainName || "",
+      validationRecords
+    };
+  } catch (error) {
+    console.error("Error getting ACM certificate status:", error);
+    return null;
+  }
+}
+var SES_REGIONS;
+var init_aws = __esm({
+  "src/utils/shared/aws.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_aws_detection();
+    init_errors();
+    SES_REGIONS = [
+      "us-east-1",
+      "us-east-2",
+      "us-west-1",
+      "us-west-2",
+      "af-south-1",
+      "ap-east-1",
+      "ap-south-1",
+      "ap-northeast-1",
+      "ap-northeast-2",
+      "ap-northeast-3",
+      "ap-southeast-1",
+      "ap-southeast-2",
+      "ap-southeast-3",
+      "ca-central-1",
+      "eu-central-1",
+      "eu-west-1",
+      "eu-west-2",
+      "eu-west-3",
+      "eu-south-1",
+      "eu-north-1",
+      "me-south-1",
+      "sa-east-1"
+    ];
+  }
+});
+
+// src/utils/shared/s3-state.ts
+var s3_state_exports = {};
+__export(s3_state_exports, {
+  clearS3StackLocks: () => clearS3StackLocks,
+  deleteMetadata: () => deleteMetadata,
+  downloadMetadata: () => downloadMetadata,
+  ensureStateBucket: () => ensureStateBucket,
+  getS3BackendUrl: () => getS3BackendUrl,
+  getStateBucketName: () => getStateBucketName,
+  migrateLocalPulumiState: () => migrateLocalPulumiState,
+  needsMigration: () => needsMigration,
+  stateBucketExists: () => stateBucketExists,
+  uploadMetadata: () => uploadMetadata
+});
+import { existsSync as existsSync2, statSync } from "fs";
+import { readdir, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+function has404StatusCode(error) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const metadataError = error;
+  return metadataError.$metadata?.httpStatusCode === 404;
+}
+function getStateBucketName(accountId, region) {
+  return `wraps-state-${accountId}-${region}`;
+}
+function getS3BackendUrl(accountId, region) {
+  return `s3://${getStateBucketName(accountId, region)}`;
+}
+async function stateBucketExists(accountId, region) {
+  const { S3Client: S3Client2, HeadBucketCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const bucketName = getStateBucketName(accountId, region);
+  try {
+    await client.send(new HeadBucketCommand({ Bucket: bucketName }));
+    return true;
+  } catch (error) {
+    if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchBucket" || has404StatusCode(error))) {
+      return false;
+    }
+    throw error;
+  }
+}
+async function ensureStateBucket(accountId, region) {
+  const {
+    S3Client: S3Client2,
+    HeadBucketCommand,
+    CreateBucketCommand,
+    PutBucketEncryptionCommand,
+    PutBucketVersioningCommand,
+    PutPublicAccessBlockCommand,
+    PutBucketTaggingCommand
+  } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const bucketName = getStateBucketName(accountId, region);
+  try {
+    await client.send(new HeadBucketCommand({ Bucket: bucketName }));
+    return bucketName;
+  } catch (error) {
+    const isNotFound = error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchBucket" || has404StatusCode(error));
+    if (!isNotFound) {
+      throw error;
+    }
+  }
+  const createParams = { Bucket: bucketName };
+  if (region !== "us-east-1") {
+    createParams.CreateBucketConfiguration = {
+      LocationConstraint: region
+    };
+  }
+  await client.send(new CreateBucketCommand(createParams));
+  await client.send(
+    new PutBucketEncryptionCommand({
+      Bucket: bucketName,
+      ServerSideEncryptionConfiguration: {
+        Rules: [
+          {
+            ApplyServerSideEncryptionByDefault: {
+              SSEAlgorithm: "AES256"
+            }
+          }
+        ]
+      }
+    })
+  );
+  await client.send(
+    new PutBucketVersioningCommand({
+      Bucket: bucketName,
+      VersioningConfiguration: {
+        Status: "Enabled"
+      }
+    })
+  );
+  await client.send(
+    new PutPublicAccessBlockCommand({
+      Bucket: bucketName,
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: true
+      }
+    })
+  );
+  await client.send(
+    new PutBucketTaggingCommand({
+      Bucket: bucketName,
+      Tagging: {
+        TagSet: [
+          { Key: "ManagedBy", Value: "wraps-cli" },
+          { Key: "Purpose", Value: "state" }
+        ]
+      }
+    })
+  );
+  return bucketName;
+}
+async function uploadMetadata(bucketName, metadata) {
+  const { S3Client: S3Client2, PutObjectCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region: metadata.region });
+  const key = `metadata/${metadata.accountId}-${metadata.region}.json`;
+  await client.send(
+    new PutObjectCommand({
+      Bucket: bucketName,
+      Key: key,
+      Body: JSON.stringify(metadata, null, 2),
+      ContentType: "application/json"
+    })
+  );
+}
+async function deleteMetadata(bucketName, accountId, region) {
+  const { S3Client: S3Client2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const key = `metadata/${accountId}-${region}.json`;
+  await client.send(
+    new DeleteObjectCommand({
+      Bucket: bucketName,
+      Key: key
+    })
+  );
+}
+async function clearS3StackLocks(accountId, region) {
+  const { S3Client: S3Client2, ListObjectsV2Command: ListObjectsV2Command2, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const bucketName = getStateBucketName(accountId, region);
+  const prefix = ".pulumi/locks/";
+  const response = await client.send(
+    new ListObjectsV2Command2({ Bucket: bucketName, Prefix: prefix })
+  );
+  const lockObjects = response.Contents ?? [];
+  if (lockObjects.length === 0) {
+    return 0;
+  }
+  for (const obj of lockObjects) {
+    if (obj.Key) {
+      await client.send(
+        new DeleteObjectCommand({ Bucket: bucketName, Key: obj.Key })
+      );
+    }
+  }
+  return lockObjects.length;
+}
+async function downloadMetadata(bucketName, accountId, region) {
+  const { S3Client: S3Client2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
+  const client = new S3Client2({ region });
+  const key = `metadata/${accountId}-${region}.json`;
+  try {
+    const response = await client.send(
+      new GetObjectCommand2({
+        Bucket: bucketName,
+        Key: key
+      })
+    );
+    const body = await response.Body?.transformToString();
+    if (!body) {
+      return null;
+    }
+    return JSON.parse(body);
+  } catch (error) {
+    if (error instanceof Error && (error.name === "NoSuchKey" || has404StatusCode(error))) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function needsMigration(localPulumiDir, accountId, region) {
+  const markerPath = join2(localPulumiDir, `.migrated-${accountId}-${region}`);
+  if (existsSync2(markerPath)) {
+    return false;
+  }
+  const stacksDir = join2(localPulumiDir, ".pulumi", "stacks");
+  if (!existsSync2(stacksDir)) {
+    return false;
+  }
+  try {
+    const entries = await readdir(stacksDir);
+    for (const entry of entries) {
+      const entryPath = join2(stacksDir, entry);
+      if (statSync(entryPath).isDirectory()) {
+        const files = await readdir(entryPath);
+        const matching = files.filter(
+          (f) => f.includes(accountId) && f.includes(region) && f.endsWith(".json")
+        );
+        if (matching.length > 0) {
+          return true;
+        }
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+async function migrateLocalPulumiState(localPulumiDir, bucketName, accountId, region) {
+  const pulumi31 = await import("@pulumi/pulumi/automation/index.js");
+  const stacksDir = join2(localPulumiDir, ".pulumi", "stacks");
+  const entries = await readdir(stacksDir);
+  for (const entry of entries) {
+    const entryPath = join2(stacksDir, entry);
+    if (!statSync(entryPath).isDirectory()) {
+      continue;
+    }
+    const projectName = entry;
+    const files = await readdir(entryPath);
+    const stackFiles = files.filter(
+      (f) => f.includes(accountId) && f.includes(region) && f.endsWith(".json")
+    );
+    for (const stackFile of stackFiles) {
+      const stackName = stackFile.replace(".json", "");
+      try {
+        const localStack = await pulumi31.LocalWorkspace.selectStack({
+          stackName,
+          workDir: localPulumiDir
+        });
+        const state = await localStack.exportStack();
+        const s3Stack = await pulumi31.LocalWorkspace.createOrSelectStack(
+          {
+            stackName,
+            projectName,
+            program: async () => ({})
+          },
+          {
+            workDir: localPulumiDir,
+            envVars: {
+              PULUMI_BACKEND_URL: `s3://${bucketName}`,
+              PULUMI_CONFIG_PASSPHRASE: ""
+            }
+          }
+        );
+        await s3Stack.importStack(state);
+      } catch (error) {
+        console.error(
+          `Warning: Failed to migrate stack ${stackName}: ${error instanceof Error ? error.message : error}`
+        );
+      }
+    }
+  }
+  const markerPath = join2(localPulumiDir, `.migrated-${accountId}-${region}`);
+  await writeFile(markerPath, (/* @__PURE__ */ new Date()).toISOString(), "utf-8");
+}
+var init_s3_state = __esm({
+  "src/utils/shared/s3-state.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/utils/shared/fs.ts
+var fs_exports = {};
+__export(fs_exports, {
+  clearLocalStackLocks: () => clearLocalStackLocks,
+  ensurePulumiWorkDir: () => ensurePulumiWorkDir,
+  ensureWrapsDir: () => ensureWrapsDir,
+  getPulumiWorkDir: () => getPulumiWorkDir,
+  getWrapsDir: () => getWrapsDir
+});
+import { existsSync as existsSync3 } from "fs";
+import { mkdir, readdir as readdir2, rm } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+function getWrapsDir() {
+  return join3(homedir2(), ".wraps");
+}
+function getPulumiWorkDir() {
+  return join3(getWrapsDir(), "pulumi");
+}
+async function ensureWrapsDir() {
+  const wrapsDir = getWrapsDir();
+  if (!existsSync3(wrapsDir)) {
+    await mkdir(wrapsDir, { recursive: true });
+  }
+}
+async function clearLocalStackLocks() {
+  const locksDir = join3(getPulumiWorkDir(), ".pulumi", "locks");
+  if (!existsSync3(locksDir)) {
+    return 0;
+  }
+  let count = 0;
+  async function walkAndDelete(dir) {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walkAndDelete(fullPath);
+      } else if (entry.name.endsWith(".json")) {
+        await rm(fullPath);
+        count++;
+      }
+    }
+  }
+  await walkAndDelete(locksDir);
+  return count;
+}
+async function ensurePulumiWorkDir(options) {
+  await ensureWrapsDir();
+  const pulumiDir = getPulumiWorkDir();
+  if (!existsSync3(pulumiDir)) {
+    await mkdir(pulumiDir, { recursive: true });
+  }
+  process.env.PULUMI_CONFIG_PASSPHRASE = "";
+  if (options?.accountId && options?.region) {
+    const { resolveAWSCredentialsToEnv: resolveAWSCredentialsToEnv2 } = await Promise.resolve().then(() => (init_aws(), aws_exports));
+    await resolveAWSCredentialsToEnv2();
+  }
+  const useS3 = options?.accountId && options?.region && process.env.WRAPS_LOCAL_ONLY !== "1";
+  if (useS3) {
+    try {
+      const {
+        ensureStateBucket: ensureStateBucket2,
+        getS3BackendUrl: getS3BackendUrl2,
+        needsMigration: needsMigration2,
+        migrateLocalPulumiState: migrateLocalPulumiState2
+      } = await Promise.resolve().then(() => (init_s3_state(), s3_state_exports));
+      const bucketName = await ensureStateBucket2(
+        options.accountId,
+        options.region
+      );
+      const shouldMigrate = await needsMigration2(
+        pulumiDir,
+        options.accountId,
+        options.region
+      );
+      if (shouldMigrate) {
+        process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
+        await migrateLocalPulumiState2(
+          pulumiDir,
+          bucketName,
+          options.accountId,
+          options.region
+        );
+      }
+      process.env.PULUMI_BACKEND_URL = getS3BackendUrl2(
+        options.accountId,
+        options.region
+      );
+      return;
+    } catch (error) {
+      const clack54 = await import("@clack/prompts");
+      clack54.log.warn(
+        `S3 state backend unavailable (${error instanceof Error ? error.message : error}). Using local state.`
+      );
+    }
+  }
+  process.env.PULUMI_BACKEND_URL = `file://${pulumiDir}`;
+}
+var init_fs = __esm({
+  "src/utils/shared/fs.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/utils/shared/config.ts
+import { existsSync as existsSync4 } from "fs";
+import { chmod, readFile, writeFile as writeFile2 } from "fs/promises";
+import { join as join4 } from "path";
+function getApiBaseUrl() {
+  return process.env.WRAPS_API_URL || "https://api.wraps.dev";
+}
+function getAppBaseUrl() {
+  return process.env.WRAPS_APP_URL || "https://app.wraps.dev";
+}
+function getConfigPath() {
+  return join4(getWrapsDir(), CONFIG_FILE);
+}
+async function readAuthConfig() {
+  const path3 = getConfigPath();
+  if (!existsSync4(path3)) {
+    return null;
+  }
+  try {
+    const content = await readFile(path3, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function saveAuthConfig(config2) {
+  await ensureWrapsDir();
+  const path3 = getConfigPath();
+  const existing = await readAuthConfig();
+  const merged = existing ? { ...existing, ...config2 } : config2;
+  await writeFile2(path3, JSON.stringify(merged, null, 2), "utf-8");
+  await chmod(path3, 384);
+}
+async function clearAuthConfig() {
+  const existing = await readAuthConfig();
+  if (existing) {
+    existing.auth = void 0;
+    await saveAuthConfig(existing);
+  }
+}
+function resolveToken(flags2) {
+  return flags2?.token || process.env.WRAPS_API_KEY || null;
+}
+async function resolveTokenAsync(flags2) {
+  const sync = resolveToken(flags2);
+  if (sync) {
+    return sync;
+  }
+  const config2 = await readAuthConfig();
+  if (!config2?.auth?.token) {
+    return null;
+  }
+  if (config2.auth.expiresAt && new Date(config2.auth.expiresAt) <= /* @__PURE__ */ new Date()) {
+    return null;
+  }
+  return config2.auth.token;
+}
+var CONFIG_FILE;
+var init_config = __esm({
+  "src/utils/shared/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_fs();
+    CONFIG_FILE = "config.json";
+  }
+});
+
+// src/telemetry/config.ts
+import Conf from "conf";
+import { v4 as uuidv4 } from "uuid";
+var CONFIG_DEFAULTS, TelemetryConfigManager;
+var init_config2 = __esm({
+  "src/telemetry/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    CONFIG_DEFAULTS = {
+      enabled: true,
+      anonymousId: uuidv4(),
+      notificationShown: false
+    };
+    TelemetryConfigManager = class {
+      config;
+      constructor(options) {
+        this.config = new Conf({
+          projectName: "wraps",
+          configName: "telemetry",
+          defaults: CONFIG_DEFAULTS,
+          cwd: options?.cwd
+        });
+      }
+      /**
+       * Check if telemetry is enabled
+       */
+      isEnabled() {
+        return this.config.get("enabled");
+      }
+      /**
+       * Enable or disable telemetry
+       */
+      setEnabled(enabled) {
+        this.config.set("enabled", enabled);
+      }
+      /**
+       * Get the anonymous user ID
+       */
+      getAnonymousId() {
+        return this.config.get("anonymousId");
+      }
+      /**
+       * Check if the first-run notification has been shown
+       */
+      hasShownNotification() {
+        return this.config.get("notificationShown");
+      }
+      /**
+       * Mark the first-run notification as shown
+       */
+      markNotificationShown() {
+        this.config.set("notificationShown", true);
+      }
+      /**
+       * Get the full path to the configuration file
+       */
+      getConfigPath() {
+        return this.config.path;
+      }
+      /**
+       * Reset configuration to defaults
+       */
+      reset() {
+        this.config.clear();
+        this.config.set({
+          ...CONFIG_DEFAULTS,
+          anonymousId: uuidv4()
+        });
+      }
+    };
+  }
+});
+
+// src/telemetry/client.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import pc2 from "picocolors";
+function getTelemetryClient() {
+  if (!telemetryInstance) {
+    telemetryInstance = new TelemetryClient();
+  }
+  return telemetryInstance;
+}
+var DEFAULT_ENDPOINT, DEFAULT_TIMEOUT, TelemetryClient, telemetryInstance;
+var init_client = __esm({
+  "src/telemetry/client.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_ci_detection();
+    init_config();
+    init_config2();
+    DEFAULT_ENDPOINT = process.env.WRAPS_TELEMETRY_URL || "https://wraps.dev/api/telemetry";
+    DEFAULT_TIMEOUT = 2e3;
+    TelemetryClient = class {
+      config;
+      endpoint;
+      timeout;
+      debug;
+      enabled;
+      eventQueue = [];
+      flushTimer;
+      hasShownFooter = false;
+      userId;
+      userIdResolved = false;
+      constructor(options = {}) {
+        this.config = new TelemetryConfigManager();
+        this.endpoint = options.endpoint || DEFAULT_ENDPOINT;
+        this.timeout = options.timeout || DEFAULT_TIMEOUT;
+        this.debug = options.debug || process.env.WRAPS_TELEMETRY_DEBUG === "1";
+        this.enabled = this.shouldBeEnabled();
+        this.resolveUserId();
+      }
+      /**
+       * Resolve authenticated user identity from CLI auth config.
+       * Uses the first organization ID as the user identifier,
+       * linking CLI telemetry to the same org tracked on the web dashboard.
+       */
+      async resolveUserId() {
+        try {
+          const config2 = await readAuthConfig();
+          if (config2?.auth?.token && config2.auth.organizations?.length) {
+            this.userId = config2.auth.organizations[0].id;
+          }
+        } catch {
+        } finally {
+          this.userIdResolved = true;
+        }
+      }
+      /**
+       * Determine if telemetry should be enabled based on environment and config
+       */
+      shouldBeEnabled() {
+        if (process.env.DO_NOT_TRACK === "1") {
+          return false;
+        }
+        if (process.env.WRAPS_TELEMETRY_DISABLED === "1") {
+          return false;
+        }
+        if (isCI()) {
+          return false;
+        }
+        if (!this.config.isEnabled()) {
+          return false;
+        }
+        return true;
+      }
+      /**
+       * Track an event
+       *
+       * @param event - Event name in format "category:action" (e.g., "command:init")
+       * @param properties - Additional event properties (no PII)
+       */
+      track(event, properties) {
+        const telemetryEvent = {
+          event,
+          properties: {
+            ...properties,
+            cli_version: this.getCLIVersion(),
+            os: process.platform,
+            node_version: process.version,
+            ci: isCI()
+          },
+          anonymousId: this.config.getAnonymousId(),
+          ...this.userId ? { userId: this.userId } : {},
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        if (this.debug) {
+          console.log(
+            "[Telemetry Debug] Event:",
+            JSON.stringify(telemetryEvent, null, 2)
+          );
+          return;
+        }
+        if (!this.enabled) {
+          return;
+        }
+        this.eventQueue.push(telemetryEvent);
+        if (this.flushTimer) {
+          clearTimeout(this.flushTimer);
+        }
+        this.flushTimer = setTimeout(() => this.flush(), 100);
+      }
+      /**
+       * Flush queued events to server
+       */
+      async flush() {
+        if (this.eventQueue.length === 0) {
+          return;
+        }
+        const eventsToSend = [...this.eventQueue];
+        this.eventQueue = [];
+        try {
+          const controller = new AbortController();
+          const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+          const requestBody = {
+            events: eventsToSend,
+            batch: true
+          };
+          await fetch(this.endpoint, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify(requestBody),
+            signal: controller.signal
+          });
+          clearTimeout(timeoutId);
+        } catch (error) {
+          if (this.debug) {
+            console.error("[Telemetry Debug] Failed to send events:", error);
+          }
+        }
+      }
+      /**
+       * Flush and wait for all events to be sent
+       * Should be called before CLI exits
+       */
+      async shutdown() {
+        if (this.flushTimer) {
+          clearTimeout(this.flushTimer);
+        }
+        if (!this.userIdResolved) {
+          await new Promise((resolve) => {
+            const check2 = () => {
+              if (this.userIdResolved) {
+                return resolve();
+              }
+              setTimeout(check2, 10);
+            };
+            check2();
+            setTimeout(resolve, 100);
+          });
+        }
+        if (this.userId) {
+          for (const evt of this.eventQueue) {
+            if (!evt.userId) {
+              evt.userId = this.userId;
+            }
+          }
+        }
+        await this.flush();
+      }
+      /**
+       * Enable telemetry.
+       * Returns null if enabled, or a string describing why an env override prevented it.
+       */
+      enable() {
+        this.config.setEnabled(true);
+        const override = this.getEnvOverride();
+        if (override) {
+          this.enabled = false;
+          return override;
+        }
+        this.enabled = true;
+        return null;
+      }
+      /**
+       * Check if an environment variable is overriding the config.
+       * Returns a human-readable reason, or null if no override.
+       */
+      getEnvOverride() {
+        if (process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true") {
+          return "DO_NOT_TRACK environment variable is set";
+        }
+        if (process.env.WRAPS_TELEMETRY_DISABLED === "1") {
+          return "WRAPS_TELEMETRY_DISABLED environment variable is set";
+        }
+        if (isCI()) {
+          return "CI environment detected";
+        }
+        return null;
+      }
+      /**
+       * Disable telemetry
+       */
+      disable() {
+        this.config.setEnabled(false);
+        this.enabled = false;
+        this.eventQueue = [];
+      }
+      /**
+       * Check if telemetry is enabled
+       */
+      isEnabled() {
+        return this.enabled;
+      }
+      /**
+       * Get config file path
+       */
+      getConfigPath() {
+        return this.config.getConfigPath();
+      }
+      /**
+       * Show first-run notification
+       */
+      shouldShowNotification() {
+        return this.enabled && !this.config.hasShownNotification();
+      }
+      /**
+       * Mark notification as shown
+       */
+      markNotificationShown() {
+        this.config.markNotificationShown();
+      }
+      /**
+       * Show promotional footer once per CLI session.
+       * Call this after successful completion of status/list commands.
+       * Returns true if footer was shown, false if already shown this session.
+       */
+      showFooterOnce() {
+        if (this.hasShownFooter) {
+          return false;
+        }
+        this.hasShownFooter = true;
+        console.log();
+        console.log(pc2.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        console.log("\u{1F4CA} Wraps Platform \u2014 analytics, templates, automations");
+        console.log(`   From $10/mo \u2192 ${pc2.cyan("https://wraps.dev/platform")}`);
+        console.log();
+        console.log(`\u{1F4AC} ${pc2.cyan("hey@wraps.sh")}`);
+        console.log(pc2.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        return true;
+      }
+      /**
+       * Get CLI version from package.json
+       */
+      getCLIVersion() {
+        try {
+          const __filename3 = fileURLToPath2(import.meta.url);
+          const __dirname4 = dirname(__filename3);
+          const pkg = JSON.parse(
+            readFileSync2(join5(__dirname4, "../package.json"), "utf-8")
+          );
+          return pkg.version;
+        } catch {
+          return "unknown";
+        }
+      }
+    };
+    telemetryInstance = null;
   }
+});
+
+// src/telemetry/events.ts
+function trackCommand(command, metadata) {
+  const client = getTelemetryClient();
+  const sanitized = metadata ? { ...metadata } : {};
+  sanitized.domain = void 0;
+  sanitized.accountId = void 0;
+  sanitized.email = void 0;
+  client.track(`command:${command}`, sanitized);
 }
-async function checkRegion(region) {
-  return SES_REGIONS.includes(region);
+function trackServiceInit(service, success, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:init", {
+    service,
+    success,
+    ...metadata
+  });
 }
-async function getAWSRegion() {
-  if (process.env.AWS_REGION) {
-    return process.env.AWS_REGION;
-  }
-  if (process.env.AWS_DEFAULT_REGION) {
-    return process.env.AWS_DEFAULT_REGION;
-  }
-  return "us-east-1";
+function trackServiceDeployed(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:deployed", {
+    service,
+    ...metadata
+  });
 }
-async function listSESDomains(region) {
-  const ses = new SESClient({ region });
-  try {
-    const identitiesResponse = await ses.send(
-      new ListIdentitiesCommand({
-        IdentityType: "Domain"
-      })
-    );
-    const identities = identitiesResponse.Identities || [];
-    if (identities.length === 0) {
-      return [];
-    }
-    const attributesResponse = await ses.send(
-      new GetIdentityVerificationAttributesCommand({
-        Identities: identities
-      })
-    );
-    const attributes = attributesResponse.VerificationAttributes || {};
-    return identities.map((domain) => ({
-      domain,
-      verified: attributes[domain]?.VerificationStatus === "Success"
-    }));
-  } catch {
-    return [];
-  }
+function trackError(errorCode, command, metadata) {
+  const client = getTelemetryClient();
+  client.track("error:occurred", {
+    error_code: errorCode,
+    command,
+    ...metadata
+  });
 }
-async function getSESAccountStatus(region) {
-  const sesv22 = new SESv2Client({ region });
-  try {
-    const response = await sesv22.send(new GetAccountCommand({}));
-    return {
-      isSandbox: !response.ProductionAccessEnabled,
-      sendQuota: response.SendQuota ? {
-        max24HourSend: response.SendQuota.Max24HourSend ?? 0,
-        maxSendRate: response.SendQuota.MaxSendRate ?? 0,
-        sentLast24Hours: response.SendQuota.SentLast24Hours ?? 0
-      } : void 0,
-      enforcementStatus: response.EnforcementStatus
-    };
-  } catch {
-    return { isSandbox: true, sandboxUncertain: true };
-  }
+function trackFeature(feature, metadata) {
+  const client = getTelemetryClient();
+  client.track(`feature:${feature}`, metadata || {});
 }
-async function isSESSandbox(region) {
-  const status2 = await getSESAccountStatus(region);
-  return status2.isSandbox;
+function trackServiceUpgrade(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:upgraded", {
+    service,
+    ...metadata
+  });
 }
-async function getACMCertificateStatus(certificateArn) {
-  const acm3 = new ACMClient({ region: "us-east-1" });
-  try {
-    const response = await acm3.send(
-      new DescribeCertificateCommand({
-        CertificateArn: certificateArn
-      })
-    );
-    const certificate = response.Certificate;
-    if (!certificate) {
-      return null;
-    }
-    const validationRecords = certificate.DomainValidationOptions?.map((option) => ({
-      name: option.ResourceRecord?.Name || "",
-      type: option.ResourceRecord?.Type || "",
-      value: option.ResourceRecord?.Value || ""
-    })) || [];
-    return {
-      status: certificate.Status || "UNKNOWN",
-      domainName: certificate.DomainName || "",
-      validationRecords
-    };
-  } catch (error) {
-    console.error("Error getting ACM certificate status:", error);
-    return null;
-  }
+function trackServiceRemoved(service, metadata) {
+  const client = getTelemetryClient();
+  client.track("service:removed", {
+    service,
+    ...metadata
+  });
 }
-var SES_REGIONS;
-var init_aws = __esm({
-  "src/utils/shared/aws.ts"() {
+var init_events = __esm({
+  "src/telemetry/events.ts"() {
     "use strict";
     init_esm_shims();
-    init_aws_detection();
-    init_errors();
-    SES_REGIONS = [
-      "us-east-1",
-      "us-east-2",
-      "us-west-1",
-      "us-west-2",
-      "af-south-1",
-      "ap-east-1",
-      "ap-south-1",
-      "ap-northeast-1",
-      "ap-northeast-2",
-      "ap-northeast-3",
-      "ap-southeast-1",
-      "ap-southeast-2",
-      "ap-southeast-3",
-      "ca-central-1",
-      "eu-central-1",
-      "eu-west-1",
-      "eu-west-2",
-      "eu-west-3",
-      "eu-south-1",
-      "eu-north-1",
-      "me-south-1",
-      "sa-east-1"
-    ];
+    init_client();
   }
 });
 
@@ -9896,14 +10027,14 @@ init_esm_shims();
 init_events();
 init_config();
 init_json_output();
-import * as clack from "@clack/prompts";
+import * as clack2 from "@clack/prompts";
 import { createAuthClient } from "better-auth/client";
 import {
   deviceAuthorizationClient,
   organizationClient
 } from "better-auth/client/plugins";
 import open from "open";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 function createCliAuthClient(baseURL) {
   return createAuthClient({
     baseURL,
@@ -9947,14 +10078,14 @@ async function login(options) {
     if (isJsonMode()) {
       jsonSuccess("auth.login", { tokenType: "api-key" });
     } else {
-      clack.log.success("API key saved.");
+      clack2.log.success("API key saved.");
     }
     return;
   }
-  clack.intro(pc2.bold("Wraps \u203A Sign In"));
+  clack2.intro(pc3.bold("Wraps \u203A Sign In"));
   const baseURL = getAppBaseUrl();
   const authClient = createCliAuthClient(baseURL);
-  const spinner10 = clack.spinner();
+  const spinner10 = clack2.spinner();
   const { data: codeData, error: codeError } = await authClient.device.code({
     client_id: "wraps-cli"
   });
@@ -9965,7 +10096,7 @@ async function login(options) {
       method: "device"
     });
     trackError("DEVICE_AUTH_FAILED", "auth:login", { step: "request_code" });
-    clack.log.error("Failed to start device authorization.");
+    clack2.log.error("Failed to start device authorization.");
     throw new Error("Failed to start device authorization.");
   }
   const {
@@ -9976,11 +10107,11 @@ async function login(options) {
     expires_in
   } = codeData;
   const formatted = `${user_code.slice(0, 4)}-${user_code.slice(4)}`;
-  clack.log.info(`Your code:  ${pc2.bold(pc2.cyan(formatted))}`);
-  clack.log.info(`Visit: ${pc2.underline(`${baseURL}/device`)}`);
+  clack2.log.info(`Your code:  ${pc3.bold(pc3.cyan(formatted))}`);
+  clack2.log.info(`Visit: ${pc3.underline(`${baseURL}/device`)}`);
   try {
     await open(`${baseURL}/device?user_code=${user_code}`);
-    clack.log.info("Opening browser...");
+    clack2.log.info("Opening browser...");
   } catch {
   }
   spinner10.start("Waiting for approval...");
@@ -10012,14 +10143,14 @@ async function login(options) {
         duration_ms: Date.now() - startTime,
         method: "device"
       });
-      clack.log.success("Signed in successfully.");
+      clack2.log.success("Signed in successfully.");
       if (organizations.length === 1) {
-        clack.log.info(`Organization: ${pc2.cyan(organizations[0].name)}`);
+        clack2.log.info(`Organization: ${pc3.cyan(organizations[0].name)}`);
       } else if (organizations.length > 1) {
-        clack.log.info(`${organizations.length} organizations available`);
+        clack2.log.info(`${organizations.length} organizations available`);
       } else {
-        clack.log.info(
-          `No organizations found. Create one at ${pc2.underline(`${baseURL}/onboarding`)} and run ${pc2.cyan("wraps auth login")} again.`
+        clack2.log.info(
+          `No organizations found. Create one at ${pc3.underline(`${baseURL}/onboarding`)} and run ${pc3.cyan("wraps auth login")} again.`
         );
       }
       if (isJsonMode()) {
@@ -10048,7 +10179,7 @@ async function login(options) {
         });
         trackError("ACCESS_DENIED", "auth:login", { step: "poll_token" });
         spinner10.stop("Denied.");
-        clack.log.error("Authorization was denied.");
+        clack2.log.error("Authorization was denied.");
         throw new Error("Authorization was denied.");
       }
       if (errorCode === "expired_token") {
@@ -10063,7 +10194,7 @@ async function login(options) {
   });
   trackError("DEVICE_CODE_EXPIRED", "auth:login", { step: "poll_token" });
   spinner10.stop("Expired.");
-  clack.log.error("Device code expired. Run `wraps auth login` to try again.");
+  clack2.log.error("Device code expired. Run `wraps auth login` to try again.");
   throw new Error("Device code expired.");
 }
 
@@ -10072,11 +10203,11 @@ init_esm_shims();
 init_events();
 init_config();
 init_json_output();
-import * as clack2 from "@clack/prompts";
-import pc3 from "picocolors";
+import * as clack3 from "@clack/prompts";
+import pc4 from "picocolors";
 async function logout() {
   if (!isJsonMode()) {
-    clack2.intro(pc3.bold("Wraps \u203A Sign Out"));
+    clack3.intro(pc4.bold("Wraps \u203A Sign Out"));
   }
   const config2 = await readAuthConfig();
   if (!config2?.auth?.token) {
@@ -10085,7 +10216,7 @@ async function logout() {
       jsonSuccess("auth.logout", { loggedOut: false, alreadyLoggedOut: true });
       return;
     }
-    clack2.log.info("Not signed in.");
+    clack3.log.info("Not signed in.");
     return;
   }
   await clearAuthConfig();
@@ -10094,7 +10225,7 @@ async function logout() {
     jsonSuccess("auth.logout", { loggedOut: true });
     return;
   }
-  clack2.log.success("Signed out. Token removed from ~/.wraps/config.json");
+  clack3.log.success("Signed out. Token removed from ~/.wraps/config.json");
 }
 
 // src/commands/auth/status.ts
@@ -10102,8 +10233,8 @@ init_esm_shims();
 init_events();
 init_config();
 init_json_output();
-import * as clack3 from "@clack/prompts";
-import pc4 from "picocolors";
+import * as clack4 from "@clack/prompts";
+import pc5 from "picocolors";
 async function authStatus(_options = {}) {
   const config2 = await readAuthConfig();
   if (!config2?.auth?.token) {
@@ -10111,8 +10242,8 @@ async function authStatus(_options = {}) {
     if (isJsonMode()) {
       jsonSuccess("auth.status", { authenticated: false });
     } else {
-      clack3.intro(pc4.bold("Wraps \u203A Auth Status"));
-      clack3.log.info("Not signed in. Run `wraps auth login` to authenticate.");
+      clack4.intro(pc5.bold("Wraps \u203A Auth Status"));
+      clack4.log.info("Not signed in. Run `wraps auth login` to authenticate.");
     }
     return;
   }
@@ -10126,10 +10257,10 @@ async function authStatus(_options = {}) {
       expiresAt: expiresAt || null
     });
   } else {
-    clack3.intro(pc4.bold("Wraps \u203A Auth Status"));
-    clack3.log.info(`Token:   ${masked} (${tokenType})`);
+    clack4.intro(pc5.bold("Wraps \u203A Auth Status"));
+    clack4.log.info(`Token:   ${masked} (${tokenType})`);
     if (expiresAt) {
-      clack3.log.info(`Expires: ${new Date(expiresAt).toLocaleDateString()}`);
+      clack4.log.info(`Expires: ${new Date(expiresAt).toLocaleDateString()}`);
     }
   }
   trackCommand("auth:status", { success: true, authenticated: true });
@@ -17766,10 +17897,18 @@ async function createSMTPCredentials(config2) {
 
 // src/infrastructure/resources/sqs.ts
 init_esm_shims();
+init_resource_checks();
 import * as aws11 from "@pulumi/aws";
+var SQS_TIMEOUTS = {
+  customTimeouts: { create: "2m", update: "2m", delete: "2m" }
+};
 async function createSQSResources() {
-  const dlq = new aws11.sqs.Queue("wraps-email-events-dlq", {
-    name: "wraps-email-events-dlq",
+  const dlqName = "wraps-email-events-dlq";
+  const queueName = "wraps-email-events";
+  const dlqUrl = await sqsQueueExists(dlqName);
+  const queueUrl = await sqsQueueExists(queueName);
+  const dlqConfig = {
+    name: dlqName,
     messageRetentionSeconds: 1209600,
     // 14 days
     tags: {
@@ -17777,9 +17916,13 @@ async function createSQSResources() {
       Service: "email",
       Description: "Dead letter queue for failed SES event processing"
     }
+  };
+  const dlq = new aws11.sqs.Queue(dlqName, dlqConfig, {
+    ...SQS_TIMEOUTS,
+    ...dlqUrl ? { import: dlqUrl } : {}
   });
-  const queue = new aws11.sqs.Queue("wraps-email-events", {
-    name: "wraps-email-events",
+  const queueConfig = {
+    name: queueName,
     visibilityTimeoutSeconds: 300,
     // Must be >= Lambda timeout (5 minutes)
     messageRetentionSeconds: 345600,
@@ -17798,6 +17941,10 @@ async function createSQSResources() {
       Service: "email",
       Description: "Queue for SES email events from EventBridge"
     }
+  };
+  const queue = new aws11.sqs.Queue(queueName, queueConfig, {
+    ...SQS_TIMEOUTS,
+    ...queueUrl ? { import: queueUrl } : {}
   });
   return {
     queue,
@@ -18551,6 +18698,8 @@ async function connect2(options) {
       throw new Error(`Preview failed: ${msg}`);
     }
   }
+  let pulumiLog = [];
+  const debugPulumi = process.env.WRAPS_DEBUG === "1";
   let outputs;
   try {
     outputs = await progress.execute(
@@ -18588,8 +18737,14 @@ async function connect2(options) {
           `wraps-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
-        const upResult = await stack.up({ onOutput: () => {
-        } });
+        const upResult = await stack.up({
+          onOutput: (msg) => {
+            pulumiLog.push(msg);
+            if (debugPulumi) {
+              process.stderr.write(msg);
+            }
+          }
+        });
         const pulumiOutputs = upResult.outputs;
         return {
           roleArn: pulumiOutputs.roleArn?.value,
@@ -18614,9 +18769,22 @@ async function connect2(options) {
       trackError("STACK_LOCKED", "email:connect", { step: "deploy" });
       throw errors.stackLocked();
     }
+    if (pulumiLog.length > 0) {
+      const tail = pulumiLog.join("").split("\n").slice(-60).join("\n");
+      const redactedTail = redactSensitiveValues(tail);
+      process.stderr.write(
+        `
+${pc19.dim("\u2500\u2500\u2500 Pulumi output (last 60 lines, redacted) \u2500\u2500\u2500")}
+${redactedTail}
+${pc19.dim("\u2500\u2500\u2500 end Pulumi output \u2500\u2500\u2500")}
+
+`
+      );
+    }
     trackError("DEPLOYMENT_FAILED", "email:connect", { step: "deploy" });
     throw new Error(`Pulumi deployment failed: ${msg}`);
   }
+  pulumiLog = [];
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
     const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
     const hostedZone = await findHostedZone2(outputs.domain, region);
@@ -21089,6 +21257,77 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   }
   console.log();
 }
+var NOT_VERIFIED_PATTERN = /not verified/i;
+function mapInboundTestSendError(error, ctx) {
+  if (error instanceof WrapsError) {
+    return error;
+  }
+  if (!(error instanceof Error)) {
+    return new WrapsError(
+      `Failed to send inbound test email to ${ctx.recipient}`,
+      "INBOUND_TEST_SEND_FAILED",
+      "An unexpected error occurred while sending the test email.\n\nCheck infrastructure status:\n  wraps email status\n  wraps email doctor",
+      "https://wraps.dev/docs/guides/email/troubleshooting"
+    );
+  }
+  const name = error.name;
+  const message = error.message || "";
+  if (name === "MailFromDomainNotVerifiedException") {
+    return new WrapsError(
+      `Custom MAIL FROM domain is not verified for ${ctx.domain}`,
+      "INBOUND_TEST_MAIL_FROM_NOT_VERIFIED",
+      `The MAIL FROM domain configured for "${ctx.domain}" is not fully verified.
+
+Verify DNS records:
+  wraps email verify
+
+Or remove the custom MAIL FROM domain in the SES console and retry.`,
+      "https://docs.aws.amazon.com/ses/latest/dg/mail-from.html"
+    );
+  }
+  if (name === "MessageRejected" || name === "InvalidParameterValue" || NOT_VERIFIED_PATTERN.test(message)) {
+    return new WrapsError(
+      `SES rejected the inbound test send: ${message || name}`,
+      "INBOUND_TEST_MESSAGE_REJECTED",
+      [
+        `Tried to send: ${ctx.source} \u2192 ${ctx.recipient} (region ${ctx.region})`,
+        "",
+        "Most likely causes:",
+        `  \u2022 Your SES account is in the sandbox and ${ctx.recipient} is not a verified address`,
+        `  \u2022 The sender domain "${ctx.domain}" is not verified for sending in ${ctx.region}`,
+        `  \u2022 The receiving domain "${ctx.receivingDomain}" is verified for receiving (MX) but not for sending`,
+        "",
+        "Check status:",
+        "  wraps email status",
+        "  wraps email doctor",
+        "",
+        "Exit the SES sandbox to send to any address:",
+        "  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html"
+      ].join("\n"),
+      "https://wraps.dev/docs/guides/email/troubleshooting"
+    );
+  }
+  if (name === "AccountSendingPausedException" || name === "ConfigurationSetSendingPausedException") {
+    return new WrapsError(
+      "SES sending is paused for this account",
+      "INBOUND_TEST_SENDING_PAUSED",
+      "Your SES account or configuration set has sending paused, usually due to a high bounce or complaint rate.\n\nCheck the SES Reputation Dashboard in the AWS console and resume sending once the issue is resolved.",
+      "https://docs.aws.amazon.com/ses/latest/dg/reputationdashboard.html"
+    );
+  }
+  if (name === "AccessDeniedException" || name === "AccessDenied") {
+    return new WrapsError(
+      `IAM permission denied: ses:SendEmail in ${ctx.region}`,
+      "INBOUND_TEST_PERMISSION_DENIED",
+      `Your AWS credentials lack the "ses:SendEmail" permission in region ${ctx.region}.
+
+View required SES permissions:
+  wraps permissions --service email --json`,
+      "https://wraps.dev/docs/guides/aws-setup/permissions"
+    );
+  }
+  return error;
+}
 async function inboundTest(options) {
   if (!isJsonMode()) {
     clack22.intro(pc24.bold("Inbound Email Test"));
@@ -21112,34 +21351,45 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   const receivingDomain = inbound.receivingDomain || (inbound.subdomain ? `${inbound.subdomain}.${emailConfig.domain}` : emailConfig.domain || "");
   const bucketName = inbound.bucketName || `wraps-inbound-${identity.accountId}-${region}`;
   const testRecipient = `test@${receivingDomain}`;
+  const testSource = `test@${emailConfig.domain}`;
   const testSubject = `Wraps Inbound Test - ${(/* @__PURE__ */ new Date()).toISOString()}`;
   await progress.execute(`Sending test email to ${testRecipient}`, async () => {
     const { SESClient: SESClient7, SendEmailCommand: SendEmailCommand2 } = await import("@aws-sdk/client-ses");
     const ses = new SESClient7({ region });
-    await ses.send(
-      new SendEmailCommand2({
-        Source: `test@${emailConfig.domain}`,
-        Destination: {
-          ToAddresses: [testRecipient]
-        },
-        Message: {
-          Subject: { Data: testSubject },
-          Body: {
-            Text: {
-              Data: "This is a test email from Wraps CLI to verify inbound email processing."
-            },
-            Html: {
-              Data: "<h1>Wraps Inbound Test</h1><p>This email was sent to verify inbound email processing is working correctly.</p>"
+    try {
+      await ses.send(
+        new SendEmailCommand2({
+          Source: testSource,
+          Destination: {
+            ToAddresses: [testRecipient]
+          },
+          Message: {
+            Subject: { Data: testSubject },
+            Body: {
+              Text: {
+                Data: "This is a test email from Wraps CLI to verify inbound email processing."
+              },
+              Html: {
+                Data: "<h1>Wraps Inbound Test</h1><p>This email was sent to verify inbound email processing is working correctly.</p>"
+              }
             }
           }
-        }
-      })
-    );
+        })
+      );
+    } catch (error) {
+      throw mapInboundTestSendError(error, {
+        source: testSource,
+        recipient: testRecipient,
+        domain: emailConfig.domain || "",
+        receivingDomain,
+        region
+      });
+    }
   });
-  const spinner10 = clack22.spinner();
-  spinner10.start("Waiting for email to be processed...");
   const { S3Client: S3Client2, ListObjectsV2Command: ListObjectsV2Command2, GetObjectCommand: GetObjectCommand2 } = await import("@aws-sdk/client-s3");
   const s34 = new S3Client2({ region });
+  const spinner10 = clack22.spinner();
+  spinner10.start("Waiting for email to be processed...");
   let found = false;
   const startTime = Date.now();
   const timeout = 3e4;