belt 0.2.3 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f58b01f78d1a1b0b6fda926c2916b28bb0db5045c20585a866fff9738ce3d674
-  data.tar.gz: 426efc91999e3c39aab7f9bcf267addc2bdffd2fc62e74103fa0c5e0222acfb2
+  metadata.gz: 6e11ea8efb5dc66136ff67b14d3a0edc5cf7fb7df101972113ac45c9ec849f2f
+  data.tar.gz: c6236fc136329ab8f1ce875efaa21b1e0ed4a74fd1ad593677bf707f9b7bbe2c
 SHA512:
-  metadata.gz: 41d8f9e02028ca0e19b79d70c87e660c28311cf3012d9b422574fb97e2559b7ae4b0d8e763a926fb4be5f6ffcc9ed7d200a21bba11780c29054feb551f9989d5
-  data.tar.gz: f7f77a0b00ed82d58523cf3a83fafc3b92fa075ee2d0e86c0973a427d86d4611ba21c849e5bd2048aae04c9c75cb9437ecd11f7a162f2180de8b4e0002671334
+  metadata.gz: c54d5f823fb61c6b922f87cf8da31ca7fa1f6e460d3d4d13ed3be42c04f5ddcd6bc9096324fe3de493d58b84d5b81e83e939910ca6827f160257107c191c18e3
+  data.tar.gz: c1d9324c79092e48c012141b152fa8bf30035284fb0738904694f741b25eee1437e8f36bc889d4446113584d4e6e702706e10b860411d0bb34a502030457f500

data/lib/belt/cli/backup_config.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+module Belt
+  module CLI
+    class BackupConfig
+      attr_reader :dynamodb_tables, :cognito_exports, :s3_buckets, :retention
+
+      # Load backup config from infrastructure/<env>/belt.rb
+      # Returns nil if no config file exists or backups aren't configured
+      def self.load(env, infra_dir: nil)
+        infra_dir ||= 'infrastructure'
+        config_file = File.join(infra_dir, env, 'belt.rb')
+        return nil unless File.exist?(config_file)
+
+        config = new
+        evaluator = ConfigEvaluator.new(config)
+        evaluator.evaluate(File.read(config_file), config_file)
+
+        # Return nil if no backups were configured
+        config.any? ? config : nil
+      end
+
+      def initialize
+        @dynamodb_tables = nil # nil = not configured, :all = all tables, Array = specific tables
+        @cognito_exports = []  # e.g. [:users, :pool_config]
+        @s3_buckets = []       # e.g. [:legal_documents]
+        @retention = { snapshots: 90, cognito: 10, s3: 10 }
+      end
+
+      def dynamodb?
+        !@dynamodb_tables.nil?
+      end
+
+      def cognito?
+        @cognito_exports.any?
+      end
+
+      def any?
+        dynamodb? || cognito? || @s3_buckets.any?
+      end
+
+      # Evaluates the belt.rb config file in an isolated context
+      # that intercepts Belt.configure calls
+      class ConfigEvaluator
+        def initialize(config)
+          @config = config
+        end
+
+        def evaluate(content, filename)
+          # The config file calls Belt.configure { |config| ... }
+          # We wrap the content to intercept the Belt constant lookup
+          # by evaluating in a module where Belt is redefined
+          config = @config
+          sandbox = Module.new
+          # Define a Belt module inside the sandbox that has .configure
+          belt_proxy = Module.new do
+            define_singleton_method(:configure) do |&block|
+              block.call(ConfigDSL.new(config))
+            end
+          end
+          sandbox.const_set(:Belt, belt_proxy)
+
+          # Evaluate the file content within the sandbox module
+          sandbox.module_eval(content, filename)
+        end
+      end
+
+      # DSL yielded to the block inside Belt.configure { |config| ... }
+      class ConfigDSL
+        def initialize(config)
+          @config = config
+        end
+
+        def backups(enabled = nil, &block)
+          if enabled == true
+            # Simple mode: config.backups = true → just DynamoDB for all tables
+            @config.instance_variable_set(:@dynamodb_tables, :all)
+          elsif block
+            backup_dsl = BackupDSL.new(@config)
+            backup_dsl.instance_eval(&block)
+          end
+        end
+      end
+
+      # DSL for the backups block
+      class BackupDSL
+        def initialize(config)
+          @config = config
+        end
+
+        def dynamodb(scope = :all)
+          if scope == :all
+            @config.instance_variable_set(:@dynamodb_tables, :all)
+          else
+            tables = Array(scope)
+            @config.instance_variable_set(:@dynamodb_tables, tables.map(&:to_s))
+          end
+        end
+
+        def cognito(*exports)
+          @config.instance_variable_set(:@cognito_exports, exports.flatten.map(&:to_sym))
+        end
+
+        def s3(*buckets)
+          @config.instance_variable_set(:@s3_buckets, buckets.flatten.map(&:to_sym))
+        end
+
+        def retention(opts = {})
+          current = @config.instance_variable_get(:@retention)
+          merged = current.merge(opts.transform_keys(&:to_sym))
+
+          # Convert duration objects (90.days) to integer days
+          merged.transform_values! do |v|
+            v.respond_to?(:to_i) ? v.to_i : v
+          end
+
+          @config.instance_variable_set(:@retention, merged)
+        end
+      end
+    end
+  end
+end

data/lib/belt/cli/backup_runner.rb

@@ -0,0 +1,510 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'tmpdir'
+require 'fileutils'
+
+module Belt
+  module CLI
+    class BackupRunner
+      def initialize(env, config, infra_dir:, app_name:)
+        @env = env
+        @config = config
+        @infra_dir = infra_dir
+        @app_name = app_name
+        @timestamp = Time.now.strftime('%Y%m%d-%H%M%S')
+        @backup_bucket = "#{@app_name}-backups-#{@env}"
+        @errors = []
+        @summary = []
+      end
+
+      def run
+        ensure_backup_bucket!
+        backup_dynamodb if @config.dynamodb?
+        backup_cognito if @config.cognito?
+        backup_s3_buckets if @config.s3_buckets.any?
+        cleanup_old_backups!
+        print_summary
+
+        abort "\n✗ Backup completed with errors (see above)" if @errors.any?
+      end
+
+      private
+
+      # ─── Backup Bucket ───────────────────────────────────────────────
+
+      def ensure_backup_bucket!
+        # Check if bucket exists
+        _, status = Open3.capture2('aws', 's3', 'ls', "s3://#{@backup_bucket}", err: File::NULL)
+        return if status.success?
+
+        puts "  📦 Creating backup bucket: #{@backup_bucket}"
+
+        run_aws('s3', 'mb', "s3://#{@backup_bucket}", '--region', detect_region)
+
+        # Enable versioning
+        run_aws('s3api', 'put-bucket-versioning',
+                '--bucket', @backup_bucket,
+                '--versioning-configuration', 'Status=Enabled')
+
+        # Block public access
+        run_aws('s3api', 'put-public-access-block',
+                '--bucket', @backup_bucket,
+                '--public-access-block-configuration',
+                'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true')
+
+        puts '  ✅ Backup bucket created and secured'
+      end
+
+      # ─── DynamoDB ────────────────────────────────────────────────────
+
+      def backup_dynamodb
+        puts '  💾 DynamoDB backups...'
+        table_names = resolve_table_names
+
+        if table_names.empty?
+          @errors << 'Could not resolve DynamoDB table names'
+          puts '  ⚠️  No table names found'
+          return
+        end
+
+        # Filter tables if specific ones configured
+        if @config.dynamodb_tables.is_a?(Array)
+          table_names = table_names.select do |name|
+            @config.dynamodb_tables.intersect?(name)
+          end
+        end
+
+        # Ensure PITR is enabled on all tables
+        table_names.each do |table_name|
+          ensure_pitr(table_name)
+
+          # Create on-demand snapshots
+          create_snapshot(table_name)
+        end
+
+        @summary << "DynamoDB: #{table_names.size} table(s) — PITR verified + snapshot created"
+      end
+
+      def ensure_pitr(table_name)
+        output, status = Open3.capture2(
+          'aws', 'dynamodb', 'describe-continuous-backups',
+          '--table-name', table_name
+        )
+
+        if status.success?
+          data = JSON.parse(output)
+          pitr_status = data.dig('ContinuousBackupsDescription', 'PointInTimeRecoveryDescription',
+                                 'PointInTimeRecoveryStatus')
+
+          return if pitr_status == 'ENABLED'
+        end
+
+        puts "    Enabling PITR for #{short_table_name(table_name)}..."
+        run_aws('dynamodb', 'update-continuous-backups',
+                '--table-name', table_name,
+                '--point-in-time-recovery-specification', 'PointInTimeRecoveryEnabled=true')
+      end
+
+      def create_snapshot(table_name)
+        short = short_table_name(table_name)
+        backup_name = "#{short}-backup-#{@timestamp}"
+
+        output, status = Open3.capture2e(
+          'aws', 'dynamodb', 'create-backup',
+          '--table-name', table_name,
+          '--backup-name', backup_name
+        )
+
+        if status.success?
+          puts "    ✅ Snapshot: #{short}"
+        else
+          puts "    ⚠️  Snapshot failed for #{short}: #{output.strip}"
+        end
+      end
+
+      # ─── Cognito ─────────────────────────────────────────────────────
+
+      def backup_cognito
+        puts '  👥 Cognito backups...'
+        pool_id = resolve_cognito_pool_id
+
+        if pool_id.nil? || pool_id.empty?
+          @errors << 'Could not resolve Cognito user pool ID'
+          puts '  ⚠️  No Cognito pool ID found'
+          return
+        end
+
+        exports_done = []
+
+        if @config.cognito_exports.include?(:users)
+          export_cognito_users(pool_id)
+          exports_done << 'users'
+        end
+
+        if @config.cognito_exports.include?(:pool_config)
+          export_cognito_pool_config(pool_id)
+          exports_done << 'pool_config'
+        end
+
+        @summary << "Cognito: #{exports_done.join(', ')} exported" if exports_done.any?
+      end
+
+      def export_cognito_users(pool_id)
+        all_users = []
+        pagination_token = nil
+
+        loop do
+          args = ['aws', 'cognito-idp', 'list-users', '--user-pool-id', pool_id, '--max-results', '60']
+          args += ['--pagination-token', pagination_token] if pagination_token
+
+          output, status = Open3.capture2(*args)
+          break unless status.success?
+
+          data = JSON.parse(output)
+          all_users.concat(data['Users'] || [])
+
+          pagination_token = data['PaginationToken']
+          break if pagination_token.nil? || pagination_token.empty?
+
+          puts '    Fetching next page of users...'
+        end
+
+        # Upload to backup bucket
+        tmp_file = File.join(Dir.tmpdir, "cognito-users-#{@timestamp}.json")
+        File.write(tmp_file, JSON.pretty_generate(all_users))
+
+        run_aws('s3', 'cp', tmp_file, "s3://#{@backup_bucket}/cognito/users-#{@timestamp}.json", '--quiet')
+        FileUtils.rm_f(tmp_file)
+
+        puts "    ✅ Cognito users exported (#{all_users.size} users)"
+      end
+
+      def export_cognito_pool_config(pool_id)
+        output, status = Open3.capture2(
+          'aws', 'cognito-idp', 'describe-user-pool',
+          '--user-pool-id', pool_id
+        )
+
+        unless status.success?
+          @errors << 'Failed to export Cognito pool configuration'
+          return
+        end
+
+        tmp_file = File.join(Dir.tmpdir, "cognito-pool-config-#{@timestamp}.json")
+        File.write(tmp_file, output)
+
+        run_aws('s3', 'cp', tmp_file, "s3://#{@backup_bucket}/cognito/pool-config-#{@timestamp}.json", '--quiet')
+        FileUtils.rm_f(tmp_file)
+
+        puts '    ✅ Cognito pool configuration exported'
+      end
+
+      # ─── S3 Bucket Sync ──────────────────────────────────────────────
+
+      def backup_s3_buckets
+        puts '  📄 S3 bucket backups...'
+
+        @config.s3_buckets.each do |bucket_key|
+          bucket_name = resolve_s3_bucket_name(bucket_key)
+
+          if bucket_name.nil? || bucket_name.empty?
+            puts "    ⚠️  Could not resolve bucket name for :#{bucket_key}"
+            @errors << "Could not resolve S3 bucket: #{bucket_key}"
+            next
+          end
+
+          puts "    Syncing #{bucket_name}..."
+          output, status = Open3.capture2e(
+            'aws', 's3', 'sync',
+            "s3://#{bucket_name}",
+            "s3://#{@backup_bucket}/s3/#{bucket_key}/#{@timestamp}/",
+            '--quiet'
+          )
+
+          if status.success?
+            puts "    ✅ #{bucket_key} synced"
+          else
+            puts "    ⚠️  #{bucket_key} sync failed: #{output.strip}"
+            @errors << "S3 sync failed for #{bucket_key}"
+          end
+        end
+
+        @summary << "S3: #{@config.s3_buckets.size} bucket(s) synced" if @errors.none? { |e| e.include?('S3') }
+      end
+
+      # ─── Cleanup ─────────────────────────────────────────────────────
+
+      def cleanup_old_backups!
+        puts '  🧹 Cleaning up old backups...'
+        cleanup_cognito_backups if @config.cognito?
+        cleanup_s3_backups if @config.s3_buckets.any?
+        cleanup_dynamodb_snapshots if @config.dynamodb?
+      end
+
+      def cleanup_cognito_backups
+        max_keep = @config.retention[:cognito] || 10
+
+        %w[users pool-config].each do |prefix|
+          output, status = Open3.capture2(
+            'aws', 's3api', 'list-objects-v2',
+            '--bucket', @backup_bucket,
+            '--prefix', "cognito/#{prefix}-",
+            '--query', 'Contents[].Key',
+            '--output', 'json'
+          )
+          next unless status.success?
+
+          keys = begin
+            JSON.parse(output)
+          rescue StandardError
+            []
+          end
+          keys = Array(keys).compact.sort.reverse
+
+          next if keys.size <= max_keep
+
+          keys[max_keep..].each do |key|
+            Open3.capture2('aws', 's3', 'rm', "s3://#{@backup_bucket}/#{key}")
+          end
+        end
+      end
+
+      def cleanup_s3_backups
+        max_keep = @config.retention[:s3] || 10
+
+        @config.s3_buckets.each do |bucket_key|
+          output, status = Open3.capture2(
+            'aws', 's3api', 'list-objects-v2',
+            '--bucket', @backup_bucket,
+            '--prefix', "s3/#{bucket_key}/",
+            '--delimiter', '/',
+            '--query', 'CommonPrefixes[].Prefix',
+            '--output', 'json'
+          )
+          next unless status.success?
+
+          prefixes = begin
+            JSON.parse(output)
+          rescue StandardError
+            []
+          end
+          prefixes = Array(prefixes).compact.sort.reverse
+
+          next if prefixes.size <= max_keep
+
+          prefixes[max_keep..].each do |prefix|
+            Open3.capture2e('aws', 's3', 'rm', "s3://#{@backup_bucket}/#{prefix}", '--recursive')
+          end
+        end
+      end
+
+      def cleanup_dynamodb_snapshots
+        retention_days = @config.retention[:snapshots] || 90
+        cutoff = Time.now - (retention_days * 86_400)
+        cutoff_epoch = cutoff.to_i
+
+        table_names = resolve_table_names
+        table_names.each do |table_name|
+          output, status = Open3.capture2(
+            'aws', 'dynamodb', 'list-backups',
+            '--table-name', table_name,
+            '--time-range-upper-bound', cutoff_epoch.to_s
+          )
+          next unless status.success?
+
+          data = begin
+            JSON.parse(output)
+          rescue StandardError
+            {}
+          end
+          arns = (data['BackupSummaries'] || []).map { |b| b['BackupArn'] }.compact
+
+          arns.each do |arn|
+            Open3.capture2('aws', 'dynamodb', 'delete-backup', '--backup-arn', arn)
+          end
+        end
+      end
+
+      # ─── Terraform Output Resolution ─────────────────────────────────
+
+      def resolve_table_names
+        @resolve_table_names ||= fetch_table_names_from_terraform
+      end
+
+      def fetch_table_names_from_terraform
+        env_dir = File.join(@infra_dir, @env)
+        return [] unless Dir.exist?(env_dir)
+
+        Dir.chdir(env_dir) do
+          names = try_terraform_table_output
+          return names if names
+
+          fetch_table_names_from_all_outputs
+        end
+      end
+
+      def try_terraform_table_output
+        output, status = Open3.capture2('terraform', 'output', '-json', 'dynamodb_table_names')
+        return nil unless status.success?
+
+        names = begin
+          JSON.parse(output)
+        rescue StandardError
+          nil
+        end
+        names.is_a?(Array) && names.any? ? Array(names) : nil
+      end
+
+      def fetch_table_names_from_all_outputs
+        output, status = Open3.capture2('terraform', 'output', '-json')
+        return [] unless status.success?
+
+        all_outputs = begin
+          JSON.parse(output)
+        rescue StandardError
+          {}
+        end
+
+        # Look for dynamodb_table_names in output
+        if all_outputs['dynamodb_table_names']
+          val = all_outputs['dynamodb_table_names']['value']
+          return Array(val) if val
+        end
+
+        # Try to find any output that looks like table names
+        all_outputs.each do |key, data|
+          next unless key.include?('table')
+
+          val = data['value']
+          return Array(val) if val.is_a?(Array) && val.any?
+        end
+
+        []
+      end
+
+      def resolve_cognito_pool_id
+        env_dir = File.join(@infra_dir, @env)
+        return nil unless Dir.exist?(env_dir)
+
+        Dir.chdir(env_dir) do
+          output, status = Open3.capture2('terraform', 'output', '-json', 'user_pool_id')
+          if status.success?
+            val = begin
+              JSON.parse(output)
+            rescue StandardError
+              nil
+            end
+            return val if val.is_a?(String) && !val.empty?
+          end
+
+          # Fallback: search all outputs
+          output, status = Open3.capture2('terraform', 'output', '-json')
+          if status.success?
+            all_outputs = begin
+              JSON.parse(output)
+            rescue StandardError
+              {}
+            end
+            %w[user_pool_id cognito_user_pool_id cognito_pool_id].each do |key|
+              val = all_outputs.dig(key, 'value')
+              return val if val.is_a?(String) && !val.empty?
+            end
+          end
+        end
+
+        nil
+      end
+
+      def resolve_s3_bucket_name(bucket_key)
+        env_dir = File.join(@infra_dir, @env)
+        return nil unless Dir.exist?(env_dir)
+
+        name = Dir.chdir(env_dir) { fetch_s3_bucket_from_terraform(bucket_key) }
+        name || discover_bucket_by_prefix(bucket_key)
+      end
+
+      def fetch_s3_bucket_from_terraform(bucket_key)
+        key_name = "#{bucket_key}_bucket_name"
+        output, status = Open3.capture2('terraform', 'output', '-json', key_name)
+        if status.success?
+          val = begin
+            JSON.parse(output)
+          rescue StandardError
+            nil
+          end
+          return val if val.is_a?(String) && !val.empty?
+        end
+
+        fetch_s3_bucket_from_all_outputs(bucket_key)
+      end
+
+      def fetch_s3_bucket_from_all_outputs(bucket_key)
+        output, status = Open3.capture2('terraform', 'output', '-json')
+        return nil unless status.success?
+
+        all_outputs = begin
+          JSON.parse(output)
+        rescue StandardError
+          {}
+        end
+
+        [
+          "#{bucket_key}_bucket_name",
+          "#{bucket_key}_bucket",
+          bucket_key.to_s
+        ].each do |var|
+          val = all_outputs.dig(var, 'value')
+          return val if val.is_a?(String) && !val.empty?
+        end
+
+        nil
+      end
+
+      def discover_bucket_by_prefix(bucket_key)
+        prefix = "#{@app_name}-#{bucket_key.to_s.tr('_', '-')}-#{@env}"
+        output, status = Open3.capture2(
+          'aws', 's3api', 'list-buckets',
+          '--query', "Buckets[?starts_with(Name, '#{prefix}')].Name | [0]",
+          '--output', 'text'
+        )
+        return nil unless status.success?
+
+        val = output.strip
+        val == 'None' ? nil : val
+      end
+
+      # ─── Helpers ─────────────────────────────────────────────────────
+
+      def short_table_name(table_name)
+        table_name.sub(/\A#{Regexp.escape(@app_name)}-#{Regexp.escape(@env)}-/, '')
+      end
+
+      def detect_region
+        # Try AWS_DEFAULT_REGION, then AWS_REGION, then fall back to us-east-1
+        ENV['AWS_DEFAULT_REGION'] || ENV['AWS_REGION'] || 'us-east-1'
+      end
+
+      def run_aws(*args)
+        output, status = Open3.capture2e('aws', *args)
+        return if status.success?
+
+        @errors << "AWS CLI failed: aws #{args.join(' ')}"
+        puts "    ⚠️  #{output.strip}" unless output.strip.empty?
+      end
+
+      def print_summary
+        puts ''
+        if @summary.any?
+          puts "  ✅ Backup complete (#{@backup_bucket})"
+          @summary.each { |s| puts "     • #{s}" }
+        end
+        return unless @errors.any?
+
+        puts "  ⚠️  #{@errors.size} warning(s):"
+        @errors.each { |e| puts "     • #{e}" }
+      end
+    end
+  end
+end

data/lib/belt/cli/deploy_command.rb

@@ -6,6 +6,8 @@ require 'open3'
 require 'tmpdir'
 require_relative 'env_resolver'
 require_relative 'terraform_command'
+require_relative 'backup_config'
+require_relative 'backup_runner'
 
 module Belt
   module CLI
@@ -20,6 +22,8 @@ module Belt
 
         auto_approve = false
         rebuild = false
+        skip_backup = false
+        backup_only = false
         filtered_args = []
 
         args.each do |arg|
@@ -28,6 +32,10 @@ module Belt
             auto_approve = true
           when '--rebuild'
             rebuild = true
+          when '--skip-backup', '--no-backup'
+            skip_backup = true
+          when '--backup-only'
+            backup_only = true
           when '-h', '--help'
             puts help_text
             exit 0
@@ -61,10 +69,12 @@ module Belt
           end
         end
 
-        if rebuild
-          new(env, auto_approve: auto_approve, extra_args: filtered_args).run_rebuild
+        if backup_only
+          new(env, auto_approve: auto_approve, skip_backup: false, extra_args: filtered_args).run_backup_only
+        elsif rebuild
+          new(env, auto_approve: auto_approve, skip_backup: skip_backup, extra_args: filtered_args).run_rebuild
         else
-          new(env, auto_approve: auto_approve, extra_args: filtered_args).run
+          new(env, auto_approve: auto_approve, skip_backup: skip_backup, extra_args: filtered_args).run
         end
       end
 
@@ -77,34 +87,54 @@ module Belt
 
           This runs the full deployment lifecycle:
             1. Ensure Gemfile.lock is consistent (fix stale PATH refs)
-            2. terraform init    (initialize providers/modules)
-            3. terraform plan    (preview changes)
-            4. Prompt for confirmation (unless --auto)
-            5. terraform apply   (deploy changes)
+            2. Regenerate route manifests
+            3. Run pre-deploy backups (if configured in belt.rb)
+            4. terraform init    (initialize providers/modules)
+            5. terraform plan    (preview changes)
+            6. Prompt for confirmation (unless --auto)
+            7. terraform apply   (deploy changes)
 
           Options:
             --auto, --yes, -y    Skip confirmation prompt (auto-approve)
             --rebuild            Rebuild and push Lambda code directly (bypasses Terraform).
                                  Much faster for code-only changes — packages gems via Docker,
                                  zips, and pushes with `aws lambda update-function-code`.
+            --skip-backup        Skip pre-deploy backup phase
+            --no-backup          Alias for --skip-backup
+            --backup-only        Run backups only, do not deploy
             -h, --help           Show this help
 
           Environment:
             Defaults to BELT_ENV if set, otherwise the first available environment.
 
+          Backup Configuration:
+            Create `infrastructure/<env>/belt.rb` to configure backups:
+
+              Belt.configure do |config|
+                config.backups do
+                  dynamodb :all
+                  cognito :users, :pool_config
+                  s3 :legal_documents
+                  retention snapshots: 90, cognito: 10, s3: 10
+                end
+              end
+
           Examples:
             belt deploy                # Deploy dev (or BELT_ENV)
             belt deploy prod           # Deploy to prod
             belt deploy dev --auto     # Deploy without confirmation (CI mode)
             belt deploy --rebuild      # Fast code push to dev (no infra changes)
             belt deploy prod --rebuild # Fast code push to prod
+            belt deploy prod --skip-backup  # Skip backups for this deploy
+            belt deploy prod --backup-only  # Run backups without deploying
             belt deploy frontend dev   # Deploy frontend assets only
         HELP
       end
 
-      def initialize(env, auto_approve: false, extra_args: [])
+      def initialize(env, auto_approve: false, skip_backup: false, extra_args: [])
         @env = env
         @auto_approve = auto_approve
+        @skip_backup = skip_backup
         @extra_args = extra_args
         @infra_dir = TerraformCommand.find_infrastructure_dir
         @project_root = find_project_root
@@ -118,6 +148,7 @@ module Belt
 
         ensure_lockfile_consistent!
         generate_routes_if_needed
+        run_backups unless @skip_backup
 
         Dir.chdir(env_dir) do
           run_init
@@ -135,6 +166,28 @@ module Belt
         puts "\n   Run `belt server` to view your app locally (auto-connects to the deployed API)."
       end
 
+      def run_backup_only
+        validate!
+
+        puts "belt → running backups for #{@env}\n\n"
+
+        backup_config = load_backup_config
+        if backup_config.nil?
+          puts "No backup configuration found for #{@env}."
+          puts "Create infrastructure/#{@env}/belt.rb to configure backups."
+          puts "\nExample:"
+          puts '  Belt.configure do |config|'
+          puts '    config.backups do'
+          puts '      dynamodb :all'
+          puts '    end'
+          puts '  end'
+          exit 1
+        end
+
+        run_backup_phase(backup_config)
+        puts "\n✅ Backups complete for #{@env}!"
+      end
+
       def run_rebuild
         validate!
         validate_aws!
@@ -200,6 +253,42 @@ module Belt
         end
       end
 
+      # ─── Backup Phase ───────────────────────────────────────────────
+
+      def run_backups
+        backup_config = load_backup_config
+        return unless backup_config
+
+        run_backup_phase(backup_config)
+        puts ''
+      end
+
+      def load_backup_config
+        BackupConfig.load(@env, infra_dir: @infra_dir)
+      end
+
+      def run_backup_phase(backup_config)
+        puts '━━━ pre-deploy backup ━━━'
+        app_name = detect_app_name_for_backup
+        runner = BackupRunner.new(@env, backup_config, infra_dir: @infra_dir, app_name: app_name)
+        runner.run
+      end
+
+      def detect_app_name_for_backup
+        # Try terraform.tfvars first for the app name
+        tfvars_file = File.join(@infra_dir, @env, 'terraform.tfvars')
+        if File.exist?(tfvars_file)
+          match = File.read(tfvars_file).match(/^\s*app_name\s*=\s*"([^"]+)"/)
+          return match[1] if match
+
+          match = File.read(tfvars_file).match(/^\s*project\s*=\s*"([^"]+)"/)
+          return match[1] if match
+        end
+
+        # Fall back to directory name
+        File.basename(@project_root)
+      end
+
       # Ensure Gemfile.lock doesn't have stale PATH references that will break
       # the Docker-based gem build. If the Gemfile no longer uses `path:` but the
       # lockfile still references a PATH source, refresh the lock.

data/lib/belt/cli/generate_command.rb

@@ -39,8 +39,9 @@ module Belt
               lambda/models/<name>.rb                            Model with validations and fields
               lambda/controllers/<app>/<names>_controller.rb    RESTful controller (index, show, create, update, destroy)
               config/routes.tf.rb                                Route entry added
-              config/schema.tf.rb                                DynamoDB table schema added
+              config/schema.tf.rb                                API response contract added
               lambda/lib/routes/<app>_routes.rb                  Route manifest updated
+              infrastructure/modules/app/dynamodb.tf             DynamoDB table generated
               frontend/src/pages/<names>/                        React pages (if frontend exists)
 
             Alias: `belt g resource` works the same way.
@@ -58,7 +59,9 @@ module Belt
           ],
           notes: <<~NOTES
             Creates:
-              lambda/models/<name>.rb    Model class inheriting from ActiveItem::Base
+              lambda/models/<name>.rb                            Model class inheriting from ApplicationRecord
+              config/schema.tf.rb                                API response contract added
+              infrastructure/modules/app/dynamodb.tf             DynamoDB table generated
           NOTES
         },
         'controller' => {
@@ -452,11 +455,12 @@ module Belt
 
         content = File.read(schema_file)
 
-        field_lines = @fields.map { |f| "    field :#{f[:name]}, type: :#{f[:type]}" }
-        field_lines << '    field :created_at, type: :string'
-        field_lines << '    field :updated_at, type: :string'
+        # Generate OpenAPI-style model block for API response contracts
+        response_fields = @fields.map { |f| "    #{schema_type_for(f[:type])} :#{f[:name]}" }
+        response_fields << '    string :created_at'
+        response_fields << '    string :updated_at'
 
-        schema_block = "  model :#{@singular_name} do\n#{field_lines.join("\n")}\n  end\n"
+        schema_block = "  model :#{@singular_name} do\n#{response_fields.join("\n")}\n  end\n"
 
         # If model already exists (force mode), replace it
         existing_model_pattern = /^  model :#{Regexp.escape(@singular_name)} do\n.*?^  end\n/m
@@ -474,6 +478,18 @@ module Belt
         puts "  update  #{schema_file}"
       end
 
+      # Map generator field types to OpenAPI schema DSL types
+      def schema_type_for(field_type)
+        case field_type.to_s
+        when 'text' then 'string'
+        when 'integer' then 'integer'
+        when 'float' then 'number'
+        when 'boolean' then 'boolean'
+        when 'date', 'datetime' then 'string'
+        else 'string'
+        end
+      end
+
       def sync_tables
         Belt::CLI::TablesCommand.sync_all_environments
       end

data/lib/belt/cli/tables_command.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative 'app_detection'
 require_relative 'env_resolver'
 require_relative 'terraform_command'
 require_relative '../inflector'
@@ -8,10 +7,8 @@ require_relative '../inflector'
 module Belt
   module CLI
     class TablesCommand
-      SCHEMA_FILE_CANDIDATES = ['config/schema.tf.rb', 'infrastructure/schema.tf.rb'].freeze
       MODULE_DIR = 'infrastructure/modules/app'
-
-      include AppDetection
+      MODELS_DIR = 'lambda/models'
 
       def self.run(args)
         # Environment argument accepted for backwards compatibility but unused —
@@ -22,27 +19,22 @@ module Belt
       end
 
       # Automatically sync dynamodb.tf in the app module.
-      # Called by generators after updating schema.tf.rb.
+      # Called by generators after creating/updating model files.
       def self.sync_all_environments
-        return unless schema_file_path
+        return unless Dir.exist?(MODELS_DIR)
 
         new(quiet: true).run
       end
 
-      def self.schema_file_path
-        SCHEMA_FILE_CANDIDATES.find { |f| File.exist?(f) }
-      end
-
       def initialize(quiet: false)
         @quiet = quiet
-        @app_name = detect_app_name
       end
 
       def run
         validate!
-        models = parse_schema
+        models = parse_models
         if models.empty?
-          puts "No models found in #{SCHEMA_FILE}" unless @quiet
+          puts "No models found in #{MODELS_DIR}/" unless @quiet
           return
         end
 
@@ -52,11 +44,10 @@ module Belt
       private
 
       def validate!
-        schema_file = self.class.schema_file_path
-        unless schema_file
+        unless Dir.exist?(MODELS_DIR)
           unless @quiet
-            abort 'Error: No schema.tf.rb found (checked config/ and infrastructure/). ' \
-                  'Run `belt generate resource` first.'
+            abort "Error: No models directory found at #{MODELS_DIR}/. " \
+                  'Run `belt generate model` to create your first model.'
           end
           return
         end
@@ -68,21 +59,53 @@ module Belt
               'Run `belt new` to create a project with the correct structure.'
       end
 
-      def parse_schema
-        schema_file = self.class.schema_file_path
-        return [] unless schema_file && File.exist?(schema_file)
+      def parse_models
+        model_files = Dir.glob(File.join(MODELS_DIR, '*.rb'))
+                        .reject { |f| File.basename(f) == 'application_record.rb' }
+                        .reject { |f| File.basename(f).start_with?('concerns') }
+                        .sort
+
+        model_files.filter_map { |f| parse_model_file(f) }
+      end
+
+      # Parse a model file to extract its name and index declarations.
+      # Uses lightweight regex parsing — does NOT require loading activeitem or the model.
+      def parse_model_file(file_path)
+        content = File.read(file_path)
+
+        # Extract class name from `class Foo < ApplicationRecord`
+        class_match = content.match(/^class\s+(\w+)\s*<\s*ApplicationRecord/)
+        return nil unless class_match
+
+        class_name = class_match[1]
+        model_name = Belt::Inflector.underscore(class_name)
+
+        # Extract indexes() declaration
+        indexes = extract_indexes(content)
+
+        { name: model_name, indexes: indexes }
+      end
+
+      def extract_indexes(content)
+        indexes = []
+
+        # Match the indexes() DSL: indexes('Name' => { partition_key: 'pk' }, ...)
+        # This handles the Ruby hash syntax used by ActiveItem
+        index_block = content.match(/^\s*indexes\(\s*\n?(.*?)\n?\s*\)/m)
+        return indexes unless index_block
 
-        parser = SchemaParser.new
-        schema_content = File.read(schema_file)
+        index_content = index_block[1]
 
-        # Replace DSL wrapper with direct parser call
-        inner = schema_content.sub(/\A(?:Belt\.application)\.schema\.draw do\n?/, '').sub(/\n?end\s*\z/, '')
-        inner.strip!
+        # Parse each index entry: 'IndexName' => { partition_key: 'key', sort_key: 'key' }
+        index_content.scan(/'([^']+)'\s*=>\s*\{([^}]+)\}/) do |name, opts|
+          partition_key = opts.match(/partition_key:\s*'([^']+)'/)&.captures&.first
+          sort_key = opts.match(/sort_key:\s*'([^']+)'/)&.captures&.first
+          next unless partition_key
 
-        return [] if inner.empty? || inner.match?(/\A\s*\z/m)
+          indexes << { name: name, partition_key: partition_key, sort_key: sort_key }
+        end
 
-        parser.instance_eval(inner, schema_file)
-        parser.models
+        indexes
       end
 
       def generate_dynamodb_tf(models)
@@ -108,78 +131,94 @@ module Belt
 
       def render_dynamodb(models)
         blocks = models.map { |m| render_table(m) }
-        "# Auto-generated by Belt from schema.tf.rb\n" \
+        "# Auto-generated by Belt from model definitions\n" \
           "# Do not edit manually — re-run `belt setup tables`\n\n#{blocks.join("\n\n")}\n"
       end
 
       def render_table(model)
         name = table_name(model[:name])
-        <<~HCL
-          resource "aws_dynamodb_table" "#{Belt::Inflector.pluralize(model[:name])}" {
-            name         = "#{name}"
-            billing_mode = "PAY_PER_REQUEST"
-            hash_key     = "id"
-
-            attribute {
-              name = "id"
-              type = "S"
-            }
-
-            attribute {
-              name = "_recent_pk"
-              type = "S"
-            }
-
-            attribute {
-              name = "createdAt"
-              type = "S"
-            }
-
-            global_secondary_index {
-              name            = "RecentIndex"
-              hash_key        = "_recent_pk"
-              range_key       = "createdAt"
-              projection_type = "ALL"
-            }
-
-            tags = {
-              Name        = "#{name}"
-              Environment = var.environment
-              ManagedBy   = "Terraform"
-            }
-          }
-        HCL
-      end
-
-      def table_name(model_name)
-        "#{@app_name}-${var.environment}-#{Belt::Inflector.pluralize(model_name)}"
-      end
-
-      # Minimal DSL parser for schema.tf.rb
-      class SchemaParser
-        attr_reader :models
-
-        def initialize
-          @models = []
+        custom_indexes = model[:indexes] || []
+
+        # Collect all custom index attribute names, deduplicating against built-in ones
+        builtin_attrs = Set.new(%w[id _recent_pk createdAt])
+        extra_attrs = []
+        custom_indexes.each do |idx|
+          unless builtin_attrs.include?(idx[:partition_key])
+            extra_attrs << idx[:partition_key]
+            builtin_attrs.add(idx[:partition_key])
+          end
+          if idx[:sort_key] && !builtin_attrs.include?(idx[:sort_key])
+            extra_attrs << idx[:sort_key]
+            builtin_attrs.add(idx[:sort_key])
+          end
         end
 
-        def model(name, &block)
-          model_def = ModelParser.new
-          model_def.instance_eval(&block) if block
-          @models << { name: name.to_s, fields: model_def.fields }
+        lines = []
+        lines << "resource \"aws_dynamodb_table\" \"#{Belt::Inflector.pluralize(model[:name])}\" {"
+        lines << "  name         = \"#{name}\""
+        lines << '  billing_mode = "PAY_PER_REQUEST"'
+        lines << '  hash_key     = "id"'
+        lines << ''
+        lines << '  attribute {'
+        lines << '    name = "id"'
+        lines << '    type = "S"'
+        lines << '  }'
+        lines << ''
+        lines << '  attribute {'
+        lines << '    name = "_recent_pk"'
+        lines << '    type = "S"'
+        lines << '  }'
+        lines << ''
+        lines << '  attribute {'
+        lines << '    name = "createdAt"'
+        lines << '    type = "S"'
+        lines << '  }'
+
+        extra_attrs.each do |attr|
+          lines << ''
+          lines << '  attribute {'
+          lines << "    name = \"#{attr}\""
+          lines << '    type = "S"'
+          lines << '  }'
         end
-      end
 
-      class ModelParser
-        attr_reader :fields
-
-        def initialize
-          @fields = []
+        lines << ''
+        lines << '  global_secondary_index {'
+        lines << '    name            = "RecentIndex"'
+        lines << '    hash_key        = "_recent_pk"'
+        lines << '    range_key       = "createdAt"'
+        lines << '    projection_type = "ALL"'
+        lines << '  }'
+
+        custom_indexes.each do |idx|
+          lines << ''
+          lines << '  global_secondary_index {'
+          lines << "    name            = \"#{idx[:name]}\""
+          lines << "    hash_key        = \"#{idx[:partition_key]}\""
+          lines << "    range_key       = \"#{idx[:sort_key]}\"" if idx[:sort_key]
+          lines << '    projection_type = "ALL"'
+          lines << '  }'
         end
 
-        def field(name, **opts)
-          @fields << { name: name.to_s, type: opts[:type]&.to_s || 'string' }
-        end
+        lines << ''
+        lines << '  point_in_time_recovery {'
+        lines << '    enabled = var.enable_pitr'
+        lines << '  }'
+        lines << ''
+        lines << '  deletion_protection_enabled = var.deletion_protection'
+        lines << ''
+        lines << '  tags = {'
+        lines << "    Name        = \"#{name}\""
+        lines << '    Environment = var.environment'
+        lines << '    ManagedBy   = "Terraform"'
+        lines << '  }'
+        lines << '}'
+
+        lines.join("\n")
+      end
+
+      def table_name(model_name)
+        "${var.app_name}-${var.environment}-#{Belt::Inflector.pluralize(model_name)}"
       end
     end
   end

data/lib/belt/cli.rb

@@ -14,6 +14,8 @@ require_relative 'cli/views_command'
 require_relative 'cli/setup_command'
 require_relative 'cli/terraform_command'
 require_relative 'cli/deploy_command'
+require_relative 'cli/backup_config'
+require_relative 'cli/backup_runner'
 require_relative 'cli/server_command'
 require_relative 'cli/routes_command'
 require_relative 'cli/lambda_config_command'

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.3'
+  VERSION = '0.2.5'
 end

data/lib/templates/environment/main.tf.erb

@@ -39,6 +39,8 @@ module "app" {
   environment  = var.environment
   aws_region   = var.aws_region
   domain       = var.domain
+  enable_pitr  = var.enable_pitr
+  deletion_protection = var.deletion_protection
   frontend_urls = concat(
     var.domain != "" ? ["https://${var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"}"] : [],
     var.environment == "prod" ? [] : ["http://localhost:3000"]

data/lib/templates/environment/terraform.tfvars.erb

@@ -4,3 +4,10 @@ domain      = "<%= @domain %>"
 <% else -%>
 # domain      = "myapp.com"
 <% end -%>
+
+# DynamoDB protection (PITR is true by default everywhere)
+<% if @env_name == 'prod' || @env_name == 'production' -%>
+deletion_protection = true
+<% else -%>
+# deletion_protection = true  # Enable in production environments
+<% end -%>

data/lib/templates/environment/variables.tf.erb

@@ -20,3 +20,15 @@ variable "domain" {
   type        = string
   default     = ""
 }
+
+variable "enable_pitr" {
+  description = "Enable DynamoDB Point-in-Time Recovery (PITR) for all tables"
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection" {
+  description = "Enable deletion protection on DynamoDB tables (prevents accidental terraform destroy)"
+  type        = bool
+  default     = false
+}

data/lib/templates/module/variables.tf.erb

@@ -37,3 +37,15 @@ variable "lambda_config" {
   type        = any
   default     = {}
 }
+
+variable "enable_pitr" {
+  description = "Enable DynamoDB Point-in-Time Recovery (PITR) for all tables"
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection" {
+  description = "Enable deletion protection on DynamoDB tables (prevents accidental terraform destroy)"
+  type        = bool
+  default     = false
+}

data/lib/templates/new_app/config/schema.tf.rb.erb

@@ -1,9 +1,22 @@
-Belt.application.schema.draw do
-  # model :post do
-  #   field :title, type: :string, required: true
-  #   field :slug, type: :string, required: true
-  #   field :content, type: :string
-  #   field :status, type: :string, enum: %w[draft published]
-  #   field :published_at, type: :string
-  # end
+Belt.application.schema.define do
+  # API Schema Definitions — request/response contracts
+  #
+  # request :create_thing — declares what an endpoint accepts
+  # model :thing          — declares what an endpoint returns
+  #
+  # Example:
+  #   request :create_post do
+  #     string :title, required: true
+  #     string :body, required: true
+  #     string :status
+  #   end
+  #
+  #   model :post do
+  #     string :id
+  #     string :title
+  #     string :body
+  #     string :status
+  #     string :created_at
+  #     string :updated_at
+  #   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.5
 platform: ruby
 authors:
 - Stowzilla
@@ -70,6 +70,8 @@ files:
 - lib/belt/assets/welcome.css
 - lib/belt/cli.rb
 - lib/belt/cli/app_detection.rb
+- lib/belt/cli/backup_config.rb
+- lib/belt/cli/backup_runner.rb
 - lib/belt/cli/bucket_security.rb
 - lib/belt/cli/console_command.rb
 - lib/belt/cli/deploy_command.rb