@everystack/cli 0.4.59 → 0.4.61

package/src/cli/commands/db-plan.ts

@@ -43,31 +43,31 @@
 import fs from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
-import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } from '../authz-ownership.js';
-import { introspectSchema, type SchemaSnapshot } from '../schema-introspect.js';
-import { readStageStateTwice } from '../stage-read-consistency.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { mintEdgePlan, planHash, buildPlanSummary } from '../edge-plan.js';
-import { verifyDescent } from '../git-descent.js';
-import { planBackfills, readBackfillLog } from '../backfill.js';
-import { readSqlDirIfPresent } from './db-sync.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
-import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
-import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents.js';
-import { compileTableContract } from '../authz-compile.js';
-import { reportPipelineLastRun } from './pipeline-run.js';
-import { step, success, fail, info, warn, reserveStdoutForData } from '../output.js';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract';
+import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } from '../authz-ownership';
+import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
+import { readStageStateTwice } from '../stage-read-consistency';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { mintEdgePlan, planHash, buildPlanSummary } from '../edge-plan';
+import { verifyDescent } from '../git-descent';
+import { planBackfills, readBackfillLog } from '../backfill';
+import { readSqlDirIfPresent } from './db-sync';
+import { currentGitRef } from '../state-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveModelsPath } from '../models-path';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
+import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents';
+import { compileTableContract } from '../authz-compile';
+import { reportPipelineLastRun } from './pipeline-run';
+import { step, success, fail, info, warn, reserveStdoutForData } from '../output';
 
 const DEFAULT_OUT = 'db.plan.json';
 

package/src/cli/commands/db-pull.ts

@@ -33,24 +33,24 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { introspectSchema, MATVIEW_COLUMNS_SQL, matviewColumnsByIdentity, type ColumnRow, type ColumnSchema } from '../schema-introspect.js';
-import { fingerprintLive } from '../schema-fingerprint.js';
-import { ungovernedGrants, vestigialSequenceGrants, renderVestigialSequenceGrants, ALWAYS_GOVERNED, type GrantExemption } from '../authz-reconcile.js';
-import { buildStageBaseline, mergeBaseline, readBaselineFile, writeBaselineFile, BASELINE_FILE } from '../authz-baseline.js';
-import { introspectDerived, type DerivedCatalog } from '../derived-introspect.js';
-import { introspectContract, type TableContract, type AuthzContract } from '../authz-contract.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { renderDerivedSource, renderDerivedFile, type DerivedRenderResult } from '../derived-render.js';
-import { renderModelSource, renderModelFiles, pullableTables, skippedInfrastructureTables, modelVarName, ABILITY_PRESETS } from '../model-render.js';
-import { deriveAbilities } from '../authz-derive.js';
-import type { QueryRunner } from '../authz-contract.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { fail } from '../output.js';
-import { opsAdviceLines } from '../ops-advice.js';
+import { introspectSchema, MATVIEW_COLUMNS_SQL, matviewColumnsByIdentity, type ColumnRow, type ColumnSchema } from '../schema-introspect';
+import { fingerprintLive } from '../schema-fingerprint';
+import { ungovernedGrants, vestigialSequenceGrants, renderVestigialSequenceGrants, ALWAYS_GOVERNED, type GrantExemption } from '../authz-reconcile';
+import { buildStageBaseline, mergeBaseline, readBaselineFile, writeBaselineFile, BASELINE_FILE } from '../authz-baseline';
+import { introspectDerived, type DerivedCatalog } from '../derived-introspect';
+import { introspectContract, type TableContract, type AuthzContract } from '../authz-contract';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { renderDerivedSource, renderDerivedFile, type DerivedRenderResult } from '../derived-render';
+import { renderModelSource, renderModelFiles, pullableTables, skippedInfrastructureTables, modelVarName, ABILITY_PRESETS } from '../model-render';
+import { deriveAbilities } from '../authz-derive';
+import type { QueryRunner } from '../authz-contract';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { fail } from '../output';
+import { opsAdviceLines } from '../ops-advice';
 
 // Progress → stderr, so stdout carries only the rendered source (this command is codegen,
 // not a report — the shared output helpers write to stdout, which would corrupt a redirect).

package/src/cli/commands/db-reconcile.ts

@@ -29,10 +29,10 @@
  * runs it direct. A stage DRY-RUN (no `--apply`) reads through the `db:query` path.
  */
 
-import type { QueryRunner } from '../authz-contract.js';
-import type { SourceObject } from '../derived-source.js';
-import { introspectDerived } from '../derived-introspect.js';
-import { planReconcile, type ReconcilePlan, type ReconcileOptions } from '../derived-plan.js';
+import type { QueryRunner } from '../authz-contract';
+import type { SourceObject } from '../derived-source';
+import { introspectDerived } from '../derived-introspect';
+import { planReconcile, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
   renderProvenanceUpsert,
@@ -49,16 +49,16 @@ import {
   builderOwnerMode,
   type OwnerApplyMode,
   ENSURE_RECONCILER_SQL,
-} from '../derived-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../derived-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { currentGitRef } from '../state-apply';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 // ---------------------------------------------------------------------------
 // The testable core.

package/src/cli/commands/db-refresh.ts

@@ -23,13 +23,13 @@
  * they did not choose.
  */
 
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { executeRefresh, matviewIdentities, type RefreshRun } from '../refresh-execute.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { loadDeclaredDerived } from '../declared-derived';
+import { executeRefresh, matviewIdentities, type RefreshRun } from '../refresh-execute';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { invokeAction } from '../aws';
+import { step, success, fail, info } from '../output';
 
 export async function dbRefreshCommand(flags: Record<string, string>): Promise<void> {
   // The declared matviews, in dependency order (a dependent matview reads its parents' fresh rows).

package/src/cli/commands/db-snapshot.ts

@@ -7,11 +7,11 @@
  * docs/plans/db-backup-restore.md.
  */
 
-import { resolveConfig, type CliConfig } from '../config.js';
-import { createRdsSnapshot, describeRdsSnapshots, type RdsSnapshotSummary } from '../aws.js';
-import { utcStamp } from '../backup.js';
-import { rdsSnapshotIdentifier } from '../rds-snapshot.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, type CliConfig } from '../config';
+import { createRdsSnapshot, describeRdsSnapshots, type RdsSnapshotSummary } from '../aws';
+import { utcStamp } from '../backup';
+import { rdsSnapshotIdentifier } from '../rds-snapshot';
+import { step, success, fail, info } from '../output';
 
 /**
  * Resolve the RDS DB instance identifier: explicit `--instance` wins, else the deployed

package/src/cli/commands/db-swap.ts

@@ -22,31 +22,32 @@ import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
 import type { ModelDescriptor } from '@everystack/model';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import type { SourceObject } from '../derived-source.js';
-import { pairedDerivedSchemas, renderPairedDerivedBuild, renderSwapSchemaUsage, swapSchemaRoles, expectedIncomingObjects, renderPairedProvenance } from '../swap-pair.js';
-import { introspectDerived } from '../derived-introspect.js';
-import { legacyFunctionIdentity } from '../pg-argtypes.js';
-import { createUrlRunner } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import type { QueryRunner } from '../authz-contract.js';
-import { executeSwap, type SwapVerdict } from '../swap-execute.js';
-import { startHeartbeat, humanElapsed } from '../swap-heartbeat.js';
-import { formatBytes } from '../bundle-weight.js';
-import { rewriteStatementLine, opensCopyData, closesCopyData } from '../schema-rewrite.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet, createRdsSnapshot, describeRdsSnapshots } from '../aws.js';
-import { keyForArtifactId, metaKey, utcStamp } from '../backup.js';
-import { rdsSnapshotIdentifier } from '../rds-snapshot.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { decideSnapshotMode, confirmPhysicalSnapshot, interpretBackupPoll, type SnapshotModeRequest } from '../swap-snapshot.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { step, success, fail, warn, info } from '../output.js';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import type { SourceObject } from '../derived-source';
+import { pairedDerivedSchemas, renderPairedDerivedBuild, renderSwapSchemaUsage, swapSchemaRoles, expectedIncomingObjects, renderPairedProvenance } from '../swap-pair';
+import { introspectDerived } from '../derived-introspect';
+import { legacyFunctionIdentity } from '../pg-argtypes';
+import { createUrlRunner } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import type { QueryRunner } from '../authz-contract';
+import { executeSwap, type SwapVerdict } from '../swap-execute';
+import { startHeartbeat, humanElapsed } from '../swap-heartbeat';
+import { formatBytes } from '../bundle-weight';
+import { rewriteStatementLine, opensCopyData, closesCopyData } from '../schema-rewrite';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet, createRdsSnapshot, describeRdsSnapshots } from '../aws';
+import { keyForArtifactId, metaKey, utcStamp } from '../backup';
+import { rdsSnapshotIdentifier } from '../rds-snapshot';
+import { pollTaskUntilStopped } from '../task-poll';
+import { decideSnapshotMode, confirmPhysicalSnapshot, interpretBackupPoll, type SnapshotModeRequest } from '../swap-snapshot';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { step, success, fail, warn, info } from '../output';
 
 /** A COPY-aware line transform that rewrites the schema token on statement lines only. */
 function schemaRewriteStream(from: string, to: string): Transform {
@@ -475,19 +476,30 @@ async function takePreSwapSnapshot(
   // Logical: dispatch the Task and WAIT. The dispatch returning is not the backup existing — that
   // conflation is what let a pg_dump run concurrently with the restore it was supposed to precede.
   step('Snapshotting the stage before the swap (db:backup — waiting for the dump to finish)...');
-  const dispatched: any = await invokeAction(ctx.region!, ctx.opsFn!, 'db:backup', {
-    stage: ctx.stage,
-    actor: process.env.USER ?? null,
+  // The shared sandwich. A rollback point taken across a concurrent migration holds a schema that
+  // matches neither endpoint — restoring from it would not return the stage to where it was, which
+  // is the one thing a pre-swap snapshot has to guarantee. An unproven artifact fails the swap.
+  const backup = await runStageBackup({
+    ...stageBackupDeps({ region: ctx.region! }, ctx.opsFn!, ctx.stage, {
+      onStep: step,
+      onDispatch: (d: { id: string; runId: string }) => info(`backup ${d.id} dispatched (run ${d.runId}) — waiting for the task to stop before the restore starts.`),
+    }),
+    // Swap keeps its OWN reading of a finished poll: it is the only caller that can tell the
+    // operator to re-run with `--snapshot-ref <id>` once the dump lands, and each outcome needs
+    // different advice. The shared helper takes injected deps for exactly this.
+    awaitTask: async (ids) => {
+      const poll = await pollTaskUntilStopped(ctx.region!, ctx.opsFn!, { runId: ids.runId, taskArn: ids.taskArn });
+      const verdict = interpretBackupPoll(poll, { runId: ids.runId, id: ids.id });
+      if (!verdict.ok) return verdict;
+      // Carry the stamp through, or this caller silently opts out of the image-skew check.
+      return { ok: true, stampedFingerprint: (poll as any).status?.result?.fingerprint as string | undefined };
+    },
   });
-  if (dispatched?.error) throw new Error(`the pre-swap backup would not dispatch, so the swap was NOT applied: ${dispatched.error}`);
-  const { runId, taskArn, id } = dispatched as { runId: string; taskArn: string; id: string };
-  info(`backup ${id} dispatched (run ${runId}) — waiting for the task to stop before the restore starts.`);
-  const verdict = interpretBackupPoll(
-    await pollTaskUntilStopped(ctx.region!, ctx.opsFn!, { runId, taskArn }),
-    { runId, id },
-  );
-  if (!verdict.ok) throw new Error(verdict.reason);
-  info(`rollback point CONFIRMED: backup ${id} complete — restore with db:restore --from ${id} --confirm.`);
+  if (!backup.ok) {
+    throw new Error(`the pre-swap backup is not a usable rollback point, so the swap was NOT applied and live is untouched: ${backup.reason}`);
+  }
+  if (backup.warning) warn(backup.warning);
+  info(`rollback point CONFIRMED: backup ${backup.id} complete — restore with db:restore --from ${backup.id} --confirm.`);
 }
 
 export async function dbSwapCommand(flags: Record<string, string>): Promise<void> {

package/src/cli/commands/db-sync.ts

@@ -30,12 +30,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
-import { introspectContract, type QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { generateMigrationSql, unmodeledTables } from '../migration-generate.js';
+import { introspectContract, type QueryRunner } from '../authz-contract';
+import { introspectSchema } from '../schema-introspect';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { generateMigrationSql, unmodeledTables } from '../migration-generate';
 import type { SequenceDescriptor } from '@everystack/model';
-import type { SourceObject } from '../derived-source.js';
+import type { SourceObject } from '../derived-source';
 import {
   applyStateAndVerify,
   classifyGeneratedStatements,
@@ -43,19 +43,19 @@ import {
   currentGitRef,
   type ClassifiedStatements,
   type StateSyncOutcome,
-} from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import type { SourceFile } from '../derived-source.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { planBackfills, readBackfillLog } from '../backfill.js';
-import { resolveModelsPath } from '../models-path.js';
-import { executeReconcile, buildReconcileReport, type ReconcileRun } from './db-reconcile.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { reportPipelineLastRun } from './pipeline-run.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { compileDrizzleSource } from '../schema-source';
+import type { SourceFile } from '../derived-source';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { planBackfills, readBackfillLog } from '../backfill';
+import { resolveModelsPath } from '../models-path';
+import { executeReconcile, buildReconcileReport, type ReconcileRun } from './db-reconcile';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { reportPipelineLastRun } from './pipeline-run';
+import { step, success, fail, info, warn } from '../output';
 
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 

package/src/cli/commands/db.ts

@@ -5,10 +5,10 @@
  * No HTTP endpoints, no shared secrets — IAM is the authorization layer.
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
 
 /** Secret-store keys that may hold the privileged (operator) connection URL,
  *  in precedence order. Names vary by deployment; --secret-name overrides. */
@@ -488,8 +488,8 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
 
   // Load the stage secrets once — the direct venue reads the privileged URL from here (never
   // from argv), and the writer below reuses them.
-  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   const secretsCtx = { appName: await parseAppName(), stage: flags.stage, region: config.region };
   let stageSecrets: Record<string, string> = {};
   try {
@@ -527,12 +527,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // all-public app sets no path (unchanged behavior).
   let declaredSchemas: string[] = [];
   try {
-    const { resolveModelsPath } = await import('../models-path.js');
-    const { loadModels } = await import('./db-generate.js');
+    const { resolveModelsPath } = await import('../models-path');
+    const { loadModels } = await import('./db-generate');
     const models = await loadModels(resolveModelsPath(flags.models));
     let derivedObjects: Array<{ schema: string }> = [];
     try {
-      const { loadDeclaredDerived } = await import('../declared-derived.js');
+      const { loadDeclaredDerived } = await import('../declared-derived');
       const declared = await loadDeclaredDerived(flags.models);
       if (declared) derivedObjects = declared.objects;
     } catch {
@@ -555,7 +555,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // and the auto-fallback below.
   const provisionDirect = async (url: string): Promise<any> => {
     const { runProvision } = await loadServerProvision();
-    const { createUrlRunner } = await import('../db-source.js');
+    const { createUrlRunner } = await import('../db-source');
     const { runner, end } = await createUrlRunner(url);
     try {
       return await runProvision({ authPassword, adminPassword, searchPath }, {
@@ -746,7 +746,7 @@ function printDoctorReport(report: any): void {
  */
 async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: string): Promise<boolean> {
   const { runDoctorProbe } = await loadServerDoctor();
-  const { createUrlRunner } = await import('../db-source.js');
+  const { createUrlRunner } = await import('../db-source');
   step('Probing database connections (api + operator)...');
   const apiConn = await createUrlRunner(apiUrl);
   const opsConn = await createUrlRunner(adminUrl);
@@ -797,8 +797,8 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
 
   // Load the stage secrets once — the direct venue (--direct, and the no-Ops auto-fallback)
   // reads DATABASE_URL + ADMIN_DATABASE_URL from here, never from argv.
-  const { loadSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   let stageSecrets: Record<string, string> = {};
   try {
     stageSecrets = await loadSstSecrets({ appName: await parseAppName(), stage: flags.stage, region: config.region });
@@ -957,8 +957,8 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
   step('Resolving the admin connection from the secret store...');
   let secrets: Record<string, string>;
   try {
-    const { loadSstSecrets } = await import('../utils/secrets.js');
-    const { parseAppName } = await import('../discover.js');
+    const { loadSstSecrets } = await import('../utils/secrets');
+    const { parseAppName } = await import('../discover');
     const appName = await parseAppName();
     secrets = await loadSstSecrets({ appName, stage: flags.stage, region: config.region });
   } catch (err: any) {

package/src/cli/commands/deploy.ts

@@ -11,10 +11,11 @@
  */
 
 import { spawn } from 'node:child_process';
-import { step, success, fail, info, warn } from '../output.js';
-import { invalidateCachedConfig } from '../discover.js';
-import { resolveConfig } from '../config.js';
-import { probeDeployedFunctions } from '../deploy-probe.js';
+import { step, success, fail, info, warn } from '../output';
+import { invalidateCachedConfig } from '../discover';
+import { resolveConfig } from '../config';
+import { probeDeployedFunctions } from '../deploy-probe';
+import { getDistributionStatus } from '../aws';
 
 /** The `sst` argv `everystack deploy` runs. Pure, so the mapping is unit-tested. */
 export function buildDeployArgs(flags: Record<string, string>): string[] {
@@ -68,8 +69,9 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
   // `sst deploy` exiting 0 only proves the code UPLOADED — a bundle that crashes at INIT still
   // deploys "green" and takes the whole ops plane down until the next verb trips over it. Probe
   // the deployed functions now so the operator learns here, with the real cause attached.
+  let config: Awaited<ReturnType<typeof resolveConfig>> | undefined;
   try {
-    const config = await resolveConfig(stage);
+    config = await resolveConfig(stage);
     const { fatal } = await probeDeployedFunctions(stage, config);
     if (fatal) {
       fail('Deploy landed, but a deployed function cannot serve — every --stage verb will fail until this is fixed and redeployed.');
@@ -81,8 +83,40 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
     info(`Skipped the post-deploy probe: ${err?.message ?? err}`);
   }
 
+  // Wait for CloudFront distribution to finish propagating.
+  if (config?.distributionId) {
+    step('Waiting for CloudFront distribution...');
+    const deployed = await waitForDistribution(config.region, config.distributionId);
+    if (deployed) {
+      success('Distribution deployed.');
+    } else {
+      warn('Distribution did not reach Deployed within timeout. It may still be propagating.');
+    }
+  }
+
   // The 0.4 flow: schema changes ride db:plan → db:apply. Migration-based apps still have
   // db:migrate, but the copy-paste hint must advertise the canonical path — this exact
   // line got copied into consumer runbooks with the retired verb.
   info('Next: schema changes via `everystack db:plan --stage ' + stage + '` → `db:apply`; `everystack update` to publish the app bundle.');
 }
+
+const DISTRIBUTION_POLL_MS = 10_000;
+const DISTRIBUTION_TIMEOUT_MS = 300_000;
+
+/** @internal Exported for testing. */
+export async function waitForDistribution(
+  region: string,
+  distributionId: string,
+): Promise<boolean> {
+  const deadline = Date.now() + DISTRIBUTION_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      const status = await getDistributionStatus(region, distributionId);
+      if (status === 'Deployed') return true;
+    } catch {
+      // Permission error or transient — keep trying.
+    }
+    await new Promise((r) => setTimeout(r, DISTRIBUTION_POLL_MS));
+  }
+  return false;
+}

package/src/cli/commands/diag.ts

@@ -13,10 +13,10 @@
  *   everystack diag [url] --hydration  # Analyze SSR hydration issues
  */
 
-import { resolveConfig } from '../config.js';
-import { getFromS3 } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer.js';
+import { resolveConfig } from '../config';
+import { getFromS3 } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer';
 
 interface DiagResult {
   url: string;

package/src/cli/commands/lighthouse.ts

@@ -20,9 +20,9 @@ import {
   formatLighthouseReport,
   type ExtractedRun,
   type LhReport,
-} from '../lighthouse.js';
-import { resolveConfig } from '../config.js';
-import { step, info, fail, warn } from '../output.js';
+} from '../lighthouse';
+import { resolveConfig } from '../config';
+import { step, info, fail, warn } from '../output';
 
 function runLighthouse(url: string, outPath: string): LhReport {
   // Warm the edge so we measure the real-user (cached-HTML) experience.

package/src/cli/commands/logs.ts

@@ -10,11 +10,11 @@
  * immune to the Lambda hash rotating on redeploy.
  */
 
-import { resolveConfig } from '../config.js';
-import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws.js';
-import { summarizeRuntimeFailures } from '../ops-diagnostics.js';
-import { queryLogArchive, type ObservabilityQuery } from '../observability.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig } from '../config';
+import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws';
+import { summarizeRuntimeFailures } from '../ops-diagnostics';
+import { queryLogArchive, type ObservabilityQuery } from '../observability';
+import { step, success, fail, info } from '../output';
 
 /** Default S3 key prefix for the observability archive (loggingPlugin default). */
 const DEFAULT_PREFIX = '_observability';

package/src/cli/commands/pipeline-run.ts

@@ -18,19 +18,19 @@ import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source';
+import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { currentGitRef } from '../state-apply';
+import { step, success, fail, info, warn } from '../output';
 import {
   loadServerPipeline,
   type Pipeline,
   type PipelineLane,
   type RunPipelineOptions,
   type PipelineRunOutcome,
-} from '../pipeline-loader.js';
+} from '../pipeline-loader';
 
 /** --rebuild → rebuild, --curate → curate, neither → all. Both is a contradiction. */
 export function pipelineLaneFromFlags(flags: Record<string, string>): PipelineLane {

package/src/cli/commands/runbook.ts

@@ -16,11 +16,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { detectProjectReality } from '../runbook/detect.js';
-import { generateRunbook, type RunbookResult } from '../runbook/generate.js';
-import { renderDataModelSection } from '../runbook/model-section.js';
-import { parseRunbook, sha8 } from '../runbook/markers.js';
-import { fail, info, step, success, warn } from '../output.js';
+import { detectProjectReality } from '../runbook/detect';
+import { generateRunbook, type RunbookResult } from '../runbook/generate';
+import { renderDataModelSection } from '../runbook/model-section';
+import { parseRunbook, sha8 } from '../runbook/markers';
+import { fail, info, step, success, warn } from '../output';
 
 const OUT_REL = path.join('docs', 'RUNBOOK.md');
 

package/src/cli/commands/secrets.ts

@@ -15,10 +15,10 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
-import { parseDotenv, serializeDotenv } from '../utils/dotenv.js';
-import { isMissingOptionalDependencyError } from '../aws.js';
+import { step, success, fail, info, warn } from '../output';
+import { loadSstSecrets, putSstSecrets } from '../utils/secrets';
+import { parseDotenv, serializeDotenv } from '../utils/dotenv';
+import { isMissingOptionalDependencyError } from '../aws';
 
 interface SecretsContext {
   appName: string;
@@ -34,7 +34,7 @@ async function resolveContext(flags: Record<string, string>): Promise<SecretsCon
     process.exit(1);
   }
 
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';