@everystack/cli 0.4.60 → 0.4.61

package/src/cli/commands/update.ts

@@ -5,13 +5,13 @@ import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
-import { resolveConfig, type CliConfig } from '../config.js';
-import { uploadToS3, headS3, invokeAction } from '../aws.js';
-import { step, success, warn, fail, info } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
-import { exportApp } from '../utils/export.js';
-import { walkDirectory } from '../utils/walk.js';
-import { loadSstSecrets } from '../utils/secrets.js';
+import { resolveConfig, type CliConfig } from '../config';
+import { uploadToS3, headS3, invokeAction, rollingRestart } from '../aws';
+import { step, success, warn, fail, info } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
+import { exportApp } from '../utils/export';
+import { walkDirectory } from '../utils/walk';
+import { loadSstSecrets } from '../utils/secrets';
 
 /**
  * Embed an 8-char content hash in a filename for cache busting.
@@ -111,7 +111,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
     // filter that gates what reaches the bundle (see env.config.js tiers).
     // This avoids requiring `sst shell` in deploy scripts.
     try {
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       const region = resolvedConfig?.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
       step('Loading SST secrets...');
@@ -627,6 +627,27 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         }
       }
 
+      // 6. Rolling restart — retire warm containers so they cold-start with the new bundle.
+      step('Restarting Lambda containers...');
+      try {
+        const { newGen } = await rollingRestart(config.region, config.apiFunctionName);
+        success(`Containers restarting (gen ${newGen})`);
+      } catch (err: any) {
+        warn(`Rolling restart failed: ${err.message}`);
+        info('Warm containers will pick up the new bundle after the 60s TTL expires.');
+      }
+
+      // 7. Verify the origin is serving the new release.
+      step('Verifying origin serves new release...');
+      const verified = await verifyOriginRelease(config.baseUrl, updateId);
+      if (verified) {
+        success(`Origin confirmed: ${updateId.slice(0, 12)}...`);
+      } else {
+        warn('Origin did not confirm the new release within the timeout.');
+        info('The release may still be propagating. Check manually:');
+        info(`  curl -sI ${config.baseUrl} | grep x-everystack-release`);
+      }
+
       // Clean up archive
       await fs.unlink(archivePath).catch(() => {});
 
@@ -787,3 +808,38 @@ export function getExpoRouterSsrFlags(appConfig: any): {
   }
   return { useServerRendering: false, useServerDataLoaders: false };
 }
+
+const VERIFY_CONSECUTIVE = 3;
+const VERIFY_INTERVAL_MS = 2_000;
+const VERIFY_TIMEOUT_MS = 30_000;
+
+/**
+ * Poll the origin until N consecutive responses carry the expected updateId.
+ * Uses a cache-busting query param so each request reaches the Lambda origin.
+ * @internal Exported for testing.
+ */
+export async function verifyOriginRelease(
+  baseUrl: string,
+  expectedUpdateId: string,
+): Promise<boolean> {
+  const deadline = Date.now() + VERIFY_TIMEOUT_MS;
+  let consecutive = 0;
+
+  while (Date.now() < deadline) {
+    try {
+      const probe = `${baseUrl}?_probe=${Date.now()}`;
+      const res = await fetch(probe, { redirect: 'follow' });
+      const release = res.headers.get('x-everystack-release');
+      if (release === expectedUpdateId) {
+        consecutive++;
+        if (consecutive >= VERIFY_CONSECUTIVE) return true;
+      } else {
+        consecutive = 0;
+      }
+    } catch {
+      consecutive = 0;
+    }
+    await new Promise((r) => setTimeout(r, VERIFY_INTERVAL_MS));
+  }
+  return false;
+}

package/src/cli/component-audit.ts

@@ -17,12 +17,12 @@
  * this file; this file imports the model, never the reverse.
  */
 
-import type { AuditFinding, SourceLoc } from './bundle-audit.js';
-import type { ComponentDescriptor, JsxNode } from './component-model.js';
-import { canonicalizeStyle, isDesignStyle, type UiBloatBudget } from './ui-bloat.js';
+import type { AuditFinding, SourceLoc } from './bundle-audit';
+import type { ComponentDescriptor, JsxNode } from './component-model';
+import { canonicalizeStyle, isDesignStyle, type UiBloatBudget } from './ui-bloat';
 
-export { DEFAULT_UI_BLOAT_BUDGET, type UiBloatBudget } from './ui-bloat.js';
-import { DEFAULT_UI_BLOAT_BUDGET } from './ui-bloat.js';
+export { DEFAULT_UI_BLOAT_BUDGET, type UiBloatBudget } from './ui-bloat';
+import { DEFAULT_UI_BLOAT_BUDGET } from './ui-bloat';
 
 const VERIFY = 'rerun ui:audit; this finding clears when its occurrence count drops below the threshold';
 

package/src/cli/config.ts

@@ -9,7 +9,7 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { step } from './output.js';
+import { step } from './output';
 
 export interface CliConfig {
   baseUrl: string;
@@ -91,7 +91,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
       discoverConfig,
       getCachedConfig,
       setCachedConfig,
-    } = await import('./discover.js');
+    } = await import('./discover');
 
     // Check cache first
     const cached = await getCachedConfig(stage);

package/src/cli/db-build.ts

@@ -11,13 +11,13 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import type { TableContract, QueryRunner } from './authz-contract.js';
-import type { SourceObject } from './derived-source.js';
+import type { TableContract, QueryRunner } from './authz-contract';
+import type { SourceObject } from './derived-source';
 import type { SequenceDescriptor } from '@everystack/model';
-import { compileDeclaredState } from './declared-diff.js';
-import { createUrlRunner } from './db-source.js';
-import { executeSync, buildSyncReport } from './commands/db-sync.js';
-import { executeReconcile } from './commands/db-reconcile.js';
+import { compileDeclaredState } from './declared-diff';
+import { createUrlRunner } from './db-source';
+import { executeSync, buildSyncReport } from './commands/db-sync';
+import { executeReconcile } from './commands/db-reconcile';
 
 const SAFE_NAME = /^[a-z_][a-z0-9_$]*$/;
 

package/src/cli/db-source.ts

@@ -24,8 +24,8 @@
  * driver only surfaces — with instructions — when the direct path is actually used.
  */
 
-import type { QueryRunner } from './authz-contract.js';
-import { buildSearchPathSql, type SessionRunner, type SessionResult } from './session.js';
+import type { QueryRunner } from './authz-contract';
+import { buildSearchPathSql, type SessionRunner, type SessionResult } from './session';
 
 export type DbSource =
   | { kind: 'url'; url: string; from: 'flag' | 'env' | 'admin-env' | 'operator' }

package/src/cli/declared-derived.ts

@@ -13,11 +13,11 @@ import fs from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
 import { moduleGovernedRoles } from '@everystack/model';
-import { compileDerived } from './derived-compile.js';
-import { compileTableRenames, compileTableMoves } from './schema-compile.js';
-import type { SourceObject } from './derived-source.js';
-import { resolveModelsPath } from './models-path.js';
-import { asModelComposeError } from './ops-advice.js';
+import { compileDerived } from './derived-compile';
+import { compileTableRenames, compileTableMoves } from './schema-compile';
+import type { SourceObject } from './derived-source';
+import { resolveModelsPath } from './models-path';
+import { asModelComposeError } from './ops-advice';
 
 export interface DeclaredDerived {
   /** Descriptor-compiled derived objects, in dependency order. */

package/src/cli/declared-diff.ts

@@ -27,11 +27,11 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { compileTableSchema, compileEnums } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { generateMigrationSql } from './migration-generate.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { compileTableSchema, compileEnums } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { generateMigrationSql } from './migration-generate';
 
 export interface DeclaredState {
   snapshot: SchemaSnapshot;

package/src/cli/deploy-probe.ts

@@ -16,9 +16,9 @@
  * and must never fail the deploy.
  */
 
-import { isOpsHandlerCrash } from './ops-diagnostics.js';
-import { diagnoseOpsCrash, importOptionalAws } from './aws.js';
-import { step, success, fail, info } from './output.js';
+import { isOpsHandlerCrash } from './ops-diagnostics';
+import { diagnoseOpsCrash, importOptionalAws } from './aws';
+import { step, success, fail, info } from './output';
 
 /** The raw outcome of one probe invoke, before classification. */
 export interface ProbeOutcome {

package/src/cli/derived-apply.ts

@@ -13,11 +13,11 @@
  * the reconciler writes it and never reads it.
  */
 
-import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
-import type { ReconcilePlan } from './derived-plan.js';
-import { parseGrantAttachments } from './derived-grants.js';
-import { quoteIdent, quoteQualified } from './pg-ident.js';
-import { splitFunctionIdentity } from './pg-argtypes.js';
+import { normalizeSql, parseQualified, type SourceObject } from './derived-source';
+import type { ReconcilePlan } from './derived-plan';
+import { parseGrantAttachments } from './derived-grants';
+import { quoteIdent, quoteQualified } from './pg-ident';
+import { splitFunctionIdentity } from './pg-argtypes';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
 export function escapeLiteral(value: string): string {

package/src/cli/derived-compile.ts

@@ -21,10 +21,10 @@ import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
   FunctionDescriptor, SqlDescriptor, TriggerSpec, TriggerDescriptor, Ability, SetofReturn, DependsOnRef,
 } from '@everystack/model';
-import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source.js';
-import { isPlainGrantAttachment } from './derived-grants.js';
-import { functionIdentity } from './pg-argtypes.js';
-import { findInvokerReachabilityGaps } from './derived-lint.js';
+import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source';
+import { isPlainGrantAttachment } from './derived-grants';
+import { functionIdentity } from './pg-argtypes';
+import { findInvokerReachabilityGaps } from './derived-lint';
 
 /** The provenance marker for descriptor-compiled objects (SourceObject.file). */
 const DECLARED = DECLARED_SOURCE_FILE;

package/src/cli/derived-grants.ts

@@ -23,7 +23,7 @@
  * silently half-diffed.
  */
 
-import type { Attachment } from './derived-source.js';
+import type { Attachment } from './derived-source';
 
 export interface ParsedGrants {
   /** grantee → sorted privileges. PUBLIC present-with-[] means explicitly revoked. */

package/src/cli/derived-introspect.ts

@@ -18,9 +18,9 @@
  */
 
 import { createHash } from 'node:crypto';
-import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract.js';
-import { normalizeSql, type DerivedKind } from './derived-source.js';
-import { INTROSPECTION_SESSION, rowsOrEmpty, type SessionRunner } from './session.js';
+import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract';
+import { normalizeSql, type DerivedKind } from './derived-source';
+import { INTROSPECTION_SESSION, rowsOrEmpty, type SessionRunner } from './session';
 
 export interface LiveObject {
   kind: DerivedKind;

package/src/cli/derived-lint.ts

@@ -31,8 +31,8 @@ import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
   FunctionDescriptor, DependsOnRef,
 } from '@everystack/model';
-import { parseQualified } from './derived-source.js';
-import { GOVERNED_VOCABULARY } from './authz-derive.js';
+import { parseQualified } from './derived-source';
+import { GOVERNED_VOCABULARY } from './authz-derive';
 
 export interface DerivedAuthzGap {
   /** `schema.name` of the descriptor that fails the gate. */

package/src/cli/derived-plan.ts

@@ -24,11 +24,11 @@
  * drift report, not a silent skip.
  */
 
-import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source.js';
-import type { DerivedCatalog, LiveObject } from './derived-introspect.js';
-import { triggerDropSql } from './derived-apply.js';
-import { parseGrantAttachments, diffObjectGrants } from './derived-grants.js';
-import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes.js';
+import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source';
+import type { DerivedCatalog, LiveObject } from './derived-introspect';
+import { triggerDropSql } from './derived-apply';
+import { parseGrantAttachments, diffObjectGrants } from './derived-grants';
+import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes';
 
 export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'rebaseline' | 'prune' | 'backfill';
 

package/src/cli/derived-render.ts

@@ -13,12 +13,12 @@
  * checklist effect, on purpose — never a silent drop.
  */
 
-import type { DerivedCatalog, LiveObject } from './derived-introspect.js';
-import type { ColumnSchema, SequenceSchema, TableSchema } from './schema-introspect.js';
-import { parseIndexDefinition } from './schema-introspect.js';
-import { modelImportPath, renderFieldLines } from './model-render.js';
-import { splitFunctionIdentity } from './pg-argtypes.js';
-import { GOVERNED_VOCABULARY, KNOWN_ROLES } from './authz-derive.js';
+import type { DerivedCatalog, LiveObject } from './derived-introspect';
+import type { ColumnSchema, SequenceSchema, TableSchema } from './schema-introspect';
+import { parseIndexDefinition } from './schema-introspect';
+import { modelImportPath, renderFieldLines } from './model-render';
+import { splitFunctionIdentity } from './pg-argtypes';
+import { GOVERNED_VOCABULARY, KNOWN_ROLES } from './authz-derive';
 
 export interface DerivedRenderResult {
   /** The source block: `export const … = defineView(…)` etc., dependency-ordered. */

package/src/cli/direct-venue.ts

@@ -11,8 +11,8 @@
  * never written, never exported. Callers pass it straight to createUrlRunner and drop it.
  */
 
-import { resolveConfig, opsFunction } from './config.js';
-import { invokeAction } from './aws.js';
+import { resolveConfig, opsFunction } from './config';
+import { invokeAction } from './aws';
 
 export interface OperatorConnection {
   /** The operator connection string — hold in memory, never print. */

package/src/cli/discover.ts

@@ -13,7 +13,7 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { importOptionalAws } from './aws.js';
+import { importOptionalAws } from './aws';
 
 /** Mirrors CliConfig from config.ts — defined locally to avoid circular imports. */
 interface DiscoveredConfig {
@@ -285,7 +285,7 @@ export async function discoverConfig(
   // Distribution discovery is best-effort (status CDN section, cache:purge --invalidate)
   let distributionId: string | undefined;
   try {
-    const { discoverDistribution } = await import('./discover-distribution.js');
+    const { discoverDistribution } = await import('./discover-distribution');
     const routerHost = lambdaResult.routerUrl
       ? new URL(lambdaResult.routerUrl).host
       : undefined;

package/src/cli/edge-plan.ts

@@ -26,14 +26,14 @@
 
 import { createHash } from 'node:crypto';
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { generateMigrationSql, unmodeledTables } from './migration-generate.js';
-import { compileTableContract } from './authz-compile.js';
-import { classifyGeneratedStatements, classifyDestructive, partitionStatements, renderStatementHistogram } from './state-apply.js';
-import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, FINGERPRINT_VERSION } from './schema-fingerprint.js';
-import { compileDeclaredState } from './declared-diff.js';
-import { compileTableRenames, compileTableMoves } from './schema-compile.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { generateMigrationSql, unmodeledTables } from './migration-generate';
+import { compileTableContract } from './authz-compile';
+import { classifyGeneratedStatements, classifyDestructive, partitionStatements, renderStatementHistogram } from './state-apply';
+import { fingerprintLive, fingerprintState, fingerprintModels, governedRolesForModels, stableStringify, compareStoredFingerprint, formatChangedMessage, FINGERPRINT_VERSION } from './schema-fingerprint';
+import { compileDeclaredState } from './declared-diff';
+import { compileTableRenames, compileTableMoves } from './schema-compile';
 
 export const PLAN_VERSION = 2;
 

package/src/cli/exec-digest.ts

@@ -21,7 +21,7 @@
  * models?". Server-side, no CLI/model dependency: a plain string that any runner can execute.
  */
 
-import { escapeLiteral } from './derived-apply.js';
+import { escapeLiteral } from './derived-apply';
 
 /**
  * Build the digest query. Returns SQL selecting a single `digest` column (md5 hex, or md5('')

package/src/cli/exec-execute.ts

@@ -15,7 +15,7 @@
  */
 
 import { createHash } from 'node:crypto';
-import { lex } from './derived-source.js';
+import { lex } from './derived-source';
 
 export interface ExecIntent {
   /** sha256 of the exact file bytes — content identity + a free join to a consumer's stage sha. */

package/src/cli/exec-log.ts

@@ -11,7 +11,7 @@
  * Mirrors everystack.backfill_log: a per-database ledger the way schema_log is a write-only memoir.
  */
 
-import { escapeLiteral } from './derived-apply.js';
+import { escapeLiteral } from './derived-apply';
 
 export const ENSURE_EXEC_LOG_SQL: string[] = [
   'CREATE SCHEMA IF NOT EXISTS everystack',

package/src/cli/exec-run.ts

@@ -19,8 +19,8 @@
  * (against PostgreSQL) is in __tests__/integration/exec.test.ts.
  */
 
-import { splitSqlStatements } from './derived-source.js';
-import { catalogDigestQuery } from './exec-digest.js';
+import { splitSqlStatements } from './derived-source';
+import { catalogDigestQuery } from './exec-digest';
 
 /** The normalized result of one statement: its rows and how many it affected. */
 export interface ExecStmtResult {

package/src/cli/git-descent.ts

@@ -29,11 +29,11 @@ import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { ModelDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { fingerprintLive } from './schema-fingerprint.js';
-import { predictLiveFingerprint, governedLiveFingerprint } from './edge-plan.js';
-import { governedRolesForModels } from './schema-fingerprint.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { fingerprintLive } from './schema-fingerprint';
+import { predictLiveFingerprint, governedLiveFingerprint } from './edge-plan';
+import { governedRolesForModels } from './schema-fingerprint';
 
 /** Compile a models barrel on disk. The default rides the CLI's runtime (tsx). */
 export type ModelsLoader = (barrel: string) => Promise<ModelDescriptor[]>;

package/src/cli/index.ts

@@ -2,51 +2,51 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { updateCommand } from './commands/update.js';
-import { deployCommand } from './commands/deploy.js';
-import { certsCommand } from './commands/certs.js';
-import { channelsCommand } from './commands/channels.js';
-import { branchesCommand } from './commands/branches.js';
-import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db.js';
-import { dbAuthzPullCommand, dbAuthzDiffCommand, dbAuthzTestCommand, dbAuthzOwnerCommand, dbAuthzReportCommand } from './commands/db-authz.js';
-import { dbGenerateCommand } from './commands/db-generate.js';
-import { dbPullCommand } from './commands/db-pull.js';
-import { dbReconcileCommand } from './commands/db-reconcile.js';
-import { dbRefreshCommand } from './commands/db-refresh.js';
-import { dbFingerprintCommand } from './commands/db-fingerprint.js';
-import { dbSyncCommand } from './commands/db-sync.js';
-import { dbDiffCommand } from './commands/db-diff.js';
-import { dbPlanCommand } from './commands/db-plan.js';
-import { dbApplyCommand } from './commands/db-apply.js';
-import { dbCheckCommand } from './commands/db-check.js';
-import { dbBuildCommand } from './commands/db-build.js';
-import { dbApproversCommand } from './commands/db-approvers.js';
-import { dbBackfillCommand } from './commands/db-backfill.js';
-import { dbExecCommand } from './commands/db-exec.js';
-import { taskProbeCommand } from './commands/task-probe.js';
-import { pipelineRunCommand, pipelineListCommand } from './commands/pipeline-run.js';
-import { dbTemplateRefreshCommand, dbBranchCommand } from './commands/db-branch.js';
-import { dbForkCommand } from './commands/db-fork.js';
-import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot.js';
-import { dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup.js';
-import { dbExportCommand } from './commands/db-export.js';
-import { dbSwapCommand } from './commands/db-swap.js';
-import { consoleCommand } from './commands/console.js';
-import { cachePurgeCommand } from './commands/cache.js';
-import { statusCommand } from './commands/status.js';
-import { diagCommand } from './commands/diag.js';
-import { analyzeSSRCommand } from './commands/analyze.js';
-import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
-import { secretsCommand } from './commands/secrets.js';
-import { securityAuditCommand } from './commands/security.js';
-import { securityProbeCommand } from './commands/security-probe.js';
-import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle.js';
-import { auditLighthouseCommand } from './commands/lighthouse.js';
-import { auditCommand } from './commands/audit.js';
-import { uiAuditCommand } from './commands/ui-audit.js';
-import { runbookCommand } from './commands/runbook.js';
-import { fail } from './output.js';
-import { parseFlags } from './parse-flags.js';
+import { updateCommand } from './commands/update';
+import { deployCommand } from './commands/deploy';
+import { certsCommand } from './commands/certs';
+import { channelsCommand } from './commands/channels';
+import { branchesCommand } from './commands/branches';
+import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db';
+import { dbAuthzPullCommand, dbAuthzDiffCommand, dbAuthzTestCommand, dbAuthzOwnerCommand, dbAuthzReportCommand } from './commands/db-authz';
+import { dbGenerateCommand } from './commands/db-generate';
+import { dbPullCommand } from './commands/db-pull';
+import { dbReconcileCommand } from './commands/db-reconcile';
+import { dbRefreshCommand } from './commands/db-refresh';
+import { dbFingerprintCommand } from './commands/db-fingerprint';
+import { dbSyncCommand } from './commands/db-sync';
+import { dbDiffCommand } from './commands/db-diff';
+import { dbPlanCommand } from './commands/db-plan';
+import { dbApplyCommand } from './commands/db-apply';
+import { dbCheckCommand } from './commands/db-check';
+import { dbBuildCommand } from './commands/db-build';
+import { dbApproversCommand } from './commands/db-approvers';
+import { dbBackfillCommand } from './commands/db-backfill';
+import { dbExecCommand } from './commands/db-exec';
+import { taskProbeCommand } from './commands/task-probe';
+import { pipelineRunCommand, pipelineListCommand } from './commands/pipeline-run';
+import { dbTemplateRefreshCommand, dbBranchCommand } from './commands/db-branch';
+import { dbForkCommand } from './commands/db-fork';
+import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot';
+import { dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup';
+import { dbExportCommand } from './commands/db-export';
+import { dbSwapCommand } from './commands/db-swap';
+import { consoleCommand } from './commands/console';
+import { cachePurgeCommand } from './commands/cache';
+import { statusCommand } from './commands/status';
+import { diagCommand } from './commands/diag';
+import { analyzeSSRCommand } from './commands/analyze';
+import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs';
+import { secretsCommand } from './commands/secrets';
+import { securityAuditCommand } from './commands/security';
+import { securityProbeCommand } from './commands/security-probe';
+import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle';
+import { auditLighthouseCommand } from './commands/lighthouse';
+import { auditCommand } from './commands/audit';
+import { uiAuditCommand } from './commands/ui-audit';
+import { runbookCommand } from './commands/runbook';
+import { fail } from './output';
+import { parseFlags } from './parse-flags';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -109,7 +109,7 @@ async function main() {
   // (loadSstOutputs and resolveConfig both consult it). Use after a deploy the CLI didn't run,
   // or whenever a stage command resolves to the wrong function.
   if (flags.refresh && flags.stage) {
-    const { invalidateCachedConfig } = await import('./discover.js');
+    const { invalidateCachedConfig } = await import('./discover');
     await invalidateCachedConfig(flags.stage);
   }
 

package/src/cli/migration-compile.ts

@@ -20,13 +20,13 @@
  */
 
 import type { ModelDescriptor, Module, SequenceDescriptor } from '@everystack/model';
-import type { AuthzContract, TableContract } from './authz-contract.js';
-import { compileCreateTable, compileEnums, compileSequences, sequenceCreateSql, foreignKeySql, modelConstraintSpecs, qualifiedTable, toSnakeCase, type CompileTableOptions } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql } from './authz-reconcile.js';
-import { emitSchemaSql, nextvalSequence, type SchemaChange } from './schema-diff.js';
-import { compileDerived } from './derived-compile.js';
-import { renderEnsureObjectSchemas } from './derived-apply.js';
+import type { AuthzContract, TableContract } from './authz-contract';
+import { compileCreateTable, compileEnums, compileSequences, sequenceCreateSql, foreignKeySql, modelConstraintSpecs, qualifiedTable, toSnakeCase, type CompileTableOptions } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { emitReconcileSql } from './authz-reconcile';
+import { emitSchemaSql, nextvalSequence, type SchemaChange } from './schema-diff';
+import { compileDerived } from './derived-compile';
+import { renderEnsureObjectSchemas } from './derived-apply';
 
 /** The empty (not-yet-created) authz state for a table — the greenfield baseline. */
 function emptyTable(table: string): TableContract {

package/src/cli/migration-generate.ts

@@ -16,12 +16,12 @@
  */
 
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
-import type { SchemaSnapshot } from './schema-introspect.js';
-import type { AuthzContract } from './authz-contract.js';
-import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile.js';
-import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql, governedRoleSet } from './authz-reconcile.js';
-import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff.js';
+import type { SchemaSnapshot } from './schema-introspect';
+import type { AuthzContract } from './authz-contract';
+import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile';
+import { compileTableContract } from './authz-compile';
+import { emitReconcileSql, governedRoleSet } from './authz-reconcile';
+import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff';
 
 export interface GenerateOptions {
   /** The Postgres schema the Models live in. Default: `public`. */