@wraps.dev/cli 3.3.0 → 3.5.0

package/dist/cli.js

@@ -778,13 +778,13 @@ function handleCLIError(error, command6) {
       docsUrl = wrapsErr.docsUrl;
     } else {
       trackError("UNHANDLED_ERROR", cmdContext, {
-        errorType: error instanceof Error ? error.constructor.name : typeof error,
-        message: sanitizeErrorMessage(error)
+        errorType: error instanceof Error ? error.constructor.name : typeof error
       });
       message = error instanceof Error ? error.message : String(error || message);
     }
     jsonError(cmdContext, { code, message, suggestion, docsUrl });
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   console.error("");
   if (error instanceof WrapsError) {
@@ -804,7 +804,8 @@ ${pc.yellow("Suggestion:")}`);
       console.log(`  ${pc.blue(error.docsUrl)}
 `);
     }
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   if (isAWSError(error)) {
     const { code, action } = parseAWSError(error);
@@ -830,7 +831,8 @@ ${pc.yellow("Suggestion:")}`);
       console.log(`  ${pc.blue(wrapsError.docsUrl)}
 `);
     }
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   if (isPulumiError(error)) {
     const { code, iamAction, service, resourceName, resourceType } = parsePulumiError(error);
@@ -862,11 +864,11 @@ ${pc.yellow("Suggestion:")}`);
       console.log(`  ${pc.blue(wrapsError.docsUrl)}
 `);
     }
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   trackError("UNHANDLED_ERROR", cmdContext, {
-    errorType: error instanceof Error ? error.constructor.name : typeof error,
-    message: sanitizeErrorMessage(error)
+    errorType: error instanceof Error ? error.constructor.name : typeof error
   });
   clack.log.error("An unexpected error occurred");
   if (error instanceof Error) {
@@ -878,7 +880,7 @@ ${pc.yellow("Suggestion:")}`);
 ${pc.dim("If this persists, please report at:")}`);
   console.log(`  ${pc.blue("https://github.com/wraps-team/wraps/issues")}
 `);
-  process.exit(1);
+  process.exitCode = 1;
 }
 function awsErrorToWrapsError(code, action, originalError, isAgentContext = false) {
   const originalName = originalError instanceof Error ? originalError.name : "";
@@ -1035,6 +1037,37 @@ Saved regions: ${savedRegions.join(", ")}` : "Pass --region or set AWS_REGION.\n
         `Pass ${flagHint} (or run in an interactive terminal).`,
         "https://wraps.dev/docs/reference/json-output"
       ),
+      // ── User-input rejections ──────────────────────────────────────────────────
+      // "The user gave us bad input and this message says exactly what was wrong."
+      // These are WrapsErrors on purpose: handleCLIError's WrapsError branch
+      // (errors.ts:424 human, :369 JSON) already renders the exact target shape —
+      // a specific telemetry code, the message, the suggestion, exit non-zero —
+      // whereas a bare `throw new Error(...)` falls through to the generic tail,
+      // which prints "An unexpected error occurred" plus a GitHub-issue link and
+      // reports the user's typo as UNHANDLED_ERROR.
+      //
+      // Callers throw these INSTEAD of printing their own clack.log.error and
+      // usage line. That is not tidiness: an unguarded clack.log.error writes to
+      // stdout ahead of the JSON envelope, so `--json` consumers were parsing the
+      // human text and the envelope out of one stream.
+      unknownCommand: (what, typed, suggestion) => new WrapsError(
+        `Unknown ${what}: ${typed || "(none)"}`,
+        "UNKNOWN_COMMAND",
+        suggestion,
+        "https://wraps.dev/docs/cli-reference"
+      ),
+      // Code deliberately reuses MISSING_REQUIRED_FLAG rather than minting a new one:
+      // four commands already emit it inline (commands/sms/verify-number.ts:193,
+      // commands/sms/test.ts:71, commands/email/config-domain.ts:208,
+      // commands/email/test.ts:108), it is already on the errors reference page (:583),
+      // and domains.test.ts:1251 already asserts it. A second code for one condition is
+      // exactly the machine-readable inconsistency this feature exists to remove.
+      missingInput: (what, usage) => new WrapsError(
+        `${what} is required`,
+        "MISSING_REQUIRED_FLAG",
+        `Usage: ${usage}`,
+        "https://wraps.dev/docs/cli-reference"
+      ),
       pulumiError: (message) => new WrapsError(
         `Infrastructure deployment failed: ${message}`,
         "PULUMI_ERROR",
@@ -1913,7 +1946,7 @@ async function needsMigration(localPulumiDir, accountId, region) {
   }
 }
 async function migrateLocalPulumiState(localPulumiDir, bucketName, accountId, region) {
-  const pulumi35 = await import("@pulumi/pulumi/automation/index.js");
+  const pulumi36 = await import("@pulumi/pulumi/automation/index.js");
   const stacksDir = join2(localPulumiDir, ".pulumi", "stacks");
   const entries = await readdir(stacksDir);
   for (const entry of entries) {
@@ -1929,12 +1962,12 @@ async function migrateLocalPulumiState(localPulumiDir, bucketName, accountId, re
     for (const stackFile of stackFiles) {
       const stackName = stackFile.replace(".json", "");
       try {
-        const localStack = await pulumi35.LocalWorkspace.selectStack({
+        const localStack = await pulumi36.LocalWorkspace.selectStack({
           stackName,
           workDir: localPulumiDir
         });
         const state2 = await localStack.exportStack();
-        const s3Stack = await pulumi35.LocalWorkspace.createOrSelectStack(
+        const s3Stack = await pulumi36.LocalWorkspace.createOrSelectStack(
           {
             stackName,
             projectName,
@@ -28346,14 +28379,14 @@ async function withLockRetry(fn, options) {
       throw error;
     }
     const clack67 = await import("@clack/prompts");
-    const pc72 = (await import("picocolors")).default;
+    const pc73 = (await import("picocolors")).default;
     if (options.autoConfirm) {
       clack67.log.warn(
         "Stack is locked from a previous interrupted run. Auto-clearing..."
       );
     } else {
       const shouldClear = await clack67.confirm({
-        message: `Stack is locked from a previous interrupted run. ${pc72.yellow("Clear the stale lock and retry?")}`,
+        message: `Stack is locked from a previous interrupted run. ${pc73.yellow("Clear the stale lock and retry?")}`,
         initialValue: true
       });
       if (clack67.isCancel(shouldClear) || !shouldClear) {
@@ -28380,8 +28413,8 @@ var init_pulumi = __esm({
 // src/infrastructure/shared/resource-checks.ts
 async function roleExists(roleName) {
   try {
-    const { IAMClient: IAMClient6, GetRoleCommand: GetRoleCommand4 } = await import("@aws-sdk/client-iam");
-    const iam13 = new IAMClient6({ region: "us-east-1" });
+    const { IAMClient: IAMClient7, GetRoleCommand: GetRoleCommand4 } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient7({ region: "us-east-1" });
     await iam13.send(new GetRoleCommand4({ RoleName: roleName }));
     return true;
   } catch (error) {
@@ -30138,8 +30171,8 @@ __export(iam_agent_user_exports, {
 import * as aws22 from "@pulumi/aws";
 async function userExists2(userName) {
   try {
-    const { IAMClient: IAMClient6, GetUserCommand } = await import("@aws-sdk/client-iam");
-    const iam13 = new IAMClient6({
+    const { IAMClient: IAMClient7, GetUserCommand } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient7({
       region: getDefaultRegion()
     });
     await iam13.send(new GetUserCommand({ UserName: userName }));
@@ -31692,8 +31725,8 @@ import { homedir as homedir6, tmpdir as tmpdir2 } from "os";
 import { join as join24 } from "path";
 import { Readable as Readable5 } from "stream";
 import { pipeline } from "stream/promises";
-import { cancel as cancel35, confirm as confirm29, intro as intro61, isCancel as isCancel40, log as log60 } from "@clack/prompts";
-import pc70 from "picocolors";
+import { cancel as cancel35, confirm as confirm30, intro as intro62, isCancel as isCancel41, log as log61 } from "@clack/prompts";
+import pc71 from "picocolors";
 function isStandaloneInstall() {
   return process.execPath.includes(".wraps/runtime");
 }
@@ -31722,7 +31755,7 @@ function detectPlatformArch() {
   return { platform: platform3, arch };
 }
 async function update(currentVersion) {
-  intro61(pc70.bold("Wraps CLI Update"));
+  intro62(pc71.bold("Wraps CLI Update"));
   const progress = new DeploymentProgress();
   const result = await progress.execute(
     "Checking for updates...",
@@ -31734,27 +31767,27 @@ async function update(currentVersion) {
   }
   const { version: latestVersion, release: release2 } = result;
   if (currentVersion === latestVersion) {
-    progress.succeed(`Already up to date ${pc70.dim(`(v${currentVersion})`)}`);
+    progress.succeed(`Already up to date ${pc71.dim(`(v${currentVersion})`)}`);
     return;
   }
   console.log();
-  log60.info(
-    `Current version: ${pc70.dim(`v${currentVersion}`)}
-  Latest version:  ${pc70.cyan(`v${latestVersion}`)}`
+  log61.info(
+    `Current version: ${pc71.dim(`v${currentVersion}`)}
+  Latest version:  ${pc71.cyan(`v${latestVersion}`)}`
   );
   console.log();
   if (!isStandaloneInstall()) {
-    log60.info(
+    log61.info(
       `You installed Wraps via npm. Update with:
 
-  ${pc70.cyan("npm update -g @wraps.dev/cli")}`
+  ${pc71.cyan("npm update -g @wraps.dev/cli")}`
     );
     return;
   }
-  const shouldUpdate = await confirm29({
+  const shouldUpdate = await confirm30({
     message: `Update to v${latestVersion}?`
   });
-  if (isCancel40(shouldUpdate) || !shouldUpdate) {
+  if (isCancel41(shouldUpdate) || !shouldUpdate) {
     cancel35("Update cancelled.");
     return;
   }
@@ -31822,7 +31855,7 @@ async function update(currentVersion) {
     });
     console.log();
     progress.succeed(
-      `Updated to ${pc70.cyan(`v${latestVersion}`)} successfully!`
+      `Updated to ${pc71.cyan(`v${latestVersion}`)} successfully!`
     );
   } finally {
     rmSync(tmp, { recursive: true, force: true });
@@ -31846,7 +31879,7 @@ import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname6, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import * as clack66 from "@clack/prompts";
-import pc71 from "picocolors";
+import pc72 from "picocolors";
 
 // src/commands/auth/login.ts
 init_esm_shims();
@@ -32427,7 +32460,7 @@ function collectRemediations(findings) {
 // src/commands/aws/doctor.ts
 init_json_output();
 var CATEGORY = "AWS Setup";
-async function runDiagnostics(state2) {
+async function runDiagnostics(state2, regionOverride) {
   const results = [];
   if (state2.cliInstalled) {
     results.push({
@@ -32613,6 +32646,8 @@ async function runDiagnostics(state2) {
     }
     return results;
   }
+  const configuredRegion = state2.region || "us-east-1";
+  const effectiveRegion = regionOverride || state2.region;
   if (state2.region) {
     results.push({
       status: "pass",
@@ -32628,6 +32663,14 @@ async function runDiagnostics(state2) {
       remediation: remediations.setAwsRegion()
     });
   }
+  if (regionOverride && regionOverride !== configuredRegion) {
+    results.push({
+      status: "info",
+      category: CATEGORY,
+      name: `Checked region: ${regionOverride}`,
+      details: state2.region ? `Overrides the configured region ${state2.region}. The SES check below is about ${regionOverride}.` : `The SES check below is about ${regionOverride}, not the us-east-1 default.`
+    });
+  }
   if (!state2.sso.configured) {
     const profiles = getConfiguredProfiles();
     if (profiles.length > 1) {
@@ -32640,11 +32683,19 @@ async function runDiagnostics(state2) {
     }
   }
   if (state2.credentialsConfigured) {
-    const regionUsed = state2.region || "us-east-1";
-    const regionNote = state2.region ? `Region: ${regionUsed}` : `No AWS_REGION set \u2014 defaulted to ${regionUsed}. Set AWS_REGION if your deployment lives elsewhere.`;
+    const regionUsed = effectiveRegion || "us-east-1";
+    const regionNote = effectiveRegion ? `Region: ${regionUsed}` : `No AWS_REGION set \u2014 defaulted to ${regionUsed}. Set AWS_REGION if your deployment lives elsewhere.`;
     try {
-      const sandbox = await isSESSandbox(regionUsed);
-      if (sandbox) {
+      const ses = await getSESAccountStatus(regionUsed);
+      if (ses.sandboxUncertain) {
+        results.push({
+          status: "info",
+          category: CATEGORY,
+          name: "Could not confirm SES account status",
+          details: `SES may not be enabled in this region, or the account may lack ses:GetAccount.
+${regionNote}`
+        });
+      } else if (ses.isSandbox) {
         results.push({
           status: "warn",
           category: CATEGORY,
@@ -32665,7 +32716,7 @@ ${regionNote}`,
       results.push({
         status: "info",
         category: CATEGORY,
-        name: "Could not check SES status",
+        name: "Could not confirm SES account status",
         details: `SES may not be enabled in this region.
 ${regionNote}`
       });
@@ -32731,22 +32782,32 @@ function suggestionsFor(results) {
     results.filter((r6) => r6.status === "fail" || r6.status === "warn")
   ).map(formatRemediation);
 }
-async function collectAwsFindings() {
-  const state2 = await detectAWSState();
-  return { findings: await runDiagnostics(state2), state: state2 };
+async function collectAwsFindings(options = {}) {
+  const state2 = options.state ?? await detectAWSState();
+  return { findings: await runDiagnostics(state2, options.region), state: state2 };
 }
-async function doctor() {
+async function doctor(options = {}) {
   const startTime = Date.now();
   if (!isJsonMode()) {
     clack5.intro(pc6.bold("AWS Setup Diagnostics"));
   }
   const spinner11 = isJsonMode() ? null : clack5.spinner();
   spinner11?.start("Running diagnostics...");
-  const { findings: results } = await collectAwsFindings();
+  const { findings: results, state: state2 } = await collectAwsFindings({
+    region: options.region
+  });
   spinner11?.stop("Diagnostics complete");
   const failCount = results.filter((r6) => r6.status === "fail").length;
   const warnCount = results.filter((r6) => r6.status === "warn").length;
   const passCount = results.filter((r6) => r6.status === "pass").length;
+  trackCommand("aws:doctor", {
+    success: true,
+    duration_ms: Date.now() - startTime,
+    region: options.region || state2.region || "us-east-1",
+    pass_count: passCount,
+    fail_count: failCount,
+    warn_count: warnCount
+  });
   if (isJsonMode()) {
     jsonSuccess("aws.doctor", {
       checks: results.map((r6) => ({
@@ -32778,13 +32839,6 @@ async function doctor() {
       console.log(`  ${pc6.dim("-")} ${suggestion}`);
     }
   }
-  trackCommand("aws:doctor", {
-    success: true,
-    duration_ms: Date.now() - startTime,
-    pass_count: passCount,
-    fail_count: failCount,
-    warn_count: warnCount
-  });
   console.log();
   clack5.outro(
     pc6.dim(failCount > 0 ? "See suggested fixes above" : "Ready to deploy")
@@ -34188,8 +34242,8 @@ init_constants();
 import * as aws3 from "@pulumi/aws";
 async function getExistingOIDCProviderArn(url) {
   try {
-    const { IAMClient: IAMClient6, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
-    const iam13 = new IAMClient6({
+    const { IAMClient: IAMClient7, ListOpenIDConnectProvidersCommand } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient7({
       region: getDefaultRegion()
     });
     const response = await iam13.send(new ListOpenIDConnectProvidersCommand({}));
@@ -36269,6 +36323,7 @@ ${pc16.dim("Tip:")} Run ${pc16.cyan("wraps cdn sync")} to update infrastructure
 init_esm_shims();
 init_events();
 init_aws();
+init_aws_detection();
 import * as clack16 from "@clack/prompts";
 import pc18 from "picocolors";
 init_json_output();
@@ -37256,19 +37311,23 @@ async function wrapsDoctor(options) {
     clack16.intro(pc18.bold("Wraps Doctor"));
   }
   const progress = new DeploymentProgress();
-  const { findings: awsFindings, state: state2 } = await progress.execute(
-    "Checking AWS setup",
-    async () => collectAwsFindings()
+  const state2 = await progress.execute(
+    "Detecting AWS setup",
+    async () => detectAWSState()
   );
-  const findings = [...awsFindings];
   const emailConnections = state2.credentialsConfigured && state2.accountId ? await findConnectionsWithService(state2.accountId, "email") : [];
   const regionExplicit = Boolean(
     options.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION
   );
-  let region = options.region || await getAWSRegion();
+  let region = options.region || state2.region || await getAWSRegion();
   if (!regionExplicit && emailConnections.length > 0) {
     region = emailConnections[0].region;
   }
+  const { findings: awsFindings } = await progress.execute(
+    "Checking AWS setup",
+    async () => collectAwsFindings({ region, state: state2 })
+  );
+  const findings = [...awsFindings];
   if (state2.credentialsConfigured && state2.accountId) {
     if (!regionExplicit && emailConnections.length > 1) {
       findings.push({
@@ -38273,8 +38332,8 @@ function convertToSMTPPassword2(secretAccessKey, region) {
 }
 async function userExists(userName) {
   try {
-    const { IAMClient: IAMClient6, GetUserCommand } = await import("@aws-sdk/client-iam");
-    const iam13 = new IAMClient6({
+    const { IAMClient: IAMClient7, GetUserCommand } = await import("@aws-sdk/client-iam");
+    const iam13 = new IAMClient7({
       region: getDefaultRegion()
     });
     await iam13.send(new GetUserCommand({ UserName: userName }));
@@ -47187,8 +47246,8 @@ function getRequiredActions(config2) {
 }
 async function checkIAMPermissions(userArn, actions, region) {
   try {
-    const { IAMClient: IAMClient6, SimulatePrincipalPolicyCommand } = await import("@aws-sdk/client-iam");
-    const client2 = new IAMClient6({ region });
+    const { IAMClient: IAMClient7, SimulatePrincipalPolicyCommand } = await import("@aws-sdk/client-iam");
+    const client2 = new IAMClient7({ region });
     const batchSize = 100;
     const batches = [];
     for (let i6 = 0; i6 < actions.length; i6 += batchSize) {
@@ -48041,12 +48100,12 @@ async function emailLogsList(options) {
   }
   const COL = { time: 8, status: 11, to: 28, subject: 40, msgId: 18 };
   const header = pc32.bold("Time".padEnd(COL.time)) + "  " + pc32.bold("Status".padEnd(COL.status)) + "  " + pc32.bold("To".padEnd(COL.to)) + "  " + pc32.bold("Subject".padEnd(COL.subject)) + "  " + pc32.bold("Message ID");
-  const rows = data.logs.map((log62) => {
-    const time2 = relativeTime(log62.createdAt).padEnd(COL.time);
-    const status2 = padVisible(colorStatus(log62.status), COL.status);
-    const to = padVisible(truncate(log62.recipient, COL.to), COL.to);
-    const subject = padVisible(truncate(log62.subject, COL.subject), COL.subject);
-    const msgId = truncate(log62.messageId, COL.msgId);
+  const rows = data.logs.map((log63) => {
+    const time2 = relativeTime(log63.createdAt).padEnd(COL.time);
+    const status2 = padVisible(colorStatus(log63.status), COL.status);
+    const to = padVisible(truncate(log63.recipient, COL.to), COL.to);
+    const subject = padVisible(truncate(log63.subject, COL.subject), COL.subject);
+    const msgId = truncate(log63.messageId, COL.msgId);
     return `${time2}  ${status2}  ${to}  ${subject}  ${msgId}`;
   });
   clack30.note(
@@ -48104,32 +48163,32 @@ async function emailLogsGet(options) {
     }
     return;
   }
-  const log62 = await resp.json();
+  const log63 = await resp.json();
   if (isJsonMode()) {
-    jsonSuccess("email.logs.get", log62);
+    jsonSuccess("email.logs.get", log63);
     return;
   }
   const kv = (label, value) => `${pc32.dim(label.padEnd(16))} ${value ?? pc32.dim("\u2014")}`;
-  const sentAt = log62.sentAt ? new Date(log62.sentAt).toLocaleString() : null;
-  const deliveredAt = log62.deliveredAt ? new Date(log62.deliveredAt).toLocaleString() : null;
-  const bouncedAt = log62.bouncedAt ? new Date(log62.bouncedAt).toLocaleString() : null;
-  const createdAt = new Date(log62.createdAt).toLocaleString();
+  const sentAt = log63.sentAt ? new Date(log63.sentAt).toLocaleString() : null;
+  const deliveredAt = log63.deliveredAt ? new Date(log63.deliveredAt).toLocaleString() : null;
+  const bouncedAt = log63.bouncedAt ? new Date(log63.bouncedAt).toLocaleString() : null;
+  const createdAt = new Date(log63.createdAt).toLocaleString();
   const lines = [
-    kv("Message ID:", log62.messageId),
-    kv("Status:", log62.status ? colorStatus(log62.status) : null),
-    kv("To:", log62.recipient),
-    kv("From:", log62.from),
-    kv("Subject:", log62.subject),
-    kv("Source:", log62.sourceType),
+    kv("Message ID:", log63.messageId),
+    kv("Status:", log63.status ? colorStatus(log63.status) : null),
+    kv("To:", log63.recipient),
+    kv("From:", log63.from),
+    kv("Subject:", log63.subject),
+    kv("Source:", log63.sourceType),
     kv("Sent:", sentAt),
     kv("Delivered:", deliveredAt),
     kv("Bounced:", bouncedAt),
-    ...log62.bouncedSubType ? [kv("Bounce type:", log62.bouncedSubType)] : [],
+    ...log63.bouncedSubType ? [kv("Bounce type:", log63.bouncedSubType)] : [],
     kv("Created:", createdAt)
   ];
   clack30.note(
     lines.join("\n"),
-    `Log Detail \u2014 ${log62.messageId ?? "(no message id)"}`
+    `Log Detail \u2014 ${log63.messageId ?? "(no message id)"}`
   );
 }
 
@@ -53345,10 +53404,7 @@ ${pc40.bold("Cost Impact:")}`);
       trackError("STACK_LOCKED", "email:upgrade", { step: "deploy" });
       throw errors.stackLocked();
     }
-    trackError("UPGRADE_FAILED", "email:upgrade", {
-      step: "deploy",
-      error_detail: redactSensitiveValues(msg).slice(0, 3e3)
-    });
+    trackError("UPGRADE_FAILED", "email:upgrade", { step: "deploy" });
     throw new Error(`Pulumi upgrade failed: ${extractPulumiErrorSummary(msg)}`);
   }
   let dnsAutoCreated = false;
@@ -55663,7 +55719,7 @@ import pc44 from "picocolors";
 // src/utils/license.ts
 init_esm_shims();
 import { sign as sign2 } from "crypto";
-var VALID_TIERS = ["starter", "growth", "scale"];
+var VALID_TIERS = ["pro", "business", "starter", "growth", "scale"];
 function generateLicenseKey(tier, expires) {
   if (!VALID_TIERS.includes(tier)) {
     throw new Error(
@@ -55687,7 +55743,7 @@ function generateLicenseKey(tier, expires) {
 
 // src/commands/license/generate.ts
 init_json_output();
-var VALID_TIERS2 = ["starter", "growth", "scale"];
+var VALID_TIERS2 = ["pro", "business", "starter", "growth", "scale"];
 async function licenseGenerate(options) {
   if (!isJsonMode()) {
     clack43.intro(pc44.bold("Wraps License Key Generator"));
@@ -56296,7 +56352,6 @@ import pc47 from "picocolors";
 init_events();
 init_aws();
 init_config();
-init_errors();
 init_fs();
 init_json_output();
 init_metadata();
@@ -56960,9 +57015,7 @@ You can try the manual flow: ${pc47.cyan("wraps auth logout")} then ${pc47.cyan(
     progress.stop();
     const duration = Date.now() - startTime;
     const errorCode = error instanceof Error ? error.name : "UNKNOWN_ERROR";
-    trackError(errorCode, "platform:connect", {
-      message: sanitizeErrorMessage(error)
-    });
+    trackError(errorCode, "platform:connect", { step: "authenticated" });
     trackCommand("platform:connect", {
       success: false,
       duration_ms: duration,
@@ -57243,9 +57296,7 @@ ${pc47.bold("Next Steps:")}`);
     progress.stop();
     const duration = Date.now() - startTime;
     const errorCode = error instanceof Error ? error.name : "UNKNOWN_ERROR";
-    trackError(errorCode, "platform:connect", {
-      message: sanitizeErrorMessage(error)
-    });
+    trackError(errorCode, "platform:connect", { step: "unauthenticated" });
     trackCommand("platform:connect", {
       success: false,
       duration_ms: duration
@@ -57254,54 +57305,285 @@ ${pc47.bold("Next Steps:")}`);
   }
 }
 
+// src/commands/platform/disconnect.ts
+init_esm_shims();
+init_dist();
+import {
+  DeleteRoleCommand as DeleteRoleCommand2,
+  DeleteRolePolicyCommand as DeleteRolePolicyCommand2,
+  IAMClient as IAMClient4
+} from "@aws-sdk/client-iam";
+import { confirm as confirm22, intro as intro40, isCancel as isCancel30, log as log42, outro as outro27 } from "@clack/prompts";
+import * as pulumi27 from "@pulumi/pulumi";
+import pc48 from "picocolors";
+init_aws();
+init_errors();
+init_fs();
+init_json_output();
+init_metadata();
+init_output();
+init_prompts();
+init_pulumi();
+init_region_resolver();
+async function removeConsoleAccessRole(region) {
+  const iam13 = new IAMClient4({ region });
+  try {
+    await iam13.send(
+      new DeleteRolePolicyCommand2({
+        RoleName: CONSOLE_ACCESS_ROLE_NAME,
+        PolicyName: "wraps-console-access-policy"
+      })
+    );
+  } catch (error) {
+    if (!isAWSNotFoundError(error)) {
+      throw error;
+    }
+  }
+  try {
+    await iam13.send(
+      new DeleteRoleCommand2({ RoleName: CONSOLE_ACCESS_ROLE_NAME })
+    );
+    return true;
+  } catch (error) {
+    if (isAWSNotFoundError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+async function disconnect(options) {
+  const json = isJsonMode();
+  if (!json) {
+    intro40(pc48.bold("Disconnect from Wraps Platform"));
+  }
+  const progress = new DeploymentProgress();
+  try {
+    await progress.execute(
+      "Checking Pulumi CLI installation",
+      async () => await ensurePulumiInstalled()
+    );
+    const identity = await progress.execute(
+      "Validating AWS credentials",
+      async () => validateAWSCredentials()
+    );
+    const region = await resolveRegionForCommand({
+      accountId: identity.accountId,
+      optionRegion: options.region,
+      label: "connection"
+    });
+    const metadata = await loadConnectionMetadata(identity.accountId, region);
+    if (!metadata) {
+      progress.stop();
+      if (json) {
+        jsonError("platform.disconnect", {
+          code: "NO_DEPLOYMENT",
+          message: `No Wraps deployment found for account ${identity.accountId} in ${region}.`,
+          suggestion: "Run `wraps email init` to deploy infrastructure first."
+        });
+        return;
+      }
+      log42.error(
+        `No Wraps deployment found for account ${pc48.cyan(identity.accountId)} in region ${pc48.cyan(region)}`
+      );
+      process.exit(1);
+    }
+    const emailService = metadata.services.email;
+    if (!emailService?.config) {
+      progress.stop();
+      if (json) {
+        jsonError("platform.disconnect", {
+          code: "NO_EMAIL_SERVICE",
+          message: "No email service deployed in this region.",
+          suggestion: "Run `wraps email init` first."
+        });
+        return;
+      }
+      log42.error("No email service deployed in this region.");
+      process.exit(1);
+    }
+    if (!emailService.webhookSecret) {
+      progress.stop();
+      if (json) {
+        jsonSuccess("platform.disconnect", {
+          accountId: identity.accountId,
+          region,
+          disconnected: false,
+          reason: "not connected"
+        });
+        return;
+      }
+      log42.info("This account is not connected to the Wraps Platform.");
+      outro27("Nothing to do");
+      return;
+    }
+    const stillSelfhosted = !!emailService.selfhostWebhook;
+    if (!(options.force || options.yes || json)) {
+      progress.stop();
+      log42.warn(
+        `SES events from AWS account ${pc48.cyan(identity.accountId)} will stop reaching ${pc48.cyan("app.wraps.dev")}.`
+      );
+      log42.info(
+        [
+          "This does NOT affect sending \u2014 your mail flows through your own SES.",
+          `Wraps' cross-account IAM role (${pc48.cyan(CONSOLE_ACCESS_ROLE_NAME)}) will be deleted, revoking dashboard access to this account.`,
+          stillSelfhosted ? `Your self-hosted control plane (${pc48.cyan(emailService.selfhostWebhook?.url ?? "self-hosted")}) keeps receiving events.` : "Dashboard email logs and analytics will stop updating for this account."
+        ].join("\n  ")
+      );
+      const confirmed = await confirm22({
+        message: "Disconnect from the Wraps Platform?",
+        initialValue: false
+      });
+      if (isCancel30(confirmed) || !confirmed) {
+        outro27("Disconnect cancelled");
+        return;
+      }
+    }
+    emailService.webhookSecret = void 0;
+    emailService.webhookUrl = void 0;
+    await saveConnectionMetadata(metadata);
+    if (metadata.provider === "vercel" && !metadata.vercel) {
+      progress.stop();
+      metadata.vercel = await promptVercelConfig();
+    }
+    const stackConfig = buildEmailStackConfig(metadata, region, {
+      webhook: void 0
+    });
+    await progress.execute("Removing platform event target", async () => {
+      await ensurePulumiWorkDir({ accountId: identity.accountId, region });
+      const stack = await pulumi27.automation.LocalWorkspace.createOrSelectStack(
+        {
+          stackName: emailService.pulumiStackName || `wraps-${identity.accountId}-${region}`,
+          projectName: "wraps-email",
+          program: async () => {
+            const result = await deployEmailStack(stackConfig);
+            return {
+              roleArn: result.roleArn,
+              configSetName: result.configSetName,
+              tableName: result.tableName,
+              region: result.region
+            };
+          }
+        },
+        {
+          workDir: getPulumiWorkDir(),
+          envVars: {
+            PULUMI_CONFIG_PASSPHRASE: "",
+            AWS_REGION: region
+          },
+          secretsProvider: "passphrase"
+        }
+      );
+      await stack.setConfig("aws:region", { value: region });
+      await stack.refresh({ onOutput: () => {
+      } });
+      const stackState = await stack.exportStack();
+      const resourceCount = stackState.deployment?.resources?.length ?? 0;
+      if (resourceCount > 1) {
+        stackConfig.skipResourceImports = true;
+      }
+      await stack.up({ onOutput: () => {
+      } });
+    });
+    progress.succeed("Platform event target removed");
+    const roleRemoved = await progress.execute(
+      "Revoking dashboard access",
+      async () => removeConsoleAccessRole(region)
+    );
+    metadata.platform = void 0;
+    await saveConnectionMetadata(metadata);
+    if (json) {
+      jsonSuccess("platform.disconnect", {
+        accountId: identity.accountId,
+        region,
+        disconnected: true,
+        selfhostWebhookRetained: stillSelfhosted,
+        consoleAccessRoleRemoved: roleRemoved
+      });
+      return;
+    }
+    console.log();
+    log42.success("Disconnected from the Wraps Platform.");
+    console.log();
+    console.log(
+      `  SES events from ${pc48.cyan(identity.accountId)} no longer reach app.wraps.dev.`
+    );
+    console.log(
+      roleRemoved ? `  Wraps' cross-account access role was deleted \u2014 the dashboard can no longer read this account.` : "  No cross-account access role was present to remove."
+    );
+    if (stillSelfhosted) {
+      console.log(
+        `  Your self-hosted plane at ${pc48.cyan(emailService.selfhostWebhook?.url ?? "")} is unchanged.`
+      );
+    }
+    console.log(
+      pc48.dim(`  Reconnect any time with ${pc48.cyan("wraps platform connect")}.`)
+    );
+    console.log();
+    outro27("Done");
+  } catch (error) {
+    progress.stop();
+    if (json) {
+      jsonError("platform.disconnect", {
+        code: "DISCONNECT_FAILED",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      return;
+    }
+    throw error;
+  }
+}
+
 // src/commands/platform/index.ts
 init_esm_shims();
 import * as clack46 from "@clack/prompts";
-import pc48 from "picocolors";
+import pc49 from "picocolors";
 async function platform2() {
-  clack46.intro(pc48.bold("Wraps Platform"));
+  clack46.intro(pc49.bold("Wraps Platform"));
   console.log();
   console.log(
     "  The Wraps Platform extends the free CLI with hosted features:"
   );
   console.log();
-  console.log(`  ${pc48.bold("Features:")}`);
-  console.log(`    ${pc48.green("\u2713")} Visual email template editor`);
-  console.log(`    ${pc48.green("\u2713")} Broadcast campaigns & scheduling`);
-  console.log(`    ${pc48.green("\u2713")} Contact management & segments`);
-  console.log(`    ${pc48.green("\u2713")} Workflow automations`);
-  console.log(`    ${pc48.green("\u2713")} Analytics dashboard`);
-  console.log(`    ${pc48.green("\u2713")} Team collaboration`);
+  console.log(`  ${pc49.bold("Features:")}`);
+  console.log(`    ${pc49.green("\u2713")} Visual email template editor`);
+  console.log(`    ${pc49.green("\u2713")} Broadcast campaigns & scheduling`);
+  console.log(`    ${pc49.green("\u2713")} Contact management & segments`);
+  console.log(`    ${pc49.green("\u2713")} Workflow automations`);
+  console.log(`    ${pc49.green("\u2713")} Analytics dashboard`);
+  console.log(`    ${pc49.green("\u2713")} Team collaboration`);
   console.log();
-  console.log(`  ${pc48.bold("Pricing:")}`);
-  console.log(`    ${pc48.cyan("Starter")}      $10/mo   5,000 contacts`);
-  console.log(`    ${pc48.cyan("Growth")}       $25/mo   25,000 contacts`);
-  console.log(`    ${pc48.cyan("Scale")}        $50/mo   100,000 contacts`);
-  console.log(`    ${pc48.cyan("Enterprise")}   Custom   Unlimited contacts`);
+  console.log(`  ${pc49.bold("Pricing:")}`);
+  console.log(`    ${pc49.cyan("Starter")}      $10/mo   5,000 contacts`);
+  console.log(`    ${pc49.cyan("Growth")}       $25/mo   25,000 contacts`);
+  console.log(`    ${pc49.cyan("Scale")}        $50/mo   100,000 contacts`);
+  console.log(`    ${pc49.cyan("Enterprise")}   Custom   Unlimited contacts`);
   console.log();
   console.log(
-    pc48.dim("  + AWS costs at $0.10 per 1,000 emails (paid directly to AWS)")
+    pc49.dim("  + AWS costs at $0.10 per 1,000 emails (paid directly to AWS)")
   );
   console.log();
   console.log(
-    `  ${pc48.bold("Learn more:")} ${pc48.cyan("https://wraps.dev/platform")}`
+    `  ${pc49.bold("Learn more:")} ${pc49.cyan("https://wraps.dev/platform")}`
   );
   console.log();
-  console.log(pc48.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc49.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
-  console.log(`  ${pc48.bold("Platform Commands:")}`);
+  console.log(`  ${pc49.bold("Platform Commands:")}`);
   console.log();
   console.log(
-    `    ${pc48.cyan("wraps platform connect")}      Connect infrastructure to Wraps Platform`
+    `    ${pc49.cyan("wraps platform connect")}      Connect infrastructure to Wraps Platform`
+  );
+  console.log(
+    `    ${pc49.cyan("wraps platform disconnect")}   Stop streaming events to Wraps Platform`
   );
   console.log(
-    `    ${pc48.cyan("wraps platform update-role")}  Update IAM permissions for dashboard`
+    `    ${pc49.cyan("wraps platform update-role")}  Update IAM permissions for dashboard`
   );
   console.log();
   console.log(
-    pc48.dim("  The connect command sets up event streaming and IAM permissions")
+    pc49.dim("  The connect command sets up event streaming and IAM permissions")
   );
-  console.log(pc48.dim("  in one step. Run it after deploying infrastructure."));
+  console.log(pc49.dim("  in one step. Run it after deploying infrastructure."));
   console.log();
 }
 
@@ -57317,15 +57599,15 @@ init_region_resolver();
 import {
   CreateRoleCommand as CreateRoleCommand2,
   GetRoleCommand as GetRoleCommand2,
-  IAMClient as IAMClient4,
+  IAMClient as IAMClient5,
   UpdateAssumeRolePolicyCommand as UpdateAssumeRolePolicyCommand2
 } from "@aws-sdk/client-iam";
-import { confirm as confirm22, intro as intro41, isCancel as isCancel30, log as log42, outro as outro27 } from "@clack/prompts";
-import pc49 from "picocolors";
+import { confirm as confirm23, intro as intro42, isCancel as isCancel31, log as log43, outro as outro28 } from "@clack/prompts";
+import pc50 from "picocolors";
 async function updateRole(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    intro41(pc49.bold("Update Platform Access Role"));
+    intro42(pc50.bold("Update Platform Access Role"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -57340,19 +57622,19 @@ async function updateRole(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     progress.stop();
-    log42.error(
-      `No Wraps deployment found for account ${pc49.cyan(identity.accountId)} in region ${pc49.cyan(region)}`
+    log43.error(
+      `No Wraps deployment found for account ${pc50.cyan(identity.accountId)} in region ${pc50.cyan(region)}`
     );
     console.log(
       `
-Run ${pc49.cyan("wraps email init")} to deploy infrastructure first.
+Run ${pc50.cyan("wraps email init")} to deploy infrastructure first.
 `
     );
     process.exit(1);
   }
   const selfhosted = options.selfhosted === true;
   const roleName = selfhosted ? SELFHOST_CONSOLE_ACCESS_ROLE_NAME : CONSOLE_ACCESS_ROLE_NAME;
-  const iam13 = new IAMClient4({ region: "us-east-1" });
+  const iam13 = new IAMClient5({ region: "us-east-1" });
   const WRAPS_PLATFORM_ACCOUNT_ID2 = "905130073023";
   const trustedAccountId = selfhosted ? metadata.accountId : WRAPS_PLATFORM_ACCOUNT_ID2;
   let roleExists2 = false;
@@ -57368,13 +57650,13 @@ Run ${pc49.cyan("wraps email init")} to deploy infrastructure first.
   const externalId = selfhosted ? metadata.selfhostPlatform?.externalId : metadata.platform?.externalId;
   if (!(roleExists2 || externalId)) {
     progress.stop();
-    log42.warn(`IAM role ${pc49.cyan(roleName)} does not exist`);
+    log43.warn(`IAM role ${pc50.cyan(roleName)} does not exist`);
     if (selfhosted) {
       console.log(
         "\nThis role is created when your self-hosted control plane connects this AWS account."
       );
       console.log(
-        `Run ${pc49.cyan("wraps selfhost connect")} to create the role automatically.
+        `Run ${pc50.cyan("wraps selfhost connect")} to create the role automatically.
 `
       );
     } else {
@@ -57382,28 +57664,28 @@ Run ${pc49.cyan("wraps email init")} to deploy infrastructure first.
         "\nThis role is created when you connect AWS accounts through the Wraps Platform."
       );
       console.log(
-        `Run ${pc49.cyan("wraps platform connect")} while logged in to create the role automatically.
+        `Run ${pc50.cyan("wraps platform connect")} while logged in to create the role automatically.
 `
       );
     }
     process.exit(0);
   }
   if (roleExists2) {
-    progress.info(`Found IAM role: ${pc49.cyan(roleName)}`);
+    progress.info(`Found IAM role: ${pc50.cyan(roleName)}`);
   } else {
     progress.info(
-      `IAM role ${pc49.cyan(roleName)} not found \u2014 will create it using stored externalId`
+      `IAM role ${pc50.cyan(roleName)} not found \u2014 will create it using stored externalId`
     );
   }
   if (!options.force) {
     progress.stop();
     const actionLabel = roleExists2 ? "Update" : "Create";
-    const shouldContinue = await confirm22({
-      message: `${actionLabel} IAM role ${pc49.cyan(roleName)} with latest permissions?`,
+    const shouldContinue = await confirm23({
+      message: `${actionLabel} IAM role ${pc50.cyan(roleName)} with latest permissions?`,
       initialValue: true
     });
-    if (isCancel30(shouldContinue) || !shouldContinue) {
-      outro27(`${actionLabel} cancelled`);
+    if (isCancel31(shouldContinue) || !shouldContinue) {
+      outro28(`${actionLabel} cancelled`);
       process.exit(0);
     }
   }
@@ -57509,51 +57791,51 @@ Run ${pc49.cyan("wraps email init")} to deploy infrastructure first.
     });
     return;
   }
-  outro27(pc49.green(`\u2713 Platform access role ${actionVerb} successfully`));
+  outro28(pc50.green(`\u2713 Platform access role ${actionVerb} successfully`));
   console.log(`
-${pc49.bold("Permissions:")}`);
+${pc50.bold("Permissions:")}`);
   console.log(`
-  ${pc49.bold(pc49.cyan("Email:"))}`);
+  ${pc50.bold(pc50.cyan("Email:"))}`);
   console.log(
-    `  ${pc49.green("\u2713")} SES metrics and identity verification (always enabled)`
+    `  ${pc50.green("\u2713")} SES metrics and identity verification (always enabled)`
   );
-  console.log(`  ${pc49.green("\u2713")} SES template management (always enabled)`);
-  console.log(`  ${pc49.green("\u2713")} Inbound bucket detection (always enabled)`);
+  console.log(`  ${pc50.green("\u2713")} SES template management (always enabled)`);
+  console.log(`  ${pc50.green("\u2713")} Inbound bucket detection (always enabled)`);
   if (sendingEnabled) {
-    console.log(`  ${pc49.green("\u2713")} Email sending via SES`);
+    console.log(`  ${pc50.green("\u2713")} Email sending via SES`);
   }
   console.log(
-    `  ${pc49.green("\u2713")} DynamoDB read access (including DescribeTable)`
+    `  ${pc50.green("\u2713")} DynamoDB read access (including DescribeTable)`
   );
   if (eventTracking?.enabled) {
-    console.log(`  ${pc49.green("\u2713")} EventBridge and SQS access`);
+    console.log(`  ${pc50.green("\u2713")} EventBridge and SQS access`);
   }
   if (emailArchiving?.enabled) {
-    console.log(`  ${pc49.green("\u2713")} Mail Manager Archive access`);
+    console.log(`  ${pc50.green("\u2713")} Mail Manager Archive access`);
   }
   const inbound = emailConfig?.inbound;
   if (inbound?.enabled) {
-    console.log(`  ${pc49.green("\u2713")} S3 access for inbound email`);
+    console.log(`  ${pc50.green("\u2713")} S3 access for inbound email`);
   }
   if (smsEnabled) {
     console.log(`
-  ${pc49.bold(pc49.cyan("SMS:"))}`);
+  ${pc50.bold(pc50.cyan("SMS:"))}`);
     console.log(
-      `  ${pc49.green("\u2713")} SMS Voice V2 read access (phone numbers, config, registrations)`
+      `  ${pc50.green("\u2713")} SMS Voice V2 read access (phone numbers, config, registrations)`
     );
     if (smsSendingEnabled) {
-      console.log(`  ${pc49.green("\u2713")} SMS sending via SMS Voice V2`);
+      console.log(`  ${pc50.green("\u2713")} SMS sending via SMS Voice V2`);
     }
     if (smsEventTracking?.dynamoDBHistory) {
-      console.log(`  ${pc49.green("\u2713")} DynamoDB read access for SMS history`);
+      console.log(`  ${pc50.green("\u2713")} DynamoDB read access for SMS history`);
     }
     if (smsEventTracking?.enabled) {
-      console.log(`  ${pc49.green("\u2713")} SNS topic access for SMS events`);
+      console.log(`  ${pc50.green("\u2713")} SNS topic access for SMS events`);
     }
   }
   console.log(
     `
-${pc49.dim(`The Wraps Platform will now have ${actionVerb} permissions for feature detection.`)}
+${pc50.dim(`The Wraps Platform will now have ${actionVerb} permissions for feature detection.`)}
 `
   );
 }
@@ -57751,12 +58033,12 @@ function buildConsolePolicyDocument2(emailConfig, smsConfig) {
 init_esm_shims();
 init_events();
 import * as clack47 from "@clack/prompts";
-import pc50 from "picocolors";
+import pc51 from "picocolors";
 
 // src/utils/selfhost/email-stack.ts
 init_esm_shims();
 init_dist();
-import { GetRoleCommand as GetRoleCommand3, IAMClient as IAMClient5 } from "@aws-sdk/client-iam";
+import { GetRoleCommand as GetRoleCommand3, IAMClient as IAMClient6 } from "@aws-sdk/client-iam";
 import {
   ListConfigurationSetsCommand as ListConfigurationSetsCommand2,
   ListEmailIdentitiesCommand,
@@ -57764,7 +58046,7 @@ import {
 } from "@aws-sdk/client-sesv2";
 async function detectEmailStack(region) {
   try {
-    const iam13 = new IAMClient5({ region });
+    const iam13 = new IAMClient6({ region });
     const ses = new SESv2Client9({ region });
     const [roleResult, setsResult, identitiesResult] = await Promise.allSettled(
       [
@@ -57815,7 +58097,7 @@ init_region_resolver();
 async function selfhostEnv(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack47.intro(pc50.bold("Wraps Self-Hosted \u2014 Vercel Environment Variables"));
+    clack47.intro(pc51.bold("Wraps Self-Hosted \u2014 Vercel Environment Variables"));
   }
   const identity = await validateAWSCredentials();
   const region = await resolveRegionForCommand({
@@ -57829,7 +58111,7 @@ async function selfhostEnv(options) {
     clack47.log.error("No self-hosted deployment found");
     console.log(
       `
-Run ${pc50.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane.
+Run ${pc51.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane.
 `
     );
     process.exit(1);
@@ -57843,7 +58125,7 @@ Run ${pc50.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
     );
     console.log(
       `
-The deployment may have failed partway through. Run ${pc50.cyan("pnpm selfhost:upgrade")} from your fork to complete it.
+The deployment may have failed partway through. Run ${pc51.cyan("pnpm selfhost:upgrade")} from your fork to complete it.
 `
     );
     process.exit(1);
@@ -57949,7 +58231,7 @@ The deployment may have failed partway through. Run ${pc50.cyan("pnpm selfhost:u
     `# AWS_ROLE_ARN=arn:aws:iam::${identity.accountId}:role/<your-vercel-backend-role>`
   );
   clack47.outro(
-    pc50.dim(
+    pc51.dim(
       "Paste into Vercel \u2192 Settings \u2192 Environment Variables \u2192 Add from .env"
     )
   );
@@ -57964,7 +58246,7 @@ init_esm_shims();
 init_events();
 import * as clack48 from "@clack/prompts";
 import open2 from "open";
-import pc51 from "picocolors";
+import pc52 from "picocolors";
 init_aws();
 init_config();
 init_json_output();
@@ -57973,7 +58255,7 @@ init_region_resolver();
 async function selfhostLogin(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack48.intro(pc51.bold("Wraps Self-Hosted \u203A Sign In"));
+    clack48.intro(pc52.bold("Wraps Self-Hosted \u203A Sign In"));
   }
   const identity = await validateAWSCredentials();
   const region = await resolveRegionForCommand({
@@ -57987,7 +58269,7 @@ async function selfhostLogin(options) {
     clack48.log.error("No self-hosted deployment found.");
     console.log(
       `
-Run ${pc51.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane first.
+Run ${pc52.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane first.
 `
     );
     process.exit(1);
@@ -57995,7 +58277,7 @@ Run ${pc51.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
   }
   const { appUrl: baseURL } = metadata.services.selfhost.config;
   const apiUrl = await reconcileSelfhostApiUrl(metadata, region);
-  clack48.log.info(`Connecting to: ${pc51.cyan(baseURL)}`);
+  clack48.log.info(`Connecting to: ${pc52.cyan(baseURL)}`);
   const authClient = createCliAuthClient(baseURL);
   const spinner11 = clack48.spinner();
   const { data: codeData, error: codeError } = await authClient.device.code({
@@ -58011,14 +58293,14 @@ Run ${pc51.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
       step: "request_code"
     });
     clack48.log.error(
-      `Failed to reach ${pc51.cyan(baseURL)}. Make sure the dashboard is deployed and reachable.`
+      `Failed to reach ${pc52.cyan(baseURL)}. Make sure the dashboard is deployed and reachable.`
     );
     throw new Error("Failed to start device authorization.");
   }
   const { device_code, user_code, interval, expires_in } = codeData;
   const formatted = `${user_code.slice(0, 4)}-${user_code.slice(4)}`;
-  clack48.log.info(`Your code:  ${pc51.bold(pc51.cyan(formatted))}`);
-  clack48.log.info(`Visit: ${pc51.underline(`${baseURL}/device`)}`);
+  clack48.log.info(`Your code:  ${pc52.bold(pc52.cyan(formatted))}`);
+  clack48.log.info(`Visit: ${pc52.underline(`${baseURL}/device`)}`);
   try {
     await open2(`${baseURL}/device?user_code=${user_code}`);
     clack48.log.info("Opening browser...");
@@ -58055,18 +58337,18 @@ Run ${pc51.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
       });
       clack48.log.success("Signed in to your self-hosted Wraps instance.");
       if (organizations.length === 1) {
-        clack48.log.info(`Organization: ${pc51.cyan(organizations[0].name)}`);
+        clack48.log.info(`Organization: ${pc52.cyan(organizations[0].name)}`);
       } else if (organizations.length > 1) {
         clack48.log.info(`${organizations.length} organizations available`);
       } else {
         clack48.log.info(
-          `No organizations found. Create one at ${pc51.underline(`${baseURL}/onboarding`)} and run ${pc51.cyan("wraps selfhost login")} again.`
+          `No organizations found. Create one at ${pc52.underline(`${baseURL}/onboarding`)} and run ${pc52.cyan("wraps selfhost login")} again.`
         );
       }
       if (isJsonMode()) {
         jsonSuccess("selfhost.login", { tokenType: "session", organizations });
       } else {
-        clack48.outro(pc51.green("Done!"));
+        clack48.outro(pc52.green("Done!"));
       }
       return;
     }
@@ -58114,10 +58396,10 @@ init_json_output();
 init_metadata();
 init_region_resolver();
 import * as clack49 from "@clack/prompts";
-import pc52 from "picocolors";
+import pc53 from "picocolors";
 async function selfhostLogout(options) {
   if (!isJsonMode()) {
-    clack49.intro(pc52.bold("Wraps Self-Hosted \u203A Sign Out"));
+    clack49.intro(pc53.bold("Wraps Self-Hosted \u203A Sign Out"));
   }
   const identity = await validateAWSCredentials();
   const region = await resolveRegionForCommand({
@@ -58131,7 +58413,7 @@ async function selfhostLogout(options) {
     clack49.log.error("No self-hosted deployment found.");
     console.log(
       `
-Run ${pc52.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane first.
+Run ${pc53.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted control plane first.
 `
     );
     process.exit(1);
@@ -58150,7 +58432,7 @@ Run ${pc52.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
       });
       return;
     }
-    clack49.log.info(`Not signed in to ${pc52.cyan(baseURL)}.`);
+    clack49.log.info(`Not signed in to ${pc53.cyan(baseURL)}.`);
     return;
   }
   await clearSelfhostAuth(baseURL);
@@ -58159,13 +58441,13 @@ Run ${pc52.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
     jsonSuccess("selfhost.logout", { loggedOut: true });
     return;
   }
-  clack49.log.success(`Signed out of ${pc52.cyan(baseURL)}.`);
+  clack49.log.success(`Signed out of ${pc53.cyan(baseURL)}.`);
 }
 
 // src/commands/selfhost/logs.ts
 init_esm_shims();
 import * as clack50 from "@clack/prompts";
-import pc53 from "picocolors";
+import pc54 from "picocolors";
 
 // src/utils/selfhost/logs.ts
 init_esm_shims();
@@ -58504,10 +58786,10 @@ var MAX_INTERVAL_SECONDS = 60;
 var FOLLOW_BACKFILL_MS = 5 * 60 * 1e3;
 var MAX_ENTRIES = 1e3;
 var SOURCE_COLORS = {
-  api: pc53.cyan,
-  web: pc53.magenta,
-  workers: pc53.blue,
-  other: pc53.gray
+  api: pc54.cyan,
+  web: pc54.magenta,
+  workers: pc54.blue,
+  other: pc54.gray
 };
 function formatTime(timestamp) {
   const date2 = new Date(timestamp);
@@ -58516,25 +58798,25 @@ function formatTime(timestamp) {
 }
 function colorLevel(level) {
   if (!level) {
-    return pc53.dim("     ");
+    return pc54.dim("     ");
   }
   const padded = level.padEnd(5).slice(0, 5);
   if (level === "ERROR" || level === "FATAL" || level === "CRITICAL") {
-    return pc53.red(padded);
+    return pc54.red(padded);
   }
   if (level === "WARN") {
-    return pc53.yellow(padded);
+    return pc54.yellow(padded);
   }
   if (level === "INFO") {
-    return pc53.green(padded);
+    return pc54.green(padded);
   }
-  return pc53.dim(padded);
+  return pc54.dim(padded);
 }
 function renderEntry(entry, options) {
   const level = detectLevel(entry.message);
   const label = logSourceLabel(entry.source).padEnd(options.sourceWidth);
   const body = options.verbose ? entry.message : formatMessageBody(entry.message);
-  return `${pc53.dim(formatTime(entry.timestamp))}  ${SOURCE_COLORS[entry.source](label)}  ${colorLevel(level)}  ${body}`;
+  return `${pc54.dim(formatTime(entry.timestamp))}  ${SOURCE_COLORS[entry.source](label)}  ${colorLevel(level)}  ${body}`;
 }
 function toJsonEntry(entry) {
   return {
@@ -58605,17 +58887,17 @@ function printGroupSummary(groups) {
     bySource.set(group4.source, existing);
   }
   const parts = [...bySource.entries()].map(
-    ([source, names]) => `${SOURCE_COLORS[source](logSourceLabel(source))} ${pc53.dim(`(${names.length})`)}`
+    ([source, names]) => `${SOURCE_COLORS[source](logSourceLabel(source))} ${pc54.dim(`(${names.length})`)}`
   );
   console.log(
-    `${pc53.dim("Sources:")} ${parts.join(pc53.dim(" \xB7 "))}  ${pc53.dim(`${groups.length} log group${groups.length === 1 ? "" : "s"}`)}`
+    `${pc54.dim("Sources:")} ${parts.join(pc54.dim(" \xB7 "))}  ${pc54.dim(`${groups.length} log group${groups.length === 1 ? "" : "s"}`)}`
   );
 }
 async function selfhostLogs(options) {
   const progress = new DeploymentProgress();
   const json = isJsonMode();
   if (!json) {
-    clack50.intro(pc53.bold("Wraps Self-Hosted Logs"));
+    clack50.intro(pc54.bold("Wraps Self-Hosted Logs"));
   }
   const sinceMs = parseSince(options.since ?? DEFAULT_SINCE);
   const intervalSeconds = parseInterval(options.interval);
@@ -58717,18 +58999,18 @@ async function printWindow(context, window) {
     clack50.log.info(
       window.errorsOnly ? `No errors in the last ${window.sinceLabel}.` : `No log events in the last ${window.sinceLabel}.`
     );
-    clack50.outro(pc53.dim("Nothing to report"));
+    clack50.outro(pc54.dim("Nothing to report"));
     return;
   }
   context.emit(entries);
   console.log("");
   if (entries.length >= MAX_ENTRIES) {
     clack50.log.warn(
-      `Showing the most recent ${MAX_ENTRIES} events \u2014 narrow the window with ${pc53.cyan("--since")} to see more.`
+      `Showing the most recent ${MAX_ENTRIES} events \u2014 narrow the window with ${pc54.cyan("--since")} to see more.`
     );
   }
   clack50.outro(
-    pc53.dim(
+    pc54.dim(
       `${entries.length} event${entries.length === 1 ? "" : "s"} from the last ${window.sinceLabel}`
     )
   );
@@ -58737,17 +59019,17 @@ function printFollowHeader(context) {
   printGroupSummary(context.groups);
   if (context.live) {
     console.log(
-      pc53.yellow(
+      pc54.yellow(
         "\u26A0 CloudWatch Live Tail bills ~$0.01/min for as long as this session is open."
       )
     );
     console.log(
-      pc53.dim(`Live tailing \xB7 ${pc53.reset(pc53.bold("Ctrl+C"))} to stop`)
+      pc54.dim(`Live tailing \xB7 ${pc54.reset(pc54.bold("Ctrl+C"))} to stop`)
     );
   } else {
     console.log(
-      pc53.dim(
-        `Polling every ${context.intervalSeconds}s \xB7 ${pc53.reset(pc53.bold("Ctrl+C"))} to stop`
+      pc54.dim(
+        `Polling every ${context.intervalSeconds}s \xB7 ${pc54.reset(pc54.bold("Ctrl+C"))} to stop`
       )
     );
   }
@@ -58797,13 +59079,13 @@ async function follow(context) {
   }
   if (!context.json) {
     console.log("");
-    clack50.outro(pc53.dim("Stopped"));
+    clack50.outro(pc54.dim("Stopped"));
   }
 }
 async function runLiveTail(context, control) {
   if (context.groups.length > liveTailGroupLimit() && !context.json) {
     clack50.log.warn(
-      `Live Tail supports ${liveTailGroupLimit()} log groups per session \u2014 tailing the first ${liveTailGroupLimit()}. Use ${pc53.cyan("--source")} to choose which.`
+      `Live Tail supports ${liveTailGroupLimit()} log groups per session \u2014 tailing the first ${liveTailGroupLimit()}. Use ${pc54.cyan("--source")} to choose which.`
     );
   }
   const session = startSelfhostLiveTail({
@@ -58824,7 +59106,7 @@ async function runLiveTail(context, control) {
   }
   if (!(control.isStopped() || context.json)) {
     clack50.log.warn(
-      `Live Tail session ended (AWS caps sessions at ~3 hours). Run ${pc53.cyan("wraps selfhost logs --follow --live")} again to resume.`
+      `Live Tail session ended (AWS caps sessions at ~3 hours). Run ${pc54.cyan("wraps selfhost logs --follow --live")} again to resume.`
     );
   }
 }
@@ -58851,7 +59133,7 @@ function isAbortError(error) {
 init_esm_shims();
 init_events();
 import * as clack51 from "@clack/prompts";
-import pc54 from "picocolors";
+import pc55 from "picocolors";
 init_aws();
 init_json_output();
 init_metadata();
@@ -58861,26 +59143,26 @@ function displaySelfhostStatus(options) {
   const lines = [];
   const incomplete = !(options.apiUrl && options.appUrl);
   lines.push(
-    incomplete ? pc54.bold(pc54.yellow("Self-Hosted Control Plane Incomplete")) : pc54.bold(pc54.green("Self-Hosted Control Plane Active"))
+    incomplete ? pc55.bold(pc55.yellow("Self-Hosted Control Plane Incomplete")) : pc55.bold(pc55.green("Self-Hosted Control Plane Active"))
   );
   if (incomplete) {
     lines.push(
-      pc54.yellow(
-        `A previous deploy did not finish. Run ${pc54.cyan("pnpm selfhost:upgrade")} from your fork to complete it.`
+      pc55.yellow(
+        `A previous deploy did not finish. Run ${pc55.cyan("pnpm selfhost:upgrade")} from your fork to complete it.`
       )
     );
   }
   lines.push("");
-  lines.push(pc54.bold("API"));
-  lines.push(`  URL: ${pc54.cyan(options.apiUrl || "(not deployed)")}`);
-  lines.push(`  Region: ${pc54.cyan(options.region)}`);
-  lines.push(`  Deployed: ${pc54.dim(options.deployedAt)}`);
+  lines.push(pc55.bold("API"));
+  lines.push(`  URL: ${pc55.cyan(options.apiUrl || "(not deployed)")}`);
+  lines.push(`  Region: ${pc55.cyan(options.region)}`);
+  lines.push(`  Deployed: ${pc55.dim(options.deployedAt)}`);
   lines.push("");
-  lines.push(pc54.bold("Configuration"));
-  lines.push(`  App URL: ${pc54.cyan(options.appUrl || "(not deployed)")}`);
-  lines.push(`  License Key: ${pc54.dim(`${options.licenseKeyPrefix}...`)}`);
+  lines.push(pc55.bold("Configuration"));
+  lines.push(`  App URL: ${pc55.cyan(options.appUrl || "(not deployed)")}`);
+  lines.push(`  License Key: ${pc55.dim(`${options.licenseKeyPrefix}...`)}`);
   if (options.neonProjectId) {
-    lines.push(`  Neon Project: ${pc54.dim(options.neonProjectId)}`);
+    lines.push(`  Neon Project: ${pc55.dim(options.neonProjectId)}`);
   }
   clack51.note(lines.join("\n"), "Self-Hosted Status");
 }
@@ -58888,7 +59170,7 @@ async function selfhostStatus(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack51.intro(pc54.bold("Wraps Self-Hosted Status"));
+    clack51.intro(pc55.bold("Wraps Self-Hosted Status"));
   }
   const identity = await progress.execute(
     "Loading self-hosted status",
@@ -58906,7 +59188,7 @@ async function selfhostStatus(options) {
     clack51.log.error("No self-hosted deployment found");
     console.log(
       `
-Run ${pc54.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted platform.
+Run ${pc55.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hosted platform.
 `
     );
     process.exit(1);
@@ -58929,24 +59211,24 @@ Run ${pc54.cyan("pnpm selfhost:deploy")} from your fork to deploy the self-hoste
   }
   displaySelfhostStatus(statusData);
   console.log("");
-  clack51.log.info(pc54.bold("Commands:"));
+  clack51.log.info(pc55.bold("Commands:"));
   console.log(
-    `  ${pc54.cyan("pnpm selfhost:upgrade")} (from your fork) - Redeploy the platform and run migrations`
+    `  ${pc55.cyan("pnpm selfhost:upgrade")} (from your fork) - Redeploy the platform and run migrations`
   );
   trackCommand("selfhost:status", {
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack51.outro(pc54.dim("Self-hosted deployment is active"));
+  clack51.outro(pc55.dim("Self-hosted deployment is active"));
 }
 
 // src/commands/shared/dashboard.ts
 init_esm_shims();
 import * as clack52 from "@clack/prompts";
-import * as pulumi27 from "@pulumi/pulumi";
+import * as pulumi28 from "@pulumi/pulumi";
 import getPort from "get-port";
 import open3 from "open";
-import pc55 from "picocolors";
+import pc56 from "picocolors";
 
 // src/console/server.ts
 init_esm_shims();
@@ -60146,13 +60428,13 @@ function createMetricsRouter(config2) {
   const router = createRouter5();
   router.get("/stream", async (req, res) => {
     const connectionId = randomUUID().slice(0, 8);
-    const log62 = (msg, data) => {
+    const log63 = (msg, data) => {
       console.log(JSON.stringify({ connectionId, msg, ...data }));
     };
     res.setHeader("Content-Type", "text/event-stream");
     res.setHeader("Cache-Control", "no-cache");
     res.setHeader("Connection", "keep-alive");
-    log62("SSE connected");
+    log63("SSE connected");
     res.write('data: {"type":"connected"}\n\n');
     const { startTime, endTime } = req.query;
     const getTimeRange = () => ({
@@ -60162,7 +60444,7 @@ function createMetricsRouter(config2) {
     const sendMetrics = async () => {
       try {
         const timeRange = getTimeRange();
-        log62("Fetching metrics", {
+        log63("Fetching metrics", {
           start: timeRange.start.toISOString(),
           end: timeRange.end.toISOString()
         });
@@ -60175,7 +60457,7 @@ function createMetricsRouter(config2) {
           ),
           fetchSendQuota(config2.roleArn, config2.region)
         ]);
-        log62("Metrics fetched successfully");
+        log63("Metrics fetched successfully");
         const data = {
           type: "metrics",
           timestamp: Date.now(),
@@ -60205,7 +60487,7 @@ function createMetricsRouter(config2) {
     const interval = setInterval(sendMetrics, 6e4);
     req.on("close", () => {
       clearInterval(interval);
-      log62("SSE disconnected");
+      log63("SSE disconnected");
     });
   });
   router.get("/snapshot", async (_req, res) => {
@@ -61461,9 +61743,9 @@ function createUserRouter(config2) {
         if (config2.roleArn) {
           console.log("[User API] Attempting to fetch account alias via IAM");
           const { assumeRole: assumeRole2 } = await Promise.resolve().then(() => (init_assume_role(), assume_role_exports));
-          const { IAMClient: IAMClient6, ListAccountAliasesCommand } = await import("@aws-sdk/client-iam");
+          const { IAMClient: IAMClient7, ListAccountAliasesCommand } = await import("@aws-sdk/client-iam");
           const credentials = await assumeRole2(config2.roleArn, region);
-          const iamClient = new IAMClient6({ region, credentials });
+          const iamClient = new IAMClient7({ region, credentials });
           const response = await iamClient.send(
             new ListAccountAliasesCommand({})
           );
@@ -61600,7 +61882,7 @@ init_output();
 init_pulumi();
 async function dashboard(options) {
   await ensurePulumiInstalled();
-  clack52.intro(pc55.bold("Wraps Dashboard"));
+  clack52.intro(pc56.bold("Wraps Dashboard"));
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -61613,7 +61895,7 @@ async function dashboard(options) {
   try {
     await ensurePulumiWorkDir({ accountId: identity.accountId, region });
     try {
-      const emailStack = await pulumi27.automation.LocalWorkspace.selectStack({
+      const emailStack = await pulumi28.automation.LocalWorkspace.selectStack({
         stackName: `wraps-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -61621,7 +61903,7 @@ async function dashboard(options) {
     } catch (_emailError) {
     }
     try {
-      const smsStack = await pulumi27.automation.LocalWorkspace.selectStack({
+      const smsStack = await pulumi28.automation.LocalWorkspace.selectStack({
         stackName: `wraps-sms-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -61629,7 +61911,7 @@ async function dashboard(options) {
     } catch (_smsError) {
     }
     try {
-      const cdnStack = await pulumi27.automation.LocalWorkspace.selectStack({
+      const cdnStack = await pulumi28.automation.LocalWorkspace.selectStack({
         stackName: `wraps-cdn-${identity.accountId}-${region}`,
         workDir: getPulumiWorkDir()
       });
@@ -61643,7 +61925,7 @@ async function dashboard(options) {
     progress.stop();
     clack52.log.error("No Wraps infrastructure found");
     console.log(
-      `\\nRun ${pc55.cyan("wraps email init")}, ${pc55.cyan("wraps sms init")}, or ${pc55.cyan("wraps storage init")} to deploy infrastructure first.\\n`
+      `\\nRun ${pc56.cyan("wraps email init")}, ${pc56.cyan("wraps sms init")}, or ${pc56.cyan("wraps storage init")} to deploy infrastructure first.\\n`
     );
     process.exit(1);
   }
@@ -61687,7 +61969,7 @@ async function dashboard(options) {
   progress.stop();
   clack52.log.success("Starting dashboard server...");
   console.log(
-    `${pc55.dim("Using current AWS credentials (no role assumption)")}\\n`
+    `${pc56.dim("Using current AWS credentials (no role assumption)")}\\n`
   );
   const { url } = await startConsoleServer({
     port,
@@ -61720,8 +62002,8 @@ async function dashboard(options) {
     cdnCustomDomain,
     cdnCertificateArn
   });
-  console.log(`\\n${pc55.bold("Dashboard:")} ${pc55.cyan(url)}`);
-  console.log(`${pc55.dim("Press Ctrl+C to stop")}\\n`);
+  console.log(`\\n${pc56.bold("Dashboard:")} ${pc56.cyan(url)}`);
+  console.log(`${pc56.dim("Press Ctrl+C to stop")}\\n`);
   getTelemetryClient().showFooterOnce();
   if (!options.noOpen) {
     await open3(url);
@@ -61743,7 +62025,7 @@ init_errors();
 init_json_output();
 init_metadata();
 import * as clack53 from "@clack/prompts";
-import pc56 from "picocolors";
+import pc57 from "picocolors";
 async function destroy(options) {
   trackCommand("destroy", { success: true });
   if (isJsonMode() && !options.force) {
@@ -61754,7 +62036,7 @@ async function destroy(options) {
     );
   }
   if (!isJsonMode()) {
-    clack53.intro(pc56.bold("Wraps Infrastructure Teardown"));
+    clack53.intro(pc57.bold("Wraps Infrastructure Teardown"));
   }
   const spinner11 = clack53.spinner();
   spinner11.start("Validating AWS credentials");
@@ -61776,14 +62058,14 @@ async function destroy(options) {
     clack53.log.warn("No Wraps services found in this region");
     console.log(
       `
-Run ${pc56.cyan("wraps email init")} to deploy infrastructure.
+Run ${pc57.cyan("wraps email init")} to deploy infrastructure.
 `
     );
     process.exit(0);
   }
   if (deployedServices.length === 1) {
     const service = deployedServices[0];
-    clack53.log.info(`Found ${pc56.cyan(service)} service deployed`);
+    clack53.log.info(`Found ${pc57.cyan(service)} service deployed`);
     if (service === "email") {
       await emailDestroy(options);
       return;
@@ -61821,7 +62103,7 @@ Run ${pc56.cyan("wraps email init")} to deploy infrastructure.
     await emailDestroy(options);
   }
   if (serviceToDestroy === "all") {
-    clack53.outro(pc56.green("All Wraps infrastructure has been removed"));
+    clack53.outro(pc57.green("All Wraps infrastructure has been removed"));
   }
 }
 
@@ -61829,8 +62111,8 @@ Run ${pc56.cyan("wraps email init")} to deploy infrastructure.
 init_esm_shims();
 init_events();
 import * as clack54 from "@clack/prompts";
-import * as pulumi28 from "@pulumi/pulumi";
-import pc57 from "picocolors";
+import * as pulumi29 from "@pulumi/pulumi";
+import pc58 from "picocolors";
 init_aws();
 init_fs();
 init_json_output();
@@ -61841,23 +62123,23 @@ async function status(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack54.intro(pc57.bold("Wraps Infrastructure Status"));
+    clack54.intro(pc58.bold("Wraps Infrastructure Status"));
   }
   const identity = await progress.execute(
     "Loading infrastructure status",
     async () => validateAWSCredentials()
   );
   if (!isJsonMode()) {
-    progress.info(`AWS Account: ${pc57.cyan(identity.accountId)}`);
+    progress.info(`AWS Account: ${pc58.cyan(identity.accountId)}`);
   }
   const region = options.region || await getAWSRegion();
   if (!isJsonMode()) {
-    progress.info(`Region: ${pc57.cyan(region)}`);
+    progress.info(`Region: ${pc58.cyan(region)}`);
   }
   const services = [];
   try {
     await ensurePulumiWorkDir({ accountId: identity.accountId, region });
-    const emailStack = await pulumi28.automation.LocalWorkspace.selectStack({
+    const emailStack = await pulumi29.automation.LocalWorkspace.selectStack({
       stackName: `wraps-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -61876,7 +62158,7 @@ async function status(options) {
     services.push({ name: "Email", status: "not_deployed" });
   }
   try {
-    const smsStack = await pulumi28.automation.LocalWorkspace.selectStack({
+    const smsStack = await pulumi29.automation.LocalWorkspace.selectStack({
       stackName: `wraps-sms-${identity.accountId}-${region}`,
       workDir: getPulumiWorkDir()
     });
@@ -61907,33 +62189,33 @@ async function status(options) {
   clack54.note(
     services.map((s2) => {
       if (s2.status === "deployed") {
-        const details = s2.details ? pc57.dim(` (${s2.details})`) : "";
-        return `  ${pc57.green("\u2713")} ${s2.name}${details}`;
+        const details = s2.details ? pc58.dim(` (${s2.details})`) : "";
+        return `  ${pc58.green("\u2713")} ${s2.name}${details}`;
       }
-      return `  ${pc57.dim("\u25CB")} ${s2.name} ${pc57.dim("(not deployed)")}`;
+      return `  ${pc58.dim("\u25CB")} ${s2.name} ${pc58.dim("(not deployed)")}`;
     }).join("\n"),
     "Services"
   );
   const hasDeployedServices = services.some((s2) => s2.status === "deployed");
   if (hasDeployedServices) {
     console.log(`
-${pc57.bold("Details:")}`);
+${pc58.bold("Details:")}`);
     if (services.find((s2) => s2.name === "Email")?.status === "deployed") {
-      console.log(`  ${pc57.dim("Email:")} ${pc57.cyan("wraps email status")}`);
+      console.log(`  ${pc58.dim("Email:")} ${pc58.cyan("wraps email status")}`);
     }
     if (services.find((s2) => s2.name === "SMS")?.status === "deployed") {
-      console.log(`  ${pc57.dim("SMS:")} ${pc57.cyan("wraps sms status")}`);
+      console.log(`  ${pc58.dim("SMS:")} ${pc58.cyan("wraps sms status")}`);
     }
   } else {
     console.log(`
-${pc57.bold("Get started:")}`);
-    console.log(`  ${pc57.dim("Deploy email:")} ${pc57.cyan("wraps email init")}`);
-    console.log(`  ${pc57.dim("Deploy SMS:")} ${pc57.cyan("wraps sms init")}`);
+${pc58.bold("Get started:")}`);
+    console.log(`  ${pc58.dim("Deploy email:")} ${pc58.cyan("wraps email init")}`);
+    console.log(`  ${pc58.dim("Deploy SMS:")} ${pc58.cyan("wraps sms init")}`);
   }
   const dashboardUrl = await resolveDashboardUrl(identity.accountId, region);
   console.log(`
-${pc57.bold("Dashboard:")} ${pc57.blue(dashboardUrl)}`);
-  console.log(`${pc57.bold("Docs:")} ${pc57.blue("https://wraps.dev/docs")}
+${pc58.bold("Dashboard:")} ${pc58.blue(dashboardUrl)}`);
+  console.log(`${pc58.bold("Docs:")} ${pc58.blue("https://wraps.dev/docs")}
 `);
   trackCommand("status", {
     success: true,
@@ -61945,13 +62227,13 @@ ${pc57.bold("Dashboard:")} ${pc57.blue(dashboardUrl)}`);
 // src/commands/sms/destroy.ts
 init_esm_shims();
 import * as clack55 from "@clack/prompts";
-import * as pulumi30 from "@pulumi/pulumi";
-import pc58 from "picocolors";
+import * as pulumi31 from "@pulumi/pulumi";
+import pc59 from "picocolors";
 
 // src/infrastructure/sms-stack.ts
 init_esm_shims();
 import * as aws24 from "@pulumi/aws";
-import * as pulumi29 from "@pulumi/pulumi";
+import * as pulumi30 from "@pulumi/pulumi";
 init_resource_checks();
 async function createSMSIAMRole(config2) {
   const statements = [];
@@ -62231,7 +62513,7 @@ async function createSMSSNSResources(config2) {
   });
   new aws24.sqs.QueuePolicy("wraps-sms-events-queue-policy", {
     queueUrl: config2.queueUrl,
-    policy: pulumi29.all([config2.queueArn, topic.arn]).apply(
+    policy: pulumi30.all([config2.queueArn, topic.arn]).apply(
       ([queueArn, topicArn2]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -62330,7 +62612,7 @@ async function deploySMSLambdaFunction(config2) {
   });
   new aws24.iam.RolePolicy("wraps-sms-lambda-policy", {
     role: lambdaRole.name,
-    policy: pulumi29.all([config2.tableName, config2.queueArn]).apply(
+    policy: pulumi30.all([config2.tableName, config2.queueArn]).apply(
       ([tableName, queueArn]) => JSON.stringify({
         Version: "2012-10-17",
         Statement: [
@@ -62367,7 +62649,7 @@ async function deploySMSLambdaFunction(config2) {
       runtime: "nodejs24.x",
       handler: "index.handler",
       role: lambdaRole.arn,
-      code: new pulumi29.asset.FileArchive(codeDir),
+      code: new pulumi30.asset.FileArchive(codeDir),
       timeout: 300,
       // 5 minutes
       memorySize: 512,
@@ -62637,18 +62919,18 @@ async function createSMSProtectConfigurationWithSDK(configurationSetName, region
     const existing = await client2.send(
       new DescribeProtectConfigurationsCommand({})
     );
-    for (const pc72 of existing.ProtectConfigurations || []) {
-      if (!(pc72.ProtectConfigurationArn && pc72.ProtectConfigurationId)) {
+    for (const pc73 of existing.ProtectConfigurations || []) {
+      if (!(pc73.ProtectConfigurationArn && pc73.ProtectConfigurationId)) {
         continue;
       }
       const tagsResponse = await client2.send(
         new ListTagsForResourceCommand({
-          ResourceArn: pc72.ProtectConfigurationArn
+          ResourceArn: pc73.ProtectConfigurationArn
         })
       );
       const nameTag = tagsResponse.Tags?.find((t) => t.Key === "Name");
       if (nameTag?.Value === protectConfigName) {
-        existingProtectConfigId = pc72.ProtectConfigurationId;
+        existingProtectConfigId = pc73.ProtectConfigurationId;
         break;
       }
     }
@@ -62744,13 +63026,13 @@ async function deleteSMSProtectConfigurationWithSDK(region) {
       new DescribeProtectConfigurationsCommand({})
     );
     if (existing.ProtectConfigurations) {
-      for (const pc72 of existing.ProtectConfigurations) {
-        if (!(pc72.ProtectConfigurationArn && pc72.ProtectConfigurationId)) {
+      for (const pc73 of existing.ProtectConfigurations) {
+        if (!(pc73.ProtectConfigurationArn && pc73.ProtectConfigurationId)) {
           continue;
         }
         const tagsResponse = await client2.send(
           new ListTagsForResourceCommand({
-            ResourceArn: pc72.ProtectConfigurationArn
+            ResourceArn: pc73.ProtectConfigurationArn
           })
         );
         const isWrapsManaged = tagsResponse.Tags?.some(
@@ -62759,7 +63041,7 @@ async function deleteSMSProtectConfigurationWithSDK(region) {
         if (isWrapsManaged) {
           await client2.send(
             new DeleteProtectConfigurationCommand({
-              ProtectConfigurationId: pc72.ProtectConfigurationId
+              ProtectConfigurationId: pc73.ProtectConfigurationId
             })
           );
         }
@@ -62795,7 +63077,7 @@ async function smsDestroy(options) {
   }
   if (!isJsonMode()) {
     clack55.intro(
-      pc58.bold(
+      pc59.bold(
         options.preview ? "SMS Infrastructure Destruction Preview" : "SMS Infrastructure Teardown"
       )
     );
@@ -62845,7 +63127,7 @@ async function smsDestroy(options) {
   }
   if (!(options.force || options.preview)) {
     const confirmed = await clack55.confirm({
-      message: pc58.red(
+      message: pc59.red(
         "Are you sure you want to destroy all SMS infrastructure?"
       ),
       initialValue: false
@@ -62864,7 +63146,7 @@ async function smsDestroy(options) {
           const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
           let stack;
           try {
-            stack = await pulumi30.automation.LocalWorkspace.selectStack({
+            stack = await pulumi31.automation.LocalWorkspace.selectStack({
               stackName,
               workDir: getPulumiWorkDir()
             });
@@ -62884,7 +63166,7 @@ async function smsDestroy(options) {
         commandName: "wraps sms destroy"
       });
       clack55.outro(
-        pc58.green("Preview complete. Run without --preview to destroy.")
+        pc59.green("Preview complete. Run without --preview to destroy.")
       );
       trackServiceRemoved("sms", {
         preview: true,
@@ -62922,7 +63204,7 @@ async function smsDestroy(options) {
         const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
         let stack;
         try {
-          stack = await pulumi30.automation.LocalWorkspace.selectStack({
+          stack = await pulumi31.automation.LocalWorkspace.selectStack({
             stackName,
             workDir: getPulumiWorkDir()
           });
@@ -62981,20 +63263,20 @@ async function smsDestroy(options) {
   }
   if (destroyFailed) {
     clack55.outro(
-      pc58.yellow("SMS infrastructure partially removed. Metadata cleaned up.")
+      pc59.yellow("SMS infrastructure partially removed. Metadata cleaned up.")
     );
   } else {
-    clack55.outro(pc58.green("SMS infrastructure has been removed"));
+    clack55.outro(pc59.green("SMS infrastructure has been removed"));
     console.log(`
-${pc58.bold("Cleaned up:")}`);
-    console.log(`  ${pc58.green("\u2713")} Phone number released`);
-    console.log(`  ${pc58.green("\u2713")} Configuration set deleted`);
-    console.log(`  ${pc58.green("\u2713")} Event processing infrastructure removed`);
-    console.log(`  ${pc58.green("\u2713")} IAM role deleted`);
+${pc59.bold("Cleaned up:")}`);
+    console.log(`  ${pc59.green("\u2713")} Phone number released`);
+    console.log(`  ${pc59.green("\u2713")} Configuration set deleted`);
+    console.log(`  ${pc59.green("\u2713")} Event processing infrastructure removed`);
+    console.log(`  ${pc59.green("\u2713")} IAM role deleted`);
   }
   console.log(
     `
-Run ${pc58.cyan("wraps sms init")} to deploy infrastructure again.
+Run ${pc59.cyan("wraps sms init")} to deploy infrastructure again.
 `
   );
   trackServiceRemoved("sms", {
@@ -63007,8 +63289,8 @@ Run ${pc58.cyan("wraps sms init")} to deploy infrastructure again.
 // src/commands/sms/init.ts
 init_esm_shims();
 import * as clack56 from "@clack/prompts";
-import * as pulumi31 from "@pulumi/pulumi";
-import pc60 from "picocolors";
+import * as pulumi32 from "@pulumi/pulumi";
+import pc61 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -63246,16 +63528,16 @@ function getSMSCostSummary(config2, messagesPerMonth = 1e3) {
 
 // src/utils/sms/output.ts
 init_esm_shims();
-import pc59 from "picocolors";
+import pc60 from "picocolors";
 function displaySMSSDKUsage(region) {
-  console.log(pc59.dim("  npm install @wraps.dev/sms"));
+  console.log(pc60.dim("  npm install @wraps.dev/sms"));
   console.log("");
-  console.log(pc59.dim("  import { WrapsSMS } from '@wraps.dev/sms';"));
-  console.log(pc59.dim(`  const sms = new WrapsSMS({ region: '${region}' });`));
-  console.log(pc59.dim("  await sms.send({"));
-  console.log(pc59.dim("    to: '+14155551234',"));
-  console.log(pc59.dim("    message: 'Your code is 123456',"));
-  console.log(pc59.dim("  });"));
+  console.log(pc60.dim("  import { WrapsSMS } from '@wraps.dev/sms';"));
+  console.log(pc60.dim(`  const sms = new WrapsSMS({ region: '${region}' });`));
+  console.log(pc60.dim("  await sms.send({"));
+  console.log(pc60.dim("    to: '+14155551234',"));
+  console.log(pc60.dim("    message: 'Your code is 123456',"));
+  console.log(pc60.dim("  });"));
 }
 
 // src/utils/sms/presets.ts
@@ -63577,14 +63859,14 @@ function parseVolume(raw) {
 async function init3(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack56.intro(pc60.bold("Wraps SMS Infrastructure Setup"));
+    clack56.intro(pc61.bold("Wraps SMS Infrastructure Setup"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc60.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc61.cyan(identity.accountId)}`);
   const wasAutoInstalled = await progress.execute(
     "Checking Pulumi CLI installation",
     async () => await ensurePulumiInstalled()
@@ -63604,9 +63886,9 @@ async function init3(options) {
   );
   if (existingConnection?.services?.sms) {
     clack56.log.warn(
-      `SMS already configured for account ${pc60.cyan(identity.accountId)} in region ${pc60.cyan(region)}`
+      `SMS already configured for account ${pc61.cyan(identity.accountId)} in region ${pc61.cyan(region)}`
     );
-    clack56.log.info(`Use ${pc60.cyan("wraps sms status")} to view current setup`);
+    clack56.log.info(`Use ${pc61.cyan("wraps sms status")} to view current setup`);
     process.exit(0);
   }
   let preset = options.preset;
@@ -63652,7 +63934,7 @@ async function init3(options) {
   }
   progress.info(
     `
-${pc60.bold("Fraud Protection")} - Block SMS to countries where you don't do business`
+${pc61.bold("Fraud Protection")} - Block SMS to countries where you don't do business`
   );
   let allowedCountries;
   if (options.countries) {
@@ -63690,13 +63972,13 @@ ${pc60.bold("Fraud Protection")} - Block SMS to countries where you don't do bus
     estimatedVolume = await promptEstimatedSMSVolume();
   }
   progress.info(`
-${pc60.bold("Cost Estimate:")}`);
+${pc61.bold("Cost Estimate:")}`);
   const costSummary = getSMSCostSummary(smsConfig, estimatedVolume);
   clack56.log.info(costSummary);
   const warnings = validateSMSConfig(smsConfig);
   if (warnings.length > 0) {
     progress.info(`
-${pc60.yellow(pc60.bold("Important Notes:"))}`);
+${pc61.yellow(pc61.bold("Important Notes:"))}`);
     for (const warning2 of warnings) {
       clack56.log.warn(warning2);
     }
@@ -63716,7 +63998,7 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
   };
   const createStack = async () => {
     await ensurePulumiWorkDir({ accountId: identity.accountId, region });
-    const stack = await pulumi31.automation.LocalWorkspace.createOrSelectStack(
+    const stack = await pulumi32.automation.LocalWorkspace.createOrSelectStack(
       {
         stackName: `wraps-sms-${identity.accountId}-${region}`,
         projectName: "wraps-sms",
@@ -63765,7 +64047,7 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
         commandName: "wraps sms init"
       });
       clack56.outro(
-        pc60.green("Preview complete. Run without --preview to deploy.")
+        pc61.green("Preview complete. Run without --preview to deploy.")
       );
       trackServiceInit("sms", true, {
         provider,
@@ -63816,7 +64098,7 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
         clack56.log.warn(`Phone pool creation failed: ${msg}`);
         clack56.log.info(
-          `Run ${pc60.cyan("wraps sms sync")} to retry SDK resource creation.`
+          `Run ${pc61.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
     }
@@ -63834,7 +64116,7 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
         clack56.log.warn(`Event destination creation failed: ${msg}`);
         clack56.log.info(
-          `Run ${pc60.cyan("wraps sms sync")} to retry SDK resource creation.`
+          `Run ${pc61.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
     }
@@ -63855,7 +64137,7 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
         const msg = sdkError instanceof Error ? sdkError.message : String(sdkError);
         clack56.log.warn(`Protect configuration creation failed: ${msg}`);
         clack56.log.info(
-          `Run ${pc60.cyan("wraps sms sync")} to retry SDK resource creation.`
+          `Run ${pc61.cyan("wraps sms sync")} to retry SDK resource creation.`
         );
       }
     }
@@ -63905,40 +64187,40 @@ ${pc60.yellow(pc60.bold("Important Notes:"))}`);
     return;
   }
   console.log("\n");
-  clack56.log.success(pc60.green(pc60.bold("SMS infrastructure deployed!")));
+  clack56.log.success(pc61.green(pc61.bold("SMS infrastructure deployed!")));
   console.log("\n");
   clack56.note(
     [
-      `${pc60.bold("Phone Number:")} ${pc60.cyan(outputs.phoneNumber || "Provisioning...")}`,
-      `${pc60.bold("Phone Type:")} ${pc60.cyan(smsConfig.phoneNumberType || "simulator")}`,
-      `${pc60.bold("Config Set:")} ${pc60.cyan(outputs.configSetName || "wraps-sms-config")}`,
-      `${pc60.bold("Region:")} ${pc60.cyan(outputs.region)}`,
-      outputs.tableName ? `${pc60.bold("History Table:")} ${pc60.cyan(outputs.tableName)}` : "",
+      `${pc61.bold("Phone Number:")} ${pc61.cyan(outputs.phoneNumber || "Provisioning...")}`,
+      `${pc61.bold("Phone Type:")} ${pc61.cyan(smsConfig.phoneNumberType || "simulator")}`,
+      `${pc61.bold("Config Set:")} ${pc61.cyan(outputs.configSetName || "wraps-sms-config")}`,
+      `${pc61.bold("Region:")} ${pc61.cyan(outputs.region)}`,
+      outputs.tableName ? `${pc61.bold("History Table:")} ${pc61.cyan(outputs.tableName)}` : "",
       "",
-      pc60.dim("IAM Role:"),
-      pc60.dim(`  ${outputs.roleArn}`)
+      pc61.dim("IAM Role:"),
+      pc61.dim(`  ${outputs.roleArn}`)
     ].filter(Boolean).join("\n"),
     "SMS Infrastructure"
   );
   const nextSteps = [];
   if (smsConfig.phoneNumberType === "toll-free") {
     nextSteps.push(
-      `${pc60.cyan("wraps sms register")} - Submit toll-free registration (required before sending)`
+      `${pc61.cyan("wraps sms register")} - Submit toll-free registration (required before sending)`
     );
   }
   nextSteps.push(
-    `${pc60.cyan("wraps sms test --to +1234567890")} - Send a test message`
+    `${pc61.cyan("wraps sms test --to +1234567890")} - Send a test message`
   );
-  nextSteps.push(`${pc60.cyan("wraps sms status")} - View SMS configuration`);
+  nextSteps.push(`${pc61.cyan("wraps sms status")} - View SMS configuration`);
   console.log("\n");
-  clack56.log.info(pc60.bold("Next steps:"));
+  clack56.log.info(pc61.bold("Next steps:"));
   for (const step of nextSteps) {
     console.log(`  ${step}`);
   }
   console.log("\n");
-  clack56.log.info(pc60.bold("SDK Usage:"));
+  clack56.log.info(pc61.bold("SDK Usage:"));
   displaySMSSDKUsage(region);
-  clack56.outro(pc60.green("Setup complete!"));
+  clack56.outro(pc61.green("Setup complete!"));
   const duration = Date.now() - startTime;
   const enabledFeatures = [];
   if (smsConfig.tracking?.enabled) {
@@ -63975,7 +64257,7 @@ init_json_output();
 init_metadata();
 init_output();
 import * as clack57 from "@clack/prompts";
-import pc61 from "picocolors";
+import pc62 from "picocolors";
 async function getPhoneNumberDetails(region) {
   const { PinpointSMSVoiceV2Client: PinpointSMSVoiceV2Client5, DescribePhoneNumbersCommand: DescribePhoneNumbersCommand2 } = await import("@aws-sdk/client-pinpoint-sms-voice-v2");
   const client2 = new PinpointSMSVoiceV2Client5({ region });
@@ -64016,7 +64298,7 @@ async function getRegistrationStatus(region, registrationId) {
 async function smsRegister(options) {
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack57.intro(pc61.bold("Wraps SMS - Toll-Free Registration"));
+    clack57.intro(pc62.bold("Wraps SMS - Toll-Free Registration"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -64030,7 +64312,7 @@ async function smsRegister(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata?.services?.sms) {
     clack57.log.error("No SMS infrastructure found.");
-    clack57.log.info(`Run ${pc61.cyan("wraps sms init")} first.`);
+    clack57.log.info(`Run ${pc62.cyan("wraps sms init")} first.`);
     process.exit(1);
   }
   const phoneDetails = await progress.execute(
@@ -64064,14 +64346,14 @@ async function smsRegister(options) {
   }
   console.log("");
   console.log(
-    `${pc61.bold("Phone Number:")} ${pc61.cyan(phoneDetails.phoneNumber)}`
+    `${pc62.bold("Phone Number:")} ${pc62.cyan(phoneDetails.phoneNumber)}`
   );
-  console.log(`${pc61.bold("Type:")} ${pc61.cyan(phoneDetails.type)}`);
+  console.log(`${pc62.bold("Type:")} ${pc62.cyan(phoneDetails.type)}`);
   console.log(
-    `${pc61.bold("Status:")} ${phoneDetails.status === "ACTIVE" ? pc61.green(phoneDetails.status) : pc61.yellow(phoneDetails.status)}`
+    `${pc62.bold("Status:")} ${phoneDetails.status === "ACTIVE" ? pc62.green(phoneDetails.status) : pc62.yellow(phoneDetails.status)}`
   );
   if (registrationStatus) {
-    console.log(`${pc61.bold("Registration:")} ${pc61.cyan(registrationStatus)}`);
+    console.log(`${pc62.bold("Registration:")} ${pc62.cyan(registrationStatus)}`);
   }
   console.log("");
   if (phoneDetails.status === "ACTIVE") {
@@ -64089,21 +64371,21 @@ async function smsRegister(options) {
     clack57.log.info(`Your ${phoneDetails.type} number should be ready to use.`);
     process.exit(0);
   }
-  console.log(pc61.bold("Toll-Free Registration Required"));
+  console.log(pc62.bold("Toll-Free Registration Required"));
   console.log("");
   console.log(
-    pc61.dim("To send SMS at scale, you must register your toll-free number.")
+    pc62.dim("To send SMS at scale, you must register your toll-free number.")
   );
-  console.log(pc61.dim("This process typically takes 1-15 business days."));
+  console.log(pc62.dim("This process typically takes 1-15 business days."));
   console.log("");
-  console.log(pc61.bold("You'll need to provide:"));
-  console.log(`  ${pc61.dim("\u2022")} Business name and address`);
+  console.log(pc62.bold("You'll need to provide:"));
+  console.log(`  ${pc62.dim("\u2022")} Business name and address`);
   console.log(
-    `  ${pc61.dim("\u2022")} Use case description (what messages you're sending)`
+    `  ${pc62.dim("\u2022")} Use case description (what messages you're sending)`
   );
-  console.log(`  ${pc61.dim("\u2022")} Sample messages (2-3 examples)`);
-  console.log(`  ${pc61.dim("\u2022")} How users opt-in to receive messages`);
-  console.log(`  ${pc61.dim("\u2022")} Expected monthly message volume`);
+  console.log(`  ${pc62.dim("\u2022")} Sample messages (2-3 examples)`);
+  console.log(`  ${pc62.dim("\u2022")} How users opt-in to receive messages`);
+  console.log(`  ${pc62.dim("\u2022")} Expected monthly message volume`);
   console.log("");
   const openConsole = await clack57.confirm({
     message: "Open AWS Console to start registration?",
@@ -64128,33 +64410,33 @@ async function smsRegister(options) {
       } catch {
         clack57.log.info("Open this URL in your browser:");
         console.log(`
-  ${pc61.cyan(consoleUrl)}
+  ${pc62.cyan(consoleUrl)}
 `);
       }
     }
     console.log("");
-    console.log(pc61.bold("Next Steps:"));
+    console.log(pc62.bold("Next Steps:"));
     console.log(
-      `  1. Click ${pc61.cyan("Create registration")} in the AWS Console`
+      `  1. Click ${pc62.cyan("Create registration")} in the AWS Console`
     );
-    console.log(`  2. Select ${pc61.cyan("Toll-free number registration")}`);
+    console.log(`  2. Select ${pc62.cyan("Toll-free number registration")}`);
     console.log("  3. Fill out the business information form");
     console.log("  4. Submit and wait for approval (1-15 business days)");
     console.log("");
     console.log(
-      pc61.dim("Once approved, run `wraps sms sync` to complete setup.")
+      pc62.dim("Once approved, run `wraps sms sync` to complete setup.")
     );
   } else {
     const consoleUrl = `https://${region}.console.aws.amazon.com/sms-voice/home?region=${region}#/registrations`;
     console.log("");
     console.log("When you're ready, go to:");
-    console.log(`  ${pc61.cyan(consoleUrl)}`);
+    console.log(`  ${pc62.cyan(consoleUrl)}`);
   }
   trackCommand("sms:register", {
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack57.outro(pc61.dim("Good luck with your registration!"));
+  clack57.outro(pc62.dim("Good luck with your registration!"));
 }
 
 // src/commands/sms/status.ts
@@ -64168,44 +64450,44 @@ init_output();
 init_pulumi();
 init_region_resolver();
 import * as clack58 from "@clack/prompts";
-import * as pulumi32 from "@pulumi/pulumi";
-import pc62 from "picocolors";
+import * as pulumi33 from "@pulumi/pulumi";
+import pc63 from "picocolors";
 function displaySMSStatus(options) {
   const lines = [];
-  lines.push(pc62.bold(pc62.green("SMS Infrastructure Active")));
+  lines.push(pc63.bold(pc63.green("SMS Infrastructure Active")));
   lines.push("");
-  lines.push(pc62.bold("Phone Number"));
+  lines.push(pc63.bold("Phone Number"));
   if (options.phoneNumber) {
-    lines.push(`  Number: ${pc62.cyan(options.phoneNumber)}`);
+    lines.push(`  Number: ${pc63.cyan(options.phoneNumber)}`);
   } else {
-    lines.push(`  Number: ${pc62.yellow("Provisioning...")}`);
+    lines.push(`  Number: ${pc63.yellow("Provisioning...")}`);
   }
-  lines.push(`  Type: ${pc62.cyan(options.phoneNumberType || "simulator")}`);
+  lines.push(`  Type: ${pc63.cyan(options.phoneNumberType || "simulator")}`);
   lines.push("");
-  lines.push(pc62.bold("Configuration"));
-  lines.push(`  Region: ${pc62.cyan(options.region)}`);
+  lines.push(pc63.bold("Configuration"));
+  lines.push(`  Region: ${pc63.cyan(options.region)}`);
   if (options.preset) {
-    lines.push(`  Preset: ${pc62.cyan(options.preset)}`);
+    lines.push(`  Preset: ${pc63.cyan(options.preset)}`);
   }
   if (options.configSetName) {
-    lines.push(`  Config Set: ${pc62.cyan(options.configSetName)}`);
+    lines.push(`  Config Set: ${pc63.cyan(options.configSetName)}`);
   }
   lines.push("");
-  lines.push(pc62.bold("Features"));
+  lines.push(pc63.bold("Features"));
   lines.push(
-    `  Event Tracking: ${options.eventTracking ? pc62.green("Enabled") : pc62.dim("Disabled")}`
+    `  Event Tracking: ${options.eventTracking ? pc63.green("Enabled") : pc63.dim("Disabled")}`
   );
   if (options.tableName) {
-    lines.push(`  Message History: ${pc62.green("Enabled")}`);
-    lines.push(`    Table: ${pc62.dim(options.tableName)}`);
+    lines.push(`  Message History: ${pc63.green("Enabled")}`);
+    lines.push(`    Table: ${pc63.dim(options.tableName)}`);
   }
   if (options.queueUrl) {
-    lines.push(`  Event Queue: ${pc62.green("Enabled")}`);
+    lines.push(`  Event Queue: ${pc63.green("Enabled")}`);
   }
   lines.push("");
   if (options.roleArn) {
-    lines.push(pc62.bold("IAM Role"));
-    lines.push(`  ${pc62.dim(options.roleArn)}`);
+    lines.push(pc63.bold("IAM Role"));
+    lines.push(`  ${pc63.dim(options.roleArn)}`);
   }
   clack58.note(lines.join("\n"), "SMS Status");
 }
@@ -64214,7 +64496,7 @@ async function smsStatus(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack58.intro(pc62.bold("Wraps SMS Status"));
+    clack58.intro(pc63.bold("Wraps SMS Status"));
   }
   const identity = await progress.execute(
     "Loading SMS infrastructure status",
@@ -64232,7 +64514,7 @@ async function smsStatus(options) {
     clack58.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc62.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -64241,7 +64523,7 @@ Run ${pc62.cyan("wraps sms init")} to deploy SMS infrastructure.
   try {
     await ensurePulumiWorkDir({ accountId: identity.accountId, region });
     const stackName = metadata.services.sms.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`;
-    const stack = await pulumi32.automation.LocalWorkspace.selectStack({
+    const stack = await pulumi33.automation.LocalWorkspace.selectStack({
       stackName,
       workDir: getPulumiWorkDir()
     });
@@ -64268,25 +64550,25 @@ Run ${pc62.cyan("wraps sms init")} to deploy SMS infrastructure.
   }
   displaySMSStatus(smsStatusData);
   console.log("");
-  clack58.log.info(pc62.bold("Commands:"));
+  clack58.log.info(pc63.bold("Commands:"));
   console.log(
-    `  ${pc62.cyan("wraps sms test --to +1234567890")} - Send a test message`
+    `  ${pc63.cyan("wraps sms test --to +1234567890")} - Send a test message`
   );
-  console.log(`  ${pc62.cyan("wraps sms destroy")} - Remove SMS infrastructure`);
+  console.log(`  ${pc63.cyan("wraps sms destroy")} - Remove SMS infrastructure`);
   trackCommand("sms:status", {
     success: true,
     phone_type: smsConfig?.phoneNumberType,
     event_tracking: smsConfig?.eventTracking?.enabled,
     duration_ms: Date.now() - startTime
   });
-  clack58.outro(pc62.dim("SMS infrastructure is ready"));
+  clack58.outro(pc63.dim("SMS infrastructure is ready"));
 }
 
 // src/commands/sms/sync.ts
 init_esm_shims();
 import * as clack59 from "@clack/prompts";
-import * as pulumi33 from "@pulumi/pulumi";
-import pc63 from "picocolors";
+import * as pulumi34 from "@pulumi/pulumi";
+import pc64 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -64299,7 +64581,7 @@ async function smsSync(options) {
   await ensurePulumiInstalled();
   const startTime = Date.now();
   if (!isJsonMode()) {
-    clack59.intro(pc63.bold("Wraps SMS Infrastructure Sync"));
+    clack59.intro(pc64.bold("Wraps SMS Infrastructure Sync"));
   }
   const progress = new DeploymentProgress();
   const identity = await progress.execute(
@@ -64314,7 +64596,7 @@ async function smsSync(options) {
     clack59.log.error("No SMS infrastructure found to sync");
     console.log(
       `
-Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure first.
+Run ${pc64.cyan("wraps sms init")} to deploy SMS infrastructure first.
 `
     );
     process.exit(1);
@@ -64323,10 +64605,10 @@ Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure first.
   const storedStackName = smsService.pulumiStackName;
   progress.info("Found existing SMS configuration");
   progress.info(
-    `Phone type: ${pc63.cyan(smsConfig.phoneNumberType || "simulator")}`
+    `Phone type: ${pc64.cyan(smsConfig.phoneNumberType || "simulator")}`
   );
   progress.info(
-    `Event tracking: ${pc63.cyan(smsConfig.eventTracking?.enabled ? "enabled" : "disabled")}`
+    `Event tracking: ${pc64.cyan(smsConfig.eventTracking?.enabled ? "enabled" : "disabled")}`
   );
   if (!options.yes) {
     const confirmed = await clack59.confirm({
@@ -64349,7 +64631,7 @@ Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure first.
     outputs = await progress.execute("Syncing SMS infrastructure", async () => {
       await ensurePulumiWorkDir({ accountId: identity.accountId, region });
       const stackName = storedStackName || `wraps-sms-${identity.accountId}-${region}`;
-      const stack = await pulumi33.automation.LocalWorkspace.createOrSelectStack(
+      const stack = await pulumi34.automation.LocalWorkspace.createOrSelectStack(
         {
           stackName,
           projectName: "wraps-sms",
@@ -64459,7 +64741,7 @@ Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure first.
     return;
   }
   console.log("\n");
-  clack59.log.success(pc63.green("SMS infrastructure synced successfully!"));
+  clack59.log.success(pc64.green("SMS infrastructure synced successfully!"));
   const changes = [];
   if (outputs.lambdaFunctions?.length) {
     changes.push("Lambda functions updated");
@@ -64467,13 +64749,13 @@ Run ${pc63.cyan("wraps sms init")} to deploy SMS infrastructure first.
   changes.push("SDK resources verified");
   console.log("");
   for (const change of changes) {
-    console.log(`  ${pc63.green("\u2713")} ${change}`);
+    console.log(`  ${pc64.green("\u2713")} ${change}`);
   }
   trackCommand("sms:sync", {
     success: true,
     duration_ms: Date.now() - startTime
   });
-  clack59.outro(pc63.green("Sync complete!"));
+  clack59.outro(pc64.green("Sync complete!"));
 }
 
 // src/commands/sms/test.ts
@@ -64489,7 +64771,7 @@ import {
   SendTextMessageCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
 import * as clack60 from "@clack/prompts";
-import pc64 from "picocolors";
+import pc65 from "picocolors";
 
 // src/utils/sms/validation.ts
 init_esm_shims();
@@ -64512,7 +64794,7 @@ async function smsTest(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack60.intro(pc64.bold("Wraps SMS Test"));
+    clack60.intro(pc65.bold("Wraps SMS Test"));
   }
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -64525,7 +64807,7 @@ async function smsTest(options) {
     clack60.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc64.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc65.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -64654,16 +64936,16 @@ Run ${pc64.cyan("wraps sms init")} to deploy SMS infrastructure.
       return;
     }
     console.log("\n");
-    clack60.log.success(pc64.green("Test SMS sent successfully!"));
+    clack60.log.success(pc65.green("Test SMS sent successfully!"));
     console.log("");
     clack60.note(
       [
-        `${pc64.bold("Message ID:")} ${pc64.cyan(messageId || "unknown")}`,
-        `${pc64.bold("To:")} ${pc64.cyan(toNumber)}`,
-        `${pc64.bold("Message:")} ${message}`,
-        `${pc64.bold("Type:")} ${pc64.cyan(smsConfig?.phoneNumberType || "simulator")}`,
+        `${pc65.bold("Message ID:")} ${pc65.cyan(messageId || "unknown")}`,
+        `${pc65.bold("To:")} ${pc65.cyan(toNumber)}`,
+        `${pc65.bold("Message:")} ${message}`,
+        `${pc65.bold("Type:")} ${pc65.cyan(smsConfig?.phoneNumberType || "simulator")}`,
         "",
-        pc64.dim(
+        pc65.dim(
           smsConfig?.phoneNumberType === "simulator" ? "Note: Simulator messages are not actually delivered" : "Check your phone for the message!"
         )
       ].join("\n"),
@@ -64672,10 +64954,10 @@ Run ${pc64.cyan("wraps sms init")} to deploy SMS infrastructure.
     if (smsConfig?.eventTracking?.enabled) {
       console.log("");
       clack60.log.info(
-        pc64.dim("Event tracking is enabled. Check DynamoDB for delivery status.")
+        pc65.dim("Event tracking is enabled. Check DynamoDB for delivery status.")
       );
     }
-    clack60.outro(pc64.green("Test complete!"));
+    clack60.outro(pc65.green("Test complete!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -64700,7 +64982,7 @@ Run ${pc64.cyan("wraps sms init")} to deploy SMS infrastructure.
       clack60.log.error("Toll-free number registration is not complete");
       console.log(
         `
-Run ${pc64.cyan("wraps sms register")} to check registration status.
+Run ${pc65.cyan("wraps sms register")} to check registration status.
 `
       );
     } else if (errorName === "AccessDeniedException") {
@@ -64709,7 +64991,7 @@ Run ${pc64.cyan("wraps sms register")} to check registration status.
       );
       console.log(
         `
-Run ${pc64.cyan("wraps sms upgrade")} to update IAM policies.
+Run ${pc65.cyan("wraps sms upgrade")} to update IAM policies.
 `
       );
     } else {
@@ -64722,8 +65004,8 @@ Run ${pc64.cyan("wraps sms upgrade")} to update IAM policies.
 // src/commands/sms/upgrade.ts
 init_esm_shims();
 import * as clack61 from "@clack/prompts";
-import * as pulumi34 from "@pulumi/pulumi";
-import pc65 from "picocolors";
+import * as pulumi35 from "@pulumi/pulumi";
+import pc66 from "picocolors";
 init_events();
 init_aws();
 init_errors();
@@ -64738,7 +65020,7 @@ async function smsUpgrade(options) {
   const startTime = Date.now();
   let upgradeAction = "";
   if (!isJsonMode()) {
-    clack61.intro(pc65.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
+    clack61.intro(pc66.bold("Wraps SMS Upgrade - Enhance Your SMS Infrastructure"));
   }
   const progress = new DeploymentProgress();
   const wasAutoInstalled = await progress.execute(
@@ -64752,7 +65034,7 @@ async function smsUpgrade(options) {
     "Validating AWS credentials",
     async () => validateAWSCredentials()
   );
-  progress.info(`Connected to AWS account: ${pc65.cyan(identity.accountId)}`);
+  progress.info(`Connected to AWS account: ${pc66.cyan(identity.accountId)}`);
   const region = await resolveRegionForCommand({
     accountId: identity.accountId,
     optionRegion: options.region,
@@ -64762,34 +65044,34 @@ async function smsUpgrade(options) {
   const metadata = await loadConnectionMetadata(identity.accountId, region);
   if (!metadata) {
     clack61.log.error(
-      `No Wraps connection found for account ${pc65.cyan(identity.accountId)} in region ${pc65.cyan(region)}`
+      `No Wraps connection found for account ${pc66.cyan(identity.accountId)} in region ${pc66.cyan(region)}`
     );
     clack61.log.info(
-      `Use ${pc65.cyan("wraps sms init")} to create new infrastructure.`
+      `Use ${pc66.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
   }
   if (!metadata.services.sms) {
     clack61.log.error("No SMS infrastructure found");
     clack61.log.info(
-      `Use ${pc65.cyan("wraps sms init")} to deploy SMS infrastructure.`
+      `Use ${pc66.cyan("wraps sms init")} to deploy SMS infrastructure.`
     );
     process.exit(1);
   }
   progress.info(`Found existing connection created: ${metadata.timestamp}`);
   console.log(`
-${pc65.bold("Current Configuration:")}
+${pc66.bold("Current Configuration:")}
 `);
   if (metadata.services.sms.preset) {
-    console.log(`  Preset: ${pc65.cyan(metadata.services.sms.preset)}`);
+    console.log(`  Preset: ${pc66.cyan(metadata.services.sms.preset)}`);
   } else {
-    console.log(`  Preset: ${pc65.cyan("custom")}`);
+    console.log(`  Preset: ${pc66.cyan("custom")}`);
   }
   const config2 = metadata.services.sms.config;
   if (!config2) {
     clack61.log.error("No SMS configuration found in metadata");
     clack61.log.info(
-      `Use ${pc65.cyan("wraps sms init")} to create new infrastructure.`
+      `Use ${pc66.cyan("wraps sms init")} to create new infrastructure.`
     );
     process.exit(1);
   }
@@ -64801,45 +65083,45 @@ ${pc65.bold("Current Configuration:")}
       "short-code": "Short code ($995+/mo, 100+ MPS)"
     };
     console.log(
-      `  Phone Type: ${pc65.cyan(phoneTypeLabels2[config2.phoneNumberType] || config2.phoneNumberType)}`
+      `  Phone Type: ${pc66.cyan(phoneTypeLabels2[config2.phoneNumberType] || config2.phoneNumberType)}`
     );
   }
   if (config2.tracking?.enabled) {
-    console.log(`  ${pc65.green("\u2713")} Delivery Tracking`);
+    console.log(`  ${pc66.green("\u2713")} Delivery Tracking`);
     if (config2.tracking.linkTracking) {
-      console.log(`    ${pc65.dim("\u2514\u2500")} Link click tracking enabled`);
+      console.log(`    ${pc66.dim("\u2514\u2500")} Link click tracking enabled`);
     }
   }
   if (config2.eventTracking?.enabled) {
-    console.log(`  ${pc65.green("\u2713")} Event Tracking (SNS)`);
+    console.log(`  ${pc66.green("\u2713")} Event Tracking (SNS)`);
     if (config2.eventTracking.dynamoDBHistory) {
       console.log(
-        `    ${pc65.dim("\u2514\u2500")} Message History: ${pc65.cyan(config2.eventTracking.archiveRetention || "90days")}`
+        `    ${pc66.dim("\u2514\u2500")} Message History: ${pc66.cyan(config2.eventTracking.archiveRetention || "90days")}`
       );
     }
   }
   if (config2.messageArchiving?.enabled) {
     console.log(
-      `  ${pc65.green("\u2713")} Message Archiving (${config2.messageArchiving.retention})`
+      `  ${pc66.green("\u2713")} Message Archiving (${config2.messageArchiving.retention})`
     );
   }
   if (config2.optOutManagement) {
-    console.log(`  ${pc65.green("\u2713")} Opt-out Management`);
+    console.log(`  ${pc66.green("\u2713")} Opt-out Management`);
   }
   if (config2.protectConfiguration?.enabled) {
     const countries = config2.protectConfiguration.allowedCountries?.join(", ") || "US";
-    console.log(`  ${pc65.green("\u2713")} Fraud Protection`);
-    console.log(`    ${pc65.dim("\u2514\u2500")} Allowed countries: ${pc65.cyan(countries)}`);
+    console.log(`  ${pc66.green("\u2713")} Fraud Protection`);
+    console.log(`    ${pc66.dim("\u2514\u2500")} Allowed countries: ${pc66.cyan(countries)}`);
     if (config2.protectConfiguration.aitFiltering) {
-      console.log(`    ${pc65.dim("\u2514\u2500")} AIT filtering: ${pc65.cyan("enabled")}`);
+      console.log(`    ${pc66.dim("\u2514\u2500")} AIT filtering: ${pc66.cyan("enabled")}`);
     }
   } else {
-    console.log(`  ${pc65.dim("\u25CB")} Fraud Protection (not configured)`);
+    console.log(`  ${pc66.dim("\u25CB")} Fraud Protection (not configured)`);
   }
   const currentCostData = calculateSMSCosts(config2, 1e4);
   console.log(
     `
-  Estimated Cost: ${pc65.cyan(`~${formatCost3(currentCostData.total.monthly)}/mo`)}`
+  Estimated Cost: ${pc66.cyan(`~${formatCost3(currentCostData.total.monthly)}/mo`)}`
   );
   console.log("");
   const phoneTypeLabels = {
@@ -64946,22 +65228,22 @@ ${pc65.bold("Current Configuration:")}
       if (selectedType === "toll-free") {
         console.log(
           `
-${pc65.yellow("\u26A0")} ${pc65.bold("Toll-free Registration Required")}
+${pc66.yellow("\u26A0")} ${pc66.bold("Toll-free Registration Required")}
 `
         );
         console.log(
-          pc65.dim("Toll-free numbers require carrier registration before")
+          pc66.dim("Toll-free numbers require carrier registration before")
         );
         console.log(
-          pc65.dim("they can send messages at scale. After deployment:\n")
+          pc66.dim("they can send messages at scale. After deployment:\n")
         );
         console.log(
-          `  1. Run ${pc65.cyan("wraps sms register")} to start registration`
+          `  1. Run ${pc66.cyan("wraps sms register")} to start registration`
         );
         console.log("  2. Submit your business use case information");
         console.log("  3. Wait for carrier verification (1-5 business days)");
         console.log(
-          pc65.dim("\nUntil verified, sending is limited to low volume.\n")
+          pc66.dim("\nUntil verified, sending is limited to low volume.\n")
         );
         const confirmTollFree = await clack61.confirm({
           message: "Continue with toll-free number request?",
@@ -64975,10 +65257,10 @@ ${pc65.yellow("\u26A0")} ${pc65.bold("Toll-free Registration Required")}
       if (selectedType === "10dlc") {
         console.log(
           `
-${pc65.yellow("\u26A0")} ${pc65.bold("10DLC Campaign Registration Required")}
+${pc66.yellow("\u26A0")} ${pc66.bold("10DLC Campaign Registration Required")}
 `
         );
-        console.log(pc65.dim("10DLC requires brand and campaign registration:"));
+        console.log(pc66.dim("10DLC requires brand and campaign registration:"));
         console.log("  \u2022 Brand registration: one-time $4 fee");
         console.log("  \u2022 Campaign registration: $15/mo per campaign");
         console.log("  \u2022 Verification takes 1-7 business days");
@@ -65211,12 +65493,12 @@ ${pc65.yellow("\u26A0")} ${pc65.bold("10DLC Campaign Registration Required")}
       const enableLinkTracking = !config2.tracking?.linkTracking;
       if (enableLinkTracking) {
         clack61.log.info(
-          pc65.dim(
+          pc66.dim(
             "Link tracking will track clicks on URLs in your SMS messages."
           )
         );
         clack61.log.info(
-          pc65.dim("URLs will be rewritten to go through a tracking endpoint.")
+          pc66.dim("URLs will be rewritten to go through a tracking endpoint.")
         );
       }
       const confirmed = await clack61.confirm({
@@ -65429,18 +65711,18 @@ ${pc65.yellow("\u26A0")} ${pc65.bold("10DLC Campaign Registration Required")}
   const newCostData = calculateSMSCosts(updatedConfig, 1e4);
   const costDiff = newCostData.total.monthly - currentCostData.total.monthly;
   console.log(`
-${pc65.bold("Cost Impact:")}`);
+${pc66.bold("Cost Impact:")}`);
   console.log(
-    `  Current: ${pc65.cyan(`${formatCost3(currentCostData.total.monthly)}/mo`)}`
+    `  Current: ${pc66.cyan(`${formatCost3(currentCostData.total.monthly)}/mo`)}`
   );
   console.log(
-    `  New:     ${pc65.cyan(`${formatCost3(newCostData.total.monthly)}/mo`)}`
+    `  New:     ${pc66.cyan(`${formatCost3(newCostData.total.monthly)}/mo`)}`
   );
   if (costDiff > 0) {
-    console.log(`  Change:  ${pc65.yellow(`+${formatCost3(costDiff)}/mo`)}`);
+    console.log(`  Change:  ${pc66.yellow(`+${formatCost3(costDiff)}/mo`)}`);
   } else if (costDiff < 0) {
     console.log(
-      `  Change:  ${pc65.green(`-${formatCost3(Math.abs(costDiff))}/mo`)}`
+      `  Change:  ${pc66.green(`-${formatCost3(Math.abs(costDiff))}/mo`)}`
     );
   }
   console.log("");
@@ -65469,7 +65751,7 @@ ${pc65.bold("Cost Impact:")}`);
   const stackName = metadata.services.sms?.pulumiStackName || `wraps-sms-${identity.accountId}-${region}`;
   const createStack = async () => {
     await ensurePulumiWorkDir({ accountId: identity.accountId, region });
-    const stack = await pulumi34.automation.LocalWorkspace.createOrSelectStack(
+    const stack = await pulumi35.automation.LocalWorkspace.createOrSelectStack(
       {
         stackName,
         projectName: "wraps-sms",
@@ -65520,7 +65802,7 @@ ${pc65.bold("Cost Impact:")}`);
         commandName: "wraps sms upgrade"
       });
       clack61.outro(
-        pc65.green("Preview complete. Run without --preview to upgrade.")
+        pc66.green("Preview complete. Run without --preview to upgrade.")
       );
       trackServiceUpgrade("sms", {
         region,
@@ -65625,43 +65907,43 @@ ${pc65.bold("Cost Impact:")}`);
   }
   progress.info("Connection metadata updated");
   console.log("\n");
-  clack61.log.success(pc65.green(pc65.bold("SMS infrastructure upgraded!")));
+  clack61.log.success(pc66.green(pc66.bold("SMS infrastructure upgraded!")));
   console.log("\n");
   clack61.note(
     [
-      `${pc65.bold("Phone Number:")} ${pc65.cyan(outputs.phoneNumber || "Provisioning...")}`,
-      `${pc65.bold("Phone Type:")} ${pc65.cyan(updatedConfig.phoneNumberType || "simulator")}`,
-      `${pc65.bold("Config Set:")} ${pc65.cyan(outputs.configSetName || "wraps-sms-config")}`,
-      `${pc65.bold("Region:")} ${pc65.cyan(outputs.region)}`,
-      outputs.tableName ? `${pc65.bold("History Table:")} ${pc65.cyan(outputs.tableName)}` : "",
+      `${pc66.bold("Phone Number:")} ${pc66.cyan(outputs.phoneNumber || "Provisioning...")}`,
+      `${pc66.bold("Phone Type:")} ${pc66.cyan(updatedConfig.phoneNumberType || "simulator")}`,
+      `${pc66.bold("Config Set:")} ${pc66.cyan(outputs.configSetName || "wraps-sms-config")}`,
+      `${pc66.bold("Region:")} ${pc66.cyan(outputs.region)}`,
+      outputs.tableName ? `${pc66.bold("History Table:")} ${pc66.cyan(outputs.tableName)}` : "",
       "",
-      pc65.dim("IAM Role:"),
-      pc65.dim(`  ${outputs.roleArn}`)
+      pc66.dim("IAM Role:"),
+      pc66.dim(`  ${outputs.roleArn}`)
     ].filter(Boolean).join("\n"),
     "SMS Infrastructure"
   );
   console.log(`
-${pc65.green("\u2713")} ${pc65.bold("Upgrade complete!")}
+${pc66.green("\u2713")} ${pc66.bold("Upgrade complete!")}
 `);
   if (upgradeAction === "phone-number") {
     console.log(
-      `Upgraded to ${pc65.cyan(updatedConfig.phoneNumberType)} number (${pc65.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Upgraded to ${pc66.cyan(updatedConfig.phoneNumberType)} number (${pc66.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
     if (updatedConfig.phoneNumberType === "toll-free") {
-      console.log(`${pc65.bold("Next Steps:")}`);
+      console.log(`${pc66.bold("Next Steps:")}`);
       console.log(
-        `  1. Run ${pc65.cyan("wraps sms register")} to start toll-free registration`
+        `  1. Run ${pc66.cyan("wraps sms register")} to start toll-free registration`
       );
       console.log("  2. Submit your business information and use case");
       console.log("  3. Wait for carrier verification (1-5 business days)");
       console.log("");
       console.log(
-        pc65.dim("Until verified, your number can only send limited messages.")
+        pc66.dim("Until verified, your number can only send limited messages.")
       );
       console.log("");
     } else if (updatedConfig.phoneNumberType === "10dlc") {
-      console.log(`${pc65.bold("Next Steps:")}`);
+      console.log(`${pc66.bold("Next Steps:")}`);
       console.log("  1. Register your brand in the AWS Console");
       console.log("  2. Create a 10DLC campaign for your use case");
       console.log("  3. Wait for campaign approval (1-7 business days)");
@@ -65669,16 +65951,16 @@ ${pc65.green("\u2713")} ${pc65.bold("Upgrade complete!")}
     }
   } else if (upgradeAction === "preset" && newPreset) {
     console.log(
-      `Upgraded to ${pc65.cyan(newPreset)} preset (${pc65.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Upgraded to ${pc66.cyan(newPreset)} preset (${pc66.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
   } else {
     console.log(
-      `Updated configuration (${pc65.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
+      `Updated configuration (${pc66.green(`${formatCost3(newCostData.total.monthly)}/mo`)})
 `
     );
   }
-  console.log(pc65.dim(getSMSCostSummary(updatedConfig, 1e4)));
+  console.log(pc66.dim(getSMSCostSummary(updatedConfig, 1e4)));
   const enabledFeatures = [];
   if (updatedConfig.tracking?.enabled) {
     enabledFeatures.push("tracking");
@@ -65702,7 +65984,7 @@ ${pc65.green("\u2713")} ${pc65.bold("Upgrade complete!")}
     action: typeof upgradeAction === "string" ? upgradeAction : void 0,
     duration_ms: Date.now() - startTime
   });
-  clack61.outro(pc65.green("Upgrade complete!"));
+  clack61.outro(pc66.green("Upgrade complete!"));
 }
 
 // src/commands/sms/verify-number.ts
@@ -65722,12 +66004,12 @@ import {
   VerifyDestinationNumberCommand
 } from "@aws-sdk/client-pinpoint-sms-voice-v2";
 import * as clack62 from "@clack/prompts";
-import pc66 from "picocolors";
+import pc67 from "picocolors";
 async function smsVerifyNumber(options) {
   const startTime = Date.now();
   const progress = new DeploymentProgress();
   if (!isJsonMode()) {
-    clack62.intro(pc66.bold("Wraps SMS - Verify Destination Number"));
+    clack62.intro(pc67.bold("Wraps SMS - Verify Destination Number"));
   }
   const identity = await progress.execute(
     "Validating AWS credentials",
@@ -65740,7 +66022,7 @@ async function smsVerifyNumber(options) {
     clack62.log.error("No SMS infrastructure found");
     console.log(
       `
-Run ${pc66.cyan("wraps sms init")} to deploy SMS infrastructure.
+Run ${pc67.cyan("wraps sms init")} to deploy SMS infrastructure.
 `
     );
     process.exit(1);
@@ -65757,16 +66039,16 @@ Run ${pc66.cyan("wraps sms init")} to deploy SMS infrastructure.
         clack62.log.info("No verified destination numbers found");
         console.log(
           `
-Run ${pc66.cyan("wraps sms verify-number")} to verify a number.
+Run ${pc67.cyan("wraps sms verify-number")} to verify a number.
 `
         );
       } else {
         console.log("\n");
-        clack62.log.info(pc66.bold("Verified Destination Numbers:"));
+        clack62.log.info(pc67.bold("Verified Destination Numbers:"));
         console.log("");
         for (const num of response.VerifiedDestinationNumbers) {
-          const status2 = num.Status === "VERIFIED" ? pc66.green("\u2713 Verified") : pc66.yellow("\u29D6 Pending");
-          console.log(`  ${pc66.cyan(num.DestinationPhoneNumber)} - ${status2}`);
+          const status2 = num.Status === "VERIFIED" ? pc67.green("\u2713 Verified") : pc67.yellow("\u29D6 Pending");
+          console.log(`  ${pc67.cyan(num.DestinationPhoneNumber)} - ${status2}`);
         }
         console.log("");
       }
@@ -65784,7 +66066,7 @@ Run ${pc66.cyan("wraps sms verify-number")} to verify a number.
         });
         return;
       }
-      clack62.outro(pc66.green("Done!"));
+      clack62.outro(pc67.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -65803,7 +66085,7 @@ Run ${pc66.cyan("wraps sms verify-number")} to verify a number.
       clack62.log.error("Phone number is required for deletion");
       console.log(
         `
-Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234")}
+Usage: ${pc67.cyan("wraps sms verify-number --delete --phone-number +14155551234")}
 `
       );
       process.exit(1);
@@ -65828,7 +66110,7 @@ Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234
         );
       });
       progress.stop();
-      clack62.log.success(`Removed ${pc66.cyan(phoneNumber2)} from verified list`);
+      clack62.log.success(`Removed ${pc67.cyan(phoneNumber2)} from verified list`);
       trackCommand("sms:verify-number:delete", {
         success: true,
         duration_ms: Date.now() - startTime
@@ -65840,7 +66122,7 @@ Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234
         });
         return;
       }
-      clack62.outro(pc66.green("Done!"));
+      clack62.outro(pc67.green("Done!"));
       return;
     } catch (error) {
       progress.stop();
@@ -65912,11 +66194,11 @@ Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234
       progress.stop();
       console.log("\n");
       clack62.log.success(
-        pc66.green(`Phone number ${pc66.cyan(phoneNumber)} verified!`)
+        pc67.green(`Phone number ${pc67.cyan(phoneNumber)} verified!`)
       );
       console.log("");
       console.log(
-        `You can now send test messages to this number with ${pc66.cyan("wraps sms test")}`
+        `You can now send test messages to this number with ${pc67.cyan("wraps sms test")}`
       );
       trackCommand("sms:verify-number:confirm", {
         success: true,
@@ -65929,7 +66211,7 @@ Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234
         });
         return;
       }
-      clack62.outro(pc66.green("Verification complete!"));
+      clack62.outro(pc67.green("Verification complete!"));
       return;
     } catch (error) {
       progress.stop();
@@ -65938,7 +66220,7 @@ Usage: ${pc66.cyan("wraps sms verify-number --delete --phone-number +14155551234
         clack62.log.error("Invalid verification code. Please try again.");
         console.log(
           `
-Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
+Run ${pc67.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
 `
         );
       } else {
@@ -65974,11 +66256,11 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         );
       });
       progress.stop();
-      clack62.log.success(`Verification code resent to ${pc66.cyan(phoneNumber)}`);
+      clack62.log.success(`Verification code resent to ${pc67.cyan(phoneNumber)}`);
       console.log("");
       console.log(
         `Once you receive the code, run:
-  ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
+  ${pc67.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
       );
       trackCommand("sms:verify-number:resend", {
         success: true,
@@ -65991,7 +66273,7 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         });
         return;
       }
-      clack62.outro(pc66.green("Code sent!"));
+      clack62.outro(pc67.green("Code sent!"));
       return;
     } catch (error) {
       progress.stop();
@@ -66020,9 +66302,9 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         return;
       }
       clack62.log.info(
-        `Number ${pc66.cyan(phoneNumber)} is already verified and ready to use!`
+        `Number ${pc67.cyan(phoneNumber)} is already verified and ready to use!`
       );
-      clack62.outro(pc66.green("Done!"));
+      clack62.outro(pc67.green("Done!"));
       return;
     }
     if (existingNumber?.Status === "PENDING") {
@@ -66047,14 +66329,14 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         return;
       }
       clack62.log.info(
-        `Verification already in progress. New code sent to ${pc66.cyan(phoneNumber)}`
+        `Verification already in progress. New code sent to ${pc67.cyan(phoneNumber)}`
       );
       console.log("");
       console.log(
         `Once you receive the code, run:
-  ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
+  ${pc67.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`
       );
-      clack62.outro(pc66.green("Code sent!"));
+      clack62.outro(pc67.green("Code sent!"));
       return;
     }
     const createResponse = await progress.execute(
@@ -66076,7 +66358,7 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
     progress.stop();
     console.log("\n");
     clack62.log.success(
-      `Verification code sent to ${pc66.cyan(phoneNumber)} via SMS`
+      `Verification code sent to ${pc67.cyan(phoneNumber)} via SMS`
     );
     console.log("");
     clack62.note(
@@ -66084,9 +66366,9 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
         "1. Check your phone for the verification code",
         "",
         "2. Complete verification with:",
-        `   ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`,
+        `   ${pc67.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --code YOUR_CODE`)}`,
         "",
-        pc66.dim("The code expires in 24 hours")
+        pc67.dim("The code expires in 24 hours")
       ].join("\n"),
       "Next Steps"
     );
@@ -66102,7 +66384,7 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       });
       return;
     }
-    clack62.outro(pc66.green("Verification started!"));
+    clack62.outro(pc67.green("Verification started!"));
   } catch (error) {
     progress.stop();
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -66110,7 +66392,7 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
       clack62.log.error("This number is already being verified");
       console.log(
         `
-Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
+Run ${pc67.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`)} to get a new code.
 `
       );
     } else {
@@ -66127,21 +66409,21 @@ Run ${pc66.cyan(`wraps sms verify-number --phone-number ${phoneNumber} --resend`
 init_esm_shims();
 init_events();
 import * as clack63 from "@clack/prompts";
-import pc67 from "picocolors";
+import pc68 from "picocolors";
 async function support() {
   trackCommand("support", { success: true });
-  clack63.intro(pc67.bold("Get Help with Wraps"));
+  clack63.intro(pc68.bold("Get Help with Wraps"));
   console.log();
-  console.log(`  ${pc67.bold("Email:")}   ${pc67.cyan("hey@wraps.dev")}`);
+  console.log(`  ${pc68.bold("Email:")}   ${pc68.cyan("hey@wraps.dev")}`);
   console.log(
-    `  ${pc67.bold("GitHub:")}  ${pc67.cyan("https://github.com/wraps-dev/wraps/issues")}`
+    `  ${pc68.bold("GitHub:")}  ${pc68.cyan("https://github.com/wraps-dev/wraps/issues")}`
   );
-  console.log(`  ${pc67.bold("Docs:")}    ${pc67.cyan("https://wraps.dev/docs")}`);
+  console.log(`  ${pc68.bold("Docs:")}    ${pc68.cyan("https://wraps.dev/docs")}`);
   console.log(
-    `  ${pc67.bold("AI docs:")} ${pc67.cyan("https://wraps.dev/llms-full.txt")} ${pc67.dim("(complete docs, one file)")}`
+    `  ${pc68.bold("AI docs:")} ${pc68.cyan("https://wraps.dev/llms-full.txt")} ${pc68.dim("(complete docs, one file)")}`
   );
   console.log();
-  console.log(pc67.dim("  Response time: Usually within 24 hours"));
+  console.log(pc68.dim("  Response time: Usually within 24 hours"));
   console.log();
 }
 
@@ -66149,7 +66431,7 @@ async function support() {
 init_esm_shims();
 init_client();
 import * as clack64 from "@clack/prompts";
-import pc68 from "picocolors";
+import pc69 from "picocolors";
 async function telemetryEnable() {
   const client2 = getTelemetryClient();
   const override = client2.enable();
@@ -66157,60 +66439,60 @@ async function telemetryEnable() {
     clack64.log.warn(
       "Telemetry enabled in config, but overridden by environment"
     );
-    console.log(`   Reason: ${pc68.yellow(override)}`);
-    console.log(`   Config: ${pc68.dim(client2.getConfigPath())}`);
+    console.log(`   Reason: ${pc69.yellow(override)}`);
+    console.log(`   Config: ${pc69.dim(client2.getConfigPath())}`);
     console.log();
   } else {
-    clack64.log.success(pc68.green("Telemetry enabled"));
-    console.log(`   Config: ${pc68.dim(client2.getConfigPath())}`);
+    clack64.log.success(pc69.green("Telemetry enabled"));
+    console.log(`   Config: ${pc69.dim(client2.getConfigPath())}`);
     console.log(`
-   ${pc68.dim("Thank you for helping improve Wraps!")}
+   ${pc69.dim("Thank you for helping improve Wraps!")}
 `);
   }
 }
 async function telemetryDisable() {
   const client2 = getTelemetryClient();
   client2.disable();
-  clack64.log.success(pc68.green("Telemetry disabled"));
-  console.log(`   Config: ${pc68.dim(client2.getConfigPath())}`);
+  clack64.log.success(pc69.green("Telemetry disabled"));
+  console.log(`   Config: ${pc69.dim(client2.getConfigPath())}`);
   console.log(
     `
-   ${pc68.dim("You can re-enable with:")} wraps telemetry enable
+   ${pc69.dim("You can re-enable with:")} wraps telemetry enable
 `
   );
 }
 async function telemetryStatus() {
   const client2 = getTelemetryClient();
-  clack64.intro(pc68.bold("Telemetry Status"));
+  clack64.intro(pc69.bold("Telemetry Status"));
   const override = client2.getEnvOverride();
-  const status2 = client2.isEnabled() ? pc68.green("Enabled") : pc68.red("Disabled");
+  const status2 = client2.isEnabled() ? pc69.green("Enabled") : pc69.red("Disabled");
   console.log();
-  console.log(`  ${pc68.bold("Status:")} ${status2}`);
+  console.log(`  ${pc69.bold("Status:")} ${status2}`);
   if (!client2.isEnabled() && override) {
-    console.log(`  ${pc68.bold("Reason:")} ${pc68.yellow(override)}`);
+    console.log(`  ${pc69.bold("Reason:")} ${pc69.yellow(override)}`);
   }
-  console.log(`  ${pc68.bold("Config file:")} ${pc68.dim(client2.getConfigPath())}`);
+  console.log(`  ${pc69.bold("Config file:")} ${pc69.dim(client2.getConfigPath())}`);
   if (client2.isEnabled()) {
     console.log();
-    console.log(pc68.bold("  How to opt-out:"));
-    console.log(`    ${pc68.cyan("wraps telemetry disable")}`);
+    console.log(pc69.bold("  How to opt-out:"));
+    console.log(`    ${pc69.cyan("wraps telemetry disable")}`);
     console.log(
-      `    ${pc68.dim("Or set:")} ${pc68.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
+      `    ${pc69.dim("Or set:")} ${pc69.cyan("WRAPS_TELEMETRY_DISABLED=1")}`
     );
-    console.log(`    ${pc68.dim("Or set:")} ${pc68.cyan("DO_NOT_TRACK=1")}`);
+    console.log(`    ${pc69.dim("Or set:")} ${pc69.cyan("DO_NOT_TRACK=1")}`);
   } else {
     console.log();
-    console.log(pc68.bold("  How to opt-in:"));
-    console.log(`    ${pc68.cyan("wraps telemetry enable")}`);
+    console.log(pc69.bold("  How to opt-in:"));
+    console.log(`    ${pc69.cyan("wraps telemetry enable")}`);
   }
   console.log();
-  console.log(pc68.bold("  Debug mode:"));
+  console.log(pc69.bold("  Debug mode:"));
   console.log(
-    `    ${pc68.dim("See what would be sent:")} ${pc68.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
+    `    ${pc69.dim("See what would be sent:")} ${pc69.cyan("WRAPS_TELEMETRY_DEBUG=1 wraps <command>")}`
   );
   console.log();
   console.log(
-    `  ${pc68.dim("Learn more:")} ${pc68.cyan("https://wraps.dev/docs/telemetry")}`
+    `  ${pc69.dim("Learn more:")} ${pc69.cyan("https://wraps.dev/docs/telemetry")}`
   );
   console.log();
 }
@@ -66220,7 +66502,7 @@ init_esm_shims();
 import { existsSync as existsSync18, mkdirSync as mkdirSync2, writeFileSync } from "fs";
 import { join as join23 } from "path";
 import * as clack65 from "@clack/prompts";
-import pc69 from "picocolors";
+import pc70 from "picocolors";
 var EXAMPLE_CASCADE_WORKFLOW = `import {
   defineWorkflow,
   sendEmail,
@@ -66315,13 +66597,13 @@ export default defineConfig({
 });
 `;
 async function workflowInit(options = {}) {
-  clack65.intro(pc69.bgCyan(pc69.black(" wraps workflow init ")));
+  clack65.intro(pc70.bgCyan(pc70.black(" wraps workflow init ")));
   const wrapsDir = join23(process.cwd(), "wraps");
   const workflowsDir = join23(wrapsDir, "workflows");
   const configPath = join23(wrapsDir, "wraps.config.ts");
   if (existsSync18(workflowsDir)) {
     clack65.log.info(
-      `Workflows directory already exists at ${pc69.cyan("wraps/workflows/")}`
+      `Workflows directory already exists at ${pc70.cyan("wraps/workflows/")}`
     );
     const files = existsSync18(join23(workflowsDir, "cart-recovery.ts")) || existsSync18(join23(workflowsDir, "welcome-sequence.ts"));
     if (files && !options.yes) {
@@ -66356,39 +66638,123 @@ async function workflowInit(options = {}) {
     s2.stop("Created 2 example workflows");
     if (!existsSync18(configPath)) {
       writeFileSync(configPath, EXAMPLE_CONFIG, "utf-8");
-      clack65.log.info(`Created ${pc69.cyan("wraps/wraps.config.ts")}`);
+      clack65.log.info(`Created ${pc70.cyan("wraps/wraps.config.ts")}`);
     }
     clack65.log.success(
-      `${pc69.bold("Workflows scaffolded!")} Created:
-  ${pc69.cyan("wraps/wraps.config.ts")}               \u2014 Project config
-  ${pc69.cyan("wraps/workflows/cart-recovery.ts")}    \u2014 Cross-channel cascade example
-  ${pc69.cyan("wraps/workflows/welcome-sequence.ts")} \u2014 Welcome series example`
+      `${pc70.bold("Workflows scaffolded!")} Created:
+  ${pc70.cyan("wraps/wraps.config.ts")}               \u2014 Project config
+  ${pc70.cyan("wraps/workflows/cart-recovery.ts")}    \u2014 Cross-channel cascade example
+  ${pc70.cyan("wraps/workflows/welcome-sequence.ts")} \u2014 Welcome series example`
     );
     showNextSteps2();
-    clack65.outro(pc69.green("Happy orchestrating!"));
+    clack65.outro(pc70.green("Happy orchestrating!"));
   } catch (error) {
     clack65.log.error(
       `Failed to scaffold workflows: ${error instanceof Error ? error.message : String(error)}`
     );
-    clack65.outro(pc69.red("Scaffolding failed."));
+    clack65.outro(pc70.red("Scaffolding failed."));
     process.exitCode = 1;
   }
 }
 function showNextSteps2() {
   clack65.log.info(
-    `${pc69.bold("Next steps:")}
+    `${pc70.bold("Next steps:")}
 
-  1. Edit ${pc69.cyan("wraps/wraps.config.ts")} with your org slug and domain
-  2. Edit your workflows in ${pc69.cyan("wraps/workflows/")}
-  3. Validate: ${pc69.cyan("wraps email workflows validate")}
-  4. Push:     ${pc69.cyan("wraps email workflows push")}
+  1. Edit ${pc70.cyan("wraps/wraps.config.ts")} with your org slug and domain
+  2. Edit your workflows in ${pc70.cyan("wraps/workflows/")}
+  3. Validate: ${pc70.cyan("wraps email workflows validate")}
+  4. Push:     ${pc70.cyan("wraps email workflows push")}
 
-  ${pc69.dim("Docs:")} ${pc69.underline("https://wraps.dev/docs/guides/orchestration")}`
+  ${pc70.dim("Docs:")} ${pc70.underline("https://wraps.dev/docs/guides/orchestration")}`
   );
 }
 
 // src/cli.ts
 init_client();
+
+// src/telemetry/command-name.ts
+init_esm_shims();
+
+// src/utils/shared/did-you-mean.ts
+init_esm_shims();
+var TOP_LEVEL_COMMANDS = [
+  "auth",
+  "aws",
+  "cdn",
+  "completion",
+  "console",
+  "destroy",
+  "doctor",
+  "email",
+  "help",
+  "license",
+  "news",
+  "permissions",
+  "platform",
+  "push",
+  "selfhost",
+  "sms",
+  "status",
+  "support",
+  "telemetry",
+  "update",
+  "workflow"
+];
+function distance(a6, b6) {
+  let previous = Array.from({ length: b6.length + 1 }, (_, i6) => i6);
+  for (let i6 = 1; i6 <= a6.length; i6++) {
+    const current = [i6];
+    for (let j6 = 1; j6 <= b6.length; j6++) {
+      const substitution = previous[j6 - 1] + (a6[i6 - 1] === b6[j6 - 1] ? 0 : 1);
+      current[j6] = Math.min(current[j6 - 1] + 1, previous[j6] + 1, substitution);
+    }
+    previous = current;
+  }
+  return previous[b6.length];
+}
+var MAX_DISTANCE = 2;
+function suggestCommand(input, known = TOP_LEVEL_COMMANDS) {
+  const needle = input.toLowerCase();
+  if (needle === "") {
+    return null;
+  }
+  const candidates = known.filter((candidate) => candidate !== needle);
+  let prefixMatch = null;
+  for (const candidate of candidates) {
+    if (candidate.startsWith(needle) && (prefixMatch === null || candidate.length < prefixMatch.length)) {
+      prefixMatch = candidate;
+    }
+  }
+  if (prefixMatch) {
+    return prefixMatch;
+  }
+  let best = null;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of candidates) {
+    const candidateDistance = distance(needle, candidate);
+    if (candidateDistance < bestDistance) {
+      best = candidate;
+      bestDistance = candidateDistance;
+    }
+  }
+  return bestDistance <= MAX_DISTANCE ? best : null;
+}
+
+// src/telemetry/command-name.ts
+var UNKNOWN = "unknown";
+var COMMAND_WORD = /^[a-z][a-z0-9-]{0,31}$/;
+var COMMANDS_WITH_DATA_SECOND_POSITIONAL = ["push"];
+function telemetryCommandName(primaryCommand2, subCommand2) {
+  if (!(primaryCommand2 && TOP_LEVEL_COMMANDS.includes(primaryCommand2))) {
+    return UNKNOWN;
+  }
+  if (!subCommand2 || COMMANDS_WITH_DATA_SECOND_POSITIONAL.includes(primaryCommand2)) {
+    return primaryCommand2;
+  }
+  return COMMAND_WORD.test(subCommand2) ? `${primaryCommand2}:${subCommand2}` : `${primaryCommand2}:${UNKNOWN}`;
+}
+
+// src/cli.ts
 init_events();
 
 // src/utils/shared/arg-parser.ts
@@ -66562,71 +66928,6 @@ function printCompletionScript() {
   console.log("#   --preview       : Preview changes without deploying\n");
 }
 
-// src/utils/shared/did-you-mean.ts
-init_esm_shims();
-var TOP_LEVEL_COMMANDS = [
-  "auth",
-  "aws",
-  "cdn",
-  "completion",
-  "console",
-  "destroy",
-  "doctor",
-  "email",
-  "help",
-  "license",
-  "news",
-  "permissions",
-  "platform",
-  "push",
-  "selfhost",
-  "sms",
-  "status",
-  "support",
-  "telemetry",
-  "update",
-  "workflow"
-];
-function distance(a6, b6) {
-  let previous = Array.from({ length: b6.length + 1 }, (_, i6) => i6);
-  for (let i6 = 1; i6 <= a6.length; i6++) {
-    const current = [i6];
-    for (let j6 = 1; j6 <= b6.length; j6++) {
-      const substitution = previous[j6 - 1] + (a6[i6 - 1] === b6[j6 - 1] ? 0 : 1);
-      current[j6] = Math.min(current[j6 - 1] + 1, previous[j6] + 1, substitution);
-    }
-    previous = current;
-  }
-  return previous[b6.length];
-}
-var MAX_DISTANCE = 2;
-function suggestCommand(input, known = TOP_LEVEL_COMMANDS) {
-  const needle = input.toLowerCase();
-  if (needle === "") {
-    return null;
-  }
-  const candidates = known.filter((candidate) => candidate !== needle);
-  let prefixMatch = null;
-  for (const candidate of candidates) {
-    if (candidate.startsWith(needle) && (prefixMatch === null || candidate.length < prefixMatch.length)) {
-      prefixMatch = candidate;
-    }
-  }
-  if (prefixMatch) {
-    return prefixMatch;
-  }
-  let best = null;
-  let bestDistance = Number.POSITIVE_INFINITY;
-  for (const candidate of candidates) {
-    const candidateDistance = distance(needle, candidate);
-    if (candidateDistance < bestDistance) {
-      best = candidate;
-      bestDistance = candidateDistance;
-    }
-  }
-  return bestDistance <= MAX_DISTANCE ? best : null;
-}
-
 // src/cli.ts
 init_errors();
 init_json_output();
@@ -66656,238 +66957,241 @@ function showVersion() {
   process.exit(0);
 }
 function showHelp() {
-  clack66.intro(pc71.bold(`WRAPS CLI v${VERSION}`));
+  clack66.intro(pc72.bold(`WRAPS CLI v${VERSION}`));
   console.log("Deploy AWS infrastructure to your account\n");
   console.log("Usage: wraps [service] <command> [options]\n");
   console.log("Services:");
-  console.log(`  ${pc71.cyan("email")}       Email infrastructure (AWS SES)`);
+  console.log(`  ${pc72.cyan("email")}       Email infrastructure (AWS SES)`);
   console.log(
-    `  ${pc71.cyan("sms")}         SMS infrastructure (AWS End User Messaging)`
+    `  ${pc72.cyan("sms")}         SMS infrastructure (AWS End User Messaging)`
   );
   console.log(
-    `  ${pc71.cyan("cdn")}         CDN infrastructure (AWS S3 + CloudFront)`
+    `  ${pc72.cyan("cdn")}         CDN infrastructure (AWS S3 + CloudFront)`
   );
   console.log(
-    `  ${pc71.cyan("selfhost")}    Self-hosted Wraps control plane (enterprise)`
+    `  ${pc72.cyan("selfhost")}    Self-hosted Wraps control plane (enterprise)`
   );
   console.log(
-    `  ${pc71.cyan("license")}     License key management (Wraps team only)
+    `  ${pc72.cyan("license")}     License key management (Wraps team only)
 `
   );
   console.log("Email Commands:");
   console.log(
-    `  ${pc71.cyan("email init")}           Deploy new email infrastructure`
+    `  ${pc72.cyan("email init")}           Deploy new email infrastructure`
   );
   console.log(
-    `  ${pc71.cyan("email check")}          Check email deliverability for a domain`
+    `  ${pc72.cyan("email check")}          Check email deliverability for a domain`
   );
   console.log(
-    `  ${pc71.cyan("email connect")}        Connect to existing AWS SES`
+    `  ${pc72.cyan("email connect")}        Connect to existing AWS SES`
   );
   console.log(
-    `  ${pc71.cyan("email status")}         Show email infrastructure details`
+    `  ${pc72.cyan("email status")}         Show email infrastructure details`
   );
   console.log(
-    `  ${pc71.cyan("email plan")}           Show SES pricing plan and cheaper options`
+    `  ${pc72.cyan("email plan")}           Show SES pricing plan and cheaper options`
   );
-  console.log(`  ${pc71.cyan("email test")}           Send a test email`);
-  console.log(`  ${pc71.cyan("email verify")}         Verify domain DNS records`);
+  console.log(`  ${pc72.cyan("email test")}           Send a test email`);
+  console.log(`  ${pc72.cyan("email verify")}         Verify domain DNS records`);
   console.log(
-    `  ${pc71.cyan("email sync")}           Apply CLI updates to infrastructure`
+    `  ${pc72.cyan("email sync")}           Apply CLI updates to infrastructure`
   );
-  console.log(`  ${pc71.cyan("email upgrade")}        Add features`);
+  console.log(`  ${pc72.cyan("email upgrade")}        Add features`);
   console.log(
-    `  ${pc71.cyan("email restore")}        Restore original configuration`
+    `  ${pc72.cyan("email restore")}        Restore original configuration`
   );
   console.log(
-    `  ${pc71.cyan("email destroy")}        Remove email infrastructure`
+    `  ${pc72.cyan("email destroy")}        Remove email infrastructure`
   );
   console.log(
-    `  ${pc71.cyan("email doctor")}         Diagnose and clean up email infrastructure`
+    `  ${pc72.cyan("email doctor")}         Diagnose and clean up email infrastructure`
   );
-  console.log(`  ${pc71.cyan("email domains add")}    Add a domain to SES`);
-  console.log(`  ${pc71.cyan("email domains list")}   List all domains`);
-  console.log(`  ${pc71.cyan("email domains remove")} Remove a domain`);
+  console.log(`  ${pc72.cyan("email domains add")}    Add a domain to SES`);
+  console.log(`  ${pc72.cyan("email domains list")}   List all domains`);
+  console.log(`  ${pc72.cyan("email domains remove")} Remove a domain`);
   console.log(
-    `  ${pc71.cyan("email inbound init")}   Enable inbound email receiving`
+    `  ${pc72.cyan("email inbound init")}   Enable inbound email receiving`
   );
-  console.log(`  ${pc71.cyan("email inbound status")} Show inbound email status`);
+  console.log(`  ${pc72.cyan("email inbound status")} Show inbound email status`);
   console.log(
-    `  ${pc71.cyan("email inbound verify")} Verify inbound DNS records`
+    `  ${pc72.cyan("email inbound verify")} Verify inbound DNS records`
   );
   console.log(
-    `  ${pc71.cyan("email inbound test")}   Send test email and verify receipt`
+    `  ${pc72.cyan("email inbound test")}   Send test email and verify receipt`
   );
   console.log(
-    `  ${pc71.cyan("email inbound destroy")} Remove inbound email infrastructure
+    `  ${pc72.cyan("email inbound destroy")} Remove inbound email infrastructure
 `
   );
   console.log("Agent Commands:");
   console.log(
-    `  ${pc71.cyan("email agent create")}   Create a leashed agent mailbox`
+    `  ${pc72.cyan("email agent create")}   Create a leashed agent mailbox`
   );
-  console.log(`  ${pc71.cyan("email agent list")}     List agents`);
+  console.log(`  ${pc72.cyan("email agent list")}     List agents`);
   console.log(
-    `  ${pc71.cyan("email agent kill")}     Kill an agent (revoke sending)
+    `  ${pc72.cyan("email agent kill")}     Kill an agent (revoke sending)
 `
   );
   console.log("Template Commands:");
   console.log(
-    `  ${pc71.cyan("email templates init")}  Initialize templates-as-code`
+    `  ${pc72.cyan("email templates init")}  Initialize templates-as-code`
   );
   console.log(
-    `  ${pc71.cyan("email templates push")}  Push templates to SES + dashboard`
+    `  ${pc72.cyan("email templates push")}  Push templates to SES + dashboard`
   );
   console.log(
-    `  ${pc71.cyan("email templates preview")} Preview templates in browser`
+    `  ${pc72.cyan("email templates preview")} Preview templates in browser`
   );
   console.log(
-    `  ${pc71.cyan("push")}                  ${pc71.dim("(alias for email templates push)")}
+    `  ${pc72.cyan("push")}                  ${pc72.dim("(alias for email templates push)")}
 `
   );
   console.log("Workflow Commands:");
   console.log(
-    `  ${pc71.cyan("email workflows init")}      Initialize workflows-as-code`
+    `  ${pc72.cyan("email workflows init")}      Initialize workflows-as-code`
   );
   console.log(
-    `  ${pc71.cyan("email workflows validate")}  Validate workflow files`
+    `  ${pc72.cyan("email workflows validate")}  Validate workflow files`
   );
   console.log(
-    `  ${pc71.cyan("email workflows push")}      Push workflows to dashboard
+    `  ${pc72.cyan("email workflows push")}      Push workflows to dashboard
 `
   );
   console.log("SMS Commands:");
-  console.log(`  ${pc71.cyan("sms init")}             Deploy SMS infrastructure`);
+  console.log(`  ${pc72.cyan("sms init")}             Deploy SMS infrastructure`);
   console.log(
-    `  ${pc71.cyan("sms status")}           Show SMS infrastructure details`
+    `  ${pc72.cyan("sms status")}           Show SMS infrastructure details`
   );
-  console.log(`  ${pc71.cyan("sms test")}             Send a test SMS message`);
+  console.log(`  ${pc72.cyan("sms test")}             Send a test SMS message`);
   console.log(
-    `  ${pc71.cyan("sms verify-number")}    Verify a destination phone number`
+    `  ${pc72.cyan("sms verify-number")}    Verify a destination phone number`
   );
   console.log(
-    `  ${pc71.cyan("sms sync")}             Sync infrastructure (update Lambda, etc.)`
+    `  ${pc72.cyan("sms sync")}             Sync infrastructure (update Lambda, etc.)`
   );
-  console.log(`  ${pc71.cyan("sms upgrade")}          Upgrade SMS features`);
-  console.log(`  ${pc71.cyan("sms register")}         Register toll-free number`);
+  console.log(`  ${pc72.cyan("sms upgrade")}          Upgrade SMS features`);
+  console.log(`  ${pc72.cyan("sms register")}         Register toll-free number`);
   console.log(
-    `  ${pc71.cyan("sms destroy")}          Remove SMS infrastructure
+    `  ${pc72.cyan("sms destroy")}          Remove SMS infrastructure
 `
   );
   console.log("CDN Commands:");
   console.log(
-    `  ${pc71.cyan("cdn init")}             Deploy CDN infrastructure (S3 + CloudFront)`
+    `  ${pc72.cyan("cdn init")}             Deploy CDN infrastructure (S3 + CloudFront)`
   );
   console.log(
-    `  ${pc71.cyan("cdn status")}           Show CDN infrastructure details`
+    `  ${pc72.cyan("cdn status")}           Show CDN infrastructure details`
   );
   console.log(
-    `  ${pc71.cyan("cdn verify")}           Check DNS and certificate status`
+    `  ${pc72.cyan("cdn verify")}           Check DNS and certificate status`
   );
   console.log(
-    `  ${pc71.cyan("cdn upgrade")}          Add custom domain after cert validation`
+    `  ${pc72.cyan("cdn upgrade")}          Add custom domain after cert validation`
   );
   console.log(
-    `  ${pc71.cyan("cdn sync")}             Sync infrastructure with current config`
+    `  ${pc72.cyan("cdn sync")}             Sync infrastructure with current config`
   );
   console.log(
-    `  ${pc71.cyan("cdn destroy")}          Remove CDN infrastructure
+    `  ${pc72.cyan("cdn destroy")}          Remove CDN infrastructure
 `
   );
   console.log("Self-Hosted Commands:");
   console.log(
-    `  ${pc71.cyan("selfhost login")}       Sign in to your self-hosted Wraps instance`
+    `  ${pc72.cyan("selfhost login")}       Sign in to your self-hosted Wraps instance`
   );
   console.log(
-    `  ${pc71.cyan("selfhost logout")}      Sign out of your self-hosted Wraps instance`
+    `  ${pc72.cyan("selfhost logout")}      Sign out of your self-hosted Wraps instance`
   );
   console.log(
-    `  ${pc71.cyan("selfhost status")}      Show self-hosted deployment details`
+    `  ${pc72.cyan("selfhost status")}      Show self-hosted deployment details`
   );
   console.log(
-    `  ${pc71.cyan("selfhost logs")}        Stream logs from your self-hosted API, dashboard, and workers`
+    `  ${pc72.cyan("selfhost logs")}        Stream logs from your self-hosted API, dashboard, and workers`
   );
   console.log(
-    `  ${pc71.cyan("selfhost env")}         Print env vars for hosting the dashboard yourself`
+    `  ${pc72.cyan("selfhost env")}         Print env vars for hosting the dashboard yourself`
   );
   console.log(
-    `  ${pc71.cyan("selfhost connect")}     Connect your AWS account to your self-hosted instance`
+    `  ${pc72.cyan("selfhost connect")}     Connect your AWS account to your self-hosted instance`
   );
   console.log(
-    `  ${pc71.cyan("selfhost update-role")} Refresh your self-hosted console role's permissions
+    `  ${pc72.cyan("selfhost update-role")} Refresh your self-hosted console role's permissions
 `
   );
   console.log("Local Development:");
   console.log(
-    `  ${pc71.cyan("console")}               Start local web console
+    `  ${pc72.cyan("console")}               Start local web console
 `
   );
   console.log("Platform:");
   console.log(
-    `  ${pc71.cyan("platform")}              Show platform info and pricing`
+    `  ${pc72.cyan("platform")}              Show platform info and pricing`
+  );
+  console.log(
+    `  ${pc72.cyan("platform connect")}      Connect to Wraps Platform (events + IAM)`
   );
   console.log(
-    `  ${pc71.cyan("platform connect")}      Connect to Wraps Platform (events + IAM)`
+    `  ${pc72.cyan("platform disconnect")}   Stop streaming events to Wraps Platform`
   );
   console.log(
-    `  ${pc71.cyan("platform update-role")} Update platform IAM permissions
+    `  ${pc72.cyan("platform update-role")} Update platform IAM permissions
 `
   );
   console.log("Auth:");
   console.log(
-    `  ${pc71.cyan("auth login")}           Sign in to wraps.dev (device flow)`
+    `  ${pc72.cyan("auth login")}           Sign in to wraps.dev (device flow)`
   );
-  console.log(`  ${pc71.cyan("auth status")}          Show current auth state`);
+  console.log(`  ${pc72.cyan("auth status")}          Show current auth state`);
   console.log(
-    `  ${pc71.cyan("auth logout")}          Sign out and remove stored token
+    `  ${pc72.cyan("auth logout")}          Sign out and remove stored token
 `
   );
   console.log("AWS Setup:");
   console.log(
-    `  ${pc71.cyan("aws setup")}            Interactive AWS setup wizard`
+    `  ${pc72.cyan("aws setup")}            Interactive AWS setup wizard`
   );
   console.log(
-    `  ${pc71.cyan("aws doctor")}           Diagnose AWS configuration issues
+    `  ${pc72.cyan("aws doctor")}           Diagnose AWS configuration issues
 `
   );
   console.log("Global Commands:");
-  console.log(`  ${pc71.cyan("status")}       Show overview of all services`);
+  console.log(`  ${pc72.cyan("status")}       Show overview of all services`);
   console.log(
-    `  ${pc71.cyan("doctor")}       Diagnose AWS + email infrastructure`
+    `  ${pc72.cyan("doctor")}       Diagnose AWS + email infrastructure`
   );
-  console.log(`  ${pc71.cyan("destroy")}      Remove deployed infrastructure`);
-  console.log(`  ${pc71.cyan("permissions")} Show required AWS IAM permissions`);
-  console.log(`  ${pc71.cyan("completion")}   Generate shell completion script`);
+  console.log(`  ${pc72.cyan("destroy")}      Remove deployed infrastructure`);
+  console.log(`  ${pc72.cyan("permissions")} Show required AWS IAM permissions`);
+  console.log(`  ${pc72.cyan("completion")}   Generate shell completion script`);
   console.log(
-    `  ${pc71.cyan("telemetry")}    Manage anonymous telemetry settings`
+    `  ${pc72.cyan("telemetry")}    Manage anonymous telemetry settings`
   );
-  console.log(`  ${pc71.cyan("update")}       Update CLI to latest version`);
-  console.log(`  ${pc71.cyan("news")}         Show recent Wraps updates`);
+  console.log(`  ${pc72.cyan("update")}       Update CLI to latest version`);
+  console.log(`  ${pc72.cyan("news")}         Show recent Wraps updates`);
   console.log(
-    `  ${pc71.cyan("support")}      Get help and support contact info
+    `  ${pc72.cyan("support")}      Get help and support contact info
 `
   );
   console.log("Options:");
   console.log(
-    `  ${pc71.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
+    `  ${pc72.dim("-p, --provider")}  Hosting provider (vercel, aws, railway, other)`
   );
-  console.log(`  ${pc71.dim("-r, --region")}    AWS region`);
-  console.log(`  ${pc71.dim("-d, --domain")}    Domain name`);
-  console.log(`  ${pc71.dim("--account")}        AWS account ID or alias`);
-  console.log(`  ${pc71.dim("--preset")}         Configuration preset`);
-  console.log(`  ${pc71.dim("--token")}          API key or token for auth`);
-  console.log(`  ${pc71.dim("-y, --yes")}        Skip confirmation prompts`);
-  console.log(`  ${pc71.dim("-f, --force")}      Force destructive operations`);
+  console.log(`  ${pc72.dim("-r, --region")}    AWS region`);
+  console.log(`  ${pc72.dim("-d, --domain")}    Domain name`);
+  console.log(`  ${pc72.dim("--account")}        AWS account ID or alias`);
+  console.log(`  ${pc72.dim("--preset")}         Configuration preset`);
+  console.log(`  ${pc72.dim("--token")}          API key or token for auth`);
+  console.log(`  ${pc72.dim("-y, --yes")}        Skip confirmation prompts`);
+  console.log(`  ${pc72.dim("-f, --force")}      Force destructive operations`);
   console.log(
-    `  ${pc71.dim("--preview")}        Preview changes without deploying`
+    `  ${pc72.dim("--preview")}        Preview changes without deploying`
   );
-  console.log(`  ${pc71.dim("-v, --version")}    Show version number
+  console.log(`  ${pc72.dim("-v, --version")}    Show version number
 `);
   console.log(
-    `Run ${pc71.cyan("wraps <service> <command> --help")} for more information.`
+    `Run ${pc72.cyan("wraps <service> <command> --help")} for more information.`
   );
   console.log(
-    `AI agents: complete docs at ${pc71.cyan("https://wraps.dev/llms-full.txt")}
+    `AI agents: complete docs at ${pc72.cyan("https://wraps.dev/llms-full.txt")}
 `
   );
 }
@@ -66909,25 +67213,25 @@ if (!primaryCommand) {
     const telemetry = getTelemetryClient();
     if (!isJsonMode() && telemetry.shouldShowNotification()) {
       console.log();
-      clack66.log.info(pc71.bold("Anonymous Telemetry"));
+      clack66.log.info(pc72.bold("Anonymous Telemetry"));
       console.log(
-        `  Wraps collects ${pc71.cyan("anonymous usage data")} to improve the CLI.`
+        `  Wraps collects ${pc72.cyan("anonymous usage data")} to improve the CLI.`
       );
       console.log(
-        `  We ${pc71.bold("never")} collect: domains, AWS credentials, email content, or PII.`
+        `  We ${pc72.bold("never")} collect: domains, AWS credentials, email content, or PII.`
       );
       console.log(
-        `  We ${pc71.bold("only")} collect: command names, success/failure, CLI version, OS.`
+        `  We ${pc72.bold("only")} collect: command names, success/failure, CLI version, OS.`
       );
       console.log();
-      console.log(`  Opt-out anytime: ${pc71.cyan("wraps telemetry disable")}`);
-      console.log(`  Or set: ${pc71.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
-      console.log(`  Learn more: ${pc71.cyan("https://wraps.dev/docs")}`);
+      console.log(`  Opt-out anytime: ${pc72.cyan("wraps telemetry disable")}`);
+      console.log(`  Or set: ${pc72.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
+      console.log(`  Learn more: ${pc72.cyan("https://wraps.dev/docs")}`);
       console.log();
       telemetry.markNotificationShown();
     }
     trackCommand("interactive:menu", { success: true, duration_ms: 0 });
-    clack66.intro(pc71.bold(`WRAPS CLI v${VERSION}`));
+    clack66.intro(pc72.bold(`WRAPS CLI v${VERSION}`));
     console.log("  Deploy AWS infrastructure to your account.\n");
     const action = await clack66.select({
       message: "What would you like to do?",
@@ -67055,8 +67359,9 @@ if (!primaryCommand) {
       await telemetry.shutdown();
     }
   }
-  interactiveMenu().then(() => process.exit(0)).catch((err) => {
+  interactiveMenu().then(() => process.exit(0)).catch(async (err) => {
     handleCLIError(err);
+    await getTelemetryClient().shutdown();
     process.exit(1);
   });
 }
@@ -67065,20 +67370,20 @@ async function run() {
   const telemetry = getTelemetryClient();
   if (!isJsonMode() && telemetry.shouldShowNotification()) {
     console.log();
-    clack66.log.info(pc71.bold("Anonymous Telemetry"));
+    clack66.log.info(pc72.bold("Anonymous Telemetry"));
     console.log(
-      `  Wraps collects ${pc71.cyan("anonymous usage data")} to improve the CLI.`
+      `  Wraps collects ${pc72.cyan("anonymous usage data")} to improve the CLI.`
     );
     console.log(
-      `  We ${pc71.bold("never")} collect: domains, AWS credentials, email content, or PII.`
+      `  We ${pc72.bold("never")} collect: domains, AWS credentials, email content, or PII.`
     );
     console.log(
-      `  We ${pc71.bold("only")} collect: command names, success/failure, CLI version, OS.`
+      `  We ${pc72.bold("only")} collect: command names, success/failure, CLI version, OS.`
     );
     console.log();
-    console.log(`  Opt-out anytime: ${pc71.cyan("wraps telemetry disable")}`);
-    console.log(`  Or set: ${pc71.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
-    console.log(`  Learn more: ${pc71.cyan("https://wraps.dev/docs")}`);
+    console.log(`  Opt-out anytime: ${pc72.cyan("wraps telemetry disable")}`);
+    console.log(`  Or set: ${pc72.cyan("WRAPS_TELEMETRY_DISABLED=1")}`);
+    console.log(`  Learn more: ${pc72.cyan("https://wraps.dev/docs")}`);
     console.log();
     telemetry.markNotificationShown();
   }
@@ -67173,13 +67478,10 @@ async function run() {
           break;
         case "verify": {
           if (!flags.domain) {
-            clack66.log.error("--domain flag is required");
-            console.log(
-              `
-Usage: ${pc71.cyan("wraps email verify --domain yourapp.com")}
-`
+            throw errors.missingInput(
+              "--domain",
+              "wraps email verify --domain yourapp.com"
             );
-            throw new Error("Missing required flag: --domain");
           }
           await verifyDomain({
             domain: flags.domain,
@@ -67248,16 +67550,10 @@ Usage: ${pc71.cyan("wraps email verify --domain yourapp.com")}
               });
               break;
             default:
-              clack66.log.error(
-                `Unknown inbound command: ${inboundSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("init")}, ${pc71.cyan("destroy")}, ${pc71.cyan("status")}, ${pc71.cyan("verify")}, ${pc71.cyan("test")}, ${pc71.cyan("add")}, ${pc71.cyan("remove")}
-`
-              );
-              throw new Error(
-                `Unknown inbound command: ${inboundSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "inbound command",
+                inboundSubCommand,
+                "Available commands: init, destroy, status, verify, test, add, remove"
               );
           }
           break;
@@ -67290,16 +67586,10 @@ Available commands: ${pc71.cyan("init")}, ${pc71.cyan("destroy")}, ${pc71.cyan("
               });
               break;
             default:
-              clack66.log.error(
-                `Unknown agent command: ${agentSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("create")}, ${pc71.cyan("list")}, ${pc71.cyan("kill")}
-`
-              );
-              throw new Error(
-                `Unknown agent command: ${agentSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "agent command",
+                agentSubCommand,
+                "Available commands: create, list, kill"
               );
           }
           break;
@@ -67347,16 +67637,10 @@ Available commands: ${pc71.cyan("create")}, ${pc71.cyan("list")}, ${pc71.cyan("k
               break;
             }
             default:
-              clack66.log.error(
-                `Unknown reply command: ${replySubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("init")}, ${pc71.cyan("rotate")}, ${pc71.cyan("status")}, ${pc71.cyan("destroy")}, ${pc71.cyan("decode")}
-`
-              );
-              throw new Error(
-                `Unknown reply command: ${replySubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "reply command",
+                replySubCommand,
+                "Available commands: init, rotate, status, destroy, decode"
               );
           }
           break;
@@ -67377,39 +67661,30 @@ Available commands: ${pc71.cyan("init")}, ${pc71.cyan("rotate")}, ${pc71.cyan("s
               break;
             case "verify": {
               if (!flags.domain) {
-                clack66.log.error("--domain flag is required");
-                console.log(
-                  `
-Usage: ${pc71.cyan("wraps email domains verify --domain yourapp.com")}
-`
+                throw errors.missingInput(
+                  "--domain",
+                  "wraps email domains verify --domain yourapp.com"
                 );
-                throw new Error("Missing required flag: --domain");
               }
               await verifyDomain({ domain: flags.domain });
               break;
             }
             case "get-dkim": {
               if (!flags.domain) {
-                clack66.log.error("--domain flag is required");
-                console.log(
-                  `
-Usage: ${pc71.cyan("wraps email domains get-dkim --domain yourapp.com")}
-`
+                throw errors.missingInput(
+                  "--domain",
+                  "wraps email domains get-dkim --domain yourapp.com"
                 );
-                throw new Error("Missing required flag: --domain");
               }
               await getDkim({ domain: flags.domain });
               break;
             }
             case "remove": {
               if (!flags.domain) {
-                clack66.log.error("--domain flag is required");
-                console.log(
-                  `
-Usage: ${pc71.cyan("wraps email domains remove --domain yourapp.com --force")}
-`
+                throw errors.missingInput(
+                  "--domain",
+                  "wraps email domains remove --domain yourapp.com --force"
                 );
-                throw new Error("Missing required flag: --domain");
               }
               await removeDomain({
                 domain: flags.domain,
@@ -67436,16 +67711,10 @@ Usage: ${pc71.cyan("wraps email domains remove --domain yourapp.com --force")}
               break;
             }
             default:
-              clack66.log.error(
-                `Unknown domains command: ${domainsSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("add")}, ${pc71.cyan("list")}, ${pc71.cyan("verify")}, ${pc71.cyan("get-dkim")}, ${pc71.cyan("remove")}, ${pc71.cyan("config")}
-`
-              );
-              throw new Error(
-                `Unknown domains command: ${domainsSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "domains command",
+                domainsSubCommand,
+                "Available commands: add, list, verify, get-dkim, remove, config"
               );
           }
           break;
@@ -67483,16 +67752,10 @@ Available commands: ${pc71.cyan("add")}, ${pc71.cyan("list")}, ${pc71.cyan("veri
               });
               break;
             default:
-              clack66.log.error(
-                `Unknown templates command: ${templatesSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("init")}, ${pc71.cyan("push")}, ${pc71.cyan("preview")}
-`
-              );
-              throw new Error(
-                `Unknown templates command: ${templatesSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "templates command",
+                templatesSubCommand,
+                "Available commands: init, push, preview"
               );
           }
           break;
@@ -67527,16 +67790,10 @@ Available commands: ${pc71.cyan("init")}, ${pc71.cyan("push")}, ${pc71.cyan("pre
               });
               break;
             default:
-              clack66.log.error(
-                `Unknown workflows command: ${workflowsSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("init")}, ${pc71.cyan("validate")}, ${pc71.cyan("push")}
-`
-              );
-              throw new Error(
-                `Unknown workflows command: ${workflowsSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "workflows command",
+                workflowsSubCommand,
+                "Available commands: init, validate, push"
               );
           }
           break;
@@ -67557,8 +67814,10 @@ Available commands: ${pc71.cyan("init")}, ${pc71.cyan("validate")}, ${pc71.cyan(
             case "get": {
               const messageId = sub[3];
               if (!messageId) {
-                clack66.log.error("Usage: wraps email logs get <message-id>");
-                throw new Error("Missing required argument: <message-id>");
+                throw errors.missingInput(
+                  "<message-id>",
+                  "wraps email logs get <message-id>"
+                );
               }
               await emailLogsGet({
                 messageId,
@@ -67569,16 +67828,10 @@ Available commands: ${pc71.cyan("init")}, ${pc71.cyan("validate")}, ${pc71.cyan(
               break;
             }
             default:
-              clack66.log.error(
-                `Unknown logs command: ${logsSubCommand || "(none)"}`
-              );
-              console.log(
-                `
-Available commands: ${pc71.cyan("list")}, ${pc71.cyan("get <message-id>")}
-`
-              );
-              throw new Error(
-                `Unknown logs command: ${logsSubCommand || "(none)"}`
+              throw errors.unknownCommand(
+                "logs command",
+                logsSubCommand,
+                "Available commands: list, get <message-id>"
               );
           }
           break;
@@ -67599,13 +67852,11 @@ Available commands: ${pc71.cyan("list")}, ${pc71.cyan("get <message-id>")}
           });
           break;
         default:
-          clack66.log.error(`Unknown email command: ${subCommand}`);
-          console.log(
-            `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
+          throw errors.unknownCommand(
+            "email command",
+            subCommand,
+            "Run wraps --help for available commands."
           );
-          throw new Error(`Unknown email command: ${subCommand}`);
       }
       const emailDuration = Date.now() - startTime;
       const emailCommandName = `email:${subCommand}`;
@@ -67627,13 +67878,11 @@ Run ${pc71.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack66.log.error(`Unknown license command: ${subCommand}`);
-          console.log(
-            `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
+          throw errors.unknownCommand(
+            "license command",
+            subCommand,
+            "Run wraps --help for available commands."
           );
-          throw new Error(`Unknown license command: ${subCommand}`);
       }
       trackCommand(`license:${subCommand}`, {
         success: true,
@@ -67701,13 +67950,11 @@ Run ${pc71.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack66.log.error(`Unknown selfhost command: ${subCommand}`);
-          console.log(
-            `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
+          throw errors.unknownCommand(
+            "selfhost command",
+            subCommand,
+            "Run wraps --help for available commands."
           );
-          throw new Error(`Unknown selfhost command: ${subCommand}`);
       }
       const selfhostDuration = Date.now() - startTime;
       const selfhostCommandName = `selfhost:${subCommand}`;
@@ -67787,13 +68034,11 @@ Run ${pc71.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack66.log.error(`Unknown sms command: ${subCommand}`);
-          console.log(
-            `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
+          throw errors.unknownCommand(
+            "sms command",
+            subCommand,
+            "Run wraps --help for available commands."
           );
-          throw new Error(`Unknown sms command: ${subCommand}`);
       }
       const smsDuration = Date.now() - startTime;
       const smsCommandName = `sms:${subCommand}`;
@@ -67851,13 +68096,11 @@ Run ${pc71.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack66.log.error(`Unknown cdn command: ${subCommand}`);
-          console.log(
-            `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
+          throw errors.unknownCommand(
+            "cdn command",
+            subCommand,
+            "Run wraps --help for available commands."
           );
-          throw new Error(`Unknown cdn command: ${subCommand}`);
       }
       const cdnDuration = Date.now() - startTime;
       const cdnCommandName = `cdn:${subCommand}`;
@@ -67876,16 +68119,10 @@ Run ${pc71.cyan("wraps --help")} for available commands.
           });
           break;
         default:
-          clack66.log.error(
-            `Unknown workflow command: ${subCommand || "(none)"}`
-          );
-          console.log(`
-Available commands: ${pc71.cyan("init")}
-`);
-          console.log(`Run ${pc71.cyan("wraps --help")} for more information.
-`);
-          throw new Error(
-            `Unknown workflow command: ${subCommand || "(none)"}`
+          throw errors.unknownCommand(
+            "workflow command",
+            subCommand,
+            "Available commands: init\n\nRun wraps --help for more information."
           );
       }
       const workflowDuration = Date.now() - startTime;
@@ -67916,6 +68153,14 @@ Available commands: ${pc71.cyan("init")}
             json: flags.json
           });
           break;
+        case "disconnect":
+          await disconnect({
+            region: flags.region,
+            force: flags.force,
+            yes: flags.yes,
+            json: flags.json
+          });
+          break;
         case "update-role":
           await updateRole({
             region: flags.region,
@@ -67924,17 +68169,11 @@ Available commands: ${pc71.cyan("init")}
           });
           break;
         default:
-          clack66.log.error(`Unknown platform command: ${subCommand}`);
-          console.log(
-            `
-Available commands: ${pc71.cyan("connect")}, ${pc71.cyan("update-role")}
-`
+          throw errors.unknownCommand(
+            "platform command",
+            subCommand,
+            "Available commands: connect, disconnect, update-role\n\nRun wraps platform for more information."
           );
-          console.log(
-            `Run ${pc71.cyan("wraps platform")} for more information.
-`
-          );
-          throw new Error(`Unknown platform command: ${subCommand}`);
       }
       const platformDuration = Date.now() - startTime;
       const platformCommandName = `platform:${subCommand}`;
@@ -67956,13 +68195,11 @@ Available commands: ${pc71.cyan("connect")}, ${pc71.cyan("update-role")}
           await logout();
           break;
         default:
-          clack66.log.error(`Unknown auth command: ${subCommand || "(none)"}`);
-          console.log(
-            `
-Available commands: ${pc71.cyan("login")}, ${pc71.cyan("status")}, ${pc71.cyan("logout")}
-`
+          throw errors.unknownCommand(
+            "auth command",
+            subCommand,
+            "Available commands: login, status, logout"
           );
-          throw new Error(`Unknown auth command: ${subCommand || "(none)"}`);
       }
       return;
     }
@@ -67972,18 +68209,14 @@ Available commands: ${pc71.cyan("login")}, ${pc71.cyan("status")}, ${pc71.cyan("
           await setup({});
           break;
         case "doctor":
-          await doctor();
+          await doctor({ region: flags.region, json: flags.json });
           break;
         default:
-          clack66.log.error(`Unknown aws command: ${subCommand}`);
-          console.log(
-            `
-Available commands: ${pc71.cyan("setup")}, ${pc71.cyan("doctor")}
-`
+          throw errors.unknownCommand(
+            "aws command",
+            subCommand,
+            "Available commands: setup, doctor\n\nRun wraps --help for more information."
           );
-          console.log(`Run ${pc71.cyan("wraps --help")} for more information.
-`);
-          throw new Error(`Unknown aws command: ${subCommand}`);
       }
       const awsDuration = Date.now() - startTime;
       const awsCommandName = `aws:${subCommand}`;
@@ -68068,13 +68301,11 @@ Available commands: ${pc71.cyan("setup")}, ${pc71.cyan("doctor")}
             await telemetryStatus();
             break;
           default:
-            clack66.log.error(`Unknown telemetry command: ${subCommand}`);
-            console.log(
-              `
-Available commands: ${pc71.cyan("enable")}, ${pc71.cyan("disable")}, ${pc71.cyan("status")}
-`
+            throw errors.unknownCommand(
+              "telemetry command",
+              subCommand,
+              "Available commands: enable, disable, status"
             );
-            throw new Error(`Unknown telemetry command: ${subCommand}`);
         }
         break;
       }
@@ -68095,29 +68326,22 @@ Please specify a command for ${primaryCommand} service.
         showHelp();
         break;
       default: {
-        clack66.log.error(`Unknown command: ${primaryCommand}`);
-        const suggestion = suggestCommand(primaryCommand);
-        if (suggestion) {
-          console.log(`
-Did you mean ${pc71.cyan(`wraps ${suggestion}`)}?`);
-        }
-        console.log(
-          `
-Run ${pc71.cyan("wraps --help")} for available commands.
-`
-        );
-        throw new Error(`Unknown command: ${primaryCommand}`);
+        const didYouMean = suggestCommand(primaryCommand);
+        const hint = didYouMean ? `Did you mean: wraps ${didYouMean}
+
+Run wraps --help for available commands.` : "Run wraps --help for available commands.";
+        throw errors.unknownCommand("command", primaryCommand, hint);
       }
     }
     const duration = Date.now() - startTime;
-    const commandName = subCommand ? `${primaryCommand}:${subCommand}` : primaryCommand;
+    const commandName = telemetryCommandName(primaryCommand, subCommand);
     trackCommand(commandName, {
       success: true,
       duration_ms: duration
     });
   } catch (error) {
     const duration = Date.now() - startTime;
-    const commandName = subCommand ? `${primaryCommand}:${subCommand}` : primaryCommand;
+    const commandName = telemetryCommandName(primaryCommand, subCommand);
     trackCommand(commandName, {
       success: false,
       duration_ms: duration
@@ -68125,6 +68349,9 @@ Run ${pc71.cyan("wraps --help")} for available commands.
     handleCLIError(error, commandName);
   } finally {
     await telemetry.shutdown();
+    if (process.exitCode) {
+      process.exit(process.exitCode);
+    }
   }
 }
 if (primaryCommand) {