@everystack/cli 0.4.59 → 0.4.61

package/src/cli/index.ts

@@ -2,51 +2,51 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { updateCommand } from './commands/update.js';
-import { deployCommand } from './commands/deploy.js';
-import { certsCommand } from './commands/certs.js';
-import { channelsCommand } from './commands/channels.js';
-import { branchesCommand } from './commands/branches.js';
-import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db.js';
-import { dbAuthzPullCommand, dbAuthzDiffCommand, dbAuthzTestCommand, dbAuthzOwnerCommand, dbAuthzReportCommand } from './commands/db-authz.js';
-import { dbGenerateCommand } from './commands/db-generate.js';
-import { dbPullCommand } from './commands/db-pull.js';
-import { dbReconcileCommand } from './commands/db-reconcile.js';
-import { dbRefreshCommand } from './commands/db-refresh.js';
-import { dbFingerprintCommand } from './commands/db-fingerprint.js';
-import { dbSyncCommand } from './commands/db-sync.js';
-import { dbDiffCommand } from './commands/db-diff.js';
-import { dbPlanCommand } from './commands/db-plan.js';
-import { dbApplyCommand } from './commands/db-apply.js';
-import { dbCheckCommand } from './commands/db-check.js';
-import { dbBuildCommand } from './commands/db-build.js';
-import { dbApproversCommand } from './commands/db-approvers.js';
-import { dbBackfillCommand } from './commands/db-backfill.js';
-import { dbExecCommand } from './commands/db-exec.js';
-import { taskProbeCommand } from './commands/task-probe.js';
-import { pipelineRunCommand, pipelineListCommand } from './commands/pipeline-run.js';
-import { dbTemplateRefreshCommand, dbBranchCommand } from './commands/db-branch.js';
-import { dbForkCommand } from './commands/db-fork.js';
-import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot.js';
-import { dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup.js';
-import { dbExportCommand } from './commands/db-export.js';
-import { dbSwapCommand } from './commands/db-swap.js';
-import { consoleCommand } from './commands/console.js';
-import { cachePurgeCommand } from './commands/cache.js';
-import { statusCommand } from './commands/status.js';
-import { diagCommand } from './commands/diag.js';
-import { analyzeSSRCommand } from './commands/analyze.js';
-import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
-import { secretsCommand } from './commands/secrets.js';
-import { securityAuditCommand } from './commands/security.js';
-import { securityProbeCommand } from './commands/security-probe.js';
-import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle.js';
-import { auditLighthouseCommand } from './commands/lighthouse.js';
-import { auditCommand } from './commands/audit.js';
-import { uiAuditCommand } from './commands/ui-audit.js';
-import { runbookCommand } from './commands/runbook.js';
-import { fail } from './output.js';
-import { parseFlags } from './parse-flags.js';
+import { updateCommand } from './commands/update';
+import { deployCommand } from './commands/deploy';
+import { certsCommand } from './commands/certs';
+import { channelsCommand } from './commands/channels';
+import { branchesCommand } from './commands/branches';
+import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db';
+import { dbAuthzPullCommand, dbAuthzDiffCommand, dbAuthzTestCommand, dbAuthzOwnerCommand, dbAuthzReportCommand } from './commands/db-authz';
+import { dbGenerateCommand } from './commands/db-generate';
+import { dbPullCommand } from './commands/db-pull';
+import { dbReconcileCommand } from './commands/db-reconcile';
+import { dbRefreshCommand } from './commands/db-refresh';
+import { dbFingerprintCommand } from './commands/db-fingerprint';
+import { dbSyncCommand } from './commands/db-sync';
+import { dbDiffCommand } from './commands/db-diff';
+import { dbPlanCommand } from './commands/db-plan';
+import { dbApplyCommand } from './commands/db-apply';
+import { dbCheckCommand } from './commands/db-check';
+import { dbBuildCommand } from './commands/db-build';
+import { dbApproversCommand } from './commands/db-approvers';
+import { dbBackfillCommand } from './commands/db-backfill';
+import { dbExecCommand } from './commands/db-exec';
+import { taskProbeCommand } from './commands/task-probe';
+import { pipelineRunCommand, pipelineListCommand } from './commands/pipeline-run';
+import { dbTemplateRefreshCommand, dbBranchCommand } from './commands/db-branch';
+import { dbForkCommand } from './commands/db-fork';
+import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot';
+import { dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup';
+import { dbExportCommand } from './commands/db-export';
+import { dbSwapCommand } from './commands/db-swap';
+import { consoleCommand } from './commands/console';
+import { cachePurgeCommand } from './commands/cache';
+import { statusCommand } from './commands/status';
+import { diagCommand } from './commands/diag';
+import { analyzeSSRCommand } from './commands/analyze';
+import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs';
+import { secretsCommand } from './commands/secrets';
+import { securityAuditCommand } from './commands/security';
+import { securityProbeCommand } from './commands/security-probe';
+import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle';
+import { auditLighthouseCommand } from './commands/lighthouse';
+import { auditCommand } from './commands/audit';
+import { uiAuditCommand } from './commands/ui-audit';
+import { runbookCommand } from './commands/runbook';
+import { fail } from './output';
+import { parseFlags } from './parse-flags';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -109,7 +109,7 @@ async function main() {
   // (loadSstOutputs and resolveConfig both consult it). Use after a deploy the CLI didn't run,
   // or whenever a stage command resolves to the wrong function.
   if (flags.refresh && flags.stage) {
-    const { invalidateCachedConfig } = await import('./discover.js');
+    const { invalidateCachedConfig } = await import('./discover');
     await invalidateCachedConfig(flags.stage);
   }
 

package/src/cli/migration-compile.ts

@@ -20,13 +20,13 @@
  */
 
 import type { ModelDescriptor, Module, SequenceDescriptor } from '@everystack/model';
-import type { AuthzContract, TableContract } from './authz-contract.js';
-import { compileCreateTable, compileEnums, compileSequences, sequenceCreateSql, foreignKeySql, modelConstraintSpecs, qualifiedTable, toSnakeCase, type CompileTableOptions } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql } from './authz-reconcile.js';
-import { emitSchemaSql, nextvalSequence, type SchemaChange } from './schema-diff.js';
-import { compileDerived } from './derived-compile.js';
-import { renderEnsureObjectSchemas } from './derived-apply.js';
+import type { AuthzContract, TableContract } from './authz-contract';
+import { compileCreateTable, compileEnums, compileSequences, sequenceCreateSql, foreignKeySql, modelConstraintSpecs, qualifiedTable, toSnakeCase, type CompileTableOptions } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { emitReconcileSql } from './authz-reconcile';
+import { emitSchemaSql, nextvalSequence, type SchemaChange } from './schema-diff';
+import { compileDerived } from './derived-compile';
+import { renderEnsureObjectSchemas } from './derived-apply';
 
 /** The empty (not-yet-created) authz state for a table — the greenfield baseline. */
 function emptyTable(table: string): TableContract {

package/src/cli/migration-generate.ts

@@ -16,12 +16,12 @@
  */
 
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql, governedRoleSet } from './authz-reconcile.js';
-import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { emitReconcileSql, governedRoleSet } from './authz-reconcile';
+import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff';
 
 export interface GenerateOptions {
   /** The Postgres schema the Models live in. Default: `public`. */

package/src/cli/model-api.ts

@@ -15,25 +15,25 @@
  */
 
 // --- data layer: compile, introspect, diff, render -------------------------
-export * from './schema-compile.js';
-export * from './schema-introspect.js';
-export * from './schema-diff.js';
-export * from './schema-source.js';
-export * from './model-render.js';
-export * from './migration-compile.js';
-export * from './migration-generate.js';
+export * from './schema-compile';
+export * from './schema-introspect';
+export * from './schema-diff';
+export * from './schema-source';
+export * from './model-render';
+export * from './migration-compile';
+export * from './migration-generate';
 
 // --- authz layer: contract compile/introspect/diff/reconcile ---------------
-export * from './authz-compile.js';
-export * from './authz-contract.js';
-export * from './authz-reconcile.js';
+export * from './authz-compile';
+export * from './authz-contract';
+export * from './authz-reconcile';
 
 // --- red-team: grant enforcement + owner isolation -------------------------
-export * from './authz-redteam.js';
-export * from './authz-owner-probe.js';
+export * from './authz-redteam';
+export * from './authz-owner-probe';
 
 // --- the SECDEF function catalog the contract introspection needs -----------
-export { FUNCTIONS_SQL, catalogFunctionToDescriptor } from './security-catalog.js';
+export { FUNCTIONS_SQL, catalogFunctionToDescriptor } from './security-catalog';
 
 // --- how you HAND a database to the VERIFY calls ---------------------------
 // `introspectSchema` and `introspectContract` take a `SessionRunner`, not a `QueryRunner`:
@@ -47,7 +47,7 @@ export { FUNCTIONS_SQL, catalogFunctionToDescriptor } from './security-catalog.j
 // `sessionRunnerOver(sql)` wraps a postgres.js client whose pool is a SINGLE connection.
 // `INTROSPECTION_SESSION` is the options both introspections expect — read only, repeatable
 // read, canonical `search_path`. Pass it through; do not re-derive it.
-export { sessionRunnerOver } from './db-source.js';
+export { sessionRunnerOver } from './db-source';
 export {
   INTROSPECTION_SESSION,
   borrowedSessionRunner,
@@ -57,11 +57,11 @@ export {
   type SessionStatement,
   type SessionOptions,
   type SessionResult,
-} from './session.js';
+} from './session';
 
 // --- databases FROM the declared state: ephemeral test DBs + the builder ----
 // `createEphemeralDatabase(adminUrl, models, { sources })` is the packaged
 // create-sync-drop shape for consumer test suites: a fresh database at the
 // declared state (state + authz + derived), verified to fingerprint MATCH,
 // dropped when you're done — never long-lived, never poisoned.
-export * from './db-build.js';
+export * from './db-build';

package/src/cli/model-render.ts

@@ -15,12 +15,12 @@
  * Pure and deterministic — the command shell (commands/db-pull.ts) does the IO.
  */
 
-import type { SchemaSnapshot, TableSchema, ColumnSchema, CheckConstraint } from './schema-introspect.js';
-import type { DerivedRenderResult } from './derived-render.js';
-import type { TableContract } from './authz-contract.js';
-import { deriveAbilities, renderDerivedAbilities } from './authz-derive.js';
-import { normalizeDefault, normalizeCheck } from './schema-diff.js';
-import { generatedIndexName, generatedForeignKeyName } from './schema-compile.js';
+import type { SchemaSnapshot, TableSchema, ColumnSchema, CheckConstraint } from './schema-introspect';
+import type { DerivedRenderResult } from './derived-render';
+import type { TableContract } from './authz-contract';
+import { deriveAbilities, renderDerivedAbilities } from './authz-derive';
+import { normalizeDefault, normalizeCheck } from './schema-diff';
+import { generatedIndexName, generatedForeignKeyName } from './schema-compile';
 // The soft-delete RULE itself — one boolean combination, shared with `defineModel`'s refusal.
 // Only the FACT EXTRACTION is duplicated here (this renderer holds text, not descriptors);
 // the rule is not, so the two surfaces cannot drift on when a declaration is required.

package/src/cli/mutation-lease.ts

@@ -20,7 +20,7 @@
  * lives in `pg_locks`, discoverable from the catalog rather than bookkeeping that can lie.
  */
 
-import type { QueryRunner } from './authz-contract.js';
+import type { QueryRunner } from './authz-contract';
 
 /**
  * The fixed lease key: `('ES','TK')` as two 16-bit ints — 0x4553, 0x544B. One key covers

package/src/cli/observability.ts

@@ -17,7 +17,7 @@
  * pulls React Native (admin/ui) through its peer graph — wrong for a standalone CLI.
  */
 
-import { listS3, getFromS3 } from './aws.js';
+import { listS3, getFromS3 } from './aws';
 
 /** Severity ordering — mirrors LogLevel in @everystack/logging core/types. */
 const LOG_LEVELS: Record<string, number> = {

package/src/cli/refresh-execute.ts

@@ -13,8 +13,8 @@
  * deliberate follow-on, not a silent default.
  */
 
-import { quoteQualified } from './pg-ident.js';
-import type { SourceObject } from './derived-source.js';
+import { quoteQualified } from './pg-ident';
+import type { SourceObject } from './derived-source';
 
 export type RefreshRunner = (sql: string) => Promise<any[]>;
 

package/src/cli/runbook/generate.ts

@@ -9,9 +9,9 @@
  * idempotent: unchanged project → byte-identical output.
  */
 
-import type { ProjectReality } from './detect.js';
-import { parseRunbook, composeRunbook, sha8, type Block } from './markers.js';
-import { buildStructure, headerStamp, PLACEHOLDER_PREFIX, type RunbookContext } from './sections.js';
+import type { ProjectReality } from './detect';
+import { parseRunbook, composeRunbook, sha8, type Block } from './markers';
+import { buildStructure, headerStamp, PLACEHOLDER_PREFIX, type RunbookContext } from './sections';
 
 export interface RunbookResult {
   text: string;

package/src/cli/runbook/index.ts

@@ -11,10 +11,10 @@
  *   expect(status).toBe('current');
  */
 
-export * from './detect.js';
-export * from './markers.js';
-export * from './sections.js';
-export * from './generate.js';
-export * from './model-section.js';
-export { runRunbook, checkRunbook, diffSummary } from '../commands/runbook.js';
-export type { RunbookRun, RunbookCheck, RunbookDiffSummary } from '../commands/runbook.js';
+export * from './detect';
+export * from './markers';
+export * from './sections';
+export * from './generate';
+export * from './model-section';
+export { runRunbook, checkRunbook, diffSummary } from '../commands/runbook';
+export type { RunbookRun, RunbookCheck, RunbookDiffSummary } from '../commands/runbook';

package/src/cli/runbook/sections.ts

@@ -10,8 +10,8 @@
  * markdown) → same blocks, so `runbook --check` is trustworthy in CI.
  */
 
-import type { ProjectReality } from './detect.js';
-import type { Block } from './markers.js';
+import type { ProjectReality } from './detect';
+import type { Block } from './markers';
 
 export interface RunbookContext {
   cliVersion: string;

package/src/cli/schema-compile.ts

@@ -20,9 +20,9 @@
  */
 
 import type { ModelDescriptor, FieldSpec, SequenceDescriptor } from '@everystack/model';
-import type { TableSchema, EnumType, SequenceSchema, UniqueConstraint, CheckConstraint, IndexSchema, ForeignKey } from './schema-introspect.js';
-import { nextvalSequence, identityClause, type RenameMap } from './schema-diff.js';
-import { normalizeDeparsedExpr } from './deparse-normal.js';
+import type { TableSchema, EnumType, SequenceSchema, UniqueConstraint, CheckConstraint, IndexSchema, ForeignKey } from './schema-introspect';
+import { nextvalSequence, identityClause, type RenameMap } from './schema-diff';
+import { normalizeDeparsedExpr } from './deparse-normal';
 
 /** `authorId` -> `author_id`. SQL identifiers are snake_case. */
 export function toSnakeCase(name: string): string {
@@ -606,7 +606,7 @@ export function compileSequences(sequences: readonly SequenceDescriptor[]): Sequ
 
 // The DDL renderer lives in schema-diff (emitOne needs it; this file already imports
 // schema-diff, so defining it there avoids a cycle) — re-exported here beside its compiler.
-export { sequenceCreateSql } from './schema-diff.js';
+export { sequenceCreateSql } from './schema-diff';
 
 /**
  * Foreign-key constraints for a model — its `.references()` fields and its table-level

package/src/cli/schema-diff.ts

@@ -31,7 +31,7 @@ import type {
   EnumType,
   IndexSchema,
   SequenceSchema,
-} from './schema-introspect.js';
+} from './schema-introspect';
 
 // ---------------------------------------------------------------------------
 // The change set.

package/src/cli/schema-fingerprint.ts

@@ -50,14 +50,14 @@
  */
 
 import { createHash } from 'node:crypto';
-import { canonicalAuthz } from './authz-canonical.js';
+import { canonicalAuthz } from './authz-canonical';
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
-import type { SchemaSnapshot, TableSchema } from './schema-introspect.js';
-import type { AuthzContract, TableContract } from './authz-contract.js';
-import { compileTableSchema, compileEnums, compileSequences } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { governedRoleSet } from './authz-reconcile.js';
-import { normalizeDefault, normalizeCheck, indexKey } from './schema-diff.js';
+import type { SchemaSnapshot, TableSchema } from './schema-introspect';
+import type { AuthzContract, TableContract } from './authz-contract';
+import { compileTableSchema, compileEnums, compileSequences } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { governedRoleSet } from './authz-reconcile';
+import { normalizeDefault, normalizeCheck, indexKey } from './schema-diff';
 
 // v2: expression fields (defaults, checks, partial-index WHERE) normalize through
 // the diff's pg-deparse normalizers before hashing, so the model form and the live

package/src/cli/schema-introspect.ts

@@ -13,9 +13,9 @@
  * 'numeric(12,2)', 'uuid' the Model compiler also emits), so the two sides diff.
  */
 
-import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract.js';
-import { INTROSPECTION_SESSION, type SessionRunner } from './session.js';
-import { normalizeDeparsedExpr } from './deparse-normal.js';
+import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract';
+import { INTROSPECTION_SESSION, type SessionRunner } from './session';
+import { normalizeDeparsedExpr } from './deparse-normal';
 
 // ---------------------------------------------------------------------------
 // The data-layer snapshot — the structured shape both producers target.

package/src/cli/schema-source.ts

@@ -26,7 +26,7 @@
  */
 
 import type { ModelDescriptor, FieldSpec, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor } from '@everystack/model';
-import { parseQualified } from './derived-source.js';
+import { parseQualified } from './derived-source';
 
 /** `author_id` is the SQL identifier; `authorId` the field key. The single snake-case rule. */
 function toSnakeCase(name: string): string {

package/src/cli/schema-swap.ts

@@ -31,10 +31,10 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { modelForeignKeys, qualifiedTable } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { emitSwapAuthzSql } from './authz-reconcile.js';
-import { schemaOf } from './schema-fingerprint.js';
+import { modelForeignKeys, qualifiedTable } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { emitSwapAuthzSql } from './authz-reconcile';
+import { schemaOf } from './schema-fingerprint';
 
 const SAFE_SCHEMA = /^[a-z_][a-z0-9_$]*$/;
 

package/src/cli/security-catalog.ts

@@ -14,7 +14,7 @@ import type {
   FunctionDescriptor,
   ViewDescriptor,
   ReturnClass,
-} from './security-audit.js';
+} from './security-audit';
 
 /**
  * Enumerate every function with its security context. Excludes system schemas and