@everystack/cli 0.4.60 → 0.4.61

package/src/cli/commands/db-apply.ts

@@ -30,33 +30,33 @@
  */
 
 import fs from 'node:fs/promises';
-import { type QueryRunner } from '../authz-contract.js';
-import { currentGitRef } from '../state-apply.js';
-import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
-import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent.js';
-import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
-import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute.js';
-import { estimateOpsRuntimeFit } from '../ops-fit.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { type QueryRunner } from '../authz-contract';
+import { currentGitRef } from '../state-apply';
+import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan';
+import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent';
+import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute';
+import { estimateOpsRuntimeFit } from '../ops-fit';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency';
+import { step, success, fail, info, warn } from '../output';
 
 // The apply core lives in apply-execute.ts (shared with the ops Lambda's
 // db:apply action). Re-exported so the existing integration suites — and any
 // other in-repo caller — keep importing it from this command module.
-export { executeApplyPlan } from '../apply-execute.js';
-export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute.js';
+export { executeApplyPlan } from '../apply-execute';
+export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute';
 
 // ---------------------------------------------------------------------------
 // The CLI shell.
@@ -210,7 +210,7 @@ async function applyPlanViaStage(
         process.exit(1);
       }
       step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       const approvers = await readApproverParam(region, appName, flags.stage);
       const identity = approvers === null ? null : await resolveCallerIdentity(region);
@@ -368,7 +368,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     }
     if (flags.stage) {
       const config = await resolveConfig(flags.stage);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       verifyAuthority = async () => {
         step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);

package/src/cli/commands/db-approvers.ts

@@ -14,15 +14,15 @@
  * path segments (`ty` matches `user/ty` and an assumed-role session `ty`).
  */
 
-import { resolveConfig } from '../config.js';
+import { resolveConfig } from '../config';
 import {
   approverParamName,
   parseApproverValue,
   readApproverParam,
   writeApproverParam,
   removeApproverParam,
-} from '../apply-authority.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../apply-authority';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbApproversCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
@@ -32,7 +32,7 @@ export async function dbApproversCommand(flags: Record<string, string>): Promise
 
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const paramName = approverParamName(appName, flags.stage);
 

package/src/cli/commands/db-authz.ts

@@ -31,7 +31,7 @@ import {
   diffContracts,
   type QueryRunner,
   type AuthzContract,
-} from '../authz-contract.js';
+} from '../authz-contract';
 import {
   buildProbeSql,
   PROBE_SELECT_SQL,
@@ -42,26 +42,26 @@ import {
   toGrantGap,
   buildInheritedPrivilegeSql,
   toInheritedGrant,
-} from '../authz-redteam.js';
+} from '../authz-redteam';
 import {
   buildOwnerProbeSql,
   OWNER_PROBE_SELECT_SQL,
   toOwnerProbeResult,
   evaluateOwnerProbe,
   type OwnerProbe,
-} from '../authz-owner-probe.js';
-import { modelOwner } from '../authz-compile.js';
-import { writeContract, loadContract } from '../authz-contract-io.js';
-import { renderContractMarkdown } from '../authz-render.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
-import { loadModels } from './db-generate.js';
+} from '../authz-owner-probe';
+import { modelOwner } from '../authz-compile';
+import { writeContract, loadContract } from '../authz-contract-io';
+import { renderContractMarkdown } from '../authz-render';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
+import { loadModels } from './db-generate';
 
 const DEFAULT_DIR = 'authz';
 

package/src/cli/commands/db-backfill.ts

@@ -18,22 +18,22 @@
  * reads and writes its own per-database record.
  */
 
-import type { QueryRunner } from '../authz-contract.js';
+import type { QueryRunner } from '../authz-contract';
 import {
   planBackfills,
   readBackfillLog,
   executeBackfills,
   markBackfillApplied,
   type BackfillPlan,
-} from '../backfill.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { readSqlDirIfPresent } from './db-sync.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backfill';
+import { currentGitRef } from '../state-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { readSqlDirIfPresent } from './db-sync';
+import { step, success, fail, info, warn } from '../output';
 
 const DEFAULT_DIR = 'db/backfills';
 

package/src/cli/commands/db-backup.ts

@@ -19,16 +19,16 @@ import { spawn } from 'node:child_process';
 import { createGzip } from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { randomBytes } from 'node:crypto';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet, getS3 } from '../aws.js';
-import { runStageBackup, stageBackupDeps } from '../stage-backup.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet, getS3 } from '../aws';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
 import {
   parseBackupRef, keyForId, crossStageGuard, restoreTargetGuard,
   backupKey, backupId, metaKey, utcStamp,
-} from '../backup.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backup';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info, warn } from '../output';
 
 /** Which database db:backup dumps. LOCAL requires a target --stage (its bucket receives the upload
  *  AND names the backup id). Note this DIVERGES from db:export, where --database-url and --stage are

package/src/cli/commands/db-branch.ts

@@ -34,14 +34,14 @@ import {
   templateName,
   currentBranch,
   localBranches,
-} from '../branch-db.js';
-import { currentGitRef } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveDbSource, type DbSource } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../branch-db';
+import { currentGitRef } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveDbSource, type DbSource } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 function requireUrl(flags: Record<string, string>, verb: string): string {
   let dbSource: DbSource;

package/src/cli/commands/db-build.ts

@@ -25,13 +25,13 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { buildIntoDatabase } from '../db-build.js';
-import { createUrlRunner } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, info, success, fail, warn } from '../output.js';
+import { buildIntoDatabase } from '../db-build';
+import { createUrlRunner } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { currentGitRef } from '../state-apply';
+import { step, info, success, fail, warn } from '../output';
 
 /** Tables already in the target, outside the schemas PostgreSQL owns. */
 const OCCUPANCY_SQL = `

package/src/cli/commands/db-check.ts

@@ -31,29 +31,29 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor, DerivedDescriptor } from '@everystack/model';
-import { compileDeclaredState } from '../declared-diff.js';
-import { compileMigration } from '../migration-compile.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { currentGitRef } from '../state-apply.js';
-import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate.js';
-import { resolveSchemaOut } from '../migration-generate.js';
-import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
+import { compileDeclaredState } from '../declared-diff';
+import { compileMigration } from '../migration-compile';
+import { compileDrizzleSource } from '../schema-source';
+import { currentGitRef } from '../state-apply';
+import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build';
+import { resolveModelsPath } from '../models-path';
+import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate';
+import { resolveSchemaOut } from '../migration-generate';
+import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
-import type { SourceObject } from '../derived-source.js';
-import { findReadAuthzGaps, findNakedGrants } from '../authz-lint.js';
-import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
+import type { SourceObject } from '../derived-source';
+import { findReadAuthzGaps, findNakedGrants } from '../authz-lint';
+import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline';
 import {
   findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
   findUnpinnedDefiners,
-} from '../derived-lint.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../derived-lint';
+import { step, success, fail, info, warn } from '../output';
 
 // The role derivation moved to the shared builder (db-build) with brick
 // 5-remainder; re-exported here because db:check is where it grew up.
-export { rolesFromContract } from '../db-build.js';
+export { rolesFromContract } from '../db-build';
 
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 

package/src/cli/commands/db-diff.ts

@@ -24,12 +24,12 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { diffDeclaredStates } from '../declared-diff.js';
-import { classifyGeneratedStatements } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { diffDeclaredStates } from '../declared-diff';
+import { classifyGeneratedStatements } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbDiffCommand(flags: Record<string, string>): Promise<void> {
   const fromPath = flags['from-models'];

package/src/cli/commands/db-exec.ts

@@ -16,14 +16,14 @@
  */
 
 import fs from 'node:fs/promises';
-import { resolveDbSource, sslDefaults } from '../db-source.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { isProductionTier } from '../backup.js';
-import { executeExec, assertNoTxnControl } from '../exec-execute.js';
-import { runExecInTx } from '../exec-run.js';
-import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveDbSource, sslDefaults } from '../db-source';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { isProductionTier } from '../backup';
+import { executeExec, assertNoTxnControl } from '../exec-execute';
+import { runExecInTx } from '../exec-run';
+import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log';
+import { step, success, fail, info } from '../output';
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];

package/src/cli/commands/db-export.ts

@@ -20,16 +20,16 @@ import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { utcStamp } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction } from '../aws';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { utcStamp } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info } from '../output';
 
 const fmtBytes = (b?: number): string =>
   b == null ? '?' : b >= 1024 ** 3 ? `${(b / 1024 ** 3).toFixed(1)} GB` : b >= 1024 ** 2 ? `${(b / 1024 ** 2).toFixed(1)} MB` : `${(b / 1024).toFixed(0)} KB`;

package/src/cli/commands/db-fingerprint.ts

@@ -14,10 +14,10 @@
 
 import { existsSync } from 'node:fs';
 import type { ModelDescriptor } from '@everystack/model';
-import type { QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { introspectContract } from '../authz-contract.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
+import type { QueryRunner } from '../authz-contract';
+import { introspectSchema } from '../schema-introspect';
+import { introspectContract } from '../authz-contract';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import {
   fingerprintLive,
   fingerprintModels,
@@ -25,16 +25,16 @@ import {
   mapUnfingerprintedRows,
   UNFINGERPRINTED_SQL,
   type UnfingerprintedObject,
-} from '../schema-fingerprint.js';
-import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
+} from '../schema-fingerprint';
+import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
 
 export interface FingerprintStatus {

package/src/cli/commands/db-fork.ts

@@ -19,12 +19,12 @@
  * data-governance warning. Teardown is the stage's own: `sst remove`.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet } from '../aws.js';
-import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { runStageBackup, stageBackupDeps } from '../stage-backup.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet } from '../aws';
+import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
+import { step, success, fail, info, warn } from '../output';
 
 export type ForkGuardVerdict =
   | { ok: true; piiWarning: string | null }

package/src/cli/commands/db-generate.ts

@@ -23,25 +23,25 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { ModelDescriptor, Module } from '@everystack/model';
-import { introspectSchema } from '../schema-introspect.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { compileModuleMigration } from '../migration-compile.js';
-import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate.js';
-import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile.js';
-import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived.js';
-import { asModelComposeError, opsAdviceLines } from '../ops-advice.js';
-import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { introspectSchema } from '../schema-introspect';
+import { compileDrizzleSource } from '../schema-source';
+import { compileModuleMigration } from '../migration-compile';
+import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile';
+import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived';
+import { asModelComposeError, opsAdviceLines } from '../ops-advice';
+import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 export const DEFAULT_MIGRATIONS = 'drizzle';
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';

package/src/cli/commands/db-plan.ts

@@ -43,31 +43,31 @@
 import fs from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
-import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } from '../authz-ownership.js';
-import { introspectSchema, type SchemaSnapshot } from '../schema-introspect.js';
-import { readStageStateTwice } from '../stage-read-consistency.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { mintEdgePlan, planHash, buildPlanSummary } from '../edge-plan.js';
-import { verifyDescent } from '../git-descent.js';
-import { planBackfills, readBackfillLog } from '../backfill.js';
-import { readSqlDirIfPresent } from './db-sync.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
-import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
-import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents.js';
-import { compileTableContract } from '../authz-compile.js';
-import { reportPipelineLastRun } from './pipeline-run.js';
-import { step, success, fail, info, warn, reserveStdoutForData } from '../output.js';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract';
+import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } from '../authz-ownership';
+import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
+import { readStageStateTwice } from '../stage-read-consistency';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { mintEdgePlan, planHash, buildPlanSummary } from '../edge-plan';
+import { verifyDescent } from '../git-descent';
+import { planBackfills, readBackfillLog } from '../backfill';
+import { readSqlDirIfPresent } from './db-sync';
+import { currentGitRef } from '../state-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveModelsPath } from '../models-path';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
+import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents';
+import { compileTableContract } from '../authz-compile';
+import { reportPipelineLastRun } from './pipeline-run';
+import { step, success, fail, info, warn, reserveStdoutForData } from '../output';
 
 const DEFAULT_OUT = 'db.plan.json';
 

package/src/cli/commands/db-pull.ts

@@ -33,24 +33,24 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { introspectSchema, MATVIEW_COLUMNS_SQL, matviewColumnsByIdentity, type ColumnRow, type ColumnSchema } from '../schema-introspect.js';
-import { fingerprintLive } from '../schema-fingerprint.js';
-import { ungovernedGrants, vestigialSequenceGrants, renderVestigialSequenceGrants, ALWAYS_GOVERNED, type GrantExemption } from '../authz-reconcile.js';
-import { buildStageBaseline, mergeBaseline, readBaselineFile, writeBaselineFile, BASELINE_FILE } from '../authz-baseline.js';
-import { introspectDerived, type DerivedCatalog } from '../derived-introspect.js';
-import { introspectContract, type TableContract, type AuthzContract } from '../authz-contract.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { renderDerivedSource, renderDerivedFile, type DerivedRenderResult } from '../derived-render.js';
-import { renderModelSource, renderModelFiles, pullableTables, skippedInfrastructureTables, modelVarName, ABILITY_PRESETS } from '../model-render.js';
-import { deriveAbilities } from '../authz-derive.js';
-import type { QueryRunner } from '../authz-contract.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { fail } from '../output.js';
-import { opsAdviceLines } from '../ops-advice.js';
+import { introspectSchema, MATVIEW_COLUMNS_SQL, matviewColumnsByIdentity, type ColumnRow, type ColumnSchema } from '../schema-introspect';
+import { fingerprintLive } from '../schema-fingerprint';
+import { ungovernedGrants, vestigialSequenceGrants, renderVestigialSequenceGrants, ALWAYS_GOVERNED, type GrantExemption } from '../authz-reconcile';
+import { buildStageBaseline, mergeBaseline, readBaselineFile, writeBaselineFile, BASELINE_FILE } from '../authz-baseline';
+import { introspectDerived, type DerivedCatalog } from '../derived-introspect';
+import { introspectContract, type TableContract, type AuthzContract } from '../authz-contract';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { renderDerivedSource, renderDerivedFile, type DerivedRenderResult } from '../derived-render';
+import { renderModelSource, renderModelFiles, pullableTables, skippedInfrastructureTables, modelVarName, ABILITY_PRESETS } from '../model-render';
+import { deriveAbilities } from '../authz-derive';
+import type { QueryRunner } from '../authz-contract';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { fail } from '../output';
+import { opsAdviceLines } from '../ops-advice';
 
 // Progress → stderr, so stdout carries only the rendered source (this command is codegen,
 // not a report — the shared output helpers write to stdout, which would corrupt a redirect).