@wraps.dev/cli 2.19.8 → 2.20.1

package/dist/cli.js

@@ -6057,7 +6057,9 @@ function getAllTrackedDomains(metadata) {
       managed: true,
       purpose: d.purpose,
       mailFromDomain: d.mailFromDomain,
-      addedAt: d.addedAt
+      addedAt: d.addedAt,
+      configSetName: d.configSetName,
+      trackingConfig: d.trackingConfig
     });
   }
   return result;
@@ -7255,6 +7257,35 @@ var init_dist = __esm({
   }
 });
 
+// src/utils/email/config-set-slug.ts
+var config_set_slug_exports = {};
+__export(config_set_slug_exports, {
+  domainToConfigSetName: () => domainToConfigSetName
+});
+import { createHash } from "crypto";
+function domainToConfigSetName(domain) {
+  const slug = domain.toLowerCase().replace(/\./g, "-");
+  const needsHash = domain.includes("-") || slug.length > MAX_SLUG;
+  if (!needsHash) {
+    return `${PREFIX}${slug}`;
+  }
+  const hash = createHash("sha256").update(domain).digest("hex").slice(0, 8);
+  const rawSlugPart = slug.length > MAX_SLUG_WITH_HASH ? slug.slice(0, MAX_SLUG_WITH_HASH) : slug;
+  const slugPart = rawSlugPart.replace(/-+$/, "");
+  return `${PREFIX}${slugPart}-${hash}`;
+}
+var PREFIX, MAX_LENGTH, MAX_SLUG, MAX_SLUG_WITH_HASH;
+var init_config_set_slug = __esm({
+  "src/utils/email/config-set-slug.ts"() {
+    "use strict";
+    init_esm_shims();
+    PREFIX = "wraps-email-";
+    MAX_LENGTH = 64;
+    MAX_SLUG = MAX_LENGTH - PREFIX.length;
+    MAX_SLUG_WITH_HASH = MAX_SLUG - 9;
+  }
+});
+
 // src/infrastructure/resources/eventbridge-user-webhook.ts
 var eventbridge_user_webhook_exports = {};
 __export(eventbridge_user_webhook_exports, {
@@ -7929,20 +7960,20 @@ async function createMailManagerArchive(config2) {
   let archiveId;
   let archiveArn;
   try {
-    const listResult = await mailManagerClient.send(new ListArchivesCommand({}));
+    const listResult = await mailManagerClient.send(
+      new ListArchivesCommand({})
+    );
     const existing = listResult.Archives?.find(
       (a) => a.ArchiveState === ArchiveState.ACTIVE && a.ArchiveName !== void 0 && namePattern.test(a.ArchiveName)
     );
     if (existing?.ArchiveId) {
-      console.log(`Using existing Mail Manager archive: ${existing.ArchiveName}`);
       archiveId = existing.ArchiveId;
       const getResult = await mailManagerClient.send(
         new GetArchiveCommand({ ArchiveId: archiveId })
       );
       archiveArn = getResult.ArchiveArn;
     }
-  } catch (error) {
-    console.log("Error checking for existing archive:", error);
+  } catch {
   }
   if (!archiveId) {
     for (let attempt = 1; attempt <= MAX_NAME_ATTEMPTS; attempt++) {
@@ -7966,13 +7997,9 @@ async function createMailManagerArchive(config2) {
             "Failed to create Mail Manager Archive: No ArchiveId returned"
           );
         }
-        console.log(`Created new Mail Manager archive: ${archiveName}`);
         break;
       } catch (error) {
         if (error instanceof Error && error.name === "ConflictException" && attempt < MAX_NAME_ATTEMPTS) {
-          console.log(
-            `Archive '${archiveName}' is unavailable, trying '${baseArchiveName}-${attempt + 1}'...`
-          );
           continue;
         }
         throw error;
@@ -9572,7 +9599,7 @@ Run ${pc27.cyan(`wraps email domains verify --domain ${domain} --wait`)} to keep
                 }
               }
             },
-            ConfigurationSetName: "wraps-email-tracking"
+            ConfigurationSetName: domainToConfigSetName(domain)
           })
         );
         return response.MessageId;
@@ -9684,6 +9711,7 @@ var init_test = __esm({
     "use strict";
     init_esm_shims();
     init_events();
+    init_config_set_slug();
     init_ses_simulator();
     init_verification();
     init_aws();
@@ -17403,6 +17431,7 @@ import pc18 from "picocolors";
 // src/infrastructure/email-stack.ts
 init_esm_shims();
 init_dist();
+init_config_set_slug();
 import * as aws19 from "@pulumi/aws";
 
 // src/infrastructure/resources/alerting.ts
@@ -17963,6 +17992,7 @@ init_lambda();
 
 // src/infrastructure/resources/ses.ts
 init_esm_shims();
+init_config_set_slug();
 import * as aws9 from "@pulumi/aws";
 async function configurationSetExists(configSetName, region) {
   try {
@@ -18014,8 +18044,9 @@ async function emailIdentityExists(emailIdentity, region) {
   }
 }
 async function createSESResources(config2) {
+  const configSetName = config2.domain ? domainToConfigSetName(config2.domain) : "wraps-email-tracking";
   const configSetOptions = {
-    configurationSetName: "wraps-email-tracking",
+    configurationSetName: configSetName,
     deliveryOptions: config2.tlsRequired ? {
       tlsPolicy: "REQUIRE"
       // Require TLS 1.2+ for all emails
@@ -18040,7 +18071,6 @@ async function createSESResources(config2) {
       httpsPolicy: config2.trackingConfig.httpsEnabled ? "REQUIRE" : "OPTIONAL"
     };
   }
-  const configSetName = "wraps-email-tracking";
   const exists = await configurationSetExists(configSetName, config2.region);
   const configSet = exists && !config2.skipResourceImports ? new aws9.sesv2.ConfigurationSet(configSetName, configSetOptions, {
     import: configSetName
@@ -18050,6 +18080,20 @@ async function createSESResources(config2) {
   });
   if (config2.eventTrackingEnabled) {
     const eventDestName = "wraps-email-eventbridge";
+    const opensEnabled = config2.trackingConfig?.opens ?? true;
+    const clicksEnabled = config2.trackingConfig?.clicks ?? true;
+    const matchingEventTypes = [
+      "SEND",
+      "DELIVERY",
+      ...opensEnabled ? ["OPEN"] : [],
+      ...clicksEnabled ? ["CLICK"] : [],
+      "BOUNCE",
+      "COMPLAINT",
+      "REJECT",
+      "RENDERING_FAILURE",
+      "DELIVERY_DELAY",
+      "SUBSCRIPTION"
+    ];
     new aws9.sesv2.ConfigurationSetEventDestination(
       "wraps-email-all-events",
       {
@@ -18057,18 +18101,7 @@ async function createSESResources(config2) {
         eventDestinationName: eventDestName,
         eventDestination: {
           enabled: true,
-          matchingEventTypes: [
-            "SEND",
-            "DELIVERY",
-            "OPEN",
-            "CLICK",
-            "BOUNCE",
-            "COMPLAINT",
-            "REJECT",
-            "RENDERING_FAILURE",
-            "DELIVERY_DELAY",
-            "SUBSCRIPTION"
-          ],
+          matchingEventTypes,
           eventBridgeDestination: {
             // SES requires default bus - cannot use custom bus
             eventBusArn: defaultEventBus.arn
@@ -18078,7 +18111,7 @@ async function createSESResources(config2) {
       {
         // Import existing resource if it already exists in AWS but not in Pulumi state.
         // Skip when skipResourceImports is true (resource already tracked in state).
-        import: config2.importExistingEventDestination && !config2.skipResourceImports ? `wraps-email-tracking|${eventDestName}` : void 0
+        import: config2.importExistingEventDestination && !config2.skipResourceImports ? `${configSetName}|${eventDestName}` : void 0
       }
     );
   }
@@ -18349,7 +18382,7 @@ async function deployEmailStack(config2) {
   let sesResources;
   if (emailConfig.tracking?.enabled || emailConfig.eventTracking?.enabled) {
     const shouldImportEventDest = !config2.skipResourceImports && emailConfig.eventTracking?.enabled && await eventDestinationExists(
-      "wraps-email-tracking",
+      domainToConfigSetName(emailConfig.domain ?? ""),
       "wraps-email-eventbridge",
       config2.region
     );
@@ -18433,7 +18466,7 @@ async function deployEmailStack(config2) {
   let smtpResources;
   if (emailConfig.smtpCredentials?.enabled && sesResources) {
     smtpResources = await createSMTPCredentials({
-      configSetName: "wraps-email-tracking",
+      configSetName: domainToConfigSetName(emailConfig.domain ?? ""),
       region: config2.region
     });
   }
@@ -19222,17 +19255,18 @@ ${pc19.dim("\u2500\u2500\u2500 end Pulumi output \u2500\u2500\u2500")}
     tableName: outputs.tableName
   });
   if (selectedIdentities.length > 0 && emailConfig.tracking?.enabled) {
+    const displayConfigSetName = outputs.configSetName ?? "wraps-email-<your-domain>";
     console.log(`
 ${pc19.bold("Next Steps:")}
 `);
     console.log(
-      `Update your code to use configuration set: ${pc19.cyan("wraps-email-tracking")}`
+      `Update your code to use configuration set: ${pc19.cyan(displayConfigSetName)}`
     );
     console.log(`
 ${pc19.dim("Example:")}`);
     console.log(
       pc19.gray(`  await ses.sendEmail({
-    ConfigurationSetName: 'wraps-email-tracking',
+    ConfigurationSetName: '${displayConfigSetName}',
     // ... other parameters
   });`)
     );
@@ -19550,6 +19584,42 @@ async function emailDestroy(options) {
       "Some resources may not have been fully removed. You can re-run this command or clean up manually in the AWS console."
     );
   }
+  if (destroyFailed) {
+    try {
+      const { SQSClient, GetQueueUrlCommand, DeleteQueueCommand } = await import("@aws-sdk/client-sqs");
+      const sqsClient = new SQSClient({ region });
+      for (const queueName of [
+        "wraps-email-events",
+        "wraps-email-events-dlq"
+      ]) {
+        try {
+          const { QueueUrl } = await sqsClient.send(
+            new GetQueueUrlCommand({ QueueName: queueName })
+          );
+          if (QueueUrl) {
+            await sqsClient.send(new DeleteQueueCommand({ QueueUrl }));
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  try {
+    const { SESv2Client: SESv2Client9, DeleteConfigurationSetCommand: DeleteConfigSet } = await import("@aws-sdk/client-sesv2");
+    const sesv22 = new SESv2Client9({ region });
+    const additionalDomains = emailConfig?.additionalDomains ?? [];
+    for (const d of additionalDomains) {
+      if (!d.configSetName) continue;
+      try {
+        await sesv22.send(
+          new DeleteConfigSet({ ConfigurationSetName: d.configSetName })
+        );
+      } catch {
+      }
+    }
+  } catch {
+  }
   await deleteConnectionMetadata(identity.accountId, region);
   progress.stop();
   if (isJsonMode()) {
@@ -19917,6 +19987,7 @@ init_esm_shims();
 init_client();
 init_events();
 init_dns();
+init_config_set_slug();
 init_aws();
 init_errors();
 init_json_output();
@@ -19924,7 +19995,12 @@ init_metadata();
 init_output();
 init_prompts();
 import { Resolver as Resolver2 } from "dns/promises";
-import { GetEmailIdentityCommand as GetEmailIdentityCommand2, SESv2Client as SESv2Client4 } from "@aws-sdk/client-sesv2";
+import {
+  CreateConfigurationSetCommand,
+  CreateConfigurationSetEventDestinationCommand,
+  GetEmailIdentityCommand as GetEmailIdentityCommand2,
+  SESv2Client as SESv2Client4
+} from "@aws-sdk/client-sesv2";
 import * as clack21 from "@clack/prompts";
 import pc23 from "picocolors";
 async function checkVerification(domain, sesClient, region) {
@@ -20382,13 +20458,59 @@ Run ${pc23.cyan("wraps email init")} first to deploy email infrastructure.
     if (!options.yes) {
       purpose = await promptDomainPurpose();
     }
+    const configSetName = domainToConfigSetName(domain);
+    const trackingConfig = {
+      opens: purpose === "marketing" || purpose === "notifications",
+      clicks: purpose === "marketing" || purpose === "notifications"
+    };
+    const baseEventTypes = [
+      "SEND",
+      "DELIVERY",
+      "BOUNCE",
+      "COMPLAINT",
+      "REJECT",
+      "RENDERING_FAILURE",
+      "DELIVERY_DELAY",
+      "SUBSCRIPTION"
+    ];
+    const matchingEventTypes = trackingConfig.opens ? [...baseEventTypes, "OPEN", "CLICK"] : [...baseEventTypes];
+    const eventBusArn = `arn:aws:events:${region}:${identity.accountId}:event-bus/default`;
+    await progress.execute("Creating tracking configuration", async () => {
+      try {
+        await sesClient.send(
+          new CreateConfigurationSetCommand({
+            ConfigurationSetName: configSetName,
+            SuppressionOptions: { SuppressedReasons: ["BOUNCE", "COMPLAINT"] }
+          })
+        );
+      } catch (err) {
+        if (err.name !== "AlreadyExistsException")
+          throw err;
+      }
+      try {
+        await sesClient.send(
+          new CreateConfigurationSetEventDestinationCommand({
+            ConfigurationSetName: configSetName,
+            EventDestinationName: "wraps-email-eventbridge",
+            EventDestination: {
+              Enabled: true,
+              MatchingEventTypes: matchingEventTypes,
+              EventBridgeDestination: { EventBusArn: eventBusArn }
+            }
+          })
+        );
+      } catch (err) {
+        if (err.name !== "AlreadyExistsException")
+          throw err;
+      }
+    });
     if (domainAlreadyExists) {
       const { PutEmailIdentityConfigurationSetAttributesCommand } = await import("@aws-sdk/client-sesv2");
       await progress.execute("Associating tracking configuration", async () => {
         await sesClient.send(
           new PutEmailIdentityConfigurationSetAttributesCommand({
             EmailIdentity: domain,
-            ConfigurationSetName: "wraps-email-tracking"
+            ConfigurationSetName: configSetName
           })
         );
       });
@@ -20398,7 +20520,7 @@ Run ${pc23.cyan("wraps email init")} first to deploy email infrastructure.
         await sesClient.send(
           new CreateEmailIdentityCommand({
             EmailIdentity: domain,
-            ConfigurationSetName: "wraps-email-tracking",
+            ConfigurationSetName: configSetName,
             DkimSigningAttributes: {
               NextSigningKeyLength: "RSA_2048_BIT"
             }
@@ -20511,6 +20633,8 @@ Run ${pc23.cyan("wraps email init")} first to deploy email infrastructure.
       domain,
       mailFromDomain,
       purpose,
+      configSetName,
+      trackingConfig,
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     addDomainToMetadata(metadata, entry);
@@ -21424,7 +21548,7 @@ Deploy first: ${pc24.cyan("wraps email inbound init")}
   }
   const emailService = metadata.services.email;
   const inboundConfig = emailService.config.inbound;
-  if (!options.force) {
+  if (!(options.force || options.preview)) {
     clack22.log.warn(
       `This will remove inbound email for ${pc24.cyan(inboundConfig.receivingDomain || "")}`
     );
@@ -21437,17 +21561,6 @@ Deploy first: ${pc24.cyan("wraps email inbound init")}
       process.exit(0);
     }
   }
-  await progress.execute("Removing SES receipt rules", async () => {
-    await deleteReceiptRule(region);
-    await deleteReceiptRuleSet(region);
-  });
-  await progress.execute(
-    "Preparing workspace",
-    async () => ensurePulumiWorkDir({
-      accountId: identity.accountId,
-      region
-    })
-  );
   const pulumiWorkDir = getPulumiWorkDir();
   const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
   const updatedEmailConfig = {
@@ -21458,7 +21571,8 @@ Deploy first: ${pc24.cyan("wraps email inbound init")}
   const stackConfig = buildEmailStackConfig(metadata, region, {
     emailConfig: updatedEmailConfig
   });
-  await progress.execute("Removing inbound infrastructure", async () => {
+  const createStack = async () => {
+    await ensurePulumiWorkDir({ accountId: identity.accountId, region });
     const stack = await pulumi18.automation.LocalWorkspace.createOrSelectStack(
       {
         stackName,
@@ -21473,6 +21587,39 @@ Deploy first: ${pc24.cyan("wraps email inbound init")}
       }
     );
     await stack.setConfig("aws:region", { value: region });
+    return stack;
+  };
+  if (options.preview) {
+    const previewResult = await progress.execute(
+      "Generating infrastructure preview",
+      async () => {
+        const stack = await createStack();
+        return previewWithResourceChanges(stack, { diff: true });
+      }
+    );
+    displayPreview({
+      changeSummary: previewResult.changeSummary,
+      resourceChanges: previewResult.resourceChanges,
+      commandName: "wraps email inbound destroy"
+    });
+    clack22.outro(
+      pc24.green("Preview complete. Run without --preview to destroy.")
+    );
+    return;
+  }
+  await progress.execute("Removing SES receipt rules", async () => {
+    await deleteReceiptRule(region);
+    await deleteReceiptRuleSet(region);
+  });
+  await progress.execute(
+    "Preparing workspace",
+    async () => ensurePulumiWorkDir({
+      accountId: identity.accountId,
+      region
+    })
+  );
+  await progress.execute("Removing inbound infrastructure", async () => {
+    const stack = await createStack();
     await withLockRetry(
       () => withTimeout(
         stack.up({ onOutput: () => {
@@ -22502,6 +22649,44 @@ async function init2(options) {
       emailConfig.mailFromSubdomain = mailFromFull.endsWith(suffix) ? mailFromFull.slice(0, -suffix.length) || "mail" : "mail";
     }
   }
+  if (!options.quick && preset !== "custom" && emailConfig.tracking?.enabled) {
+    const purpose = await promptDomainPurpose();
+    if (purpose === "transactional") {
+      emailConfig.tracking = {
+        ...emailConfig.tracking,
+        opens: false,
+        clicks: false
+      };
+    } else if (purpose === "marketing" || purpose === "notifications") {
+      emailConfig.tracking = {
+        ...emailConfig.tracking,
+        opens: true,
+        clicks: true
+      };
+    } else {
+      const trackOpens = await clack26.confirm({
+        message: "Track email opens?",
+        initialValue: emailConfig.tracking.opens ?? true
+      });
+      if (clack26.isCancel(trackOpens)) {
+        clack26.cancel("Operation cancelled.");
+        process.exit(0);
+      }
+      const trackClicks = await clack26.confirm({
+        message: "Track link clicks?",
+        initialValue: emailConfig.tracking.clicks ?? true
+      });
+      if (clack26.isCancel(trackClicks)) {
+        clack26.cancel("Operation cancelled.");
+        process.exit(0);
+      }
+      emailConfig.tracking = {
+        ...emailConfig.tracking,
+        opens: trackOpens,
+        clicks: trackClicks
+      };
+    }
+  }
   let costSummary;
   if (!options.quick) {
     const estimatedVolume = await promptEstimatedVolume();
@@ -23372,6 +23557,59 @@ async function replyInit(options) {
     );
   }
   const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
+  if (options.preview) {
+    const previewResult = await progress.execute(
+      "Generating infrastructure preview",
+      async () => {
+        const previewMetadata = JSON.parse(
+          JSON.stringify(metadata)
+        );
+        const previewEmailConfig = previewMetadata.services.email.config;
+        const rt = previewEmailConfig.replyThreading ?? {
+          enabled: false,
+          domains: []
+        };
+        for (const domain of targetDomains) {
+          const filtered = rt.domains.filter((d) => d.domain !== domain);
+          filtered.push({
+            domain,
+            initialSecret: randomBytes5(32).toString("base64"),
+            currentKid: 1,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          rt.domains = filtered;
+        }
+        previewEmailConfig.replyThreading = {
+          enabled: true,
+          domains: rt.domains
+        };
+        const stackConfig = buildEmailStackConfig(previewMetadata, region);
+        await ensurePulumiWorkDir({ accountId: identity.accountId, region });
+        const stack = await pulumi20.automation.LocalWorkspace.createOrSelectStack(
+          {
+            stackName,
+            projectName: "wraps-email",
+            program: async () => {
+              const result = await deployEmailStack(stackConfig);
+              return result;
+            }
+          },
+          {
+            workDir: getPulumiWorkDir()
+          }
+        );
+        await stack.setConfig("aws:region", { value: region });
+        return previewWithResourceChanges(stack, { diff: true });
+      }
+    );
+    displayPreview({
+      changeSummary: previewResult.changeSummary,
+      resourceChanges: previewResult.resourceChanges,
+      commandName: "wraps email reply init"
+    });
+    clack27.outro(pc29.green("Preview complete. Run without --preview to deploy."));
+    return;
+  }
   const results = [];
   for (const domain of targetDomains) {
     const fresh = await loadConnectionMetadata(identity.accountId, region);
@@ -23713,7 +23951,7 @@ async function replyDestroy(options) {
       "https://wraps.dev/docs/guides/reply-threading"
     );
   }
-  if (!(options.force || isJsonMode())) {
+  if (!(options.force || options.preview || isJsonMode())) {
     const confirmed = await clack27.confirm({
       message: `Remove reply threading for ${targets.join(", ")}?`,
       initialValue: false
@@ -23723,10 +23961,55 @@ async function replyDestroy(options) {
       return;
     }
   }
+  const emailService = metadata.services.email;
+  if (options.preview) {
+    if (emailService) {
+      const previewMetadata = JSON.parse(
+        JSON.stringify(metadata)
+      );
+      for (const domain of targets) {
+        stripDomainFromReplyThreadingMetadata({
+          domain,
+          metadata: previewMetadata
+        });
+      }
+      const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
+      const stackConfig = buildEmailStackConfig(previewMetadata, region);
+      const previewResult = await progress.execute(
+        "Generating infrastructure preview",
+        async () => {
+          await ensurePulumiWorkDir({ accountId: identity.accountId, region });
+          const stack = await pulumi20.automation.LocalWorkspace.createOrSelectStack(
+            {
+              stackName,
+              projectName: "wraps-email",
+              program: async () => {
+                const result = await deployEmailStack(stackConfig);
+                return result;
+              }
+            },
+            {
+              workDir: getPulumiWorkDir()
+            }
+          );
+          await stack.setConfig("aws:region", { value: region });
+          return previewWithResourceChanges(stack, { diff: true });
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        resourceChanges: previewResult.resourceChanges,
+        commandName: "wraps email reply destroy"
+      });
+    }
+    clack27.outro(
+      pc29.green("Preview complete. Run without --preview to destroy.")
+    );
+    return;
+  }
   for (const domain of targets) {
     stripDomainFromReplyThreadingMetadata({ domain, metadata });
   }
-  const emailService = metadata.services.email;
   if (emailService) {
     const stackName = emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`;
     const stackConfig = buildEmailStackConfig(metadata, region);
@@ -23819,6 +24102,7 @@ async function replyDecode(addressInput, options) {
 // src/commands/email/restore.ts
 init_esm_shims();
 init_events();
+init_config_set_slug();
 init_aws();
 init_errors();
 init_fs();
@@ -23882,7 +24166,10 @@ ${pc30.bold("The following Wraps resources will be removed:")}
 `
   );
   if (metadata.services.email?.config.tracking?.enabled) {
-    console.log(`  ${pc30.cyan("\u2713")} Configuration Set (wraps-email-tracking)`);
+    const configSetName = domainToConfigSetName(
+      metadata.services.email.config.domain ?? ""
+    );
+    console.log(`  ${pc30.cyan("\u2713")} Configuration Set (${configSetName})`);
   }
   if (metadata.services.email?.config.eventTracking?.dynamoDBHistory) {
     console.log(`  ${pc30.cyan("\u2713")} DynamoDB Table (wraps-email-history)`);
@@ -25440,7 +25727,7 @@ function renderErrorPage(err) {
 // src/commands/email/templates/push.ts
 init_esm_shims();
 init_events();
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync13 } from "fs";
 import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile8 } from "fs/promises";
 import { join as join15 } from "path";
@@ -26077,7 +26364,7 @@ async function pushToAPI(templates, token, progress, force) {
   return results;
 }
 function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
+  return createHash2("sha256").update(content).digest("hex");
 }
 
 // src/cli.ts
@@ -26301,6 +26588,11 @@ ${pc35.bold("Current Configuration:")}
       value: "hosting-provider",
       label: "Change hosting provider",
       hint: metadata.provider === "vercel" ? `Currently: Vercel (${metadata.vercel?.teamSlug || "configured"})` : `Currently: ${metadata.provider} \u2192 Switch to Vercel OIDC, etc.`
+    },
+    {
+      value: "per-domain-config-sets",
+      label: "Per-domain configuration sets",
+      hint: "Create dedicated SES config sets for each additional domain"
     }
   );
   if (options.action) {
@@ -27433,6 +27725,141 @@ ${pc35.bold("SMTP Credentials for Legacy Systems")}
       }
       break;
     }
+    case "per-domain-config-sets": {
+      const {
+        SESv2Client: SESv2Client9,
+        CreateConfigurationSetCommand: CreateConfigurationSetCommand2,
+        CreateConfigurationSetEventDestinationCommand: CreateConfigurationSetEventDestinationCommand2,
+        PutEmailIdentityConfigurationSetAttributesCommand,
+        EventType
+      } = await import("@aws-sdk/client-sesv2");
+      const { domainToConfigSetName: domainToConfigSetName2 } = await Promise.resolve().then(() => (init_config_set_slug(), config_set_slug_exports));
+      const sesClient = new SESv2Client9({ region });
+      const accountId = identity.accountId;
+      const additionalDomains = metadata.services.email?.config.additionalDomains ?? [];
+      const unmigratedDomains = additionalDomains.filter(
+        (d) => !d.configSetName
+      );
+      if (unmigratedDomains.length === 0) {
+        clack34.log.info(
+          "All additional domains are already migrated to per-domain config sets."
+        );
+        clack34.outro(pc35.green("\u2713 Nothing to migrate"));
+        trackServiceUpgrade("email", {
+          action: "per-domain-config-sets",
+          duration_ms: Date.now() - startTime
+        });
+        return;
+      }
+      clack34.log.info(
+        `Migrating ${unmigratedDomains.length} domain(s) to per-domain configuration sets...`
+      );
+      const eventBusArn = `arn:aws:events:${region}:${accountId}:event-bus/default`;
+      for (let i = 0; i < unmigratedDomains.length; i++) {
+        const d = unmigratedDomains[i];
+        const configSetName = domainToConfigSetName2(d.domain);
+        clack34.log.step(
+          `Migrating ${pc35.cyan(d.domain)} \u2192 ${pc35.dim(configSetName)}`
+        );
+        await progress.execute(
+          `Creating config set for ${d.domain}`,
+          async () => {
+            try {
+              await sesClient.send(
+                new CreateConfigurationSetCommand2({
+                  ConfigurationSetName: configSetName,
+                  SuppressionOptions: {
+                    SuppressedReasons: ["BOUNCE", "COMPLAINT"]
+                  }
+                })
+              );
+            } catch (err) {
+              if (err.name !== "AlreadyExistsException")
+                throw err;
+            }
+          }
+        );
+        const allEvents = [
+          EventType.SEND,
+          EventType.DELIVERY,
+          EventType.OPEN,
+          EventType.CLICK,
+          EventType.BOUNCE,
+          EventType.COMPLAINT,
+          EventType.REJECT,
+          EventType.RENDERING_FAILURE,
+          EventType.DELIVERY_DELAY,
+          EventType.SUBSCRIPTION
+        ];
+        const matchingEventTypes = d.trackingConfig != null ? allEvents.filter((evt) => {
+          if (evt === EventType.OPEN) return d.trackingConfig.opens;
+          if (evt === EventType.CLICK) return d.trackingConfig.clicks;
+          return true;
+        }) : [...allEvents];
+        await progress.execute(
+          `Adding EventBridge destination for ${d.domain}`,
+          async () => {
+            try {
+              await sesClient.send(
+                new CreateConfigurationSetEventDestinationCommand2({
+                  ConfigurationSetName: configSetName,
+                  EventDestinationName: "wraps-email-eventbridge",
+                  EventDestination: {
+                    Enabled: true,
+                    MatchingEventTypes: matchingEventTypes,
+                    EventBridgeDestination: { EventBusArn: eventBusArn }
+                  }
+                })
+              );
+            } catch (err) {
+              if (err.name !== "AlreadyExistsException")
+                throw err;
+            }
+          }
+        );
+        d.configSetName = configSetName;
+        await saveConnectionMetadata(metadata);
+        try {
+          await progress.execute(
+            `Reassigning identity ${d.domain}`,
+            async () => {
+              await sesClient.send(
+                new PutEmailIdentityConfigurationSetAttributesCommand({
+                  EmailIdentity: d.domain,
+                  ConfigurationSetName: configSetName
+                })
+              );
+            }
+          );
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          clack34.log.warn(
+            `Failed to reassign identity for ${pc35.cyan(d.domain)}: ${msg}`
+          );
+          clack34.log.info(
+            pc35.dim(
+              `Config set was saved \u2014 re-run to retry identity reassignment for ${d.domain}`
+            )
+          );
+        }
+        if (i < unmigratedDomains.length - 1) {
+          await new Promise((resolve) => setTimeout(resolve, 1e3));
+        }
+      }
+      clack34.log.info(
+        `For the primary domain (${pc35.cyan(config2.domain ?? "")}) config set rename: re-run ${pc35.cyan("wraps email upgrade")} with a Pulumi stack update.`
+      );
+      clack34.outro(
+        pc35.green(
+          `\u2713 Per-domain config sets migration complete (${unmigratedDomains.length} domain(s))`
+        )
+      );
+      trackServiceUpgrade("email", {
+        action: "per-domain-config-sets",
+        duration_ms: Date.now() - startTime
+      });
+      return;
+    }
   }
   const newCostData = calculateCosts(updatedConfig, 5e4);
   const costDiff = newCostData.total.monthly - currentCostData.total.monthly;
@@ -28813,7 +29240,7 @@ function assignPositions(steps, transitions) {
 
 // src/utils/email/workflow-ts.ts
 init_esm_shims();
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync15 } from "fs";
 import { mkdir as mkdir8, readdir as readdir4, readFile as readFile8, writeFile as writeFile10 } from "fs/promises";
 import { basename, join as join17 } from "path";
@@ -28839,7 +29266,7 @@ async function discoverWorkflows(dir, filter) {
 async function parseWorkflowTs(filePath, wrapsDir) {
   const { build: build2 } = await import("esbuild");
   const source = await readFile8(filePath, "utf-8");
-  const sourceHash = createHash2("sha256").update(source).digest("hex");
+  const sourceHash = createHash3("sha256").update(source).digest("hex");
   const slug = basename(filePath, ".ts");
   const shimDir = join17(wrapsDir, ".wraps", "_shims");
   await mkdir8(shimDir, { recursive: true });
@@ -30494,7 +30921,7 @@ import {
   IAMClient as IAMClient3,
   PutRolePolicyCommand
 } from "@aws-sdk/client-iam";
-import { confirm as confirm18, intro as intro34, isCancel as isCancel25, log as log36, outro as outro20, select as select17 } from "@clack/prompts";
+import { confirm as confirm18, intro as intro34, isCancel as isCancel25, log as log36, outro as outro22, select as select17 } from "@clack/prompts";
 import * as pulumi24 from "@pulumi/pulumi";
 import pc41 from "picocolors";
 init_events();
@@ -30856,7 +31283,7 @@ async function resolveOrganization() {
     }))
   });
   if (isCancel25(selected)) {
-    outro20("Operation cancelled");
+    outro22("Operation cancelled");
     process.exit(0);
   }
   return orgs.find((o) => o.id === selected) || null;
@@ -30922,7 +31349,7 @@ async function authenticatedConnect(token, options) {
           initialValue: true
         });
         if (isCancel25(enableTracking) || !enableTracking) {
-          outro20("Platform connection cancelled.");
+          outro22("Platform connection cancelled.");
           process.exit(0);
         }
         metadata.services.email.config = {
@@ -31013,7 +31440,7 @@ You can try the manual flow: ${pc41.cyan("wraps auth logout")} then ${pc41.cyan(
         webhookConnected: true
       });
     } else {
-      outro20(pc41.green("Platform connection complete!"));
+      outro22(pc41.green("Platform connection complete!"));
       console.log();
       console.log(
         pc41.dim(
@@ -31117,7 +31544,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
           initialValue: true
         });
         if (isCancel25(enableEventTracking) || !enableEventTracking) {
-          outro20("Platform connection cancelled.");
+          outro22("Platform connection cancelled.");
           process.exit(0);
         }
         metadata.services.email.config = {
@@ -31165,7 +31592,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
           ]
         });
         if (isCancel25(action)) {
-          outro20("Operation cancelled");
+          outro22("Operation cancelled");
           process.exit(0);
         }
         if (action === "keep") {
@@ -31176,7 +31603,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
             initialValue: false
           });
           if (isCancel25(confirmDisconnect) || !confirmDisconnect) {
-            outro20("Disconnect cancelled");
+            outro22("Disconnect cancelled");
             process.exit(0);
           }
           metadata.services.email.webhookSecret = void 0;
@@ -31274,7 +31701,7 @@ Run ${pc41.cyan("wraps email init")} or ${pc41.cyan("wraps sms init")} first.
     }
     await saveConnectionMetadata(metadata);
     progress.stop();
-    outro20(pc41.green("Platform connection complete!"));
+    outro22(pc41.green("Platform connection complete!"));
     if (webhookSecret && needsDeployment) {
       console.log(`
 ${pc41.bold("Webhook Secret")} ${pc41.dim("(save this!)")}`);
@@ -31387,7 +31814,7 @@ import {
   GetRoleCommand as GetRoleCommand2,
   IAMClient as IAMClient4
 } from "@aws-sdk/client-iam";
-import { confirm as confirm19, intro as intro36, isCancel as isCancel26, log as log37, outro as outro21 } from "@clack/prompts";
+import { confirm as confirm19, intro as intro36, isCancel as isCancel26, log as log37, outro as outro23 } from "@clack/prompts";
 import pc43 from "picocolors";
 async function updateRole(options) {
   const startTime = Date.now();
@@ -31457,7 +31884,7 @@ Run ${pc43.cyan("wraps email init")} to deploy infrastructure first.
       initialValue: true
     });
     if (isCancel26(shouldContinue) || !shouldContinue) {
-      outro21(`${actionLabel} cancelled`);
+      outro23(`${actionLabel} cancelled`);
       process.exit(0);
     }
   }
@@ -31537,7 +31964,7 @@ Run ${pc43.cyan("wraps email init")} to deploy infrastructure first.
     });
     return;
   }
-  outro21(pc43.green(`\u2713 Platform access role ${actionVerb} successfully`));
+  outro23(pc43.green(`\u2713 Platform access role ${actionVerb} successfully`));
   console.log(`
 ${pc43.bold("Permissions:")}`);
   console.log(`
@@ -33096,6 +33523,7 @@ function createMetricsRouter(config2) {
 
 // src/console/routes/settings.ts
 init_esm_shims();
+init_config_set_slug();
 init_metadata();
 import dns4 from "dns/promises";
 import { Router as createRouter6 } from "express";
@@ -33232,8 +33660,8 @@ function createSettingsRouter(config2) {
           error: "No Wraps infrastructure found for this account and region"
         });
       }
-      const configSetName = "wraps-email-tracking";
       const domain = metadata.services.email?.config.domain;
+      const configSetName = domainToConfigSetName(domain ?? "");
       const settings = await fetchEmailSettings(
         config2.roleArn,
         config2.region,
@@ -33335,7 +33763,9 @@ function createSettingsRouter(config2) {
           error: "No Wraps infrastructure found for this account and region"
         });
       }
-      const configSetName = "wraps-email-tracking";
+      const configSetName = domainToConfigSetName(
+        metadata.services.email?.config.domain ?? ""
+      );
       console.log(
         `[Settings] Updating sending options for ${configSetName}: ${enabled}`
       );
@@ -33372,7 +33802,9 @@ function createSettingsRouter(config2) {
           error: "No Wraps infrastructure found for this account and region"
         });
       }
-      const configSetName = "wraps-email-tracking";
+      const configSetName = domainToConfigSetName(
+        metadata.services.email?.config.domain ?? ""
+      );
       console.log(
         `[Settings] Updating reputation options for ${configSetName}: ${enabled}`
       );
@@ -33415,7 +33847,9 @@ function createSettingsRouter(config2) {
             error: "No Wraps infrastructure found for this account and region"
           });
         }
-        const configSetName = "wraps-email-tracking";
+        const configSetName = domainToConfigSetName(
+          metadata.services.email?.config.domain ?? ""
+        );
         console.log(
           `[Settings] Updating tracking domain for ${configSetName}: ${domain}`
         );
@@ -36464,7 +36898,7 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
       clack45.log.warn(warning);
     }
   }
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await confirmDeploy();
     if (!confirmed) {
       clack45.cancel("Deployment cancelled.");
@@ -36477,43 +36911,77 @@ ${pc48.yellow(pc48.bold("Important Notes:"))}`);
     vercel: vercelConfig,
     smsConfig
   };
+  const createStack = async () => {
+    await ensurePulumiWorkDir({ accountId: identity.accountId, region });
+    const stack = await pulumi29.automation.LocalWorkspace.createOrSelectStack(
+      {
+        stackName: `wraps-sms-${identity.accountId}-${region}`,
+        projectName: "wraps-sms",
+        program: async () => {
+          const result = await deploySMSStack(stackConfig);
+          return {
+            roleArn: result.roleArn,
+            phoneNumber: result.phoneNumber,
+            phoneNumberArn: result.phoneNumberArn,
+            configSetName: result.configSetName,
+            tableName: result.tableName,
+            region: result.region,
+            lambdaFunctions: result.lambdaFunctions,
+            snsTopicArn: result.snsTopicArn,
+            queueUrl: result.queueUrl,
+            dlqUrl: result.dlqUrl,
+            optOutListArn: result.optOutListArn
+          };
+        }
+      },
+      {
+        workDir: getPulumiWorkDir(),
+        envVars: {
+          PULUMI_CONFIG_PASSPHRASE: "",
+          AWS_REGION: region
+        },
+        secretsProvider: "passphrase"
+      }
+    );
+    await stack.setConfig("aws:region", { value: region });
+    return stack;
+  };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating infrastructure preview",
+        async () => {
+          const stack = await createStack();
+          return previewWithResourceChanges(stack, { diff: true });
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        resourceChanges: previewResult.resourceChanges,
+        costEstimate: getSMSCostSummary(smsConfig, 0),
+        commandName: "wraps sms init"
+      });
+      clack45.outro(
+        pc48.green("Preview complete. Run without --preview to deploy.")
+      );
+      trackServiceInit("sms", true, {
+        provider,
+        region,
+        preview: true,
+        duration_ms: Date.now() - startTime
+      });
+    } catch (error) {
+      trackError("PREVIEW_FAILED", "sms:init", { step: "preview" });
+      throw error;
+    }
+    return;
+  }
   let outputs;
   try {
     outputs = await progress.execute(
       "Deploying SMS infrastructure (this may take 2-3 minutes)",
       async () => {
-        await ensurePulumiWorkDir({ accountId: identity.accountId, region });
-        const stack = await pulumi29.automation.LocalWorkspace.createOrSelectStack(
-          {
-            stackName: `wraps-sms-${identity.accountId}-${region}`,
-            projectName: "wraps-sms",
-            program: async () => {
-              const result = await deploySMSStack(stackConfig);
-              return {
-                roleArn: result.roleArn,
-                phoneNumber: result.phoneNumber,
-                phoneNumberArn: result.phoneNumberArn,
-                configSetName: result.configSetName,
-                tableName: result.tableName,
-                region: result.region,
-                lambdaFunctions: result.lambdaFunctions,
-                snsTopicArn: result.snsTopicArn,
-                queueUrl: result.queueUrl,
-                dlqUrl: result.dlqUrl,
-                optOutListArn: result.optOutListArn
-              };
-            }
-          },
-          {
-            workDir: getPulumiWorkDir(),
-            envVars: {
-              PULUMI_CONFIG_PASSPHRASE: "",
-              AWS_REGION: region
-            },
-            secretsProvider: "passphrase"
-          }
-        );
-        await stack.setConfig("aws:region", { value: region });
+        const stack = await createStack();
         const upResult = await withLockRetry(
           () => stack.up({ onOutput: console.log }),
           { accountId: identity.accountId, region, autoConfirm: options.yes }
@@ -38180,7 +38648,7 @@ ${pc53.bold("Cost Impact:")}`);
     );
   }
   console.log("");
-  if (!options.yes) {
+  if (!(options.yes || options.preview)) {
     const confirmed = await clack50.confirm({
       message: "Proceed with upgrade?",
       initialValue: true
@@ -38202,46 +38670,79 @@ ${pc53.bold("Cost Impact:")}`);
     vercel: vercelConfig,
     smsConfig: updatedConfig
   };
+  const stackName = metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`;
+  const createStack = async () => {
+    await ensurePulumiWorkDir({ accountId: identity.accountId, region });
+    const stack = await pulumi32.automation.LocalWorkspace.createOrSelectStack(
+      {
+        stackName,
+        projectName: "wraps-sms",
+        program: async () => {
+          const result = await deploySMSStack(stackConfig);
+          return {
+            roleArn: result.roleArn,
+            phoneNumber: result.phoneNumber,
+            phoneNumberArn: result.phoneNumberArn,
+            configSetName: result.configSetName,
+            tableName: result.tableName,
+            region: result.region,
+            lambdaFunctions: result.lambdaFunctions,
+            snsTopicArn: result.snsTopicArn,
+            queueUrl: result.queueUrl,
+            dlqUrl: result.dlqUrl,
+            optOutListArn: result.optOutListArn
+          };
+        }
+      },
+      {
+        workDir: getPulumiWorkDir(),
+        envVars: {
+          PULUMI_CONFIG_PASSPHRASE: "",
+          AWS_REGION: region
+        },
+        secretsProvider: "passphrase"
+      }
+    );
+    await stack.workspace.selectStack(stackName);
+    await stack.setConfig("aws:region", { value: region });
+    return stack;
+  };
+  if (options.preview) {
+    try {
+      const previewResult = await progress.execute(
+        "Generating infrastructure preview",
+        async () => {
+          const stack = await createStack();
+          await stack.refresh({ onOutput: () => {
+          } });
+          return previewWithResourceChanges(stack, { diff: true });
+        }
+      );
+      displayPreview({
+        changeSummary: previewResult.changeSummary,
+        resourceChanges: previewResult.resourceChanges,
+        commandName: "wraps sms upgrade"
+      });
+      clack50.outro(
+        pc53.green("Preview complete. Run without --preview to upgrade.")
+      );
+      trackServiceUpgrade("sms", {
+        region,
+        preview: true,
+        duration_ms: Date.now() - startTime
+      });
+    } catch (error) {
+      trackError("PREVIEW_FAILED", "sms:upgrade", { step: "preview" });
+      throw error;
+    }
+    return;
+  }
   let outputs;
   try {
     outputs = await progress.execute(
       "Updating SMS infrastructure (this may take 2-3 minutes)",
       async () => {
-        await ensurePulumiWorkDir({ accountId: identity.accountId, region });
-        const stack = await pulumi32.automation.LocalWorkspace.createOrSelectStack(
-          {
-            stackName: metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`,
-            projectName: "wraps-sms",
-            program: async () => {
-              const result = await deploySMSStack(stackConfig);
-              return {
-                roleArn: result.roleArn,
-                phoneNumber: result.phoneNumber,
-                phoneNumberArn: result.phoneNumberArn,
-                configSetName: result.configSetName,
-                tableName: result.tableName,
-                region: result.region,
-                lambdaFunctions: result.lambdaFunctions,
-                snsTopicArn: result.snsTopicArn,
-                queueUrl: result.queueUrl,
-                dlqUrl: result.dlqUrl,
-                optOutListArn: result.optOutListArn
-              };
-            }
-          },
-          {
-            workDir: getPulumiWorkDir(),
-            envVars: {
-              PULUMI_CONFIG_PASSPHRASE: "",
-              AWS_REGION: region
-            },
-            secretsProvider: "passphrase"
-          }
-        );
-        await stack.workspace.selectStack(
-          metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`
-        );
-        await stack.setConfig("aws:region", { value: region });
+        const stack = await createStack();
         await stack.refresh({ onOutput: () => {
         } });
         const upResult = await stack.up({ onOutput: () => {
@@ -39567,7 +40068,8 @@ if (!primaryCommand) {
             provider: flags.provider,
             region: flags.region,
             preset: flags.preset,
-            yes: flags.yes
+            yes: flags.yes,
+            preview: flags.preview
           });
           break;
         case "cdn-init":
@@ -39752,6 +40254,7 @@ Usage: ${pc59.cyan("wraps email verify --domain yourapp.com")}
               await inboundDestroy({
                 region: flags.region,
                 force: flags.force,
+                preview: flags.preview,
                 json: flags.json
               });
               break;
@@ -39816,6 +40319,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("destroy")}, ${pc59.cyan("
                 domain: flags.domain,
                 all: flags.all,
                 yes: flags.yes,
+                preview: flags.preview,
                 json: flags.json
               });
               break;
@@ -39839,6 +40343,7 @@ Available commands: ${pc59.cyan("init")}, ${pc59.cyan("destroy")}, ${pc59.cyan("
                 domain: flags.domain,
                 all: flags.all,
                 force: flags.force,
+                preview: flags.preview,
                 json: flags.json
               });
               break;
@@ -40065,6 +40570,7 @@ Run ${pc59.cyan("wraps --help")} for available commands.
             region: flags.region,
             preset: flags.preset,
             yes: flags.yes,
+            preview: flags.preview,
             json: flags.json
           });
           break;
@@ -40087,6 +40593,7 @@ Run ${pc59.cyan("wraps --help")} for available commands.
           await smsUpgrade({
             region: flags.region,
             yes: flags.yes,
+            preview: flags.preview,
             json: flags.json
           });
           break;