@everystack/cli 0.4.60 → 0.4.64

package/src/cli/commands/cache.ts

@@ -9,9 +9,9 @@
  * Writes directly to CloudFront KVS — no Lambda invoke.
  */
 
-import { resolveConfig } from '../config.js';
-import { putKvsKey, createInvalidation } from '../aws.js';
-import { step, success, warn, fail, info } from '../output.js';
+import { resolveConfig } from '../config';
+import { putKvsKey, createInvalidation, getDistributionStatus, getFromS3 } from '../aws';
+import { step, success, warn, fail, info } from '../output';
 
 const VALID_ORIGINS = ['api', 'media', 'web'] as const;
 type CacheOrigin = typeof VALID_ORIGINS[number];
@@ -32,6 +32,19 @@ export async function cachePurgeCommand(flags: Record<string, string>): Promise<
     process.exit(1);
   }
 
+  const force = flags.force === 'true';
+
+  // Safety gate: verify the origin is serving the expected release and the distribution is stable.
+  if (!force) {
+    const channel = flags.channel || flags.stage || 'production';
+    const blocked = await preflight(config.region, config.baseUrl, config.updatesBucket, channel, config.distributionId);
+    if (blocked) {
+      fail(blocked);
+      info('Pass --force to override this check.');
+      process.exit(1);
+    }
+  }
+
   // Key resolution: --path wins > --origin > global
   let key: string;
   if (flags.path) {
@@ -91,3 +104,62 @@ export async function cachePurgeCommand(flags: Record<string, string>): Promise<
     }
   }
 }
+
+/**
+ * Pre-purge safety checks. Returns an error message if blocked, null if clear.
+ * @internal Exported for testing.
+ */
+export async function preflight(
+  region: string,
+  baseUrl: string,
+  updatesBucket: string,
+  channel: string,
+  distributionId?: string,
+): Promise<string | null> {
+  // 1. Read the channel pointer to get the expected updateId.
+  const pointerKey = `${channel}/web/manifest.json`;
+  const pointerData = await getFromS3(region, updatesBucket, pointerKey);
+  if (!pointerData) {
+    return `No release manifest found for channel "${channel}". Run \`everystack update\` first.`;
+  }
+  let expectedUpdateId: string;
+  try {
+    const pointer = JSON.parse(pointerData.toString('utf8'));
+    expectedUpdateId = pointer.updateId;
+  } catch {
+    return `Channel manifest for "${channel}" is malformed.`;
+  }
+  if (!expectedUpdateId) {
+    return `Channel manifest for "${channel}" has no updateId.`;
+  }
+
+  // 2. Probe the origin for the serving release.
+  try {
+    const probe = `${baseUrl}?_probe=${Date.now()}`;
+    const res = await fetch(probe, { redirect: 'follow' });
+    const serving = res.headers.get('x-everystack-release');
+    if (serving !== expectedUpdateId) {
+      return (
+        `Origin is serving release ${serving ? serving.slice(0, 12) + '...' : '(none)'} ` +
+        `but the channel pointer is ${expectedUpdateId.slice(0, 12)}.... ` +
+        `Purging now would expose stale containers to uncached traffic.`
+      );
+    }
+  } catch (err: any) {
+    return `Could not reach origin at ${baseUrl}: ${err.message}`;
+  }
+
+  // 3. Check distribution status (if discoverable).
+  if (distributionId) {
+    try {
+      const status = await getDistributionStatus(region, distributionId);
+      if (status !== 'Deployed') {
+        return `CloudFront distribution is "${status}" (not Deployed). Wait for propagation to finish.`;
+      }
+    } catch {
+      // Best-effort — missing permission is not a blocker.
+    }
+  }
+
+  return null;
+}

package/src/cli/commands/console.ts

@@ -15,12 +15,12 @@ import * as readline from 'node:readline';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { success, fail, info } from '../output.js';
-import { formatResult } from '../utils/table.js';
-import { isComplete } from '../utils/bracket-counter.js';
-import { createCompleter } from '../utils/completer.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction } from '../aws';
+import { success, fail, info } from '../output';
+import { formatResult } from '../utils/table';
+import { isComplete } from '../utils/bracket-counter';
+import { createCompleter } from '../utils/completer';
 
 const HISTORY_DIR = path.join(os.homedir(), '.everystack');
 const HISTORY_FILE = path.join(HISTORY_DIR, 'console_history');

package/src/cli/commands/db-apply.ts

@@ -30,33 +30,33 @@
  */
 
 import fs from 'node:fs/promises';
-import { type QueryRunner } from '../authz-contract.js';
-import { currentGitRef } from '../state-apply.js';
-import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
-import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent.js';
-import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
-import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute.js';
-import { estimateOpsRuntimeFit } from '../ops-fit.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { type QueryRunner } from '../authz-contract';
+import { currentGitRef } from '../state-apply';
+import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan';
+import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent';
+import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute';
+import { estimateOpsRuntimeFit } from '../ops-fit';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { readStageStateTwice, stageDestructiveRefusal } from '../stage-read-consistency';
+import { step, success, fail, info, warn } from '../output';
 
 // The apply core lives in apply-execute.ts (shared with the ops Lambda's
 // db:apply action). Re-exported so the existing integration suites — and any
 // other in-repo caller — keep importing it from this command module.
-export { executeApplyPlan } from '../apply-execute.js';
-export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute.js';
+export { executeApplyPlan } from '../apply-execute';
+export type { ApplyPlanOptions, ApplyPlanResult } from '../apply-execute';
 
 // ---------------------------------------------------------------------------
 // The CLI shell.
@@ -210,7 +210,7 @@ async function applyPlanViaStage(
         process.exit(1);
       }
       step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       const approvers = await readApproverParam(region, appName, flags.stage);
       const identity = approvers === null ? null : await resolveCallerIdentity(region);
@@ -368,7 +368,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     }
     if (flags.stage) {
       const config = await resolveConfig(flags.stage);
-      const { parseAppName } = await import('../discover.js');
+      const { parseAppName } = await import('../discover');
       const appName = await parseAppName();
       verifyAuthority = async () => {
         step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);

package/src/cli/commands/db-approvers.ts

@@ -14,15 +14,15 @@
  * path segments (`ty` matches `user/ty` and an assumed-role session `ty`).
  */
 
-import { resolveConfig } from '../config.js';
+import { resolveConfig } from '../config';
 import {
   approverParamName,
   parseApproverValue,
   readApproverParam,
   writeApproverParam,
   removeApproverParam,
-} from '../apply-authority.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../apply-authority';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbApproversCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
@@ -32,7 +32,7 @@ export async function dbApproversCommand(flags: Record<string, string>): Promise
 
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const paramName = approverParamName(appName, flags.stage);
 

package/src/cli/commands/db-authz.ts

@@ -31,7 +31,7 @@ import {
   diffContracts,
   type QueryRunner,
   type AuthzContract,
-} from '../authz-contract.js';
+} from '../authz-contract';
 import {
   buildProbeSql,
   PROBE_SELECT_SQL,
@@ -42,26 +42,26 @@ import {
   toGrantGap,
   buildInheritedPrivilegeSql,
   toInheritedGrant,
-} from '../authz-redteam.js';
+} from '../authz-redteam';
 import {
   buildOwnerProbeSql,
   OWNER_PROBE_SELECT_SQL,
   toOwnerProbeResult,
   evaluateOwnerProbe,
   type OwnerProbe,
-} from '../authz-owner-probe.js';
-import { modelOwner } from '../authz-compile.js';
-import { writeContract, loadContract } from '../authz-contract-io.js';
-import { renderContractMarkdown } from '../authz-render.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
-import { loadModels } from './db-generate.js';
+} from '../authz-owner-probe';
+import { modelOwner } from '../authz-compile';
+import { writeContract, loadContract } from '../authz-contract-io';
+import { renderContractMarkdown } from '../authz-render';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveConfig, opsFunction } from '../config';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, connectingVia, createUrlProbeRunner } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
+import { loadModels } from './db-generate';
 
 const DEFAULT_DIR = 'authz';
 

package/src/cli/commands/db-backfill.ts

@@ -18,22 +18,22 @@
  * reads and writes its own per-database record.
  */
 
-import type { QueryRunner } from '../authz-contract.js';
+import type { QueryRunner } from '../authz-contract';
 import {
   planBackfills,
   readBackfillLog,
   executeBackfills,
   markBackfillApplied,
   type BackfillPlan,
-} from '../backfill.js';
-import { currentGitRef } from '../state-apply.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolveOperatorUrlViaStage } from '../direct-venue.js';
-import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { readSqlDirIfPresent } from './db-sync.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backfill';
+import { currentGitRef } from '../state-apply';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { resolveOperatorUrlViaStage } from '../direct-venue';
+import { withMutationLease, MutationLeaseError } from '../mutation-lease';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { readSqlDirIfPresent } from './db-sync';
+import { step, success, fail, info, warn } from '../output';
 
 const DEFAULT_DIR = 'db/backfills';
 

package/src/cli/commands/db-backup.ts

@@ -19,16 +19,16 @@ import { spawn } from 'node:child_process';
 import { createGzip } from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { randomBytes } from 'node:crypto';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet, getS3 } from '../aws.js';
-import { runStageBackup, stageBackupDeps } from '../stage-backup.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet, getS3 } from '../aws';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
 import {
   parseBackupRef, keyForId, crossStageGuard, restoreTargetGuard,
   backupKey, backupId, metaKey, utcStamp,
-} from '../backup.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../backup';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info, warn } from '../output';
 
 /** Which database db:backup dumps. LOCAL requires a target --stage (its bucket receives the upload
  *  AND names the backup id). Note this DIVERGES from db:export, where --database-url and --stage are

package/src/cli/commands/db-branch.ts

@@ -34,14 +34,14 @@ import {
   templateName,
   currentBranch,
   localBranches,
-} from '../branch-db.js';
-import { currentGitRef } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveDbSource, type DbSource } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../branch-db';
+import { currentGitRef } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveDbSource, type DbSource } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 function requireUrl(flags: Record<string, string>, verb: string): string {
   let dbSource: DbSource;

package/src/cli/commands/db-build.ts

@@ -25,13 +25,13 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { buildIntoDatabase } from '../db-build.js';
-import { createUrlRunner } from '../db-source.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
-import { loadModels } from './db-generate.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, info, success, fail, warn } from '../output.js';
+import { buildIntoDatabase } from '../db-build';
+import { createUrlRunner } from '../db-source';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
+import { loadModels } from './db-generate';
+import { currentGitRef } from '../state-apply';
+import { step, info, success, fail, warn } from '../output';
 
 /** Tables already in the target, outside the schemas PostgreSQL owns. */
 const OCCUPANCY_SQL = `

package/src/cli/commands/db-check.ts

@@ -31,29 +31,29 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { ModelDescriptor, DerivedDescriptor } from '@everystack/model';
-import { compileDeclaredState } from '../declared-diff.js';
-import { compileMigration } from '../migration-compile.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { currentGitRef } from '../state-apply.js';
-import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate.js';
-import { resolveSchemaOut } from '../migration-generate.js';
-import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint.js';
-import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
+import { compileDeclaredState } from '../declared-diff';
+import { compileMigration } from '../migration-compile';
+import { compileDrizzleSource } from '../schema-source';
+import { currentGitRef } from '../state-apply';
+import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build';
+import { resolveModelsPath } from '../models-path';
+import { loadModels, loadModules, readJournal, DEFAULT_MIGRATIONS } from './db-generate';
+import { resolveSchemaOut } from '../migration-generate';
+import { findUnexportedModels, scanModelDirectory, type ModelFileScan } from '../model-barrel-lint';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
-import type { SourceObject } from '../derived-source.js';
-import { findReadAuthzGaps, findNakedGrants } from '../authz-lint.js';
-import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
+import type { SourceObject } from '../derived-source';
+import { findReadAuthzGaps, findNakedGrants } from '../authz-lint';
+import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline';
 import {
   findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
   findUnpinnedDefiners,
-} from '../derived-lint.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../derived-lint';
+import { step, success, fail, info, warn } from '../output';
 
 // The role derivation moved to the shared builder (db-build) with brick
 // 5-remainder; re-exported here because db:check is where it grew up.
-export { rolesFromContract } from '../db-build.js';
+export { rolesFromContract } from '../db-build';
 
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 

package/src/cli/commands/db-diff.ts

@@ -24,12 +24,12 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
-import { diffDeclaredStates } from '../declared-diff.js';
-import { classifyGeneratedStatements } from '../state-apply.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { diffDeclaredStates } from '../declared-diff';
+import { classifyGeneratedStatements } from '../state-apply';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { step, success, fail, info, warn } from '../output';
 
 export async function dbDiffCommand(flags: Record<string, string>): Promise<void> {
   const fromPath = flags['from-models'];

package/src/cli/commands/db-exec.ts

@@ -16,14 +16,14 @@
  */
 
 import fs from 'node:fs/promises';
-import { resolveDbSource, sslDefaults } from '../db-source.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { isProductionTier } from '../backup.js';
-import { executeExec, assertNoTxnControl } from '../exec-execute.js';
-import { runExecInTx } from '../exec-run.js';
-import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveDbSource, sslDefaults } from '../db-source';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { isProductionTier } from '../backup';
+import { executeExec, assertNoTxnControl } from '../exec-execute';
+import { runExecInTx } from '../exec-run';
+import { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from '../exec-log';
+import { step, success, fail, info } from '../output';
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];

package/src/cli/commands/db-export.ts

@@ -20,16 +20,16 @@ import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { fingerprintModels } from '../schema-fingerprint.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
-import { pgEnvFromUrl, pgKeepaliveConninfo } from './db.js';
-import { utcStamp } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction } from '../aws';
+import { fingerprintModels } from '../schema-fingerprint';
+import { resolveModelsPath } from '../models-path';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
+import { pgEnvFromUrl, pgKeepaliveConninfo } from './db';
+import { utcStamp } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { step, success, fail, info } from '../output';
 
 const fmtBytes = (b?: number): string =>
   b == null ? '?' : b >= 1024 ** 3 ? `${(b / 1024 ** 3).toFixed(1)} GB` : b >= 1024 ** 2 ? `${(b / 1024 ** 2).toFixed(1)} MB` : `${(b / 1024).toFixed(0)} KB`;

package/src/cli/commands/db-fingerprint.ts

@@ -14,10 +14,10 @@
 
 import { existsSync } from 'node:fs';
 import type { ModelDescriptor } from '@everystack/model';
-import type { QueryRunner } from '../authz-contract.js';
-import { introspectSchema } from '../schema-introspect.js';
-import { introspectContract } from '../authz-contract.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
+import type { QueryRunner } from '../authz-contract';
+import { introspectSchema } from '../schema-introspect';
+import { introspectContract } from '../authz-contract';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
 import {
   fingerprintLive,
   fingerprintModels,
@@ -25,16 +25,16 @@ import {
   mapUnfingerprintedRows,
   UNFINGERPRINTED_SQL,
   type UnfingerprintedObject,
-} from '../schema-fingerprint.js';
-import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan.js';
-import { resolveModelsPath } from '../models-path.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadModels } from './db-generate.js';
-import { loadDeclaredDerived } from '../declared-derived.js';
+} from '../schema-fingerprint';
+import { predictLiveFingerprint, governedLiveFingerprint } from '../edge-plan';
+import { resolveModelsPath } from '../models-path';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, INTROSPECTION_SESSION, type SessionRunner } from '../session';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { loadModels } from './db-generate';
+import { loadDeclaredDerived } from '../declared-derived';
 import type { SequenceDescriptor } from '@everystack/model';
 
 export interface FingerprintStatus {

package/src/cli/commands/db-fork.ts

@@ -19,12 +19,12 @@
  * data-governance warning. Teardown is the stage's own: `sst remove`.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, presignGet } from '../aws.js';
-import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup.js';
-import { pollTaskUntilStopped } from '../task-poll.js';
-import { runStageBackup, stageBackupDeps } from '../stage-backup.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, presignGet } from '../aws';
+import { keyForId, parseBackupRef, isProductionTier, crossStageGuard } from '../backup';
+import { pollTaskUntilStopped } from '../task-poll';
+import { runStageBackup, stageBackupDeps } from '../stage-backup';
+import { step, success, fail, info, warn } from '../output';
 
 export type ForkGuardVerdict =
   | { ok: true; piiWarning: string | null }

package/src/cli/commands/db-generate.ts

@@ -23,25 +23,25 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { ModelDescriptor, Module } from '@everystack/model';
-import { introspectSchema } from '../schema-introspect.js';
-import { compileDrizzleSource } from '../schema-source.js';
-import { compileModuleMigration } from '../migration-compile.js';
-import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate.js';
-import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
-import { compileTableContract } from '../authz-compile.js';
-import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile.js';
-import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class.js';
-import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership.js';
-import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
-import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
-import { borrowedSessionRunner, type SessionRunner } from '../session.js';
-import { resolveModelsPath } from '../models-path.js';
-import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived.js';
-import { asModelComposeError, opsAdviceLines } from '../ops-advice.js';
-import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { introspectSchema } from '../schema-introspect';
+import { compileDrizzleSource } from '../schema-source';
+import { compileModuleMigration } from '../migration-compile';
+import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract';
+import { compileTableContract } from '../authz-compile';
+import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile';
+import { classifyAdoption, renderAdoptionReport } from '../authz-adoption-class';
+import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
+import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
+import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
+import { borrowedSessionRunner, type SessionRunner } from '../session';
+import { resolveModelsPath } from '../models-path';
+import { loadDeclaredDerived, assertNoHoles, type DeclaredDerived } from '../declared-derived';
+import { asModelComposeError, opsAdviceLines } from '../ops-advice';
+import { applyStateAndVerify, classifyGeneratedStatements, renderStatementHistogram, currentGitRef, type StateSyncOutcome } from '../state-apply';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 export const DEFAULT_MIGRATIONS = 'drizzle';
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';