@everystack/cli 0.4.59 → 0.4.61

package/src/cli/commands/security-probe.ts

@@ -25,10 +25,10 @@ import {
   type CatalogColumn,
   type CatalogGrant,
   type ProbeResult,
-} from '../security-probe.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, info, fail, success, warn } from '../output.js';
+} from '../security-probe';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, info, fail, success, warn } from '../output';
 
 const SYS_SCHEMAS = "('pg_catalog','information_schema','pg_toast')";
 

package/src/cli/commands/security.ts

@@ -22,17 +22,17 @@ import {
   type AuditReport,
   type FunctionDescriptor,
   type ViewDescriptor,
-} from '../security-audit.js';
+} from '../security-audit';
 import {
   FUNCTIONS_SQL,
   RELATIONS_SQL,
   catalogFunctionToDescriptor,
   catalogRelationToDescriptor,
-} from '../security-catalog.js';
-import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../security-catalog';
+import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 const MIGRATION_DIRS = ['drizzle', 'db/migrations', 'migrations', 'db/drizzle'];
 const WAIVER_FILES = ['security-audit.json', '.security-audit.json'];

package/src/cli/commands/status.ts

@@ -11,9 +11,9 @@
  * CDN and Lambda metrics still work with nothing but IAM credentials.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, importOptionalAws } from '../aws.js';
-import { fail, info, step } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, importOptionalAws } from '../aws';
+import { fail, info, step } from '../output';
 
 export interface MetricSpec {
   namespace: string;

package/src/cli/commands/task-probe.ts

@@ -11,10 +11,10 @@
  * run id so the operator can reconcile (the task_log row + ECS both carry it).
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info } from '../output';
 
 const DEADLINE_MS = 10 * 60_000; // 10 min — Fargate cold start + pull + handshake, with headroom.
 

package/src/cli/commands/ui-audit.ts

@@ -14,11 +14,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { discoverComponents } from '../component-model.js';
-import { auditComponents } from '../component-audit.js';
-import { resolveUiBloatBudget } from '../ui-bloat.js';
-import { summarize, type AuditFinding } from '../bundle-audit.js';
-import { fail, info, step, success, warn } from '../output.js';
+import { discoverComponents } from '../component-model';
+import { auditComponents } from '../component-audit';
+import { resolveUiBloatBudget } from '../ui-bloat';
+import { summarize, type AuditFinding } from '../bundle-audit';
+import { fail, info, step, success, warn } from '../output';
 
 export interface UiAuditResult {
   findings: AuditFinding[];

package/src/cli/commands/update.ts

@@ -5,13 +5,13 @@ import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
-import { resolveConfig, type CliConfig } from '../config.js';
-import { uploadToS3, headS3, invokeAction } from '../aws.js';
-import { step, success, warn, fail, info } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
-import { exportApp } from '../utils/export.js';
-import { walkDirectory } from '../utils/walk.js';
-import { loadSstSecrets } from '../utils/secrets.js';
+import { resolveConfig, type CliConfig } from '../config';
+import { uploadToS3, headS3, invokeAction, rollingRestart } from '../aws';
+import { step, success, warn, fail, info } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
+import { exportApp } from '../utils/export';
+import { walkDirectory } from '../utils/walk';
+import { loadSstSecrets } from '../utils/secrets';
 
 /**
  * Embed an 8-char content hash in a filename for cache busting.
@@ -111,7 +111,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
     // filter that gates what reaches the bundle (see env.config.js tiers).
     // This avoids requiring `sst shell` in deploy scripts.
     try {
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       const region = resolvedConfig?.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
       step('Loading SST secrets...');
@@ -627,6 +627,27 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         }
       }
 
+      // 6. Rolling restart — retire warm containers so they cold-start with the new bundle.
+      step('Restarting Lambda containers...');
+      try {
+        const { newGen } = await rollingRestart(config.region, config.apiFunctionName);
+        success(`Containers restarting (gen ${newGen})`);
+      } catch (err: any) {
+        warn(`Rolling restart failed: ${err.message}`);
+        info('Warm containers will pick up the new bundle after the 60s TTL expires.');
+      }
+
+      // 7. Verify the origin is serving the new release.
+      step('Verifying origin serves new release...');
+      const verified = await verifyOriginRelease(config.baseUrl, updateId);
+      if (verified) {
+        success(`Origin confirmed: ${updateId.slice(0, 12)}...`);
+      } else {
+        warn('Origin did not confirm the new release within the timeout.');
+        info('The release may still be propagating. Check manually:');
+        info(`  curl -sI ${config.baseUrl} | grep x-everystack-release`);
+      }
+
       // Clean up archive
       await fs.unlink(archivePath).catch(() => {});
 
@@ -787,3 +808,38 @@ export function getExpoRouterSsrFlags(appConfig: any): {
   }
   return { useServerRendering: false, useServerDataLoaders: false };
 }
+
+const VERIFY_CONSECUTIVE = 3;
+const VERIFY_INTERVAL_MS = 2_000;
+const VERIFY_TIMEOUT_MS = 30_000;
+
+/**
+ * Poll the origin until N consecutive responses carry the expected updateId.
+ * Uses a cache-busting query param so each request reaches the Lambda origin.
+ * @internal Exported for testing.
+ */
+export async function verifyOriginRelease(
+  baseUrl: string,
+  expectedUpdateId: string,
+): Promise<boolean> {
+  const deadline = Date.now() + VERIFY_TIMEOUT_MS;
+  let consecutive = 0;
+
+  while (Date.now() < deadline) {
+    try {
+      const probe = `${baseUrl}?_probe=${Date.now()}`;
+      const res = await fetch(probe, { redirect: 'follow' });
+      const release = res.headers.get('x-everystack-release');
+      if (release === expectedUpdateId) {
+        consecutive++;
+        if (consecutive >= VERIFY_CONSECUTIVE) return true;
+      } else {
+        consecutive = 0;
+      }
+    } catch {
+      consecutive = 0;
+    }
+    await new Promise((r) => setTimeout(r, VERIFY_INTERVAL_MS));
+  }
+  return false;
+}

package/src/cli/component-audit.ts

@@ -17,12 +17,12 @@
  * this file; this file imports the model, never the reverse.
  */
 
-import type { AuditFinding, SourceLoc } from './bundle-audit.js';
-import type { ComponentDescriptor, JsxNode } from './component-model.js';
-import { canonicalizeStyle, isDesignStyle, type UiBloatBudget } from './ui-bloat.js';
+import type { AuditFinding, SourceLoc } from './bundle-audit';
+import type { ComponentDescriptor, JsxNode } from './component-model';
+import { canonicalizeStyle, isDesignStyle, type UiBloatBudget } from './ui-bloat';
 
-export { DEFAULT_UI_BLOAT_BUDGET, type UiBloatBudget } from './ui-bloat.js';
-import { DEFAULT_UI_BLOAT_BUDGET } from './ui-bloat.js';
+export { DEFAULT_UI_BLOAT_BUDGET, type UiBloatBudget } from './ui-bloat';
+import { DEFAULT_UI_BLOAT_BUDGET } from './ui-bloat';
 
 const VERIFY = 'rerun ui:audit; this finding clears when its occurrence count drops below the threshold';
 

package/src/cli/config.ts

@@ -9,7 +9,7 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { step } from './output.js';
+import { step } from './output';
 
 export interface CliConfig {
   baseUrl: string;
@@ -91,7 +91,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
       discoverConfig,
       getCachedConfig,
       setCachedConfig,
-    } = await import('./discover.js');
+    } = await import('./discover');
 
     // Check cache first
     const cached = await getCachedConfig(stage);

package/src/cli/db-build.ts

@@ -11,13 +11,13 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import type { TableContract, QueryRunner } from './authz-contract.js';
-import type { SourceObject } from './derived-source.js';
+import type { TableContract, QueryRunner } from './authz-contract';
+import type { SourceObject } from './derived-source';
 import type { SequenceDescriptor } from '@everystack/model';
-import { compileDeclaredState } from './declared-diff.js';
-import { createUrlRunner } from './db-source.js';
-import { executeSync, buildSyncReport } from './commands/db-sync.js';
-import { executeReconcile } from './commands/db-reconcile.js';
+import { compileDeclaredState } from './declared-diff';
+import { createUrlRunner } from './db-source';
+import { executeSync, buildSyncReport } from './commands/db-sync';
+import { executeReconcile } from './commands/db-reconcile';
 
 const SAFE_NAME = /^[a-z_][a-z0-9_$]*$/;
 

package/src/cli/db-source.ts

@@ -24,8 +24,8 @@
  * driver only surfaces — with instructions — when the direct path is actually used.
  */
 
-import type { QueryRunner } from './authz-contract.js';
-import { buildSearchPathSql, type SessionRunner, type SessionResult } from './session.js';
+import type { QueryRunner } from './authz-contract';
+import { buildSearchPathSql, type SessionRunner, type SessionResult } from './session';
 
 export type DbSource =
   | { kind: 'url'; url: string; from: 'flag' | 'env' | 'admin-env' | 'operator' }

package/src/cli/declared-derived.ts

@@ -13,11 +13,11 @@ import fs from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
 import { moduleGovernedRoles } from '@everystack/model';
-import { compileDerived } from './derived-compile.js';
-import { compileTableRenames, compileTableMoves } from './schema-compile.js';
-import type { SourceObject } from './derived-source.js';
-import { resolveModelsPath } from './models-path.js';
-import { asModelComposeError } from './ops-advice.js';
+import { compileDerived } from './derived-compile';
+import { compileTableRenames, compileTableMoves } from './schema-compile';
+import type { SourceObject } from './derived-source';
+import { resolveModelsPath } from './models-path';
+import { asModelComposeError } from './ops-advice';
 
 export interface DeclaredDerived {
   /** Descriptor-compiled derived objects, in dependency order. */

package/src/cli/declared-diff.ts

@@ -27,11 +27,11 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { compileTableSchema, compileEnums } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { generateMigrationSql } from './migration-generate.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { compileTableSchema, compileEnums } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { generateMigrationSql } from './migration-generate';
 
 export interface DeclaredState {
   snapshot: SchemaSnapshot;

package/src/cli/deploy-probe.ts

@@ -16,9 +16,9 @@
  * and must never fail the deploy.
  */
 
-import { isOpsHandlerCrash } from './ops-diagnostics.js';
-import { diagnoseOpsCrash, importOptionalAws } from './aws.js';
-import { step, success, fail, info } from './output.js';
+import { isOpsHandlerCrash } from './ops-diagnostics';
+import { diagnoseOpsCrash, importOptionalAws } from './aws';
+import { step, success, fail, info } from './output';
 
 /** The raw outcome of one probe invoke, before classification. */
 export interface ProbeOutcome {

package/src/cli/derived-apply.ts

@@ -13,11 +13,11 @@
  * the reconciler writes it and never reads it.
  */
 
-import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
-import type { ReconcilePlan } from './derived-plan.js';
-import { parseGrantAttachments } from './derived-grants.js';
-import { quoteIdent, quoteQualified } from './pg-ident.js';
-import { splitFunctionIdentity } from './pg-argtypes.js';
+import { normalizeSql, parseQualified, type SourceObject } from './derived-source';
+import type { ReconcilePlan } from './derived-plan';
+import { parseGrantAttachments } from './derived-grants';
+import { quoteIdent, quoteQualified } from './pg-ident';
+import { splitFunctionIdentity } from './pg-argtypes';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
 export function escapeLiteral(value: string): string {

package/src/cli/derived-compile.ts

@@ -21,10 +21,10 @@ import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
   FunctionDescriptor, SqlDescriptor, TriggerSpec, TriggerDescriptor, Ability, SetofReturn, DependsOnRef,
 } from '@everystack/model';
-import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source.js';
-import { isPlainGrantAttachment } from './derived-grants.js';
-import { functionIdentity } from './pg-argtypes.js';
-import { findInvokerReachabilityGaps } from './derived-lint.js';
+import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source';
+import { isPlainGrantAttachment } from './derived-grants';
+import { functionIdentity } from './pg-argtypes';
+import { findInvokerReachabilityGaps } from './derived-lint';
 
 /** The provenance marker for descriptor-compiled objects (SourceObject.file). */
 const DECLARED = DECLARED_SOURCE_FILE;

package/src/cli/derived-grants.ts

@@ -23,7 +23,7 @@
  * silently half-diffed.
  */
 
-import type { Attachment } from './derived-source.js';
+import type { Attachment } from './derived-source';
 
 export interface ParsedGrants {
   /** grantee → sorted privileges. PUBLIC present-with-[] means explicitly revoked. */

package/src/cli/derived-introspect.ts

@@ -18,9 +18,9 @@
  */
 
 import { createHash } from 'node:crypto';
-import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract.js';
-import { normalizeSql, type DerivedKind } from './derived-source.js';
-import { INTROSPECTION_SESSION, rowsOrEmpty, type SessionRunner } from './session.js';
+import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract';
+import { normalizeSql, type DerivedKind } from './derived-source';
+import { INTROSPECTION_SESSION, rowsOrEmpty, type SessionRunner } from './session';
 
 export interface LiveObject {
   kind: DerivedKind;

package/src/cli/derived-lint.ts

@@ -31,8 +31,8 @@ import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
   FunctionDescriptor, DependsOnRef,
 } from '@everystack/model';
-import { parseQualified } from './derived-source.js';
-import { GOVERNED_VOCABULARY } from './authz-derive.js';
+import { parseQualified } from './derived-source';
+import { GOVERNED_VOCABULARY } from './authz-derive';
 
 export interface DerivedAuthzGap {
   /** `schema.name` of the descriptor that fails the gate. */

package/src/cli/derived-plan.ts

@@ -24,11 +24,11 @@
  * drift report, not a silent skip.
  */
 
-import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source.js';
-import type { DerivedCatalog, LiveObject } from './derived-introspect.js';
-import { triggerDropSql } from './derived-apply.js';
-import { parseGrantAttachments, diffObjectGrants } from './derived-grants.js';
-import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes.js';
+import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source';
+import type { DerivedCatalog, LiveObject } from './derived-introspect';
+import { triggerDropSql } from './derived-apply';
+import { parseGrantAttachments, diffObjectGrants } from './derived-grants';
+import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes';
 
 export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'rebaseline' | 'prune' | 'backfill';
 

package/src/cli/derived-render.ts

@@ -13,12 +13,12 @@
  * checklist effect, on purpose — never a silent drop.
  */
 
-import type { DerivedCatalog, LiveObject } from './derived-introspect.js';
-import type { ColumnSchema, SequenceSchema, TableSchema } from './schema-introspect.js';
-import { parseIndexDefinition } from './schema-introspect.js';
-import { modelImportPath, renderFieldLines } from './model-render.js';
-import { splitFunctionIdentity } from './pg-argtypes.js';
-import { GOVERNED_VOCABULARY, KNOWN_ROLES } from './authz-derive.js';
+import type { DerivedCatalog, LiveObject } from './derived-introspect';
+import type { ColumnSchema, SequenceSchema, TableSchema } from './schema-introspect';
+import { parseIndexDefinition } from './schema-introspect';
+import { modelImportPath, renderFieldLines } from './model-render';
+import { splitFunctionIdentity } from './pg-argtypes';
+import { GOVERNED_VOCABULARY, KNOWN_ROLES } from './authz-derive';
 
 export interface DerivedRenderResult {
   /** The source block: `export const … = defineView(…)` etc., dependency-ordered. */

package/src/cli/direct-venue.ts

@@ -11,8 +11,8 @@
  * never written, never exported. Callers pass it straight to createUrlRunner and drop it.
  */
 
-import { resolveConfig, opsFunction } from './config.js';
-import { invokeAction } from './aws.js';
+import { resolveConfig, opsFunction } from './config';
+import { invokeAction } from './aws';
 
 export interface OperatorConnection {
   /** The operator connection string — hold in memory, never print. */

package/src/cli/discover.ts

@@ -13,7 +13,7 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { importOptionalAws } from './aws.js';
+import { importOptionalAws } from './aws';
 
 /** Mirrors CliConfig from config.ts — defined locally to avoid circular imports. */
 interface DiscoveredConfig {
@@ -285,7 +285,7 @@ export async function discoverConfig(
   // Distribution discovery is best-effort (status CDN section, cache:purge --invalidate)
   let distributionId: string | undefined;
   try {
-    const { discoverDistribution } = await import('./discover-distribution.js');
+    const { discoverDistribution } = await import('./discover-distribution');
     const routerHost = lambdaResult.routerUrl
       ? new URL(lambdaResult.routerUrl).host
       : undefined;

package/src/cli/edge-plan.ts

@@ -26,14 +26,14 @@
 
 import { createHash } from 'node:crypto';
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { generateMigrationSql, unmodeledTables } from './migration-generate.js';
-import { compileTableContract } from './authz-compile.js';
-import { classifyGeneratedStatements, classifyDestructive, partitionStatements, renderStatementHistogram } from './state-apply.js';
-import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, FINGERPRINT_VERSION } from './schema-fingerprint.js';
-import { compileDeclaredState } from './declared-diff.js';
-import { compileTableRenames, compileTableMoves } from './schema-compile.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { generateMigrationSql, unmodeledTables } from './migration-generate';
+import { compileTableContract } from './authz-compile';
+import { classifyGeneratedStatements, classifyDestructive, partitionStatements, renderStatementHistogram } from './state-apply';
+import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, FINGERPRINT_VERSION } from './schema-fingerprint';
+import { compileDeclaredState } from './declared-diff';
+import { compileTableRenames, compileTableMoves } from './schema-compile';
 
 export const PLAN_VERSION = 2;
 

package/src/cli/exec-digest.ts

@@ -21,7 +21,7 @@
  * models?". Server-side, no CLI/model dependency: a plain string that any runner can execute.
  */
 
-import { escapeLiteral } from './derived-apply.js';
+import { escapeLiteral } from './derived-apply';
 
 /**
  * Build the digest query. Returns SQL selecting a single `digest` column (md5 hex, or md5('')

package/src/cli/exec-execute.ts

@@ -15,7 +15,7 @@
  */
 
 import { createHash } from 'node:crypto';
-import { lex } from './derived-source.js';
+import { lex } from './derived-source';
 
 export interface ExecIntent {
   /** sha256 of the exact file bytes — content identity + a free join to a consumer's stage sha. */

package/src/cli/exec-log.ts

@@ -11,7 +11,7 @@
  * Mirrors everystack.backfill_log: a per-database ledger the way schema_log is a write-only memoir.
  */
 
-import { escapeLiteral } from './derived-apply.js';
+import { escapeLiteral } from './derived-apply';
 
 export const ENSURE_EXEC_LOG_SQL: string[] = [
   'CREATE SCHEMA IF NOT EXISTS everystack',

package/src/cli/exec-run.ts

@@ -19,8 +19,8 @@
  * (against PostgreSQL) is in __tests__/integration/exec.test.ts.
  */
 
-import { splitSqlStatements } from './derived-source.js';
-import { catalogDigestQuery } from './exec-digest.js';
+import { splitSqlStatements } from './derived-source';
+import { catalogDigestQuery } from './exec-digest';
 
 /** The normalized result of one statement: its rows and how many it affected. */
 export interface ExecStmtResult {

package/src/cli/git-descent.ts

@@ -29,11 +29,11 @@ import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { fingerprintLive } from './schema-fingerprint.js';
-import { predictLiveFingerprint, governedLiveFingerprint } from './edge-plan.js';
-import { governedRolesForModels } from './schema-fingerprint.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { fingerprintLive } from './schema-fingerprint';
+import { predictLiveFingerprint, governedLiveFingerprint } from './edge-plan';
+import { governedRolesForModels } from './schema-fingerprint';
 
 /** Compile a models barrel on disk. The default rides the CLI's runtime (tsx). */
 export type ModelsLoader = (barrel: string) => Promise<ModelDescriptor[]>;