@everystack/cli 0.4.60 → 0.4.64

package/src/cli/commands/db.ts

@@ -5,10 +5,10 @@
  * No HTTP endpoints, no shared secrets — IAM is the authorization layer.
  */
 
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
 
 /** Secret-store keys that may hold the privileged (operator) connection URL,
  *  in precedence order. Names vary by deployment; --secret-name overrides. */
@@ -258,7 +258,7 @@ export function buildProvisionSecretPlan(args: {
  *  same seam as pipeline-loader). */
 export interface ServerProvision {
   runProvision(
-    payload: { authPassword?: string; adminPassword?: string; searchPath?: string[] },
+    payload: { authPassword?: string; adminPassword?: string; searchPath?: string[]; rotationPairs?: boolean },
     deps: {
       execute: (sql: string) => Promise<unknown>;
       connection?: { host: string; port?: number | string; database: string } | null;
@@ -471,12 +471,277 @@ export function parseUrlConnection(url: string): { host: string; port: string; d
   };
 }
 
+/**
+ * db:provision --rotate — swap the active A/B role for one or both credential slots.
+ *
+ * Steps: preflight master → detect active → provision inactive → write SSM →
+ * rolling restart → verify origin → retire old → drain sessions.
+ */
+async function rotateCredentials(flags: Record<string, string>): Promise<void> {
+  const stage = flags.stage!;
+  const graceMs = (flags.grace ? Number(flags.grace) : 60) * 1000;
+
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
+  const secretsCtx = { appName: await parseAppName(), stage, region: config.region };
+  let stageSecrets: Record<string, string> = {};
+  try {
+    stageSecrets = await loadSstSecrets(secretsCtx);
+  } catch (err: any) {
+    fail(`Cannot read stage secrets: ${err.message}`);
+    process.exit(1);
+  }
+
+  // Resolve the direct connection (the rotate command always runs direct — it needs
+  // to query pg_roles and ALTER ROLE, which the ops action doesn't expose).
+  const adminUrl = stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl;
+  if (!adminUrl) {
+    fail('No ADMIN_DATABASE_URL secret found. Run db:provision first to set up the credential split.');
+    process.exit(1);
+  }
+
+  // Step 0: preflight — verify the master credential works (break-glass path).
+  step('Preflight: verifying master connection...');
+  try {
+    const result = await invokeAction(config.region, opsFunction(config), 'db:query', { sql: 'SELECT current_user' });
+    if ((result as any)?.error) throw new Error((result as any).error);
+    success('Master connection verified.');
+  } catch (err: any) {
+    fail(`Master connection failed: ${err.message}`);
+    info('The master credential is the break-glass. Fix it before rotating.');
+    process.exit(1);
+  }
+
+  // Connect directly for role management.
+  const { createUrlRunner } = await import('../db-source');
+  const { runner, end } = await createUrlRunner(adminUrl);
+  const deps = {
+    query: async (sql: string) => runner(sql) as Promise<any[]>,
+    execute: async (sql: string) => { await runner(sql); },
+  };
+
+  try {
+    const {
+      detectActiveRole,
+      provisionInactiveRole,
+      retireRole,
+      drainRole,
+    } = await import('@everystack/server/rotate');
+
+    // Detect which slots to rotate.
+    const slotFlag = flags.slot || 'both';
+    if (!['api', 'ops', 'both'].includes(slotFlag)) {
+      fail(`Invalid --slot: ${slotFlag}. Use api, ops, or both.`);
+      process.exit(1);
+    }
+    const slots: Array<{ base: string; secretKeys: string[] }> = [];
+    if (slotFlag === 'api' || slotFlag === 'both') {
+      slots.push({ base: 'authenticator', secretKeys: ['DatabaseUrl', 'ReadDatabaseUrl'] });
+    }
+    if (slotFlag === 'ops' || slotFlag === 'both') {
+      slots.push({ base: 'migrator', secretKeys: ['AdminDatabaseUrl'] });
+    }
+
+    const { randomBytes } = await import('node:crypto');
+    const conn = parseUrlConnection(adminUrl);
+    const sourceUrl = adminUrl;
+
+    // Track the old active role for each slot so retire uses the RIGHT role (F1 fix).
+    const oldActiveRoles: Array<{ base: string; oldRole: string }> = [];
+    // Track credential env overrides to set during rolling restart.
+    const credEnvOverrides: Record<string, string> = {};
+
+    for (const { base, secretKeys } of slots) {
+      step(`Rotating ${base}...`);
+
+      const detected = await detectActiveRole(base, deps);
+      if (!detected) {
+        fail(`No rotation pairs found for ${base}. Run db:provision --rotation-pairs first.`);
+        process.exit(1);
+      }
+      info(`  Active: ${detected.activeRole}, inactive: ${detected.inactiveRole}`);
+      oldActiveRoles.push({ base, oldRole: detected.activeRole });
+      const active = detected;
+
+      // Provision the inactive role.
+      const password = randomBytes(24).toString('hex');
+      await provisionInactiveRole(active, password, deps);
+      success(`  ${active.inactiveRole} provisioned with new password.`);
+
+      // Build the new URL.
+      const newUrl = preserveConnParams(
+        `postgresql://${active.inactiveRole}:${password}@${conn.host}:${conn.port}/${conn.database}`,
+        sourceUrl,
+      );
+
+      // Write to the SST secret store (blob-first per Fable ruling — must
+      // complete before UpdateFunctionConfiguration so a crash at any point
+      // is recovered by re-running rotate or by deploying).
+      step(`  Updating secrets (${secretKeys.join(', ')})...`);
+      try {
+        const secrets = { ...stageSecrets };
+        for (const key of secretKeys) {
+          let credUrl = newUrl;
+          if (key === 'ReadDatabaseUrl') {
+            const existingReadUrl = stageSecrets.READ_DATABASE_URL ?? stageSecrets.ReadDatabaseUrl;
+            if (existingReadUrl) {
+              try {
+                const u = new URL(newUrl);
+                u.hostname = new URL(existingReadUrl).hostname;
+                credUrl = u.toString();
+              } catch { /* use primary host */ }
+            }
+          }
+          secrets[key] = credUrl;
+          credEnvOverrides[`EVERYSTACK_CRED_${key}`] = credUrl;
+        }
+        await putSstSecrets(secretsCtx, secrets);
+        stageSecrets = secrets;
+        success(`  Secrets written.`);
+      } catch (err: any) {
+        fail(`  Secret write failed: ${err.message}`);
+        info('  Ensure your IAM role has s3:PutObject + kms:Encrypt on the SST state bucket.');
+        process.exit(1);
+      }
+    }
+
+    // Rolling restart all linked functions with credential env overrides.
+    // Each function gets only the credentials it links — preserving the split.
+    // Track failures on credential-carrying functions — if ANY fail, abort
+    // before retire (both roles keep LOGIN = safe re-runnable state).
+    const { rollingRestart } = await import('../aws');
+    step('Rolling restart...');
+    const apiCreds: Record<string, string> = {};
+    const opsCreds: Record<string, string> = {};
+    for (const [k, v] of Object.entries(credEnvOverrides)) {
+      if (k.includes('Admin')) {
+        opsCreds[k] = v;
+      } else {
+        apiCreds[k] = v;
+      }
+    }
+    const allCreds = { ...apiCreds, ...opsCreds };
+    const functions: Array<{ name: string; creds: Record<string, string>; critical: boolean }> = [
+      { name: config.apiFunctionName, creds: apiCreds, critical: true },
+      ...(config.opsFunctionName ? [{ name: config.opsFunctionName, creds: allCreds, critical: true }] : []),
+      ...(config.workerFunctionName ? [{ name: config.workerFunctionName, creds: {}, critical: false }] : []),
+      ...(config.imageFunctionName ? [{ name: config.imageFunctionName, creds: {}, critical: false }] : []),
+    ];
+
+    let restartFailed = false;
+    for (const { name: fn, creds, critical } of functions) {
+      try {
+        const { newGen } = await rollingRestart(config.region, fn, creds);
+        success(`  ${fn} → gen ${newGen}`);
+      } catch (err: any) {
+        if (critical) {
+          fail(`  ${fn}: ${err.message}`);
+          restartFailed = true;
+        } else {
+          warn(`  ${fn}: ${err.message}`);
+        }
+      }
+    }
+
+    if (restartFailed) {
+      fail('Restart failed on a credential-carrying function. Both roles keep LOGIN (safe state).');
+      info('Fix the issue and re-run db:provision --rotate. No credential was revoked.');
+      process.exit(1);
+    }
+
+    // Verify origin with a login probe — prove the new credential works
+    // before revoking the old one.
+    step('Verifying new credential...');
+    let verifyPassed = false;
+    try {
+      const { default: pg } = await import('postgres');
+      const newApiUrl = credEnvOverrides.EVERYSTACK_CRED_DatabaseUrl;
+      if (newApiUrl) {
+        const probe = pg(newApiUrl, { max: 1, connect_timeout: 5, ssl: 'prefer' });
+        try {
+          await probe`SELECT 1`;
+          verifyPassed = true;
+          success('New credential connects to the database.');
+        } finally {
+          await probe.end({ timeout: 1 });
+        }
+      } else {
+        verifyPassed = true;
+      }
+    } catch (err: any) {
+      fail(`New credential login failed: ${err.message}`);
+      info('Both roles keep LOGIN (safe state). Fix and re-run.');
+      process.exit(1);
+    }
+
+    // Origin HTTP check (non-blocking — the login probe is the real gate).
+    if (config.baseUrl) {
+      try {
+        const probe = `${config.baseUrl}?_probe=${Date.now()}`;
+        const res = await fetch(probe, { redirect: 'follow' });
+        if (res.ok) success('Origin responding.');
+        else warn(`Origin returned ${res.status}.`);
+      } catch (err: any) {
+        warn(`Origin probe failed: ${err.message}`);
+      }
+    }
+
+    // Retire old roles and drain sessions — using the roles recorded at
+    // detection time, NOT re-detected (F1 fix: both roles have LOGIN now,
+    // re-detection would pick the wrong one via the tiebreak).
+    for (const { base, oldRole } of oldActiveRoles) {
+      step(`Retiring ${oldRole}...`);
+      await retireRole(oldRole, deps);
+      success(`  ${oldRole} set to NOLOGIN.`);
+
+      // Also retire the base role if it still has LOGIN (F6 fix: a leaked
+      // pre-rotation credential must not survive rotation).
+      try {
+        const baseRows = await deps.query(
+          `SELECT rolcanlogin FROM pg_roles WHERE rolname = '${base}'`,
+        );
+        if (baseRows[0]?.rolcanlogin) {
+          await retireRole(base, deps);
+          success(`  ${base} (base role) set to NOLOGIN.`);
+        }
+      } catch { /* best-effort */ }
+
+      step(`Draining ${oldRole} sessions (grace: ${graceMs / 1000}s)...`);
+      const { drained, terminated } = await drainRole(oldRole, graceMs, deps);
+      if (drained && terminated === 0) {
+        success(`  ${oldRole} drained cleanly.`);
+      } else if (drained) {
+        success(`  ${oldRole} drained (${terminated} session(s) terminated after grace period).`);
+      }
+    }
+
+    success('Credential rotation complete.');
+
+  } finally {
+    await end?.();
+  }
+}
+
 export async function dbProvisionCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
     fail('--stage is required for db:provision (it writes the stage\'s DATABASE_URL secret — the new credentials are never displayed, so they must land in the secret store)');
     process.exit(1);
   }
 
+  if (flags.rotate) {
+    await rotateCredentials(flags);
+    return;
+  }
+
   step('Resolving deployed config...');
   let config;
   try {
@@ -488,8 +753,8 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
 
   // Load the stage secrets once — the direct venue reads the privileged URL from here (never
   // from argv), and the writer below reuses them.
-  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   const secretsCtx = { appName: await parseAppName(), stage: flags.stage, region: config.region };
   let stageSecrets: Record<string, string> = {};
   try {
@@ -527,12 +792,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // all-public app sets no path (unchanged behavior).
   let declaredSchemas: string[] = [];
   try {
-    const { resolveModelsPath } = await import('../models-path.js');
-    const { loadModels } = await import('./db-generate.js');
+    const { resolveModelsPath } = await import('../models-path');
+    const { loadModels } = await import('./db-generate');
     const models = await loadModels(resolveModelsPath(flags.models));
     let derivedObjects: Array<{ schema: string }> = [];
     try {
-      const { loadDeclaredDerived } = await import('../declared-derived.js');
+      const { loadDeclaredDerived } = await import('../declared-derived');
       const declared = await loadDeclaredDerived(flags.models);
       if (declared) derivedObjects = declared.objects;
     } catch {
@@ -555,10 +820,10 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // and the auto-fallback below.
   const provisionDirect = async (url: string): Promise<any> => {
     const { runProvision } = await loadServerProvision();
-    const { createUrlRunner } = await import('../db-source.js');
+    const { createUrlRunner } = await import('../db-source');
     const { runner, end } = await createUrlRunner(url);
     try {
-      return await runProvision({ authPassword, adminPassword, searchPath }, {
+      return await runProvision({ authPassword, adminPassword, searchPath, rotationPairs: !!flags['rotation-pairs'] }, {
         execute: async (statement) => runner(statement),
         connection: parseUrlConnection(url),
         // Same probe as the ops-Lambda venue: a real login as the new role, DDL-capable.
@@ -591,7 +856,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     conn = parseUrlConnection(directUrl);
   } else {
     try {
-      result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword, searchPath });
+      result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword, searchPath, rotationPairs: !!flags['rotation-pairs'] });
     } catch (err: any) {
       // Auto-fallback: no Ops Lambda (Unknown action), but an ADMIN_DATABASE_URL secret exists —
       // provision directly over it. Master never crosses the CLI; the operator sets nothing new.
@@ -746,7 +1011,7 @@ function printDoctorReport(report: any): void {
  */
 async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: string): Promise<boolean> {
   const { runDoctorProbe } = await loadServerDoctor();
-  const { createUrlRunner } = await import('../db-source.js');
+  const { createUrlRunner } = await import('../db-source');
   step('Probing database connections (api + operator)...');
   const apiConn = await createUrlRunner(apiUrl);
   const opsConn = await createUrlRunner(adminUrl);
@@ -797,8 +1062,8 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
 
   // Load the stage secrets once — the direct venue (--direct, and the no-Ops auto-fallback)
   // reads DATABASE_URL + ADMIN_DATABASE_URL from here, never from argv.
-  const { loadSstSecrets } = await import('../utils/secrets.js');
-  const { parseAppName } = await import('../discover.js');
+  const { loadSstSecrets } = await import('../utils/secrets');
+  const { parseAppName } = await import('../discover');
   let stageSecrets: Record<string, string> = {};
   try {
     stageSecrets = await loadSstSecrets({ appName: await parseAppName(), stage: flags.stage, region: config.region });
@@ -957,8 +1222,8 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
   step('Resolving the admin connection from the secret store...');
   let secrets: Record<string, string>;
   try {
-    const { loadSstSecrets } = await import('../utils/secrets.js');
-    const { parseAppName } = await import('../discover.js');
+    const { loadSstSecrets } = await import('../utils/secrets');
+    const { parseAppName } = await import('../discover');
     const appName = await parseAppName();
     secrets = await loadSstSecrets({ appName, stage: flags.stage, region: config.region });
   } catch (err: any) {

package/src/cli/commands/deploy.ts

@@ -11,10 +11,11 @@
  */
 
 import { spawn } from 'node:child_process';
-import { step, success, fail, info, warn } from '../output.js';
-import { invalidateCachedConfig } from '../discover.js';
-import { resolveConfig } from '../config.js';
-import { probeDeployedFunctions } from '../deploy-probe.js';
+import { step, success, fail, info, warn } from '../output';
+import { invalidateCachedConfig } from '../discover';
+import { resolveConfig } from '../config';
+import { probeDeployedFunctions } from '../deploy-probe';
+import { getDistributionStatus } from '../aws';
 
 /** The `sst` argv `everystack deploy` runs. Pure, so the mapping is unit-tested. */
 export function buildDeployArgs(flags: Record<string, string>): string[] {
@@ -68,8 +69,9 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
   // `sst deploy` exiting 0 only proves the code UPLOADED — a bundle that crashes at INIT still
   // deploys "green" and takes the whole ops plane down until the next verb trips over it. Probe
   // the deployed functions now so the operator learns here, with the real cause attached.
+  let config: Awaited<ReturnType<typeof resolveConfig>> | undefined;
   try {
-    const config = await resolveConfig(stage);
+    config = await resolveConfig(stage);
     const { fatal } = await probeDeployedFunctions(stage, config);
     if (fatal) {
       fail('Deploy landed, but a deployed function cannot serve — every --stage verb will fail until this is fixed and redeployed.');
@@ -81,8 +83,40 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
     info(`Skipped the post-deploy probe: ${err?.message ?? err}`);
   }
 
+  // Wait for CloudFront distribution to finish propagating.
+  if (config?.distributionId) {
+    step('Waiting for CloudFront distribution...');
+    const deployed = await waitForDistribution(config.region, config.distributionId);
+    if (deployed) {
+      success('Distribution deployed.');
+    } else {
+      warn('Distribution did not reach Deployed within timeout. It may still be propagating.');
+    }
+  }
+
   // The 0.4 flow: schema changes ride db:plan → db:apply. Migration-based apps still have
   // db:migrate, but the copy-paste hint must advertise the canonical path — this exact
   // line got copied into consumer runbooks with the retired verb.
   info('Next: schema changes via `everystack db:plan --stage ' + stage + '` → `db:apply`; `everystack update` to publish the app bundle.');
 }
+
+const DISTRIBUTION_POLL_MS = 10_000;
+const DISTRIBUTION_TIMEOUT_MS = 300_000;
+
+/** @internal Exported for testing. */
+export async function waitForDistribution(
+  region: string,
+  distributionId: string,
+): Promise<boolean> {
+  const deadline = Date.now() + DISTRIBUTION_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      const status = await getDistributionStatus(region, distributionId);
+      if (status === 'Deployed') return true;
+    } catch {
+      // Permission error or transient — keep trying.
+    }
+    await new Promise((r) => setTimeout(r, DISTRIBUTION_POLL_MS));
+  }
+  return false;
+}

package/src/cli/commands/diag.ts

@@ -13,10 +13,10 @@
  *   everystack diag [url] --hydration  # Analyze SSR hydration issues
  */
 
-import { resolveConfig } from '../config.js';
-import { getFromS3 } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
-import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer.js';
+import { resolveConfig } from '../config';
+import { getFromS3 } from '../aws';
+import { step, success, fail, info, warn } from '../output';
+import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer';
 
 interface DiagResult {
   url: string;
@@ -85,7 +85,7 @@ export async function diagCommand(
       cacheStatus: response.headers.get('x-cache') ?? undefined,
       cacheAge: response.headers.get('age') ?? undefined,
       cacheControl: response.headers.get('cache-control') ?? undefined,
-      serverDebug: response.headers.get('x-server-debug') ?? undefined,
+      serverDebug: response.headers.get('x-everystack-release') ?? response.headers.get('x-everystack-created') ?? undefined,
     };
 
     // Fetch full HTML if hydration analysis requested
@@ -138,7 +138,7 @@ export async function diagCommand(
   if (diag.serverDebug) {
     console.log(`  Serving Release:  ${diag.serverDebug}`);
   } else {
-    warn('  No X-Server-Debug header found. Update @everystack/server to get release timestamp on SSR responses.');
+    warn('  No x-everystack-release header found. Update @everystack/server (>= 0.4.22) to get release headers on SSR responses.');
   }
   console.log('');
 
@@ -168,15 +168,15 @@ export async function diagCommand(
   // 4. Version comparison
   if (!manifest) {
     warn('  Cannot compare: no manifest available.');
-  } else if (diag.serverDebug && manifest.createdAt) {
-    if (diag.serverDebug === manifest.createdAt) {
+  } else if (diag.serverDebug && manifest.updateId) {
+    if (diag.serverDebug === manifest.updateId) {
       success('  Version match: serving the latest release');
     } else {
-      fail(`  Version mismatch: serving ${diag.serverDebug}, latest is ${manifest.createdAt}`);
+      fail(`  Version mismatch: serving ${diag.serverDebug}, latest is ${manifest.updateId}`);
       info('  Run `everystack cache:purge --origin web` to bust the CDN cache.');
     }
   } else {
-    warn('  Cannot compare: missing X-Server-Debug header or manifest timestamp.');
+    warn('  Cannot compare: missing x-everystack-release header or manifest updateId.');
   }
 
   console.log('');

package/src/cli/commands/lighthouse.ts

@@ -20,9 +20,9 @@ import {
   formatLighthouseReport,
   type ExtractedRun,
   type LhReport,
-} from '../lighthouse.js';
-import { resolveConfig } from '../config.js';
-import { step, info, fail, warn } from '../output.js';
+} from '../lighthouse';
+import { resolveConfig } from '../config';
+import { step, info, fail, warn } from '../output';
 
 function runLighthouse(url: string, outPath: string): LhReport {
   // Warm the edge so we measure the real-user (cached-HTML) experience.

package/src/cli/commands/logs.ts

@@ -10,11 +10,11 @@
  * immune to the Lambda hash rotating on redeploy.
  */
 
-import { resolveConfig } from '../config.js';
-import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws.js';
-import { summarizeRuntimeFailures } from '../ops-diagnostics.js';
-import { queryLogArchive, type ObservabilityQuery } from '../observability.js';
-import { step, success, fail, info } from '../output.js';
+import { resolveConfig } from '../config';
+import { resolveLogGroup, fetchRecentLogEvents, importOptionalAws } from '../aws';
+import { summarizeRuntimeFailures } from '../ops-diagnostics';
+import { queryLogArchive, type ObservabilityQuery } from '../observability';
+import { step, success, fail, info } from '../output';
 
 /** Default S3 key prefix for the observability archive (loggingPlugin default). */
 const DEFAULT_PREFIX = '_observability';

package/src/cli/commands/pipeline-run.ts

@@ -18,19 +18,19 @@ import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source.js';
-import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { currentGitRef } from '../state-apply.js';
-import { step, success, fail, info, warn } from '../output.js';
+import { resolveDbSource, createUrlPipelineRunner, connectingVia, type DbSource } from '../db-source';
+import { resolvePipelinePath, PIPELINE_HOMES } from '../pipeline-path';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { currentGitRef } from '../state-apply';
+import { step, success, fail, info, warn } from '../output';
 import {
   loadServerPipeline,
   type Pipeline,
   type PipelineLane,
   type RunPipelineOptions,
   type PipelineRunOutcome,
-} from '../pipeline-loader.js';
+} from '../pipeline-loader';
 
 /** --rebuild → rebuild, --curate → curate, neither → all. Both is a contradiction. */
 export function pipelineLaneFromFlags(flags: Record<string, string>): PipelineLane {

package/src/cli/commands/runbook.ts

@@ -16,11 +16,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { detectProjectReality } from '../runbook/detect.js';
-import { generateRunbook, type RunbookResult } from '../runbook/generate.js';
-import { renderDataModelSection } from '../runbook/model-section.js';
-import { parseRunbook, sha8 } from '../runbook/markers.js';
-import { fail, info, step, success, warn } from '../output.js';
+import { detectProjectReality } from '../runbook/detect';
+import { generateRunbook, type RunbookResult } from '../runbook/generate';
+import { renderDataModelSection } from '../runbook/model-section';
+import { parseRunbook, sha8 } from '../runbook/markers';
+import { fail, info, step, success, warn } from '../output';
 
 const OUT_REL = path.join('docs', 'RUNBOOK.md');
 

package/src/cli/commands/secrets.ts

@@ -15,10 +15,10 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { step, success, fail, info, warn } from '../output.js';
-import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
-import { parseDotenv, serializeDotenv } from '../utils/dotenv.js';
-import { isMissingOptionalDependencyError } from '../aws.js';
+import { step, success, fail, info, warn } from '../output';
+import { loadSstSecrets, putSstSecrets } from '../utils/secrets';
+import { parseDotenv, serializeDotenv } from '../utils/dotenv';
+import { isMissingOptionalDependencyError } from '../aws';
 
 interface SecretsContext {
   appName: string;
@@ -34,7 +34,7 @@ async function resolveContext(flags: Record<string, string>): Promise<SecretsCon
     process.exit(1);
   }
 
-  const { parseAppName } = await import('../discover.js');
+  const { parseAppName } = await import('../discover');
   const appName = await parseAppName();
   const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
 

package/src/cli/commands/security-probe.ts

@@ -25,10 +25,10 @@ import {
   type CatalogColumn,
   type CatalogGrant,
   type ProbeResult,
-} from '../security-probe.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, info, fail, success, warn } from '../output.js';
+} from '../security-probe';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, info, fail, success, warn } from '../output';
 
 const SYS_SCHEMAS = "('pg_catalog','information_schema','pg_toast')";
 

package/src/cli/commands/security.ts

@@ -22,17 +22,17 @@ import {
   type AuditReport,
   type FunctionDescriptor,
   type ViewDescriptor,
-} from '../security-audit.js';
+} from '../security-audit';
 import {
   FUNCTIONS_SQL,
   RELATIONS_SQL,
   catalogFunctionToDescriptor,
   catalogRelationToDescriptor,
-} from '../security-catalog.js';
-import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract.js';
-import { resolveConfig, opsFunction } from '../config.js';
-import { invokeAction } from '../aws.js';
-import { step, success, fail, info, warn } from '../output.js';
+} from '../security-catalog';
+import { SCHEMA_ACL_SQL, parseSchemaAcl } from '../authz-contract';
+import { resolveConfig, opsFunction } from '../config';
+import { invokeAction } from '../aws';
+import { step, success, fail, info, warn } from '../output';
 
 const MIGRATION_DIRS = ['drizzle', 'db/migrations', 'migrations', 'db/drizzle'];
 const WAIVER_FILES = ['security-audit.json', '.security-audit.json'];

package/src/cli/commands/status.ts

@@ -11,9 +11,9 @@
  * CDN and Lambda metrics still work with nothing but IAM credentials.
  */
 
-import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
-import { invokeAction, importOptionalAws } from '../aws.js';
-import { fail, info, step } from '../output.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config';
+import { invokeAction, importOptionalAws } from '../aws';
+import { fail, info, step } from '../output';
 
 export interface MetricSpec {
   namespace: string;