@wraps.dev/cli 2.26.0 → 2.27.0

package/dist/cli.js

@@ -2679,10 +2679,9 @@ var init_costs = __esm({
       // $0.20 per million API Destination invocations
     };
     FREE_TIER = {
-      // SES: 3,000 emails/month for first 12 months (new AWS accounts only)
-      // After 12 months or for existing accounts: NO free tier
+      // SES: no free sending tier (the 3,000/mo-for-12-months offer was retired
+      // 2026-07-21; new accounts get generic $200 AWS credits instead)
       SES_EMAILS: 0,
-      // Conservative: assume no free tier (most users are past 12 months)
       // Lambda: Permanently free tier
       LAMBDA_REQUESTS: 1e6,
       // 1M requests per month (always free)
@@ -6084,6 +6083,9 @@ async function findConnectionsWithService(accountId, service) {
   const accountConnections = await findConnectionsForAccount(accountId);
   return accountConnections.filter((conn) => hasService(conn, service));
 }
+function normalizeWebhookBaseUrl(webhookUrl) {
+  return webhookUrl.replace(/\/v1\/ses-events\/?$/, "").replace(/\/+$/, "");
+}
 function buildEmailStackConfig(metadata, region, overrides) {
   const emailService = metadata.services.email;
   let webhook;
@@ -6092,7 +6094,10 @@ function buildEmailStackConfig(metadata, region, overrides) {
   } else if (emailService?.webhookSecret) {
     webhook = {
       awsAccountNumber: metadata.accountId,
-      webhookSecret: emailService.webhookSecret
+      webhookSecret: emailService.webhookSecret,
+      ...emailService.webhookUrl && {
+        webhookUrl: normalizeWebhookBaseUrl(emailService.webhookUrl)
+      }
     };
   }
   const emailConfig = overrides?.emailConfig ?? emailService?.config;
@@ -11450,7 +11455,7 @@ async function runFullSetup() {
   console.log(`  ${pc9.cyan("https://aws.amazon.com/free")}`);
   console.log();
   console.log(
-    pc9.dim("  The AWS Free Tier includes 3,000 SES emails/month for 12 months")
+    pc9.dim("  New AWS accounts get $200 in Free Tier credits (6 months)")
   );
   console.log();
   const hasAccount = await clack7.confirm({
@@ -16120,9 +16125,38 @@ async function deployEmailStack(config2) {
   };
 }
 
+// src/utils/shared/agent-api.ts
+init_esm_shims();
+init_config();
+async function createAgentApiClient(tokenFlag) {
+  const token = await resolveTokenAsync({ token: tokenFlag });
+  if (!token) {
+    return { ok: false, reason: "not-authenticated" };
+  }
+  const apiBase = getApiBaseUrl();
+  const orgHeader = {};
+  const orgs = (await readAuthConfig())?.auth?.organizations;
+  if (orgs && orgs.length === 1) {
+    orgHeader["X-Organization-Id"] = orgs[0].id;
+  }
+  const call = (method) => (path3, body) => fetch(`${apiBase}${path3}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      ...body ? { "Content-Type": "application/json" } : {},
+      ...orgHeader
+    },
+    ...body ? { body: JSON.stringify(body) } : {}
+  });
+  return { ok: true, get: call("GET"), post: call("POST") };
+}
+async function parseAgentApiError(resp) {
+  const data = await resp.json().catch(() => ({}));
+  return data.error ?? `HTTP ${resp.status}`;
+}
+
 // src/commands/email/agent.ts
 init_aws();
-init_config();
 init_fs();
 init_json_output();
 init_metadata();
@@ -16169,32 +16203,6 @@ var DEFAULT_AGENT_POLICY = {
   allowedRecipientDomains: []
 };
 var AGENT_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,51}$/;
-async function createAgentApiClient(tokenFlag) {
-  const token = await resolveTokenAsync({ token: tokenFlag });
-  if (!token) {
-    return { ok: false, reason: "not-authenticated" };
-  }
-  const apiBase = getApiBaseUrl();
-  const orgHeader = {};
-  const orgs = (await readAuthConfig())?.auth?.organizations;
-  if (orgs && orgs.length === 1) {
-    orgHeader["X-Organization-Id"] = orgs[0].id;
-  }
-  const call = (method) => (path3, body) => fetch(`${apiBase}${path3}`, {
-    method,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      ...body ? { "Content-Type": "application/json" } : {},
-      ...orgHeader
-    },
-    ...body ? { body: JSON.stringify(body) } : {}
-  });
-  return { ok: true, get: call("GET"), post: call("POST") };
-}
-async function parseError(resp) {
-  const data = await resp.json().catch(() => ({}));
-  return data.error ?? `HTTP ${resp.status}`;
-}
 async function agentCreate(options) {
   if (!isJsonMode()) {
     clack15.intro(pc17.bold("Create Agent Mailbox"));
@@ -16250,7 +16258,7 @@ Sign in first: ${pc17.cyan("wraps auth login")}
     async () => {
       const resp = await api.get("/v1/connections");
       if (!resp.ok) {
-        throw new Error(await parseError(resp));
+        throw new Error(await parseAgentApiError(resp));
       }
       const data = await resp.json();
       return data.connections.some((c) => c.accountId === identity.accountId);
@@ -16396,7 +16404,7 @@ Connect (or reconnect) first so it is stored locally:
         return { kind: "created", agent: await resp.json() };
       }
       if (resp.status !== 409) {
-        throw new Error(await parseError(resp));
+        throw new Error(await parseAgentApiError(resp));
       }
       const listResp = await api.get("/v1/agents");
       const existing = listResp.ok ? (await listResp.json()).agents.find(
@@ -16567,7 +16575,7 @@ ${suggestion}
       awsAccountId: identity.accountId
     });
     if (!resp.ok) {
-      throw new Error(await parseError(resp));
+      throw new Error(await parseAgentApiError(resp));
     }
   });
   if (isJsonMode()) {
@@ -16630,7 +16638,7 @@ async function agentList(options) {
   }
   const resp = await api.get("/v1/agents");
   if (!resp.ok) {
-    const message = await parseError(resp);
+    const message = await parseAgentApiError(resp);
     if (isJsonMode()) {
       jsonError("email.agent.list", { code: "API_ERROR", message });
     } else {
@@ -16670,7 +16678,7 @@ async function agentKill(options) {
   }
   const listResp = await api.get("/v1/agents");
   if (!listResp.ok) {
-    const message = await parseError(listResp);
+    const message = await parseAgentApiError(listResp);
     if (isJsonMode()) {
       jsonError("email.agent.kill", { code: "API_ERROR", message });
     } else {
@@ -16729,7 +16737,7 @@ async function agentKill(options) {
   }
   const resp = await api.post(`/v1/agents/${target.id}/kill`);
   if (!resp.ok) {
-    const message = await parseError(resp);
+    const message = await parseAgentApiError(resp);
     if (isJsonMode()) {
       jsonError("email.agent.kill", { code: "API_ERROR", message });
     } else {
@@ -20535,6 +20543,9 @@ ${pc20.dim("Example:")}`);
 init_esm_shims();
 init_events();
 init_route53();
+import * as clack19 from "@clack/prompts";
+import * as pulumi18 from "@pulumi/pulumi";
+import pc21 from "picocolors";
 init_aws();
 init_errors();
 init_fs();
@@ -20542,9 +20553,6 @@ init_json_output();
 init_metadata();
 init_output();
 init_pulumi();
-import * as clack19 from "@clack/prompts";
-import * as pulumi18 from "@pulumi/pulumi";
-import pc21 from "picocolors";
 async function getEmailIdentityInfo(domain, region) {
   try {
     const { SESv2Client: SESv2Client10, GetEmailIdentityCommand: GetEmailIdentityCommand7 } = await import("@aws-sdk/client-sesv2");
@@ -20563,6 +20571,30 @@ async function getEmailIdentityInfo(domain, region) {
     throw error;
   }
 }
+function selectAgentsToDestroy(emailConfig) {
+  const agentsConfig = emailConfig?.agents;
+  if (!agentsConfig?.enabled) {
+    return [];
+  }
+  return (agentsConfig.agents ?? []).map((a) => ({
+    id: a.id,
+    name: a.name,
+    emailAddress: a.emailAddress
+  }));
+}
+function buildAgentDestroySummaryLines(agents) {
+  if (agents.length === 0) {
+    return [];
+  }
+  const addresses = agents.map((a) => a.emailAddress).join(", ");
+  return [
+    "",
+    `Agent mailboxes (${agents.length}): ${addresses}`,
+    pc21.yellow(
+      "Agent scoped credentials are revoked (IAM users wraps-agent-* deleted), the wraps-agent-enforcer Lambda and wraps-email-agent-policy table are destroyed, and any pending approvals become undeliverable."
+    )
+  ];
+}
 async function emailDestroy(options) {
   const startTime = Date.now();
   if (isJsonMode() && !options.force) {
@@ -20623,6 +20655,7 @@ async function emailDestroy(options) {
   const emailConfig = emailService?.config;
   const domain = emailConfig?.domain;
   const storedStackName = emailService?.pulumiStackName;
+  const agentsToDestroy = selectAgentsToDestroy(emailConfig);
   if (!(options.force || options.preview)) {
     const additionalDomainNames = (emailConfig?.additionalDomains ?? []).map((d) => d.domain).filter(Boolean);
     const domainList = [domain, ...additionalDomainNames].filter(Boolean);
@@ -20635,6 +20668,7 @@ async function emailDestroy(options) {
         "Event streaming stops: the Wraps dashboard email timeline and event history for THIS ENTIRE AWS ACCOUNT stop receiving events. Historical events in DynamoDB are destroyed with the table. This cannot be undone."
       )
     ];
+    summaryLines.push(...buildAgentDestroySummaryLines(agentsToDestroy));
     if (emailService?.webhookSecret) {
       summaryLines.push(
         "",
@@ -20731,6 +20765,13 @@ async function emailDestroy(options) {
           );
         }
       }
+      const agentSummaryLines = buildAgentDestroySummaryLines(agentsToDestroy);
+      if (agentSummaryLines.length > 0) {
+        clack19.note(
+          agentSummaryLines.filter(Boolean).join("\n"),
+          "Agent mailboxes"
+        );
+      }
       clack19.outro(
         pc21.green("Preview complete. Run without --preview to destroy.")
       );
@@ -20850,6 +20891,33 @@ async function emailDestroy(options) {
     }
   } catch {
   }
+  if (agentsToDestroy.length > 0) {
+    try {
+      const agentApi = await createAgentApiClient();
+      if (agentApi.ok) {
+        let killed = 0;
+        for (const agent of agentsToDestroy) {
+          try {
+            const resp = await agentApi.post(`/v1/agents/${agent.id}/kill`);
+            if (resp.ok) {
+              killed++;
+            }
+          } catch {
+          }
+        }
+        if (!isJsonMode()) {
+          clack19.log.info(
+            `Marked ${killed}/${agentsToDestroy.length} agent(s) as killed in the Wraps dashboard.`
+          );
+        }
+      } else if (!isJsonMode()) {
+        clack19.log.warn(
+          "Could not reach the Wraps Platform to update agent status \u2014 your agents will still show as active in the dashboard. Kill them there: wraps email agent kill (or the dashboard)."
+        );
+      }
+    } catch {
+    }
+  }
   await deleteConnectionMetadata(identity.accountId, region);
   progress.stop();
   if (isJsonMode()) {
@@ -20857,7 +20925,12 @@ async function emailDestroy(options) {
       destroyed: !destroyFailed,
       region,
       dns_cleaned: shouldCleanDNS,
-      partial_failure: destroyFailed
+      partial_failure: destroyFailed,
+      agents: agentsToDestroy.map((a) => ({
+        id: a.id,
+        name: a.name,
+        emailAddress: a.emailAddress
+      }))
     });
     trackServiceRemoved("email", {
       reason: "user_initiated",
@@ -35258,6 +35331,128 @@ import { dirname as dirname5, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import * as clack45 from "@clack/prompts";
 import * as pulumi28 from "@pulumi/pulumi";
+
+// ../db/dist/connection-url.js
+init_esm_shims();
+
+// ../db/dist/connection-url-CJ0MYp2V.js
+init_esm_shims();
+var POSTGRES_SCHEMES = ["postgres:", "postgresql:"];
+var TRUST_STORE_SENTINELS = /* @__PURE__ */ new Set(["system", "os"]);
+var TLS_OPT_OUT = /* @__PURE__ */ new Set(["disable", "no-verify"]);
+function pinVerification(parsed) {
+  const modes = parsed.searchParams.getAll("sslmode");
+  const effective = modes.at(-1)?.toLowerCase();
+  const hadCompat = parsed.searchParams.has("uselibpqcompat");
+  if (effective && TLS_OPT_OUT.has(effective)) {
+    parsed.searchParams.set("sslmode", effective);
+    parsed.searchParams.delete("uselibpqcompat");
+    return;
+  }
+  const alreadyVerifying = modes.length === 1 && effective === "verify-full" && !hadCompat;
+  parsed.searchParams.set("sslmode", "verify-full");
+  parsed.searchParams.delete("uselibpqcompat");
+  return alreadyVerifying ? void 0 : "Pinned sslmode=verify-full \u2014 without the CA reference the original mode would have connected unverified (or in cleartext).";
+}
+function normalizeDatabaseUrl(raw) {
+  const url = raw.trim();
+  const notes = [];
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return {
+      url,
+      notes
+    };
+  }
+  const certKey = [...parsed.searchParams.keys()].find((key) => key.toLowerCase() === "sslrootcert");
+  const sslRootCert = certKey ? parsed.searchParams.get(certKey) : void 0;
+  if (!(sslRootCert && TRUST_STORE_SENTINELS.has(sslRootCert.toLowerCase()))) return {
+    url,
+    notes
+  };
+  parsed.searchParams.delete(certKey);
+  notes.push(`Dropped sslrootcert=${sslRootCert} \u2014 node-postgres would read it as a filename. TLS stays on and the certificate is verified against Node's bundled CA set (set NODE_EXTRA_CA_CERTS for a private CA).`);
+  const pinNote = pinVerification(parsed);
+  if (pinNote) notes.push(pinNote);
+  return {
+    url: parsed.toString(),
+    notes
+  };
+}
+function describeMigrationError(error) {
+  const parts = [];
+  let current = error;
+  const seen = /* @__PURE__ */ new Set();
+  while (current instanceof Error && !seen.has(current)) {
+    seen.add(current);
+    const code = current.code;
+    const message = current.message.startsWith("Failed query:") ? current.message.split("\n")[0] : current.message;
+    const described = code ? `${message} (${code})` : message;
+    if (!parts.includes(described)) parts.push(described);
+    current = current.cause;
+  }
+  return parts.length > 0 ? parts.join(" \u2014 ") : String(error);
+}
+var HINTS = [
+  {
+    match: /\b(ENOENT|EACCES)\b/,
+    hint: "A file named in DATABASE_URL (usually sslrootcert) is missing or unreadable. Point it at a readable CA file, or set NODE_EXTRA_CA_CERTS if the certificate chains to a private CA."
+  },
+  {
+    match: /password authentication failed|28P01|28000/i,
+    hint: "The credentials in DATABASE_URL were rejected. Check the user and password."
+  },
+  {
+    match: /CREATE SCHEMA|permission denied for database|must be owner of database/i,
+    hint: "The database user cannot create schemas. Grant it CREATE on the database (GRANT CREATE ON DATABASE <db> TO <user>), or use an owner role."
+  },
+  {
+    match: /permission denied|42501/i,
+    hint: "The database user lacks a privilege this migration needs. The failing statement above names the object \u2014 grant on that, or run migrations as the database owner."
+  },
+  {
+    match: /database .* does not exist|3D000/i,
+    hint: "The database named in DATABASE_URL does not exist. Create it first."
+  },
+  {
+    match: /no pg_hba\.conf entry|SSL|self[- ]signed|certificate/i,
+    hint: "TLS negotiation failed. Most managed Postgres requires ?sslmode=verify-full on DATABASE_URL."
+  },
+  {
+    match: /ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN/i,
+    hint: "Could not reach the database host. Check the host and port, and that this machine is allowed through the firewall or IP allowlist."
+  }
+];
+function migrationHint(description) {
+  return HINTS.find(({ match }) => match.test(description))?.hint;
+}
+function describeMigrationFailure(error) {
+  const description = describeMigrationError(error);
+  const hint = migrationHint(description);
+  return hint ? `Database migrations failed: ${description}
+${hint}` : `Database migrations failed: ${description}`;
+}
+function assertPostgresUrl(raw) {
+  const url = raw.trim();
+  if (!url) throw new Error("DATABASE_URL is empty.");
+  if (!url.includes("://")) {
+    if (/(^|\s)(host|dbname|user)=/.test(url)) throw new Error("DATABASE_URL is a libpq keyword/value connection string, which node-postgres cannot parse. Use the URI form instead: postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=verify-full");
+    throw new Error("DATABASE_URL is not a connection URI. Expected postgresql://USER:PASSWORD@HOST:5432/DATABASE");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("DATABASE_URL could not be parsed as a URI. If the password contains @ / : or ?, percent-encode it.");
+  }
+  if (POSTGRES_SCHEMES.includes(parsed.protocol)) return;
+  if (parsed.protocol === "mysql:" || parsed.protocol === "mysql2:") throw new Error(`DATABASE_URL points at MySQL (${parsed.protocol}//). Wraps requires PostgreSQL \u2014 its schema uses Postgres types, enums and partial indexes that have no MySQL equivalent.`);
+  throw new Error(`DATABASE_URL has an unsupported scheme (${parsed.protocol}//). Wraps requires PostgreSQL: postgresql://USER:PASSWORD@HOST:5432/DATABASE`);
+}
+
+// src/commands/selfhost/deploy.ts
 import pc48 from "picocolors";
 
 // src/infrastructure/selfhost-stack.ts
@@ -35514,6 +35709,29 @@ function buildNeonProjectName(accountId, region) {
   return `wraps-selfhost-${accountId}-${region}`;
 }
 
+// src/utils/selfhost/variant.ts
+init_esm_shims();
+var SHARED_SCHEDULER_ROLE = "wraps-selfhost-scheduler-role";
+async function detectSelfhostVariant(region) {
+  try {
+    const { LambdaClient: LambdaClient3, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
+    const lambda7 = new LambdaClient3({ region });
+    await lambda7.send(
+      new GetFunctionCommand({ FunctionName: SELFHOST_API_FUNCTION_NAME })
+    );
+    return "pulumi";
+  } catch {
+  }
+  try {
+    const { IAMClient: IAMClient5, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient5({ region });
+    await iam13.send(new GetRoleCommand3({ RoleName: SHARED_SCHEDULER_ROLE }));
+    return "sst";
+  } catch {
+    return null;
+  }
+}
+
 // src/commands/selfhost/deploy.ts
 init_aws();
 init_errors();
@@ -35571,17 +35789,42 @@ async function selfhostDeploy(options) {
     region
   );
   if (existingMetadata?.services?.selfhost) {
+    const existing = existingMetadata.services.selfhost;
     clack45.log.warn(
       `Self-hosted deployment already exists for account ${pc48.cyan(identity.accountId)} in region ${pc48.cyan(region)}`
     );
+    clack45.log.info(`API URL: ${pc48.cyan(existing.apiUrl)}`);
+    clack45.log.info(`Deployed: ${existing.deployedAt}`);
+    clack45.log.info(
+      existing.variant === "sst" ? `This is a full-platform (SST) deployment. To update: run ${pc48.cyan("pnpm selfhost:upgrade")} from your fork.` : `To update: run ${pc48.cyan("wraps selfhost upgrade")}`
+    );
+    process.exit(0);
+  }
+  const deployedVariant = await progress.execute(
+    "Checking for existing selfhost deployments",
+    async () => detectSelfhostVariant(region)
+  );
+  if (deployedVariant === "sst") {
+    progress.stop();
+    clack45.log.error(
+      "A full-platform (SST) selfhost deployment already exists in this AWS account."
+    );
     clack45.log.info(
-      `API URL: ${pc48.cyan(existingMetadata.services.selfhost.apiUrl)}`
+      `The two selfhost variants share IAM resources and cannot coexist.
+To update it: run ${pc48.cyan("pnpm selfhost:upgrade")} from your fork.
+To replace it with the API-only control plane: run ${pc48.cyan("pnpm selfhost:destroy")} from your fork first.`
+    );
+    process.exit(1);
+  }
+  if (deployedVariant === "pulumi") {
+    progress.stop();
+    clack45.log.error(
+      "An API-only selfhost control plane already exists in this AWS account, but no local metadata was found."
     );
     clack45.log.info(
-      `Deployed: ${existingMetadata.services.selfhost.deployedAt}`
+      `It was deployed from another machine. Run ${pc48.cyan("wraps selfhost upgrade")} there, or remove the existing stack before redeploying from this one.`
     );
-    clack45.log.info(`To update: run ${pc48.cyan("wraps selfhost upgrade")}`);
-    process.exit(0);
+    process.exit(1);
   }
   let resolvedDatabaseUrl = options.databaseUrl;
   let resolvedNeonProjectId;
@@ -35709,6 +35952,7 @@ async function selfhostDeploy(options) {
     );
   }
   const databaseUrl = resolvedDatabaseUrl;
+  assertPostgresUrl(databaseUrl);
   const unsubscribeSecret = randomBytes6(32).toString("hex");
   const betterAuthSecret = randomBytes6(32).toString("hex");
   const selfhostConfig = {
@@ -35734,19 +35978,26 @@ async function selfhostDeploy(options) {
     deployedAt,
     pulumiStackName: stackName,
     config: selfhostConfig,
-    apiUrl: priorApiUrl
+    apiUrl: priorApiUrl,
     // Refreshed from Pulumi outputs after deploy succeeds
+    variant: "pulumi"
   };
   savedMetadata.timestamp = deployedAt;
   await saveConnectionMetadata(savedMetadata);
+  const { url: migrationUrl, notes: connectionNotes } = normalizeDatabaseUrl(databaseUrl);
+  for (const note22 of connectionNotes) {
+    progress.info(note22);
+  }
   await progress.execute("Running database migrations", async () => {
     const { Pool } = await import("pg");
     const { drizzle } = await import("drizzle-orm/node-postgres");
     const { migrate } = await import("drizzle-orm/node-postgres/migrator");
-    const pool = new Pool({ connectionString: databaseUrl });
+    const pool = new Pool({ connectionString: migrationUrl });
     const db = drizzle(pool);
     try {
       await migrate(db, { migrationsFolder: bundledMigrationsDir });
+    } catch (error) {
+      throw new Error(describeMigrationFailure(error));
     } finally {
       await pool.end();
     }
@@ -36018,7 +36269,7 @@ Run ${pc50.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
     );
     console.log(
       `
-The deployment may have failed partway through. Re-run ${pc50.cyan("wraps selfhost deploy")} to complete it.
+The deployment may have failed partway through. Run ${pc50.cyan("pnpm selfhost:upgrade")} from your fork (SST deployments) or re-run ${pc50.cyan("wraps selfhost deploy")} (API-only deployments) to complete it.
 `
     );
     process.exit(1);
@@ -36329,15 +36580,30 @@ init_output();
 init_region_resolver();
 function displaySelfhostStatus(options) {
   const lines = [];
-  lines.push(pc53.bold(pc53.green("Self-Hosted Control Plane Active")));
+  const incomplete = !(options.apiUrl && options.appUrl);
+  lines.push(
+    incomplete ? pc53.bold(pc53.yellow("Self-Hosted Control Plane Incomplete")) : pc53.bold(pc53.green("Self-Hosted Control Plane Active"))
+  );
+  if (incomplete) {
+    lines.push(
+      pc53.yellow(
+        `A previous deploy did not finish. Run ${pc53.cyan("pnpm selfhost:upgrade")} from your fork to complete it.`
+      )
+    );
+  }
   lines.push("");
   lines.push(pc53.bold("API"));
-  lines.push(`  URL: ${pc53.cyan(options.apiUrl)}`);
+  lines.push(`  URL: ${pc53.cyan(options.apiUrl || "(not deployed)")}`);
   lines.push(`  Region: ${pc53.cyan(options.region)}`);
   lines.push(`  Deployed: ${pc53.dim(options.deployedAt)}`);
+  if (options.variant) {
+    lines.push(
+      `  Type: ${pc53.cyan(options.variant === "sst" ? "Full platform (SST, deployed from fork)" : "API-only control plane (CLI)")}`
+    );
+  }
   lines.push("");
   lines.push(pc53.bold("Configuration"));
-  lines.push(`  App URL: ${pc53.cyan(options.appUrl)}`);
+  lines.push(`  App URL: ${pc53.cyan(options.appUrl || "(not deployed)")}`);
   lines.push(`  License Key: ${pc53.dim(`${options.licenseKeyPrefix}...`)}`);
   if (options.neonProjectId) {
     lines.push(`  Neon Project: ${pc53.dim(options.neonProjectId)}`);
@@ -36366,7 +36632,8 @@ async function selfhostStatus(options) {
     clack50.log.error("No self-hosted deployment found");
     console.log(
       `
-Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plane.
+Run ${pc53.cyan("pnpm selfhost:deploy")} from your fork to deploy the full platform (API + dashboard),
+or ${pc53.cyan("wraps selfhost deploy")} for the API-only control plane.
 `
     );
     process.exit(1);
@@ -36375,13 +36642,23 @@ Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
   const selfhostService = metadata.services.selfhost;
   const config2 = selfhostService.config;
   const apiUrl = await reconcileSelfhostApiUrl(metadata, region) ?? selfhostService.apiUrl;
+  if (!selfhostService.variant) {
+    const inferred = await detectSelfhostVariant(region);
+    if (inferred) {
+      selfhostService.variant = inferred;
+      metadata.timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      await saveConnectionMetadata(metadata);
+    }
+  }
+  const variant = selfhostService.variant;
   const statusData = {
     region,
     apiUrl,
     deployedAt: selfhostService.deployedAt,
     neonProjectId: config2.neonProjectId,
     appUrl: config2.appUrl,
-    licenseKeyPrefix: config2.licenseKey.slice(0, 12)
+    licenseKeyPrefix: config2.licenseKey.slice(0, 12),
+    variant
   };
   if (isJsonMode()) {
     jsonSuccess("selfhost.status", statusData);
@@ -36391,7 +36668,7 @@ Run ${pc53.cyan("wraps selfhost deploy")} to deploy the self-hosted control plan
   console.log("");
   clack50.log.info(pc53.bold("Commands:"));
   console.log(
-    `  ${pc53.cyan("wraps selfhost upgrade")} - Rebuild and redeploy the API Lambda`
+    variant === "sst" ? `  ${pc53.cyan("pnpm selfhost:upgrade")} (from your fork) - Redeploy the platform and run migrations` : `  ${pc53.cyan("wraps selfhost upgrade")} - Rebuild and redeploy the API Lambda`
   );
   trackCommand("selfhost:status", {
     success: true,