@wraps.dev/cli 2.19.0 → 2.19.2

package/dist/cli.js

@@ -820,6 +820,18 @@ To remove: wraps destroy --stack ${stackName}`,
         "Use a valid AWS region like: us-east-1, eu-west-1, ap-southeast-1",
         "https://docs.aws.amazon.com/general/latest/gr/rande.html"
       ),
+      // The accountId parameter is kept in the signature so callers don't
+      // have to change, but it is deliberately not included in the output —
+      // the user ran the command so they know their own account, and keeping
+      // IDs out of error text matches the `sanitizeErrorMessage` posture used
+      // elsewhere in the error system.
+      regionRequired: (_accountId, savedRegions) => new WrapsError(
+        "Region is required and could not be determined",
+        "REGION_REQUIRED",
+        savedRegions.length > 0 ? `Pass --region or set AWS_REGION.
+Saved regions: ${savedRegions.join(", ")}` : "Pass --region or set AWS_REGION.\nNo saved Wraps deployments found.",
+        "https://wraps.dev/docs/cli-reference"
+      ),
       pulumiError: (message) => new WrapsError(
         `Infrastructure deployment failed: ${message}`,
         "PULUMI_ERROR",
@@ -842,7 +854,7 @@ To remove: wraps destroy --stack ${stackName}`,
         "The Pulumi stack is locked from a previous run",
         "STACK_LOCKED",
         "This happens when a previous deployment was interrupted.\n\nFor local state, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nFor S3 state, delete the lock object in your wraps-state-* bucket under .pulumi/locks/\n\nThen try your command again.",
-        "https://wraps.dev/docs/guides/aws-setup/permissions/troubleshooting"
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
       // SMS-specific errors
       smsNotConfigured: () => new WrapsError(
@@ -958,7 +970,7 @@ View required SES permissions:
         `SES rejected the message: ${detail}`,
         "SES_MESSAGE_REJECTED",
         "Common causes:\n  \u2022 Account is in the SES sandbox and the recipient is not a verified address\n  \u2022 Sender identity (domain or email) is not verified for sending\n  \u2022 The sender domain is verified for receiving but not for sending\n\nCheck status:\n  wraps email status\n  wraps email doctor\n\nRequest production access (exit sandbox):\n  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html",
-        "https://wraps.dev/docs/guides/email/troubleshooting"
+        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
       ),
       sesMailFromNotVerified: (detail) => new WrapsError(
         `SES MAIL FROM domain is not verified: ${detail}`,
@@ -1088,25 +1100,25 @@ You may need to merge your existing rules into the wraps rule set.`,
         "wraps/wraps.config.ts not found",
         "WRAPS_CONFIG_NOT_FOUND",
         "Initialize templates first:\n  wraps email templates init",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       ),
       templateCompilationFailed: (name, error) => new WrapsError(
         `Failed to compile template "${name}": ${error}`,
         "TEMPLATE_COMPILATION_FAILED",
         "Check your template for syntax errors and ensure all imports are valid.",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       ),
       notAuthenticated: () => new WrapsError(
         "Not authenticated to Wraps Platform",
         "NOT_AUTHENTICATED",
         "Sign in first:\n  wraps auth login\n\nOr provide an API key:\n  wraps push --token wraps_...\n  WRAPS_API_KEY=wraps_... wraps push",
-        "https://wraps.dev/docs/auth"
+        "https://wraps.dev/docs/cli-reference/auth"
       ),
       templatePushFailed: (name, error) => new WrapsError(
         `Failed to push template "${name}": ${error}`,
         "TEMPLATE_PUSH_FAILED",
         "Check your API key and network connection.",
-        "https://wraps.dev/docs/templates-as-code"
+        "https://wraps.dev/docs/guides/templates"
       )
     };
   }
@@ -1195,8 +1207,8 @@ async function validateAWSCredentialsWithDetails() {
   }
 }
 async function resolveAWSCredentialsToEnv() {
-  delete process.env.AWS_PROFILE;
   if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+    delete process.env.AWS_PROFILE;
     return;
   }
   const sts = new STSClient2({});
@@ -1223,6 +1235,7 @@ async function resolveAWSCredentialsToEnv() {
   if (creds.sessionToken) {
     process.env.AWS_SESSION_TOKEN = creds.sessionToken;
   }
+  delete process.env.AWS_PROFILE;
 }
 async function checkRegion(region) {
   return SES_REGIONS.includes(region);
@@ -1702,8 +1715,8 @@ async function ensurePulumiWorkDir(options) {
       );
       return;
     } catch (error) {
-      const clack55 = await import("@clack/prompts");
-      clack55.log.warn(
+      const clack56 = await import("@clack/prompts");
+      clack56.log.warn(
         `S3 state backend unavailable (${error instanceof Error ? error.message : error}). Using local state.`
       );
     }
@@ -4423,6 +4436,7 @@ __export(prompts_exports, {
   confirmConnect: () => confirmConnect,
   confirmDeploy: () => confirmDeploy,
   getAvailableFeatures: () => getAvailableFeatures,
+  isInteractive: () => isInteractive,
   promptConfigPreset: () => promptConfigPreset,
   promptConflictResolution: () => promptConflictResolution,
   promptContinueManualDNS: () => promptContinueManualDNS,
@@ -4448,6 +4462,9 @@ __export(prompts_exports, {
 });
 import * as clack6 from "@clack/prompts";
 import pc8 from "picocolors";
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true && !process.env.CI;
+}
 async function promptProvider() {
   const provider = await clack6.select({
     message: "Where is your app hosted?",
@@ -6783,23 +6800,23 @@ async function withLockRetry(fn, options) {
     if (parsed.code !== "STACK_LOCKED") {
       throw error;
     }
-    const clack55 = await import("@clack/prompts");
+    const clack56 = await import("@clack/prompts");
     const pc60 = (await import("picocolors")).default;
     if (options.autoConfirm) {
-      clack55.log.warn(
+      clack56.log.warn(
         "Stack is locked from a previous interrupted run. Auto-clearing..."
       );
     } else {
-      const shouldClear = await clack55.confirm({
+      const shouldClear = await clack56.confirm({
         message: `Stack is locked from a previous interrupted run. ${pc60.yellow("Clear the stale lock and retry?")}`,
         initialValue: true
       });
-      if (clack55.isCancel(shouldClear) || !shouldClear) {
+      if (clack56.isCancel(shouldClear) || !shouldClear) {
         throw errors.stackLocked();
       }
     }
     const cleared = await clearStackLocks(options.accountId, options.region);
-    clack55.log.info(
+    clack56.log.info(
       `Cleared ${cleared} lock file${cleared === 1 ? "" : "s"}. Retrying...`
     );
     return fn();
@@ -6815,26 +6832,11 @@ var init_pulumi = __esm({
   }
 });
 
-// src/constants.ts
-function getDefaultRegion() {
-  return process.env.AWS_REGION || DEFAULT_AWS_REGION;
-}
-var DEFAULT_AWS_REGION;
-var init_constants = __esm({
-  "src/constants.ts"() {
-    "use strict";
-    init_esm_shims();
-    DEFAULT_AWS_REGION = "us-east-1";
-  }
-});
-
 // src/infrastructure/shared/resource-checks.ts
 async function roleExists(roleName) {
   try {
     const { IAMClient: IAMClient5, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
-    const iam10 = new IAMClient5({
-      region: getDefaultRegion()
-    });
+    const iam10 = new IAMClient5({ region: "us-east-1" });
     await iam10.send(new GetRoleCommand3({ RoleName: roleName }));
     return true;
   } catch (error) {
@@ -6845,12 +6847,10 @@ async function roleExists(roleName) {
     return false;
   }
 }
-async function tableExists(tableName) {
+async function tableExists(tableName, region) {
   try {
     const { DynamoDBClient: DynamoDBClient7, DescribeTableCommand: DescribeTableCommand2 } = await import("@aws-sdk/client-dynamodb");
-    const dynamodb3 = new DynamoDBClient7({
-      region: getDefaultRegion()
-    });
+    const dynamodb3 = new DynamoDBClient7({ region });
     await dynamodb3.send(new DescribeTableCommand2({ TableName: tableName }));
     return true;
   } catch (error) {
@@ -6861,12 +6861,10 @@ async function tableExists(tableName) {
     return false;
   }
 }
-async function sqsQueueExists(queueName) {
+async function sqsQueueExists(queueName, region) {
   try {
     const { SQSClient, GetQueueUrlCommand } = await import("@aws-sdk/client-sqs");
-    const sqs5 = new SQSClient({
-      region: getDefaultRegion()
-    });
+    const sqs5 = new SQSClient({ region });
     const response = await sqs5.send(
       new GetQueueUrlCommand({ QueueName: queueName })
     );
@@ -6875,12 +6873,10 @@ async function sqsQueueExists(queueName) {
     return null;
   }
 }
-async function snsTopicExists(topicName) {
+async function snsTopicExists(topicName, region) {
   try {
     const { SNSClient: SNSClient3, ListTopicsCommand: ListTopicsCommand2 } = await import("@aws-sdk/client-sns");
-    const sns3 = new SNSClient3({
-      region: getDefaultRegion()
-    });
+    const sns3 = new SNSClient3({ region });
     let nextToken;
     do {
       const response = await sns3.send(
@@ -6899,12 +6895,10 @@ async function snsTopicExists(topicName) {
     return null;
   }
 }
-async function lambdaFunctionExists(functionName) {
+async function lambdaFunctionExists(functionName, region) {
   try {
     const { LambdaClient: LambdaClient3, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
-    const lambda4 = new LambdaClient3({
-      region: getDefaultRegion()
-    });
+    const lambda4 = new LambdaClient3({ region });
     await lambda4.send(new GetFunctionCommand({ FunctionName: functionName }));
     return true;
   } catch (error) {
@@ -6919,7 +6913,6 @@ var init_resource_checks = __esm({
   "src/infrastructure/shared/resource-checks.ts"() {
     "use strict";
     init_esm_shims();
-    init_constants();
   }
 });
 
@@ -7350,12 +7343,10 @@ function getPackageRoot() {
   }
   throw new Error("Could not find package.json");
 }
-async function findEventSourceMapping(functionName, queueArn) {
+async function findEventSourceMapping(functionName, queueArn, region) {
   try {
     const { LambdaClient: LambdaClient3, ListEventSourceMappingsCommand } = await import("@aws-sdk/client-lambda");
-    const lambda4 = new LambdaClient3({
-      region: getDefaultRegion()
-    });
+    const lambda4 = new LambdaClient3({ region });
     const response = await lambda4.send(
       new ListEventSourceMappingsCommand({
         FunctionName: functionName,
@@ -7464,7 +7455,7 @@ async function deployLambdaFunctions(config2) {
     )
   });
   const functionName = "wraps-email-event-processor";
-  const exists = await lambdaFunctionExists(functionName);
+  const exists = await lambdaFunctionExists(functionName, config2.region);
   const lambdaEnvironment = {
     variables: {
       TABLE_NAME: config2.tableName,
@@ -7512,7 +7503,8 @@ async function deployLambdaFunctions(config2) {
   const queueArnValue = `arn:aws:sqs:${config2.region}:${config2.accountId}:wraps-email-events`;
   const existingMappingUuid = await findEventSourceMapping(
     functionName,
-    queueArnValue
+    queueArnValue,
+    config2.region
   );
   const mappingConfig = {
     eventSourceArn: config2.queueArn,
@@ -7545,7 +7537,6 @@ var init_lambda = __esm({
   "src/infrastructure/resources/lambda.ts"() {
     "use strict";
     init_esm_shims();
-    init_constants();
     init_resource_checks();
     nodeBuiltins = builtinModules.flatMap((m) => [m, `node:${m}`]);
   }
@@ -7893,7 +7884,7 @@ function retentionToAWSPeriod2(retention) {
   }
 }
 async function createMailManagerArchive(config2) {
-  const region = config2.region || getDefaultRegion();
+  const region = config2.region;
   const archiveName = `wraps-${config2.name}-archive`;
   const mailManagerClient = new MailManagerClient({ region });
   const sesClient = new SESv2Client3({ region });
@@ -7995,7 +7986,6 @@ var init_mail_manager = __esm({
   "src/infrastructure/resources/mail-manager.ts"() {
     "use strict";
     init_esm_shims();
-    init_constants();
   }
 });
 
@@ -9675,6 +9665,60 @@ var init_test = __esm({
   }
 });
 
+// src/utils/shared/region-resolver.ts
+var region_resolver_exports = {};
+__export(region_resolver_exports, {
+  resolveRegionForCommand: () => resolveRegionForCommand
+});
+import * as clack28 from "@clack/prompts";
+async function resolveRegionForCommand(opts) {
+  const { accountId, optionRegion, service, label = "deployment" } = opts;
+  if (optionRegion) {
+    return optionRegion;
+  }
+  const envRegion = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+  if (envRegion) {
+    return envRegion;
+  }
+  const connections = (service ? await findConnectionsWithService(accountId, service) : await findConnectionsForAccount(accountId)) ?? [];
+  if (connections.length === 1) {
+    return connections[0].region;
+  }
+  const savedRegions = connections.map((c) => c.region);
+  if (connections.length === 0) {
+    return getAWSRegion();
+  }
+  if (!isInteractive() || isJsonMode()) {
+    throw errors.regionRequired(accountId, savedRegions);
+  }
+  const selected = await clack28.select({
+    message: `Multiple ${label}s found. Which region?`,
+    options: connections.map((conn) => ({
+      value: conn.region,
+      label: conn.region
+    }))
+  });
+  if (clack28.isCancel(selected)) {
+    throw new WrapsError(
+      "Operation cancelled",
+      "OPERATION_CANCELLED",
+      `Pass --region to skip the prompt. Saved regions: ${savedRegions.join(", ")}`
+    );
+  }
+  return selected;
+}
+var init_region_resolver = __esm({
+  "src/utils/shared/region-resolver.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_aws();
+    init_errors();
+    init_json_output();
+    init_metadata();
+    init_prompts();
+  }
+});
+
 // src/utils/dns/caa.ts
 var caa_exports = {};
 __export(caa_exports, {
@@ -10080,7 +10124,7 @@ import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
 import { join as join21 } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
-import { cancel as cancel31, confirm as confirm26, intro as intro51, isCancel as isCancel35, log as log50 } from "@clack/prompts";
+import { cancel as cancel31, confirm as confirm26, intro as intro51, isCancel as isCancel36, log as log50 } from "@clack/prompts";
 import pc58 from "picocolors";
 function isStandaloneInstall() {
   return process.execPath.includes(".wraps/runtime");
@@ -10142,7 +10186,7 @@ async function update(currentVersion) {
   const shouldUpdate = await confirm26({
     message: `Update to v${latestVersion}?`
   });
-  if (isCancel35(shouldUpdate) || !shouldUpdate) {
+  if (isCancel36(shouldUpdate) || !shouldUpdate) {
     cancel31("Update cancelled.");
     return;
   }
@@ -10233,7 +10277,7 @@ init_esm_shims();
 import { readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname5, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
-import * as clack54 from "@clack/prompts";
+import * as clack55 from "@clack/prompts";
 import pc59 from "picocolors";
 
 // src/commands/auth/login.ts
@@ -10648,26 +10692,30 @@ async function runDiagnostics(state) {
     }
   }
   if (state.credentialsConfigured) {
+    const regionUsed = state.region || "us-east-1";
+    const regionNote = state.region ? `Region: ${regionUsed}` : `No AWS_REGION set \u2014 defaulted to ${regionUsed}. Set AWS_REGION if your deployment lives elsewhere.`;
     try {
-      const region = state.region || "us-east-1";
-      const sandbox = await isSESSandbox(region);
+      const sandbox = await isSESSandbox(regionUsed);
       if (sandbox) {
         results.push({
           status: "warn",
           message: "SES is in sandbox mode",
-          details: "You can only send to verified emails. Request production access in AWS console."
+          details: `You can only send to verified emails. Request production access in AWS console.
+${regionNote}`
         });
       } else {
         results.push({
           status: "pass",
-          message: "SES has production access"
+          message: "SES has production access",
+          details: regionNote
         });
       }
     } catch {
       results.push({
         status: "info",
         message: "Could not check SES status",
-        details: "SES may not be enabled in this region"
+        details: `SES may not be enabled in this region.
+${regionNote}`
       });
     }
   }
@@ -11812,6 +11860,7 @@ async function createCdnBucket(config2) {
   const corsOrigins = [
     "https://wraps.dev",
     "https://*.wraps.dev",
+    "https://*.wraps.localhost",
     "http://localhost:3000",
     "http://localhost:3001",
     "http://localhost:3002",
@@ -12201,8 +12250,16 @@ async function createServiceIAMRole(config2) {
 
 // src/infrastructure/vercel-oidc.ts
 init_esm_shims();
-init_constants();
 import * as aws3 from "@pulumi/aws";
+
+// src/constants.ts
+init_esm_shims();
+var DEFAULT_AWS_REGION = "us-east-1";
+function getDefaultRegion() {
+  return process.env.AWS_REGION || DEFAULT_AWS_REGION;
+}
+
+// src/infrastructure/vercel-oidc.ts
 async function getExistingOIDCProviderArn(url) {
   try {
     const { IAMClient: IAMClient5, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
@@ -17508,9 +17565,9 @@ async function createAlertingResources(config2) {
 init_esm_shims();
 init_resource_checks();
 import * as aws5 from "@pulumi/aws";
-async function createDynamoDBTables(_config) {
+async function createDynamoDBTables(config2) {
   const tableName = "wraps-email-history";
-  const exists = await tableExists(tableName);
+  const exists = await tableExists(tableName, config2.region);
   const emailHistory = exists ? new aws5.dynamodb.Table(
     tableName,
     {
@@ -18048,7 +18105,6 @@ async function createSESResources(config2) {
 
 // src/infrastructure/resources/smtp-credentials.ts
 init_esm_shims();
-init_constants();
 import { createHmac as createHmac3 } from "crypto";
 import * as aws10 from "@pulumi/aws";
 function convertToSMTPPassword2(secretAccessKey, region) {
@@ -18138,11 +18194,11 @@ import * as aws11 from "@pulumi/aws";
 var SQS_TIMEOUTS = {
   customTimeouts: { create: "2m", update: "2m", delete: "2m" }
 };
-async function createSQSResources() {
+async function createSQSResources(config2) {
   const dlqName = "wraps-email-events-dlq";
   const queueName = "wraps-email-events";
-  const dlqUrl = await sqsQueueExists(dlqName);
-  const queueUrl = await sqsQueueExists(queueName);
+  const dlqUrl = await sqsQueueExists(dlqName, config2.region);
+  const queueUrl = await sqsQueueExists(queueName, config2.region);
   const dlqConfig = {
     name: dlqName,
     messageRetentionSeconds: 1209600,
@@ -18281,12 +18337,13 @@ async function deployEmailStack(config2) {
   let dynamoTables;
   if (emailConfig.eventTracking?.dynamoDBHistory) {
     dynamoTables = await createDynamoDBTables({
+      region: config2.region,
       retention: emailConfig.eventTracking.archiveRetention
     });
   }
   let sqsResources;
   if (emailConfig.eventTracking?.enabled) {
-    sqsResources = await createSQSResources();
+    sqsResources = await createSQSResources({ region: config2.region });
   }
   if (emailConfig.eventTracking?.enabled && sesResources && sqsResources) {
     await createEventBridgeResources({
@@ -21245,6 +21302,8 @@ async function inboundInit(options) {
       subdomain,
       bucketName: `wraps-inbound-${identity.accountId}-${region}`,
       webhookUrl: webhookUrl || null,
+      webhookSecret: webhookUrl ? webhookSecret : null,
+      webhookHeader: webhookUrl ? "X-Wraps-Inbound-Key" : null,
       dnsAutoCreated,
       region
     });
@@ -21263,6 +21322,27 @@ async function inboundInit(options) {
   if (dnsAutoCreated) {
     console.log(`  ${pc24.dim("DNS:")}              ${pc24.green("Auto-created")}`);
   }
+  if (webhookUrl) {
+    const setupLines = [
+      `EventBridge will POST every ${pc24.cyan("email.received")} event to:`,
+      `  ${pc24.cyan(webhookUrl)}`,
+      "",
+      "Verify the request by checking this header on every POST:",
+      `  ${pc24.bold("X-Wraps-Inbound-Key")}: ${pc24.yellow(webhookSecret)}`,
+      "",
+      pc24.bold("Save this secret now \u2014 it is only shown once."),
+      `Retrieve it later with: ${pc24.cyan("wraps email inbound status --reveal-secret")}`,
+      "",
+      "Body shape (JSON):",
+      pc24.dim(
+        '  { "emailId", "from", "to", "subject", "html", "text", "attachments", "headers", ... }'
+      ),
+      "",
+      `Docs: ${pc24.cyan("https://wraps.dev/docs/quickstart/email/inbound")}`
+    ].join("\n");
+    console.log();
+    clack22.note(setupLines, "Webhook setup");
+  }
   console.log();
   console.log(pc24.bold("Next steps:"));
   if (dnsAutoCreated) {
@@ -21413,6 +21493,8 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
       bucketName: inbound.bucketName || "",
       region,
       webhookUrl: inbound.webhookUrl || null,
+      webhookHeader: inbound.webhookUrl ? "X-Wraps-Inbound-Key" : null,
+      webhookSecret: options.revealSecret && inbound.webhookUrl ? inbound.webhookSecret || null : null,
       receiptRuleSetActive: activeRuleSet === RULE_SET_NAME,
       retention: inbound.retention || null
     });
@@ -21436,6 +21518,20 @@ Enable it: ${pc24.cyan("wraps email inbound init")}
   console.log(
     `  ${pc24.dim("Webhook URL:")}       ${inbound.webhookUrl ? pc24.cyan(inbound.webhookUrl) : pc24.dim("not configured")}`
   );
+  if (inbound.webhookUrl) {
+    console.log(
+      `  ${pc24.dim("Webhook header:")}    ${pc24.cyan("X-Wraps-Inbound-Key")}`
+    );
+    if (options.revealSecret) {
+      console.log(
+        `  ${pc24.dim("Webhook secret:")}    ${inbound.webhookSecret ? pc24.yellow(inbound.webhookSecret) : pc24.dim("not set")}`
+      );
+    } else {
+      console.log(
+        `  ${pc24.dim("Webhook secret:")}    ${pc24.dim("hidden \u2014 pass --reveal-secret to show")}`
+      );
+    }
+  }
   console.log(
     `  ${pc24.dim("Receipt rule set:")}  ${activeRuleSet === RULE_SET_NAME ? pc24.green("active") : pc24.yellow("inactive")}`
   );
@@ -21571,7 +21667,7 @@ function mapInboundTestSendError(error, ctx) {
       `Failed to send inbound test email to ${ctx.recipient}`,
       "INBOUND_TEST_SEND_FAILED",
       "An unexpected error occurred while sending the test email.\n\nCheck infrastructure status:\n  wraps email status\n  wraps email doctor",
-      "https://wraps.dev/docs/guides/email/troubleshooting"
+      "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
     );
   }
   const name = error.name;
@@ -21608,7 +21704,7 @@ Or remove the custom MAIL FROM domain in the SES console and retry.`,
         "Exit the SES sandbox to send to any address:",
         "  https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html"
       ].join("\n"),
-      "https://wraps.dev/docs/guides/email/troubleshooting"
+      "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
     );
   }
   if (name === "AccountSendingPausedException" || name === "ConfigurationSetSendingPausedException") {
@@ -23049,7 +23145,7 @@ async function replyInitForSingleDomain(params) {
       `The Pulumi deploy completed but the SSM parameter ${ssmParameterName(domain)} was not found. Run:
   wraps email reply status
 to diagnose, or retry the init.`,
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const finalEntry = {
@@ -23162,7 +23258,7 @@ async function replyInit(options) {
       "Reply threading requires inbound email infrastructure",
       "REPLY_REQUIRES_INBOUND",
       "Deploy inbound first:\n  wraps email inbound init\n\nThen enable reply threading:\n  wraps email reply init --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const emailService = metadata.services.email;
@@ -23178,7 +23274,7 @@ async function replyInit(options) {
       "No inbound domains configured",
       "REPLY_NO_INBOUND_DOMAINS",
       "Add an inbound domain first:\n  wraps email inbound add --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   let targetDomains;
@@ -23207,7 +23303,7 @@ async function replyInit(options) {
         "REPLY_INBOUND_DOMAIN_NOT_FOUND",
         `Add it to inbound first:
   wraps email inbound add ${target}`,
-        "https://wraps.dev/docs/guides/email/reply-threading"
+        "https://wraps.dev/docs/guides/reply-threading"
       );
     }
     if (isReplyEnabledFor(metadata, target)) {
@@ -23216,7 +23312,7 @@ async function replyInit(options) {
         "REPLY_ALREADY_ENABLED",
         `To rotate the signing secret, run:
   wraps email reply rotate --domain ${target}`,
-        "https://wraps.dev/docs/guides/email/reply-threading"
+        "https://wraps.dev/docs/guides/reply-threading"
       );
     }
     targetDomains = [target];
@@ -23225,7 +23321,7 @@ async function replyInit(options) {
       "Specify a domain or use --all",
       "REPLY_MISSING_DOMAIN",
       "Use one of:\n  wraps email reply init --domain yourapp.com\n  wraps email reply init --all",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
@@ -23277,7 +23373,7 @@ async function replyRotate(options) {
       "--domain is required for rotate",
       "REPLY_ROTATE_MISSING_DOMAIN",
       "Usage:\n  wraps email reply rotate --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const identity = await progress.execute(
@@ -23291,7 +23387,7 @@ async function replyRotate(options) {
       "Reply threading is not enabled",
       "REPLY_NOT_ENABLED",
       "Enable it first:\n  wraps email reply init --domain yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const rt = metadata.services.email.config.replyThreading;
@@ -23302,7 +23398,7 @@ async function replyRotate(options) {
       "REPLY_DOMAIN_NOT_ENABLED",
       `Enable it first:
   wraps email reply init --domain ${options.domain}`,
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const parameterName = entry.parameterName || ssmParameterName(options.domain);
@@ -23327,7 +23423,7 @@ async function replyRotate(options) {
           "REPLY_SECRET_PARAMETER_MISSING",
           `The signing secret for ${options.domain} has not been created yet. Run:
   wraps email reply init --domain ${options.domain}`,
-          "https://wraps.dev/docs/guides/email/reply-threading"
+          "https://wraps.dev/docs/guides/reply-threading"
         );
       }
       throw error;
@@ -23567,7 +23663,7 @@ async function replyDestroy(options) {
       "Specify a domain or use --all",
       "REPLY_DESTROY_MISSING_DOMAIN",
       "Usage:\n  wraps email reply destroy --domain yourapp.com\n  wraps email reply destroy --all",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   if (!(options.force || isJsonMode())) {
@@ -23622,7 +23718,7 @@ async function replyDecode(addressInput, options) {
       "Usage: wraps email reply decode <token>@r.mail.yourapp.com",
       "REPLY_DECODE_MISSING_ADDRESS",
       "Provide a signed reply address like:\n  wraps email reply decode abcDEF123@r.mail.yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const at = addressInput.lastIndexOf("@");
@@ -23632,7 +23728,7 @@ async function replyDecode(addressInput, options) {
       "Address must be in the form <token>@r.mail.example.com",
       "REPLY_DECODE_MALFORMED_ADDRESS",
       "Pass a full signed reply address:\n  wraps email reply decode abcDEF123@r.mail.yourapp.com",
-      "https://wraps.dev/docs/guides/email/reply-threading"
+      "https://wraps.dev/docs/guides/reply-threading"
     );
   }
   const local = addressInput.slice(0, at);
@@ -23683,7 +23779,8 @@ init_json_output();
 init_metadata();
 init_output();
 init_pulumi();
-import * as clack28 from "@clack/prompts";
+init_region_resolver();
+import * as clack29 from "@clack/prompts";
 import * as pulumi21 from "@pulumi/pulumi";
 import pc30 from "picocolors";
 async function restore(options) {
@@ -23696,15 +23793,15 @@ async function restore(options) {
     );
   }
   if (!isJsonMode()) {
-    clack28.intro(
+    clack29.intro(
       pc30.bold(
         options.preview ? "Wraps Restore Preview" : "Wraps Restore - Remove Wraps Infrastructure"
       )
     );
-    clack28.log.info(
+    clack29.log.info(
       `${pc30.yellow("Note:")} This will remove all Wraps-managed infrastructure.`
     );
-    clack28.log.info(
+    clack29.log.info(
       "Your original AWS resources remain untouched (Wraps never modifies them).\n"
     );
   }
@@ -23715,17 +23812,18 @@ async function restore(options) {
     async () => validateAWSCredentials()
   );
   progress.info(`Connected to AWS account: ${pc30.cyan(identity.accountId)}`);
-  let region = options.region;
-  if (!region) {
-    const defaultRegion = await getAWSRegion();
-    region = defaultRegion;
-  }
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    service: "email",
+    label: "email deployment"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
-    clack28.log.error(
+    clack29.log.error(
       `No Wraps connection found for account ${pc30.cyan(identity.accountId)} in region ${pc30.cyan(region)}`
     );
-    clack28.log.info(
+    clack29.log.info(
       `Use ${pc30.cyan("wraps email init")} or ${pc30.cyan("wraps email connect")} to create a connection first.`
     );
     process.exit(1);
@@ -23750,12 +23848,12 @@ ${pc30.bold("The following Wraps resources will be removed:")}
   console.log(`  ${pc30.cyan("\u2713")} IAM Role (wraps-email-role)`);
   console.log("");
   if (!(options.force || options.preview)) {
-    const confirmed = await clack28.confirm({
+    const confirmed = await clack29.confirm({
       message: "Proceed with removal? This cannot be undone.",
       initialValue: false
     });
-    if (clack28.isCancel(confirmed) || !confirmed) {
-      clack28.cancel("Removal cancelled.");
+    if (clack29.isCancel(confirmed) || !confirmed) {
+      clack29.cancel("Removal cancelled.");
       process.exit(0);
     }
   }
@@ -23795,7 +23893,7 @@ ${pc30.bold("The following Wraps resources will be removed:")}
           costEstimate: "Monthly cost after removal: $0.00",
           commandName: "wraps email restore"
         });
-        clack28.outro(
+        clack29.outro(
           pc30.green(
             "Preview complete. Run without --preview to remove infrastructure."
           )
@@ -23888,7 +23986,7 @@ init_json_output();
 init_metadata();
 init_output();
 init_pulumi();
-import * as clack29 from "@clack/prompts";
+import * as clack30 from "@clack/prompts";
 import * as pulumi22 from "@pulumi/pulumi";
 import pc31 from "picocolors";
 async function emailStatus(options) {
@@ -23896,7 +23994,7 @@ async function emailStatus(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack29.intro(pc31.bold("Wraps Email Status"));
+    clack30.intro(pc31.bold("Wraps Email Status"));
   }
   const identity = await progress.execute(
     "Loading email infrastructure status",
@@ -23911,15 +24009,15 @@ async function emailStatus(options) {
     if (emailConnections.length === 1) {
       region = emailConnections[0].region;
     } else if (emailConnections.length > 1) {
-      const selectedRegion = await clack29.select({
+      const selectedRegion = await clack30.select({
         message: "Multiple email deployments found. Which region?",
         options: emailConnections.map((conn) => ({
           value: conn.region,
           label: conn.region
         }))
       });
-      if (clack29.isCancel(selectedRegion)) {
-        clack29.cancel("Operation cancelled");
+      if (clack30.isCancel(selectedRegion)) {
+        clack30.cancel("Operation cancelled");
         process.exit(0);
       }
       region = selectedRegion;
@@ -23935,7 +24033,7 @@ async function emailStatus(options) {
     stackOutputs = await stack.outputs();
   } catch (_error) {
     progress.stop();
-    clack29.log.error("No email infrastructure found");
+    clack30.log.error("No email infrastructure found");
     console.log(
       `
 Run ${pc31.cyan("wraps email init")} to deploy email infrastructure.
@@ -24031,7 +24129,7 @@ init_output();
 import { existsSync as existsSync9 } from "fs";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
 import { join as join11 } from "path";
-import * as clack30 from "@clack/prompts";
+import * as clack31 from "@clack/prompts";
 import pc32 from "picocolors";
 
 // src/utils/shared/scaffold-claude.ts
@@ -24478,7 +24576,7 @@ async function templatesInit(options) {
   const cwd = process.cwd();
   const wrapsDir = join11(cwd, "wraps");
   if (!isJsonMode()) {
-    clack30.intro(pc32.bold("Templates as Code"));
+    clack31.intro(pc32.bold("Templates as Code"));
   }
   const progress = new DeploymentProgress();
   if (existsSync9(wrapsDir) && !options.force) {
@@ -24495,12 +24593,12 @@ async function templatesInit(options) {
     if (orgs?.length === 1) {
       orgSlug = orgs[0].slug;
     } else if (orgs && orgs.length > 1 && !isJsonMode()) {
-      const selected = await clack30.select({
+      const selected = await clack31.select({
         message: "Which organization?",
         options: orgs.map((o) => ({ value: o.slug, label: o.name }))
       });
-      if (clack30.isCancel(selected)) {
-        clack30.cancel("Operation cancelled.");
+      if (clack31.isCancel(selected)) {
+        clack31.cancel("Operation cancelled.");
         process.exit(0);
       }
       orgSlug = selected;
@@ -24634,7 +24732,7 @@ wraps/.wraps/
     duration_ms: Date.now() - startTime
   });
   console.log();
-  clack30.log.success(pc32.green("Templates as Code initialized!"));
+  clack31.log.success(pc32.green("Templates as Code initialized!"));
   console.log();
   console.log(`  ${pc32.dim("Directory:")} ${pc32.cyan("wraps/")}`);
   console.log(`  ${pc32.dim("Config:")}    ${pc32.cyan("wraps/wraps.config.ts")}`);
@@ -24847,7 +24945,7 @@ init_esm_shims();
 init_events();
 import { existsSync as existsSync11, watch } from "fs";
 import { join as join13 } from "path";
-import * as clack31 from "@clack/prompts";
+import * as clack32 from "@clack/prompts";
 import pc33 from "picocolors";
 
 // src/utils/email/template-compiler.ts
@@ -24972,7 +25070,7 @@ async function templatesPreview(options) {
   if (!existsSync11(configPath)) {
     throw errors.wrapsConfigNotFound();
   }
-  clack31.intro(pc33.bold("Preview Templates"));
+  clack32.intro(pc33.bold("Preview Templates"));
   const config2 = await loadWrapsConfig(wrapsDir);
   const templatesDir = join13(wrapsDir, config2.templatesDir || "./templates");
   if (!existsSync11(templatesDir)) {
@@ -24980,7 +25078,7 @@ async function templatesPreview(options) {
   }
   const templateFiles = await discoverTemplates(templatesDir, options.template);
   if (templateFiles.length === 0) {
-    clack31.log.info("No templates found.");
+    clack32.log.info("No templates found.");
     return;
   }
   const cache = /* @__PURE__ */ new Map();
@@ -25095,11 +25193,11 @@ async function templatesPreview(options) {
       success: true,
       template_count: templateFiles.length
     });
-    clack31.log.success(`Preview server running at ${pc33.cyan(url)}`);
+    clack32.log.success(`Preview server running at ${pc33.cyan(url)}`);
     if (options.template) {
-      clack31.log.info(`Previewing: ${pc33.cyan(options.template)}`);
+      clack32.log.info(`Previewing: ${pc33.cyan(options.template)}`);
     } else {
-      clack31.log.info(
+      clack32.log.info(
         `${templateFiles.length} template${templateFiles.length === 1 ? "" : "s"} available`
       );
     }
@@ -25299,7 +25397,7 @@ import { createHash } from "crypto";
 import { existsSync as existsSync13 } from "fs";
 import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
 import { join as join15 } from "path";
-import * as clack32 from "@clack/prompts";
+import * as clack33 from "@clack/prompts";
 import pc34 from "picocolors";
 
 // src/utils/email/template-render.ts
@@ -25420,7 +25518,7 @@ async function templatesPush(options) {
     throw errors.wrapsConfigNotFound();
   }
   if (!isJsonMode()) {
-    clack32.intro(pc34.bold("Push Templates"));
+    clack33.intro(pc34.bold("Push Templates"));
   }
   const progress = new DeploymentProgress();
   progress.start("Loading configuration");
@@ -25433,7 +25531,7 @@ async function templatesPush(options) {
   const templateFiles = await discoverTemplates(templatesDir, options.template);
   if (templateFiles.length === 0) {
     if (!isJsonMode()) {
-      clack32.log.info("No templates found to push.");
+      clack33.log.info("No templates found to push.");
     }
     return;
   }
@@ -25479,7 +25577,7 @@ async function templatesPush(options) {
         errors: []
       });
     } else {
-      clack32.log.info(
+      clack33.log.info(
         `${unchanged.length} template${unchanged.length === 1 ? "" : "s"} unchanged. Use --force to re-push.`
       );
     }
@@ -25500,7 +25598,7 @@ async function templatesPush(options) {
       });
     } else {
       console.log();
-      clack32.log.info(pc34.bold("Dry run \u2014 no changes made"));
+      clack33.log.info(pc34.bold("Dry run \u2014 no changes made"));
       console.log();
       for (const t of compiled) {
         console.log(
@@ -25552,16 +25650,16 @@ async function templatesPush(options) {
     });
   } else {
     console.log();
-    clack32.log.success(
+    clack33.log.success(
       pc34.green(
         `${compiled.length} template${compiled.length === 1 ? "" : "s"} pushed`
       )
     );
     if (unchanged.length > 0) {
-      clack32.log.info(`${unchanged.length} unchanged (use --force to re-push)`);
+      clack33.log.info(`${unchanged.length} unchanged (use --force to re-push)`);
     }
     if (compileErrors.length > 0) {
-      clack32.log.error(`${compileErrors.length} failed to compile`);
+      clack33.log.error(`${compileErrors.length} failed to compile`);
     }
     console.log();
   }
@@ -25696,20 +25794,21 @@ function transformVariablesForSes(content) {
 }
 async function pushToSES(templates, progress) {
   const results = [];
-  let hasAWSCredentials = false;
-  let region = "us-east-1";
+  const { validateAWSCredentialsWithDetails: validateAWSCredentialsWithDetails2 } = await Promise.resolve().then(() => (init_aws(), aws_exports));
+  let identity;
   try {
-    const { validateAWSCredentialsWithDetails: validateAWSCredentialsWithDetails2, getAWSRegion: getAWSRegion2 } = await Promise.resolve().then(() => (init_aws(), aws_exports));
-    await validateAWSCredentialsWithDetails2();
-    hasAWSCredentials = true;
-    region = await getAWSRegion2();
+    const result = await validateAWSCredentialsWithDetails2();
+    identity = result.identity;
   } catch {
     progress.info("No AWS credentials \u2014 skipping SES push");
     return templates.map((t) => ({ slug: t.slug, success: false }));
   }
-  if (!hasAWSCredentials) {
-    return templates.map((t) => ({ slug: t.slug, success: false }));
-  }
+  const { resolveRegionForCommand: resolveRegionForCommand2 } = await Promise.resolve().then(() => (init_region_resolver(), region_resolver_exports));
+  const region = await resolveRegionForCommand2({
+    accountId: identity.accountId,
+    service: "email",
+    label: "email deployment"
+  });
   const {
     SESv2Client: SESv2Client9,
     CreateEmailTemplateCommand,
@@ -25939,7 +26038,7 @@ init_test();
 
 // src/commands/email/upgrade.ts
 init_esm_shims();
-import * as clack33 from "@clack/prompts";
+import * as clack34 from "@clack/prompts";
 import * as pulumi23 from "@pulumi/pulumi";
 import pc35 from "picocolors";
 init_events();
@@ -25955,11 +26054,12 @@ init_metadata();
 init_output();
 init_prompts();
 init_pulumi();
+init_region_resolver();
 async function upgrade(options) {
   const startTime = Date.now();
   let upgradeAction = "";
   if (!isJsonMode()) {
-    clack33.intro(
+    clack34.intro(
       pc35.bold(
         options.preview ? "Wraps Upgrade Preview" : "Wraps Upgrade - Enhance Your Email Infrastructure"
       )
@@ -25978,17 +26078,18 @@ async function upgrade(options) {
     async () => validateAWSCredentials()
   );
   progress.info(`Connected to AWS account: ${pc35.cyan(identity.accountId)}`);
-  let region = options.region;
-  if (!region) {
-    const defaultRegion = await getAWSRegion();
-    region = defaultRegion;
-  }
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    service: "email",
+    label: "email deployment"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
-    clack33.log.error(
+    clack34.log.error(
       `No Wraps connection found for account ${pc35.cyan(identity.accountId)} in region ${pc35.cyan(region)}`
     );
-    clack33.log.info(
+    clack34.log.info(
       `Use ${pc35.cyan("wraps email init")} to create new infrastructure or ${pc35.cyan("wraps email connect")} to connect existing.`
     );
     process.exit(1);
@@ -26004,8 +26105,8 @@ ${pc35.bold("Current Configuration:")}
   }
   const config2 = metadata.services.email?.config;
   if (!config2) {
-    clack33.log.error("No email configuration found in metadata");
-    clack33.log.info(
+    clack34.log.error("No email configuration found in metadata");
+    clack34.log.info(
       `Use ${pc35.cyan("wraps email init")} to create new infrastructure.`
     );
     process.exit(1);
@@ -26158,12 +26259,12 @@ ${pc35.bold("Current Configuration:")}
   if (options.action) {
     upgradeAction = options.action;
   } else {
-    upgradeAction = await clack33.select({
+    upgradeAction = await clack34.select({
       message: "What would you like to do?",
       options: upgradeOptions
     });
-    if (clack33.isCancel(upgradeAction)) {
-      clack33.cancel("Upgrade cancelled.");
+    if (clack34.isCancel(upgradeAction)) {
+      clack34.cancel("Upgrade cancelled.");
       process.exit(0);
     }
   }
@@ -26171,7 +26272,7 @@ ${pc35.bold("Current Configuration:")}
   let newPreset = metadata.services.email?.preset;
   switch (upgradeAction) {
     case "finish-tracking-domain": {
-      clack33.log.info(
+      clack34.log.info(
         `Checking certificate status for ${pc35.cyan(config2.tracking?.customRedirectDomain ?? "")}...`
       );
       updatedConfig = { ...config2 };
@@ -26192,19 +26293,19 @@ ${pc35.bold("Current Configuration:")}
         disabled: currentPresetIdx >= 0 && idx <= currentPresetIdx ? "Current or lower tier" : void 0
       })).filter((p) => !p.disabled);
       if (availablePresets.length === 0) {
-        clack33.log.warn("Already on highest preset (Enterprise)");
+        clack34.log.warn("Already on highest preset (Enterprise)");
         process.exit(0);
       }
       let selectedPreset;
       if (options.preset) {
         selectedPreset = options.preset;
       } else {
-        selectedPreset = await clack33.select({
+        selectedPreset = await clack34.select({
           message: "Select new preset:",
           options: availablePresets
         });
-        if (clack33.isCancel(selectedPreset)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(selectedPreset)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
       }
@@ -26215,7 +26316,7 @@ ${pc35.bold("Current Configuration:")}
     }
     case "archiving": {
       if (config2.emailArchiving?.enabled) {
-        const archivingAction = await clack33.select({
+        const archivingAction = await clack34.select({
           message: "What would you like to do with email archiving?",
           options: [
             {
@@ -26230,17 +26331,17 @@ ${pc35.bold("Current Configuration:")}
             }
           ]
         });
-        if (clack33.isCancel(archivingAction)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(archivingAction)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (archivingAction === "disable") {
-          const confirmDisable = await clack33.confirm({
+          const confirmDisable = await clack34.confirm({
             message: "Are you sure? Existing archived emails will remain, but new emails won't be archived.",
             initialValue: false
           });
-          if (clack33.isCancel(confirmDisable) || !confirmDisable) {
-            clack33.cancel("Archiving not disabled.");
+          if (clack34.isCancel(confirmDisable) || !confirmDisable) {
+            clack34.cancel("Archiving not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -26251,7 +26352,7 @@ ${pc35.bold("Current Configuration:")}
             }
           };
         } else {
-          const retention = await clack33.select({
+          const retention = await clack34.select({
             message: "Email archive retention period:",
             options: [
               {
@@ -26287,8 +26388,8 @@ ${pc35.bold("Current Configuration:")}
             ],
             initialValue: config2.emailArchiving.retention
           });
-          if (clack33.isCancel(retention)) {
-            clack33.cancel("Upgrade cancelled.");
+          if (clack34.isCancel(retention)) {
+            clack34.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -26300,19 +26401,19 @@ ${pc35.bold("Current Configuration:")}
           };
         }
       } else {
-        const enableArchiving = await clack33.confirm({
+        const enableArchiving = await clack34.confirm({
           message: "Enable email archiving? (Store full email content with HTML for viewing)",
           initialValue: true
         });
-        if (clack33.isCancel(enableArchiving)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(enableArchiving)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (!enableArchiving) {
-          clack33.log.info("Email archiving not enabled.");
+          clack34.log.info("Email archiving not enabled.");
           process.exit(0);
         }
-        const retention = await clack33.select({
+        const retention = await clack34.select({
           message: "Email archive retention period:",
           options: [
             {
@@ -26348,16 +26449,16 @@ ${pc35.bold("Current Configuration:")}
           ],
           initialValue: "90days"
         });
-        if (clack33.isCancel(retention)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(retention)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim(
             "Archiving stores full RFC 822 emails with HTML, attachments, and headers"
           )
         );
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim(
             "Cost: $2/GB ingestion + $0.19/GB/month storage (~50KB per email)"
           )
@@ -26375,10 +26476,10 @@ ${pc35.bold("Current Configuration:")}
     }
     case "tracking-domain": {
       if (!config2.domain) {
-        clack33.log.error(
+        clack34.log.error(
           "No sending domain configured. You must configure a sending domain before adding a custom tracking domain."
         );
-        clack33.log.info(
+        clack34.log.info(
           `Use ${pc35.cyan("wraps email init")} to set up a sending domain first.`
         );
         process.exit(1);
@@ -26390,13 +26491,13 @@ ${pc35.bold("Current Configuration:")}
       );
       const sendingDomain = domains.find((d) => d.domain === config2.domain);
       if (!sendingDomain?.verified) {
-        clack33.log.error(
+        clack34.log.error(
           `Sending domain ${pc35.cyan(config2.domain)} is not verified.`
         );
-        clack33.log.info(
+        clack34.log.info(
           "You must verify your sending domain before adding a custom tracking domain."
         );
-        clack33.log.info(
+        clack34.log.info(
           `Use ${pc35.cyan("wraps email verify")} to check DNS records and complete verification.`
         );
         process.exit(1);
@@ -26404,7 +26505,7 @@ ${pc35.bold("Current Configuration:")}
       progress.info(
         `Sending domain ${pc35.cyan(config2.domain)} is verified ${pc35.green("\u2713")}`
       );
-      const trackingDomain = await clack33.text({
+      const trackingDomain = await clack34.text({
         message: "Custom tracking redirect domain:",
         placeholder: "track.yourdomain.com",
         initialValue: config2.tracking?.customRedirectDomain || "",
@@ -26414,25 +26515,25 @@ ${pc35.bold("Current Configuration:")}
           }
         }
       });
-      if (clack33.isCancel(trackingDomain)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(trackingDomain)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
-      const enableHttps = await clack33.confirm({
+      const enableHttps = await clack34.confirm({
         message: "Enable HTTPS tracking with CloudFront + SSL certificate?",
         initialValue: true
       });
-      if (clack33.isCancel(enableHttps)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(enableHttps)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (enableHttps) {
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim(
             "HTTPS tracking creates a CloudFront distribution with an SSL certificate."
           )
         );
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim(
             "This ensures all tracking links use secure HTTPS connections."
           )
@@ -26463,32 +26564,32 @@ ${pc35.bold("Current Configuration:")}
             progress.info(
               `Found ${pc35.cyan(getDNSProviderDisplayName(detectedProvider.provider))} ${pc35.green("\u2713")}`
             );
-            clack33.log.info(
+            clack34.log.info(
               pc35.dim(
                 "DNS records (SSL certificate validation + CloudFront) will be created automatically."
               )
             );
           } else {
             canAutomateDNS = false;
-            clack33.log.warn(
+            clack34.log.warn(
               `No automatic DNS provider detected for ${pc35.cyan(trackingDomain || config2.domain)}`
             );
-            clack33.log.info(
+            clack34.log.info(
               pc35.dim(
                 "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
               )
             );
-            clack33.log.info(
+            clack34.log.info(
               pc35.dim("DNS record details will be shown after deployment.")
             );
           }
         }
-        const confirmHttps = await clack33.confirm({
+        const confirmHttps = await clack34.confirm({
           message: canAutomateDNS ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
           initialValue: true
         });
-        if (clack33.isCancel(confirmHttps) || !confirmHttps) {
-          clack33.log.info("HTTPS tracking not enabled. Using HTTP tracking.");
+        if (clack34.isCancel(confirmHttps) || !confirmHttps) {
+          clack34.log.info("HTTPS tracking not enabled. Using HTTP tracking.");
           updatedConfig = {
             ...config2,
             tracking: {
@@ -26510,7 +26611,7 @@ ${pc35.bold("Current Configuration:")}
           };
         }
       } else {
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim(
             "Using HTTP tracking (standard). Links will use http:// protocol."
           )
@@ -26529,7 +26630,7 @@ ${pc35.bold("Current Configuration:")}
       break;
     }
     case "retention": {
-      const retention = await clack33.select({
+      const retention = await clack34.select({
         message: "Email history retention period (event data in DynamoDB):",
         options: [
           { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -26553,16 +26654,16 @@ ${pc35.bold("Current Configuration:")}
         ],
         initialValue: config2.eventTracking?.archiveRetention || "90days"
       });
-      if (clack33.isCancel(retention)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(retention)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
-      clack33.log.info(
+      clack34.log.info(
         pc35.dim(
           "Note: This is for event data (sent, delivered, opened, etc.) stored in DynamoDB."
         )
       );
-      clack33.log.info(
+      clack34.log.info(
         pc35.dim(
           "For full email content storage, use 'Enable email archiving' option."
         )
@@ -26580,7 +26681,7 @@ ${pc35.bold("Current Configuration:")}
       break;
     }
     case "events": {
-      const selectedEvents = await clack33.multiselect({
+      const selectedEvents = await clack34.multiselect({
         message: "Select SES event types to track:",
         options: [
           { value: "SEND", label: "Send", hint: "Email sent to SES" },
@@ -26624,8 +26725,8 @@ ${pc35.bold("Current Configuration:")}
         ],
         required: true
       });
-      if (clack33.isCancel(selectedEvents)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(selectedEvents)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -26640,16 +26741,16 @@ ${pc35.bold("Current Configuration:")}
       break;
     }
     case "dedicated-ip": {
-      const confirmed = await clack33.confirm({
+      const confirmed = await clack34.confirm({
         message: "Enable dedicated IP? (Requires 100k+ emails/day, adds ~$50-100/mo)",
         initialValue: false
       });
-      if (clack33.isCancel(confirmed)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(confirmed)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (!confirmed) {
-        clack33.log.info("Dedicated IP not enabled.");
+        clack34.log.info("Dedicated IP not enabled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -26661,16 +26762,16 @@ ${pc35.bold("Current Configuration:")}
     }
     case "alerts": {
       if (!config2.reputationMetrics) {
-        clack33.log.warn("Reputation metrics must be enabled to use alerting.");
-        clack33.log.info(
+        clack34.log.warn("Reputation metrics must be enabled to use alerting.");
+        clack34.log.info(
           "This requires the Production or Enterprise preset, or enabling reputation metrics manually."
         );
-        const enableReputationMetrics = await clack33.confirm({
+        const enableReputationMetrics = await clack34.confirm({
           message: "Enable reputation metrics now?",
           initialValue: true
         });
-        if (clack33.isCancel(enableReputationMetrics) || !enableReputationMetrics) {
-          clack33.cancel("Alerting not enabled.");
+        if (clack34.isCancel(enableReputationMetrics) || !enableReputationMetrics) {
+          clack34.cancel("Alerting not enabled.");
           process.exit(0);
         }
         updatedConfig = {
@@ -26679,13 +26780,13 @@ ${pc35.bold("Current Configuration:")}
         };
       }
       if (config2.alerts?.enabled) {
-        clack33.log.info(`Alerting is currently ${pc35.green("enabled")}`);
+        clack34.log.info(`Alerting is currently ${pc35.green("enabled")}`);
         if (config2.alerts.notificationEmail) {
-          clack33.log.info(
+          clack34.log.info(
             `  Notification email: ${pc35.cyan(config2.alerts.notificationEmail)}`
           );
         }
-        const alertsAction = await clack33.select({
+        const alertsAction = await clack34.select({
           message: "What would you like to do?",
           options: [
             {
@@ -26705,17 +26806,17 @@ ${pc35.bold("Current Configuration:")}
             }
           ]
         });
-        if (clack33.isCancel(alertsAction)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(alertsAction)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (alertsAction === "disable") {
-          const confirmDisable = await clack33.confirm({
+          const confirmDisable = await clack34.confirm({
             message: "Are you sure? You won't be notified if your reputation degrades.",
             initialValue: false
           });
-          if (clack33.isCancel(confirmDisable) || !confirmDisable) {
-            clack33.log.info("Alerting not disabled.");
+          if (clack34.isCancel(confirmDisable) || !confirmDisable) {
+            clack34.log.info("Alerting not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -26723,7 +26824,7 @@ ${pc35.bold("Current Configuration:")}
             alerts: { enabled: false }
           };
         } else if (alertsAction === "change-email") {
-          const notificationEmail = await clack33.text({
+          const notificationEmail = await clack34.text({
             message: "Notification email address:",
             placeholder: "alerts@yourcompany.com",
             initialValue: config2.alerts.notificationEmail || "",
@@ -26733,8 +26834,8 @@ ${pc35.bold("Current Configuration:")}
               }
             }
           });
-          if (clack33.isCancel(notificationEmail)) {
-            clack33.cancel("Upgrade cancelled.");
+          if (clack34.isCancel(notificationEmail)) {
+            clack34.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -26746,14 +26847,14 @@ ${pc35.bold("Current Configuration:")}
             }
           };
         } else if (alertsAction === "change-thresholds") {
-          clack33.log.info(`
+          clack34.log.info(`
 ${pc35.bold("Alert Thresholds")}`);
-          clack33.log.info(
+          clack34.log.info(
             pc35.dim("These thresholds warn you BEFORE AWS takes action:")
           );
-          clack33.log.info(pc35.dim("  AWS warns at 5% bounce, 0.1% complaint"));
-          clack33.log.info(pc35.dim("  Gmail blocks at 0.3% complaint rate\n"));
-          const thresholdPreset = await clack33.select({
+          clack34.log.info(pc35.dim("  AWS warns at 5% bounce, 0.1% complaint"));
+          clack34.log.info(pc35.dim("  Gmail blocks at 0.3% complaint rate\n"));
+          const thresholdPreset = await clack34.select({
             message: "Choose threshold sensitivity:",
             options: [
               {
@@ -26773,8 +26874,8 @@ ${pc35.bold("Alert Thresholds")}`);
               }
             ]
           });
-          if (clack33.isCancel(thresholdPreset)) {
-            clack33.cancel("Upgrade cancelled.");
+          if (clack34.isCancel(thresholdPreset)) {
+            clack34.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           const thresholdConfigs = {
@@ -26807,27 +26908,27 @@ ${pc35.bold("Alert Thresholds")}`);
           };
         }
       } else {
-        clack33.log.info(`
+        clack34.log.info(`
 ${pc35.bold("Reputation Alerts")}
 `);
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim("Get notified when your email reputation is at risk:")
         );
-        clack33.log.info(pc35.dim("  - Bounce rate warnings (before AWS review)"));
-        clack33.log.info(
+        clack34.log.info(pc35.dim("  - Bounce rate warnings (before AWS review)"));
+        clack34.log.info(
           pc35.dim("  - Complaint rate warnings (before Gmail blocks you)")
         );
-        clack33.log.info(pc35.dim("  - DLQ alerts (event processing failures)"));
-        clack33.log.info(pc35.dim("\nCost: ~$0.50/mo (5 CloudWatch alarms)\n"));
-        const enableAlerts = await clack33.confirm({
+        clack34.log.info(pc35.dim("  - DLQ alerts (event processing failures)"));
+        clack34.log.info(pc35.dim("\nCost: ~$0.50/mo (5 CloudWatch alarms)\n"));
+        const enableAlerts = await clack34.confirm({
           message: "Enable reputation alerts?",
           initialValue: true
         });
-        if (clack33.isCancel(enableAlerts) || !enableAlerts) {
-          clack33.log.info("Alerting not enabled.");
+        if (clack34.isCancel(enableAlerts) || !enableAlerts) {
+          clack34.log.info("Alerting not enabled.");
           process.exit(0);
         }
-        const notificationEmail = await clack33.text({
+        const notificationEmail = await clack34.text({
           message: "Notification email address:",
           placeholder: "alerts@yourcompany.com",
           validate: (value) => {
@@ -26839,11 +26940,11 @@ ${pc35.bold("Reputation Alerts")}
             }
           }
         });
-        if (clack33.isCancel(notificationEmail)) {
-          clack33.cancel("Upgrade cancelled.");
+        if (clack34.isCancel(notificationEmail)) {
+          clack34.cancel("Upgrade cancelled.");
           process.exit(0);
         }
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim("\nYou'll receive an email to confirm your subscription.")
         );
         updatedConfig = {
@@ -26870,18 +26971,18 @@ ${pc35.bold("Reputation Alerts")}
     }
     case "wraps-dashboard": {
       if (!config2.eventTracking?.enabled) {
-        clack33.log.warn(
+        clack34.log.warn(
           "Event tracking must be enabled to connect to Wraps Dashboard."
         );
-        clack33.log.info(
+        clack34.log.info(
           "Enabling event tracking will allow SES events to be sent to the dashboard."
         );
-        const enableEventTracking = await clack33.confirm({
+        const enableEventTracking = await clack34.confirm({
           message: "Enable event tracking now?",
           initialValue: true
         });
-        if (clack33.isCancel(enableEventTracking) || !enableEventTracking) {
-          clack33.cancel("Dashboard connection cancelled.");
+        if (clack34.isCancel(enableEventTracking) || !enableEventTracking) {
+          clack34.cancel("Dashboard connection cancelled.");
           process.exit(0);
         }
         updatedConfig = {
@@ -26904,10 +27005,10 @@ ${pc35.bold("Reputation Alerts")}
       }
       const existingSecret = metadata.services.email?.webhookSecret;
       if (existingSecret) {
-        clack33.log.info(
+        clack34.log.info(
           `Currently connected to Wraps Dashboard (AWS Account: ${pc35.cyan(metadata.accountId)})`
         );
-        const action = await clack33.select({
+        const action = await clack34.select({
           message: "What would you like to do?",
           options: [
             {
@@ -26927,17 +27028,17 @@ ${pc35.bold("Reputation Alerts")}
             }
           ]
         });
-        if (clack33.isCancel(action) || action === "cancel") {
-          clack33.log.info("No changes made.");
+        if (clack34.isCancel(action) || action === "cancel") {
+          clack34.log.info("No changes made.");
           process.exit(0);
         }
         if (action === "disconnect") {
-          const confirmDisconnect = await clack33.confirm({
+          const confirmDisconnect = await clack34.confirm({
             message: "Are you sure? Events will no longer be sent to the Wraps Dashboard.",
             initialValue: false
           });
-          if (clack33.isCancel(confirmDisconnect) || !confirmDisconnect) {
-            clack33.log.info("Disconnect cancelled.");
+          if (clack34.isCancel(confirmDisconnect) || !confirmDisconnect) {
+            clack34.log.info("Disconnect cancelled.");
             process.exit(0);
           }
           if (metadata.services.email) {
@@ -26949,12 +27050,12 @@ ${pc35.bold("Reputation Alerts")}
         }
       }
       const webhookSecret = generateWebhookSecret();
-      clack33.log.info(`
+      clack34.log.info(`
 ${pc35.bold("Webhook Configuration:")}`);
-      clack33.log.info(
+      clack34.log.info(
         pc35.dim("A secure webhook secret has been generated for authentication.")
       );
-      clack33.log.info(
+      clack34.log.info(
         pc35.dim(
           "After deployment, you'll need to register this secret in the dashboard.\n"
         )
@@ -27000,18 +27101,18 @@ ${pc35.bold("Webhook Configuration:")}`);
         }
       };
       if (!config2.eventTracking?.enabled) {
-        clack33.log.warn(
+        clack34.log.warn(
           "Event tracking must be enabled to configure a webhook endpoint."
         );
-        clack33.log.info(
+        clack34.log.info(
           "Enabling event tracking will allow SES events to be sent to your endpoint."
         );
-        const enableEventTracking = await clack33.confirm({
+        const enableEventTracking = await clack34.confirm({
           message: "Enable event tracking now?",
           initialValue: true
         });
-        if (clack33.isCancel(enableEventTracking) || !enableEventTracking) {
-          clack33.cancel("Webhook configuration cancelled.");
+        if (clack34.isCancel(enableEventTracking) || !enableEventTracking) {
+          clack34.cancel("Webhook configuration cancelled.");
           process.exit(0);
         }
         updatedConfig = {
@@ -27033,10 +27134,10 @@ ${pc35.bold("Webhook Configuration:")}`);
         };
       }
       if (config2.userWebhook?.enabled) {
-        clack33.log.info(
+        clack34.log.info(
           `Webhook endpoint currently sending events to: ${pc35.cyan(config2.userWebhook.url)}`
         );
-        const action = await clack33.select({
+        const action = await clack34.select({
           message: "What would you like to do?",
           options: [
             {
@@ -27061,17 +27162,17 @@ ${pc35.bold("Webhook Configuration:")}`);
             }
           ]
         });
-        if (clack33.isCancel(action) || action === "cancel") {
-          clack33.log.info("No changes made.");
+        if (clack34.isCancel(action) || action === "cancel") {
+          clack34.log.info("No changes made.");
           process.exit(0);
         }
         if (action === "disable") {
-          const confirmDisable = await clack33.confirm({
+          const confirmDisable = await clack34.confirm({
             message: "Are you sure? Events will no longer be sent to your webhook endpoint.",
             initialValue: false
           });
-          if (clack33.isCancel(confirmDisable) || !confirmDisable) {
-            clack33.log.info("Webhook not disabled.");
+          if (clack34.isCancel(confirmDisable) || !confirmDisable) {
+            clack34.log.info("Webhook not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -27082,13 +27183,13 @@ ${pc35.bold("Webhook Configuration:")}`);
           break;
         }
         if (action === "change-url") {
-          const newUrl = await clack33.text({
+          const newUrl = await clack34.text({
             message: "New webhook URL:",
             placeholder: "https://your-app.com/webhooks/email-events",
             validate: validateWebhookUrl
           });
-          if (clack33.isCancel(newUrl)) {
-            clack33.cancel("Webhook configuration cancelled.");
+          if (clack34.isCancel(newUrl)) {
+            clack34.cancel("Webhook configuration cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -27116,20 +27217,20 @@ ${pc35.bold("Webhook Configuration:")}`);
           break;
         }
       } else {
-        clack33.log.info(`
+        clack34.log.info(`
 ${pc35.bold("Webhook Endpoint")}
 `);
-        clack33.log.info(
+        clack34.log.info(
           pc35.dim("Send SES events (send, delivery, open, click, bounce, etc.)")
         );
-        clack33.log.info(pc35.dim("to your own HTTP endpoint in real-time.\n"));
-        const webhookUrl = await clack33.text({
+        clack34.log.info(pc35.dim("to your own HTTP endpoint in real-time.\n"));
+        const webhookUrl = await clack34.text({
           message: "Webhook URL (must be HTTPS):",
           placeholder: "https://your-app.com/webhooks/email-events",
           validate: validateWebhookUrl
         });
-        if (clack33.isCancel(webhookUrl)) {
-          clack33.cancel("Webhook configuration cancelled.");
+        if (clack34.isCancel(webhookUrl)) {
+          clack34.cancel("Webhook configuration cancelled.");
           process.exit(0);
         }
         const secret2 = generateWebhookSecret();
@@ -27147,10 +27248,10 @@ ${pc35.bold("Webhook Endpoint")}
     }
     case "smtp-credentials": {
       if (metadata.services.email?.smtpCredentials?.enabled) {
-        clack33.log.info(
+        clack34.log.info(
           `SMTP credentials are currently ${pc35.green("enabled")} (created ${metadata.services.email.smtpCredentials.createdAt})`
         );
-        const smtpAction = await clack33.select({
+        const smtpAction = await clack34.select({
           message: "What would you like to do?",
           options: [
             {
@@ -27170,17 +27271,17 @@ ${pc35.bold("Webhook Endpoint")}
             }
           ]
         });
-        if (clack33.isCancel(smtpAction) || smtpAction === "cancel") {
-          clack33.log.info("No changes made.");
+        if (clack34.isCancel(smtpAction) || smtpAction === "cancel") {
+          clack34.log.info("No changes made.");
           process.exit(0);
         }
         if (smtpAction === "disable") {
-          const confirmDisable = await clack33.confirm({
+          const confirmDisable = await clack34.confirm({
             message: "Are you sure? Any systems using these credentials will stop working immediately.",
             initialValue: false
           });
-          if (clack33.isCancel(confirmDisable) || !confirmDisable) {
-            clack33.log.info("SMTP credentials not disabled.");
+          if (clack34.isCancel(confirmDisable) || !confirmDisable) {
+            clack34.log.info("SMTP credentials not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -27193,43 +27294,43 @@ ${pc35.bold("Webhook Endpoint")}
           newPreset = void 0;
           break;
         }
-        clack33.log.info(
+        clack34.log.info(
           "\nRotating credentials will invalidate your current SMTP password."
         );
-        clack33.log.warn(
+        clack34.log.warn(
           "You will need to update all systems using the old credentials."
         );
-        const confirmRotate = await clack33.confirm({
+        const confirmRotate = await clack34.confirm({
           message: "Generate new SMTP credentials?",
           initialValue: false
         });
-        if (clack33.isCancel(confirmRotate) || !confirmRotate) {
-          clack33.log.info("Credential rotation cancelled.");
+        if (clack34.isCancel(confirmRotate) || !confirmRotate) {
+          clack34.log.info("Credential rotation cancelled.");
           process.exit(0);
         }
       }
-      clack33.log.info(`
+      clack34.log.info(`
 ${pc35.bold("SMTP Credentials for Legacy Systems")}
 `);
-      clack33.log.info(
+      clack34.log.info(
         pc35.dim("Generate SMTP username/password that works with:")
       );
-      clack33.log.info(pc35.dim("  - PHP mail() and PHPMailer"));
-      clack33.log.info(pc35.dim("  - WordPress (WP Mail SMTP plugin)"));
-      clack33.log.info(pc35.dim("  - Nodemailer and other SMTP libraries"));
-      clack33.log.info(pc35.dim("  - Any SMTP-compatible email client"));
+      clack34.log.info(pc35.dim("  - PHP mail() and PHPMailer"));
+      clack34.log.info(pc35.dim("  - WordPress (WP Mail SMTP plugin)"));
+      clack34.log.info(pc35.dim("  - Nodemailer and other SMTP libraries"));
+      clack34.log.info(pc35.dim("  - Any SMTP-compatible email client"));
       console.log("");
-      clack33.log.warn(
+      clack34.log.warn(
         "Credentials will be shown ONCE after deployment - save them immediately!"
       );
       console.log("");
       if (!options.yes) {
-        const confirmCreate = await clack33.confirm({
+        const confirmCreate = await clack34.confirm({
           message: "Create SMTP credentials?",
           initialValue: true
         });
-        if (clack33.isCancel(confirmCreate) || !confirmCreate) {
-          clack33.log.info("SMTP credentials not created.");
+        if (clack34.isCancel(confirmCreate) || !confirmCreate) {
+          clack34.log.info("SMTP credentials not created.");
           process.exit(0);
         }
       }
@@ -27244,7 +27345,7 @@ ${pc35.bold("SMTP Credentials for Legacy Systems")}
       break;
     }
     case "hosting-provider": {
-      const newProvider = await clack33.select({
+      const newProvider = await clack34.select({
         message: "Where is your app hosted?",
         options: [
           {
@@ -27269,12 +27370,12 @@ ${pc35.bold("SMTP Credentials for Legacy Systems")}
           }
         ]
       });
-      if (clack33.isCancel(newProvider)) {
-        clack33.cancel("Upgrade cancelled.");
+      if (clack34.isCancel(newProvider)) {
+        clack34.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (newProvider === metadata.provider) {
-        clack33.log.info("Provider unchanged \u2014 no changes needed.");
+        clack34.log.info("Provider unchanged \u2014 no changes needed.");
         process.exit(0);
       }
       metadata.provider = newProvider;
@@ -27305,12 +27406,12 @@ ${pc35.bold("Cost Impact:")}`);
   }
   console.log("");
   if (!(options.yes || options.preview)) {
-    const confirmed = await clack33.confirm({
+    const confirmed = await clack34.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
     });
-    if (clack33.isCancel(confirmed) || !confirmed) {
-      clack33.cancel("Upgrade cancelled.");
+    if (clack34.isCancel(confirmed) || !confirmed) {
+      clack34.cancel("Upgrade cancelled.");
       process.exit(0);
     }
   }
@@ -27357,15 +27458,15 @@ ${pc35.bold("Cost Impact:")}`);
           );
           await new Promise((resolve) => setTimeout(resolve, 2e3));
         } else if (!caaResult.success) {
-          clack33.log.warn(
+          clack34.log.warn(
             `Could not verify CAA records: ${caaResult.error || "Unknown error"}`
           );
-          clack33.log.info(
+          clack34.log.info(
             pc35.dim(
               "If certificate issuance fails, you may need to add a CAA record manually:"
             )
           );
-          clack33.log.info(pc35.dim(`  ${parentDomain} CAA 0 issue "amazon.com"`));
+          clack34.log.info(pc35.dim(`  ${parentDomain} CAA 0 issue "amazon.com"`));
         }
       }
     }
@@ -27429,7 +27530,7 @@ ${pc35.bold("Cost Impact:")}`);
         costEstimate: costComparison,
         commandName: "wraps email upgrade"
       });
-      clack33.outro(
+      clack34.outro(
         pc35.green("Preview complete. Run without --preview to upgrade.")
       );
       trackServiceUpgrade("email", {
@@ -27607,7 +27708,7 @@ ${pc35.bold("Cost Impact:")}`);
           );
         }
       } else {
-        clack33.log.warn(
+        clack34.log.warn(
           credResult.error || `Unable to validate ${getDNSProviderDisplayName(dnsProvider)} credentials`
         );
       }
@@ -27623,7 +27724,7 @@ ${pc35.bold("Cost Impact:")}`);
       };
       const dnsRecords = buildEmailDNSRecords(dnsData);
       console.log();
-      clack33.note(
+      clack34.note(
         formatManualDNSInstructions(dnsRecords),
         "DNS Records \u2014 Add these to your DNS provider"
       );
@@ -27933,7 +28034,7 @@ init_output();
 import { existsSync as existsSync14 } from "fs";
 import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile9 } from "fs/promises";
 import { join as join16 } from "path";
-import * as clack34 from "@clack/prompts";
+import * as clack35 from "@clack/prompts";
 import pc36 from "picocolors";
 
 // src/commands/email/workflows/claude-content.ts
@@ -28325,7 +28426,7 @@ async function workflowsInit(options) {
   const cwd = process.cwd();
   const workflowsDir = join16(cwd, "wraps", "workflows");
   if (!isJsonMode()) {
-    clack34.intro(pc36.bold("Workflows as Code"));
+    clack35.intro(pc36.bold("Workflows as Code"));
   }
   const progress = new DeploymentProgress();
   if (existsSync14(workflowsDir) && !options.force) {
@@ -28335,7 +28436,7 @@ async function workflowsInit(options) {
       (f) => f.endsWith(".ts") && !f.startsWith("_")
     );
     if (tsFiles.length > 0 && !options.force && !isJsonMode()) {
-      clack34.log.warn(
+      clack35.log.warn(
         `${pc36.cyan("wraps/workflows/")} already contains ${tsFiles.length} workflow file(s). Use ${pc36.bold("--force")} to overwrite.`
       );
     }
@@ -28402,7 +28503,7 @@ async function workflowsInit(options) {
     return;
   }
   console.log();
-  clack34.log.success(pc36.green("Workflows as Code initialized!"));
+  clack35.log.success(pc36.green("Workflows as Code initialized!"));
   console.log();
   console.log(`  ${pc36.dim("Directory:")}  ${pc36.cyan("wraps/workflows/")}`);
   if (!options.noExample) {
@@ -28445,7 +28546,7 @@ init_esm_shims();
 init_events();
 import { existsSync as existsSync16 } from "fs";
 import { join as join18 } from "path";
-import * as clack35 from "@clack/prompts";
+import * as clack36 from "@clack/prompts";
 import pc37 from "picocolors";
 
 // src/utils/email/workflow-transform.ts
@@ -29296,7 +29397,7 @@ async function workflowsPush(options) {
     throw errors.wrapsConfigNotFound();
   }
   if (!isJsonMode()) {
-    clack35.intro(pc37.bold("Push Workflows"));
+    clack36.intro(pc37.bold("Push Workflows"));
   }
   const progress = new DeploymentProgress();
   progress.start("Loading configuration");
@@ -29311,7 +29412,7 @@ async function workflowsPush(options) {
         errors: []
       });
     } else {
-      clack35.log.info("No workflows/ directory found.");
+      clack36.log.info("No workflows/ directory found.");
     }
     return;
   }
@@ -29324,7 +29425,7 @@ async function workflowsPush(options) {
         errors: []
       });
     } else {
-      clack35.log.info("No workflows found to push.");
+      clack36.log.info("No workflows found to push.");
     }
     return;
   }
@@ -29393,7 +29494,7 @@ async function workflowsPush(options) {
       });
     } else {
       console.log();
-      clack35.log.error(
+      clack36.log.error(
         pc37.red("Cannot push due to validation errors. Fix errors and retry.")
       );
       console.log();
@@ -29408,7 +29509,7 @@ async function workflowsPush(options) {
         errors: []
       });
     } else {
-      clack35.log.info(
+      clack36.log.info(
         `${unchanged.length} workflow(s) unchanged. Use --force to re-push.`
       );
     }
@@ -29429,7 +29530,7 @@ async function workflowsPush(options) {
       });
     } else {
       console.log();
-      clack35.log.info(pc37.bold("Dry run \u2014 no changes made"));
+      clack36.log.info(pc37.bold("Dry run \u2014 no changes made"));
       console.log();
       for (const w of toProcess) {
         console.log(
@@ -29486,20 +29587,20 @@ async function workflowsPush(options) {
   } else {
     console.log();
     if (enabled.length > 0) {
-      clack35.log.success(
+      clack36.log.success(
         pc37.green(`${enabled.length} workflow(s) pushed and enabled`)
       );
     }
     if (drafts.length > 0) {
-      clack35.log.success(
+      clack36.log.success(
         pc37.green(`${drafts.length} workflow(s) pushed as draft`)
       );
     }
     if (unchanged.length > 0) {
-      clack35.log.info(`${unchanged.length} unchanged (use --force to re-push)`);
+      clack36.log.info(`${unchanged.length} unchanged (use --force to re-push)`);
     }
     if (conflicts.length > 0) {
-      clack35.log.error(
+      clack36.log.error(
         `${conflicts.length} workflow(s) skipped due to dashboard edits. Use --force to overwrite.`
       );
       for (const c of conflicts) {
@@ -29663,7 +29764,7 @@ init_esm_shims();
 init_events();
 import { existsSync as existsSync17 } from "fs";
 import { join as join19 } from "path";
-import * as clack36 from "@clack/prompts";
+import * as clack37 from "@clack/prompts";
 import pc38 from "picocolors";
 init_errors();
 init_json_output();
@@ -29677,7 +29778,7 @@ async function workflowsValidate(options) {
     throw errors.wrapsConfigNotFound();
   }
   if (!isJsonMode()) {
-    clack36.intro(pc38.bold("Validate Workflows"));
+    clack37.intro(pc38.bold("Validate Workflows"));
   }
   const progress = new DeploymentProgress();
   progress.start("Loading configuration");
@@ -29688,7 +29789,7 @@ async function workflowsValidate(options) {
     if (isJsonMode()) {
       jsonSuccess("email.workflows.validate", { workflows: [], errors: [] });
     } else {
-      clack36.log.info("No workflows/ directory found.");
+      clack37.log.info("No workflows/ directory found.");
     }
     return;
   }
@@ -29697,7 +29798,7 @@ async function workflowsValidate(options) {
     if (isJsonMode()) {
       jsonSuccess("email.workflows.validate", { workflows: [], errors: [] });
     } else {
-      clack36.log.info("No workflows found to validate.");
+      clack37.log.info("No workflows found to validate.");
     }
     return;
   }
@@ -29774,18 +29875,18 @@ async function workflowsValidate(options) {
     const invalidCount = validationResults.filter((r) => !r.valid).length;
     const parseErrorCount = parseErrors.length;
     if (parseErrorCount === 0 && invalidCount === 0) {
-      clack36.log.success(
+      clack37.log.success(
         pc38.green(`${validCount} workflow(s) validated successfully`)
       );
     } else {
       if (validCount > 0) {
-        clack36.log.success(pc38.green(`${validCount} workflow(s) valid`));
+        clack37.log.success(pc38.green(`${validCount} workflow(s) valid`));
       }
       if (invalidCount > 0) {
-        clack36.log.error(pc38.red(`${invalidCount} workflow(s) have errors`));
+        clack37.log.error(pc38.red(`${invalidCount} workflow(s) have errors`));
       }
       if (parseErrorCount > 0) {
-        clack36.log.error(
+        clack37.log.error(
           pc38.red(`${parseErrorCount} workflow(s) failed to parse`)
         );
       }
@@ -29819,11 +29920,11 @@ async function workflowsValidate(options) {
 // src/commands/news.ts
 init_esm_shims();
 init_events();
-import * as clack37 from "@clack/prompts";
+import * as clack38 from "@clack/prompts";
 import pc39 from "picocolors";
 async function news() {
   trackCommand("news", { success: true });
-  clack37.intro(pc39.bold("What's New in Wraps"));
+  clack38.intro(pc39.bold("What's New in Wraps"));
   console.log();
   console.log("  See the latest updates, features, and improvements:");
   console.log();
@@ -29839,7 +29940,7 @@ async function news() {
 init_esm_shims();
 init_events();
 init_json_output();
-import * as clack38 from "@clack/prompts";
+import * as clack39 from "@clack/prompts";
 import pc40 from "picocolors";
 function getBaseStatements() {
   return [
@@ -30231,7 +30332,7 @@ function buildPolicy(service, preset) {
   };
 }
 function displaySummary(service, preset) {
-  clack38.intro(pc40.bold("Wraps Required AWS Permissions"));
+  clack39.intro(pc40.bold("Wraps Required AWS Permissions"));
   const serviceLabel = service ? service.toUpperCase() : "All Services";
   const presetLabel = preset ? preset.charAt(0).toUpperCase() + preset.slice(1) : "All Features";
   console.log(`
@@ -30325,7 +30426,7 @@ async function permissions(options) {
     console.log("2. Create the policy in AWS Console:");
     console.log("   IAM > Policies > Create Policy > JSON\n");
     console.log("3. Attach to your IAM user/role\n");
-    clack38.outro(
+    clack39.outro(
       pc40.green("Run with --json to get the full IAM policy document")
     );
   }
@@ -30343,7 +30444,7 @@ import {
   IAMClient as IAMClient3,
   PutRolePolicyCommand
 } from "@aws-sdk/client-iam";
-import { confirm as confirm18, intro as intro34, isCancel as isCancel24, log as log36, outro as outro20, select as select16 } from "@clack/prompts";
+import { confirm as confirm18, intro as intro34, isCancel as isCancel25, log as log36, outro as outro20, select as select17 } from "@clack/prompts";
 import * as pulumi24 from "@pulumi/pulumi";
 import pc41 from "picocolors";
 init_events();
@@ -30356,6 +30457,7 @@ init_metadata();
 init_output();
 init_prompts();
 init_pulumi();
+init_region_resolver();
 function buildConsolePolicyDocument(emailConfig, smsConfig) {
   const statements = [];
   statements.push({
@@ -30532,10 +30634,11 @@ async function validateAndLoadMetadata(options, progress) {
     async () => validateAWSCredentials()
   );
   progress.info(`Connected to AWS account: ${pc41.cyan(identity.accountId)}`);
-  let region = options.region;
-  if (!region) {
-    region = await getAWSRegion();
-  }
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    label: "connection"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     progress.stop();
@@ -30694,7 +30797,7 @@ async function resolveOrganization() {
   if (orgs.length === 1) {
     return orgs[0];
   }
-  const selected = await select16({
+  const selected = await select17({
     message: "Which organization should this AWS account connect to?",
     options: orgs.map((org) => ({
       value: org.id,
@@ -30702,7 +30805,7 @@ async function resolveOrganization() {
       hint: org.slug
     }))
   });
-  if (isCancel24(selected)) {
+  if (isCancel25(selected)) {
     outro20("Operation cancelled");
     process.exit(0);
   }
@@ -30768,7 +30871,7 @@ async function authenticatedConnect(token, options) {
           message: "Enable event tracking now?",
           initialValue: true
         });
-        if (isCancel24(enableTracking) || !enableTracking) {
+        if (isCancel25(enableTracking) || !enableTracking) {
           outro20("Platform connection cancelled.");
           process.exit(0);
         }
@@ -30913,10 +31016,11 @@ async function connect3(options) {
       async () => validateAWSCredentials()
     );
     progress.info(`Connected to AWS account: ${pc41.cyan(identity.accountId)}`);
-    let region = options.region;
-    if (!region) {
-      region = await getAWSRegion();
-    }
+    const region = await resolveRegionForCommand({
+      accountId: identity.accountId,
+      optionRegion: options.region,
+      label: "connection"
+    });
     const metadata = await loadConnectionMetadata(identity.accountId, region);
     if (!metadata) {
       progress.stop();
@@ -30962,7 +31066,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
           message: "Enable event tracking now?",
           initialValue: true
         });
-        if (isCancel24(enableEventTracking) || !enableEventTracking) {
+        if (isCancel25(enableEventTracking) || !enableEventTracking) {
           outro20("Platform connection cancelled.");
           process.exit(0);
         }
@@ -30990,7 +31094,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
         log36.info(
           `Already connected to Wraps Platform (AWS Account: ${pc41.cyan(metadata.accountId)})`
         );
-        const action = await select16({
+        const action = await select17({
           message: "What would you like to do?",
           options: [
             {
@@ -31010,7 +31114,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
             }
           ]
         });
-        if (isCancel24(action)) {
+        if (isCancel25(action)) {
           outro20("Operation cancelled");
           process.exit(0);
         }
@@ -31021,7 +31125,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
             message: "Are you sure? Events will no longer be sent to the Wraps Platform.",
             initialValue: false
           });
-          if (isCancel24(confirmDisconnect) || !confirmDisconnect) {
+          if (isCancel25(confirmDisconnect) || !confirmDisconnect) {
             outro20("Disconnect cancelled");
             process.exit(0);
           }
@@ -31171,10 +31275,10 @@ ${pc41.bold("Next Steps:")}`);
 
 // src/commands/platform/index.ts
 init_esm_shims();
-import * as clack39 from "@clack/prompts";
+import * as clack40 from "@clack/prompts";
 import pc42 from "picocolors";
 async function platform() {
-  clack39.intro(pc42.bold("Wraps Platform"));
+  clack40.intro(pc42.bold("Wraps Platform"));
   console.log();
   console.log(
     "  The Wraps Platform extends the free CLI with hosted features:"
@@ -31227,12 +31331,13 @@ init_aws();
 init_json_output();
 init_metadata();
 init_output();
+init_region_resolver();
 import {
   CreateRoleCommand as CreateRoleCommand2,
   GetRoleCommand as GetRoleCommand2,
   IAMClient as IAMClient4
 } from "@aws-sdk/client-iam";
-import { confirm as confirm19, intro as intro36, isCancel as isCancel25, log as log37, outro as outro21 } from "@clack/prompts";
+import { confirm as confirm19, intro as intro36, isCancel as isCancel26, log as log37, outro as outro21 } from "@clack/prompts";
 import pc43 from "picocolors";
 async function updateRole(options) {
   const startTime = Date.now();
@@ -31244,7 +31349,11 @@ async function updateRole(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  const region = options.region || await getAWSRegion();
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    label: "connection"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     progress.stop();
@@ -31297,7 +31406,7 @@ Run ${pc43.cyan("wraps email init")} to deploy infrastructure first.
       message: `${actionLabel} IAM role ${pc43.cyan(roleName)} with latest permissions?`,
       initialValue: true
     });
-    if (isCancel25(shouldContinue) || !shouldContinue) {
+    if (isCancel26(shouldContinue) || !shouldContinue) {
       outro21(`${actionLabel} cancelled`);
       process.exit(0);
     }
@@ -31616,7 +31725,7 @@ function buildConsolePolicyDocument2(emailConfig, smsConfig) {
 
 // src/commands/shared/dashboard.ts
 init_esm_shims();
-import * as clack40 from "@clack/prompts";
+import * as clack41 from "@clack/prompts";
 import * as pulumi25 from "@pulumi/pulumi";
 import getPort from "get-port";
 import open2 from "open";
@@ -34267,7 +34376,7 @@ init_output();
 init_pulumi();
 async function dashboard(options) {
   await ensurePulumiInstalled();
-  clack40.intro(pc44.bold("Wraps Dashboard"));
+  clack41.intro(pc44.bold("Wraps Dashboard"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -34308,7 +34417,7 @@ async function dashboard(options) {
     }
   } catch (_error) {
     progress.stop();
-    clack40.log.error("No Wraps infrastructure found");
+    clack41.log.error("No Wraps infrastructure found");
     console.log(
       `\\nRun ${pc44.cyan("wraps email init")}, ${pc44.cyan("wraps sms init")}, or ${pc44.cyan("wraps storage init")} to deploy infrastructure first.\\n`
     );
@@ -34352,7 +34461,7 @@ async function dashboard(options) {
   }
   const port = options.port || await getPort({ port: [5555, 5556, 5557, 5558, 5559] });
   progress.stop();
-  clack40.log.success("Starting dashboard server...");
+  clack41.log.success("Starting dashboard server...");
   console.log(
     `${pc44.dim("Using current AWS credentials (no role assumption)")}\\n`
   );
@@ -34409,7 +34518,7 @@ init_aws();
 init_errors();
 init_json_output();
 init_metadata();
-import * as clack41 from "@clack/prompts";
+import * as clack42 from "@clack/prompts";
 import pc45 from "picocolors";
 async function destroy(options) {
   trackCommand("destroy", { success: true });
@@ -34421,9 +34530,9 @@ async function destroy(options) {
     );
   }
   if (!isJsonMode()) {
-    clack41.intro(pc45.bold("Wraps Infrastructure Teardown"));
+    clack42.intro(pc45.bold("Wraps Infrastructure Teardown"));
   }
-  const spinner10 = clack41.spinner();
+  const spinner10 = clack42.spinner();
   spinner10.start("Validating AWS credentials");
   let identity;
   try {
@@ -34440,7 +34549,7 @@ async function destroy(options) {
     deployedServices.push("email");
   }
   if (deployedServices.length === 0) {
-    clack41.log.warn("No Wraps services found in this region");
+    clack42.log.warn("No Wraps services found in this region");
     console.log(
       `
 Run ${pc45.cyan("wraps email init")} to deploy infrastructure.
@@ -34450,7 +34559,7 @@ Run ${pc45.cyan("wraps email init")} to deploy infrastructure.
   }
   if (deployedServices.length === 1) {
     const service = deployedServices[0];
-    clack41.log.info(`Found ${pc45.cyan(service)} service deployed`);
+    clack42.log.info(`Found ${pc45.cyan(service)} service deployed`);
     if (service === "email") {
       await emailDestroy(options);
       return;
@@ -34465,7 +34574,7 @@ Run ${pc45.cyan("wraps email init")} to deploy infrastructure.
     jsonSuccess("destroy", { destroyed: true });
     return;
   }
-  const serviceToDestroy = await clack41.select({
+  const serviceToDestroy = await clack42.select({
     message: "Which service would you like to destroy?",
     options: [
       ...deployedServices.map((s) => ({
@@ -34480,15 +34589,15 @@ Run ${pc45.cyan("wraps email init")} to deploy infrastructure.
       }
     ]
   });
-  if (clack41.isCancel(serviceToDestroy)) {
-    clack41.cancel("Operation cancelled.");
+  if (clack42.isCancel(serviceToDestroy)) {
+    clack42.cancel("Operation cancelled.");
     process.exit(0);
   }
   if ((serviceToDestroy === "email" || serviceToDestroy === "all") && deployedServices.includes("email")) {
     await emailDestroy(options);
   }
   if (serviceToDestroy === "all") {
-    clack41.outro(pc45.green("All Wraps infrastructure has been removed"));
+    clack42.outro(pc45.green("All Wraps infrastructure has been removed"));
   }
 }
 
@@ -34500,7 +34609,7 @@ init_fs();
 init_json_output();
 init_output();
 init_pulumi();
-import * as clack42 from "@clack/prompts";
+import * as clack43 from "@clack/prompts";
 import * as pulumi26 from "@pulumi/pulumi";
 import pc46 from "picocolors";
 async function status(_options) {
@@ -34508,7 +34617,7 @@ async function status(_options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack42.intro(pc46.bold("Wraps Infrastructure Status"));
+    clack43.intro(pc46.bold("Wraps Infrastructure Status"));
   }
   const identity = await progress.execute(
     "Loading infrastructure status",
@@ -34571,7 +34680,7 @@ async function status(_options) {
     return;
   }
   console.log();
-  clack42.note(
+  clack43.note(
     services.map((s) => {
       if (s.status === "deployed") {
         const details = s.details ? pc46.dim(` (${s.details})`) : "";
@@ -34610,13 +34719,12 @@ ${pc46.bold("Dashboard:")} ${pc46.blue("https://app.wraps.dev")}`);
 
 // src/commands/sms/destroy.ts
 init_esm_shims();
-import * as clack43 from "@clack/prompts";
+import * as clack44 from "@clack/prompts";
 import * as pulumi28 from "@pulumi/pulumi";
 import pc47 from "picocolors";
 
 // src/infrastructure/sms-stack.ts
 init_esm_shims();
-init_constants();
 import * as aws20 from "@pulumi/aws";
 import * as pulumi27 from "@pulumi/pulumi";
 init_resource_checks();
@@ -34732,12 +34840,10 @@ function createSMSOptOutList() {
     }
   });
 }
-async function findExistingPhoneNumber(phoneNumberType) {
+async function findExistingPhoneNumber(phoneNumberType, region) {
   try {
     const { PinpointSMSVoiceV2Client: PinpointSMSVoiceV2Client5, DescribePhoneNumbersCommand: DescribePhoneNumbersCommand2 } = await import("@aws-sdk/client-pinpoint-sms-voice-v2");
-    const client = new PinpointSMSVoiceV2Client5({
-      region: getDefaultRegion()
-    });
+    const client = new PinpointSMSVoiceV2Client5({ region });
     const numberTypeMap = {
       simulator: "SIMULATOR",
       "toll-free": "TOLL_FREE",
@@ -34771,14 +34877,14 @@ async function findExistingPhoneNumber(phoneNumberType) {
     throw error;
   }
 }
-async function createSMSPhoneNumber(phoneNumberType, optOutList) {
+async function createSMSPhoneNumber(phoneNumberType, optOutList, region) {
   const numberTypeMap = {
     simulator: "SIMULATOR",
     "toll-free": "TOLL_FREE",
     "10dlc": "TEN_DLC",
     "short-code": "SHORT_CODE"
   };
-  const existingArn = await findExistingPhoneNumber(phoneNumberType);
+  const existingArn = await findExistingPhoneNumber(phoneNumberType, region);
   const phoneConfig = {
     isoCountryCode: "US",
     messageType: "TRANSACTIONAL",
@@ -34815,11 +34921,11 @@ async function createSMSPhoneNumber(phoneNumberType, optOutList) {
     }
   );
 }
-async function createSMSSQSResources() {
+async function createSMSSQSResources(config2) {
   const dlqName = "wraps-sms-events-dlq";
   const queueName = "wraps-sms-events";
-  const dlqUrl = await sqsQueueExists(dlqName);
-  const queueUrl = await sqsQueueExists(queueName);
+  const dlqUrl = await sqsQueueExists(dlqName, config2.region);
+  const queueUrl = await sqsQueueExists(queueName, config2.region);
   const dlqConfig = {
     name: dlqName,
     messageRetentionSeconds: 1209600,
@@ -34866,7 +34972,7 @@ async function createSMSSQSResources() {
 }
 async function createSMSSNSResources(config2) {
   const topicName = "wraps-sms-events";
-  const topicArn = await snsTopicExists(topicName);
+  const topicArn = await snsTopicExists(topicName, config2.region);
   const topicConfig = {
     name: topicName,
     tags: {
@@ -34929,9 +35035,9 @@ async function createSMSSNSResources(config2) {
   );
   return { topic, subscription };
 }
-async function createSMSDynamoDBTable() {
+async function createSMSDynamoDBTable(config2) {
   const tableName = "wraps-sms-history";
-  const exists = await tableExists(tableName);
+  const exists = await tableExists(tableName, config2.region);
   const tableConfig = {
     name: tableName,
     billingMode: "PAY_PER_REQUEST",
@@ -35096,23 +35202,25 @@ async function deploySMSStack(config2) {
   if (smsConfig.phoneNumberType) {
     phoneNumber = await createSMSPhoneNumber(
       smsConfig.phoneNumberType,
-      optOutList
+      optOutList,
+      config2.region
     );
   }
   let sqsResources;
   if (smsConfig.eventTracking?.enabled) {
-    sqsResources = await createSMSSQSResources();
+    sqsResources = await createSMSSQSResources({ region: config2.region });
   }
   let snsResources;
   if (smsConfig.eventTracking?.enabled && sqsResources) {
     snsResources = await createSMSSNSResources({
       queueArn: sqsResources.queue.arn,
-      queueUrl: sqsResources.queue.url
+      queueUrl: sqsResources.queue.url,
+      region: config2.region
     });
   }
   let dynamoTable;
   if (smsConfig.eventTracking?.dynamoDBHistory) {
-    dynamoTable = await createSMSDynamoDBTable();
+    dynamoTable = await createSMSDynamoDBTable({ region: config2.region });
   }
   let lambdaFunction;
   if (smsConfig.eventTracking?.dynamoDBHistory && dynamoTable && sqsResources) {
@@ -35461,7 +35569,7 @@ async function smsDestroy(options) {
     );
   }
   if (!isJsonMode()) {
-    clack43.intro(
+    clack44.intro(
       pc47.bold(
         options.preview ? "SMS Infrastructure Destruction Preview" : "SMS Infrastructure Teardown"
       )
@@ -35488,15 +35596,15 @@ async function smsDestroy(options) {
           `Available regions: ${smsConnections.map((c) => c.region).join(", ")}`
         );
       }
-      const selectedRegion = await clack43.select({
+      const selectedRegion = await clack44.select({
         message: "Multiple SMS deployments found. Which region to destroy?",
         options: smsConnections.map((conn) => ({
           value: conn.region,
           label: conn.region
         }))
       });
-      if (clack43.isCancel(selectedRegion)) {
-        clack43.cancel("Operation cancelled");
+      if (clack44.isCancel(selectedRegion)) {
+        clack44.cancel("Operation cancelled");
         process.exit(0);
       }
       region = selectedRegion;
@@ -35507,18 +35615,18 @@ async function smsDestroy(options) {
   const storedStackName = smsService?.pulumiStackName;
   if (!smsService) {
     progress.stop();
-    clack43.log.warn("No SMS infrastructure found");
+    clack44.log.warn("No SMS infrastructure found");
     process.exit(0);
   }
   if (!(options.force || options.preview)) {
-    const confirmed = await clack43.confirm({
+    const confirmed = await clack44.confirm({
       message: pc47.red(
         "Are you sure you want to destroy all SMS infrastructure?"
       ),
       initialValue: false
     });
-    if (clack43.isCancel(confirmed) || !confirmed) {
-      clack43.cancel("Destruction cancelled.");
+    if (clack44.isCancel(confirmed) || !confirmed) {
+      clack44.cancel("Destruction cancelled.");
       process.exit(0);
     }
   }
@@ -35550,7 +35658,7 @@ async function smsDestroy(options) {
         costEstimate: "Monthly cost after destruction: $0.00",
         commandName: "wraps sms destroy"
       });
-      clack43.outro(
+      clack44.outro(
         pc47.green("Preview complete. Run without --preview to destroy.")
       );
       trackServiceRemoved("sms", {
@@ -35562,7 +35670,7 @@ async function smsDestroy(options) {
       progress.stop();
       const errorMessage = error instanceof Error ? error.message : String(error);
       if (errorMessage.includes("No SMS infrastructure found")) {
-        clack43.log.warn("No SMS infrastructure found to preview");
+        clack44.log.warn("No SMS infrastructure found to preview");
         process.exit(0);
       }
       trackError("PREVIEW_FAILED", "sms destroy", { step: "preview" });
@@ -35611,7 +35719,7 @@ async function smsDestroy(options) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
     if (errorMessage.includes("No SMS infrastructure found")) {
-      clack43.log.warn("No SMS infrastructure found");
+      clack44.log.warn("No SMS infrastructure found");
       if (metadata) {
         removeServiceFromConnection(metadata, "sms");
         await saveConnectionMetadata(metadata);
@@ -35624,7 +35732,7 @@ async function smsDestroy(options) {
     }
     trackError("DESTROY_FAILED", "sms destroy", { step: "destroy" });
     destroyFailed = true;
-    clack43.log.warn(
+    clack44.log.warn(
       "Some resources may not have been fully removed. You can re-run this command or clean up manually in the AWS console."
     );
   }
@@ -35647,11 +35755,11 @@ async function smsDestroy(options) {
     return;
   }
   if (destroyFailed) {
-    clack43.outro(
+    clack44.outro(
       pc47.yellow("SMS infrastructure partially removed. Metadata cleaned up.")
     );
   } else {
-    clack43.outro(pc47.green("SMS infrastructure has been removed"));
+    clack44.outro(pc47.green("SMS infrastructure has been removed"));
     console.log(`
 ${pc47.bold("Cleaned up:")}`);
     console.log(`  ${pc47.green("\u2713")} Phone number released`);
@@ -35673,7 +35781,7 @@ Run ${pc47.cyan("wraps sms init")} to deploy infrastructure again.
 
 // src/commands/sms/init.ts
 init_esm_shims();
-import * as clack44 from "@clack/prompts";
+import * as clack45 from "@clack/prompts";
 import * as pulumi29 from "@pulumi/pulumi";
 import pc48 from "picocolors";
 init_events();
@@ -36094,7 +36202,7 @@ function validateSMSConfig(config2) {
 
 // src/commands/sms/init.ts
 async function promptPhoneNumberType() {
-  const result = await clack44.select({
+  const result = await clack45.select({
     message: "Select phone number type:",
     options: [
       {
@@ -36114,14 +36222,14 @@ async function promptPhoneNumberType() {
       }
     ]
   });
-  if (clack44.isCancel(result)) {
-    clack44.cancel("Operation cancelled.");
+  if (clack45.isCancel(result)) {
+    clack45.cancel("Operation cancelled.");
     process.exit(0);
   }
   return result;
 }
 async function promptSMSPreset() {
-  const result = await clack44.select({
+  const result = await clack45.select({
     message: "Choose configuration preset:",
     options: [
       {
@@ -36146,8 +36254,8 @@ async function promptSMSPreset() {
       }
     ]
   });
-  if (clack44.isCancel(result)) {
-    clack44.cancel("Operation cancelled.");
+  if (clack45.isCancel(result)) {
+    clack45.cancel("Operation cancelled.");
     process.exit(0);
   }
   return result;
@@ -36167,7 +36275,7 @@ var COMMON_COUNTRIES = [
   { code: "IN", name: "India" }
 ];
 async function promptAllowedCountries() {
-  const result = await clack44.multiselect({
+  const result = await clack45.multiselect({
     message: "Select countries to allow SMS delivery (blocks all others):",
     options: COMMON_COUNTRIES.map((c) => ({
       value: c.code,
@@ -36176,14 +36284,14 @@ async function promptAllowedCountries() {
     initialValues: ["US"],
     required: true
   });
-  if (clack44.isCancel(result)) {
-    clack44.cancel("Operation cancelled.");
+  if (clack45.isCancel(result)) {
+    clack45.cancel("Operation cancelled.");
     process.exit(0);
   }
   return result;
 }
 async function promptEstimatedSMSVolume() {
-  const result = await clack44.select({
+  const result = await clack45.select({
     message: "Estimated messages per month:",
     options: [
       { value: 100, label: "< 100 (Testing)" },
@@ -36193,8 +36301,8 @@ async function promptEstimatedSMSVolume() {
       { value: 1e5, label: "50,000+" }
     ]
   });
-  if (clack44.isCancel(result)) {
-    clack44.cancel("Operation cancelled.");
+  if (clack45.isCancel(result)) {
+    clack45.cancel("Operation cancelled.");
     process.exit(0);
   }
   return result;
@@ -36202,7 +36310,7 @@ async function promptEstimatedSMSVolume() {
 async function init3(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack44.intro(pc48.bold("Wraps SMS Infrastructure Setup"));
+    clack45.intro(pc48.bold("Wraps SMS Infrastructure Setup"));
   }
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
@@ -36228,10 +36336,10 @@ async function init3(options) {
     region
   );
   if (existingConnection?.services?.sms) {
-    clack44.log.warn(
+    clack45.log.warn(
       `SMS already configured for account ${pc48.cyan(identity.accountId)} in region ${pc48.cyan(region)}`
     );
-    clack44.log.info(`Use ${pc48.cyan("wraps sms status")} to view current setup`);
+    clack45.log.info(`Use ${pc48.cyan("wraps sms status")} to view current setup`);
     process.exit(0);
   }
   let preset = options.preset;
@@ -36248,12 +36356,12 @@ async function init3(options) {
       optOutManagement: true,
       sendingEnabled: true
     };
-    const enableEventTracking = await clack44.confirm({
+    const enableEventTracking = await clack45.confirm({
       message: "Enable event tracking (EventBridge + DynamoDB)?",
       initialValue: false
     });
-    if (clack44.isCancel(enableEventTracking)) {
-      clack44.cancel("Operation cancelled.");
+    if (clack45.isCancel(enableEventTracking)) {
+      clack45.cancel("Operation cancelled.");
       process.exit(0);
     }
     if (enableEventTracking) {
@@ -36278,12 +36386,12 @@ ${pc48.bold("Fraud Protection")} - Block SMS to countries where you don't do bus
   const allowedCountries = await promptAllowedCountries();
   let aitFiltering = false;
   if (smsConfig.phoneNumberType !== "simulator") {
-    const enableAIT = await clack44.confirm({
+    const enableAIT = await clack45.confirm({
       message: "Enable AIT (Artificially Inflated Traffic) filtering? (adds per-message cost)",
       initialValue: false
     });
-    if (clack44.isCancel(enableAIT)) {
-      clack44.cancel("Operation cancelled.");
+    if (clack45.isCancel(enableAIT)) {
+      clack45.cancel("Operation cancelled.");
       process.exit(0);
     }
     aitFiltering = enableAIT;
@@ -36297,19 +36405,19 @@ ${pc48.bold("Fraud Protection")} - Block SMS to countries where you don't do bus
   progress.info(`
 ${pc48.bold("Cost Estimate:")}`);
   const costSummary = getSMSCostSummary(smsConfig, estimatedVolume);
-  clack44.log.info(costSummary);
+  clack45.log.info(costSummary);
   const warnings = validateSMSConfig(smsConfig);
   if (warnings.length > 0) {
     progress.info(`
 ${pc48.yellow(pc48.bold("Important Notes:"))}`);
     for (const warning of warnings) {
-      clack44.log.warn(warning);
+      clack45.log.warn(warning);
     }
   }
   if (!options.yes) {
     const confirmed = await confirmDeploy();
     if (!confirmed) {
-      clack44.cancel("Deployment cancelled.");
+      clack45.cancel("Deployment cancelled.");
       process.exit(0);
     }
   }
@@ -36385,8 +36493,8 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
       } catch (sdkError) {
         sdkResourceWarning = true;
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
-        clack44.log.warn(`Phone pool creation failed: ${msg}`);
-        clack44.log.info(
+        clack45.log.warn(`Phone pool creation failed: ${msg}`);
+        clack45.log.info(
           `Run ${pc48.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
@@ -36403,8 +36511,8 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
       } catch (sdkError) {
         sdkResourceWarning = true;
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
-        clack44.log.warn(`Event destination creation failed: ${msg}`);
-        clack44.log.info(
+        clack45.log.warn(`Event destination creation failed: ${msg}`);
+        clack45.log.info(
           `Run ${pc48.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
@@ -36424,14 +36532,14 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
       } catch (sdkError) {
         sdkResourceWarning = true;
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
-        clack44.log.warn(`Protect configuration creation failed: ${msg}`);
-        clack44.log.info(
+        clack45.log.warn(`Protect configuration creation failed: ${msg}`);
+        clack45.log.info(
           `Run ${pc48.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
     }
     if (sdkResourceWarning) {
-      clack44.log.warn(
+      clack45.log.warn(
         "Some SDK resources failed to create. Core infrastructure is deployed."
       );
     }
@@ -36476,9 +36584,9 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
     return;
   }
   console.log("\n");
-  clack44.log.success(pc48.green(pc48.bold("SMS infrastructure deployed!")));
+  clack45.log.success(pc48.green(pc48.bold("SMS infrastructure deployed!")));
   console.log("\n");
-  clack44.note(
+  clack45.note(
     [
       `${pc48.bold("Phone Number:")} ${pc48.cyan(outputs.phoneNumber || "Provisioning...")}`,
       `${pc48.bold("Phone Type:")} ${pc48.cyan(smsConfig.phoneNumberType || "simulator")}`,
@@ -36502,12 +36610,12 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
   );
   nextSteps.push(`${pc48.cyan("wraps sms status")} - View SMS configuration`);
   console.log("\n");
-  clack44.log.info(pc48.bold("Next steps:"));
+  clack45.log.info(pc48.bold("Next steps:"));
   for (const step of nextSteps) {
     console.log(`  ${step}`);
   }
   console.log("\n");
-  clack44.log.info(pc48.bold("SDK Usage:"));
+  clack45.log.info(pc48.bold("SDK Usage:"));
   console.log(pc48.dim("  npm install @wraps.dev/sms"));
   console.log("");
   console.log(pc48.dim("  import { Wraps } from '@wraps.dev/sms';"));
@@ -36516,7 +36624,7 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
   console.log(pc48.dim("    to: '+14155551234',"));
   console.log(pc48.dim("    message: 'Your code is 123456',"));
   console.log(pc48.dim("  });"));
-  clack44.outro(pc48.green("Setup complete!"));
+  clack45.outro(pc48.green("Setup complete!"));
   const duration = Date.now() - startTime;
   const enabledFeatures = [];
   if (smsConfig.tracking?.enabled) {
@@ -36552,7 +36660,7 @@ init_aws();
 init_json_output();
 init_metadata();
 init_output();
-import * as clack45 from "@clack/prompts";
+import * as clack46 from "@clack/prompts";
 import pc49 from "picocolors";
 async function getPhoneNumberDetails(region) {
   const { PinpointSMSVoiceV2Client: PinpointSMSVoiceV2Client5, DescribePhoneNumbersCommand: DescribePhoneNumbersCommand2 } = await import("@aws-sdk/client-pinpoint-sms-voice-v2");
@@ -36573,7 +36681,7 @@ async function getPhoneNumberDetails(region) {
     return null;
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
-    clack45.log.error(`Error fetching phone number: ${errorMessage}`);
+    clack46.log.error(`Error fetching phone number: ${errorMessage}`);
     return null;
   }
 }
@@ -36594,7 +36702,7 @@ async function getRegistrationStatus(region, registrationId) {
 async function smsRegister(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack45.intro(pc49.bold("Wraps SMS - Toll-Free Registration"));
+    clack46.intro(pc49.bold("Wraps SMS - Toll-Free Registration"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -36607,8 +36715,8 @@ async function smsRegister(options) {
   }
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
-    clack45.log.error("No SMS infrastructure found.");
-    clack45.log.info(`Run ${pc49.cyan("wraps sms init")} first.`);
+    clack46.log.error("No SMS infrastructure found.");
+    clack46.log.info(`Run ${pc49.cyan("wraps sms init")} first.`);
     process.exit(1);
   }
   const phoneDetails = await progress.execute(
@@ -36616,7 +36724,7 @@ async function smsRegister(options) {
     async () => getPhoneNumberDetails(region)
   );
   if (!phoneDetails) {
-    clack45.log.error("No phone number found.");
+    clack46.log.error("No phone number found.");
     process.exit(1);
   }
   let registrationStatus = null;
@@ -36653,18 +36761,18 @@ async function smsRegister(options) {
   }
   console.log("");
   if (phoneDetails.status === "ACTIVE") {
-    clack45.log.success("Your phone number is already ACTIVE and ready to use!");
+    clack46.log.success("Your phone number is already ACTIVE and ready to use!");
     const { PinpointSMSVoiceV2Client: PinpointSMSVoiceV2Client5, DescribePoolsCommand } = await import("@aws-sdk/client-pinpoint-sms-voice-v2");
     const client = new PinpointSMSVoiceV2Client5({ region });
     const pools = await client.send(new DescribePoolsCommand({}));
     if (!pools.Pools?.length) {
-      clack45.log.info("Run `wraps sms sync` to create the phone pool.");
+      clack46.log.info("Run `wraps sms sync` to create the phone pool.");
     }
     process.exit(0);
   }
   if (phoneDetails.type !== "TOLL_FREE") {
-    clack45.log.info("Only toll-free numbers require registration.");
-    clack45.log.info(`Your ${phoneDetails.type} number should be ready to use.`);
+    clack46.log.info("Only toll-free numbers require registration.");
+    clack46.log.info(`Your ${phoneDetails.type} number should be ready to use.`);
     process.exit(0);
   }
   console.log(pc49.bold("Toll-Free Registration Required"));
@@ -36683,12 +36791,12 @@ async function smsRegister(options) {
   console.log(`  ${pc49.dim("\u2022")} How users opt-in to receive messages`);
   console.log(`  ${pc49.dim("\u2022")} Expected monthly message volume`);
   console.log("");
-  const openConsole = await clack45.confirm({
+  const openConsole = await clack46.confirm({
     message: "Open AWS Console to start registration?",
     initialValue: true
   });
-  if (clack45.isCancel(openConsole)) {
-    clack45.cancel("Registration cancelled.");
+  if (clack46.isCancel(openConsole)) {
+    clack46.cancel("Registration cancelled.");
     process.exit(0);
   }
   if (openConsole) {
@@ -36698,13 +36806,13 @@ async function smsRegister(options) {
     const execAsync2 = promisify2(exec2);
     try {
       await execAsync2(`open "${consoleUrl}"`);
-      clack45.log.success("Opened AWS Console in your browser.");
+      clack46.log.success("Opened AWS Console in your browser.");
     } catch {
       try {
         await execAsync2(`xdg-open "${consoleUrl}"`);
-        clack45.log.success("Opened AWS Console in your browser.");
+        clack46.log.success("Opened AWS Console in your browser.");
       } catch {
-        clack45.log.info("Open this URL in your browser:");
+        clack46.log.info("Open this URL in your browser:");
         console.log(`
   ${pc49.cyan(consoleUrl)}
 `);
@@ -36732,7 +36840,7 @@ async function smsRegister(options) {
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack45.outro(pc49.dim("Good luck with your registration!"));
+  clack46.outro(pc49.dim("Good luck with your registration!"));
 }
 
 // src/commands/sms/status.ts
@@ -36744,7 +36852,8 @@ init_json_output();
 init_metadata();
 init_output();
 init_pulumi();
-import * as clack46 from "@clack/prompts";
+init_region_resolver();
+import * as clack47 from "@clack/prompts";
 import * as pulumi30 from "@pulumi/pulumi";
 import pc50 from "picocolors";
 function displaySMSStatus(options) {
@@ -36784,24 +36893,29 @@ function displaySMSStatus(options) {
     lines.push(pc50.bold("IAM Role"));
     lines.push(`  ${pc50.dim(options.roleArn)}`);
   }
-  clack46.note(lines.join("\n"), "SMS Status");
+  clack47.note(lines.join("\n"), "SMS Status");
 }
-async function smsStatus(_options) {
+async function smsStatus(options) {
   await ensurePulumiInstalled();
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack46.intro(pc50.bold("Wraps SMS Status"));
+    clack47.intro(pc50.bold("Wraps SMS Status"));
   }
   const identity = await progress.execute(
     "Loading SMS infrastructure status",
     async () => validateAWSCredentials()
   );
-  const region = await getAWSRegion();
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    service: "sms",
+    label: "SMS deployment"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
     progress.stop();
-    clack46.log.error("No SMS infrastructure found");
+    clack47.log.error("No SMS infrastructure found");
     console.log(
       `
 Run ${pc50.cyan("wraps sms init")} to deploy SMS infrastructure.
@@ -36840,7 +36954,7 @@ Run ${pc50.cyan("wraps sms init")} to deploy SMS infrastructure.
   }
   displaySMSStatus(smsStatusData);
   console.log("");
-  clack46.log.info(pc50.bold("Commands:"));
+  clack47.log.info(pc50.bold("Commands:"));
   console.log(
     `  ${pc50.cyan("wraps sms test --to +1234567890")} - Send a test message`
   );
@@ -36851,12 +36965,12 @@ Run ${pc50.cyan("wraps sms init")} to deploy SMS infrastructure.
     event_tracking: smsConfig?.eventTracking?.enabled,
     duration_ms: Date.now() - startTime
   });
-  clack46.outro(pc50.dim("SMS infrastructure is ready"));
+  clack47.outro(pc50.dim("SMS infrastructure is ready"));
 }
 
 // src/commands/sms/sync.ts
 init_esm_shims();
-import * as clack47 from "@clack/prompts";
+import * as clack48 from "@clack/prompts";
 import * as pulumi31 from "@pulumi/pulumi";
 import pc51 from "picocolors";
 init_events();
@@ -36871,7 +36985,7 @@ async function smsSync(options) {
   await ensurePulumiInstalled();
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack47.intro(pc51.bold("Wraps SMS Infrastructure Sync"));
+    clack48.intro(pc51.bold("Wraps SMS Infrastructure Sync"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -36883,7 +36997,7 @@ async function smsSync(options) {
   const smsService = metadata?.services?.sms;
   if (!smsService?.config) {
     progress.stop();
-    clack47.log.error("No SMS infrastructure found to sync");
+    clack48.log.error("No SMS infrastructure found to sync");
     console.log(
       `
 Run ${pc51.cyan("wraps sms init")} to deploy SMS infrastructure first.
@@ -36901,12 +37015,12 @@ Run ${pc51.cyan("wraps sms init")} to deploy SMS infrastructure first.
     `Event tracking: ${pc51.cyan(smsConfig.eventTracking?.enabled ? "enabled" : "disabled")}`
   );
   if (!options.yes) {
-    const confirmed = await clack47.confirm({
+    const confirmed = await clack48.confirm({
       message: "Sync SMS infrastructure? This will update Lambda code and recreate any missing resources.",
       initialValue: true
     });
-    if (clack47.isCancel(confirmed) || !confirmed) {
-      clack47.cancel("Sync cancelled.");
+    if (clack48.isCancel(confirmed) || !confirmed) {
+      clack48.cancel("Sync cancelled.");
       process.exit(0);
     }
   }
@@ -37011,7 +37125,7 @@ Run ${pc51.cyan("wraps sms init")} to deploy SMS infrastructure first.
       throw errors.stackLocked();
     }
     trackError("SYNC_FAILED", "sms:sync", { step: "sync" });
-    clack47.log.error(`SMS sync failed: ${errorMessage}`);
+    clack48.log.error(`SMS sync failed: ${errorMessage}`);
     process.exit(1);
   }
   if (metadata && smsService) {
@@ -37031,7 +37145,7 @@ Run ${pc51.cyan("wraps sms init")} to deploy SMS infrastructure first.
     return;
   }
   console.log("\n");
-  clack47.log.success(pc51.green("SMS infrastructure synced successfully!"));
+  clack48.log.success(pc51.green("SMS infrastructure synced successfully!"));
   const changes = [];
   if (outputs.lambdaFunctions?.length) {
     changes.push("Lambda functions updated");
@@ -37045,7 +37159,7 @@ Run ${pc51.cyan("wraps sms init")} to deploy SMS infrastructure first.
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack47.outro(pc51.green("Sync complete!"));
+  clack48.outro(pc51.green("Sync complete!"));
 }
 
 // src/commands/sms/test.ts
@@ -37060,7 +37174,7 @@ import {
   PinpointSMSVoiceV2Client as PinpointSMSVoiceV2Client3,
   SendTextMessageCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
-import * as clack48 from "@clack/prompts";
+import * as clack49 from "@clack/prompts";
 import pc52 from "picocolors";
 
 // src/utils/sms/validation.ts
@@ -37084,7 +37198,7 @@ async function smsTest(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack48.intro(pc52.bold("Wraps SMS Test"));
+    clack49.intro(pc52.bold("Wraps SMS Test"));
   }
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -37094,7 +37208,7 @@ async function smsTest(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
     progress.stop();
-    clack48.log.error("No SMS infrastructure found");
+    clack49.log.error("No SMS infrastructure found");
     console.log(
       `
 Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
@@ -37111,7 +37225,7 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
     );
   }
   if (!toNumber) {
-    const destinationType = await clack48.select({
+    const destinationType = await clack49.select({
       message: "Choose destination number:",
       options: [
         {
@@ -37126,25 +37240,25 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
         }
       ]
     });
-    if (clack48.isCancel(destinationType)) {
-      clack48.cancel("Operation cancelled.");
+    if (clack49.isCancel(destinationType)) {
+      clack49.cancel("Operation cancelled.");
       process.exit(0);
     }
     if (destinationType === "simulator") {
-      const simResult = await clack48.select({
+      const simResult = await clack49.select({
         message: "Select simulator destination:",
         options: SIMULATOR_DESTINATIONS.map((sim) => ({
           value: sim.number,
           label: `${sim.number} | ${sim.country}`
         }))
       });
-      if (clack48.isCancel(simResult)) {
-        clack48.cancel("Operation cancelled.");
+      if (clack49.isCancel(simResult)) {
+        clack49.cancel("Operation cancelled.");
         process.exit(0);
       }
       toNumber = simResult;
     } else {
-      const result = await clack48.text({
+      const result = await clack49.text({
         message: "Enter destination phone number (E.164 format):",
         placeholder: "+14155551234",
         validate: (value) => {
@@ -37157,22 +37271,22 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
           return;
         }
       });
-      if (clack48.isCancel(result)) {
-        clack48.cancel("Operation cancelled.");
+      if (clack49.isCancel(result)) {
+        clack49.cancel("Operation cancelled.");
         process.exit(0);
       }
       toNumber = result;
     }
   } else if (!isValidPhoneNumber(toNumber)) {
     progress.stop();
-    clack48.log.error(
+    clack49.log.error(
       `Invalid phone number format: ${toNumber}. Use E.164 format (e.g., +14155551234)`
     );
     process.exit(1);
   }
   let message = options.message;
   if (!message) {
-    const result = await clack48.text({
+    const result = await clack49.text({
       message: "Enter test message:",
       placeholder: "Hello from Wraps SMS!",
       defaultValue: "Hello from Wraps SMS! This is a test message.",
@@ -37186,8 +37300,8 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
         return;
       }
     });
-    if (clack48.isCancel(result)) {
-      clack48.cancel("Operation cancelled.");
+    if (clack49.isCancel(result)) {
+      clack49.cancel("Operation cancelled.");
       process.exit(0);
     }
     message = result;
@@ -37226,9 +37340,9 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
       return;
     }
     console.log("\n");
-    clack48.log.success(pc52.green("Test SMS sent successfully!"));
+    clack49.log.success(pc52.green("Test SMS sent successfully!"));
     console.log("");
-    clack48.note(
+    clack49.note(
       [
         `${pc52.bold("Message ID:")} ${pc52.cyan(messageId || "unknown")}`,
         `${pc52.bold("To:")} ${pc52.cyan(toNumber)}`,
@@ -37243,11 +37357,11 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
     );
     if (smsConfig?.eventTracking?.enabled) {
       console.log("");
-      clack48.log.info(
+      clack49.log.info(
         pc52.dim("Event tracking is enabled. Check DynamoDB for delivery status.")
       );
     }
-    clack48.outro(pc52.green("Test complete!"));
+    clack49.outro(pc52.green("Test complete!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -37259,24 +37373,24 @@ Run ${pc52.cyan("wraps sms init")} to deploy SMS infrastructure.
     });
     const errorName = error instanceof Error ? error.name : "";
     if (errorName === "ConflictException" || errorMessage.includes("opt-out")) {
-      clack48.log.error("Destination number has opted out of messages");
+      clack49.log.error("Destination number has opted out of messages");
       console.log("\nThe recipient has opted out of receiving SMS messages.\n");
     } else if (errorName === "ThrottlingException" || errorMessage.includes("spending limit")) {
-      clack48.log.error("SMS rate or spending limit reached");
+      clack49.log.error("SMS rate or spending limit reached");
       console.log(
         "\nCheck your AWS account SMS spending limits in the console.\n"
       );
     } else if (errorName === "ValidationException") {
-      clack48.log.error(`Invalid request: ${errorMessage}`);
+      clack49.log.error(`Invalid request: ${errorMessage}`);
     } else if (errorMessage.includes("not verified") || errorMessage.includes("not registered")) {
-      clack48.log.error("Toll-free number registration is not complete");
+      clack49.log.error("Toll-free number registration is not complete");
       console.log(
         `
 Run ${pc52.cyan("wraps sms register")} to check registration status.
 `
       );
     } else if (errorName === "AccessDeniedException") {
-      clack48.log.error(
+      clack49.log.error(
         "Permission denied \u2014 IAM role may be missing SMS send permissions"
       );
       console.log(
@@ -37285,7 +37399,7 @@ Run ${pc52.cyan("wraps sms upgrade")} to update IAM policies.
 `
       );
     } else {
-      clack48.log.error(`Failed to send SMS: ${errorMessage}`);
+      clack49.log.error(`Failed to send SMS: ${errorMessage}`);
     }
     process.exit(1);
   }
@@ -37293,7 +37407,7 @@ Run ${pc52.cyan("wraps sms upgrade")} to update IAM policies.
 
 // src/commands/sms/upgrade.ts
 init_esm_shims();
-import * as clack49 from "@clack/prompts";
+import * as clack50 from "@clack/prompts";
 import * as pulumi32 from "@pulumi/pulumi";
 import pc53 from "picocolors";
 init_events();
@@ -37305,11 +37419,12 @@ init_metadata();
 init_output();
 init_prompts();
 init_pulumi();
+init_region_resolver();
 async function smsUpgrade(options) {
   const startTime = Date.now();
   let upgradeAction = "";
   if (!isJsonMode()) {
-    clack49.intro(pc53.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
+    clack50.intro(pc53.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
   }
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
@@ -37324,24 +37439,25 @@ async function smsUpgrade(options) {
     async () => validateAWSCredentials()
   );
   progress.info(`Connected to AWS account: ${pc53.cyan(identity.accountId)}`);
-  let region = options.region;
-  if (!region) {
-    const defaultRegion = await getAWSRegion();
-    region = defaultRegion;
-  }
+  const region = await resolveRegionForCommand({
+    accountId: identity.accountId,
+    optionRegion: options.region,
+    service: "sms",
+    label: "SMS deployment"
+  });
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
-    clack49.log.error(
+    clack50.log.error(
       `No Wraps connection found for account ${pc53.cyan(identity.accountId)} in region ${pc53.cyan(region)}`
     );
-    clack49.log.info(
+    clack50.log.info(
       `Use ${pc53.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
   }
   if (!metadata.services.sms) {
-    clack49.log.error("No SMS infrastructure found");
-    clack49.log.info(
+    clack50.log.error("No SMS infrastructure found");
+    clack50.log.info(
       `Use ${pc53.cyan("wraps sms init")} to deploy SMS infrastructure.`
     );
     process.exit(1);
@@ -37357,8 +37473,8 @@ ${pc53.bold("Current Configuration:")}
   }
   const config2 = metadata.services.sms.config;
   if (!config2) {
-    clack49.log.error("No SMS configuration found in metadata");
-    clack49.log.info(
+    clack50.log.error("No SMS configuration found in metadata");
+    clack50.log.info(
       `Use ${pc53.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
@@ -37418,7 +37534,7 @@ ${pc53.bold("Current Configuration:")}
     "10dlc": "10DLC",
     "short-code": "Short code"
   };
-  upgradeAction = await clack49.select({
+  upgradeAction = await clack50.select({
     message: "What would you like to do?",
     options: [
       {
@@ -37458,8 +37574,8 @@ ${pc53.bold("Current Configuration:")}
       }
     ]
   });
-  if (clack49.isCancel(upgradeAction)) {
-    clack49.cancel("Upgrade cancelled.");
+  if (clack50.isCancel(upgradeAction)) {
+    clack50.cancel("Upgrade cancelled.");
     process.exit(0);
   }
   let updatedConfig = { ...config2 };
@@ -37500,17 +37616,17 @@ ${pc53.bold("Current Configuration:")}
         hint: p.hint
       }));
       if (availableTypes.length === 0) {
-        clack49.log.warn(
+        clack50.log.warn(
           "Already on highest phone number tier. Contact AWS for dedicated short codes."
         );
         process.exit(0);
       }
-      const selectedType = await clack49.select({
+      const selectedType = await clack50.select({
         message: "Select new phone number type:",
         options: availableTypes
       });
-      if (clack49.isCancel(selectedType)) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(selectedType)) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       if (selectedType === "toll-free") {
@@ -37533,12 +37649,12 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("Toll-free Registration Required")}
         console.log(
           pc53.dim("\nUntil verified, sending is limited to low volume.\n")
         );
-        const confirmTollFree = await clack49.confirm({
+        const confirmTollFree = await clack50.confirm({
           message: "Continue with toll-free number request?",
           initialValue: true
         });
-        if (clack49.isCancel(confirmTollFree) || !confirmTollFree) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(confirmTollFree) || !confirmTollFree) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
       }
@@ -37553,12 +37669,12 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
         console.log("  \u2022 Campaign registration: $15/mo per campaign");
         console.log("  \u2022 Verification takes 1-7 business days");
         console.log("");
-        const confirm10DLC = await clack49.confirm({
+        const confirm10DLC = await clack50.confirm({
           message: "Continue with 10DLC number request?",
           initialValue: true
         });
-        if (clack49.isCancel(confirm10DLC) || !confirm10DLC) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(confirm10DLC) || !confirm10DLC) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
       }
@@ -37583,15 +37699,15 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
         disabled: currentPresetIdx >= 0 && idx <= currentPresetIdx ? "Current or lower tier" : void 0
       })).filter((p) => !p.disabled && p.value !== "custom");
       if (availablePresets.length === 0) {
-        clack49.log.warn("Already on highest preset (Enterprise)");
+        clack50.log.warn("Already on highest preset (Enterprise)");
         process.exit(0);
       }
-      const selectedPreset = await clack49.select({
+      const selectedPreset = await clack50.select({
         message: "Select new preset:",
         options: availablePresets
       });
-      if (clack49.isCancel(selectedPreset)) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(selectedPreset)) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       const presetConfig = getSMSPreset(selectedPreset);
@@ -37607,7 +37723,7 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
     }
     case "event-tracking": {
       if (config2.eventTracking?.enabled) {
-        const eventAction = await clack49.select({
+        const eventAction = await clack50.select({
           message: "What would you like to do with event tracking?",
           options: [
             {
@@ -37622,17 +37738,17 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             }
           ]
         });
-        if (clack49.isCancel(eventAction)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(eventAction)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (eventAction === "disable") {
-          const confirmDisable = await clack49.confirm({
+          const confirmDisable = await clack50.confirm({
             message: "Are you sure? Existing history will remain, but new events won't be tracked.",
             initialValue: false
           });
-          if (clack49.isCancel(confirmDisable) || !confirmDisable) {
-            clack49.cancel("Event tracking not disabled.");
+          if (clack50.isCancel(confirmDisable) || !confirmDisable) {
+            clack50.cancel("Event tracking not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -37642,7 +37758,7 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             }
           };
         } else {
-          const retention = await clack49.select({
+          const retention = await clack50.select({
             message: "Message history retention period:",
             options: [
               { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -37669,8 +37785,8 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             ],
             initialValue: config2.eventTracking.archiveRetention || "90days"
           });
-          if (clack49.isCancel(retention)) {
-            clack49.cancel("Upgrade cancelled.");
+          if (clack50.isCancel(retention)) {
+            clack50.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -37682,19 +37798,19 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
           };
         }
       } else {
-        const enableTracking = await clack49.confirm({
+        const enableTracking = await clack50.confirm({
           message: "Enable event tracking? (Track SMS events with history)",
           initialValue: true
         });
-        if (clack49.isCancel(enableTracking)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(enableTracking)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (!enableTracking) {
-          clack49.log.info("Event tracking not enabled.");
+          clack50.log.info("Event tracking not enabled.");
           process.exit(0);
         }
-        const retention = await clack49.select({
+        const retention = await clack50.select({
           message: "Message history retention period:",
           options: [
             { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -37717,8 +37833,8 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
           ],
           initialValue: "90days"
         });
-        if (clack49.isCancel(retention)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(retention)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         updatedConfig = {
@@ -37737,12 +37853,12 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
     }
     case "retention": {
       if (!config2.eventTracking?.enabled) {
-        clack49.log.error(
+        clack50.log.error(
           "Event tracking is not enabled. Enable it first to change retention."
         );
         process.exit(1);
       }
-      const retention = await clack49.select({
+      const retention = await clack50.select({
         message: "Message history retention period (event data in DynamoDB):",
         options: [
           { value: "7days", label: "7 days", hint: "Minimal storage cost" },
@@ -37761,8 +37877,8 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
         ],
         initialValue: config2.eventTracking.archiveRetention || "90days"
       });
-      if (clack49.isCancel(retention)) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(retention)) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -37780,21 +37896,21 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
     case "link-tracking": {
       const enableLinkTracking = !config2.tracking?.linkTracking;
       if (enableLinkTracking) {
-        clack49.log.info(
+        clack50.log.info(
           pc53.dim(
             "Link tracking will track clicks on URLs in your SMS messages."
           )
         );
-        clack49.log.info(
+        clack50.log.info(
           pc53.dim("URLs will be rewritten to go through a tracking endpoint.")
         );
       }
-      const confirmed = await clack49.confirm({
+      const confirmed = await clack50.confirm({
         message: enableLinkTracking ? "Enable link click tracking?" : "Disable link click tracking?",
         initialValue: enableLinkTracking
       });
-      if (clack49.isCancel(confirmed) || !confirmed) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(confirmed) || !confirmed) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -37811,7 +37927,7 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
     }
     case "archiving": {
       if (config2.messageArchiving?.enabled) {
-        const archivingAction = await clack49.select({
+        const archivingAction = await clack50.select({
           message: "What would you like to do with message archiving?",
           options: [
             {
@@ -37826,17 +37942,17 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             }
           ]
         });
-        if (clack49.isCancel(archivingAction)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(archivingAction)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (archivingAction === "disable") {
-          const confirmDisable = await clack49.confirm({
+          const confirmDisable = await clack50.confirm({
             message: "Are you sure? Existing archived messages will remain, but new messages won't be archived.",
             initialValue: false
           });
-          if (clack49.isCancel(confirmDisable) || !confirmDisable) {
-            clack49.cancel("Archiving not disabled.");
+          if (clack50.isCancel(confirmDisable) || !confirmDisable) {
+            clack50.cancel("Archiving not disabled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -37847,7 +37963,7 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             }
           };
         } else {
-          const retention = await clack49.select({
+          const retention = await clack50.select({
             message: "Message archive retention period:",
             options: [
               {
@@ -37878,8 +37994,8 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
             ],
             initialValue: config2.messageArchiving.retention
           });
-          if (clack49.isCancel(retention)) {
-            clack49.cancel("Upgrade cancelled.");
+          if (clack50.isCancel(retention)) {
+            clack50.cancel("Upgrade cancelled.");
             process.exit(0);
           }
           updatedConfig = {
@@ -37891,19 +38007,19 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
           };
         }
       } else {
-        const enableArchiving = await clack49.confirm({
+        const enableArchiving = await clack50.confirm({
           message: "Enable message archiving? (Store full message content for viewing)",
           initialValue: true
         });
-        if (clack49.isCancel(enableArchiving)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(enableArchiving)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         if (!enableArchiving) {
-          clack49.log.info("Message archiving not enabled.");
+          clack50.log.info("Message archiving not enabled.");
           process.exit(0);
         }
-        const retention = await clack49.select({
+        const retention = await clack50.select({
           message: "Message archive retention period:",
           options: [
             { value: "7days", label: "7 days", hint: "~$1-2/mo for 10k msgs" },
@@ -37930,8 +38046,8 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
           ],
           initialValue: "90days"
         });
-        if (clack49.isCancel(retention)) {
-          clack49.cancel("Upgrade cancelled.");
+        if (clack50.isCancel(retention)) {
+          clack50.cancel("Upgrade cancelled.");
           process.exit(0);
         }
         updatedConfig = {
@@ -37963,7 +38079,7 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
       const currentAllowed = config2.protectConfiguration?.allowedCountries || [
         "US"
       ];
-      const selectedCountries = await clack49.multiselect({
+      const selectedCountries = await clack50.multiselect({
         message: "Select countries to allow SMS delivery (all others blocked):",
         options: commonCountries.map((c) => ({
           value: c.code,
@@ -37972,16 +38088,16 @@ ${pc53.yellow("\u26A0")} ${pc53.bold("10DLC Campaign Registration Required")}
         initialValues: currentAllowed,
         required: true
       });
-      if (clack49.isCancel(selectedCountries)) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(selectedCountries)) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
-      const enableAIT = await clack49.confirm({
+      const enableAIT = await clack50.confirm({
         message: "Enable AIT (Artificially Inflated Traffic) filtering? (adds per-message cost)",
         initialValue: config2.protectConfiguration?.aitFiltering ?? false
       });
-      if (clack49.isCancel(enableAIT)) {
-        clack49.cancel("Upgrade cancelled.");
+      if (clack50.isCancel(enableAIT)) {
+        clack50.cancel("Upgrade cancelled.");
         process.exit(0);
       }
       updatedConfig = {
@@ -38015,12 +38131,12 @@ ${pc53.bold("Cost Impact:")}`);
   }
   console.log("");
   if (!options.yes) {
-    const confirmed = await clack49.confirm({
+    const confirmed = await clack50.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
     });
-    if (clack49.isCancel(confirmed) || !confirmed) {
-      clack49.cancel("Upgrade cancelled.");
+    if (clack50.isCancel(confirmed) || !confirmed) {
+      clack50.cancel("Upgrade cancelled.");
       process.exit(0);
     }
   }
@@ -38162,9 +38278,9 @@ ${pc53.bold("Cost Impact:")}`);
   }
   progress.info("Connection metadata updated");
   console.log("\n");
-  clack49.log.success(pc53.green(pc53.bold("SMS infrastructure upgraded!")));
+  clack50.log.success(pc53.green(pc53.bold("SMS infrastructure upgraded!")));
   console.log("\n");
-  clack49.note(
+  clack50.note(
     [
       `${pc53.bold("Phone Number:")} ${pc53.cyan(outputs.phoneNumber || "Provisioning...")}`,
       `${pc53.bold("Phone Type:")} ${pc53.cyan(updatedConfig.phoneNumberType || "simulator")}`,
@@ -38239,7 +38355,7 @@ ${pc53.green("\u2713")} ${pc53.bold("Upgrade complete!")}
     action: typeof upgradeAction === "string" ? upgradeAction : void 0,
     duration_ms: Date.now() - startTime
   });
-  clack49.outro(pc53.green("Upgrade complete!"));
+  clack50.outro(pc53.green("Upgrade complete!"));
 }
 
 // src/commands/sms/verify-number.ts
@@ -38258,13 +38374,13 @@ import {
   SendDestinationNumberVerificationCodeCommand,
   VerifyDestinationNumberCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
-import * as clack50 from "@clack/prompts";
+import * as clack51 from "@clack/prompts";
 import pc54 from "picocolors";
 async function smsVerifyNumber(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack50.intro(pc54.bold("Wraps SMS - Verify Destination Number"));
+    clack51.intro(pc54.bold("Wraps SMS - Verify Destination Number"));
   }
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -38274,7 +38390,7 @@ async function smsVerifyNumber(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
     progress.stop();
-    clack50.log.error("No SMS infrastructure found");
+    clack51.log.error("No SMS infrastructure found");
     console.log(
       `
 Run ${pc54.cyan("wraps sms init")} to deploy SMS infrastructure.
@@ -38291,7 +38407,7 @@ Run ${pc54.cyan("wraps sms init")} to deploy SMS infrastructure.
       );
       progress.stop();
       if (!response.VerifiedDestinationNumbers || response.VerifiedDestinationNumbers.length === 0) {
-        clack50.log.info("No verified destination numbers found");
+        clack51.log.info("No verified destination numbers found");
         console.log(
           `
 Run ${pc54.cyan("wraps sms verify-number")} to verify a number.
@@ -38299,7 +38415,7 @@ Run ${pc54.cyan("wraps sms verify-number")} to verify a number.
         );
       } else {
         console.log("\n");
-        clack50.log.info(pc54.bold("Verified Destination Numbers:"));
+        clack51.log.info(pc54.bold("Verified Destination Numbers:"));
         console.log("");
         for (const num of response.VerifiedDestinationNumbers) {
           const status2 = num.Status === "VERIFIED" ? pc54.green("\u2713 Verified") : pc54.yellow("\u29D6 Pending");
@@ -38321,7 +38437,7 @@ Run ${pc54.cyan("wraps sms verify-number")} to verify a number.
         });
         return;
       }
-      clack50.outro(pc54.green("Done!"));
+      clack51.outro(pc54.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -38329,7 +38445,7 @@ Run ${pc54.cyan("wraps sms verify-number")} to verify a number.
       trackError("SMS_LIST_VERIFIED_FAILED", "sms:verify-number:list", {
         error: errorMessage
       });
-      clack50.log.error(`Failed to list verified numbers: ${errorMessage}`);
+      clack51.log.error(`Failed to list verified numbers: ${errorMessage}`);
       process.exit(1);
     }
   }
@@ -38337,7 +38453,7 @@ Run ${pc54.cyan("wraps sms verify-number")} to verify a number.
     const phoneNumber2 = options.phoneNumber;
     if (!phoneNumber2) {
       progress.stop();
-      clack50.log.error("Phone number is required for deletion");
+      clack51.log.error("Phone number is required for deletion");
       console.log(
         `
 Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234")}
@@ -38354,7 +38470,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
       const verifiedNumber = listResponse.VerifiedDestinationNumbers?.[0];
       if (!verifiedNumber?.VerifiedDestinationNumberId) {
         progress.stop();
-        clack50.log.error(`Number ${phoneNumber2} is not in verified list`);
+        clack51.log.error(`Number ${phoneNumber2} is not in verified list`);
         process.exit(1);
       }
       await progress.execute(`Removing ${phoneNumber2}`, async () => {
@@ -38365,7 +38481,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
         );
       });
       progress.stop();
-      clack50.log.success(`Removed ${pc54.cyan(phoneNumber2)} from verified list`);
+      clack51.log.success(`Removed ${pc54.cyan(phoneNumber2)} from verified list`);
       trackCommand("sms:verify-number:delete", {
         success: true,
         duration_ms: Date.now() - startTime
@@ -38377,7 +38493,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
         });
         return;
       }
-      clack50.outro(pc54.green("Done!"));
+      clack51.outro(pc54.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -38385,7 +38501,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
       trackError("SMS_DELETE_VERIFIED_FAILED", "sms:verify-number:delete", {
         error: errorMessage
       });
-      clack50.log.error(`Failed to delete verified number: ${errorMessage}`);
+      clack51.log.error(`Failed to delete verified number: ${errorMessage}`);
       process.exit(1);
     }
   }
@@ -38398,7 +38514,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
     );
   }
   if (!phoneNumber) {
-    const result = await clack50.text({
+    const result = await clack51.text({
       message: "Enter phone number to verify (E.164 format):",
       placeholder: "+14155551234",
       validate: (value) => {
@@ -38411,14 +38527,14 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
         return;
       }
     });
-    if (clack50.isCancel(result)) {
-      clack50.cancel("Operation cancelled.");
+    if (clack51.isCancel(result)) {
+      clack51.cancel("Operation cancelled.");
       process.exit(0);
     }
     phoneNumber = result;
   } else if (!isValidPhoneNumber(phoneNumber)) {
     progress.stop();
-    clack50.log.error(
+    clack51.log.error(
       `Invalid phone number format: ${phoneNumber}. Use E.164 format (e.g., +14155551234)`
     );
     process.exit(1);
@@ -38433,7 +38549,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
       const verifiedNumber = listResponse.VerifiedDestinationNumbers?.[0];
       if (!verifiedNumber?.VerifiedDestinationNumberId) {
         progress.stop();
-        clack50.log.error(
+        clack51.log.error(
           `Number ${phoneNumber} not found. Run without --code first.`
         );
         process.exit(1);
@@ -38448,7 +38564,7 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
       });
       progress.stop();
       console.log("\n");
-      clack50.log.success(
+      clack51.log.success(
         pc54.green(`Phone number ${pc54.cyan(phoneNumber)} verified!`)
       );
       console.log("");
@@ -38466,13 +38582,13 @@ Usage: ${pc54.cyan("wraps sms verify-number --delete --phone-number +14155551234
         });
         return;
       }
-      clack50.outro(pc54.green("Verification complete!"));
+      clack51.outro(pc54.green("Verification complete!"));
       return;
     } catch (error) {
       progress.stop();
       const errorMessage = error instanceof Error ? error.message : String(error);
       if (errorMessage.includes("Invalid verification code")) {
-        clack50.log.error("Invalid verification code. Please try again.");
+        clack51.log.error("Invalid verification code. Please try again.");
         console.log(
           `
 Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
@@ -38482,7 +38598,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         trackError("SMS_VERIFY_CODE_FAILED", "sms:verify-number:confirm", {
           error: errorMessage
         });
-        clack50.log.error(`Verification failed: ${errorMessage}`);
+        clack51.log.error(`Verification failed: ${errorMessage}`);
       }
       process.exit(1);
     }
@@ -38497,7 +38613,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       const verifiedNumber = listResponse.VerifiedDestinationNumbers?.[0];
       if (!verifiedNumber?.VerifiedDestinationNumberId) {
         progress.stop();
-        clack50.log.error(
+        clack51.log.error(
           `Number ${phoneNumber} not found. Run without --resend first.`
         );
         process.exit(1);
@@ -38511,7 +38627,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         );
       });
       progress.stop();
-      clack50.log.success(`Verification code resent to ${pc54.cyan(phoneNumber)}`);
+      clack51.log.success(`Verification code resent to ${pc54.cyan(phoneNumber)}`);
       console.log("");
       console.log(
         `Once you receive the code, run:
@@ -38528,7 +38644,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         });
         return;
       }
-      clack50.outro(pc54.green("Code sent!"));
+      clack51.outro(pc54.green("Code sent!"));
       return;
     } catch (error) {
       progress.stop();
@@ -38536,7 +38652,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       trackError("SMS_RESEND_CODE_FAILED", "sms:verify-number:resend", {
         error: errorMessage
       });
-      clack50.log.error(`Failed to resend code: ${errorMessage}`);
+      clack51.log.error(`Failed to resend code: ${errorMessage}`);
       process.exit(1);
     }
   }
@@ -38556,10 +38672,10 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         });
         return;
       }
-      clack50.log.info(
+      clack51.log.info(
         `Number ${pc54.cyan(phoneNumber)} is already verified and ready to use!`
       );
-      clack50.outro(pc54.green("Done!"));
+      clack51.outro(pc54.green("Done!"));
       return;
     }
     if (existingNumber?.Status === "PENDING") {
@@ -38583,7 +38699,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         });
         return;
       }
-      clack50.log.info(
+      clack51.log.info(
         `Verification already in progress. New code sent to ${pc54.cyan(phoneNumber)}`
       );
       console.log("");
@@ -38591,7 +38707,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         `Once you receive the code, run:
   ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
       );
-      clack50.outro(pc54.green("Code sent!"));
+      clack51.outro(pc54.green("Code sent!"));
       return;
     }
     const createResponse = await progress.execute(
@@ -38612,11 +38728,11 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
     });
     progress.stop();
     console.log("\n");
-    clack50.log.success(
+    clack51.log.success(
       `Verification code sent to ${pc54.cyan(phoneNumber)} via SMS`
     );
     console.log("");
-    clack50.note(
+    clack51.note(
       [
         "1. Check your phone for the verification code",
         "",
@@ -38639,12 +38755,12 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       });
       return;
     }
-    clack50.outro(pc54.green("Verification started!"));
+    clack51.outro(pc54.green("Verification started!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
     if (errorMessage.includes("already exists")) {
-      clack50.log.error("This number is already being verified");
+      clack51.log.error("This number is already being verified");
       console.log(
         `
 Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
@@ -38654,7 +38770,7 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       trackError("SMS_CREATE_VERIFIED_FAILED", "sms:verify-number:start", {
         error: errorMessage
       });
-      clack50.log.error(`Failed to start verification: ${errorMessage}`);
+      clack51.log.error(`Failed to start verification: ${errorMessage}`);
     }
     process.exit(1);
   }
@@ -38663,11 +38779,11 @@ Run ${pc54.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
 // src/commands/support.ts
 init_esm_shims();
 init_events();
-import * as clack51 from "@clack/prompts";
+import * as clack52 from "@clack/prompts";
 import pc55 from "picocolors";
 async function support() {
   trackCommand("support", { success: true });
-  clack51.intro(pc55.bold("Get Help with Wraps"));
+  clack52.intro(pc55.bold("Get Help with Wraps"));
   console.log();
   console.log(`  ${pc55.bold("Email:")}   ${pc55.cyan("hey@wraps.sh")}`);
   console.log(
@@ -38682,20 +38798,20 @@ async function support() {
 // src/commands/telemetry.ts
 init_esm_shims();
 init_client();
-import * as clack52 from "@clack/prompts";
+import * as clack53 from "@clack/prompts";
 import pc56 from "picocolors";
 async function telemetryEnable() {
   const client = getTelemetryClient();
   const override = client.enable();
   if (override) {
-    clack52.log.warn(
+    clack53.log.warn(
       "Telemetry enabled in config, but overridden by environment"
     );
     console.log(`   Reason: ${pc56.yellow(override)}`);
     console.log(`   Config: ${pc56.dim(client.getConfigPath())}`);
     console.log();
   } else {
-    clack52.log.success(pc56.green("Telemetry enabled"));
+    clack53.log.success(pc56.green("Telemetry enabled"));
     console.log(`   Config: ${pc56.dim(client.getConfigPath())}`);
     console.log(`
    ${pc56.dim("Thank you for helping improve Wraps!")}
@@ -38705,7 +38821,7 @@ async function telemetryEnable() {
 async function telemetryDisable() {
   const client = getTelemetryClient();
   client.disable();
-  clack52.log.success(pc56.green("Telemetry disabled"));
+  clack53.log.success(pc56.green("Telemetry disabled"));
   console.log(`   Config: ${pc56.dim(client.getConfigPath())}`);
   console.log(
     `
@@ -38715,7 +38831,7 @@ async function telemetryDisable() {
 }
 async function telemetryStatus() {
   const client = getTelemetryClient();
-  clack52.intro(pc56.bold("Telemetry Status"));
+  clack53.intro(pc56.bold("Telemetry Status"));
   const override = client.getEnvOverride();
   const status2 = client.isEnabled() ? pc56.green("Enabled") : pc56.red("Disabled");
   console.log();
@@ -38753,7 +38869,7 @@ async function telemetryStatus() {
 init_esm_shims();
 import { existsSync as existsSync18, mkdirSync as mkdirSync2, writeFileSync } from "fs";
 import { join as join20 } from "path";
-import * as clack53 from "@clack/prompts";
+import * as clack54 from "@clack/prompts";
 import pc57 from "picocolors";
 var EXAMPLE_CASCADE_WORKFLOW = `import {
   defineWorkflow,
@@ -38849,30 +38965,30 @@ export default defineConfig({
 });
 `;
 async function workflowInit(options = {}) {
-  clack53.intro(pc57.bgCyan(pc57.black(" wraps workflow init ")));
+  clack54.intro(pc57.bgCyan(pc57.black(" wraps workflow init ")));
   const wrapsDir = join20(process.cwd(), "wraps");
   const workflowsDir = join20(wrapsDir, "workflows");
   const configPath = join20(wrapsDir, "wraps.config.ts");
   if (existsSync18(workflowsDir)) {
-    clack53.log.info(
+    clack54.log.info(
       `Workflows directory already exists at ${pc57.cyan("wraps/workflows/")}`
     );
     const files = existsSync18(join20(workflowsDir, "cart-recovery.ts")) || existsSync18(join20(workflowsDir, "welcome-sequence.ts"));
     if (files && !options.yes) {
-      const shouldContinue = await clack53.confirm({
+      const shouldContinue = await clack54.confirm({
         message: "Example files may already exist. Overwrite them?",
         initialValue: false
       });
-      if (clack53.isCancel(shouldContinue) || !shouldContinue) {
-        clack53.log.info("Skipping file creation.");
+      if (clack54.isCancel(shouldContinue) || !shouldContinue) {
+        clack54.log.info("Skipping file creation.");
         showNextSteps2();
-        clack53.outro("Done!");
+        clack54.outro("Done!");
         return;
       }
     }
   }
   try {
-    const s = clack53.spinner();
+    const s = clack54.spinner();
     s.start("Creating workflows directory...");
     mkdirSync2(workflowsDir, { recursive: true });
     s.stop("Created wraps/workflows/");
@@ -38890,26 +39006,26 @@ async function workflowInit(options = {}) {
     s.stop("Created 2 example workflows");
     if (!existsSync18(configPath)) {
       writeFileSync(configPath, EXAMPLE_CONFIG, "utf-8");
-      clack53.log.info(`Created ${pc57.cyan("wraps/wraps.config.ts")}`);
+      clack54.log.info(`Created ${pc57.cyan("wraps/wraps.config.ts")}`);
     }
-    clack53.log.success(
+    clack54.log.success(
       `${pc57.bold("Workflows scaffolded!")} Created:
   ${pc57.cyan("wraps/wraps.config.ts")}               \u2014 Project config
   ${pc57.cyan("wraps/workflows/cart-recovery.ts")}    \u2014 Cross-channel cascade example
   ${pc57.cyan("wraps/workflows/welcome-sequence.ts")} \u2014 Welcome series example`
     );
     showNextSteps2();
-    clack53.outro(pc57.green("Happy orchestrating!"));
+    clack54.outro(pc57.green("Happy orchestrating!"));
   } catch (error) {
-    clack53.log.error(
+    clack54.log.error(
       `Failed to scaffold workflows: ${error instanceof Error ? error.message : String(error)}`
     );
-    clack53.outro(pc57.red("Scaffolding failed."));
+    clack54.outro(pc57.red("Scaffolding failed."));
     process.exitCode = 1;
   }
 }
 function showNextSteps2() {
-  clack53.log.info(
+  clack54.log.info(
     `${pc57.bold("Next steps:")}
 
   1. Edit ${pc57.cyan("wraps/wraps.config.ts")} with your org slug and domain
@@ -38968,6 +39084,7 @@ var BOOLEAN_FLAGS = [
   "draft",
   "root",
   "cleanup",
+  "reveal-secret",
   "help",
   "version"
 ];
@@ -39094,7 +39211,7 @@ function showVersion() {
   process.exit(0);
 }
 function showHelp() {
-  clack54.intro(pc59.bold(`WRAPS CLI v${VERSION}`));
+  clack55.intro(pc59.bold(`WRAPS CLI v${VERSION}`));
   console.log("Deploy AWS infrastructure to your account\n");
   console.log("Usage: wraps [service] <command> [options]\n");
   console.log("Services:");
@@ -39300,7 +39417,7 @@ if (!primaryCommand) {
     const telemetry = getTelemetryClient();
     if (telemetry.shouldShowNotification()) {
       console.log();
-      clack54.log.info(pc59.bold("Anonymous Telemetry"));
+      clack55.log.info(pc59.bold("Anonymous Telemetry"));
       console.log(
         `  Wraps collects ${pc59.cyan("anonymous usage data")} to improve the CLI.`
       );
@@ -39318,9 +39435,9 @@ if (!primaryCommand) {
       telemetry.markNotificationShown();
     }
     trackCommand("interactive:menu", { success: true, duration_ms: 0 });
-    clack54.intro(pc59.bold(`WRAPS CLI v${VERSION}`));
+    clack55.intro(pc59.bold(`WRAPS CLI v${VERSION}`));
     console.log("  Deploy AWS infrastructure to your account.\n");
-    const action = await clack54.select({
+    const action = await clack55.select({
       message: "What would you like to do?",
       options: [
         {
@@ -39370,13 +39487,13 @@ if (!primaryCommand) {
         }
       ]
     });
-    if (clack54.isCancel(action)) {
+    if (clack55.isCancel(action)) {
       trackCommand("interactive:cancel", {
         success: true,
         duration_ms: Date.now() - startTime
       });
       await telemetry.shutdown();
-      clack54.cancel("Operation cancelled.");
+      clack55.cancel("Operation cancelled.");
       process.exit(0);
     }
     trackCommand(`interactive:${action}`, {
@@ -39455,7 +39572,7 @@ async function run() {
   const telemetry = getTelemetryClient();
   if (telemetry.shouldShowNotification()) {
     console.log();
-    clack54.log.info(pc59.bold("Anonymous Telemetry"));
+    clack55.log.info(pc59.bold("Anonymous Telemetry"));
     console.log(
       `  Wraps collects ${pc59.cyan("anonymous usage data")} to improve the CLI.`
     );
@@ -39552,7 +39669,7 @@ async function run() {
           break;
         case "verify": {
           if (!flags.domain) {
-            clack54.log.error("--domain flag is required");
+            clack55.log.error("--domain flag is required");
             console.log(
               `
 Usage: ${pc59.cyan("wraps email verify --domain yourapp.com")}
@@ -39591,7 +39708,8 @@ Usage: ${pc59.cyan("wraps email verify --domain yourapp.com")}
             case "status":
               await inboundStatus({
                 region: flags.region,
-                json: flags.json
+                json: flags.json,
+                revealSecret: flags.revealSecret
               });
               break;
             case "verify":
@@ -39625,7 +39743,7 @@ Usage: ${pc59.cyan("wraps email verify --domain yourapp.com")}
               });
               break;
             default:
-              clack54.log.error(
+              clack55.log.error(
                 `Unknown inbound command: ${inboundSubCommand || "(none)"}`
               );
               console.log(
@@ -39680,7 +39798,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("destroy")}, ${pc59.cyan("
               break;
             }
             default:
-              clack54.log.error(
+              clack55.log.error(
                 `Unknown reply command: ${replySubCommand || "(none)"}`
               );
               console.log(
@@ -39710,7 +39828,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("rotate")}, ${pc59.cyan("s
               break;
             case "verify": {
               if (!flags.domain) {
-                clack54.log.error("--domain flag is required");
+                clack55.log.error("--domain flag is required");
                 console.log(
                   `
 Usage: ${pc59.cyan("wraps email domains verify --domain yourapp.com")}
@@ -39723,7 +39841,7 @@ Usage: ${pc59.cyan("wraps email domains verify --domain yourapp.com")}
             }
             case "get-dkim": {
               if (!flags.domain) {
-                clack54.log.error("--domain flag is required");
+                clack55.log.error("--domain flag is required");
                 console.log(
                   `
 Usage: ${pc59.cyan("wraps email domains get-dkim --domain yourapp.com")}
@@ -39736,7 +39854,7 @@ Usage: ${pc59.cyan("wraps email domains get-dkim --domain yourapp.com")}
             }
             case "remove": {
               if (!flags.domain) {
-                clack54.log.error("--domain flag is required");
+                clack55.log.error("--domain flag is required");
                 console.log(
                   `
 Usage: ${pc59.cyan("wraps email domains remove --domain yourapp.com --force")}
@@ -39751,7 +39869,7 @@ Usage: ${pc59.cyan("wraps email domains remove --domain yourapp.com --force")}
               break;
             }
             default:
-              clack54.log.error(
+              clack55.log.error(
                 `Unknown domains command: ${domainsSubCommand || "(none)"}`
               );
               console.log(
@@ -39798,7 +39916,7 @@ Available commands: ${pc59.cyan("add")}, ${pc59.cyan("list")}, ${pc59.cyan("veri
               });
               break;
             default:
-              clack54.log.error(
+              clack55.log.error(
                 `Unknown templates command: ${templatesSubCommand || "(none)"}`
               );
               console.log(
@@ -39842,7 +39960,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("push")}, ${pc59.cyan("pre
               });
               break;
             default:
-              clack54.log.error(
+              clack55.log.error(
                 `Unknown workflows command: ${workflowsSubCommand || "(none)"}`
               );
               console.log(
@@ -39872,7 +39990,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("validate")}, ${pc59.cyan(
           });
           break;
         default:
-          clack54.log.error(`Unknown email command: ${subCommand}`);
+          clack55.log.error(`Unknown email command: ${subCommand}`);
           console.log(
             `
 Run ${pc59.cyan("wraps --help")} for available commands.
@@ -39950,7 +40068,7 @@ Run ${pc59.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack54.log.error(`Unknown sms command: ${subCommand}`);
+          clack55.log.error(`Unknown sms command: ${subCommand}`);
           console.log(
             `
 Run ${pc59.cyan("wraps --help")} for available commands.
@@ -40014,7 +40132,7 @@ Run ${pc59.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack54.log.error(`Unknown cdn command: ${subCommand}`);
+          clack55.log.error(`Unknown cdn command: ${subCommand}`);
           console.log(
             `
 Run ${pc59.cyan("wraps --help")} for available commands.
@@ -40039,7 +40157,7 @@ Run ${pc59.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack54.log.error(
+          clack55.log.error(
             `Unknown workflow command: ${subCommand || "(none)"}`
           );
           console.log(`
@@ -40087,7 +40205,7 @@ Available commands: ${pc59.cyan("init")}
           });
           break;
         default:
-          clack54.log.error(`Unknown platform command: ${subCommand}`);
+          clack55.log.error(`Unknown platform command: ${subCommand}`);
           console.log(
             `
 Available commands: ${pc59.cyan("connect")}, ${pc59.cyan("update-role")}
@@ -40119,7 +40237,7 @@ Available commands: ${pc59.cyan("connect")}, ${pc59.cyan("update-role")}
           await logout();
           break;
         default:
-          clack54.log.error(`Unknown auth command: ${subCommand || "(none)"}`);
+          clack55.log.error(`Unknown auth command: ${subCommand || "(none)"}`);
           console.log(
             `
 Available commands: ${pc59.cyan("login")}, ${pc59.cyan("status")}, ${pc59.cyan("logout")}
@@ -40140,7 +40258,7 @@ Available commands: ${pc59.cyan("login")}, ${pc59.cyan("status")}, ${pc59.cyan("
           await doctor();
           break;
         default:
-          clack54.log.error(`Unknown aws command: ${subCommand}`);
+          clack55.log.error(`Unknown aws command: ${subCommand}`);
           console.log(
             `
 Available commands: ${pc59.cyan("setup")}, ${pc59.cyan("doctor")}
@@ -40225,7 +40343,7 @@ Available commands: ${pc59.cyan("setup")}, ${pc59.cyan("doctor")}
             await telemetryStatus();
             break;
           default:
-            clack54.log.error(`Unknown telemetry command: ${subCommand}`);
+            clack55.log.error(`Unknown telemetry command: ${subCommand}`);
             console.log(
               `
 Available commands: ${pc59.cyan("enable")}, ${pc59.cyan("disable")}, ${pc59.cyan("status")}
@@ -40252,7 +40370,7 @@ Please specify a command for ${primaryCommand} service.
         showHelp();
         break;
       default:
-        clack54.log.error(`Unknown command: ${primaryCommand}`);
+        clack55.log.error(`Unknown command: ${primaryCommand}`);
         console.log(
           `
 Run ${pc59.cyan("wraps --help")} for available commands.