@wraps.dev/cli 2.3.5 → 2.5.0

package/dist/cli.js

@@ -1989,9 +1989,11 @@ __export(prompts_exports, {
   getAvailableFeatures: () => getAvailableFeatures,
   promptConfigPreset: () => promptConfigPreset,
   promptConflictResolution: () => promptConflictResolution,
+  promptContinueManualDNS: () => promptContinueManualDNS,
   promptCustomConfig: () => promptCustomConfig,
   promptDNSConfirmation: () => promptDNSConfirmation,
   promptDNSManagement: () => promptDNSManagement,
+  promptDNSProvider: () => promptDNSProvider,
   promptDomain: () => promptDomain,
   promptEmailArchiving: () => promptEmailArchiving,
   promptEstimatedVolume: () => promptEstimatedVolume,
@@ -2713,6 +2715,58 @@ async function promptDNSManagement(domain) {
   }
   return manage;
 }
+async function promptDNSProvider(domain, availableProviders) {
+  const options = availableProviders.map((p) => {
+    let label;
+    let hint;
+    switch (p.provider) {
+      case "route53":
+        label = "AWS Route53";
+        hint = p.detected ? "Hosted zone detected" : "Requires Route53 hosted zone";
+        break;
+      case "vercel":
+        label = "Vercel DNS";
+        hint = p.detected ? "Token found" : "Requires VERCEL_TOKEN";
+        break;
+      case "cloudflare":
+        label = "Cloudflare";
+        hint = p.detected ? "Token found" : "Requires CLOUDFLARE_API_TOKEN";
+        break;
+      case "manual":
+        label = "Manual";
+        hint = "I'll add DNS records myself";
+        break;
+    }
+    if (p.detected && p.provider !== "manual") {
+      label = `${label} (Recommended)`;
+    }
+    return {
+      value: p.provider,
+      label,
+      hint: p.hint || hint
+    };
+  });
+  const provider = await clack3.select({
+    message: `Where do you manage DNS for ${pc4.cyan(domain)}?`,
+    options
+  });
+  if (clack3.isCancel(provider)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  return provider;
+}
+async function promptContinueManualDNS() {
+  const continueManual = await clack3.confirm({
+    message: "Continue with manual DNS setup?",
+    initialValue: true
+  });
+  if (clack3.isCancel(continueManual)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  return continueManual;
+}
 var DNS_CATEGORY_LABELS, DNS_STATUS_SYMBOLS;
 var init_prompts = __esm({
   "src/utils/shared/prompts.ts"() {
@@ -4433,185 +4487,1108 @@ var init_mail_manager = __esm({
   }
 });
 
-// src/utils/shared/assume-role.ts
-var assume_role_exports = {};
-__export(assume_role_exports, {
-  assumeRole: () => assumeRole
-});
-import { AssumeRoleCommand, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-async function assumeRole(roleArn, region, sessionName = "wraps-console") {
-  const sts = new STSClient3({ region });
-  const response = await sts.send(
-    new AssumeRoleCommand({
-      RoleArn: roleArn,
-      RoleSessionName: sessionName,
-      DurationSeconds: 3600
-      // 1 hour
-    })
-  );
-  if (!response.Credentials) {
-    throw new Error("Failed to assume role: No credentials returned");
-  }
-  return {
-    accessKeyId: response.Credentials.AccessKeyId,
-    secretAccessKey: response.Credentials.SecretAccessKey,
-    sessionToken: response.Credentials.SessionToken,
-    expiration: response.Credentials.Expiration
-  };
-}
-var init_assume_role = __esm({
-  "src/utils/shared/assume-role.ts"() {
+// src/utils/dns/cloudflare.ts
+var CLOUDFLARE_API_BASE, CloudflareDNSClient;
+var init_cloudflare = __esm({
+  "src/utils/dns/cloudflare.ts"() {
     "use strict";
     init_esm_shims();
-  }
-});
-
-// src/utils/archive.ts
-import {
-  GetArchiveMessageCommand,
-  GetArchiveSearchResultsCommand,
-  MailManagerClient as MailManagerClient2,
-  StartArchiveSearchCommand
-} from "@aws-sdk/client-mailmanager";
-import DOMPurify from "isomorphic-dompurify";
-import { simpleParser } from "mailparser";
-function extractArchiveId(archiveArnOrId) {
-  if (archiveArnOrId.startsWith("arn:")) {
-    const parts = archiveArnOrId.split("/");
-    return parts.at(-1);
-  }
-  return archiveArnOrId;
-}
-async function getArchivedEmail(archiveArnOrId, searchCriteria, region) {
-  const client = new MailManagerClient2({ region });
-  const archiveId = extractArchiveId(archiveArnOrId);
-  const searchTime = searchCriteria.timestamp || /* @__PURE__ */ new Date();
-  const dayBefore = new Date(searchTime.getTime() - 24 * 60 * 60 * 1e3);
-  const dayAfter = new Date(searchTime.getTime() + 24 * 60 * 60 * 1e3);
-  const filters = [];
-  if (searchCriteria.from) {
-    filters.push({
-      StringExpression: {
-        Evaluate: {
-          Attribute: "FROM"
-        },
-        Operator: "CONTAINS",
-        Values: [searchCriteria.from]
+    CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+    CloudflareDNSClient = class {
+      zoneId;
+      apiToken;
+      constructor(zoneId, apiToken) {
+        this.zoneId = zoneId;
+        this.apiToken = apiToken;
+      }
+      async request(endpoint, method = "GET", body) {
+        const response = await fetch(
+          `${CLOUDFLARE_API_BASE}/zones/${this.zoneId}${endpoint}`,
+          {
+            method,
+            headers: {
+              Authorization: `Bearer ${this.apiToken}`,
+              "Content-Type": "application/json"
+            },
+            body: body ? JSON.stringify(body) : void 0
+          }
+        );
+        return response.json();
       }
-    });
-  }
-  if (searchCriteria.to) {
-    filters.push({
-      StringExpression: {
-        Evaluate: {
-          Attribute: "TO"
-        },
-        Operator: "CONTAINS",
-        Values: [searchCriteria.to]
+      async createRecord(name, type, content, priority) {
+        const body = {
+          name,
+          type,
+          content,
+          ttl: 1800,
+          proxied: false
+          // Must not be proxied for email records
+        };
+        if (priority !== void 0) {
+          body.priority = priority;
+        }
+        const result = await this.request(
+          "/dns_records",
+          "POST",
+          body
+        );
+        return result.success;
       }
-    });
-  }
-  if (searchCriteria.subject) {
-    filters.push({
-      StringExpression: {
-        Evaluate: {
-          Attribute: "SUBJECT"
-        },
-        Operator: "CONTAINS",
-        Values: [searchCriteria.subject]
+      async findRecord(name, type) {
+        const result = await this.request(
+          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
+        );
+        if (result.success && result.result.length > 0) {
+          return result.result[0];
+        }
+        return null;
       }
-    });
-  }
-  if (filters.length === 0) {
-    throw new Error(
-      "At least one search criterion (from, to, or subject) is required"
-    );
-  }
-  const searchCommand = new StartArchiveSearchCommand({
-    ArchiveId: archiveId,
-    FromTimestamp: dayBefore,
-    ToTimestamp: dayAfter,
-    Filters: {
-      Include: filters
-    },
-    MaxResults: 10
-    // Get a few results in case there are multiple matches
-  });
-  const searchResponse = await client.send(searchCommand);
-  const searchId = searchResponse.SearchId;
-  if (!searchId) {
-    throw new Error("Failed to start archive search");
-  }
-  let archivedMessageId;
-  let attempts = 0;
-  const maxAttempts = 20;
-  const pollInterval = 1e3;
-  await new Promise((resolve) => setTimeout(resolve, 1e3));
-  while (attempts < maxAttempts) {
-    try {
-      const resultsCommand = new GetArchiveSearchResultsCommand({
-        SearchId: searchId
-      });
-      const resultsResponse = await client.send(resultsCommand);
-      if (resultsResponse.Rows && resultsResponse.Rows.length > 0) {
-        archivedMessageId = resultsResponse.Rows[0].ArchivedMessageId;
-        break;
+      async deleteRecord(recordId) {
+        const result = await this.request(
+          `/dns_records/${recordId}`,
+          "DELETE"
+        );
+        return result.success;
       }
-      if (resultsResponse.Rows && resultsResponse.Rows.length === 0) {
-        break;
+      async createEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const success = await this.createRecord(
+              name,
+              "CNAME",
+              `${token}.dkim.amazonses.com`
+            );
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create DKIM record: ${name}`);
+            }
+          }
+          const spfSuccess = await this.createRecord(
+            domain,
+            "TXT",
+            "v=spf1 include:amazonses.com ~all"
+          );
+          if (spfSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create SPF record for ${domain}`);
+          }
+          const dmarcSuccess = await this.createRecord(
+            `_dmarc.${domain}`,
+            "TXT",
+            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+          );
+          if (dmarcSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create DMARC record for ${domain}`);
+          }
+          if (mailFromDomain) {
+            const mxSuccess = await this.createRecord(
+              mailFromDomain,
+              "MX",
+              `feedback-smtp.${region}.amazonses.com`,
+              10
+            );
+            if (mxSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create MX record for ${mailFromDomain}`);
+            }
+            const mailFromSpfSuccess = await this.createRecord(
+              mailFromDomain,
+              "TXT",
+              "v=spf1 include:amazonses.com ~all"
+            );
+            if (mailFromSpfSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create SPF record for ${mailFromDomain}`);
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
       }
-    } catch (error) {
-      if (error instanceof Error && error.name === "ConflictException" && error.message.includes("still in progress")) {
-        console.log(`Search still in progress, attempt ${attempts + 1}...`);
-      } else {
-        throw error;
+      async deleteEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const record = await this.findRecord(name, "CNAME");
+            if (record) {
+              const success = await this.deleteRecord(record.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete DKIM record: ${name}`);
+              }
+            }
+          }
+          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+          if (dmarcRecord) {
+            const success = await this.deleteRecord(dmarcRecord.id);
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push("Failed to delete DMARC record");
+            }
+          }
+          if (mailFromDomain) {
+            const mxRecord = await this.findRecord(mailFromDomain, "MX");
+            if (mxRecord) {
+              const success = await this.deleteRecord(mxRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
+              }
+            }
+            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
+            if (spfRecord) {
+              const success = await this.deleteRecord(spfRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
+              }
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
       }
-    }
-    await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    attempts++;
-  }
-  if (!archivedMessageId) {
-    throw new Error(
-      "Email not found in archive with the provided search criteria. It may have been sent before archiving was enabled."
-    );
-  }
-  const command = new GetArchiveMessageCommand({
-    ArchivedMessageId: archivedMessageId
-  });
-  const response = await client.send(command);
-  if (!response.MessageDownloadLink) {
-    throw new Error("No download link available for archived message");
-  }
-  const emailResponse = await fetch(response.MessageDownloadLink);
-  if (!emailResponse.ok) {
-    throw new Error(`Failed to download email: ${emailResponse.statusText}`);
-  }
-  const emailRaw = await emailResponse.text();
-  const parsed = await simpleParser(emailRaw);
-  const attachments = parsed.attachments?.map((att) => ({
-    filename: att.filename,
-    contentType: att.contentType,
-    size: att.size
-  })) || [];
-  const headers = {};
-  if (parsed.headers) {
-    for (const [key, value] of parsed.headers) {
-      if (value instanceof Date) {
-        headers[key] = value.toISOString();
-      } else if (typeof value === "string") {
-        headers[key] = value;
-      } else if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
-        headers[key] = value;
-      } else {
-        headers[key] = JSON.stringify(value);
+      async verifyRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const missing = [];
+        const incorrect = [];
+        for (const token of dkimTokens) {
+          const name = `${token}._domainkey.${domain}`;
+          const expectedValue = `${token}.dkim.amazonses.com`;
+          const record = await this.findRecord(name, "CNAME");
+          if (!record) {
+            missing.push(`DKIM: ${name}`);
+          } else if (record.content !== expectedValue) {
+            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
+          }
+        }
+        const spfRecord = await this.findRecord(domain, "TXT");
+        if (!spfRecord) {
+          missing.push(`SPF: ${domain}`);
+        } else if (!spfRecord.content.includes("include:amazonses.com")) {
+          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
+        }
+        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+        if (!dmarcRecord) {
+          missing.push(`DMARC: _dmarc.${domain}`);
+        }
+        if (mailFromDomain) {
+          const mxRecord = await this.findRecord(mailFromDomain, "MX");
+          if (!mxRecord) {
+            missing.push(`MX: ${mailFromDomain}`);
+          } else if (!mxRecord.content.includes(`feedback-smtp.${region}.amazonses.com`)) {
+            incorrect.push(`MX: ${mailFromDomain}`);
+          }
+          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
+          if (!mailFromSpf) {
+            missing.push(`SPF: ${mailFromDomain}`);
+          }
+        }
+        return {
+          verified: missing.length === 0 && incorrect.length === 0,
+          missing,
+          incorrect
+        };
       }
-    }
+    };
   }
-  const getAddressText = (addr) => {
-    if (!addr) {
-      return "";
-    }
-    if (Array.isArray(addr)) {
+});
+
+// src/utils/dns/vercel.ts
+var VERCEL_API_BASE, VercelDNSClient;
+var init_vercel = __esm({
+  "src/utils/dns/vercel.ts"() {
+    "use strict";
+    init_esm_shims();
+    VERCEL_API_BASE = "https://api.vercel.com";
+    VercelDNSClient = class {
+      domain;
+      apiToken;
+      teamId;
+      constructor(domain, apiToken, teamId) {
+        this.domain = domain;
+        this.apiToken = apiToken;
+        this.teamId = teamId;
+      }
+      get teamParam() {
+        return this.teamId ? `&teamId=${this.teamId}` : "";
+      }
+      async request(endpoint, method = "GET", body) {
+        const url = `${VERCEL_API_BASE}${endpoint}${endpoint.includes("?") ? "&" : "?"}${this.teamParam.slice(1)}`;
+        const response = await fetch(url, {
+          method,
+          headers: {
+            Authorization: `Bearer ${this.apiToken}`,
+            "Content-Type": "application/json"
+          },
+          body: body ? JSON.stringify(body) : void 0
+        });
+        return response.json();
+      }
+      async createRecord(name, type, value, mxPriority) {
+        const relativeName = name === this.domain ? "@" : name.replace(`.${this.domain}`, "");
+        const body = {
+          name: relativeName,
+          type,
+          value,
+          ttl: 1800
+        };
+        if (mxPriority !== void 0) {
+          body.mxPriority = mxPriority;
+        }
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records`,
+          "POST",
+          body
+        );
+        return !result.error;
+      }
+      async findRecord(name, type) {
+        const result = await this.request(
+          `/v4/domains/${this.domain}/records`
+        );
+        if (result.error || !result.records) {
+          return null;
+        }
+        const relativeName = name === this.domain ? "@" : name.replace(`.${this.domain}`, "");
+        return result.records.find(
+          (r) => (r.name === relativeName || r.name === name) && r.type === type
+        ) || null;
+      }
+      async deleteRecord(recordId) {
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records/${recordId}`,
+          "DELETE"
+        );
+        return !result.error;
+      }
+      async createEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const success = await this.createRecord(
+              name,
+              "CNAME",
+              `${token}.dkim.amazonses.com`
+            );
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create DKIM record: ${name}`);
+            }
+          }
+          const spfSuccess = await this.createRecord(
+            domain,
+            "TXT",
+            "v=spf1 include:amazonses.com ~all"
+          );
+          if (spfSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create SPF record for ${domain}`);
+          }
+          const dmarcSuccess = await this.createRecord(
+            `_dmarc.${domain}`,
+            "TXT",
+            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+          );
+          if (dmarcSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create DMARC record for ${domain}`);
+          }
+          if (mailFromDomain) {
+            const mxSuccess = await this.createRecord(
+              mailFromDomain,
+              "MX",
+              `feedback-smtp.${region}.amazonses.com`,
+              10
+            );
+            if (mxSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create MX record for ${mailFromDomain}`);
+            }
+            const mailFromSpfSuccess = await this.createRecord(
+              mailFromDomain,
+              "TXT",
+              "v=spf1 include:amazonses.com ~all"
+            );
+            if (mailFromSpfSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create SPF record for ${mailFromDomain}`);
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async deleteEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const record = await this.findRecord(name, "CNAME");
+            if (record) {
+              const success = await this.deleteRecord(record.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete DKIM record: ${name}`);
+              }
+            }
+          }
+          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+          if (dmarcRecord) {
+            const success = await this.deleteRecord(dmarcRecord.id);
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push("Failed to delete DMARC record");
+            }
+          }
+          if (mailFromDomain) {
+            const mxRecord = await this.findRecord(mailFromDomain, "MX");
+            if (mxRecord) {
+              const success = await this.deleteRecord(mxRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
+              }
+            }
+            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
+            if (spfRecord) {
+              const success = await this.deleteRecord(spfRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
+              }
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async verifyRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const missing = [];
+        const incorrect = [];
+        for (const token of dkimTokens) {
+          const name = `${token}._domainkey.${domain}`;
+          const expectedValue = `${token}.dkim.amazonses.com`;
+          const record = await this.findRecord(name, "CNAME");
+          if (!record) {
+            missing.push(`DKIM: ${name}`);
+          } else if (record.value !== expectedValue) {
+            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
+          }
+        }
+        const spfRecord = await this.findRecord(domain, "TXT");
+        if (!spfRecord) {
+          missing.push(`SPF: ${domain}`);
+        } else if (!spfRecord.value.includes("include:amazonses.com")) {
+          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
+        }
+        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+        if (!dmarcRecord) {
+          missing.push(`DMARC: _dmarc.${domain}`);
+        }
+        if (mailFromDomain) {
+          const mxRecord = await this.findRecord(mailFromDomain, "MX");
+          if (!mxRecord) {
+            missing.push(`MX: ${mailFromDomain}`);
+          } else if (!mxRecord.value.includes(`feedback-smtp.${region}.amazonses.com`)) {
+            incorrect.push(`MX: ${mailFromDomain}`);
+          }
+          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
+          if (!mailFromSpf) {
+            missing.push(`SPF: ${mailFromDomain}`);
+          }
+        }
+        return {
+          verified: missing.length === 0 && incorrect.length === 0,
+          missing,
+          incorrect
+        };
+      }
+    };
+  }
+});
+
+// src/utils/dns/create-records.ts
+function buildEmailDNSRecords(data) {
+  const { domain, dkimTokens, mailFromDomain, region } = data;
+  const records = [];
+  for (const token of dkimTokens) {
+    records.push({
+      name: `${token}._domainkey.${domain}`,
+      type: "CNAME",
+      value: `${token}.dkim.amazonses.com`,
+      category: "dkim"
+    });
+  }
+  records.push({
+    name: domain,
+    type: "TXT",
+    value: "v=spf1 include:amazonses.com ~all",
+    category: "spf"
+  });
+  const dmarcRuaDomain = mailFromDomain || domain;
+  records.push({
+    name: `_dmarc.${domain}`,
+    type: "TXT",
+    value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
+    category: "dmarc"
+  });
+  if (mailFromDomain) {
+    records.push({
+      name: mailFromDomain,
+      type: "MX",
+      value: `feedback-smtp.${region}.amazonses.com`,
+      priority: 10,
+      category: "mailfrom_mx"
+    });
+    records.push({
+      name: mailFromDomain,
+      type: "TXT",
+      value: "v=spf1 include:amazonses.com ~all",
+      category: "mailfrom_spf"
+    });
+  }
+  return records;
+}
+function formatDNSRecordsForDisplay(records) {
+  return records.map((r) => ({
+    name: r.name,
+    type: r.type,
+    value: r.priority ? `${r.priority} ${r.value}` : r.value
+  }));
+}
+async function createDNSRecordsForProvider(credentials, data, selectedCategories) {
+  switch (credentials.provider) {
+    case "route53": {
+      const categories = selectedCategories || /* @__PURE__ */ new Set([
+        "dkim",
+        "spf",
+        "dmarc",
+        "mailfrom_mx",
+        "mailfrom_spf"
+      ]);
+      try {
+        await createSelectedDNSRecords(
+          credentials.hostedZoneId,
+          data.domain,
+          data.dkimTokens,
+          data.region,
+          categories,
+          void 0,
+          // customTrackingDomain - not used here
+          data.mailFromDomain
+        );
+        let recordsCreated = 0;
+        if (categories.has("dkim")) recordsCreated += data.dkimTokens.length;
+        if (categories.has("spf")) recordsCreated += 1;
+        if (categories.has("dmarc")) recordsCreated += 1;
+        if (data.mailFromDomain) {
+          if (categories.has("mailfrom_mx")) recordsCreated += 1;
+          if (categories.has("mailfrom_spf")) recordsCreated += 1;
+        }
+        return {
+          success: true,
+          recordsCreated
+        };
+      } catch (error) {
+        return {
+          success: false,
+          recordsCreated: 0,
+          errors: [error instanceof Error ? error.message : "Unknown error"]
+        };
+      }
+    }
+    case "vercel": {
+      const client = new VercelDNSClient(
+        data.domain,
+        credentials.token,
+        credentials.teamId
+      );
+      return client.createEmailRecords(data);
+    }
+    case "cloudflare": {
+      const client = new CloudflareDNSClient(
+        credentials.zoneId,
+        credentials.token
+      );
+      return client.createEmailRecords(data);
+    }
+    case "manual": {
+      return {
+        success: true,
+        recordsCreated: 0
+      };
+    }
+  }
+}
+function getDNSProviderDisplayName(provider) {
+  switch (provider) {
+    case "route53":
+      return "AWS Route53";
+    case "vercel":
+      return "Vercel DNS";
+    case "cloudflare":
+      return "Cloudflare";
+    case "manual":
+      return "Manual";
+  }
+}
+function getDNSProviderTokenUrl(provider) {
+  switch (provider) {
+    case "vercel":
+      return "https://vercel.com/account/tokens";
+    case "cloudflare":
+      return "https://dash.cloudflare.com/profile/api-tokens";
+  }
+}
+var init_create_records = __esm({
+  "src/utils/dns/create-records.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_route53();
+    init_cloudflare();
+    init_vercel();
+  }
+});
+
+// src/utils/dns/credentials.ts
+function getDNSProviderEnvVars(provider) {
+  switch (provider) {
+    case "route53":
+      return [];
+    // Uses AWS credentials from environment/config
+    case "vercel":
+      return ["VERCEL_TOKEN"];
+    case "cloudflare":
+      return ["CLOUDFLARE_API_TOKEN"];
+    case "manual":
+      return [];
+  }
+}
+function getDNSProviderOptionalEnvVars(provider) {
+  switch (provider) {
+    case "vercel":
+      return ["VERCEL_TEAM_ID"];
+    case "cloudflare":
+      return ["CLOUDFLARE_ZONE_ID"];
+    default:
+      return [];
+  }
+}
+function hasVercelToken() {
+  return !!process.env.VERCEL_TOKEN;
+}
+function hasCloudflareToken() {
+  return !!process.env.CLOUDFLARE_API_TOKEN;
+}
+async function validateVercelCredentials(token) {
+  try {
+    const response = await fetch("https://api.vercel.com/v2/user", {
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function checkVercelDomain(token, domain, teamId) {
+  try {
+    const teamParam = teamId ? `&teamId=${teamId}` : "";
+    const response = await fetch(
+      `https://api.vercel.com/v5/domains/${domain}?${teamParam}`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function validateCloudflareCredentials(token) {
+  try {
+    const response = await fetch(
+      "https://api.cloudflare.com/client/v4/user/tokens/verify",
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+    const data = await response.json();
+    return data.success === true;
+  } catch {
+    return false;
+  }
+}
+async function findCloudflareZoneId(token, domain) {
+  try {
+    const response = await fetch(
+      `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(domain)}`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json"
+        }
+      }
+    );
+    const data = await response.json();
+    if (data.success && data.result.length > 0) {
+      return data.result[0].id;
+    }
+    const parts = domain.split(".");
+    if (parts.length > 2) {
+      const parentDomain = parts.slice(-2).join(".");
+      const parentResponse = await fetch(
+        `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(parentDomain)}`,
+        {
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json"
+          }
+        }
+      );
+      const parentData = await parentResponse.json();
+      if (parentData.success && parentData.result.length > 0) {
+        return parentData.result[0].id;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getDNSCredentials(provider, domain, region) {
+  switch (provider) {
+    case "route53": {
+      const hostedZone = await findHostedZone(domain, region);
+      if (hostedZone) {
+        return {
+          valid: true,
+          credentials: { provider: "route53", hostedZoneId: hostedZone.id }
+        };
+      }
+      return {
+        valid: false,
+        error: `No Route53 hosted zone found for ${domain}`
+      };
+    }
+    case "vercel": {
+      const token = process.env.VERCEL_TOKEN;
+      if (!token) {
+        return {
+          valid: false,
+          error: "VERCEL_TOKEN environment variable is not set"
+        };
+      }
+      const isValid = await validateVercelCredentials(token);
+      if (!isValid) {
+        return {
+          valid: false,
+          error: "Invalid VERCEL_TOKEN - authentication failed"
+        };
+      }
+      const teamId = process.env.VERCEL_TEAM_ID;
+      const hasDomain = await checkVercelDomain(token, domain, teamId);
+      if (!hasDomain) {
+        return {
+          valid: false,
+          error: `Domain ${domain} not found in Vercel DNS`
+        };
+      }
+      return {
+        valid: true,
+        credentials: { provider: "vercel", token, teamId }
+      };
+    }
+    case "cloudflare": {
+      const token = process.env.CLOUDFLARE_API_TOKEN;
+      if (!token) {
+        return {
+          valid: false,
+          error: "CLOUDFLARE_API_TOKEN environment variable is not set"
+        };
+      }
+      const isValid = await validateCloudflareCredentials(token);
+      if (!isValid) {
+        return {
+          valid: false,
+          error: "Invalid CLOUDFLARE_API_TOKEN - authentication failed"
+        };
+      }
+      let zoneId = process.env.CLOUDFLARE_ZONE_ID;
+      if (!zoneId) {
+        const detectedZoneId = await findCloudflareZoneId(token, domain);
+        zoneId = detectedZoneId ?? void 0;
+      }
+      if (!zoneId) {
+        return {
+          valid: false,
+          error: `Could not find Cloudflare zone for ${domain}. Set CLOUDFLARE_ZONE_ID if the domain uses a different zone.`
+        };
+      }
+      return {
+        valid: true,
+        credentials: { provider: "cloudflare", token, zoneId }
+      };
+    }
+    case "manual":
+      return {
+        valid: true,
+        credentials: { provider: "manual" }
+      };
+  }
+}
+async function detectAvailableDNSProviders(domain, region) {
+  const providers = [];
+  const hostedZone = await findHostedZone(domain, region);
+  providers.push({
+    provider: "route53",
+    detected: !!hostedZone,
+    hint: hostedZone ? "Hosted zone detected" : void 0
+  });
+  const vercelToken = process.env.VERCEL_TOKEN;
+  if (vercelToken) {
+    const teamId = process.env.VERCEL_TEAM_ID;
+    const hasDomain = await checkVercelDomain(vercelToken, domain, teamId);
+    providers.push({
+      provider: "vercel",
+      detected: hasDomain,
+      hint: hasDomain ? "Domain found in Vercel DNS" : "Token found"
+    });
+  } else {
+    providers.push({
+      provider: "vercel",
+      detected: false
+    });
+  }
+  const cfToken = process.env.CLOUDFLARE_API_TOKEN;
+  if (cfToken) {
+    const zoneId = process.env.CLOUDFLARE_ZONE_ID || await findCloudflareZoneId(cfToken, domain);
+    providers.push({
+      provider: "cloudflare",
+      detected: !!zoneId,
+      hint: zoneId ? "Zone found" : "Token found"
+    });
+  } else {
+    providers.push({
+      provider: "cloudflare",
+      detected: false
+    });
+  }
+  providers.push({
+    provider: "manual",
+    detected: true,
+    hint: "I'll add DNS records myself"
+  });
+  return providers.sort((a, b) => {
+    if (a.provider === "manual") return 1;
+    if (b.provider === "manual") return -1;
+    if (a.detected && !b.detected) return -1;
+    if (!a.detected && b.detected) return 1;
+    return 0;
+  });
+}
+var init_credentials = __esm({
+  "src/utils/dns/credentials.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_route53();
+  }
+});
+
+// src/utils/dns/index.ts
+var dns_exports = {};
+__export(dns_exports, {
+  CloudflareDNSClient: () => CloudflareDNSClient,
+  VercelDNSClient: () => VercelDNSClient,
+  buildEmailDNSRecords: () => buildEmailDNSRecords,
+  createDNSRecordsForProvider: () => createDNSRecordsForProvider,
+  detectAvailableDNSProviders: () => detectAvailableDNSProviders,
+  findCloudflareZoneId: () => findCloudflareZoneId,
+  formatDNSRecordsForDisplay: () => formatDNSRecordsForDisplay,
+  getDNSCredentials: () => getDNSCredentials,
+  getDNSProviderDisplayName: () => getDNSProviderDisplayName,
+  getDNSProviderEnvVars: () => getDNSProviderEnvVars,
+  getDNSProviderOptionalEnvVars: () => getDNSProviderOptionalEnvVars,
+  getDNSProviderTokenUrl: () => getDNSProviderTokenUrl,
+  hasCloudflareToken: () => hasCloudflareToken,
+  hasVercelToken: () => hasVercelToken
+});
+var init_dns = __esm({
+  "src/utils/dns/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_cloudflare();
+    init_create_records();
+    init_credentials();
+    init_vercel();
+  }
+});
+
+// src/utils/shared/assume-role.ts
+var assume_role_exports = {};
+__export(assume_role_exports, {
+  assumeRole: () => assumeRole
+});
+import { AssumeRoleCommand, STSClient as STSClient3 } from "@aws-sdk/client-sts";
+async function assumeRole(roleArn, region, sessionName = "wraps-console") {
+  const sts = new STSClient3({ region });
+  const response = await sts.send(
+    new AssumeRoleCommand({
+      RoleArn: roleArn,
+      RoleSessionName: sessionName,
+      DurationSeconds: 3600
+      // 1 hour
+    })
+  );
+  if (!response.Credentials) {
+    throw new Error("Failed to assume role: No credentials returned");
+  }
+  return {
+    accessKeyId: response.Credentials.AccessKeyId,
+    secretAccessKey: response.Credentials.SecretAccessKey,
+    sessionToken: response.Credentials.SessionToken,
+    expiration: response.Credentials.Expiration
+  };
+}
+var init_assume_role = __esm({
+  "src/utils/shared/assume-role.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/utils/archive.ts
+import {
+  GetArchiveMessageCommand,
+  GetArchiveSearchResultsCommand,
+  MailManagerClient as MailManagerClient2,
+  StartArchiveSearchCommand
+} from "@aws-sdk/client-mailmanager";
+import DOMPurify from "isomorphic-dompurify";
+import { simpleParser } from "mailparser";
+function extractArchiveId(archiveArnOrId) {
+  if (archiveArnOrId.startsWith("arn:")) {
+    const parts = archiveArnOrId.split("/");
+    return parts.at(-1);
+  }
+  return archiveArnOrId;
+}
+async function getArchivedEmail(archiveArnOrId, searchCriteria, region) {
+  const client = new MailManagerClient2({ region });
+  const archiveId = extractArchiveId(archiveArnOrId);
+  const searchTime = searchCriteria.timestamp || /* @__PURE__ */ new Date();
+  const dayBefore = new Date(searchTime.getTime() - 24 * 60 * 60 * 1e3);
+  const dayAfter = new Date(searchTime.getTime() + 24 * 60 * 60 * 1e3);
+  const filters = [];
+  if (searchCriteria.from) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "FROM"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.from]
+      }
+    });
+  }
+  if (searchCriteria.to) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "TO"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.to]
+      }
+    });
+  }
+  if (searchCriteria.subject) {
+    filters.push({
+      StringExpression: {
+        Evaluate: {
+          Attribute: "SUBJECT"
+        },
+        Operator: "CONTAINS",
+        Values: [searchCriteria.subject]
+      }
+    });
+  }
+  if (filters.length === 0) {
+    throw new Error(
+      "At least one search criterion (from, to, or subject) is required"
+    );
+  }
+  const searchCommand = new StartArchiveSearchCommand({
+    ArchiveId: archiveId,
+    FromTimestamp: dayBefore,
+    ToTimestamp: dayAfter,
+    Filters: {
+      Include: filters
+    },
+    MaxResults: 10
+    // Get a few results in case there are multiple matches
+  });
+  const searchResponse = await client.send(searchCommand);
+  const searchId = searchResponse.SearchId;
+  if (!searchId) {
+    throw new Error("Failed to start archive search");
+  }
+  let archivedMessageId;
+  let attempts = 0;
+  const maxAttempts = 20;
+  const pollInterval = 1e3;
+  await new Promise((resolve) => setTimeout(resolve, 1e3));
+  while (attempts < maxAttempts) {
+    try {
+      const resultsCommand = new GetArchiveSearchResultsCommand({
+        SearchId: searchId
+      });
+      const resultsResponse = await client.send(resultsCommand);
+      if (resultsResponse.Rows && resultsResponse.Rows.length > 0) {
+        archivedMessageId = resultsResponse.Rows[0].ArchivedMessageId;
+        break;
+      }
+      if (resultsResponse.Rows && resultsResponse.Rows.length === 0) {
+        break;
+      }
+    } catch (error) {
+      if (error instanceof Error && error.name === "ConflictException" && error.message.includes("still in progress")) {
+        console.log(`Search still in progress, attempt ${attempts + 1}...`);
+      } else {
+        throw error;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    attempts++;
+  }
+  if (!archivedMessageId) {
+    throw new Error(
+      "Email not found in archive with the provided search criteria. It may have been sent before archiving was enabled."
+    );
+  }
+  const command = new GetArchiveMessageCommand({
+    ArchivedMessageId: archivedMessageId
+  });
+  const response = await client.send(command);
+  if (!response.MessageDownloadLink) {
+    throw new Error("No download link available for archived message");
+  }
+  const emailResponse = await fetch(response.MessageDownloadLink);
+  if (!emailResponse.ok) {
+    throw new Error(`Failed to download email: ${emailResponse.statusText}`);
+  }
+  const emailRaw = await emailResponse.text();
+  const parsed = await simpleParser(emailRaw);
+  const attachments = parsed.attachments?.map((att) => ({
+    filename: att.filename,
+    contentType: att.contentType,
+    size: att.size
+  })) || [];
+  const headers = {};
+  if (parsed.headers) {
+    for (const [key, value] of parsed.headers) {
+      if (value instanceof Date) {
+        headers[key] = value.toISOString();
+      } else if (typeof value === "string") {
+        headers[key] = value;
+      } else if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        headers[key] = value;
+      } else {
+        headers[key] = JSON.stringify(value);
+      }
+    }
+  }
+  const getAddressText = (addr) => {
+    if (!addr) {
+      return "";
+    }
+    if (Array.isArray(addr)) {
       return addr.map((a) => a.text).join(", ");
     }
     return addr.text || "";
@@ -4758,7 +5735,7 @@ import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import * as clack37 from "@clack/prompts";
 import args from "args";
-import pc39 from "picocolors";
+import pc40 from "picocolors";
 
 // src/commands/aws/doctor.ts
 init_esm_shims();
@@ -6885,8 +7862,8 @@ init_esm_shims();
 import * as aws2 from "@pulumi/aws";
 async function getExistingOIDCProviderArn(url) {
   try {
-    const { IAMClient: IAMClient3, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
-    const iam8 = new IAMClient3({
+    const { IAMClient: IAMClient4, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
+    const iam8 = new IAMClient4({
       region: process.env.AWS_REGION || "us-east-1"
     });
     const response = await iam8.send(new ListOpenIDConnectProvidersCommand({}));
@@ -6943,11 +7920,11 @@ async function createVercelOIDC(config2) {
 // src/infrastructure/cdn-stack.ts
 async function roleExists(roleName) {
   try {
-    const { IAMClient: IAMClient3, GetRoleCommand: GetRoleCommand2 } = await import("@aws-sdk/client-iam");
-    const iam8 = new IAMClient3({
+    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam8 = new IAMClient4({
       region: process.env.AWS_REGION || "us-east-1"
     });
-    await iam8.send(new GetRoleCommand2({ RoleName: roleName }));
+    await iam8.send(new GetRoleCommand3({ RoleName: roleName }));
     return true;
   } catch (error) {
     if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
@@ -12300,11 +13277,11 @@ import * as aws7 from "@pulumi/aws";
 import * as pulumi10 from "@pulumi/pulumi";
 async function roleExists2(roleName) {
   try {
-    const { IAMClient: IAMClient3, GetRoleCommand: GetRoleCommand2 } = await import("@aws-sdk/client-iam");
-    const iam8 = new IAMClient3({
+    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam8 = new IAMClient4({
       region: process.env.AWS_REGION || "us-east-1"
     });
-    await iam8.send(new GetRoleCommand2({ RoleName: roleName }));
+    await iam8.send(new GetRoleCommand3({ RoleName: roleName }));
     return true;
   } catch (error) {
     if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
@@ -12689,8 +13666,8 @@ function convertToSMTPPassword2(secretAccessKey, region) {
 }
 async function userExists(userName) {
   try {
-    const { IAMClient: IAMClient3, GetUserCommand } = await import("@aws-sdk/client-iam");
-    const iam8 = new IAMClient3({
+    const { IAMClient: IAMClient4, GetUserCommand } = await import("@aws-sdk/client-iam");
+    const iam8 = new IAMClient4({
       region: process.env.AWS_REGION || "us-east-1"
     });
     await iam8.send(new GetUserCommand({ UserName: userName }));
@@ -14585,8 +15562,8 @@ function getRequiredActions(config2) {
 }
 async function checkIAMPermissions(userArn, actions, region) {
   try {
-    const { IAMClient: IAMClient3, SimulatePrincipalPolicyCommand } = await import("@aws-sdk/client-iam");
-    const client = new IAMClient3({ region });
+    const { IAMClient: IAMClient4, SimulatePrincipalPolicyCommand } = await import("@aws-sdk/client-iam");
+    const client = new IAMClient4({ region });
     const batchSize = 100;
     const batches = [];
     for (let i = 0; i < actions.length; i += batchSize) {
@@ -14978,51 +15955,149 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
   await saveConnectionMetadata(metadata);
   progress.info("Connection metadata saved for upgrade and restore capability");
   let dnsAutoCreated = false;
+  let dnsProvider;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, previewDNSChanges: previewDNSChanges2, createSelectedDNSRecords: createSelectedDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const { promptDNSManagement: promptDNSManagement2, promptDNSConfirmation: promptDNSConfirmation2 } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
-    if (hostedZone) {
-      const manageDNS = await promptDNSManagement2(outputs.domain);
-      if (manageDNS) {
-        try {
-          progress.start("Checking existing DNS records");
-          const dnsPreview = await previewDNSChanges2(
-            hostedZone.id,
-            outputs.domain,
-            outputs.dkimTokens,
-            region,
-            outputs.customTrackingDomain,
-            outputs.mailFromDomain
-          );
-          progress.stop();
-          const { shouldCreate, selectedCategories } = await promptDNSConfirmation2(dnsPreview);
-          if (shouldCreate && selectedCategories.size > 0) {
-            progress.start("Creating selected DNS records in Route53");
-            await createSelectedDNSRecords2(
-              hostedZone.id,
+    const {
+      detectAvailableDNSProviders: detectAvailableDNSProviders2,
+      getDNSCredentials: getDNSCredentials2,
+      createDNSRecordsForProvider: createDNSRecordsForProvider2,
+      getDNSProviderDisplayName: getDNSProviderDisplayName2,
+      getDNSProviderTokenUrl: getDNSProviderTokenUrl2,
+      buildEmailDNSRecords: buildEmailDNSRecords2
+    } = await Promise.resolve().then(() => (init_dns(), dns_exports));
+    const {
+      promptDNSProvider: promptDNSProvider2,
+      promptDNSConfirmation: promptDNSConfirmation2,
+      promptContinueManualDNS: promptContinueManualDNS2
+    } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
+    const { previewDNSChanges: previewDNSChanges2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    progress.start("Detecting DNS providers");
+    const availableProviders = await detectAvailableDNSProviders2(
+      outputs.domain,
+      region
+    );
+    progress.stop();
+    const selectedProvider = await promptDNSProvider2(
+      outputs.domain,
+      availableProviders
+    );
+    dnsProvider = selectedProvider;
+    if (selectedProvider !== "manual") {
+      progress.start(
+        `Validating ${getDNSProviderDisplayName2(selectedProvider)} credentials`
+      );
+      const credentialResult2 = await getDNSCredentials2(
+        selectedProvider,
+        outputs.domain,
+        region
+      );
+      progress.stop();
+      if (credentialResult2.valid && credentialResult2.credentials) {
+        const credentials = credentialResult2.credentials;
+        if (credentials.provider === "route53") {
+          try {
+            progress.start("Checking existing DNS records");
+            const dnsPreview = await previewDNSChanges2(
+              credentials.hostedZoneId,
               outputs.domain,
               outputs.dkimTokens,
               region,
-              selectedCategories,
               outputs.customTrackingDomain,
               outputs.mailFromDomain
             );
+            progress.stop();
+            const { shouldCreate, selectedCategories } = await promptDNSConfirmation2(dnsPreview);
+            if (shouldCreate && selectedCategories.size > 0) {
+              progress.start("Creating selected DNS records in Route53");
+              const result = await createDNSRecordsForProvider2(
+                credentials,
+                {
+                  domain: outputs.domain,
+                  dkimTokens: outputs.dkimTokens,
+                  mailFromDomain: outputs.mailFromDomain,
+                  region
+                },
+                selectedCategories
+              );
+              if (result.success) {
+                progress.succeed(
+                  `Created ${selectedCategories.size} DNS record group(s) in Route53`
+                );
+                dnsAutoCreated = true;
+              } else {
+                progress.fail("Failed to create some DNS records");
+                if (result.errors) {
+                  for (const error of result.errors) {
+                    clack17.log.warn(error);
+                  }
+                }
+              }
+            } else {
+              clack17.log.info(
+                "Skipping DNS record creation. You can add them manually."
+              );
+            }
+          } catch (error) {
+            progress.stop();
+            clack17.log.warn(`Could not manage DNS records: ${error.message}`);
+          }
+        } else {
+          const recordData = {
+            domain: outputs.domain,
+            dkimTokens: outputs.dkimTokens,
+            mailFromDomain: outputs.mailFromDomain,
+            region
+          };
+          const records = buildEmailDNSRecords2(recordData);
+          clack17.log.info(pc18.bold("DNS records to create:"));
+          for (const record of records) {
+            clack17.log.info(
+              pc18.dim(`  ${record.type} ${record.name} \u2192 ${record.value}`)
+            );
+          }
+          progress.start(
+            `Creating DNS records in ${getDNSProviderDisplayName2(credentials.provider)}`
+          );
+          const result = await createDNSRecordsForProvider2(
+            credentials,
+            recordData
+          );
+          if (result.success) {
             progress.succeed(
-              `Created ${selectedCategories.size} DNS record group(s) in Route53`
+              `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(credentials.provider)}`
             );
             dnsAutoCreated = true;
           } else {
-            clack17.log.info(
-              "Skipping DNS record creation. You can add them manually."
-            );
+            progress.fail("Failed to create some DNS records");
+            if (result.errors) {
+              for (const error of result.errors) {
+                clack17.log.warn(error);
+              }
+            }
           }
-        } catch (error) {
-          progress.stop();
-          clack17.log.warn(`Could not manage DNS records: ${error.message}`);
+        }
+      } else {
+        clack17.log.warn(
+          credentialResult2.error || "Could not validate credentials"
+        );
+        if (selectedProvider === "vercel" || selectedProvider === "cloudflare") {
+          clack17.log.info(
+            `Set the ${selectedProvider === "vercel" ? "VERCEL_TOKEN" : "CLOUDFLARE_API_TOKEN"} environment variable to enable automatic DNS management.`
+          );
+          clack17.log.info(
+            `You can create a token at: ${pc18.cyan(getDNSProviderTokenUrl2(selectedProvider))}`
+          );
+        }
+        const continueManual = await promptContinueManualDNS2();
+        if (continueManual) {
+          dnsProvider = "manual";
         }
       }
     }
+    if (dnsProvider && metadata.services.email) {
+      metadata.services.email.dnsProvider = dnsProvider;
+      await saveConnectionMetadata(metadata);
+    }
   }
   const dnsRecords = [];
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0 && !dnsAutoCreated) {
@@ -15380,6 +16455,8 @@ import * as clack20 from "@clack/prompts";
 import * as pulumi18 from "@pulumi/pulumi";
 import pc21 from "picocolors";
 init_events();
+init_create_records();
+init_credentials();
 init_costs();
 init_presets();
 init_aws();
@@ -15820,35 +16897,54 @@ ${pc21.bold("Current Configuration:")}
             "This ensures all tracking links use secure HTTPS connections."
           )
         );
-        const { findHostedZone: findHostedZone2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-        const hostedZone = await progress.execute(
-          "Checking for Route53 hosted zone",
-          async () => await findHostedZone2(trackingDomain || config2.domain, region)
-        );
-        if (hostedZone) {
-          progress.info(
-            `Found Route53 hosted zone: ${pc21.cyan(hostedZone.name)} ${pc21.green("\u2713")}`
-          );
-          clack20.log.info(
-            pc21.dim(
-              "DNS records (SSL certificate validation + CloudFront) will be created automatically."
-            )
-          );
+        let trackingDnsProvider = metadata.services.email?.dnsProvider;
+        let canAutomateDNS = false;
+        if (trackingDnsProvider) {
+          canAutomateDNS = trackingDnsProvider !== "manual";
+          if (canAutomateDNS) {
+            progress.info(
+              `Will use ${pc21.cyan(getDNSProviderDisplayName(trackingDnsProvider))} for DNS records ${pc21.green("\u2713")}`
+            );
+          }
         } else {
-          clack20.log.warn(
-            `No Route53 hosted zone found for ${pc21.cyan(trackingDomain || config2.domain)}`
-          );
-          clack20.log.info(
-            pc21.dim(
-              "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
+          const availableProviders = await progress.execute(
+            "Detecting available DNS providers",
+            async () => await detectAvailableDNSProviders(
+              trackingDomain || config2.domain,
+              region
             )
           );
-          clack20.log.info(
-            pc21.dim("DNS record details will be shown after deployment.")
+          const detectedProvider = availableProviders.find(
+            (p) => p.detected && p.provider !== "manual"
           );
+          if (detectedProvider) {
+            trackingDnsProvider = detectedProvider.provider;
+            canAutomateDNS = true;
+            progress.info(
+              `Found ${pc21.cyan(getDNSProviderDisplayName(detectedProvider.provider))} ${pc21.green("\u2713")}`
+            );
+            clack20.log.info(
+              pc21.dim(
+                "DNS records (SSL certificate validation + CloudFront) will be created automatically."
+              )
+            );
+          } else {
+            canAutomateDNS = false;
+            clack20.log.warn(
+              `No automatic DNS provider detected for ${pc21.cyan(trackingDomain || config2.domain)}`
+            );
+            clack20.log.info(
+              pc21.dim(
+                "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
+              )
+            );
+            clack20.log.info(
+              pc21.dim("DNS record details will be shown after deployment.")
+            );
+          }
         }
         const confirmHttps = await clack20.confirm({
-          message: hostedZone ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
+          message: canAutomateDNS ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
           initialValue: true
         });
         if (clack20.isCancel(confirmHttps) || !confirmHttps) {
@@ -16660,31 +17756,103 @@ ${pc21.bold("Cost Impact:")}`);
     trackError("UPGRADE_FAILED", "email:upgrade", { step: "deploy" });
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
+  let dnsAutoCreated = false;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
-    if (hostedZone) {
-      try {
-        progress.start("Creating DNS records in Route53");
-        const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
-        await createDNSRecords2(
-          hostedZone.id,
+    let dnsProvider = metadata.services.email?.dnsProvider;
+    if (!dnsProvider) {
+      const availableProviders = await progress.execute(
+        "Detecting available DNS providers",
+        async () => await detectAvailableDNSProviders(outputs.domain, region)
+      );
+      const detectedProvider = availableProviders.find(
+        (p) => p.detected && p.provider !== "manual"
+      );
+      if (detectedProvider) {
+        dnsProvider = await promptDNSProvider(
           outputs.domain,
-          outputs.dkimTokens,
-          region,
-          outputs.customTrackingDomain,
-          mailFromDomain,
-          outputs.cloudFrontDomain
-        );
-        progress.succeed("DNS records created in Route53");
-      } catch (error) {
-        progress.fail(
-          `Failed to create DNS records automatically: ${error.message}`
+          availableProviders
         );
-        progress.info(
-          "You can manually add the required DNS records shown below"
+        if (dnsProvider && dnsProvider !== "manual" && metadata.services.email) {
+          metadata.services.email.dnsProvider = dnsProvider;
+        }
+      }
+    }
+    if (dnsProvider && dnsProvider !== "manual") {
+      const credResult = await progress.execute(
+        `Validating ${getDNSProviderDisplayName(dnsProvider)} credentials`,
+        async () => await getDNSCredentials(dnsProvider, outputs.domain, region)
+      );
+      if (credResult.valid && credResult.credentials) {
+        const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
+        const dnsData = {
+          domain: outputs.domain,
+          dkimTokens: outputs.dkimTokens,
+          mailFromDomain,
+          region
+        };
+        try {
+          progress.start(
+            `Creating DNS records in ${getDNSProviderDisplayName(dnsProvider)}`
+          );
+          const result = await createDNSRecordsForProvider(
+            credResult.credentials,
+            dnsData
+          );
+          if (result.success) {
+            progress.succeed(
+              `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName(dnsProvider)}`
+            );
+            dnsAutoCreated = true;
+          } else {
+            progress.fail(
+              `Failed to create some DNS records: ${result.errors?.join(", ")}`
+            );
+            progress.info(
+              "You can manually add the required DNS records shown below"
+            );
+          }
+        } catch (error) {
+          progress.fail(
+            `Failed to create DNS records automatically: ${error.message}`
+          );
+          progress.info(
+            "You can manually add the required DNS records shown below"
+          );
+        }
+      } else {
+        clack20.log.warn(
+          credResult.error || `Unable to validate ${getDNSProviderDisplayName(dnsProvider)} credentials`
         );
+        if (dnsProvider === "vercel" || dnsProvider === "cloudflare") {
+          clack20.log.info(
+            `Set ${dnsProvider === "vercel" ? "VERCEL_TOKEN" : "CLOUDFLARE_API_TOKEN"} to enable automatic DNS management.`
+          );
+          clack20.log.info(
+            `You can create a token at: ${pc21.cyan(getDNSProviderTokenUrl(dnsProvider))}`
+          );
+        }
+      }
+    }
+    if (!dnsAutoCreated) {
+      const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
+      const dnsData = {
+        domain: outputs.domain,
+        dkimTokens: outputs.dkimTokens,
+        mailFromDomain,
+        region
+      };
+      const dnsRecords = buildEmailDNSRecords(dnsData);
+      const displayRecords = formatDNSRecordsForDisplay(dnsRecords);
+      console.log(
+        `
+${pc21.bold("Add these DNS records to your DNS provider:")}
+`
+      );
+      for (const record of displayRecords) {
+        console.log(`  ${pc21.cyan(record.type)} ${record.name}`);
+        console.log(`       ${pc21.dim(record.value)}`);
       }
+      console.log("");
     }
   }
   updateEmailConfig(metadata, updatedConfig);
@@ -17257,127 +18425,578 @@ ${pc23.dim("Service:")} ${pc23.cyan(serviceLabel)}`);
         `  ${pc23.green("+")} ${pc23.bold("SQS")} - Event queuing (Production+)`
       );
       console.log(
-        `  ${pc23.green("+")} ${pc23.bold("Lambda")} - Event processing (Production+)`
+        `  ${pc23.green("+")} ${pc23.bold("Lambda")} - Event processing (Production+)`
+      );
+      console.log(
+        `  ${pc23.green("+")} ${pc23.bold("DynamoDB")} - Email history (Production+)`
+      );
+    }
+    console.log(
+      `  ${pc23.yellow("?")} ${pc23.bold("Route53")} - Auto DNS ${pc23.dim("(optional)")}`
+    );
+    console.log(
+      `  ${pc23.yellow("?")} ${pc23.bold("IAM OIDC")} - Vercel integration ${pc23.dim("(if using Vercel)")}`
+    );
+  }
+  if (!service || service === "sms") {
+    console.log(
+      `  ${pc23.green("+")} ${pc23.bold("SMS Voice")} - SMS sending & management`
+    );
+    console.log(`  ${pc23.green("+")} ${pc23.bold("DynamoDB")} - Message history`);
+    console.log(`  ${pc23.green("+")} ${pc23.bold("Lambda")} - Event processing`);
+  }
+  if (!service || service === "cdn") {
+    console.log(`  ${pc23.green("+")} ${pc23.bold("S3")} - Asset storage`);
+    console.log(
+      `  ${pc23.green("+")} ${pc23.bold("CloudFront")} - CDN distribution`
+    );
+    console.log(`  ${pc23.green("+")} ${pc23.bold("ACM")} - SSL certificates`);
+    console.log(
+      `  ${pc23.yellow("?")} ${pc23.bold("Route53")} - DNS management ${pc23.dim("(optional)")}`
+    );
+  }
+  console.log(`
+${pc23.dim("Get full IAM policy JSON:")}`);
+  console.log(`  ${pc23.cyan("wraps permissions --json")}`);
+  if (service) {
+    console.log(`
+${pc23.dim("Get permissions for all services:")}`);
+    console.log(`  ${pc23.cyan("wraps permissions")}`);
+  }
+  console.log(`
+${pc23.dim("Documentation:")}`);
+  console.log(
+    `  ${pc23.blue("https://wraps.dev/docs/guides/aws-setup/permissions")}
+`
+  );
+}
+async function permissions(options) {
+  const startTime = Date.now();
+  trackCommand("permissions", {
+    json: options.json,
+    preset: options.preset,
+    service: options.service
+  });
+  const policy = buildPolicy(options.service, options.preset);
+  if (options.json) {
+    console.log(JSON.stringify(policy, null, 2));
+  } else {
+    displaySummary(options.service, options.preset);
+    console.log(pc23.bold("Quick Setup:\n"));
+    console.log("1. Copy the IAM policy:");
+    console.log(
+      `   ${pc23.cyan("wraps permissions --json > wraps-policy.json")}
+`
+    );
+    console.log("2. Create the policy in AWS Console:");
+    console.log("   IAM > Policies > Create Policy > JSON\n");
+    console.log("3. Attach to your IAM user/role\n");
+    clack22.outro(
+      pc23.green("Run with --json to get the full IAM policy document")
+    );
+  }
+  trackCommand("permissions", {
+    success: true,
+    duration_ms: Date.now() - startTime
+  });
+}
+
+// src/commands/platform/connect.ts
+init_esm_shims();
+import {
+  GetRoleCommand,
+  IAMClient as IAMClient2,
+  PutRolePolicyCommand
+} from "@aws-sdk/client-iam";
+import { confirm as confirm11, intro as intro21, isCancel as isCancel16, log as log21, outro as outro18, select as select12 } from "@clack/prompts";
+import * as pulumi19 from "@pulumi/pulumi";
+import pc24 from "picocolors";
+init_events();
+init_aws();
+init_fs();
+init_metadata();
+init_prompts();
+function buildConsolePolicyDocument(emailConfig, smsConfig) {
+  const statements = [];
+  statements.push({
+    Effect: "Allow",
+    Action: [
+      "ses:GetAccount",
+      "ses:GetSendStatistics",
+      "ses:ListIdentities",
+      "ses:GetIdentityVerificationAttributes",
+      "ses:ListEmailIdentities",
+      "ses:GetEmailIdentity",
+      "ses:GetConfigurationSet",
+      "ses:GetConfigurationSetEventDestinations",
+      "cloudwatch:GetMetricData",
+      "cloudwatch:GetMetricStatistics"
+    ],
+    Resource: "*"
+  });
+  statements.push({
+    Effect: "Allow",
+    Action: [
+      "ses:GetTemplate",
+      "ses:ListTemplates",
+      "ses:CreateTemplate",
+      "ses:UpdateTemplate",
+      "ses:DeleteTemplate",
+      "ses:TestRenderTemplate"
+    ],
+    Resource: "*"
+  });
+  const sendingEnabled = !emailConfig || emailConfig.sendingEnabled !== false;
+  if (sendingEnabled) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "ses:SendEmail",
+        "ses:SendRawEmail",
+        "ses:SendTemplatedEmail",
+        "ses:SendBulkTemplatedEmail",
+        "ses:SendBulkEmail"
+      ],
+      Resource: "*"
+    });
+  }
+  const eventTracking = emailConfig?.eventTracking;
+  if (eventTracking?.dynamoDBHistory) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "dynamodb:PutItem",
+        "dynamodb:GetItem",
+        "dynamodb:Query",
+        "dynamodb:Scan",
+        "dynamodb:BatchGetItem",
+        "dynamodb:DescribeTable"
+      ],
+      Resource: [
+        "arn:aws:dynamodb:*:*:table/wraps-email-*",
+        "arn:aws:dynamodb:*:*:table/wraps-email-*/index/*"
+      ]
+    });
+  }
+  if (eventTracking?.enabled) {
+    statements.push({
+      Effect: "Allow",
+      Action: ["events:PutEvents", "events:DescribeEventBus"],
+      Resource: "arn:aws:events:*:*:event-bus/wraps-email-*"
+    });
+  }
+  if (eventTracking?.enabled) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "sqs:SendMessage",
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:GetQueueAttributes"
+      ],
+      Resource: "arn:aws:sqs:*:*:wraps-email-*"
+    });
+  }
+  const emailArchiving = emailConfig?.emailArchiving;
+  if (emailArchiving?.enabled) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "ses:StartArchiveSearch",
+        "ses:GetArchiveSearchResults",
+        "ses:GetArchiveMessage",
+        "ses:GetArchiveMessageContent",
+        "ses:GetArchive",
+        "ses:ListArchives",
+        "ses:StartArchiveExport",
+        "ses:GetArchiveExport"
+      ],
+      Resource: "arn:aws:ses:*:*:mailmanager-archive/*"
+    });
+  }
+  if (smsConfig) {
+    statements.push({
+      Effect: "Allow",
+      Action: [
+        "sms-voice:DescribeAccountAttributes",
+        "sms-voice:DescribeSpendLimits",
+        "sms-voice:DescribeConfigurationSets",
+        "sms-voice:DescribeOptOutLists",
+        "sms-voice:DescribeOptedOutNumbers",
+        "sms-voice:DescribePools",
+        "sms-voice:DescribePhoneNumbers",
+        "sms-voice:DescribeProtectConfigurations",
+        "sms-voice:DescribeRegistrations",
+        "sms-voice:DescribeRegistrationAttachments",
+        "sms-voice:DescribeRegistrationFieldDefinitions",
+        "sms-voice:DescribeRegistrationFieldValues",
+        "sms-voice:DescribeRegistrationSectionDefinitions",
+        "sms-voice:DescribeRegistrationVersions"
+      ],
+      Resource: "*"
+    });
+    const smsSendingEnabled = smsConfig.sendingEnabled !== false;
+    if (smsSendingEnabled) {
+      statements.push({
+        Effect: "Allow",
+        Action: ["sms-voice:SendTextMessage", "sms-voice:SendMediaMessage"],
+        Resource: "*"
+      });
+    }
+    const smsEventTracking = smsConfig.eventTracking;
+    if (smsEventTracking?.dynamoDBHistory) {
+      statements.push({
+        Effect: "Allow",
+        Action: [
+          "dynamodb:GetItem",
+          "dynamodb:Query",
+          "dynamodb:Scan",
+          "dynamodb:BatchGetItem",
+          "dynamodb:DescribeTable"
+        ],
+        Resource: [
+          "arn:aws:dynamodb:*:*:table/wraps-sms-*",
+          "arn:aws:dynamodb:*:*:table/wraps-sms-*/index/*"
+        ]
+      });
+    }
+    if (smsEventTracking?.enabled) {
+      statements.push({
+        Effect: "Allow",
+        Action: ["sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic"],
+        Resource: "arn:aws:sns:*:*:wraps-sms-*"
+      });
+    }
+  }
+  return {
+    Version: "2012-10-17",
+    Statement: statements
+  };
+}
+async function connect3(options) {
+  const startTime = Date.now();
+  intro21(pc24.bold("Connect to Wraps Platform"));
+  const progress = new DeploymentProgress();
+  try {
+    const wasAutoInstalled = await progress.execute(
+      "Checking Pulumi CLI installation",
+      async () => await ensurePulumiInstalled()
+    );
+    if (wasAutoInstalled) {
+      progress.info("Pulumi CLI was automatically installed");
+    }
+    const identity = await progress.execute(
+      "Validating AWS credentials",
+      async () => validateAWSCredentials()
+    );
+    progress.info(`Connected to AWS account: ${pc24.cyan(identity.accountId)}`);
+    let region = options.region;
+    if (!region) {
+      region = await getAWSRegion();
+    }
+    const metadata = await loadConnectionMetadata(identity.accountId, region);
+    if (!metadata) {
+      progress.stop();
+      log21.error(
+        `No Wraps deployment found for account ${pc24.cyan(identity.accountId)} in region ${pc24.cyan(region)}`
+      );
+      console.log(
+        `
+Run ${pc24.cyan("wraps email init")} to deploy infrastructure first.
+`
       );
+      process.exit(1);
+    }
+    const hasEmail = !!metadata.services.email?.config;
+    const hasSms = !!metadata.services.sms?.config;
+    if (!(hasEmail || hasSms)) {
+      progress.stop();
+      log21.error("No services deployed in this region.");
       console.log(
-        `  ${pc23.green("+")} ${pc23.bold("DynamoDB")} - Email history (Production+)`
+        `
+Run ${pc24.cyan("wraps email init")} or ${pc24.cyan("wraps sms init")} first.
+`
       );
+      process.exit(1);
+    }
+    progress.info(
+      `Found services: ${[hasEmail && "email", hasSms && "sms"].filter(Boolean).join(", ")}`
+    );
+    let webhookSecret;
+    let needsDeployment = false;
+    if (hasEmail) {
+      const emailConfig = metadata.services.email.config;
+      const existingSecret = metadata.services.email.webhookSecret;
+      if (!emailConfig.eventTracking?.enabled) {
+        progress.stop();
+        log21.warn(
+          "Event tracking must be enabled to connect to the Wraps Platform."
+        );
+        log21.info(
+          "Enabling event tracking will allow SES events to be streamed to the dashboard."
+        );
+        const enableEventTracking = await confirm11({
+          message: "Enable event tracking now?",
+          initialValue: true
+        });
+        if (isCancel16(enableEventTracking) || !enableEventTracking) {
+          outro18("Platform connection cancelled.");
+          process.exit(0);
+        }
+        metadata.services.email.config = {
+          ...emailConfig,
+          eventTracking: {
+            enabled: true,
+            eventBridge: true,
+            events: [
+              "SEND",
+              "DELIVERY",
+              "OPEN",
+              "CLICK",
+              "BOUNCE",
+              "COMPLAINT"
+            ],
+            dynamoDBHistory: emailConfig.eventTracking?.dynamoDBHistory ?? false,
+            archiveRetention: emailConfig.eventTracking?.archiveRetention ?? "90days"
+          }
+        };
+        needsDeployment = true;
+      }
+      if (existingSecret) {
+        progress.stop();
+        log21.info(
+          `Already connected to Wraps Platform (AWS Account: ${pc24.cyan(metadata.accountId)})`
+        );
+        const action = await select12({
+          message: "What would you like to do?",
+          options: [
+            {
+              value: "keep",
+              label: "Keep current connection",
+              hint: "Continue with existing webhook secret"
+            },
+            {
+              value: "regenerate",
+              label: "Regenerate webhook secret",
+              hint: "Create new secret (requires update in dashboard)"
+            },
+            {
+              value: "disconnect",
+              label: "Disconnect from platform",
+              hint: "Stop sending events to Wraps"
+            }
+          ]
+        });
+        if (isCancel16(action)) {
+          outro18("Operation cancelled");
+          process.exit(0);
+        }
+        if (action === "keep") {
+          webhookSecret = existingSecret;
+        } else if (action === "disconnect") {
+          const confirmDisconnect = await confirm11({
+            message: "Are you sure? Events will no longer be sent to the Wraps Platform.",
+            initialValue: false
+          });
+          if (isCancel16(confirmDisconnect) || !confirmDisconnect) {
+            outro18("Disconnect cancelled");
+            process.exit(0);
+          }
+          metadata.services.email.webhookSecret = void 0;
+          needsDeployment = true;
+          webhookSecret = void 0;
+        } else {
+          webhookSecret = generateWebhookSecret();
+          metadata.services.email.webhookSecret = webhookSecret;
+          needsDeployment = true;
+        }
+      } else {
+        webhookSecret = generateWebhookSecret();
+        metadata.services.email.webhookSecret = webhookSecret;
+        needsDeployment = true;
+      }
+    }
+    if (needsDeployment && hasEmail) {
+      let vercelConfig;
+      if (metadata.provider === "vercel" && !metadata.vercel) {
+        progress.stop();
+        vercelConfig = await promptVercelConfig();
+      } else if (metadata.provider === "vercel") {
+        vercelConfig = metadata.vercel;
+      }
+      const stackConfig = {
+        provider: metadata.provider,
+        region,
+        vercel: vercelConfig,
+        emailConfig: metadata.services.email.config,
+        webhook: webhookSecret ? {
+          awsAccountNumber: metadata.accountId,
+          webhookSecret
+        } : void 0
+      };
+      await progress.execute("Configuring event streaming", async () => {
+        await ensurePulumiWorkDir();
+        const stack = await pulumi19.automation.LocalWorkspace.createOrSelectStack(
+          {
+            stackName: metadata.services.email?.pulumiStackName || `wraps-${identity.accountId}-${region}`,
+            projectName: "wraps-email",
+            program: async () => {
+              const result = await deployEmailStack(stackConfig);
+              return {
+                roleArn: result.roleArn,
+                configSetName: result.configSetName,
+                tableName: result.tableName,
+                region: result.region
+              };
+            }
+          },
+          {
+            workDir: getPulumiWorkDir(),
+            envVars: {
+              PULUMI_CONFIG_PASSPHRASE: "",
+              AWS_REGION: region
+            },
+            secretsProvider: "passphrase"
+          }
+        );
+        await stack.setConfig("aws:region", { value: region });
+        await stack.refresh({ onOutput: () => {
+        } });
+        await stack.up({ onOutput: () => {
+        } });
+      });
+      progress.succeed("Event streaming configured");
+    } else if (!needsDeployment && hasEmail && webhookSecret) {
+      progress.succeed("Event streaming already configured");
+    }
+    const roleName = "wraps-console-access-role";
+    const iam8 = new IAMClient2({ region: "us-east-1" });
+    let roleExists4 = false;
+    try {
+      await iam8.send(new GetRoleCommand({ RoleName: roleName }));
+      roleExists4 = true;
+    } catch (error) {
+      if (error && typeof error === "object" && "name" in error && error.name !== "NoSuchEntity") {
+        throw error;
+      }
+    }
+    if (roleExists4) {
+      const emailConfig = metadata.services.email?.config;
+      const smsConfig = metadata.services.sms?.config;
+      const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
+      await progress.execute("Updating platform access role", async () => {
+        await iam8.send(
+          new PutRolePolicyCommand({
+            RoleName: roleName,
+            PolicyName: "wraps-console-access-policy",
+            PolicyDocument: JSON.stringify(policy, null, 2)
+          })
+        );
+      });
+      progress.succeed("Platform access role updated");
+    } else {
+      progress.info(
+        `IAM role ${pc24.cyan(roleName)} will be created when you add your AWS account in the dashboard`
+      );
+    }
+    await saveConnectionMetadata(metadata);
+    progress.stop();
+    outro18(pc24.green("Platform connection complete!"));
+    if (webhookSecret && needsDeployment) {
+      console.log(`
+${pc24.bold("Webhook Secret")} ${pc24.dim("(save this!)")}`);
+      console.log(pc24.dim("\u2500".repeat(60)));
+      console.log(`  ${pc24.cyan(webhookSecret)}`);
+      console.log(pc24.dim("\u2500".repeat(60)));
+    } else if (metadata.services.email?.webhookSecret && !needsDeployment) {
+      console.log(`
+${pc24.bold("Existing Webhook Secret:")}`);
+      console.log(pc24.dim("\u2500".repeat(60)));
+      console.log(`  ${pc24.cyan(metadata.services.email.webhookSecret)}`);
+      console.log(pc24.dim("\u2500".repeat(60)));
     }
-    console.log(
-      `  ${pc23.yellow("?")} ${pc23.bold("Route53")} - Auto DNS ${pc23.dim("(optional)")}`
-    );
-    console.log(
-      `  ${pc23.yellow("?")} ${pc23.bold("IAM OIDC")} - Vercel integration ${pc23.dim("(if using Vercel)")}`
-    );
-  }
-  if (!service || service === "sms") {
-    console.log(
-      `  ${pc23.green("+")} ${pc23.bold("SMS Voice")} - SMS sending & management`
-    );
-    console.log(`  ${pc23.green("+")} ${pc23.bold("DynamoDB")} - Message history`);
-    console.log(`  ${pc23.green("+")} ${pc23.bold("Lambda")} - Event processing`);
-  }
-  if (!service || service === "cdn") {
-    console.log(`  ${pc23.green("+")} ${pc23.bold("S3")} - Asset storage`);
-    console.log(
-      `  ${pc23.green("+")} ${pc23.bold("CloudFront")} - CDN distribution`
-    );
-    console.log(`  ${pc23.green("+")} ${pc23.bold("ACM")} - SSL certificates`);
-    console.log(
-      `  ${pc23.yellow("?")} ${pc23.bold("Route53")} - DNS management ${pc23.dim("(optional)")}`
-    );
-  }
-  console.log(`
-${pc23.dim("Get full IAM policy JSON:")}`);
-  console.log(`  ${pc23.cyan("wraps permissions --json")}`);
-  if (service) {
     console.log(`
-${pc23.dim("Get permissions for all services:")}`);
-    console.log(`  ${pc23.cyan("wraps permissions")}`);
-  }
-  console.log(`
-${pc23.dim("Documentation:")}`);
-  console.log(
-    `  ${pc23.blue("https://wraps.dev/docs/guides/aws-setup/permissions")}
-`
-  );
-}
-async function permissions(options) {
-  const startTime = Date.now();
-  trackCommand("permissions", {
-    json: options.json,
-    preset: options.preset,
-    service: options.service
-  });
-  const policy = buildPolicy(options.service, options.preset);
-  if (options.json) {
-    console.log(JSON.stringify(policy, null, 2));
-  } else {
-    displaySummary(options.service, options.preset);
-    console.log(pc23.bold("Quick Setup:\n"));
-    console.log("1. Copy the IAM policy:");
+${pc24.bold("Next Steps:")}`);
+    console.log(`  1. Go to ${pc24.cyan("https://app.wraps.dev/settings/aws")}`);
+    console.log(`  2. Add your AWS account: ${pc24.cyan(identity.accountId)}`);
+    if (webhookSecret) {
+      console.log("  3. Paste the webhook secret shown above");
+    }
+    console.log();
     console.log(
-      `   ${pc23.cyan("wraps permissions --json > wraps-policy.json")}
-`
-    );
-    console.log("2. Create the policy in AWS Console:");
-    console.log("   IAM > Policies > Create Policy > JSON\n");
-    console.log("3. Attach to your IAM user/role\n");
-    clack22.outro(
-      pc23.green("Run with --json to get the full IAM policy document")
+      pc24.dim(
+        "Events from your AWS infrastructure will stream to the dashboard."
+      )
     );
+    console.log();
+    const duration = Date.now() - startTime;
+    trackCommand("platform:connect", {
+      success: true,
+      duration_ms: duration
+    });
+  } catch (error) {
+    progress.stop();
+    const duration = Date.now() - startTime;
+    const errorCode = error instanceof Error ? error.name : "UNKNOWN_ERROR";
+    trackError(errorCode, "platform:connect", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+    trackCommand("platform:connect", {
+      success: false,
+      duration_ms: duration
+    });
+    throw error;
   }
-  trackCommand("permissions", {
-    success: true,
-    duration_ms: Date.now() - startTime
-  });
 }
 
 // src/commands/platform/index.ts
 init_esm_shims();
 import * as clack23 from "@clack/prompts";
-import pc24 from "picocolors";
+import pc25 from "picocolors";
 async function platform() {
-  clack23.intro(pc24.bold("Wraps Platform"));
+  clack23.intro(pc25.bold("Wraps Platform"));
   console.log();
   console.log(
     "  The Wraps Platform extends the free CLI with hosted features:"
   );
   console.log();
-  console.log(`  ${pc24.bold("Features:")}`);
-  console.log(`    ${pc24.green("\u2713")} Visual email template editor`);
-  console.log(`    ${pc24.green("\u2713")} Broadcast campaigns & scheduling`);
-  console.log(`    ${pc24.green("\u2713")} Contact management & segments`);
-  console.log(`    ${pc24.green("\u2713")} Workflow automations`);
-  console.log(`    ${pc24.green("\u2713")} Analytics dashboard`);
-  console.log(`    ${pc24.green("\u2713")} Team collaboration`);
+  console.log(`  ${pc25.bold("Features:")}`);
+  console.log(`    ${pc25.green("\u2713")} Visual email template editor`);
+  console.log(`    ${pc25.green("\u2713")} Broadcast campaigns & scheduling`);
+  console.log(`    ${pc25.green("\u2713")} Contact management & segments`);
+  console.log(`    ${pc25.green("\u2713")} Workflow automations`);
+  console.log(`    ${pc25.green("\u2713")} Analytics dashboard`);
+  console.log(`    ${pc25.green("\u2713")} Team collaboration`);
   console.log();
-  console.log(`  ${pc24.bold("Pricing:")}`);
-  console.log(`    ${pc24.cyan("Starter")}      $10/mo   5,000 contacts`);
-  console.log(`    ${pc24.cyan("Growth")}       $25/mo   25,000 contacts`);
-  console.log(`    ${pc24.cyan("Scale")}        $50/mo   100,000 contacts`);
-  console.log(`    ${pc24.cyan("Enterprise")}   Custom   Unlimited contacts`);
+  console.log(`  ${pc25.bold("Pricing:")}`);
+  console.log(`    ${pc25.cyan("Starter")}      $10/mo   5,000 contacts`);
+  console.log(`    ${pc25.cyan("Growth")}       $25/mo   25,000 contacts`);
+  console.log(`    ${pc25.cyan("Scale")}        $50/mo   100,000 contacts`);
+  console.log(`    ${pc25.cyan("Enterprise")}   Custom   Unlimited contacts`);
   console.log();
   console.log(
-    pc24.dim("  + AWS costs at $0.10 per 1,000 emails (paid directly to AWS)")
+    pc25.dim("  + AWS costs at $0.10 per 1,000 emails (paid directly to AWS)")
   );
   console.log();
   console.log(
-    `  ${pc24.bold("Learn more:")} ${pc24.cyan("https://wraps.dev/platform")}`
+    `  ${pc25.bold("Learn more:")} ${pc25.cyan("https://wraps.dev/platform")}`
   );
   console.log();
-  console.log(pc24.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc25.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
-  console.log(`  ${pc24.bold("Platform Commands:")}`);
+  console.log(`  ${pc25.bold("Platform Commands:")}`);
   console.log();
   console.log(
-    `    ${pc24.cyan("wraps platform update-role")}  Update IAM permissions for hosted dashboard`
+    `    ${pc25.cyan("wraps platform connect")}      Connect infrastructure to Wraps Platform`
+  );
+  console.log(
+    `    ${pc25.cyan("wraps platform update-role")}  Update IAM permissions for dashboard`
   );
   console.log();
   console.log(
-    pc24.dim("  Run this after deploying new infrastructure to grant the hosted")
+    pc25.dim("  The connect command sets up event streaming and IAM permissions")
   );
-  console.log(pc24.dim("  dashboard access to your AWS resources."));
+  console.log(pc25.dim("  in one step. Run it after deploying infrastructure."));
   console.log();
 }
 
@@ -17385,11 +19004,11 @@ async function platform() {
 init_esm_shims();
 init_aws();
 init_metadata();
-import { GetRoleCommand, IAMClient as IAMClient2 } from "@aws-sdk/client-iam";
-import { confirm as confirm11, intro as intro22, isCancel as isCancel16, log as log21, outro as outro18 } from "@clack/prompts";
-import pc25 from "picocolors";
+import { GetRoleCommand as GetRoleCommand2, IAMClient as IAMClient3 } from "@aws-sdk/client-iam";
+import { confirm as confirm12, intro as intro23, isCancel as isCancel17, log as log22, outro as outro19 } from "@clack/prompts";
+import pc26 from "picocolors";
 async function updateRole(options) {
-  intro22(pc25.bold("Update Platform Access Role"));
+  intro23(pc26.bold("Update Platform Access Role"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -17399,21 +19018,21 @@ async function updateRole(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     progress.stop();
-    log21.error(
-      `No Wraps deployment found for account ${pc25.cyan(identity.accountId)} in region ${pc25.cyan(region)}`
+    log22.error(
+      `No Wraps deployment found for account ${pc26.cyan(identity.accountId)} in region ${pc26.cyan(region)}`
     );
     console.log(
       `
-Run ${pc25.cyan("wraps email init")} to deploy infrastructure first.
+Run ${pc26.cyan("wraps email init")} to deploy infrastructure first.
 `
     );
     process.exit(1);
   }
   const roleName = "wraps-console-access-role";
-  const iam8 = new IAMClient2({ region: "us-east-1" });
+  const iam8 = new IAMClient3({ region: "us-east-1" });
   let roleExists4 = false;
   try {
-    await iam8.send(new GetRoleCommand({ RoleName: roleName }));
+    await iam8.send(new GetRoleCommand2({ RoleName: roleName }));
     roleExists4 = true;
   } catch (error) {
     if (error && typeof error === "object" && "name" in error && error.name !== "NoSuchEntity") {
@@ -17422,7 +19041,7 @@ Run ${pc25.cyan("wraps email init")} to deploy infrastructure first.
   }
   if (!roleExists4) {
     progress.stop();
-    log21.warn(`IAM role ${pc25.cyan(roleName)} does not exist`);
+    log22.warn(`IAM role ${pc26.cyan(roleName)} does not exist`);
     console.log(
       "\nThis role is created when you connect AWS accounts through the Wraps Platform."
     );
@@ -17431,21 +19050,21 @@ Run ${pc25.cyan("wraps email init")} to deploy infrastructure first.
     );
     process.exit(0);
   }
-  progress.info(`Found IAM role: ${pc25.cyan(roleName)}`);
+  progress.info(`Found IAM role: ${pc26.cyan(roleName)}`);
   if (!options.force) {
     progress.stop();
-    const shouldContinue = await confirm11({
-      message: `Update IAM role ${pc25.cyan(roleName)} with latest permissions?`,
+    const shouldContinue = await confirm12({
+      message: `Update IAM role ${pc26.cyan(roleName)} with latest permissions?`,
       initialValue: true
     });
-    if (isCancel16(shouldContinue) || !shouldContinue) {
-      outro18("Update cancelled");
+    if (isCancel17(shouldContinue) || !shouldContinue) {
+      outro19("Update cancelled");
       process.exit(0);
     }
   }
   const emailConfig = metadata.services.email?.config;
   const smsConfig = metadata.services.sms?.config;
-  const policy = buildConsolePolicyDocument(emailConfig, smsConfig);
+  const policy = buildConsolePolicyDocument2(emailConfig, smsConfig);
   const sendingEnabled = !emailConfig || emailConfig.sendingEnabled !== false;
   const eventTracking = emailConfig?.eventTracking;
   const emailArchiving = emailConfig?.emailArchiving;
@@ -17453,9 +19072,9 @@ Run ${pc25.cyan("wraps email init")} to deploy infrastructure first.
   const smsSendingEnabled = smsConfig && smsConfig.sendingEnabled !== false;
   const smsEventTracking = smsConfig?.eventTracking;
   await progress.execute("Updating IAM role permissions", async () => {
-    const { PutRolePolicyCommand } = await import("@aws-sdk/client-iam");
+    const { PutRolePolicyCommand: PutRolePolicyCommand2 } = await import("@aws-sdk/client-iam");
     await iam8.send(
-      new PutRolePolicyCommand({
+      new PutRolePolicyCommand2({
         RoleName: roleName,
         PolicyName: "wraps-console-access-policy",
         PolicyDocument: JSON.stringify(policy, null, 2)
@@ -17463,52 +19082,52 @@ Run ${pc25.cyan("wraps email init")} to deploy infrastructure first.
     );
   });
   progress.stop();
-  outro18(pc25.green("\u2713 Platform access role updated successfully"));
+  outro19(pc26.green("\u2713 Platform access role updated successfully"));
   console.log(`
-${pc25.bold("Updated Permissions:")}`);
+${pc26.bold("Updated Permissions:")}`);
   console.log(`
-  ${pc25.bold(pc25.cyan("Email:"))}`);
+  ${pc26.bold(pc26.cyan("Email:"))}`);
   console.log(
-    `  ${pc25.green("\u2713")} SES metrics and identity verification (always enabled)`
+    `  ${pc26.green("\u2713")} SES metrics and identity verification (always enabled)`
   );
-  console.log(`  ${pc25.green("\u2713")} SES template management (always enabled)`);
+  console.log(`  ${pc26.green("\u2713")} SES template management (always enabled)`);
   if (sendingEnabled) {
-    console.log(`  ${pc25.green("\u2713")} Email sending via SES`);
+    console.log(`  ${pc26.green("\u2713")} Email sending via SES`);
   }
   if (eventTracking?.dynamoDBHistory) {
     console.log(
-      `  ${pc25.green("\u2713")} DynamoDB read access (including DescribeTable)`
+      `  ${pc26.green("\u2713")} DynamoDB read access (including DescribeTable)`
     );
   }
   if (eventTracking?.enabled) {
-    console.log(`  ${pc25.green("\u2713")} EventBridge and SQS access`);
+    console.log(`  ${pc26.green("\u2713")} EventBridge and SQS access`);
   }
   if (emailArchiving?.enabled) {
-    console.log(`  ${pc25.green("\u2713")} Mail Manager Archive access`);
+    console.log(`  ${pc26.green("\u2713")} Mail Manager Archive access`);
   }
   if (smsEnabled) {
     console.log(`
-  ${pc25.bold(pc25.cyan("SMS:"))}`);
+  ${pc26.bold(pc26.cyan("SMS:"))}`);
     console.log(
-      `  ${pc25.green("\u2713")} SMS Voice V2 read access (phone numbers, config, registrations)`
+      `  ${pc26.green("\u2713")} SMS Voice V2 read access (phone numbers, config, registrations)`
     );
     if (smsSendingEnabled) {
-      console.log(`  ${pc25.green("\u2713")} SMS sending via SMS Voice V2`);
+      console.log(`  ${pc26.green("\u2713")} SMS sending via SMS Voice V2`);
     }
     if (smsEventTracking?.dynamoDBHistory) {
-      console.log(`  ${pc25.green("\u2713")} DynamoDB read access for SMS history`);
+      console.log(`  ${pc26.green("\u2713")} DynamoDB read access for SMS history`);
     }
     if (smsEventTracking?.enabled) {
-      console.log(`  ${pc25.green("\u2713")} SNS topic access for SMS events`);
+      console.log(`  ${pc26.green("\u2713")} SNS topic access for SMS events`);
     }
   }
   console.log(
     `
-${pc25.dim("The Wraps Platform will now have updated permissions for feature detection.")}
+${pc26.dim("The Wraps Platform will now have updated permissions for feature detection.")}
 `
   );
 }
-function buildConsolePolicyDocument(emailConfig, smsConfig) {
+function buildConsolePolicyDocument2(emailConfig, smsConfig) {
   const statements = [];
   statements.push({
     Effect: "Allow",
@@ -17673,10 +19292,10 @@ function buildConsolePolicyDocument(emailConfig, smsConfig) {
 // src/commands/shared/dashboard.ts
 init_esm_shims();
 import * as clack24 from "@clack/prompts";
-import * as pulumi19 from "@pulumi/pulumi";
+import * as pulumi20 from "@pulumi/pulumi";
 import getPort from "get-port";
 import open from "open";
-import pc26 from "picocolors";
+import pc27 from "picocolors";
 
 // src/console/server.ts
 init_esm_shims();
@@ -18765,13 +20384,13 @@ function createMetricsRouter(config2) {
   const router = createRouter4();
   router.get("/stream", async (req, res) => {
     const connectionId = randomUUID().slice(0, 8);
-    const log34 = (msg, data) => {
+    const log35 = (msg, data) => {
       console.log(JSON.stringify({ connectionId, msg, ...data }));
     };
     res.setHeader("Content-Type", "text/event-stream");
     res.setHeader("Cache-Control", "no-cache");
     res.setHeader("Connection", "keep-alive");
-    log34("SSE connected");
+    log35("SSE connected");
     res.write('data: {"type":"connected"}\n\n');
     const { startTime, endTime } = req.query;
     const getTimeRange = () => ({
@@ -18781,7 +20400,7 @@ function createMetricsRouter(config2) {
     const sendMetrics = async () => {
       try {
         const timeRange = getTimeRange();
-        log34("Fetching metrics", {
+        log35("Fetching metrics", {
           start: timeRange.start.toISOString(),
           end: timeRange.end.toISOString()
         });
@@ -18794,7 +20413,7 @@ function createMetricsRouter(config2) {
           ),
           fetchSendQuota(config2.roleArn, config2.region)
         ]);
-        log34("Metrics fetched successfully");
+        log35("Metrics fetched successfully");
         const data = {
           type: "metrics",
           timestamp: Date.now(),
@@ -18824,7 +20443,7 @@ function createMetricsRouter(config2) {
     const interval = setInterval(sendMetrics, 6e4);
     req.on("close", () => {
       clearInterval(interval);
-      log34("SSE disconnected");
+      log35("SSE disconnected");
     });
   });
   router.get("/snapshot", async (_req, res) => {
@@ -20066,9 +21685,9 @@ function createUserRouter(config2) {
         if (config2.roleArn) {
           console.log("[User API] Attempting to fetch account alias via IAM");
           const { assumeRole: assumeRole2 } = await Promise.resolve().then(() => (init_assume_role(), assume_role_exports));
-          const { IAMClient: IAMClient3, ListAccountAliasesCommand } = await import("@aws-sdk/client-iam");
+          const { IAMClient: IAMClient4, ListAccountAliasesCommand } = await import("@aws-sdk/client-iam");
           const credentials = await assumeRole2(config2.roleArn, region);
-          const iamClient = new IAMClient3({ region, credentials });
+          const iamClient = new IAMClient4({ region, credentials });
           const response = await iamClient.send(
             new ListAccountAliasesCommand({})
           );
@@ -20196,7 +21815,7 @@ init_aws();
 init_fs();
 init_metadata();
 async function dashboard(options) {
-  clack24.intro(pc26.bold("Wraps Dashboard"));
+  clack24.intro(pc27.bold("Wraps Dashboard"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -20209,7 +21828,7 @@ async function dashboard(options) {
   try {
     await ensurePulumiWorkDir();
     try {
-      const emailStack = await pulumi19.automation.LocalWorkspace.selectStack({
+      const emailStack = await pulumi20.automation.LocalWorkspace.selectStack({
         stackName: `wraps-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20217,7 +21836,7 @@ async function dashboard(options) {
     } catch (_emailError) {
     }
     try {
-      const smsStack = await pulumi19.automation.LocalWorkspace.selectStack({
+      const smsStack = await pulumi20.automation.LocalWorkspace.selectStack({
         stackName: `wraps-sms-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20225,7 +21844,7 @@ async function dashboard(options) {
     } catch (_smsError) {
     }
     try {
-      const cdnStack = await pulumi19.automation.LocalWorkspace.selectStack({
+      const cdnStack = await pulumi20.automation.LocalWorkspace.selectStack({
         stackName: `wraps-cdn-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -20239,7 +21858,7 @@ async function dashboard(options) {
     progress.stop();
     clack24.log.error("No Wraps infrastructure found");
     console.log(
-      `\\nRun ${pc26.cyan("wraps email init")}, ${pc26.cyan("wraps sms init")}, or ${pc26.cyan("wraps storage init")} to deploy infrastructure first.\\n`
+      `\\nRun ${pc27.cyan("wraps email init")}, ${pc27.cyan("wraps sms init")}, or ${pc27.cyan("wraps storage init")} to deploy infrastructure first.\\n`
     );
     process.exit(1);
   }
@@ -20282,7 +21901,7 @@ async function dashboard(options) {
   progress.stop();
   clack24.log.success("Starting dashboard server...");
   console.log(
-    `${pc26.dim("Using current AWS credentials (no role assumption)")}\\n`
+    `${pc27.dim("Using current AWS credentials (no role assumption)")}\\n`
   );
   const { url } = await startConsoleServer({
     port,
@@ -20313,8 +21932,8 @@ async function dashboard(options) {
     cdnCustomDomain,
     cdnCertificateArn
   });
-  console.log(`\\n${pc26.bold("Dashboard:")} ${pc26.cyan(url)}`);
-  console.log(`${pc26.dim("Press Ctrl+C to stop")}\\n`);
+  console.log(`\\n${pc27.bold("Dashboard:")} ${pc27.cyan(url)}`);
+  console.log(`${pc27.dim("Press Ctrl+C to stop")}\\n`);
   getTelemetryClient().showFooterOnce();
   if (!options.noOpen) {
     await open(url);
@@ -20333,9 +21952,9 @@ init_esm_shims();
 init_aws();
 init_metadata();
 import * as clack25 from "@clack/prompts";
-import pc27 from "picocolors";
+import pc28 from "picocolors";
 async function destroy(options) {
-  clack25.intro(pc27.bold("Wraps Infrastructure Teardown"));
+  clack25.intro(pc28.bold("Wraps Infrastructure Teardown"));
   const spinner6 = clack25.spinner();
   spinner6.start("Validating AWS credentials");
   let identity;
@@ -20356,14 +21975,14 @@ async function destroy(options) {
     clack25.log.warn("No Wraps services found in this region");
     console.log(
       `
-Run ${pc27.cyan("wraps email init")} to deploy infrastructure.
+Run ${pc28.cyan("wraps email init")} to deploy infrastructure.
 `
     );
     process.exit(0);
   }
   if (deployedServices.length === 1) {
     const service = deployedServices[0];
-    clack25.log.info(`Found ${pc27.cyan(service)} service deployed`);
+    clack25.log.info(`Found ${pc28.cyan(service)} service deployed`);
     if (service === "email") {
       await emailDestroy(options);
       return;
@@ -20392,7 +22011,7 @@ Run ${pc27.cyan("wraps email init")} to deploy infrastructure.
     await emailDestroy(options);
   }
   if (serviceToDestroy === "all") {
-    clack25.outro(pc27.green("All Wraps infrastructure has been removed"));
+    clack25.outro(pc28.green("All Wraps infrastructure has been removed"));
   }
 }
 
@@ -20402,23 +22021,23 @@ init_events();
 init_aws();
 init_fs();
 import * as clack26 from "@clack/prompts";
-import * as pulumi20 from "@pulumi/pulumi";
-import pc28 from "picocolors";
+import * as pulumi21 from "@pulumi/pulumi";
+import pc29 from "picocolors";
 async function status(_options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
-  clack26.intro(pc28.bold("Wraps Infrastructure Status"));
+  clack26.intro(pc29.bold("Wraps Infrastructure Status"));
   const identity = await progress.execute(
     "Loading infrastructure status",
     async () => validateAWSCredentials()
   );
-  progress.info(`AWS Account: ${pc28.cyan(identity.accountId)}`);
+  progress.info(`AWS Account: ${pc29.cyan(identity.accountId)}`);
   const region = await getAWSRegion();
-  progress.info(`Region: ${pc28.cyan(region)}`);
+  progress.info(`Region: ${pc29.cyan(region)}`);
   const services = [];
   try {
     await ensurePulumiWorkDir();
-    const emailStack = await pulumi20.automation.LocalWorkspace.selectStack({
+    const emailStack = await pulumi21.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -20437,7 +22056,7 @@ async function status(_options) {
     services.push({ name: "Email", status: "not_deployed" });
   }
   try {
-    const smsStack = await pulumi20.automation.LocalWorkspace.selectStack({
+    const smsStack = await pulumi21.automation.LocalWorkspace.selectStack({
       stackName: `wraps-sms-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -20460,32 +22079,32 @@ async function status(_options) {
   clack26.note(
     services.map((s) => {
       if (s.status === "deployed") {
-        const details = s.details ? pc28.dim(` (${s.details})`) : "";
-        return `  ${pc28.green("\u2713")} ${s.name}${details}`;
+        const details = s.details ? pc29.dim(` (${s.details})`) : "";
+        return `  ${pc29.green("\u2713")} ${s.name}${details}`;
       }
-      return `  ${pc28.dim("\u25CB")} ${s.name} ${pc28.dim("(not deployed)")}`;
+      return `  ${pc29.dim("\u25CB")} ${s.name} ${pc29.dim("(not deployed)")}`;
     }).join("\n"),
     "Services"
   );
   const hasDeployedServices = services.some((s) => s.status === "deployed");
   if (hasDeployedServices) {
     console.log(`
-${pc28.bold("Details:")}`);
+${pc29.bold("Details:")}`);
     if (services.find((s) => s.name === "Email")?.status === "deployed") {
-      console.log(`  ${pc28.dim("Email:")} ${pc28.cyan("wraps email status")}`);
+      console.log(`  ${pc29.dim("Email:")} ${pc29.cyan("wraps email status")}`);
     }
     if (services.find((s) => s.name === "SMS")?.status === "deployed") {
-      console.log(`  ${pc28.dim("SMS:")} ${pc28.cyan("wraps sms status")}`);
+      console.log(`  ${pc29.dim("SMS:")} ${pc29.cyan("wraps sms status")}`);
     }
   } else {
     console.log(`
-${pc28.bold("Get started:")}`);
-    console.log(`  ${pc28.dim("Deploy email:")} ${pc28.cyan("wraps email init")}`);
-    console.log(`  ${pc28.dim("Deploy SMS:")} ${pc28.cyan("wraps sms init")}`);
+${pc29.bold("Get started:")}`);
+    console.log(`  ${pc29.dim("Deploy email:")} ${pc29.cyan("wraps email init")}`);
+    console.log(`  ${pc29.dim("Deploy SMS:")} ${pc29.cyan("wraps sms init")}`);
   }
   console.log(`
-${pc28.bold("Dashboard:")} ${pc28.blue("https://app.wraps.dev")}`);
-  console.log(`${pc28.bold("Docs:")} ${pc28.blue("https://wraps.dev/docs")}
+${pc29.bold("Dashboard:")} ${pc29.blue("https://app.wraps.dev")}`);
+  console.log(`${pc29.bold("Docs:")} ${pc29.blue("https://wraps.dev/docs")}
 `);
   trackCommand("status", {
     success: true,
@@ -20497,20 +22116,20 @@ ${pc28.bold("Dashboard:")} ${pc28.blue("https://app.wraps.dev")}`);
 // src/commands/sms/destroy.ts
 init_esm_shims();
 import * as clack27 from "@clack/prompts";
-import * as pulumi22 from "@pulumi/pulumi";
-import pc29 from "picocolors";
+import * as pulumi23 from "@pulumi/pulumi";
+import pc30 from "picocolors";
 
 // src/infrastructure/sms-stack.ts
 init_esm_shims();
 import * as aws15 from "@pulumi/aws";
-import * as pulumi21 from "@pulumi/pulumi";
+import * as pulumi22 from "@pulumi/pulumi";
 async function roleExists3(roleName) {
   try {
-    const { IAMClient: IAMClient3, GetRoleCommand: GetRoleCommand2 } = await import("@aws-sdk/client-iam");
-    const iam8 = new IAMClient3({
+    const { IAMClient: IAMClient4, GetRoleCommand: GetRoleCommand3 } = await import("@aws-sdk/client-iam");
+    const iam8 = new IAMClient4({
       region: process.env.AWS_REGION || "us-east-1"
     });
-    await iam8.send(new GetRoleCommand2({ RoleName: roleName }));
+    await iam8.send(new GetRoleCommand3({ RoleName: roleName }));
     return true;
   } catch (error) {
     if (error.name === "NoSuchEntityException" || error.Code === "NoSuchEntity" || error.Error?.Code === "NoSuchEntity") {
@@ -20537,7 +22156,7 @@ async function tableExists2(tableName) {
 async function createSMSIAMRole(config2) {
   let assumeRolePolicy;
   if (config2.provider === "vercel" && config2.oidcProvider) {
-    assumeRolePolicy = pulumi21.interpolate`{
+    assumeRolePolicy = pulumi22.interpolate`{
       "Version": "2012-10-17",
       "Statement": [
         {
@@ -20565,7 +22184,7 @@ async function createSMSIAMRole(config2) {
       ]
     }`;
   } else if (config2.provider === "aws") {
-    assumeRolePolicy = pulumi21.output(`{
+    assumeRolePolicy = pulumi22.output(`{
       "Version": "2012-10-17",
       "Statement": [{
         "Effect": "Allow",
@@ -20920,7 +22539,7 @@ async function createSMSSNSResources(config2) {
   });
   new aws15.sqs.QueuePolicy("wraps-sms-events-queue-policy", {
     queueUrl: config2.queueUrl,
-    policy: pulumi21.all([config2.queueArn, topic.arn]).apply(
+    policy: pulumi22.all([config2.queueArn, topic.arn]).apply(
       ([queueArn, topicArn2]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -21019,7 +22638,7 @@ async function deploySMSLambdaFunction(config2) {
   });
   new aws15.iam.RolePolicy("wraps-sms-lambda-policy", {
     role: lambdaRole.name,
-    policy: pulumi21.all([config2.tableName, config2.queueArn]).apply(
+    policy: pulumi22.all([config2.tableName, config2.queueArn]).apply(
       ([tableName, queueArn]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -21056,7 +22675,7 @@ async function deploySMSLambdaFunction(config2) {
       runtime: "nodejs20.x",
       handler: "index.handler",
       role: lambdaRole.arn,
-      code: new pulumi21.asset.FileArchive(codeDir),
+      code: new pulumi22.asset.FileArchive(codeDir),
       timeout: 300,
       // 5 minutes
       memorySize: 512,
@@ -21296,18 +22915,18 @@ async function createSMSProtectConfigurationWithSDK(configurationSetName, region
     const existing = await client.send(
       new DescribeProtectConfigurationsCommand({})
     );
-    for (const pc40 of existing.ProtectConfigurations || []) {
-      if (!(pc40.ProtectConfigurationArn && pc40.ProtectConfigurationId)) {
+    for (const pc41 of existing.ProtectConfigurations || []) {
+      if (!(pc41.ProtectConfigurationArn && pc41.ProtectConfigurationId)) {
         continue;
       }
       const tagsResponse = await client.send(
         new ListTagsForResourceCommand({
-          ResourceArn: pc40.ProtectConfigurationArn
+          ResourceArn: pc41.ProtectConfigurationArn
         })
       );
       const nameTag = tagsResponse.Tags?.find((t) => t.Key === "Name");
       if (nameTag?.Value === protectConfigName) {
-        existingProtectConfigId = pc40.ProtectConfigurationId;
+        existingProtectConfigId = pc41.ProtectConfigurationId;
         break;
       }
     }
@@ -21394,13 +23013,13 @@ async function deleteSMSProtectConfigurationWithSDK(region) {
       new DescribeProtectConfigurationsCommand({})
     );
     if (existing.ProtectConfigurations) {
-      for (const pc40 of existing.ProtectConfigurations) {
-        if (!(pc40.ProtectConfigurationArn && pc40.ProtectConfigurationId)) {
+      for (const pc41 of existing.ProtectConfigurations) {
+        if (!(pc41.ProtectConfigurationArn && pc41.ProtectConfigurationId)) {
           continue;
         }
         const tagsResponse = await client.send(
           new ListTagsForResourceCommand({
-            ResourceArn: pc40.ProtectConfigurationArn
+            ResourceArn: pc41.ProtectConfigurationArn
           })
         );
         const isWrapsManaged = tagsResponse.Tags?.some(
@@ -21409,7 +23028,7 @@ async function deleteSMSProtectConfigurationWithSDK(region) {
         if (isWrapsManaged) {
           await client.send(
             new DeleteProtectConfigurationCommand({
-              ProtectConfigurationId: pc40.ProtectConfigurationId
+              ProtectConfigurationId: pc41.ProtectConfigurationId
             })
           );
         }
@@ -21428,7 +23047,7 @@ init_metadata();
 async function smsDestroy(options) {
   const startTime = Date.now();
   clack27.intro(
-    pc29.bold(
+    pc30.bold(
       options.preview ? "SMS Infrastructure Destruction Preview" : "SMS Infrastructure Teardown"
     )
   );
@@ -21448,7 +23067,7 @@ async function smsDestroy(options) {
   }
   if (!(options.force || options.preview)) {
     const confirmed = await clack27.confirm({
-      message: pc29.red(
+      message: pc30.red(
         "Are you sure you want to destroy all SMS infrastructure?"
       ),
       initialValue: false
@@ -21467,7 +23086,7 @@ async function smsDestroy(options) {
           const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
           let stack;
           try {
-            stack = await pulumi22.automation.LocalWorkspace.selectStack({
+            stack = await pulumi23.automation.LocalWorkspace.selectStack({
               stackName,
               workDir: getPulumiWorkDir()
             });
@@ -21487,7 +23106,7 @@ async function smsDestroy(options) {
         commandName: "wraps sms destroy"
       });
       clack27.outro(
-        pc29.green("Preview complete. Run without --preview to destroy.")
+        pc30.green("Preview complete. Run without --preview to destroy.")
       );
       trackServiceRemoved("sms", {
         preview: true,
@@ -21524,7 +23143,7 @@ async function smsDestroy(options) {
         const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
         let stack;
         try {
-          stack = await pulumi22.automation.LocalWorkspace.selectStack({
+          stack = await pulumi23.automation.LocalWorkspace.selectStack({
             stackName,
             workDir: getPulumiWorkDir()
           });
@@ -21560,16 +23179,16 @@ async function smsDestroy(options) {
     await saveConnectionMetadata(metadata);
   }
   progress.stop();
-  clack27.outro(pc29.green("SMS infrastructure has been removed"));
+  clack27.outro(pc30.green("SMS infrastructure has been removed"));
   console.log(`
-${pc29.bold("Cleaned up:")}`);
-  console.log(`  ${pc29.green("\u2713")} Phone number released`);
-  console.log(`  ${pc29.green("\u2713")} Configuration set deleted`);
-  console.log(`  ${pc29.green("\u2713")} Event processing infrastructure removed`);
-  console.log(`  ${pc29.green("\u2713")} IAM role deleted`);
+${pc30.bold("Cleaned up:")}`);
+  console.log(`  ${pc30.green("\u2713")} Phone number released`);
+  console.log(`  ${pc30.green("\u2713")} Configuration set deleted`);
+  console.log(`  ${pc30.green("\u2713")} Event processing infrastructure removed`);
+  console.log(`  ${pc30.green("\u2713")} IAM role deleted`);
   console.log(
     `
-Run ${pc29.cyan("wraps sms init")} to deploy infrastructure again.
+Run ${pc30.cyan("wraps sms init")} to deploy infrastructure again.
 `
   );
   trackServiceRemoved("sms", {
@@ -21581,8 +23200,8 @@ Run ${pc29.cyan("wraps sms init")} to deploy infrastructure again.
 // src/commands/sms/init.ts
 init_esm_shims();
 import * as clack28 from "@clack/prompts";
-import * as pulumi23 from "@pulumi/pulumi";
-import pc30 from "picocolors";
+import * as pulumi24 from "@pulumi/pulumi";
+import pc31 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -22106,7 +23725,7 @@ async function promptEstimatedSMSVolume() {
 }
 async function init3(options) {
   const startTime = Date.now();
-  clack28.intro(pc30.bold("Wraps SMS Infrastructure Setup"));
+  clack28.intro(pc31.bold("Wraps SMS Infrastructure Setup"));
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -22119,7 +23738,7 @@ async function init3(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc30.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc31.cyan(identity.accountId)}`);
   const provider = options.provider || await promptProvider();
   const region = options.region || await promptRegion(await getAWSRegion());
   let vercelConfig;
@@ -22132,9 +23751,9 @@ async function init3(options) {
   );
   if (existingConnection?.services?.sms) {
     clack28.log.warn(
-      `SMS already configured for account ${pc30.cyan(identity.accountId)} in region ${pc30.cyan(region)}`
+      `SMS already configured for account ${pc31.cyan(identity.accountId)} in region ${pc31.cyan(region)}`
     );
-    clack28.log.info(`Use ${pc30.cyan("wraps sms status")} to view current setup`);
+    clack28.log.info(`Use ${pc31.cyan("wraps sms status")} to view current setup`);
     process.exit(0);
   }
   let preset = options.preset;
@@ -22176,7 +23795,7 @@ async function init3(options) {
   }
   progress.info(
     `
-${pc30.bold("Fraud Protection")} - Block SMS to countries where you don't do business`
+${pc31.bold("Fraud Protection")} - Block SMS to countries where you don't do business`
   );
   const allowedCountries = await promptAllowedCountries();
   let aitFiltering = false;
@@ -22198,13 +23817,13 @@ ${pc30.bold("Fraud Protection")} - Block SMS to countries where you don't do bus
   };
   const estimatedVolume = await promptEstimatedSMSVolume();
   progress.info(`
-${pc30.bold("Cost Estimate:")}`);
+${pc31.bold("Cost Estimate:")}`);
   const costSummary = getSMSCostSummary(smsConfig, estimatedVolume);
   clack28.log.info(costSummary);
   const warnings = validateSMSConfig(smsConfig);
   if (warnings.length > 0) {
     progress.info(`
-${pc30.yellow(pc30.bold("Important Notes:"))}`);
+${pc31.yellow(pc31.bold("Important Notes:"))}`);
     for (const warning of warnings) {
       clack28.log.warn(warning);
     }
@@ -22228,7 +23847,7 @@ ${pc30.yellow(pc30.bold("Important Notes:"))}`);
       "Deploying SMS infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi23.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi24.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: `wraps-sms-${identity.accountId}-${region}`,
             projectName: "wraps-sms",
@@ -22334,47 +23953,47 @@ ${pc30.yellow(pc30.bold("Important Notes:"))}`);
   await saveConnectionMetadata(metadata);
   progress.info("Connection metadata saved");
   console.log("\n");
-  clack28.log.success(pc30.green(pc30.bold("SMS infrastructure deployed!")));
+  clack28.log.success(pc31.green(pc31.bold("SMS infrastructure deployed!")));
   console.log("\n");
   clack28.note(
     [
-      `${pc30.bold("Phone Number:")} ${pc30.cyan(outputs.phoneNumber || "Provisioning...")}`,
-      `${pc30.bold("Phone Type:")} ${pc30.cyan(smsConfig.phoneNumberType || "simulator")}`,
-      `${pc30.bold("Config Set:")} ${pc30.cyan(outputs.configSetName || "wraps-sms-config")}`,
-      `${pc30.bold("Region:")} ${pc30.cyan(outputs.region)}`,
-      outputs.tableName ? `${pc30.bold("History Table:")} ${pc30.cyan(outputs.tableName)}` : "",
+      `${pc31.bold("Phone Number:")} ${pc31.cyan(outputs.phoneNumber || "Provisioning...")}`,
+      `${pc31.bold("Phone Type:")} ${pc31.cyan(smsConfig.phoneNumberType || "simulator")}`,
+      `${pc31.bold("Config Set:")} ${pc31.cyan(outputs.configSetName || "wraps-sms-config")}`,
+      `${pc31.bold("Region:")} ${pc31.cyan(outputs.region)}`,
+      outputs.tableName ? `${pc31.bold("History Table:")} ${pc31.cyan(outputs.tableName)}` : "",
       "",
-      pc30.dim("IAM Role:"),
-      pc30.dim(`  ${outputs.roleArn}`)
+      pc31.dim("IAM Role:"),
+      pc31.dim(`  ${outputs.roleArn}`)
     ].filter(Boolean).join("\n"),
     "SMS Infrastructure"
   );
   const nextSteps = [];
   if (smsConfig.phoneNumberType === "toll-free") {
     nextSteps.push(
-      `${pc30.cyan("wraps sms register")} - Submit toll-free registration (required before sending)`
+      `${pc31.cyan("wraps sms register")} - Submit toll-free registration (required before sending)`
     );
   }
   nextSteps.push(
-    `${pc30.cyan("wraps sms test --to +1234567890")} - Send a test message`
+    `${pc31.cyan("wraps sms test --to +1234567890")} - Send a test message`
   );
-  nextSteps.push(`${pc30.cyan("wraps sms status")} - View SMS configuration`);
+  nextSteps.push(`${pc31.cyan("wraps sms status")} - View SMS configuration`);
   console.log("\n");
-  clack28.log.info(pc30.bold("Next steps:"));
+  clack28.log.info(pc31.bold("Next steps:"));
   for (const step of nextSteps) {
     console.log(`  ${step}`);
   }
   console.log("\n");
-  clack28.log.info(pc30.bold("SDK Usage:"));
-  console.log(pc30.dim("  npm install @wraps.dev/sms"));
+  clack28.log.info(pc31.bold("SDK Usage:"));
+  console.log(pc31.dim("  npm install @wraps.dev/sms"));
   console.log("");
-  console.log(pc30.dim("  import { Wraps } from '@wraps.dev/sms';"));
-  console.log(pc30.dim("  const wraps = new Wraps();"));
-  console.log(pc30.dim("  await wraps.sms.send({"));
-  console.log(pc30.dim("    to: '+14155551234',"));
-  console.log(pc30.dim("    message: 'Your code is 123456',"));
-  console.log(pc30.dim("  });"));
-  clack28.outro(pc30.green("Setup complete!"));
+  console.log(pc31.dim("  import { Wraps } from '@wraps.dev/sms';"));
+  console.log(pc31.dim("  const wraps = new Wraps();"));
+  console.log(pc31.dim("  await wraps.sms.send({"));
+  console.log(pc31.dim("    to: '+14155551234',"));
+  console.log(pc31.dim("    message: 'Your code is 123456',"));
+  console.log(pc31.dim("  });"));
+  clack28.outro(pc31.green("Setup complete!"));
   const duration = Date.now() - startTime;
   const enabledFeatures = [];
   if (smsConfig.tracking?.enabled) {
@@ -22408,7 +24027,7 @@ init_esm_shims();
 init_aws();
 init_metadata();
 import * as clack29 from "@clack/prompts";
-import pc31 from "picocolors";
+import pc32 from "picocolors";
 async function getPhoneNumberDetails(region) {
   const { PinpointSMSVoiceV2Client: PinpointSMSVoiceV2Client5, DescribePhoneNumbersCommand: DescribePhoneNumbersCommand2 } = await import("@aws-sdk/client-pinpoint-sms-voice-v2");
   const client = new PinpointSMSVoiceV2Client5({ region });
@@ -22446,7 +24065,7 @@ async function getRegistrationStatus(region, registrationId) {
   }
 }
 async function smsRegister(options) {
-  clack29.intro(pc31.bold("Wraps SMS - Toll-Free Registration"));
+  clack29.intro(pc32.bold("Wraps SMS - Toll-Free Registration"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -22459,7 +24078,7 @@ async function smsRegister(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
     clack29.log.error("No SMS infrastructure found.");
-    clack29.log.info(`Run ${pc31.cyan("wraps sms init")} first.`);
+    clack29.log.info(`Run ${pc32.cyan("wraps sms init")} first.`);
     process.exit(1);
   }
   const phoneDetails = await progress.execute(
@@ -22472,11 +24091,11 @@ async function smsRegister(options) {
   }
   console.log("");
   console.log(
-    `${pc31.bold("Phone Number:")} ${pc31.cyan(phoneDetails.phoneNumber)}`
+    `${pc32.bold("Phone Number:")} ${pc32.cyan(phoneDetails.phoneNumber)}`
   );
-  console.log(`${pc31.bold("Type:")} ${pc31.cyan(phoneDetails.type)}`);
+  console.log(`${pc32.bold("Type:")} ${pc32.cyan(phoneDetails.type)}`);
   console.log(
-    `${pc31.bold("Status:")} ${phoneDetails.status === "ACTIVE" ? pc31.green(phoneDetails.status) : pc31.yellow(phoneDetails.status)}`
+    `${pc32.bold("Status:")} ${phoneDetails.status === "ACTIVE" ? pc32.green(phoneDetails.status) : pc32.yellow(phoneDetails.status)}`
   );
   if (phoneDetails.registrationId) {
     const regStatus = await getRegistrationStatus(
@@ -22484,7 +24103,7 @@ async function smsRegister(options) {
       phoneDetails.registrationId
     );
     if (regStatus) {
-      console.log(`${pc31.bold("Registration:")} ${pc31.cyan(regStatus)}`);
+      console.log(`${pc32.bold("Registration:")} ${pc32.cyan(regStatus)}`);
     }
   }
   console.log("");
@@ -22503,21 +24122,21 @@ async function smsRegister(options) {
     clack29.log.info(`Your ${phoneDetails.type} number should be ready to use.`);
     process.exit(0);
   }
-  console.log(pc31.bold("Toll-Free Registration Required"));
+  console.log(pc32.bold("Toll-Free Registration Required"));
   console.log("");
   console.log(
-    pc31.dim("To send SMS at scale, you must register your toll-free number.")
+    pc32.dim("To send SMS at scale, you must register your toll-free number.")
   );
-  console.log(pc31.dim("This process typically takes 1-15 business days."));
+  console.log(pc32.dim("This process typically takes 1-15 business days."));
   console.log("");
-  console.log(pc31.bold("You'll need to provide:"));
-  console.log(`  ${pc31.dim("\u2022")} Business name and address`);
+  console.log(pc32.bold("You'll need to provide:"));
+  console.log(`  ${pc32.dim("\u2022")} Business name and address`);
   console.log(
-    `  ${pc31.dim("\u2022")} Use case description (what messages you're sending)`
+    `  ${pc32.dim("\u2022")} Use case description (what messages you're sending)`
   );
-  console.log(`  ${pc31.dim("\u2022")} Sample messages (2-3 examples)`);
-  console.log(`  ${pc31.dim("\u2022")} How users opt-in to receive messages`);
-  console.log(`  ${pc31.dim("\u2022")} Expected monthly message volume`);
+  console.log(`  ${pc32.dim("\u2022")} Sample messages (2-3 examples)`);
+  console.log(`  ${pc32.dim("\u2022")} How users opt-in to receive messages`);
+  console.log(`  ${pc32.dim("\u2022")} Expected monthly message volume`);
   console.log("");
   const openConsole = await clack29.confirm({
     message: "Open AWS Console to start registration?",
@@ -22542,29 +24161,29 @@ async function smsRegister(options) {
       } catch {
         clack29.log.info("Open this URL in your browser:");
         console.log(`
-  ${pc31.cyan(consoleUrl)}
+  ${pc32.cyan(consoleUrl)}
 `);
       }
     }
     console.log("");
-    console.log(pc31.bold("Next Steps:"));
+    console.log(pc32.bold("Next Steps:"));
     console.log(
-      `  1. Click ${pc31.cyan("Create registration")} in the AWS Console`
+      `  1. Click ${pc32.cyan("Create registration")} in the AWS Console`
     );
-    console.log(`  2. Select ${pc31.cyan("Toll-free number registration")}`);
+    console.log(`  2. Select ${pc32.cyan("Toll-free number registration")}`);
     console.log("  3. Fill out the business information form");
     console.log("  4. Submit and wait for approval (1-15 business days)");
     console.log("");
     console.log(
-      pc31.dim("Once approved, run `wraps sms sync` to complete setup.")
+      pc32.dim("Once approved, run `wraps sms sync` to complete setup.")
     );
   } else {
     const consoleUrl = `https://${region}.console.aws.amazon.com/sms-voice/home?region=${region}#/registrations`;
     console.log("");
     console.log("When you're ready, go to:");
-    console.log(`  ${pc31.cyan(consoleUrl)}`);
+    console.log(`  ${pc32.cyan(consoleUrl)}`);
   }
-  clack29.outro(pc31.dim("Good luck with your registration!"));
+  clack29.outro(pc32.dim("Good luck with your registration!"));
 }
 
 // src/commands/sms/status.ts
@@ -22574,51 +24193,51 @@ init_aws();
 init_fs();
 init_metadata();
 import * as clack30 from "@clack/prompts";
-import * as pulumi24 from "@pulumi/pulumi";
-import pc32 from "picocolors";
+import * as pulumi25 from "@pulumi/pulumi";
+import pc33 from "picocolors";
 function displaySMSStatus(options) {
   const lines = [];
-  lines.push(pc32.bold(pc32.green("SMS Infrastructure Active")));
+  lines.push(pc33.bold(pc33.green("SMS Infrastructure Active")));
   lines.push("");
-  lines.push(pc32.bold("Phone Number"));
+  lines.push(pc33.bold("Phone Number"));
   if (options.phoneNumber) {
-    lines.push(`  Number: ${pc32.cyan(options.phoneNumber)}`);
+    lines.push(`  Number: ${pc33.cyan(options.phoneNumber)}`);
   } else {
-    lines.push(`  Number: ${pc32.yellow("Provisioning...")}`);
+    lines.push(`  Number: ${pc33.yellow("Provisioning...")}`);
   }
-  lines.push(`  Type: ${pc32.cyan(options.phoneNumberType || "simulator")}`);
+  lines.push(`  Type: ${pc33.cyan(options.phoneNumberType || "simulator")}`);
   lines.push("");
-  lines.push(pc32.bold("Configuration"));
-  lines.push(`  Region: ${pc32.cyan(options.region)}`);
+  lines.push(pc33.bold("Configuration"));
+  lines.push(`  Region: ${pc33.cyan(options.region)}`);
   if (options.preset) {
-    lines.push(`  Preset: ${pc32.cyan(options.preset)}`);
+    lines.push(`  Preset: ${pc33.cyan(options.preset)}`);
   }
   if (options.configSetName) {
-    lines.push(`  Config Set: ${pc32.cyan(options.configSetName)}`);
+    lines.push(`  Config Set: ${pc33.cyan(options.configSetName)}`);
   }
   lines.push("");
-  lines.push(pc32.bold("Features"));
+  lines.push(pc33.bold("Features"));
   lines.push(
-    `  Event Tracking: ${options.eventTracking ? pc32.green("Enabled") : pc32.dim("Disabled")}`
+    `  Event Tracking: ${options.eventTracking ? pc33.green("Enabled") : pc33.dim("Disabled")}`
   );
   if (options.tableName) {
-    lines.push(`  Message History: ${pc32.green("Enabled")}`);
-    lines.push(`    Table: ${pc32.dim(options.tableName)}`);
+    lines.push(`  Message History: ${pc33.green("Enabled")}`);
+    lines.push(`    Table: ${pc33.dim(options.tableName)}`);
   }
   if (options.queueUrl) {
-    lines.push(`  Event Queue: ${pc32.green("Enabled")}`);
+    lines.push(`  Event Queue: ${pc33.green("Enabled")}`);
   }
   lines.push("");
   if (options.roleArn) {
-    lines.push(pc32.bold("IAM Role"));
-    lines.push(`  ${pc32.dim(options.roleArn)}`);
+    lines.push(pc33.bold("IAM Role"));
+    lines.push(`  ${pc33.dim(options.roleArn)}`);
   }
   clack30.note(lines.join("\n"), "SMS Status");
 }
 async function smsStatus(_options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
-  clack30.intro(pc32.bold("Wraps SMS Status"));
+  clack30.intro(pc33.bold("Wraps SMS Status"));
   const identity = await progress.execute(
     "Loading SMS infrastructure status",
     async () => validateAWSCredentials()
@@ -22630,7 +24249,7 @@ async function smsStatus(_options) {
     clack30.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc32.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -22639,7 +24258,7 @@ Run ${pc32.cyan("wraps sms init")} to deploy SMS infrastructure.
   try {
     await ensurePulumiWorkDir();
     const stackName = metadata.services.sms.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`;
-    const stack = await pulumi24.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi25.automation.LocalWorkspace.selectStack({
       stackName,
       workDir: getPulumiWorkDir()
     });
@@ -22661,25 +24280,25 @@ Run ${pc32.cyan("wraps sms init")} to deploy SMS infrastructure.
     preset: metadata.services.sms.preset
   });
   console.log("");
-  clack30.log.info(pc32.bold("Commands:"));
+  clack30.log.info(pc33.bold("Commands:"));
   console.log(
-    `  ${pc32.cyan("wraps sms test --to +1234567890")} - Send a test message`
+    `  ${pc33.cyan("wraps sms test --to +1234567890")} - Send a test message`
   );
-  console.log(`  ${pc32.cyan("wraps sms destroy")} - Remove SMS infrastructure`);
+  console.log(`  ${pc33.cyan("wraps sms destroy")} - Remove SMS infrastructure`);
   trackCommand("sms:status", {
     success: true,
     phone_type: smsConfig?.phoneNumberType,
     event_tracking: smsConfig?.eventTracking?.enabled,
     duration_ms: Date.now() - startTime
   });
-  clack30.outro(pc32.dim("SMS infrastructure is ready"));
+  clack30.outro(pc33.dim("SMS infrastructure is ready"));
 }
 
 // src/commands/sms/sync.ts
 init_esm_shims();
 import * as clack31 from "@clack/prompts";
-import * as pulumi25 from "@pulumi/pulumi";
-import pc33 from "picocolors";
+import * as pulumi26 from "@pulumi/pulumi";
+import pc34 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -22687,7 +24306,7 @@ init_fs();
 init_metadata();
 async function smsSync(options) {
   const startTime = Date.now();
-  clack31.intro(pc33.bold("Wraps SMS Infrastructure Sync"));
+  clack31.intro(pc34.bold("Wraps SMS Infrastructure Sync"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -22701,7 +24320,7 @@ async function smsSync(options) {
     clack31.log.error("No SMS infrastructure found to sync");
     console.log(
       `
-Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
+Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure first.
 `
     );
     process.exit(1);
@@ -22710,10 +24329,10 @@ Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
   const storedStackName = smsService.pulumiStackName;
   progress.info("Found existing SMS configuration");
   progress.info(
-    `Phone type: ${pc33.cyan(smsConfig.phoneNumberType || "simulator")}`
+    `Phone type: ${pc34.cyan(smsConfig.phoneNumberType || "simulator")}`
   );
   progress.info(
-    `Event tracking: ${pc33.cyan(smsConfig.eventTracking?.enabled ? "enabled" : "disabled")}`
+    `Event tracking: ${pc34.cyan(smsConfig.eventTracking?.enabled ? "enabled" : "disabled")}`
   );
   if (!options.yes) {
     const confirmed = await clack31.confirm({
@@ -22736,7 +24355,7 @@ Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
     outputs = await progress.execute("Syncing SMS infrastructure", async () => {
       await ensurePulumiWorkDir();
       const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
-      const stack = await pulumi25.automation.LocalWorkspace.createOrSelectStack(
+      const stack = await pulumi26.automation.LocalWorkspace.createOrSelectStack(
         {
           stackName,
           projectName: "wraps-sms",
@@ -22835,7 +24454,7 @@ Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
   }
   progress.stop();
   console.log("\n");
-  clack31.log.success(pc33.green("SMS infrastructure synced successfully!"));
+  clack31.log.success(pc34.green("SMS infrastructure synced successfully!"));
   const changes = [];
   if (outputs.lambdaFunctions?.length) {
     changes.push("Lambda functions updated");
@@ -22843,13 +24462,13 @@ Run ${pc33.cyan("wraps sms init")} to deploy SMS infrastructure first.
   changes.push("SDK resources verified");
   console.log("");
   for (const change of changes) {
-    console.log(`  ${pc33.green("\u2713")} ${change}`);
+    console.log(`  ${pc34.green("\u2713")} ${change}`);
   }
   trackCommand("sms:sync", {
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack31.outro(pc33.green("Sync complete!"));
+  clack31.outro(pc34.green("Sync complete!"));
 }
 
 // src/commands/sms/test.ts
@@ -22862,7 +24481,7 @@ import {
   SendTextMessageCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
 import * as clack32 from "@clack/prompts";
-import pc34 from "picocolors";
+import pc35 from "picocolors";
 function isValidPhoneNumber(phone) {
   return /^\+[1-9]\d{1,14}$/.test(phone);
 }
@@ -22879,7 +24498,7 @@ var SIMULATOR_DESTINATIONS = [
 async function smsTest(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
-  clack32.intro(pc34.bold("Wraps SMS Test"));
+  clack32.intro(pc35.bold("Wraps SMS Test"));
   const identity = await progress.execute(
     "Validating AWS credentials",
     async () => validateAWSCredentials()
@@ -22891,7 +24510,7 @@ async function smsTest(options) {
     clack32.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc35.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -22998,16 +24617,16 @@ Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure.
     );
     progress.stop();
     console.log("\n");
-    clack32.log.success(pc34.green("Test SMS sent successfully!"));
+    clack32.log.success(pc35.green("Test SMS sent successfully!"));
     console.log("");
     clack32.note(
       [
-        `${pc34.bold("Message ID:")} ${pc34.cyan(messageId || "unknown")}`,
-        `${pc34.bold("To:")} ${pc34.cyan(toNumber)}`,
-        `${pc34.bold("Message:")} ${message}`,
-        `${pc34.bold("Type:")} ${pc34.cyan(smsConfig?.phoneNumberType || "simulator")}`,
+        `${pc35.bold("Message ID:")} ${pc35.cyan(messageId || "unknown")}`,
+        `${pc35.bold("To:")} ${pc35.cyan(toNumber)}`,
+        `${pc35.bold("Message:")} ${message}`,
+        `${pc35.bold("Type:")} ${pc35.cyan(smsConfig?.phoneNumberType || "simulator")}`,
         "",
-        pc34.dim(
+        pc35.dim(
           smsConfig?.phoneNumberType === "simulator" ? "Note: Simulator messages are not actually delivered" : "Check your phone for the message!"
         )
       ].join("\n"),
@@ -23016,7 +24635,7 @@ Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure.
     if (smsConfig?.eventTracking?.enabled) {
       console.log("");
       clack32.log.info(
-        pc34.dim("Event tracking is enabled. Check DynamoDB for delivery status.")
+        pc35.dim("Event tracking is enabled. Check DynamoDB for delivery status.")
       );
     }
     trackCommand("sms:test", {
@@ -23025,7 +24644,7 @@ Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure.
       message_length: message?.length,
       duration_ms: Date.now() - startTime
     });
-    clack32.outro(pc34.green("Test complete!"));
+    clack32.outro(pc35.green("Test complete!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -23039,7 +24658,7 @@ Run ${pc34.cyan("wraps sms init")} to deploy SMS infrastructure.
       clack32.log.error("Toll-free number registration is not complete");
       console.log(
         `
-Run ${pc34.cyan("wraps sms register")} to complete registration.
+Run ${pc35.cyan("wraps sms register")} to complete registration.
 `
       );
     } else if (errorMessage.includes("opt-out")) {
@@ -23057,8 +24676,8 @@ Run ${pc34.cyan("wraps sms register")} to complete registration.
 // src/commands/sms/upgrade.ts
 init_esm_shims();
 import * as clack33 from "@clack/prompts";
-import * as pulumi26 from "@pulumi/pulumi";
-import pc35 from "picocolors";
+import * as pulumi27 from "@pulumi/pulumi";
+import pc36 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -23068,7 +24687,7 @@ init_prompts();
 async function smsUpgrade(options) {
   const startTime = Date.now();
   let upgradeAction = "";
-  clack33.intro(pc35.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
+  clack33.intro(pc36.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
@@ -23081,7 +24700,7 @@ async function smsUpgrade(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc35.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc36.cyan(identity.accountId)}`);
   let region = options.region;
   if (!region) {
     const defaultRegion = await getAWSRegion();
@@ -23090,34 +24709,34 @@ async function smsUpgrade(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     clack33.log.error(
-      `No Wraps connection found for account ${pc35.cyan(identity.accountId)} in region ${pc35.cyan(region)}`
+      `No Wraps connection found for account ${pc36.cyan(identity.accountId)} in region ${pc36.cyan(region)}`
     );
     clack33.log.info(
-      `Use ${pc35.cyan("wraps sms init")} to create new infrastructure.`
+      `Use ${pc36.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
   }
   if (!metadata.services.sms) {
     clack33.log.error("No SMS infrastructure found");
     clack33.log.info(
-      `Use ${pc35.cyan("wraps sms init")} to deploy SMS infrastructure.`
+      `Use ${pc36.cyan("wraps sms init")} to deploy SMS infrastructure.`
     );
     process.exit(1);
   }
   progress.info(`Found existing connection created: ${metadata.timestamp}`);
   console.log(`
-${pc35.bold("Current Configuration:")}
+${pc36.bold("Current Configuration:")}
 `);
   if (metadata.services.sms.preset) {
-    console.log(`  Preset: ${pc35.cyan(metadata.services.sms.preset)}`);
+    console.log(`  Preset: ${pc36.cyan(metadata.services.sms.preset)}`);
   } else {
-    console.log(`  Preset: ${pc35.cyan("custom")}`);
+    console.log(`  Preset: ${pc36.cyan("custom")}`);
   }
   const config2 = metadata.services.sms.config;
   if (!config2) {
     clack33.log.error("No SMS configuration found in metadata");
     clack33.log.info(
-      `Use ${pc35.cyan("wraps sms init")} to create new infrastructure.`
+      `Use ${pc36.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
   }
@@ -23129,45 +24748,45 @@ ${pc35.bold("Current Configuration:")}
       "short-code": "Short code ($995+/mo, 100+ MPS)"
     };
     console.log(
-      `  Phone Type: ${pc35.cyan(phoneTypeLabels2[config2.phoneNumberType] || config2.phoneNumberType)}`
+      `  Phone Type: ${pc36.cyan(phoneTypeLabels2[config2.phoneNumberType] || config2.phoneNumberType)}`
     );
   }
   if (config2.tracking?.enabled) {
-    console.log(`  ${pc35.green("\u2713")} Delivery Tracking`);
+    console.log(`  ${pc36.green("\u2713")} Delivery Tracking`);
     if (config2.tracking.linkTracking) {
-      console.log(`    ${pc35.dim("\u2514\u2500")} Link click tracking enabled`);
+      console.log(`    ${pc36.dim("\u2514\u2500")} Link click tracking enabled`);
     }
   }
   if (config2.eventTracking?.enabled) {
-    console.log(`  ${pc35.green("\u2713")} Event Tracking (SNS)`);
+    console.log(`  ${pc36.green("\u2713")} Event Tracking (SNS)`);
     if (config2.eventTracking.dynamoDBHistory) {
       console.log(
-        `    ${pc35.dim("\u2514\u2500")} Message History: ${pc35.cyan(config2.eventTracking.archiveRetention || "90days")}`
+        `    ${pc36.dim("\u2514\u2500")} Message History: ${pc36.cyan(config2.eventTracking.archiveRetention || "90days")}`
       );
     }
   }
   if (config2.messageArchiving?.enabled) {
     console.log(
-      `  ${pc35.green("\u2713")} Message Archiving (${config2.messageArchiving.retention})`
+      `  ${pc36.green("\u2713")} Message Archiving (${config2.messageArchiving.retention})`
     );
   }
   if (config2.optOutManagement) {
-    console.log(`  ${pc35.green("\u2713")} Opt-out Management`);
+    console.log(`  ${pc36.green("\u2713")} Opt-out Management`);
   }
   if (config2.protectConfiguration?.enabled) {
     const countries = config2.protectConfiguration.allowedCountries?.join(", ") || "US";
-    console.log(`  ${pc35.green("\u2713")} Fraud Protection`);
-    console.log(`    ${pc35.dim("\u2514\u2500")} Allowed countries: ${pc35.cyan(countries)}`);
+    console.log(`  ${pc36.green("\u2713")} Fraud Protection`);
+    console.log(`    ${pc36.dim("\u2514\u2500")} Allowed countries: ${pc36.cyan(countries)}`);
     if (config2.protectConfiguration.aitFiltering) {
-      console.log(`    ${pc35.dim("\u2514\u2500")} AIT filtering: ${pc35.cyan("enabled")}`);
+      console.log(`    ${pc36.dim("\u2514\u2500")} AIT filtering: ${pc36.cyan("enabled")}`);
     }
   } else {
-    console.log(`  ${pc35.dim("\u25CB")} Fraud Protection (not configured)`);
+    console.log(`  ${pc36.dim("\u25CB")} Fraud Protection (not configured)`);
   }
   const currentCostData = calculateSMSCosts(config2, 1e4);
   console.log(
     `
-  Estimated Cost: ${pc35.cyan(`~${formatCost3(currentCostData.total.monthly)}/mo`)}`
+  Estimated Cost: ${pc36.cyan(`~${formatCost3(currentCostData.total.monthly)}/mo`)}`
   );
   console.log("");
   const phoneTypeLabels = {
@@ -23274,22 +24893,22 @@ ${pc35.bold("Current Configuration:")}
       if (selectedType === "toll-free") {
         console.log(
           `
-${pc35.yellow("\u26A0")} ${pc35.bold("Toll-free Registration Required")}
+${pc36.yellow("\u26A0")} ${pc36.bold("Toll-free Registration Required")}
 `
         );
         console.log(
-          pc35.dim("Toll-free numbers require carrier registration before")
+          pc36.dim("Toll-free numbers require carrier registration before")
         );
         console.log(
-          pc35.dim("they can send messages at scale. After deployment:\n")
+          pc36.dim("they can send messages at scale. After deployment:\n")
         );
         console.log(
-          `  1. Run ${pc35.cyan("wraps sms register")} to start registration`
+          `  1. Run ${pc36.cyan("wraps sms register")} to start registration`
         );
         console.log("  2. Submit your business use case information");
         console.log("  3. Wait for carrier verification (1-5 business days)");
         console.log(
-          pc35.dim("\nUntil verified, sending is limited to low volume.\n")
+          pc36.dim("\nUntil verified, sending is limited to low volume.\n")
         );
         const confirmTollFree = await clack33.confirm({
           message: "Continue with toll-free number request?",
@@ -23303,10 +24922,10 @@ ${pc35.yellow("\u26A0")} ${pc35.bold("Toll-free Registration Required")}
       if (selectedType === "10dlc") {
         console.log(
           `
-${pc35.yellow("\u26A0")} ${pc35.bold("10DLC Campaign Registration Required")}
+${pc36.yellow("\u26A0")} ${pc36.bold("10DLC Campaign Registration Required")}
 `
         );
-        console.log(pc35.dim("10DLC requires brand and campaign registration:"));
+        console.log(pc36.dim("10DLC requires brand and campaign registration:"));
         console.log("  \u2022 Brand registration: one-time $4 fee");
         console.log("  \u2022 Campaign registration: $15/mo per campaign");
         console.log("  \u2022 Verification takes 1-7 business days");
@@ -23539,12 +25158,12 @@ ${pc35.yellow("\u26A0")} ${pc35.bold("10DLC Campaign Registration Required")}
       const enableLinkTracking = !config2.tracking?.linkTracking;
       if (enableLinkTracking) {
         clack33.log.info(
-          pc35.dim(
+          pc36.dim(
             "Link tracking will track clicks on URLs in your SMS messages."
           )
         );
         clack33.log.info(
-          pc35.dim("URLs will be rewritten to go through a tracking endpoint.")
+          pc36.dim("URLs will be rewritten to go through a tracking endpoint.")
         );
       }
       const confirmed = await clack33.confirm({
@@ -23757,18 +25376,18 @@ ${pc35.yellow("\u26A0")} ${pc35.bold("10DLC Campaign Registration Required")}
   const newCostData = calculateSMSCosts(updatedConfig, 1e4);
   const costDiff = newCostData.total.monthly - currentCostData.total.monthly;
   console.log(`
-${pc35.bold("Cost Impact:")}`);
+${pc36.bold("Cost Impact:")}`);
   console.log(
-    `  Current: ${pc35.cyan(`${formatCost3(currentCostData.total.monthly)}/mo`)}`
+    `  Current: ${pc36.cyan(`${formatCost3(currentCostData.total.monthly)}/mo`)}`
   );
   console.log(
-    `  New:     ${pc35.cyan(`${formatCost3(newCostData.total.monthly)}/mo`)}`
+    `  New:     ${pc36.cyan(`${formatCost3(newCostData.total.monthly)}/mo`)}`
   );
   if (costDiff > 0) {
-    console.log(`  Change:  ${pc35.yellow(`+${formatCost3(costDiff)}/mo`)}`);
+    console.log(`  Change:  ${pc36.yellow(`+${formatCost3(costDiff)}/mo`)}`);
   } else if (costDiff < 0) {
     console.log(
-      `  Change:  ${pc35.green(`-${formatCost3(Math.abs(costDiff))}/mo`)}`
+      `  Change:  ${pc36.green(`-${formatCost3(Math.abs(costDiff))}/mo`)}`
     );
   }
   console.log("");
@@ -23800,7 +25419,7 @@ ${pc35.bold("Cost Impact:")}`);
       "Updating SMS infrastructure (this may take 2-3 minutes)",
       async () => {
         await ensurePulumiWorkDir();
-        const stack = await pulumi26.automation.LocalWorkspace.createOrSelectStack(
+        const stack = await pulumi27.automation.LocalWorkspace.createOrSelectStack(
           {
             stackName: metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`,
             projectName: "wraps-sms",
@@ -23901,43 +25520,43 @@ ${pc35.bold("Cost Impact:")}`);
   await saveConnectionMetadata(metadata);
   progress.info("Connection metadata updated");
   console.log("\n");
-  clack33.log.success(pc35.green(pc35.bold("SMS infrastructure upgraded!")));
+  clack33.log.success(pc36.green(pc36.bold("SMS infrastructure upgraded!")));
   console.log("\n");
   clack33.note(
     [
-      `${pc35.bold("Phone Number:")} ${pc35.cyan(outputs.phoneNumber || "Provisioning...")}`,
-      `${pc35.bold("Phone Type:")} ${pc35.cyan(updatedConfig.phoneNumberType || "simulator")}`,
-      `${pc35.bold("Config Set:")} ${pc35.cyan(outputs.configSetName || "wraps-sms-config")}`,
-      `${pc35.bold("Region:")} ${pc35.cyan(outputs.region)}`,
-      outputs.tableName ? `${pc35.bold("History Table:")} ${pc35.cyan(outputs.tableName)}` : "",
+      `${pc36.bold("Phone Number:")} ${pc36.cyan(outputs.phoneNumber || "Provisioning...")}`,
+      `${pc36.bold("Phone Type:")} ${pc36.cyan(updatedConfig.phoneNumberType || "simulator")}`,
+      `${pc36.bold("Config Set:")} ${pc36.cyan(outputs.configSetName || "wraps-sms-config")}`,
+      `${pc36.bold("Region:")} ${pc36.cyan(outputs.region)}`,
+      outputs.tableName ? `${pc36.bold("History Table:")} ${pc36.cyan(outputs.tableName)}` : "",
       "",
-      pc35.dim("IAM Role:"),
-      pc35.dim(`  ${outputs.roleArn}`)
+      pc36.dim("IAM Role:"),
+      pc36.dim(`  ${outputs.roleArn}`)
     ].filter(Boolean).join("\n"),
     "SMS Infrastructure"
   );
   console.log(`
-${pc35.green("\u2713")} ${pc35.bold("Upgrade complete!")}
+${pc36.green("\u2713")} ${pc36.bold("Upgrade complete!")}
 `);
   if (upgradeAction === "phone-number") {
     console.log(
-      `Upgraded to ${pc35.cyan(updatedConfig.phoneNumberType)} number (${pc35.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Upgraded to ${pc36.cyan(updatedConfig.phoneNumberType)} number (${pc36.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
     if (updatedConfig.phoneNumberType === "toll-free") {
-      console.log(`${pc35.bold("Next Steps:")}`);
+      console.log(`${pc36.bold("Next Steps:")}`);
       console.log(
-        `  1. Run ${pc35.cyan("wraps sms register")} to start toll-free registration`
+        `  1. Run ${pc36.cyan("wraps sms register")} to start toll-free registration`
       );
       console.log("  2. Submit your business information and use case");
       console.log("  3. Wait for carrier verification (1-5 business days)");
       console.log("");
       console.log(
-        pc35.dim("Until verified, your number can only send limited messages.")
+        pc36.dim("Until verified, your number can only send limited messages.")
       );
       console.log("");
     } else if (updatedConfig.phoneNumberType === "10dlc") {
-      console.log(`${pc35.bold("Next Steps:")}`);
+      console.log(`${pc36.bold("Next Steps:")}`);
       console.log("  1. Register your brand in the AWS Console");
       console.log("  2. Create a 10DLC campaign for your use case");
       console.log("  3. Wait for campaign approval (1-7 business days)");
@@ -23945,16 +25564,16 @@ ${pc35.green("\u2713")} ${pc35.bold("Upgrade complete!")}
     }
   } else if (upgradeAction === "preset" && newPreset) {
     console.log(
-      `Upgraded to ${pc35.cyan(newPreset)} preset (${pc35.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Upgraded to ${pc36.cyan(newPreset)} preset (${pc36.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
   } else {
     console.log(
-      `Updated configuration (${pc35.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Updated configuration (${pc36.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
   }
-  console.log(pc35.dim(getSMSCostSummary(updatedConfig, 1e4)));
+  console.log(pc36.dim(getSMSCostSummary(updatedConfig, 1e4)));
   const enabledFeatures = [];
   if (updatedConfig.tracking?.enabled) {
     enabledFeatures.push("tracking");
@@ -23978,7 +25597,7 @@ ${pc35.green("\u2713")} ${pc35.bold("Upgrade complete!")}
     action: typeof upgradeAction === "string" ? upgradeAction : void 0,
     duration_ms: Date.now() - startTime
   });
-  clack33.outro(pc35.green("Upgrade complete!"));
+  clack33.outro(pc36.green("Upgrade complete!"));
 }
 
 // src/commands/sms/verify-number.ts
@@ -23995,14 +25614,14 @@ import {
   VerifyDestinationNumberCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
 import * as clack34 from "@clack/prompts";
-import pc36 from "picocolors";
+import pc37 from "picocolors";
 function isValidPhoneNumber2(phone) {
   return /^\+[1-9]\d{1,14}$/.test(phone);
 }
 async function smsVerifyNumber(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
-  clack34.intro(pc36.bold("Wraps SMS - Verify Destination Number"));
+  clack34.intro(pc37.bold("Wraps SMS - Verify Destination Number"));
   const identity = await progress.execute(
     "Validating AWS credentials",
     async () => validateAWSCredentials()
@@ -24014,7 +25633,7 @@ async function smsVerifyNumber(options) {
     clack34.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc36.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc37.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -24031,16 +25650,16 @@ Run ${pc36.cyan("wraps sms init")} to deploy SMS infrastructure.
         clack34.log.info("No verified destination numbers found");
         console.log(
           `
-Run ${pc36.cyan("wraps sms verify-number")} to verify a number.
+Run ${pc37.cyan("wraps sms verify-number")} to verify a number.
 `
         );
       } else {
         console.log("\n");
-        clack34.log.info(pc36.bold("Verified Destination Numbers:"));
+        clack34.log.info(pc37.bold("Verified Destination Numbers:"));
         console.log("");
         for (const num of response.VerifiedDestinationNumbers) {
-          const status2 = num.Status === "VERIFIED" ? pc36.green("\u2713 Verified") : pc36.yellow("\u29D6 Pending");
-          console.log(`  ${pc36.cyan(num.DestinationPhoneNumber)} - ${status2}`);
+          const status2 = num.Status === "VERIFIED" ? pc37.green("\u2713 Verified") : pc37.yellow("\u29D6 Pending");
+          console.log(`  ${pc37.cyan(num.DestinationPhoneNumber)} - ${status2}`);
         }
         console.log("");
       }
@@ -24049,7 +25668,7 @@ Run ${pc36.cyan("wraps sms verify-number")} to verify a number.
         count: response.VerifiedDestinationNumbers?.length || 0,
         duration_ms: Date.now() - startTime
       });
-      clack34.outro(pc36.green("Done!"));
+      clack34.outro(pc37.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -24068,7 +25687,7 @@ Run ${pc36.cyan("wraps sms verify-number")} to verify a number.
       clack34.log.error("Phone number is required for deletion");
       console.log(
         `
-Usage: ${pc36.cyan("wraps sms verify-number --delete --phone-number +14155551234")}
+Usage: ${pc37.cyan("wraps sms verify-number --delete --phone-number +14155551234")}
 `
       );
       process.exit(1);
@@ -24093,12 +25712,12 @@ Usage: ${pc36.cyan("wraps sms verify-number --delete --phone-number +14155551234
         );
       });
       progress.stop();
-      clack34.log.success(`Removed ${pc36.cyan(phoneNumber2)} from verified list`);
+      clack34.log.success(`Removed ${pc37.cyan(phoneNumber2)} from verified list`);
       trackCommand("sms:verify-number:delete", {
         success: true,
         duration_ms: Date.now() - startTime
       });
-      clack34.outro(pc36.green("Done!"));
+      clack34.outro(pc37.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -24163,17 +25782,17 @@ Usage: ${pc36.cyan("wraps sms verify-number --delete --phone-number +14155551234
       progress.stop();
       console.log("\n");
       clack34.log.success(
-        pc36.green(`Phone number ${pc36.cyan(phoneNumber)} verified!`)
+        pc37.green(`Phone number ${pc37.cyan(phoneNumber)} verified!`)
       );
       console.log("");
       console.log(
-        `You can now send test messages to this number with ${pc36.cyan("wraps sms test")}`
+        `You can now send test messages to this number with ${pc37.cyan("wraps sms test")}`
       );
       trackCommand("sms:verify-number:confirm", {
         success: true,
         duration_ms: Date.now() - startTime
       });
-      clack34.outro(pc36.green("Verification complete!"));
+      clack34.outro(pc37.green("Verification complete!"));
       return;
     } catch (error) {
       progress.stop();
@@ -24182,7 +25801,7 @@ Usage: ${pc36.cyan("wraps sms verify-number --delete --phone-number +14155551234
         clack34.log.error("Invalid verification code. Please try again.");
         console.log(
           `
-Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
+Run ${pc37.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
 `
         );
       } else {
@@ -24218,17 +25837,17 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         );
       });
       progress.stop();
-      clack34.log.success(`Verification code resent to ${pc36.cyan(phoneNumber)}`);
+      clack34.log.success(`Verification code resent to ${pc37.cyan(phoneNumber)}`);
       console.log("");
       console.log(
         `Once you receive the code, run:
-  ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
+  ${pc37.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
       );
       trackCommand("sms:verify-number:resend", {
         success: true,
         duration_ms: Date.now() - startTime
       });
-      clack34.outro(pc36.green("Code sent!"));
+      clack34.outro(pc37.green("Code sent!"));
       return;
     } catch (error) {
       progress.stop();
@@ -24250,9 +25869,9 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
     if (existingNumber?.Status === "VERIFIED") {
       progress.stop();
       clack34.log.info(
-        `Number ${pc36.cyan(phoneNumber)} is already verified and ready to use!`
+        `Number ${pc37.cyan(phoneNumber)} is already verified and ready to use!`
       );
-      clack34.outro(pc36.green("Done!"));
+      clack34.outro(pc37.green("Done!"));
       return;
     }
     if (existingNumber?.Status === "PENDING") {
@@ -24269,14 +25888,14 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       );
       progress.stop();
       clack34.log.info(
-        `Verification already in progress. New code sent to ${pc36.cyan(phoneNumber)}`
+        `Verification already in progress. New code sent to ${pc37.cyan(phoneNumber)}`
       );
       console.log("");
       console.log(
         `Once you receive the code, run:
-  ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
+  ${pc37.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
       );
-      clack34.outro(pc36.green("Code sent!"));
+      clack34.outro(pc37.green("Code sent!"));
       return;
     }
     const createResponse = await progress.execute(
@@ -24298,7 +25917,7 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
     progress.stop();
     console.log("\n");
     clack34.log.success(
-      `Verification code sent to ${pc36.cyan(phoneNumber)} via SMS`
+      `Verification code sent to ${pc37.cyan(phoneNumber)} via SMS`
     );
     console.log("");
     clack34.note(
@@ -24306,9 +25925,9 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         "1. Check your phone for the verification code",
         "",
         "2. Complete verification with:",
-        `   ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`,
+        `   ${pc37.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`,
         "",
-        pc36.dim("The code expires in 24 hours")
+        pc37.dim("The code expires in 24 hours")
       ].join("\n"),
       "Next Steps"
     );
@@ -24316,7 +25935,7 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       success: true,
       duration_ms: Date.now() - startTime
     });
-    clack34.outro(pc36.green("Verification started!"));
+    clack34.outro(pc37.green("Verification started!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -24324,7 +25943,7 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       clack34.log.error("This number is already being verified");
       console.log(
         `
-Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
+Run ${pc37.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
 `
       );
     } else {
@@ -24340,17 +25959,17 @@ Run ${pc36.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
 // src/commands/support.ts
 init_esm_shims();
 import * as clack35 from "@clack/prompts";
-import pc37 from "picocolors";
+import pc38 from "picocolors";
 async function support() {
-  clack35.intro(pc37.bold("Get Help with Wraps"));
+  clack35.intro(pc38.bold("Get Help with Wraps"));
   console.log();
-  console.log(`  ${pc37.bold("Email:")}   ${pc37.cyan("hey@wraps.sh")}`);
+  console.log(`  ${pc38.bold("Email:")}   ${pc38.cyan("hey@wraps.sh")}`);
   console.log(
-    `  ${pc37.bold("GitHub:")}  ${pc37.cyan("https://github.com/wraps-dev/wraps/issues")}`
+    `  ${pc38.bold("GitHub:")}  ${pc38.cyan("https://github.com/wraps-dev/wraps/issues")}`
   );
-  console.log(`  ${pc37.bold("Docs:")}    ${pc37.cyan("https://wraps.dev/docs")}`);
+  console.log(`  ${pc38.bold("Docs:")}    ${pc38.cyan("https://wraps.dev/docs")}`);
   console.log();
-  console.log(pc37.dim("  Response time: Usually within 24 hours"));
+  console.log(pc38.dim("  Response time: Usually within 24 hours"));
   console.log();
 }
 
@@ -24358,55 +25977,55 @@ async function support() {
 init_esm_shims();
 init_client();
 import * as clack36 from "@clack/prompts";
-import pc38 from "picocolors";
+import pc39 from "picocolors";
 async function telemetryEnable() {
   const client = getTelemetryClient();
   client.enable();
-  clack36.log.success(pc38.green("Telemetry enabled"));
-  console.log(`   Config: ${pc38.dim(client.getConfigPath())}`);
+  clack36.log.success(pc39.green("Telemetry enabled"));
+  console.log(`   Config: ${pc39.dim(client.getConfigPath())}`);
   console.log(`
-   ${pc38.dim("Thank you for helping improve Wraps!")}
+   ${pc39.dim("Thank you for helping improve Wraps!")}
 `);
 }
 async function telemetryDisable() {
   const client = getTelemetryClient();
   client.disable();
-  clack36.log.success(pc38.green("Telemetry disabled"));
-  console.log(`   Config: ${pc38.dim(client.getConfigPath())}`);
+  clack36.log.success(pc39.green("Telemetry disabled"));
+  console.log(`   Config: ${pc39.dim(client.getConfigPath())}`);
   console.log(
     `
-   ${pc38.dim("You can re-enable with:")} wraps telemetry enable
+   ${pc39.dim("You can re-enable with:")} wraps telemetry enable
 `
   );
 }
 async function telemetryStatus() {
   const client = getTelemetryClient();
-  clack36.intro(pc38.bold("Telemetry Status"));
-  const status2 = client.isEnabled() ? pc38.green("Enabled") : pc38.red("Disabled");
+  clack36.intro(pc39.bold("Telemetry Status"));
+  const status2 = client.isEnabled() ? pc39.green("Enabled") : pc39.red("Disabled");
   console.log();
-  console.log(`  ${pc38.bold("Status:")} ${status2}`);
-  console.log(`  ${pc38.bold("Config file:")} ${pc38.dim(client.getConfigPath())}`);
+  console.log(`  ${pc39.bold("Status:")} ${status2}`);
+  console.log(`  ${pc39.bold("Config file:")} ${pc39.dim(client.getConfigPath())}`);
   if (client.isEnabled()) {
     console.log();
-    console.log(pc38.bold("  How to opt-out:"));
-    console.log(`    ${pc38.cyan("wraps telemetry disable")}`);
+    console.log(pc39.bold("  How to opt-out:"));
+    console.log(`    ${pc39.cyan("wraps telemetry disable")}`);
     console.log(
-      `    ${pc38.dim("Or set:")} ${pc38.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
+      `    ${pc39.dim("Or set:")} ${pc39.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
     );
-    console.log(`    ${pc38.dim("Or set:")} ${pc38.cyan("DO_NOT_TRACK=1")}`);
+    console.log(`    ${pc39.dim("Or set:")} ${pc39.cyan("DO_NOT_TRACK=1")}`);
   } else {
     console.log();
-    console.log(pc38.bold("  How to opt-in:"));
-    console.log(`    ${pc38.cyan("wraps telemetry enable")}`);
+    console.log(pc39.bold("  How to opt-in:"));
+    console.log(`    ${pc39.cyan("wraps telemetry enable")}`);
   }
   console.log();
-  console.log(pc38.bold("  Debug mode:"));
+  console.log(pc39.bold("  Debug mode:"));
   console.log(
-    `    ${pc38.dim("See what would be sent:")} ${pc38.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
+    `    ${pc39.dim("See what would be sent:")} ${pc39.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
   );
   console.log();
   console.log(
-    `  ${pc38.dim("Learn more:")} ${pc38.cyan("https://wraps.dev/docs/telemetry")}`
+    `  ${pc39.dim("Learn more:")} ${pc39.cyan("https://wraps.dev/docs/telemetry")}`
   );
   console.log();
 }
@@ -24491,135 +26110,138 @@ function showVersion() {
   process.exit(0);
 }
 function showHelp() {
-  clack37.intro(pc39.bold(`WRAPS CLI v${VERSION}`));
+  clack37.intro(pc40.bold(`WRAPS CLI v${VERSION}`));
   console.log("Deploy AWS infrastructure to your account\n");
   console.log("Usage: wraps [service] <command> [options]\n");
   console.log("Services:");
-  console.log(`  ${pc39.cyan("email")}       Email infrastructure (AWS SES)`);
+  console.log(`  ${pc40.cyan("email")}       Email infrastructure (AWS SES)`);
   console.log(
-    `  ${pc39.cyan("sms")}         SMS infrastructure (AWS End User Messaging)`
+    `  ${pc40.cyan("sms")}         SMS infrastructure (AWS End User Messaging)`
   );
   console.log(
-    `  ${pc39.cyan("cdn")}         CDN infrastructure (AWS S3 + CloudFront)
+    `  ${pc40.cyan("cdn")}         CDN infrastructure (AWS S3 + CloudFront)
 `
   );
   console.log("Email Commands:");
   console.log(
-    `  ${pc39.cyan("email init")}           Deploy new email infrastructure`
+    `  ${pc40.cyan("email init")}           Deploy new email infrastructure`
   );
   console.log(
-    `  ${pc39.cyan("email check")}          Check email deliverability for a domain`
+    `  ${pc40.cyan("email check")}          Check email deliverability for a domain`
   );
   console.log(
-    `  ${pc39.cyan("email connect")}        Connect to existing AWS SES`
+    `  ${pc40.cyan("email connect")}        Connect to existing AWS SES`
   );
   console.log(
-    `  ${pc39.cyan("email status")}         Show email infrastructure details`
+    `  ${pc40.cyan("email status")}         Show email infrastructure details`
   );
-  console.log(`  ${pc39.cyan("email verify")}         Verify domain DNS records`);
+  console.log(`  ${pc40.cyan("email verify")}         Verify domain DNS records`);
   console.log(
-    `  ${pc39.cyan("email sync")}           Apply CLI updates to infrastructure`
+    `  ${pc40.cyan("email sync")}           Apply CLI updates to infrastructure`
   );
-  console.log(`  ${pc39.cyan("email upgrade")}        Add features`);
+  console.log(`  ${pc40.cyan("email upgrade")}        Add features`);
   console.log(
-    `  ${pc39.cyan("email restore")}        Restore original configuration`
+    `  ${pc40.cyan("email restore")}        Restore original configuration`
   );
   console.log(
-    `  ${pc39.cyan("email destroy")}        Remove email infrastructure`
+    `  ${pc40.cyan("email destroy")}        Remove email infrastructure`
   );
-  console.log(`  ${pc39.cyan("email domains add")}    Add a domain to SES`);
-  console.log(`  ${pc39.cyan("email domains list")}   List all domains`);
-  console.log(`  ${pc39.cyan("email domains remove")} Remove a domain
+  console.log(`  ${pc40.cyan("email domains add")}    Add a domain to SES`);
+  console.log(`  ${pc40.cyan("email domains list")}   List all domains`);
+  console.log(`  ${pc40.cyan("email domains remove")} Remove a domain
 `);
   console.log("SMS Commands:");
-  console.log(`  ${pc39.cyan("sms init")}             Deploy SMS infrastructure`);
+  console.log(`  ${pc40.cyan("sms init")}             Deploy SMS infrastructure`);
   console.log(
-    `  ${pc39.cyan("sms status")}           Show SMS infrastructure details`
+    `  ${pc40.cyan("sms status")}           Show SMS infrastructure details`
   );
-  console.log(`  ${pc39.cyan("sms test")}             Send a test SMS message`);
+  console.log(`  ${pc40.cyan("sms test")}             Send a test SMS message`);
   console.log(
-    `  ${pc39.cyan("sms verify-number")}    Verify a destination phone number`
+    `  ${pc40.cyan("sms verify-number")}    Verify a destination phone number`
   );
   console.log(
-    `  ${pc39.cyan("sms sync")}             Sync infrastructure (update Lambda, etc.)`
+    `  ${pc40.cyan("sms sync")}             Sync infrastructure (update Lambda, etc.)`
   );
-  console.log(`  ${pc39.cyan("sms upgrade")}          Upgrade SMS features`);
-  console.log(`  ${pc39.cyan("sms register")}         Register toll-free number`);
+  console.log(`  ${pc40.cyan("sms upgrade")}          Upgrade SMS features`);
+  console.log(`  ${pc40.cyan("sms register")}         Register toll-free number`);
   console.log(
-    `  ${pc39.cyan("sms destroy")}          Remove SMS infrastructure
+    `  ${pc40.cyan("sms destroy")}          Remove SMS infrastructure
 `
   );
   console.log("CDN Commands:");
   console.log(
-    `  ${pc39.cyan("cdn init")}             Deploy CDN infrastructure (S3 + CloudFront)`
+    `  ${pc40.cyan("cdn init")}             Deploy CDN infrastructure (S3 + CloudFront)`
   );
   console.log(
-    `  ${pc39.cyan("cdn status")}           Show CDN infrastructure details`
+    `  ${pc40.cyan("cdn status")}           Show CDN infrastructure details`
   );
   console.log(
-    `  ${pc39.cyan("cdn verify")}           Check DNS and certificate status`
+    `  ${pc40.cyan("cdn verify")}           Check DNS and certificate status`
   );
   console.log(
-    `  ${pc39.cyan("cdn upgrade")}          Add custom domain after cert validation`
+    `  ${pc40.cyan("cdn upgrade")}          Add custom domain after cert validation`
   );
   console.log(
-    `  ${pc39.cyan("cdn sync")}             Sync infrastructure with current config`
+    `  ${pc40.cyan("cdn sync")}             Sync infrastructure with current config`
   );
   console.log(
-    `  ${pc39.cyan("cdn destroy")}          Remove CDN infrastructure
+    `  ${pc40.cyan("cdn destroy")}          Remove CDN infrastructure
 `
   );
   console.log("Local Development:");
   console.log(
-    `  ${pc39.cyan("console")}               Start local web console
+    `  ${pc40.cyan("console")}               Start local web console
 `
   );
   console.log("Platform:");
   console.log(
-    `  ${pc39.cyan("platform")}              Show platform info and pricing`
+    `  ${pc40.cyan("platform")}              Show platform info and pricing`
+  );
+  console.log(
+    `  ${pc40.cyan("platform connect")}      Connect to Wraps Platform (events + IAM)`
   );
   console.log(
-    `  ${pc39.cyan("platform update-role")} Update platform IAM permissions
+    `  ${pc40.cyan("platform update-role")} Update platform IAM permissions
 `
   );
   console.log("AWS Setup:");
   console.log(
-    `  ${pc39.cyan("aws setup")}            Interactive AWS setup wizard`
+    `  ${pc40.cyan("aws setup")}            Interactive AWS setup wizard`
   );
   console.log(
-    `  ${pc39.cyan("aws doctor")}           Diagnose AWS configuration issues
+    `  ${pc40.cyan("aws doctor")}           Diagnose AWS configuration issues
 `
   );
   console.log("Global Commands:");
-  console.log(`  ${pc39.cyan("status")}       Show overview of all services`);
-  console.log(`  ${pc39.cyan("destroy")}      Remove deployed infrastructure`);
-  console.log(`  ${pc39.cyan("permissions")} Show required AWS IAM permissions`);
-  console.log(`  ${pc39.cyan("completion")}   Generate shell completion script`);
+  console.log(`  ${pc40.cyan("status")}       Show overview of all services`);
+  console.log(`  ${pc40.cyan("destroy")}      Remove deployed infrastructure`);
+  console.log(`  ${pc40.cyan("permissions")} Show required AWS IAM permissions`);
+  console.log(`  ${pc40.cyan("completion")}   Generate shell completion script`);
   console.log(
-    `  ${pc39.cyan("telemetry")}    Manage anonymous telemetry settings`
+    `  ${pc40.cyan("telemetry")}    Manage anonymous telemetry settings`
   );
-  console.log(`  ${pc39.cyan("news")}         Show recent Wraps updates`);
+  console.log(`  ${pc40.cyan("news")}         Show recent Wraps updates`);
   console.log(
-    `  ${pc39.cyan("support")}      Get help and support contact info
+    `  ${pc40.cyan("support")}      Get help and support contact info
 `
   );
   console.log("Options:");
   console.log(
-    `  ${pc39.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
+    `  ${pc40.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
   );
-  console.log(`  ${pc39.dim("-r, --region")}    AWS region`);
-  console.log(`  ${pc39.dim("-d, --domain")}    Domain name`);
-  console.log(`  ${pc39.dim("--account")}        AWS account ID or alias`);
-  console.log(`  ${pc39.dim("--preset")}         Configuration preset`);
-  console.log(`  ${pc39.dim("-y, --yes")}        Skip confirmation prompts`);
-  console.log(`  ${pc39.dim("-f, --force")}      Force destructive operations`);
+  console.log(`  ${pc40.dim("-r, --region")}    AWS region`);
+  console.log(`  ${pc40.dim("-d, --domain")}    Domain name`);
+  console.log(`  ${pc40.dim("--account")}        AWS account ID or alias`);
+  console.log(`  ${pc40.dim("--preset")}         Configuration preset`);
+  console.log(`  ${pc40.dim("-y, --yes")}        Skip confirmation prompts`);
+  console.log(`  ${pc40.dim("-f, --force")}      Force destructive operations`);
   console.log(
-    `  ${pc39.dim("--preview")}        Preview changes without deploying`
+    `  ${pc40.dim("--preview")}        Preview changes without deploying`
   );
-  console.log(`  ${pc39.dim("-v, --version")}    Show version number
+  console.log(`  ${pc40.dim("-v, --version")}    Show version number
 `);
   console.log(
-    `Run ${pc39.cyan("wraps <service> <command> --help")} for more information.
+    `Run ${pc40.cyan("wraps <service> <command> --help")} for more information.
 `
   );
   process.exit(0);
@@ -24765,7 +26387,7 @@ var flags = args.parse(process.argv);
 var [primaryCommand, subCommand] = args.sub;
 if (!primaryCommand) {
   async function interactiveMenu() {
-    clack37.intro(pc39.bold(`WRAPS CLI v${VERSION}`));
+    clack37.intro(pc40.bold(`WRAPS CLI v${VERSION}`));
     console.log("  Deploy AWS infrastructure to your account.\n");
     const action = await clack37.select({
       message: "What would you like to do?",
@@ -24879,20 +26501,20 @@ async function run() {
   const telemetry = getTelemetryClient();
   if (telemetry.shouldShowNotification()) {
     console.log();
-    clack37.log.info(pc39.bold("Anonymous Telemetry"));
+    clack37.log.info(pc40.bold("Anonymous Telemetry"));
     console.log(
-      `  Wraps collects ${pc39.cyan("anonymous usage data")} to improve the CLI.`
+      `  Wraps collects ${pc40.cyan("anonymous usage data")} to improve the CLI.`
     );
     console.log(
-      `  We ${pc39.bold("never")} collect: domains, AWS credentials, email content, or PII.`
+      `  We ${pc40.bold("never")} collect: domains, AWS credentials, email content, or PII.`
     );
     console.log(
-      `  We ${pc39.bold("only")} collect: command names, success/failure, CLI version, OS.`
+      `  We ${pc40.bold("only")} collect: command names, success/failure, CLI version, OS.`
     );
     console.log();
-    console.log(`  Opt-out anytime: ${pc39.cyan("wraps telemetry disable")}`);
-    console.log(`  Or set: ${pc39.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
-    console.log(`  Learn more: ${pc39.cyan("https://wraps.dev/docs")}`);
+    console.log(`  Opt-out anytime: ${pc40.cyan("wraps telemetry disable")}`);
+    console.log(`  Or set: ${pc40.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
+    console.log(`  Learn more: ${pc40.cyan("https://wraps.dev/docs")}`);
     console.log();
     telemetry.markNotificationShown();
   }
@@ -24962,7 +26584,7 @@ async function run() {
             clack37.log.error("--domain flag is required");
             console.log(
               `
-Usage: ${pc39.cyan("wraps email verify --domain yourapp.com")}
+Usage: ${pc40.cyan("wraps email verify --domain yourapp.com")}
 `
             );
             process.exit(1);
@@ -24978,7 +26600,7 @@ Usage: ${pc39.cyan("wraps email verify --domain yourapp.com")}
                 clack37.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc39.cyan("wraps email domains add --domain yourapp.com")}
+Usage: ${pc40.cyan("wraps email domains add --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -24994,7 +26616,7 @@ Usage: ${pc39.cyan("wraps email domains add --domain yourapp.com")}
                 clack37.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc39.cyan("wraps email domains verify --domain yourapp.com")}
+Usage: ${pc40.cyan("wraps email domains verify --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -25007,7 +26629,7 @@ Usage: ${pc39.cyan("wraps email domains verify --domain yourapp.com")}
                 clack37.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc39.cyan("wraps email domains get-dkim --domain yourapp.com")}
+Usage: ${pc40.cyan("wraps email domains get-dkim --domain yourapp.com")}
 `
                 );
                 process.exit(1);
@@ -25020,7 +26642,7 @@ Usage: ${pc39.cyan("wraps email domains get-dkim --domain yourapp.com")}
                 clack37.log.error("--domain flag is required");
                 console.log(
                   `
-Usage: ${pc39.cyan("wraps email domains remove --domain yourapp.com --force")}
+Usage: ${pc40.cyan("wraps email domains remove --domain yourapp.com --force")}
 `
                 );
                 process.exit(1);
@@ -25037,7 +26659,7 @@ Usage: ${pc39.cyan("wraps email domains remove --domain yourapp.com --force")}
               );
               console.log(
                 `
-Available commands: ${pc39.cyan("add")}, ${pc39.cyan("list")}, ${pc39.cyan("verify")}, ${pc39.cyan("get-dkim")}, ${pc39.cyan("remove")}
+Available commands: ${pc40.cyan("add")}, ${pc40.cyan("list")}, ${pc40.cyan("verify")}, ${pc40.cyan("get-dkim")}, ${pc40.cyan("remove")}
 `
               );
               process.exit(1);
@@ -25055,7 +26677,7 @@ Available commands: ${pc39.cyan("add")}, ${pc39.cyan("list")}, ${pc39.cyan("veri
           clack37.log.error(`Unknown email command: ${subCommand}`);
           console.log(
             `
-Run ${pc39.cyan("wraps --help")} for available commands.
+Run ${pc40.cyan("wraps --help")} for available commands.
 `
           );
           process.exit(1);
@@ -25126,7 +26748,7 @@ Run ${pc39.cyan("wraps --help")} for available commands.
           clack37.log.error(`Unknown sms command: ${subCommand}`);
           console.log(
             `
-Run ${pc39.cyan("wraps --help")} for available commands.
+Run ${pc40.cyan("wraps --help")} for available commands.
 `
           );
           process.exit(1);
@@ -25185,7 +26807,7 @@ Run ${pc39.cyan("wraps --help")} for available commands.
           clack37.log.error(`Unknown cdn command: ${subCommand}`);
           console.log(
             `
-Run ${pc39.cyan("wraps --help")} for available commands.
+Run ${pc40.cyan("wraps --help")} for available commands.
 `
           );
           process.exit(1);
@@ -25210,6 +26832,13 @@ Run ${pc39.cyan("wraps --help")} for available commands.
         return;
       }
       switch (subCommand) {
+        case "connect":
+          await connect3({
+            region: flags.region,
+            force: flags.force,
+            yes: flags.yes
+          });
+          break;
         case "update-role":
           await updateRole({
             region: flags.region,
@@ -25218,11 +26847,13 @@ Run ${pc39.cyan("wraps --help")} for available commands.
           break;
         default:
           clack37.log.error(`Unknown platform command: ${subCommand}`);
-          console.log(`
-Available commands: ${pc39.cyan("update-role")}
-`);
           console.log(
-            `Run ${pc39.cyan("wraps platform")} for more information.
+            `
+Available commands: ${pc40.cyan("connect")}, ${pc40.cyan("update-role")}
+`
+          );
+          console.log(
+            `Run ${pc40.cyan("wraps platform")} for more information.
 `
           );
           process.exit(1);
@@ -25249,10 +26880,10 @@ Available commands: ${pc39.cyan("update-role")}
           clack37.log.error(`Unknown aws command: ${subCommand}`);
           console.log(
             `
-Available commands: ${pc39.cyan("setup")}, ${pc39.cyan("doctor")}
+Available commands: ${pc40.cyan("setup")}, ${pc40.cyan("doctor")}
 `
           );
-          console.log(`Run ${pc39.cyan("wraps --help")} for more information.
+          console.log(`Run ${pc40.cyan("wraps --help")} for more information.
 `);
           process.exit(1);
       }
@@ -25315,7 +26946,7 @@ Available commands: ${pc39.cyan("setup")}, ${pc39.cyan("doctor")}
             clack37.log.error(`Unknown telemetry command: ${subCommand}`);
             console.log(
               `
-Available commands: ${pc39.cyan("enable")}, ${pc39.cyan("disable")}, ${pc39.cyan("status")}
+Available commands: ${pc40.cyan("enable")}, ${pc40.cyan("disable")}, ${pc40.cyan("status")}
 `
             );
             process.exit(1);
@@ -25338,7 +26969,7 @@ Please specify a command for ${primaryCommand} service.
         clack37.log.error(`Unknown command: ${primaryCommand}`);
         console.log(
           `
-Run ${pc39.cyan("wraps --help")} for available commands.
+Run ${pc40.cyan("wraps --help")} for available commands.
 `
         );
         process.exit(1);