@wraps.dev/cli 2.3.4 → 2.3.5

package/dist/cli.js

@@ -1023,7 +1023,7 @@ To remove: wraps destroy --stack ${stackName}`,
         "The Pulumi stack is locked from a previous run",
         "STACK_LOCKED",
         "This happens when a previous deployment was interrupted.\n\nTo unlock, run:\n  rm -rf ~/.wraps/pulumi/.pulumi/locks\n\nThen try your command again.",
-        "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
+        "https://wraps.dev/docs/guides/aws-setup/permissions/troubleshooting"
       ),
       // SMS-specific errors
       smsNotConfigured: () => new WrapsError(
@@ -1080,7 +1080,7 @@ To remove: wraps destroy --stack ${stackName}`,
         `AWS SSO session has expired${profile ? ` for profile "${profile}"` : ""}`,
         "SSO_SESSION_EXPIRED",
         profile ? `Run: aws sso login --profile ${profile}` : "Run: aws sso login",
-        "https://wraps.dev/docs/guides/aws-setup"
+        "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       profileNotFound: (profile, availableProfiles) => new WrapsError(
         `AWS profile "${profile}" not found`,
@@ -1092,25 +1092,25 @@ Set a valid profile:
 
 Or configure a new profile:
   aws configure --profile ${profile}` : "No AWS profiles configured.\n\nConfigure AWS credentials:\n  aws configure\n\nOr set up SSO:\n  aws configure sso",
-        "https://wraps.dev/docs/guides/aws-setup"
+        "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       credentialsFileMissing: () => new WrapsError(
         "AWS credentials file not found",
         "CREDENTIALS_FILE_MISSING",
         "Configure AWS credentials:\n  aws configure\n\nOr set environment variables:\n  export AWS_ACCESS_KEY_ID=<your-key>\n  export AWS_SECRET_ACCESS_KEY=<your-secret>",
-        "https://wraps.dev/docs/guides/aws-setup"
+        "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       accessKeyInvalid: () => new WrapsError(
         "AWS access key is invalid or has been deactivated",
         "ACCESS_KEY_INVALID",
         "Check your AWS access keys in the IAM console.\n\nReconfigure credentials:\n  aws configure\n\nOr generate new access keys in AWS IAM.",
-        "https://wraps.dev/docs/guides/aws-setup"
+        "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       sessionTokenExpired: () => new WrapsError(
         "AWS session token has expired",
         "SESSION_TOKEN_EXPIRED",
         "Your temporary credentials have expired.\n\nFor SSO users:\n  aws sso login\n\nFor assumed roles:\n  Re-run your assume-role command",
-        "https://wraps.dev/docs/guides/aws-setup"
+        "https://wraps.dev/docs/guides/aws-setup/permissions"
       ),
       // IAM permission errors
       iamPermissionDenied: (action, resource, suggestion) => new WrapsError(
@@ -9210,7 +9210,7 @@ function createNodeDnsProvider(options = {}) {
   if (options.servers && options.servers.length > 0) {
     resolver.setServers(options.servers);
   }
-  async function withTimeout(promise, operation) {
+  async function withTimeout2(promise, operation) {
     const timeoutPromise = new Promise((_, reject) => {
       setTimeout(() => {
         reject(new Error(`DNS ${operation} timed out after ${timeout}ms`));
@@ -9220,7 +9220,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveTxt(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolveTxt(domain),
         `TXT lookup for ${domain}`
       );
@@ -9234,7 +9234,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveMx(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolveMx(domain),
         `MX lookup for ${domain}`
       );
@@ -9248,7 +9248,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveA(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolve4(domain),
         `A lookup for ${domain}`
       );
@@ -9262,7 +9262,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveAaaa(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolve6(domain),
         `AAAA lookup for ${domain}`
       );
@@ -9276,7 +9276,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolvePtr(ip) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.reverse(ip),
         `PTR lookup for ${ip}`
       );
@@ -9290,7 +9290,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveCaa(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolveCaa(domain),
         `CAA lookup for ${domain}`
       );
@@ -9322,7 +9322,7 @@ function createNodeDnsProvider(options = {}) {
   }
   async function resolveCname(domain) {
     try {
-      const records = await withTimeout(
+      const records = await withTimeout2(
         dns.resolveCname(domain),
         `CNAME lookup for ${domain}`
       );
@@ -11885,14 +11885,13 @@ async function tryGetSesDkimTokens(domain) {
 // src/commands/email/config.ts
 init_esm_shims();
 import * as clack13 from "@clack/prompts";
-import * as pulumi13 from "@pulumi/pulumi";
+import * as pulumi12 from "@pulumi/pulumi";
 import pc14 from "picocolors";
 
 // src/infrastructure/email-stack.ts
 init_esm_shims();
 init_dist();
 import * as aws14 from "@pulumi/aws";
-import * as pulumi12 from "@pulumi/pulumi";
 
 // src/infrastructure/resources/alerting.ts
 init_esm_shims();
@@ -13066,7 +13065,7 @@ ${pc14.bold("Current Configuration:")}
         "Generating update preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi13.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi12.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -13130,7 +13129,7 @@ ${pc14.bold("Current Configuration:")}
       "Updating Wraps infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi13.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi12.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -13227,7 +13226,7 @@ ${pc14.green("\u2713")} ${pc14.bold("Update complete!")}
 // src/commands/email/connect.ts
 init_esm_shims();
 import * as clack14 from "@clack/prompts";
-import * as pulumi14 from "@pulumi/pulumi";
+import * as pulumi13 from "@pulumi/pulumi";
 import pc15 from "picocolors";
 init_events();
 init_presets();
@@ -13567,7 +13566,7 @@ async function connect2(options) {
         "Generating infrastructure preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi14.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi13.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -13631,7 +13630,7 @@ async function connect2(options) {
       "Deploying Wraps infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi14.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi13.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -13791,8 +13790,42 @@ init_errors();
 init_fs();
 init_metadata();
 import * as clack15 from "@clack/prompts";
-import * as pulumi15 from "@pulumi/pulumi";
+import * as pulumi14 from "@pulumi/pulumi";
 import pc16 from "picocolors";
+
+// src/utils/shared/timeout.ts
+init_esm_shims();
+init_errors();
+var DEFAULT_PULUMI_TIMEOUT_MS = 10 * 60 * 1e3;
+var TimeoutError = class extends WrapsError {
+  constructor(operation, timeoutMs) {
+    const timeoutMinutes = Math.round(timeoutMs / 6e4);
+    super(
+      `Operation "${operation}" timed out after ${timeoutMinutes} minute${timeoutMinutes === 1 ? "" : "s"}`,
+      "OPERATION_TIMEOUT",
+      "The operation took longer than expected. This can happen due to:\n  - Slow network connection\n  - AWS API throttling\n  - Large number of resources\n\nYou can try:\n  1. Check AWS CloudFormation/Pulumi state for partial deployments\n  2. Run the command again (it will resume where it left off)\n  3. Check your AWS console for any stuck resources",
+      "https://wraps.dev/docs/guides/aws-setup/troubleshooting"
+    );
+  }
+};
+async function withTimeout(promise, timeoutMs, operation) {
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new TimeoutError(operation, timeoutMs));
+    }, timeoutMs);
+  });
+  try {
+    const result = await Promise.race([promise, timeoutPromise]);
+    return result;
+  } finally {
+    if (timeoutId) {
+      clearTimeout(timeoutId);
+    }
+  }
+}
+
+// src/commands/email/destroy.ts
 async function getEmailIdentityInfo(domain, region) {
   try {
     const { SESv2Client: SESv2Client6, GetEmailIdentityCommand: GetEmailIdentityCommand5 } = await import("@aws-sdk/client-sesv2");
@@ -13893,10 +13926,10 @@ async function emailDestroy(options) {
         "Generating destruction preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stackName = storedStackName || `wraps-email-${identity.accountId}-${region}`;
+          const stackName = storedStackName || `wraps-${identity.accountId}-${region}`;
           let stack;
           try {
-            stack = await pulumi15.automation.LocalWorkspace.selectStack({
+            stack = await pulumi14.automation.LocalWorkspace.selectStack({
               stackName,
               workDir: getPulumiWorkDir()
             });
@@ -13964,18 +13997,23 @@ async function emailDestroy(options) {
       "Destroying email infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stackName = storedStackName || `wraps-email-${identity.accountId}-${region}`;
+        const stackName = storedStackName || `wraps-${identity.accountId}-${region}`;
         let stack;
         try {
-          stack = await pulumi15.automation.LocalWorkspace.selectStack({
+          stack = await pulumi14.automation.LocalWorkspace.selectStack({
             stackName,
             workDir: getPulumiWorkDir()
           });
         } catch (_error) {
           throw new Error("No email infrastructure found to destroy");
         }
-        await stack.destroy({ onOutput: () => {
-        } });
+        await withTimeout(
+          stack.destroy({ onOutput: () => {
+          } }),
+          // Suppress Pulumi output
+          DEFAULT_PULUMI_TIMEOUT_MS,
+          "Pulumi destroy"
+        );
         await stack.workspace.removeStack(stackName);
       }
     );
@@ -14479,7 +14517,7 @@ async function removeDomain(options) {
 // src/commands/email/init.ts
 init_esm_shims();
 import * as clack17 from "@clack/prompts";
-import * as pulumi16 from "@pulumi/pulumi";
+import * as pulumi15 from "@pulumi/pulumi";
 import pc18 from "picocolors";
 init_events();
 init_costs();
@@ -14487,6 +14525,141 @@ init_presets();
 init_aws();
 init_errors();
 init_fs();
+
+// src/utils/shared/iam-check.ts
+init_esm_shims();
+var CORE_IAM_ACTIONS = [
+  "iam:CreateRole",
+  "iam:GetRole",
+  "iam:PutRolePolicy",
+  "iam:DeleteRole",
+  "iam:DeleteRolePolicy",
+  "iam:TagRole",
+  "ses:CreateConfigurationSet",
+  "ses:DeleteConfigurationSet",
+  "ses:CreateEmailIdentity",
+  "ses:DeleteEmailIdentity",
+  "ses:GetEmailIdentity",
+  "ses:PutEmailIdentityDkimAttributes"
+];
+var EVENT_TRACKING_ACTIONS = [
+  "events:CreateEventBus",
+  "events:DeleteEventBus",
+  "events:PutRule",
+  "events:DeleteRule",
+  "events:PutTargets",
+  "events:RemoveTargets",
+  "sqs:CreateQueue",
+  "sqs:DeleteQueue",
+  "sqs:SetQueueAttributes",
+  "sqs:GetQueueAttributes"
+];
+var DYNAMODB_ACTIONS = [
+  "dynamodb:CreateTable",
+  "dynamodb:DeleteTable",
+  "dynamodb:DescribeTable",
+  "dynamodb:UpdateTable",
+  "dynamodb:TagResource"
+];
+var LAMBDA_ACTIONS = [
+  "lambda:CreateFunction",
+  "lambda:DeleteFunction",
+  "lambda:UpdateFunctionCode",
+  "lambda:UpdateFunctionConfiguration",
+  "lambda:GetFunction",
+  "lambda:AddPermission",
+  "lambda:RemovePermission",
+  "lambda:CreateEventSourceMapping",
+  "lambda:DeleteEventSourceMapping"
+];
+function getRequiredActions(config2) {
+  const actions = [...CORE_IAM_ACTIONS];
+  if (config2.eventTracking?.enabled) {
+    actions.push(...EVENT_TRACKING_ACTIONS);
+  }
+  if (config2.eventTracking?.dynamoDBHistory) {
+    actions.push(...DYNAMODB_ACTIONS);
+    actions.push(...LAMBDA_ACTIONS);
+  }
+  return [...new Set(actions)];
+}
+async function checkIAMPermissions(userArn, actions, region) {
+  try {
+    const { IAMClient: IAMClient3, SimulatePrincipalPolicyCommand } = await import("@aws-sdk/client-iam");
+    const client = new IAMClient3({ region });
+    const batchSize = 100;
+    const batches = [];
+    for (let i = 0; i < actions.length; i += batchSize) {
+      batches.push(actions.slice(i, i + batchSize));
+    }
+    const allowedActions = [];
+    const deniedActions = [];
+    for (const batch of batches) {
+      const command = new SimulatePrincipalPolicyCommand({
+        PolicySourceArn: userArn,
+        ActionNames: batch,
+        // Use a wildcard resource since we're checking general permissions
+        // More specific resource-level checks could be added later
+        ResourceArns: ["*"]
+      });
+      const response = await client.send(command);
+      for (const result of response.EvaluationResults || []) {
+        const actionName = result.EvalActionName;
+        const decision = result.EvalDecision;
+        if (decision === "allowed") {
+          if (actionName) allowedActions.push(actionName);
+        } else if (actionName) deniedActions.push(actionName);
+      }
+    }
+    return {
+      success: deniedActions.length === 0,
+      deniedActions,
+      allowedActions,
+      skipped: false
+    };
+  } catch (error) {
+    if (error instanceof Error && (error.name === "AccessDenied" || error.name === "AccessDeniedException" || error.message?.includes("AccessDenied") || error.message?.includes("iam:SimulatePrincipalPolicy"))) {
+      return {
+        success: true,
+        // Don't block on this
+        deniedActions: [],
+        allowedActions: [],
+        skipped: true,
+        skipReason: "Unable to verify permissions (iam:SimulatePrincipalPolicy not allowed). Deployment will proceed, but may fail if permissions are missing."
+      };
+    }
+    return {
+      success: true,
+      deniedActions: [],
+      allowedActions: [],
+      skipped: true,
+      skipReason: `Permission check failed: ${error instanceof Error ? error.message : "Unknown error"}. Proceeding with deployment.`
+    };
+  }
+}
+function formatDeniedActions(actions) {
+  if (actions.length === 0) return "";
+  const byService = {};
+  for (const action of actions) {
+    const [service, actionName] = action.split(":");
+    if (!byService[service]) {
+      byService[service] = [];
+    }
+    byService[service].push(actionName);
+  }
+  const lines = ["Missing permissions:"];
+  for (const [service, serviceActions] of Object.entries(byService)) {
+    lines.push(`  ${service.toUpperCase()}:`);
+    for (const action of serviceActions) {
+      lines.push(`    - ${service}:${action}`);
+    }
+  }
+  lines.push("");
+  lines.push("Run `wraps permissions --json` to see the full policy document.");
+  return lines.join("\n");
+}
+
+// src/commands/email/init.ts
 init_metadata();
 init_prompts();
 async function init2(options) {
@@ -14594,6 +14767,23 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
       process.exit(0);
     }
   }
+  if (!options.preview) {
+    const iamCheckResult = await progress.execute(
+      "Checking IAM permissions",
+      async () => {
+        const requiredActions = getRequiredActions(emailConfig);
+        return checkIAMPermissions(identity.arn, requiredActions, region);
+      }
+    );
+    if (iamCheckResult.skipped && iamCheckResult.skipReason) {
+      progress.info(pc18.dim(iamCheckResult.skipReason));
+    } else if (!iamCheckResult.success) {
+      clack17.log.warn(
+        pc18.yellow("Some IAM permissions may be missing. Deployment may fail.")
+      );
+      clack17.log.info(formatDeniedActions(iamCheckResult.deniedActions));
+    }
+  }
   const stackConfig = {
     provider,
     region,
@@ -14606,7 +14796,7 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
         "Generating infrastructure preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi16.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi15.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -14675,7 +14865,7 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
       "Deploying infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi16.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi15.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -14712,8 +14902,13 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
           `wraps-${identity.accountId}-${region}`
         );
         await stack.setConfig("aws:region", { value: region });
-        const upResult = await stack.up({ onOutput: () => {
-        } });
+        const upResult = await withTimeout(
+          stack.up({ onOutput: () => {
+          } }),
+          // Suppress Pulumi output
+          DEFAULT_PULUMI_TIMEOUT_MS,
+          "Pulumi deployment"
+        );
         const pulumiOutputs = upResult.outputs;
         return {
           roleArn: pulumiOutputs.roleArn?.value,
@@ -14891,7 +15086,7 @@ init_aws();
 init_fs();
 init_metadata();
 import * as clack18 from "@clack/prompts";
-import * as pulumi17 from "@pulumi/pulumi";
+import * as pulumi16 from "@pulumi/pulumi";
 import pc19 from "picocolors";
 async function restore(options) {
   const startTime = Date.now();
@@ -14963,7 +15158,7 @@ ${pc19.bold("The following Wraps resources will be removed:")}
         const previewResult = await progress.execute(
           "Generating removal preview",
           async () => {
-            const stack = await pulumi17.automation.LocalWorkspace.selectStack(
+            const stack = await pulumi16.automation.LocalWorkspace.selectStack(
               {
                 stackName: pulumiStackName,
                 projectName: "wraps-email",
@@ -15015,7 +15210,7 @@ ${pc19.bold("The following Wraps resources will be removed:")}
         if (!metadata.services.email?.pulumiStackName) {
           throw new Error("No Pulumi stack name found in metadata");
         }
-        const stack = await pulumi17.automation.LocalWorkspace.selectStack(
+        const stack = await pulumi16.automation.LocalWorkspace.selectStack(
           {
             stackName: metadata.services.email.pulumiStackName,
             projectName: "wraps-email",
@@ -15069,7 +15264,7 @@ init_aws();
 init_fs();
 init_metadata();
 import * as clack19 from "@clack/prompts";
-import * as pulumi18 from "@pulumi/pulumi";
+import * as pulumi17 from "@pulumi/pulumi";
 import pc20 from "picocolors";
 async function emailStatus(options) {
   const startTime = Date.now();
@@ -15105,7 +15300,7 @@ async function emailStatus(options) {
   let stackOutputs = {};
   try {
     await ensurePulumiWorkDir();
-    const stack = await pulumi18.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi17.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -15182,7 +15377,7 @@ Run ${pc20.cyan("wraps email init")} to deploy email infrastructure.
 // src/commands/email/upgrade.ts
 init_esm_shims();
 import * as clack20 from "@clack/prompts";
-import * as pulumi19 from "@pulumi/pulumi";
+import * as pulumi18 from "@pulumi/pulumi";
 import pc21 from "picocolors";
 init_events();
 init_costs();
@@ -16303,7 +16498,7 @@ ${pc21.bold("Cost Impact:")}`);
         "Generating upgrade preview",
         async () => {
           await ensurePulumiWorkDir();
-          const stack = await pulumi19.automation.LocalWorkspace.createOrSelectStack(
+          const stack = await pulumi18.automation.LocalWorkspace.createOrSelectStack(
             {
               stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
               projectName: "wraps-email",
@@ -16381,7 +16576,7 @@ ${pc21.bold("Cost Impact:")}`);
       "Updating Wraps infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi19.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi18.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
             projectName: "wraps-email",
@@ -17478,7 +17673,7 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
 // src/commands/shared/dashboard.ts
 init_esm_shims();
 import * as clack24 from "@clack/prompts";
-import * as pulumi20 from "@pulumi/pulumi";
+import * as pulumi19 from "@pulumi/pulumi";
 import getPort from "get-port";
 import open from "open";
 import pc26 from "picocolors";
@@ -20014,7 +20209,7 @@ async function dashboard(options) {
   try {
     await ensurePulumiWorkDir();
     try {
-      const emailStack = await pulumi20.automation.LocalWorkspace.selectStack({
+      const emailStack = await pulumi19.automation.LocalWorkspace.selectStack({
         stackName: `wraps-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20022,7 +20217,7 @@ async function dashboard(options) {
     } catch (_emailError) {
     }
     try {
-      const smsStack = await pulumi20.automation.LocalWorkspace.selectStack({
+      const smsStack = await pulumi19.automation.LocalWorkspace.selectStack({
         stackName: `wraps-sms-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20030,7 +20225,7 @@ async function dashboard(options) {
     } catch (_smsError) {
     }
     try {
-      const cdnStack = await pulumi20.automation.LocalWorkspace.selectStack({
+      const cdnStack = await pulumi19.automation.LocalWorkspace.selectStack({
         stackName: `wraps-cdn-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20207,7 +20402,7 @@ init_events();
 init_aws();
 init_fs();
 import * as clack26 from "@clack/prompts";
-import * as pulumi21 from "@pulumi/pulumi";
+import * as pulumi20 from "@pulumi/pulumi";
 import pc28 from "picocolors";
 async function status(_options) {
   const startTime = Date.now();
@@ -20223,7 +20418,7 @@ async function status(_options) {
   const services = [];
   try {
     await ensurePulumiWorkDir();
-    const emailStack = await pulumi21.automation.LocalWorkspace.selectStack({
+    const emailStack = await pulumi20.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -20242,7 +20437,7 @@ async function status(_options) {
     services.push({ name: "Email", status: "not_deployed" });
   }
   try {
-    const smsStack = await pulumi21.automation.LocalWorkspace.selectStack({
+    const smsStack = await pulumi20.automation.LocalWorkspace.selectStack({
       stackName: `wraps-sms-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -20302,13 +20497,13 @@ ${pc28.bold("Dashboard:")} ${pc28.blue("https://app.wraps.dev")}`);
 // src/commands/sms/destroy.ts
 init_esm_shims();
 import * as clack27 from "@clack/prompts";
-import * as pulumi23 from "@pulumi/pulumi";
+import * as pulumi22 from "@pulumi/pulumi";
 import pc29 from "picocolors";
 
 // src/infrastructure/sms-stack.ts
 init_esm_shims();
 import * as aws15 from "@pulumi/aws";
-import * as pulumi22 from "@pulumi/pulumi";
+import * as pulumi21 from "@pulumi/pulumi";
 async function roleExists3(roleName) {
   try {
     const { IAMClient: IAMClient3, GetRoleCommand: GetRoleCommand2 } = await import("@aws-sdk/client-iam");
@@ -20342,7 +20537,7 @@ async function tableExists2(tableName) {
 async function createSMSIAMRole(config2) {
   let assumeRolePolicy;
   if (config2.provider === "vercel" && config2.oidcProvider) {
-    assumeRolePolicy = pulumi22.interpolate`{
+    assumeRolePolicy = pulumi21.interpolate`{
       "Version": "2012-10-17",
       "Statement": [
         {
@@ -20370,7 +20565,7 @@ async function createSMSIAMRole(config2) {
       ]
     }`;
   } else if (config2.provider === "aws") {
-    assumeRolePolicy = pulumi22.output(`{
+    assumeRolePolicy = pulumi21.output(`{
       "Version": "2012-10-17",
       "Statement": [{
         "Effect": "Allow",
@@ -20725,7 +20920,7 @@ async function createSMSSNSResources(config2) {
   });
   new aws15.sqs.QueuePolicy("wraps-sms-events-queue-policy", {
     queueUrl: config2.queueUrl,
-    policy: pulumi22.all([config2.queueArn, topic.arn]).apply(
+    policy: pulumi21.all([config2.queueArn, topic.arn]).apply(
       ([queueArn, topicArn2]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -20824,7 +21019,7 @@ async function deploySMSLambdaFunction(config2) {
   });
   new aws15.iam.RolePolicy("wraps-sms-lambda-policy", {
     role: lambdaRole.name,
-    policy: pulumi22.all([config2.tableName, config2.queueArn]).apply(
+    policy: pulumi21.all([config2.tableName, config2.queueArn]).apply(
       ([tableName, queueArn]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -20861,7 +21056,7 @@ async function deploySMSLambdaFunction(config2) {
       runtime: "nodejs20.x",
       handler: "index.handler",
       role: lambdaRole.arn,
-      code: new pulumi22.asset.FileArchive(codeDir),
+      code: new pulumi21.asset.FileArchive(codeDir),
       timeout: 300,
       // 5 minutes
       memorySize: 512,
@@ -21272,7 +21467,7 @@ async function smsDestroy(options) {
           const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
           let stack;
           try {
-            stack = await pulumi23.automation.LocalWorkspace.selectStack({
+            stack = await pulumi22.automation.LocalWorkspace.selectStack({
               stackName,
               workDir: getPulumiWorkDir()
             });
@@ -21329,7 +21524,7 @@ async function smsDestroy(options) {
         const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
         let stack;
         try {
-          stack = await pulumi23.automation.LocalWorkspace.selectStack({
+          stack = await pulumi22.automation.LocalWorkspace.selectStack({
             stackName,
             workDir: getPulumiWorkDir()
           });
@@ -21386,7 +21581,7 @@ Run ${pc29.cyan("wraps sms init")} to deploy infrastructure again.
 // src/commands/sms/init.ts
 init_esm_shims();
 import * as clack28 from "@clack/prompts";
-import * as pulumi24 from "@pulumi/pulumi";
+import * as pulumi23 from "@pulumi/pulumi";
 import pc30 from "picocolors";
 init_events();
 init_aws();
@@ -22033,7 +22228,7 @@ ${pc30.yellow(pc30.bold("Important Notes:"))}`);
       "Deploying SMS infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi24.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi23.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: `wraps-sms-${identity.accountId}-${region}`,
             projectName: "wraps-sms",
@@ -22379,7 +22574,7 @@ init_aws();
 init_fs();
 init_metadata();
 import * as clack30 from "@clack/prompts";
-import * as pulumi25 from "@pulumi/pulumi";
+import * as pulumi24 from "@pulumi/pulumi";
 import pc32 from "picocolors";
 function displaySMSStatus(options) {
   const lines = [];
@@ -22444,7 +22639,7 @@ Run ${pc32.cyan("wraps sms init")} to deploy SMS infrastructure.
   try {
     await ensurePulumiWorkDir();
     const stackName = metadata.services.sms.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`;
-    const stack = await pulumi25.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi24.automation.LocalWorkspace.selectStack({
       stackName,
       workDir: getPulumiWorkDir()
     });
@@ -22483,7 +22678,7 @@ Run ${pc32.cyan("wraps sms init")} to deploy SMS infrastructure.
 // src/commands/sms/sync.ts
 init_esm_shims();
 import * as clack31 from "@clack/prompts";
-import * as pulumi26 from "@pulumi/pulumi";
+import * as pulumi25 from "@pulumi/pulumi";
 import pc33 from "picocolors";
 init_events();
 init_aws();
@@ -22541,7 +22736,7 @@ Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
     outputs = await progress.execute("Syncing SMS infrastructure", async () => {
       await ensurePulumiWorkDir();
       const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
-      const stack = await pulumi26.automation.LocalWorkspace.createOrSelectStack(
+      const stack = await pulumi25.automation.LocalWorkspace.createOrSelectStack(
         {
           stackName,
           projectName: "wraps-sms",
@@ -22862,7 +23057,7 @@ Run ${pc34.cyan("wraps sms register")} to complete registration.
 // src/commands/sms/upgrade.ts
 init_esm_shims();
 import * as clack33 from "@clack/prompts";
-import * as pulumi27 from "@pulumi/pulumi";
+import * as pulumi26 from "@pulumi/pulumi";
 import pc35 from "picocolors";
 init_events();
 init_aws();
@@ -23605,7 +23800,7 @@ ${pc35.bold("Cost Impact:")}`);
       "Updating SMS infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi27.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi26.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`,
             projectName: "wraps-sms",
@@ -24270,6 +24465,20 @@ function printCompletionScript() {
 
 // src/cli.ts
 init_errors();
+var [nodeMajorVersion] = process.versions.node.split(".").map(Number);
+if (nodeMajorVersion < 20) {
+  console.error(
+    "\x1B[31mError: Wraps CLI requires Node.js 20 or higher.\x1B[0m"
+  );
+  console.error(`Current version: ${process.versions.node}`);
+  console.error("");
+  console.error("To upgrade Node.js:");
+  console.error("  macOS/Linux (nvm): nvm install 20 && nvm use 20");
+  console.error("  macOS (Homebrew):  brew install node@20");
+  console.error("  Windows:           Download from https://nodejs.org/");
+  console.error("");
+  process.exit(1);
+}
 var __filename2 = fileURLToPath4(import.meta.url);
 var __dirname3 = dirname2(__filename2);
 var packageJson = JSON.parse(