@everystack/cli 0.4.59 → 0.4.61

package/src/cli/commands/db-apply.ts

@@ -30,33 +30,33 @@
  */
 
 import fs from 'node:fs/promises';
-import { type QueryRunner } from '../authz-contract.js';
-import { currentGitRef } from '../state-apply.js';
-import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
-import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent.js';
-import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
-import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute.js';
-import { estimateOpsRuntimeFit } from '../ops-fit.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { type QueryRunner } from '../authz-contract';
+import { currentGitRef } from '../state-apply';
+import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan';
+import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent';
+import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute';
+import { estimateOpsRuntimeFit } from '../ops-fit';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency';
+import { step, success, fail, info, warn } from '../output';
 
 // The apply core lives in apply-execute.ts (shared with the ops Lambda's
 // db:apply action). Re-exported so the existing integration suites — and any
 // other in-repo caller — keep importing it from this command module.
-export { executeApplyPlan } from '../apply-execute.js';
-export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute.js';
+export { executeApplyPlan } from '../apply-execute';
+export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute';
 
 // ---------------------------------------------------------------------------
 // The CLI shell.
@@ -210,7 +210,7 @@ async function applyPlanViaStage(
         process.exit(1);
       }
       step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       const approvers = await readApproverParam(region, appName, flags.stage);
       const identity = approvers === null ? null : await resolveCallerIdentity(region);
@@ -368,7 +368,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     }
     if (flags.stage) {
       const config = await resolveConfig(flags.stage);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       verifyAuthority = async () => {
         step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);

package/src/cli/commands/db-approvers.ts

@@ -14,15 +14,15 @@
  * path segments (`ty` matches `user/ty` and an assumed-role session `ty`).
  */
 
-import { resolveConfig } from '../config.js';
+import { resolveConfig } from '../config';
 import {
   approverParamName,
   parseApproverValue,
   readApproverParam,
   writeApproverParam,
   removeApproverParam,
-} from '../apply-authority.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../apply-authority';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbApproversCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
@@ -32,7 +32,7 @@ export async function dbApproversCommand(flags: Record<string, string>): Promise
 
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const paramName = approverParamName(appName, flags.stage);
 

package/src/cli/commands/db-authz.ts

@@ -31,7 +31,7 @@ import {
   diffContracts,
   type QueryRunner,
   type AuthzContract,
-} from '../authz-contract.js';
+} from '../authz-contract';
 import {
   buildProbeSql,
   PROBE_SELECT_SQL,
@@ -42,26 +42,26 @@ import {
   toGrantGap,
   buildInheritedPrivilegeSql,
   toInheritedGrant,
-} from '../authz-redteam.js';
+} from '../authz-redteam';
 import {
   buildOwnerProbeSql,
   OWNER_PROBE_SELECT_SQL,
   toOwnerProbeResult,
   evaluateOwnerProbe,
   type OwnerProbe,
-} from '../authz-owner-probe.js';
-import { modelOwner } from '../authz-compile.js';
-import { writeContract, loadContract } from '../authz-contract-io.js';
-import { renderContractMarkdown } from '../authz-render.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
-import { loadModels } from './db-generate.js';
+} from '../authz-owner-probe';
+import { modelOwner } from '../authz-compile';
+import { writeContract, loadContract } from '../authz-contract-io';
+import { renderContractMarkdown } from '../authz-render';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
+import { loadModels } from './db-generate';
 
 const DEFAULT_DIR = 'authz';
 

package/src/cli/commands/db-backfill.ts

@@ -18,22 +18,22 @@
  * reads and writes its own per-database record.
  */
 
-import type { QueryRunner } from '../authz-contract.js';
+import type { QueryRunner } from '../authz-contract';
 import {
   planBackfills,
   readBackfillLog,
   executeBackfills,
   markBackfillApplied,
   type BackfillPlan,
-} from '../backfill.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { readSqlDirIfPresent } from './db-sync.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backfill';
+import { currentGitRef } from '../state-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { readSqlDirIfPresent } from './db-sync';
+import { step, success, fail, info, warn } from '../output';
 
 const DEFAULT_DIR = 'db/backfills';
 

package/src/cli/commands/db-backup.ts

@@ -19,15 +19,16 @@ import { spawn } from 'node:child_process';
 import { createGzip } from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { randomBytes } from 'node:crypto';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet, getS3 } from '../aws.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet, getS3 } from '../aws';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
 import {
   parseBackupRef, keyForId, crossStageGuard, restoreTargetGuard,
   backupKey, backupId, metaKey, utcStamp,
-} from '../backup.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backup';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info, warn } from '../output';
 
 /** Which database db:backup dumps. LOCAL requires a target --stage (its bucket receives the upload
  *  AND names the backup id). Note this DIVERGES from db:export, where --database-url and --stage are
@@ -226,39 +227,27 @@ export async function dbBackupCommand(flags: Record<string, string>): Promise<vo
   info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
   const fn = opsFunction(config);
 
-  step('Dispatching the backup task (credential-free, via the ops Lambda)...');
-  let dispatched: any;
-  try {
-    dispatched = await invokeAction(config.region, fn, 'db:backup', { stage: flags.stage, actor: process.env.USER ?? null });
-  } catch (err: any) {
-    fail(`Backup failed to dispatch: ${err.message}`);
-    process.exit(1);
-  }
-  if (dispatched?.error) {
-    fail(`Backup failed: ${dispatched.error}`);
-    process.exit(1);
-  }
-  const { runId, taskArn, id, warning } = dispatched as { runId: string; taskArn: string; id: string; warning?: string };
-  info(`backup ${id} — task ${taskArn}`);
-  info(`run id: ${runId} (everystack.task_log)`);
-  if (warning) info(`note: ${warning}`);
+  const result = await runStageBackup(stageBackupDeps(config, fn, flags.stage, {
+    onDispatch: (d) => {
+      info(`backup ${d.id} — task ${d.taskArn}`);
+      info(`run id: ${d.runId} (everystack.task_log)`);
+      // The dispatch warning is folded into result.warning and printed at the end, so printing it
+      // here too says the same thing twice.
+    },
+  }));
 
-  step('Running pg_dump → S3 (this may take a while for large databases)...');
-  const poll = await pollTaskUntilStopped(config.region, fn, { runId, taskArn });
-  if (poll.outcome === 'timeout') {
-    fail(`db:backup timed out (last status: ${poll.lastStatus}). Run id ${runId} — reconcile via ECS/everystack.task_log.`);
-    process.exit(1);
-  }
-  if (poll.outcome === 'error') {
-    fail(`task:status failed repeatedly: ${poll.status.error}. The backup may still be running — reconcile run id ${runId}.`);
-    process.exit(1);
-  }
-  if (poll.status.exitCode !== 0) {
-    fail(`Backup failed (exit ${poll.status.exitCode ?? 'unknown'})${poll.status.stoppedReason ? ` — ${poll.status.stoppedReason}` : ''}. Read the task logs (CloudWatch).`);
+  if (!result.ok) {
+    fail(`Backup failed: ${result.reason}`);
+    if (result.orphanKey) {
+      info(`The artifact is still in the bucket: s3://${config.backupsBucket ?? '<backups-bucket>'}/${result.orphanKey}`);
+    }
     process.exit(1);
   }
-  const bytes = (poll.status.result?.bytes as number | undefined) ?? undefined;
-  success(`Backup ${id} (${fmtBytes(bytes)}). Restore with: everystack db:restore --from ${id} --confirm`);
+
+  // Render it. The helper produced this and nothing printed it, so the one signal that an artifact
+  // was not verified against what the operator sent was invisible at the only moment it mattered.
+  if (result.warning) warn(result.warning);
+  success(`Backup ${result.id} (${fmtBytes(result.bytes)}). Restore with: everystack db:restore --from ${result.id} --confirm`);
 }
 
 /** db:backups — list a stage's logical backups. */

package/src/cli/commands/db-branch.ts

@@ -34,14 +34,14 @@ import {
   templateName,
   currentBranch,
   localBranches,
-} from '../branch-db.js';
-import { currentGitRef } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveDbSource, type DbSource } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../branch-db';
+import { currentGitRef } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveDbSource, type DbSource } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 function requireUrl(flags: Record<string, string>, verb: string): string {
   let dbSource: DbSource;

package/src/cli/commands/db-build.ts

@@ -25,13 +25,13 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { buildIntoDatabase } from '../db-build.js';
-import { createUrlRunner } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, info, success, fail, warn } from '../output.js';
+import { buildIntoDatabase } from '../db-build';
+import { createUrlRunner } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { currentGitRef } from '../state-apply';
+import { step, info, success, fail, warn } from '../output';
 
 /** Tables already in the target, outside the schemas PostgreSQL owns. */
 const OCCUPANCY_SQL = `

package/src/cli/commands/db-check.ts

@@ -31,29 +31,29 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor, DerivedDescriptor } from '@everystack/model';
-import { compileDeclaredState } from '../declared-diff.js';
-import { compileMigration } from '../migration-compile.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { currentGitRef } from '../state-apply.js';
-import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate.js';
-import { resolveSchemaOut } from '../migration-generate.js';
-import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
+import { compileDeclaredState } from '../declared-diff';
+import { compileMigration } from '../migration-compile';
+import { compileDrizzleSource } from '../schema-source';
+import { currentGitRef } from '../state-apply';
+import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build';
+import { resolveModelsPath } from '../models-path';
+import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate';
+import { resolveSchemaOut } from '../migration-generate';
+import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
-import type { SourceObject } from '../derived-source.js';
-import { findReadAuthzGaps, findNakedGrants } from '../authz-lint.js';
-import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
+import type { SourceObject } from '../derived-source';
+import { findReadAuthzGaps, findNakedGrants } from '../authz-lint';
+import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline';
 import {
   findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
   findUnpinnedDefiners,
-} from '../derived-lint.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../derived-lint';
+import { step, success, fail, info, warn } from '../output';
 
 // The role derivation moved to the shared builder (db-build) with brick
 // 5-remainder; re-exported here because db:check is where it grew up.
-export { rolesFromContract } from '../db-build.js';
+export { rolesFromContract } from '../db-build';
 
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 

package/src/cli/commands/db-diff.ts

@@ -24,12 +24,12 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { diffDeclaredStates } from '../declared-diff.js';
-import { classifyGeneratedStatements } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { diffDeclaredStates } from '../declared-diff';
+import { classifyGeneratedStatements } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbDiffCommand(flags: Record<string, string>): Promise<void> {
   const fromPath = flags['from-models'];

package/src/cli/commands/db-exec.ts

@@ -16,14 +16,14 @@
  */
 
 import fs from 'node:fs/promises';
-import { resolveDbSource, sslDefaults } from '../db-source.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { isProductionTier } from '../backup.js';
-import { executeExec, assertNoTxnControl } from '../exec-execute.js';
-import { runExecInTx } from '../exec-run.js';
-import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveDbSource, sslDefaults } from '../db-source';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { isProductionTier } from '../backup';
+import { executeExec, assertNoTxnControl } from '../exec-execute';
+import { runExecInTx } from '../exec-run';
+import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log';
+import { step, success, fail, info } from '../output';
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];

package/src/cli/commands/db-export.ts

@@ -20,16 +20,16 @@ import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { utcStamp } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction } from '../aws';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { utcStamp } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info } from '../output';
 
 const fmtBytes = (b?: number): string =>
   b == null ? '?' : b >= 1024 ** 3 ? `${(b / 1024 ** 3).toFixed(1)} GB` : b >= 1024 ** 2 ? `${(b / 1024 ** 2).toFixed(1)} MB` : `${(b / 1024).toFixed(0)} KB`;

package/src/cli/commands/db-fingerprint.ts

@@ -14,10 +14,10 @@
 
 import { existsSync } from 'node:fs';
 import type { ModelDescriptor } from '@everystack/model';
-import type { QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { introspectContract } from '../authz-contract.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
+import type { QueryRunner } from '../authz-contract';
+import { introspectSchema } from '../schema-introspect';
+import { introspectContract } from '../authz-contract';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import {
   fingerprintLive,
   fingerprintModels,
@@ -25,16 +25,16 @@ import {
   mapUnfingerprintedRows,
   UNFINGERPRINTED_SQL,
   type UnfingerprintedObject,
-} from '../schema-fingerprint.js';
-import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
+} from '../schema-fingerprint';
+import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
 
 export interface FingerprintStatus {

package/src/cli/commands/db-fork.ts

@@ -19,11 +19,12 @@
  * data-governance warning. Teardown is the stage's own: `sst remove`.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet } from '../aws.js';
-import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet } from '../aws';
+import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
+import { step, success, fail, info, warn } from '../output';
 
 export type ForkGuardVerdict =
   | { ok: true; piiWarning: string | null }
@@ -94,18 +95,17 @@ export async function dbForkCommand(flags: Record<string, string>): Promise<void
     info(`Reusing backup ${backupId}.`);
   } else {
     step(`Backing up ${from} (pg_dump → S3 in the Task; may take a while for large databases)...`);
-    const dispatched: any = await invokeAction(source.region, opsFunction(source), 'db:backup', { stage: from, actor: process.env.USER ?? null });
-    if (dispatched?.error) {
-      fail(`Source backup failed: ${dispatched.error}`);
-      process.exit(1);
-    }
-    backupId = dispatched.id;
-    const poll = await pollTaskUntilStopped(source.region, opsFunction(source), { runId: dispatched.runId, taskArn: dispatched.taskArn });
-    if (poll.outcome !== 'stopped' || poll.status.exitCode !== 0) {
-      const why = poll.outcome === 'stopped' ? `exit ${poll.status.exitCode}${poll.status.stoppedReason ? ` — ${poll.status.stoppedReason}` : ''}` : poll.outcome;
-      fail(`Source backup failed (${why}). Reconcile run ${dispatched.runId}.`);
+    // The shared sandwich: a fork built from a dump that spans a migration copies a schema that
+    // never existed. Same helper db:backup and db:swap use, so all three agree on what a proven
+    // artifact is.
+    const backup = await runStageBackup(stageBackupDeps(source, opsFunction(source), from, { onStep: step }));
+    if (!backup.ok) {
+      fail(`Source backup failed: ${backup.reason} The fork was NOT created.`);
+      if (backup.orphanKey) info(`The artifact is still in the bucket: s3://${source.backupsBucket}/${backup.orphanKey}`);
       process.exit(1);
     }
+    backupId = backup.id;
+    if (backup.warning) warn(backup.warning);
     info(`Backup ${backupId}.`);
   }
 

package/src/cli/commands/db-generate.ts

@@ -23,25 +23,25 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { ModelDescriptor, Module } from '@everystack/model';
-import { introspectSchema } from '../schema-introspect.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { compileModuleMigration } from '../migration-compile.js';
-import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate.js';
-import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile.js';
-import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived.js';
-import { asModelComposeError, opsAdviceLines } from '../ops-advice.js';
-import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { introspectSchema } from '../schema-introspect';
+import { compileDrizzleSource } from '../schema-source';
+import { compileModuleMigration } from '../migration-compile';
+import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile';
+import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived';
+import { asModelComposeError, opsAdviceLines } from '../ops-advice';
+import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 export const DEFAULT_MIGRATIONS = 'drizzle';
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';