@everystack/cli 0.4.60 → 0.4.61

package/src/cli/commands/db-reconcile.ts

@@ -29,10 +29,10 @@
  * runs it direct. A stage DRY-RUN (no `--apply`) reads through the `db:query` path.
  */
 
-import type { QueryRunner } from '../authz-contract.js';
-import type { SourceObject } from '../derived-source.js';
-import { introspectDerived } from '../derived-introspect.js';
-import { planReconcile, type ReconcilePlan, type ReconcileOptions } from '../derived-plan.js';
+import type { QueryRunner } from '../authz-contract';
+import type { SourceObject } from '../derived-source';
+import { introspectDerived } from '../derived-introspect';
+import { planReconcile, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
   renderProvenanceUpsert,
@@ -49,16 +49,16 @@ import {
   builderOwnerMode,
   type OwnerApplyMode,
   ENSURE_RECONCILER_SQL,
-} from '../derived-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../derived-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { currentGitRef } from '../state-apply';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 // ---------------------------------------------------------------------------
 // The testable core.

package/src/cli/commands/db-refresh.ts

@@ -23,13 +23,13 @@
  * they did not choose.
  */
 
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { executeRefresh, matviewIdentities, type RefreshRun } from '../refresh-execute.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { loadDeclaredDerived } from '../declared-derived';
+import { executeRefresh, matviewIdentities, type RefreshRun } from '../refresh-execute';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { invokeAction } from '../aws';
+import { step, success, fail, info } from '../output';
 
 export async function dbRefreshCommand(flags: Record<string, string>): Promise<void> {
   // The declared matviews, in dependency order (a dependent matview reads its parents' fresh rows).

package/src/cli/commands/db-snapshot.ts

@@ -7,11 +7,11 @@
  * docs/plans/db-backup-restore.md.
  */
 
-import { resolveConfig, type CliConfig } from '../config.js';
-import { createRdsSnapshot, describeRdsSnapshots, type RdsSnapshotSummary } from '../aws.js';
-import { utcStamp } from '../backup.js';
-import { rdsSnapshotIdentifier } from '../rds-snapshot.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, type CliConfig } from '../config';
+import { createRdsSnapshot, describeRdsSnapshots, type RdsSnapshotSummary } from '../aws';
+import { utcStamp } from '../backup';
+import { rdsSnapshotIdentifier } from '../rds-snapshot';
+import { step, success, fail, info } from '../output';
 
 /**
  * Resolve the RDS DB instance identifier: explicit `--instance` wins, else the deployed

package/src/cli/commands/db-swap.ts

@@ -22,32 +22,32 @@ import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
 import type { ModelDescriptor } from '@everystack/model';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import type { SourceObject } from '../derived-source.js';
-import { pairedDerivedSchemas, renderPairedDerivedBuild, renderSwapSchemaUsage, swapSchemaRoles, expectedIncomingObjects, renderPairedProvenance } from '../swap-pair.js';
-import { introspectDerived } from '../derived-introspect.js';
-import { legacyFunctionIdentity } from '../pg-argtypes.js';
-import { createUrlRunner } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import type { QueryRunner } from '../authz-contract.js';
-import { executeSwap, type SwapVerdict } from '../swap-execute.js';
-import { startHeartbeat, humanElapsed } from '../swap-heartbeat.js';
-import { formatBytes } from '../bundle-weight.js';
-import { rewriteStatementLine, opensCopyData, closesCopyData } from '../schema-rewrite.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet, createRdsSnapshot, describeRdsSnapshots } from '../aws.js';
-import { keyForArtifactId, metaKey, utcStamp } from '../backup.js';
-import { rdsSnapshotIdentifier } from '../rds-snapshot.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { decideSnapshotMode, confirmPhysicalSnapshot, interpretBackupPoll, type SnapshotModeRequest } from '../swap-snapshot.js';
-import { runStageBackup, stageBackupDeps } from '../stage-backup.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { step, success, fail, warn, info } from '../output.js';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import type { SourceObject } from '../derived-source';
+import { pairedDerivedSchemas, renderPairedDerivedBuild, renderSwapSchemaUsage, swapSchemaRoles, expectedIncomingObjects, renderPairedProvenance } from '../swap-pair';
+import { introspectDerived } from '../derived-introspect';
+import { legacyFunctionIdentity } from '../pg-argtypes';
+import { createUrlRunner } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import type { QueryRunner } from '../authz-contract';
+import { executeSwap, type SwapVerdict } from '../swap-execute';
+import { startHeartbeat, humanElapsed } from '../swap-heartbeat';
+import { formatBytes } from '../bundle-weight';
+import { rewriteStatementLine, opensCopyData, closesCopyData } from '../schema-rewrite';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet, createRdsSnapshot, describeRdsSnapshots } from '../aws';
+import { keyForArtifactId, metaKey, utcStamp } from '../backup';
+import { rdsSnapshotIdentifier } from '../rds-snapshot';
+import { pollTaskUntilStopped } from '../task-poll';
+import { decideSnapshotMode, confirmPhysicalSnapshot, interpretBackupPoll, type SnapshotModeRequest } from '../swap-snapshot';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { step, success, fail, warn, info } from '../output';
 
 /** A COPY-aware line transform that rewrites the schema token on statement lines only. */
 function schemaRewriteStream(from: string, to: string): Transform {

package/src/cli/commands/db-sync.ts

@@ -30,12 +30,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor } from '@everystack/model';
-import { introspectContract, type QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { generateMigrationSql, unmodeledTables } from '../migration-generate.js';
+import { introspectContract, type QueryRunner } from '../authz-contract';
+import { introspectSchema } from '../schema-introspect';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { generateMigrationSql, unmodeledTables } from '../migration-generate';
 import type { SequenceDescriptor } from '@everystack/model';
-import type { SourceObject } from '../derived-source.js';
+import type { SourceObject } from '../derived-source';
 import {
   applyStateAndVerify,
   classifyGeneratedStatements,
@@ -43,19 +43,19 @@ import {
   currentGitRef,
   type ClassifiedStatements,
   type StateSyncOutcome,
-} from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import type { SourceFile } from '../derived-source.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { planBackfills, readBackfillLog } from '../backfill.js';
-import { resolveModelsPath } from '../models-path.js';
-import { executeReconcile, buildReconcileReport, type ReconcileRun } from './db-reconcile.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { reportPipelineLastRun } from './pipeline-run.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { compileDrizzleSource } from '../schema-source';
+import type { SourceFile } from '../derived-source';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { planBackfills, readBackfillLog } from '../backfill';
+import { resolveModelsPath } from '../models-path';
+import { executeReconcile, buildReconcileReport, type ReconcileRun } from './db-reconcile';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { reportPipelineLastRun } from './pipeline-run';
+import { step, success, fail, info, warn } from '../output';
 
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 

package/src/cli/commands/db.ts

@@ -5,10 +5,10 @@
  * No HTTP endpoints, no shared secrets — IAM is the authorization layer.
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
 
 /** Secret-store keys that may hold the privileged (operator) connection URL,
  *  in precedence order. Names vary by deployment; --secret-name overrides. */
@@ -488,8 +488,8 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
 
   // Load the stage secrets once — the direct venue reads the privileged URL from here (never
   // from argv), and the writer below reuses them.
-  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   const secretsCtx = { appName: await parseAppName(), stage: flags.stage, region: config.region };
   let stageSecrets: Record<string, string> = {};
   try {
@@ -527,12 +527,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // all-public app sets no path (unchanged behavior).
   let declaredSchemas: string[] = [];
   try {
-    const { resolveModelsPath } = await import('../models-path.js');
-    const { loadModels } = await import('./db-generate.js');
+    const { resolveModelsPath } = await import('../models-path');
+    const { loadModels } = await import('./db-generate');
     const models = await loadModels(resolveModelsPath(flags.models));
     let derivedObjects: Array<{ schema: string }> = [];
     try {
-      const { loadDeclaredDerived } = await import('../declared-derived.js');
+      const { loadDeclaredDerived } = await import('../declared-derived');
       const declared = await loadDeclaredDerived(flags.models);
       if (declared) derivedObjects = declared.objects;
     } catch {
@@ -555,7 +555,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // and the auto-fallback below.
   const provisionDirect = async (url: string): Promise<any> => {
     const { runProvision } = await loadServerProvision();
-    const { createUrlRunner } = await import('../db-source.js');
+    const { createUrlRunner } = await import('../db-source');
     const { runner, end } = await createUrlRunner(url);
     try {
       return await runProvision({ authPassword, adminPassword, searchPath }, {
@@ -746,7 +746,7 @@ function printDoctorReport(report: any): void {
  */
 async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: string): Promise<boolean> {
   const { runDoctorProbe } = await loadServerDoctor();
-  const { createUrlRunner } = await import('../db-source.js');
+  const { createUrlRunner } = await import('../db-source');
   step('Probing database connections (api + operator)...');
   const apiConn = await createUrlRunner(apiUrl);
   const opsConn = await createUrlRunner(adminUrl);
@@ -797,8 +797,8 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
 
   // Load the stage secrets once — the direct venue (--direct, and the no-Ops auto-fallback)
   // reads DATABASE_URL + ADMIN_DATABASE_URL from here, never from argv.
-  const { loadSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   let stageSecrets: Record<string, string> = {};
   try {
     stageSecrets = await loadSstSecrets({ appName: await parseAppName(), stage: flags.stage, region: config.region });
@@ -957,8 +957,8 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
   step('Resolving the admin connection from the secret store...');
   let secrets: Record<string, string>;
   try {
-    const { loadSstSecrets } = await import('../utils/secrets.js');
-    const { parseAppName } = await import('../discover.js');
+    const { loadSstSecrets } = await import('../utils/secrets');
+    const { parseAppName } = await import('../discover');
     const appName = await parseAppName();
     secrets = await loadSstSecrets({ appName, stage: flags.stage, region: config.region });
   } catch (err: any) {

package/src/cli/commands/deploy.ts

@@ -11,10 +11,11 @@
  */
 
 import { spawn } from 'node:child_process';
-import { step, success, fail, info, warn } from '../output.js';
-import { invalidateCachedConfig } from '../discover.js';
-import { resolveConfig } from '../config.js';
-import { probeDeployedFunctions } from '../deploy-probe.js';
+import { step, success, fail, info, warn } from '../output';
+import { invalidateCachedConfig } from '../discover';
+import { resolveConfig } from '../config';
+import { probeDeployedFunctions } from '../deploy-probe';
+import { getDistributionStatus } from '../aws';
 
 /** The `sst` argv `everystack deploy` runs. Pure, so the mapping is unit-tested. */
 export function buildDeployArgs(flags: Record<string, string>): string[] {
@@ -68,8 +69,9 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
   // `sst deploy` exiting 0 only proves the code UPLOADED — a bundle that crashes at INIT still
   // deploys "green" and takes the whole ops plane down until the next verb trips over it. Probe
   // the deployed functions now so the operator learns here, with the real cause attached.
+  let config: Awaited<ReturnType<typeof resolveConfig>> | undefined;
   try {
-    const config = await resolveConfig(stage);
+    config = await resolveConfig(stage);
     const { fatal } = await probeDeployedFunctions(stage, config);
     if (fatal) {
       fail('Deploy landed, but a deployed function cannot serve — every --stage verb will fail until this is fixed and redeployed.');
@@ -81,8 +83,40 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
     info(`Skipped the post-deploy probe: ${err?.message ?? err}`);
   }
 
+  // Wait for CloudFront distribution to finish propagating.
+  if (config?.distributionId) {
+    step('Waiting for CloudFront distribution...');
+    const deployed = await waitForDistribution(config.region, config.distributionId);
+    if (deployed) {
+      success('Distribution deployed.');
+    } else {
+      warn('Distribution did not reach Deployed within timeout. It may still be propagating.');
+    }
+  }
+
   // The 0.4 flow: schema changes ride db:plan → db:apply. Migration-based apps still have
   // db:migrate, but the copy-paste hint must advertise the canonical path — this exact
   // line got copied into consumer runbooks with the retired verb.
   info('Next: schema changes via `everystack db:plan --stage ' + stage + '` → `db:apply`; `everystack update` to publish the app bundle.');
 }
+
+const DISTRIBUTION_POLL_MS = 10_000;
+const DISTRIBUTION_TIMEOUT_MS = 300_000;
+
+/** @internal Exported for testing. */
+export async function waitForDistribution(
+  region: string,
+  distributionId: string,
+): Promise<boolean> {
+  const deadline = Date.now() + DISTRIBUTION_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      const status = await getDistributionStatus(region, distributionId);
+      if (status === 'Deployed') return true;
+    } catch {
+      // Permission error or transient — keep trying.
+    }
+    await new Promise((r) => setTimeout(r, DISTRIBUTION_POLL_MS));
+  }
+  return false;
+}

package/src/cli/commands/diag.ts

@@ -13,10 +13,10 @@
  *   everystack diag [url] --hydration  # Analyze SSR hydration issues
  */
 
-import { resolveConfig } from '../config.js';
-import { getFromS3 } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer.js';
+import { resolveConfig } from '../config';
+import { getFromS3 } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer';
 
 interface DiagResult {
   url: string;

package/src/cli/commands/lighthouse.ts

@@ -20,9 +20,9 @@ import {
   formatLighthouseReport,
   type ExtractedRun,
   type LhReport,
-} from '../lighthouse.js';
-import { resolveConfig } from '../config.js';
-import { step, info, fail, warn } from '../output.js';
+} from '../lighthouse';
+import { resolveConfig } from '../config';
+import { step, info, fail, warn } from '../output';
 
 function runLighthouse(url: string, outPath: string): LhReport {
   // Warm the edge so we measure the real-user (cached-HTML) experience.

package/src/cli/commands/logs.ts

@@ -10,11 +10,11 @@
  * immune to the Lambda hash rotating on redeploy.
  */
 
-import { resolveConfig } from '../config.js';
-import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws.js';
-import { summarizeRuntimeFailures } from '../ops-diagnostics.js';
-import { queryLogArchive, type ObservabilityQuery } from '../observability.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig } from '../config';
+import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws';
+import { summarizeRuntimeFailures } from '../ops-diagnostics';
+import { queryLogArchive, type ObservabilityQuery } from '../observability';
+import { step, success, fail, info } from '../output';
 
 /** Default S3 key prefix for the observability archive (loggingPlugin default). */
 const DEFAULT_PREFIX = '_observability';

package/src/cli/commands/pipeline-run.ts

@@ -18,19 +18,19 @@ import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source';
+import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { currentGitRef } from '../state-apply';
+import { step, success, fail, info, warn } from '../output';
 import {
   loadServerPipeline,
   type Pipeline,
   type PipelineLane,
   type RunPipelineOptions,
   type PipelineRunOutcome,
-} from '../pipeline-loader.js';
+} from '../pipeline-loader';
 
 /** --rebuild → rebuild, --curate → curate, neither → all. Both is a contradiction. */
 export function pipelineLaneFromFlags(flags: Record<string, string>): PipelineLane {

package/src/cli/commands/runbook.ts

@@ -16,11 +16,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { detectProjectReality } from '../runbook/detect.js';
-import { generateRunbook, type RunbookResult } from '../runbook/generate.js';
-import { renderDataModelSection } from '../runbook/model-section.js';
-import { parseRunbook, sha8 } from '../runbook/markers.js';
-import { fail, info, step, success, warn } from '../output.js';
+import { detectProjectReality } from '../runbook/detect';
+import { generateRunbook, type RunbookResult } from '../runbook/generate';
+import { renderDataModelSection } from '../runbook/model-section';
+import { parseRunbook, sha8 } from '../runbook/markers';
+import { fail, info, step, success, warn } from '../output';
 
 const OUT_REL = path.join('docs', 'RUNBOOK.md');
 

package/src/cli/commands/secrets.ts

@@ -15,10 +15,10 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
-import { parseDotenv, serializeDotenv } from '../utils/dotenv.js';
-import { isMissingOptionalDependencyError } from '../aws.js';
+import { step, success, fail, info, warn } from '../output';
+import { loadSstSecrets, putSstSecrets } from '../utils/secrets';
+import { parseDotenv, serializeDotenv } from '../utils/dotenv';
+import { isMissingOptionalDependencyError } from '../aws';
 
 interface SecretsContext {
   appName: string;
@@ -34,7 +34,7 @@ async function resolveContext(flags: Record<string, string>): Promise<SecretsCon
     process.exit(1);
   }
 
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
 

package/src/cli/commands/security-probe.ts

@@ -25,10 +25,10 @@ import {
   type CatalogColumn,
   type CatalogGrant,
   type ProbeResult,
-} from '../security-probe.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, info, fail, success, warn } from '../output.js';
+} from '../security-probe';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, info, fail, success, warn } from '../output';
 
 const SYS_SCHEMAS = "('pg_catalog','information_schema','pg_toast')";
 

package/src/cli/commands/security.ts

@@ -22,17 +22,17 @@ import {
   type AuditReport,
   type FunctionDescriptor,
   type ViewDescriptor,
-} from '../security-audit.js';
+} from '../security-audit';
 import {
   FUNCTIONS_SQL,
   RELATIONS_SQL,
   catalogFunctionToDescriptor,
   catalogRelationToDescriptor,
-} from '../security-catalog.js';
-import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../security-catalog';
+import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 const MIGRATION_DIRS = ['drizzle', 'db/migrations', 'migrations', 'db/drizzle'];
 const WAIVER_FILES = ['security-audit.json', '.security-audit.json'];

package/src/cli/commands/status.ts

@@ -11,9 +11,9 @@
  * CDN and Lambda metrics still work with nothing but IAM credentials.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, importOptionalAws } from '../aws.js';
-import { fail, info, step } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, importOptionalAws } from '../aws';
+import { fail, info, step } from '../output';
 
 export interface MetricSpec {
   namespace: string;

package/src/cli/commands/task-probe.ts

@@ -11,10 +11,10 @@
  * run id so the operator can reconcile (the task_log row + ECS both carry it).
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info } from '../output';
 
 const DEADLINE_MS = 10 * 60_000; // 10 min — Fargate cold start + pull + handshake, with headroom.
 

package/src/cli/commands/ui-audit.ts

@@ -14,11 +14,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { discoverComponents } from '../component-model.js';
-import { auditComponents } from '../component-audit.js';
-import { resolveUiBloatBudget } from '../ui-bloat.js';
-import { summarize, type AuditFinding } from '../bundle-audit.js';
-import { fail, info, step, success, warn } from '../output.js';
+import { discoverComponents } from '../component-model';
+import { auditComponents } from '../component-audit';
+import { resolveUiBloatBudget } from '../ui-bloat';
+import { summarize, type AuditFinding } from '../bundle-audit';
+import { fail, info, step, success, warn } from '../output';
 
 export interface UiAuditResult {
   findings: AuditFinding[];