@everystack/cli 0.4.60 → 0.4.64

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.60",
+  "version": "0.4.64",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -23,70 +23,87 @@
   ],
   "exports": {
     ".": {
+      "source": "./src/index.ts",
       "types": "./src/index.ts",
       "default": "./src/index.ts"
     },
     "./model": {
+      "source": "./src/cli/model-api.ts",
       "types": "./src/cli/model-api.ts",
       "default": "./src/cli/model-api.ts"
     },
     "./audit": {
+      "source": "./src/cli/audit-api.ts",
       "types": "./src/cli/audit-api.ts",
       "default": "./src/cli/audit-api.ts"
     },
     "./apply": {
+      "source": "./src/cli/apply-execute.ts",
       "types": "./src/cli/apply-execute.ts",
       "default": "./src/cli/apply-execute.ts"
     },
     "./db-source": {
+      "source": "./src/cli/db-source.ts",
       "types": "./src/cli/db-source.ts",
       "default": "./src/cli/db-source.ts"
     },
     "./reconcile": {
+      "source": "./src/reconcile.ts",
       "types": "./src/reconcile.ts",
       "default": "./src/reconcile.ts"
     },
     "./refresh": {
+      "source": "./src/refresh.ts",
       "types": "./src/refresh.ts",
       "default": "./src/refresh.ts"
     },
     "./backfill": {
+      "source": "./src/backfill.ts",
       "types": "./src/backfill.ts",
       "default": "./src/backfill.ts"
     },
     "./exec": {
+      "source": "./src/exec.ts",
       "types": "./src/exec.ts",
       "default": "./src/exec.ts"
     },
     "./audit/source": {
+      "source": "./src/cli/audit-source-api.ts",
       "types": "./src/cli/audit-source-api.ts",
       "default": "./src/cli/audit-source-api.ts"
     },
     "./runbook": {
+      "source": "./src/cli/runbook/index.ts",
       "types": "./src/cli/runbook/index.ts",
       "default": "./src/cli/runbook/index.ts"
     },
     "./client": {
+      "source": "./src/client/index.ts",
       "types": "./src/client/index.ts",
       "default": "./src/client/index.ts"
     },
     "./schema": {
+      "source": "./src/schema.ts",
       "types": "./src/schema.ts",
       "default": "./src/schema.ts"
     },
     "./handler": {
+      "source": "./src/handler/index.ts",
       "types": "./src/handler/index.ts",
       "default": "./src/handler/index.ts"
     },
     "./plugin": {
+      "source": "./src/plugin.ts",
       "types": "./src/plugin.ts",
       "default": "./src/plugin.ts"
     },
     "./env": {
+      "source": "./src/env.ts",
       "types": "./src/env.ts",
       "default": "./src/env.js"
     },
     "./sst": {
+      "source": "./src/sst.ts",
       "types": "./src/sst.ts",
       "default": "./src/sst.ts"
     }
@@ -160,7 +177,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.21"
+    "@everystack/server": "0.4.25"
   },
   "scripts": {
     "test": "jest",

package/src/backfill.ts

@@ -13,11 +13,11 @@ export {
   readBackfillLog,
   executeBackfills,
   markBackfillApplied,
-} from './cli/backfill.js';
+} from './cli/backfill';
 export type {
   BackfillPlan,
   BackfillRecord,
   BackfillRunOptions,
   BackfillRunResult,
-} from './cli/backfill.js';
-export type { SourceFile } from './cli/derived-source.js';
+} from './cli/backfill';
+export type { SourceFile } from './cli/derived-source';

package/src/cli/alter-type-dependents.ts

@@ -12,7 +12,7 @@
  * `db:swap`, or drop and re-create the derived objects around the change.
  */
 
-import type { QueryRunner } from './authz-contract.js';
+import type { QueryRunner } from './authz-contract';
 
 export interface AlterTypeTarget {
   table: string;

package/src/cli/apply-authority.ts

@@ -24,7 +24,7 @@
  * by the command shell.
  */
 
-import { importOptionalAws } from './aws.js';
+import { importOptionalAws } from './aws';
 
 /** The SSM parameter holding the approver set — a JSON array of entries. */
 export function approverParamName(appName: string, stage: string): string {

package/src/cli/apply-execute.ts

@@ -29,15 +29,15 @@
  * and the memoir stay here, atomic with the connection.
  */
 
-import { introspectContract, type QueryRunner, type AuthzContract } from './authz-contract.js';
-import type { SessionRunner } from './session.js';
-import { introspectSchema, type SchemaSnapshot } from './schema-introspect.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog.js';
-import { fingerprintLive } from './schema-fingerprint.js';
-import { governedLiveFingerprint } from './edge-plan.js';
-import { applyGeneratedStatements } from './state-apply.js';
-import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply.js';
-import { checkPlanPrecondition, planHash, type EdgePlan } from './edge-plan.js';
+import { introspectContract, type QueryRunner, type AuthzContract } from './authz-contract';
+import type { SessionRunner } from './session';
+import { introspectSchema, type SchemaSnapshot } from './schema-introspect';
+import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog';
+import { fingerprintLive } from './schema-fingerprint';
+import { governedLiveFingerprint } from './edge-plan';
+import { applyGeneratedStatements } from './state-apply';
+import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply';
+import { checkPlanPrecondition, planHash, type EdgePlan } from './edge-plan';
 
 export interface ApplyPlanOptions {
   actor?: string | null;
@@ -237,4 +237,4 @@ export async function executeApplyPlan(
 // Re-exported so a single import (`@everystack/cli/apply`) gives a consumer —
 // notably the ops Lambda's db:apply action — everything it needs to validate
 // and run a plan without reaching into the CLI's internal module layout.
-export { PLAN_VERSION, planHash, checkPlanPrecondition, type EdgePlan } from './edge-plan.js';
+export { PLAN_VERSION, planHash, checkPlanPrecondition, type EdgePlan } from './edge-plan';

package/src/cli/audit-api.ts

@@ -28,7 +28,7 @@ export {
   classifyPrivateEnvKeys,
   scanSecretValue,
   summarize,
-} from './bundle-audit.js';
+} from './bundle-audit';
 
 export {
   // types
@@ -45,7 +45,7 @@ export {
   scanSourceMapsPresent,
   scanDependencyWeight,
   resolveWeightBudget,
-} from './bundle-weight.js';
+} from './bundle-weight';
 
 export {
   // types
@@ -59,7 +59,7 @@ export {
   scanHardcodedColors,
   scanBundleUiBloat,
   resolveUiBloatBudget,
-} from './ui-bloat.js';
+} from './ui-bloat';
 
 // NOTE: the source-side AST scanners (component-audit + component-model) moved to
 // `@everystack/cli/audit/source` — they pull in `typescript`, which this barrel must
@@ -76,4 +76,4 @@ export {
   totalSizes,
   bucketSource,
   composeSourceMap,
-} from './bundle.js';
+} from './bundle';

package/src/cli/audit-source-api.ts

@@ -22,7 +22,7 @@ export {
   scanDuplicateJsx,
   scanDuplicateComponents,
   auditComponents,
-} from './component-audit.js';
+} from './component-audit';
 
 export {
   // types — the faithful component model (shared with the 5b frontend Module)
@@ -33,4 +33,4 @@ export {
   // the source-side foundation: parse/discover .tsx into neutral descriptors
   parseComponents,
   discoverComponents,
-} from './component-model.js';
+} from './component-model';

package/src/cli/authz-adoption-class.ts

@@ -28,10 +28,10 @@
  * output so the two can never drift apart.
  */
 
-import { matchPolicies, roleSetEqual } from './authz-identity.js';
-import { governedRoleSet } from './authz-reconcile.js';
-import { effectivePolicyCheck, holdsPrivilege, isPolicyDead, policyCommands } from './authz-contract.js';
-import type { AuthzContract, PolicyContract, TableContract } from './authz-contract.js';
+import { matchPolicies, roleSetEqual } from './authz-identity';
+import { governedRoleSet } from './authz-reconcile';
+import { effectivePolicyCheck, holdsPrivilege, isPolicyDead, policyCommands } from './authz-contract';
+import type { AuthzContract, PolicyContract, TableContract } from './authz-contract';
 
 export type AdoptionClass = 'convention' | 'capability' | 'narrowing' | 'dead' | 'unclassified';
 

package/src/cli/authz-baseline.ts

@@ -36,8 +36,8 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { FINGERPRINT_VERSION } from './schema-fingerprint.js';
-import type { GrantExemption } from './authz-reconcile.js';
+import { FINGERPRINT_VERSION } from './schema-fingerprint';
+import type { GrantExemption } from './authz-reconcile';
 
 /** The repo-relative artifact. Generated — regenerating it must reproduce it byte for byte. */
 export const BASELINE_FILE = 'db/authz-baseline.json';

package/src/cli/authz-canonical.ts

@@ -31,8 +31,8 @@
  * the same identity break in the opposite direction, and it is the harder one to notice.
  */
 
-import type { PolicyContract, TableContract } from './authz-contract.js';
-import { effectivePolicyCheck, isPolicyDead, isPolicySubsumed } from './authz-contract.js';
+import type { PolicyContract, TableContract } from './authz-contract';
+import { effectivePolicyCheck, isPolicyDead, isPolicySubsumed } from './authz-contract';
 
 /** PostgreSQL's open role set, kept whole. */
 const PUBLIC_ROLE = 'public';

package/src/cli/authz-compile.ts

@@ -21,9 +21,9 @@
  */
 
 import { isColumnAbility, type ModelDescriptor, type Ability } from '@everystack/model';
-import type { PolicyContract, TableContract, PolicyCommand } from './authz-contract.js';
-import { parenthesizeOnce } from './authz-contract.js';
-import { normalizeDeparsedExpr } from './deparse-normal.js';
+import type { PolicyContract, TableContract, PolicyCommand } from './authz-contract';
+import { parenthesizeOnce } from './authz-contract';
+import { normalizeDeparsedExpr } from './deparse-normal';
 
 export interface CompileOptions {
   /** Schema the table lives in. Default: `public`. */

package/src/cli/authz-contract-io.ts

@@ -9,8 +9,8 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import type { AuthzContract, TableContract, FunctionContract } from './authz-contract.js';
-import { renderContractMarkdown } from './authz-render.js';
+import type { AuthzContract, TableContract, FunctionContract } from './authz-contract';
+import { renderContractMarkdown } from './authz-render';
 
 /** The human-readable review doc written alongside the JSON. */
 export const REVIEW_FILE = 'AUTHORIZATION.md';

package/src/cli/authz-contract.ts

@@ -21,10 +21,10 @@
  *   - The contract is a strict sublayer of the Model: defineModel compiles to it.
  */
 
-import { parsePgArray } from './security-catalog.js';
-import { INTROSPECTION_SESSION, type SessionRunner } from './session.js';
-import { matchPolicies, roleSetEqual } from './authz-identity.js';
-import { normalizeDeparsedExpr } from './deparse-normal.js';
+import { parsePgArray } from './security-catalog';
+import { INTROSPECTION_SESSION, type SessionRunner } from './session';
+import { matchPolicies, roleSetEqual } from './authz-identity';
+import { normalizeDeparsedExpr } from './deparse-normal';
 
 // ---------------------------------------------------------------------------
 // The contract format — the frozen, reviewable, version-controlled shape.

package/src/cli/authz-derive.ts

@@ -26,8 +26,8 @@
  */
 
 import { EXTRA_PRIVILEGES } from '@everystack/model';
-import { holdsPrivilege, holdsTablePrivilege } from './authz-contract.js';
-import type { TableContract, PolicyContract } from './authz-contract.js';
+import { holdsPrivilege, holdsTablePrivilege } from './authz-contract';
+import type { TableContract, PolicyContract } from './authz-contract';
 
 /** One rendered decision: either an ability line, or a comment explaining the omission. */
 export interface DerivedAbilities {

package/src/cli/authz-identity.ts

@@ -34,7 +34,7 @@
  *    introspection's search_path is what closes that hole.
  */
 
-import { effectivePolicyCheck, type PolicyContract } from './authz-contract.js';
+import { effectivePolicyCheck, type PolicyContract } from './authz-contract';
 
 /**
  * Do two role lists name the same set?

package/src/cli/authz-ownership.ts

@@ -25,7 +25,7 @@
  */
 
 import type { WrittenBy, ModelDescriptor } from '@everystack/model';
-import { IGNORED_SCHEMAS, type QueryRunner, type AuthzContract } from './authz-contract.js';
+import { IGNORED_SCHEMAS, type QueryRunner, type AuthzContract } from './authz-contract';
 
 /**
  * Every base table with its owner. The exclusions are RLS_SQL's, verbatim — base

package/src/cli/authz-reconcile.ts

@@ -15,10 +15,10 @@
  * this layer reconciles without a migration file (unlike the data layer).
  */
 
-import type { AuthzContract, TableContract, PolicyContract, SequenceGrantContract } from './authz-contract.js';
-import { effectivePolicyCheck, parenthesizeOnce, isPolicyDead, isPolicySubsumed } from './authz-contract.js';
-import { matchPolicies } from './authz-identity.js';
-import { quoteQualified } from './pg-ident.js';
+import type { AuthzContract, TableContract, PolicyContract, SequenceGrantContract } from './authz-contract';
+import { effectivePolicyCheck, parenthesizeOnce, isPolicyDead, isPolicySubsumed } from './authz-contract';
+import { matchPolicies } from './authz-identity';
+import { quoteQualified } from './pg-ident';
 
 /**
  * Always governed, whatever the models say. `PUBLIC` because a grant to PUBLIC is the

package/src/cli/authz-redteam.ts

@@ -15,7 +15,7 @@
  * discards. Nothing persists; one round trip. The builder and evaluator here are pure.
  */
 
-import type { AuthzContract, TableContract } from './authz-contract.js';
+import type { AuthzContract, TableContract } from './authz-contract';
 
 export type ProbeCommand = 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE';
 export const PROBE_COMMANDS: ProbeCommand[] = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];

package/src/cli/authz-render.ts

@@ -13,8 +13,8 @@
  * throwaway. Anything it does not recognise is shown verbatim, never hidden.
  */
 
-import type { AuthzContract, TableContract, PolicyContract } from './authz-contract.js';
-import { hasPrivilege } from './authz-redteam.js';
+import type { AuthzContract, TableContract, PolicyContract } from './authz-contract';
+import { hasPrivilege } from './authz-redteam';
 
 /** True when the expression resolves to the signed-in user's id (any of the forms). */
 function isCurrentUserExpr(s: string): boolean {

package/src/cli/aws.ts

@@ -5,9 +5,9 @@
  * Authentication uses the developer's IAM credentials (default credential chain).
  */
 
-import { isOpsHandlerCrash, formatOpsCrashReport, fetchDiagnosisWithRetry } from './ops-diagnostics.js';
-import { tagInvokeTransport } from './ops-advice.js';
-import type { SessionRunner } from './session.js';
+import { isOpsHandlerCrash, formatOpsCrashReport, fetchDiagnosisWithRetry } from './ops-diagnostics';
+import { tagInvokeTransport } from './ops-advice';
+import type { SessionRunner } from './session';
 
 let s3Client: InstanceType<typeof import('@aws-sdk/client-s3').S3Client> | null = null;
 let lambdaClient: InstanceType<typeof import('@aws-sdk/client-lambda').LambdaClient> | null = null;
@@ -366,7 +366,7 @@ export async function invokeAction(
       const live = await resolveFunctionName(region, functionName);
       if (live === functionName) throw tagInvokeTransport(err);
       try {
-        const { invalidateCacheByFunctionName } = await import('./discover.js');
+        const { invalidateCacheByFunctionName } = await import('./discover');
         await invalidateCacheByFunctionName(functionName);
       } catch {
         // Cache invalidation is best-effort
@@ -559,6 +559,20 @@ export async function createInvalidation(
   return result.Invalidation?.Id;
 }
 
+/**
+ * Get the deploy status of a CloudFront distribution.
+ * Returns 'Deployed' when the distribution is fully propagated.
+ */
+export async function getDistributionStatus(
+  region: string,
+  distributionId: string,
+): Promise<string> {
+  const { CloudFrontClient, GetDistributionCommand } = await import('@aws-sdk/client-cloudfront');
+  const client = new CloudFrontClient({ region });
+  const result = await client.send(new GetDistributionCommand({ Id: distributionId }));
+  return result.Distribution?.Status ?? 'Unknown';
+}
+
 /**
  * Write a versioning key to CloudFront KeyValueStore.
  * KVS requires ETag for optimistic concurrency — DescribeKeyValueStore first.
@@ -712,3 +726,42 @@ export async function describeRdsSnapshots(
   summaries.sort((a, b) => (b.created?.getTime() ?? Infinity) - (a.created?.getTime() ?? Infinity));
   return summaries;
 }
+
+/**
+ * Force Lambda to retire all warm execution environments by bumping the
+ * EVERYSTACK_GEN environment variable. New requests cold-start fresh
+ * containers that pick up the latest S3 bundle.
+ *
+ * The call is a no-code-upload configuration change — it completes in ~2s,
+ * and Lambda drains in-flight requests before retiring each environment.
+ *
+ * Optional extraEnv merges additional env vars (e.g. rotated credentials).
+ * Existing env vars are preserved (read-modify-write).
+ */
+export async function rollingRestart(
+  region: string,
+  functionName: string,
+  extraEnv?: Record<string, string>,
+): Promise<{ previousGen: string; newGen: string }> {
+  const client = await getLambda(region);
+  const {
+    GetFunctionConfigurationCommand,
+    UpdateFunctionConfigurationCommand,
+  } = await import('@aws-sdk/client-lambda');
+
+  const current = await client.send(
+    new GetFunctionConfigurationCommand({ FunctionName: functionName }),
+  );
+  const env = current.Environment?.Variables ?? {};
+  const previousGen = env.EVERYSTACK_GEN ?? '0';
+  const newGen = String(Number(previousGen) + 1);
+
+  await client.send(new UpdateFunctionConfigurationCommand({
+    FunctionName: functionName,
+    Environment: {
+      Variables: { ...env, ...extraEnv, EVERYSTACK_GEN: newGen },
+    },
+  }));
+
+  return { previousGen, newGen };
+}

package/src/cli/backfill.ts

@@ -24,9 +24,9 @@
  */
 
 import { createHash } from 'node:crypto';
-import { lex, normalizeSql, splitSqlStatements, type SourceFile } from './derived-source.js';
-import { escapeLiteral } from './derived-apply.js';
-import type { QueryRunner } from './authz-contract.js';
+import { lex, normalizeSql, splitSqlStatements, type SourceFile } from './derived-source';
+import { escapeLiteral } from './derived-apply';
+import type { QueryRunner } from './authz-contract';
 
 // ---------------------------------------------------------------------------
 // Identity + advisories (pure).

package/src/cli/branch-db.ts

@@ -22,18 +22,18 @@
 import { createHash } from 'node:crypto';
 import { execSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import type { QueryRunner } from './authz-contract.js';
-import { escapeLiteral } from './derived-apply.js';
-import { createUrlRunner } from './db-source.js';
+import type { QueryRunner } from './authz-contract';
+import { escapeLiteral } from './derived-apply';
+import { createUrlRunner } from './db-source';
 import {
   withDatabase,
   createDatabase,
   dropDatabase,
   buildIntoDatabase,
   type BuildOptions,
-} from './db-build.js';
+} from './db-build';
 
-export { withDatabase } from './db-build.js';
+export { withDatabase } from './db-build';
 
 // ---------------------------------------------------------------------------
 // Naming (pure).

package/src/cli/bundle-weight.ts

@@ -18,8 +18,8 @@
  * without touching the filesystem.
  */
 
-import type { AuditFinding } from './bundle-audit.js';
-import type { Composition } from './bundle.js';
+import type { AuditFinding } from './bundle-audit';
+import type { Composition } from './bundle';
 
 /** One file's relative path and byte size — the only input the gates need. */
 export interface AssetFile {

package/src/cli/commands/analyze.ts

@@ -9,8 +9,8 @@
  */
 
 import path from 'node:path';
-import { analyzeSSRPatterns, generateSSRReport } from '../ssr-analyzer.js';
-import { step, success, fail, info } from '../output.js';
+import { analyzeSSRPatterns, generateSSRReport } from '../ssr-analyzer';
+import { step, success, fail, info } from '../output';
 
 export async function analyzeSSRCommand(
   _positional: string | undefined,

package/src/cli/commands/audit.ts

@@ -8,16 +8,16 @@
  * the heavier `audit:lighthouse` stay separate commands (run them explicitly).
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { runBundleAudit, runBundleWeightAudit, reportBundleAudit } from './bundle.js';
-import { runUiAudit, reportUiAudit } from './ui-audit.js';
-import { checkRunbook } from './runbook.js';
-import { resolveWeightBudget } from '../bundle-weight.js';
-import { runSecurityProbe, reportProbeResults } from './security-probe.js';
-import { auditDeployedSql, printReport, loadWaivers } from './security.js';
-import { collectLighthouseRuns } from './lighthouse.js';
-import { aggregate, formatLighthouseReport } from '../lighthouse.js';
-import { step, info, fail, success, warn } from '../output.js';
+import { resolveConfig, opsFunction } from '../config';
+import { runBundleAudit, runBundleWeightAudit, reportBundleAudit } from './bundle';
+import { runUiAudit, reportUiAudit } from './ui-audit';
+import { checkRunbook } from './runbook';
+import { resolveWeightBudget } from '../bundle-weight';
+import { runSecurityProbe, reportProbeResults } from './security-probe';
+import { auditDeployedSql, printReport, loadWaivers } from './security';
+import { collectLighthouseRuns } from './lighthouse';
+import { aggregate, formatLighthouseReport } from '../lighthouse';
+import { step, info, fail, success, warn } from '../output';
 
 export async function auditCommand(flags: Record<string, string>): Promise<void> {
   step('Resolving deployed config...');

package/src/cli/commands/bundle.ts

@@ -17,7 +17,7 @@ import {
   formatBundleReport,
   type ChunkInput,
   type Composition,
-} from '../bundle.js';
+} from '../bundle';
 import {
   scanSecretShapes,
   extractBundleUrls,
@@ -27,7 +27,7 @@ import {
   scanSecretValue,
   summarize,
   type AuditFinding,
-} from '../bundle-audit.js';
+} from '../bundle-audit';
 import {
   scanAssetWeights,
   scanTotalWeight,
@@ -42,14 +42,14 @@ import {
   DEFAULT_WEIGHT_BUDGET,
   type AssetFile,
   type WeightBudget,
-} from '../bundle-weight.js';
+} from '../bundle-weight';
 import {
   scanBundleUiBloat,
   DEFAULT_UI_BLOAT_BUDGET,
   type UiBloatBudget,
-} from '../ui-bloat.js';
-import { resolveConfig } from '../config.js';
-import { fail, info, step, success, warn } from '../output.js';
+} from '../ui-bloat';
+import { resolveConfig } from '../config';
+import { fail, info, step, success, warn } from '../output';
 
 // Expo Router web export puts client chunks under client/_expo/...; a plain
 // `expo export` omits the client/ prefix. Convention, not config.