@everystack/cli 0.2.36 → 0.2.39

package/README.md

@@ -286,4 +286,8 @@ The handler implements the full Expo Updates manifest protocol:
 
 ## License
 
-MIT
+[AGPL-3.0-only](https://www.gnu.org/licenses/agpl-3.0.html) © Scalable Technology, Inc.
+
+A commercial license is available for organizations that cannot or do not wish to
+comply with the AGPL-3.0 terms. For commercial licensing, contact
+licensing@scalable.technology.

package/package.json

@@ -1,8 +1,18 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.36",
+  "version": "0.2.39",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
+  "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scalable-technology/everystack.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/scalable-technology/everystack#readme",
+  "bugs": {
+    "url": "https://github.com/scalable-technology/everystack/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -43,12 +53,6 @@
   "bin": {
     "everystack": "./src/cli/index.ts"
   },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "prepublishOnly": "tsc --module commonjs --moduleResolution node --target ES2022 --esModuleInterop --skipLibCheck --declaration false --outDir src src/env.ts",
-    "lint": "tsc --noEmit"
-  },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
@@ -119,5 +123,10 @@
     "react": "19.2.6",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
   }
-}
+}

package/src/cli/commands/db.ts

@@ -9,6 +9,34 @@ import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 
+/** Secret-store keys that may hold the privileged (operator) connection URL,
+ *  in precedence order. Names vary by deployment; --secret-name overrides. */
+const ADMIN_URL_KEYS = ['ADMIN_DATABASE_URL', 'AdminDatabaseUrl', 'ADMIN_URL'];
+
+/**
+ * Parse a postgres connection URL into psql's PG* environment variables.
+ *
+ * Passing the credential via env (not argv) keeps the password out of the
+ * process table and shell history. Pure and side-effect free — it never logs;
+ * callers must never log the result either (it contains PGPASSWORD).
+ */
+export function pgEnvFromUrl(url: string): Record<string, string> {
+  const u = new URL(url);
+  if (!/^postgres(ql)?:$/.test(u.protocol)) {
+    throw new Error(`Not a postgres connection URL (protocol: ${u.protocol})`);
+  }
+  const env: Record<string, string> = {};
+  if (u.hostname) env.PGHOST = decodeURIComponent(u.hostname);
+  if (u.port) env.PGPORT = u.port;
+  if (u.username) env.PGUSER = decodeURIComponent(u.username);
+  if (u.password) env.PGPASSWORD = decodeURIComponent(u.password);
+  const database = u.pathname.replace(/^\//, '');
+  if (database) env.PGDATABASE = decodeURIComponent(database);
+  const sslmode = u.searchParams.get('sslmode');
+  if (sslmode) env.PGSSLMODE = sslmode;
+  return env;
+}
+
 export async function dbMigrateCommand(flags: Record<string, string>): Promise<void> {
   step('Resolving deployed config...');
   let config;
@@ -115,6 +143,130 @@ export async function dbResetCommand(flags: Record<string, string>): Promise<voi
   }
 }
 
+export async function dbProvisionCommand(flags: Record<string, string>): Promise<void> {
+  if (!flags.stage) {
+    fail('--stage is required for db:provision (it writes the DATABASE_URL secret for that stage)');
+    process.exit(1);
+  }
+
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  info('Creating the least-privilege role chain on your EXISTING database (no database is created).');
+  step('Provisioning roles...');
+
+  // Generate the login password and keep it in memory only — it is written straight into
+  // the secret store and is NEVER printed, logged, or returned to a human.
+  const { randomBytes } = await import('node:crypto');
+  const authPassword = randomBytes(24).toString('hex');
+
+  let result: any;
+  try {
+    result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword });
+  } catch (err: any) {
+    fail(`db:provision failed: ${err.message}`);
+    info('Ensure your IAM user/role has lambda:InvokeFunction permission.');
+    process.exit(1);
+  }
+  if (result?.error) {
+    fail(`db:provision failed: ${result.error}`);
+    process.exit(1);
+  }
+  success(`Role chain ready: ${result.loginRole} (LOGIN, NOINHERIT, no BYPASSRLS) → can SET ROLE to ${result.appRoles.join(', ')}`);
+
+  // Resolve host/port/db (not secret) to build the connection string in memory.
+  let conn: any;
+  try {
+    conn = await invokeAction(config.region, opsFunction(config), 'db:psql', {});
+  } catch {
+    /* handled below */
+  }
+  if (!conn?.host) {
+    fail('Could not resolve the database host to build DATABASE_URL.');
+    info('Provide a db:psql connectionInfo callback, or set the DATABASE_URL secret yourself.');
+    process.exit(1);
+  }
+  const url = `postgresql://${result.loginRole}:${authPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`;
+
+  // Write the secret directly to the SST secret store — never display it.
+  step('Writing the DATABASE_URL secret (not displayed)...');
+  try {
+    const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets.js');
+    const { parseAppName } = await import('../discover.js');
+    const ctx = { appName: await parseAppName(), stage: flags.stage, region: config.region };
+    const secrets = await loadSstSecrets(ctx);
+    secrets.DATABASE_URL = url;
+    await putSstSecrets(ctx, secrets);
+  } catch (err: any) {
+    fail(`Failed to write the DATABASE_URL secret: ${err.message}`);
+    info('Ensure your IAM role can write the SST secret store (s3:PutObject, kms:Encrypt).');
+    process.exit(1);
+  }
+
+  success(`DATABASE_URL secret set for stage "${flags.stage}" → role ${result.loginRole}. No credential was displayed.`);
+  console.log('');
+  info('Finish the wiring in sst.config.ts (one-time): declare `new sst.Secret("DatabaseUrl")`,');
+  info('link it to the Api function, and remove the raw Postgres component from the Api link');
+  info('(keep it on the ops/worker functions). Then redeploy.');
+  info(`Verify:  everystack db:doctor --stage ${flags.stage}`);
+}
+
+export async function dbDoctorCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  step('Probing database connections (api + operator)...');
+
+  let report: any;
+  try {
+    report = await invokeAction(config.region, opsFunction(config), 'db:doctor', {});
+  } catch (err: any) {
+    fail(`db:doctor failed: ${err.message}`);
+    info('Ensure your IAM user/role has lambda:InvokeFunction permission.');
+    process.exit(1);
+  }
+
+  if (report?.error) {
+    fail(`db:doctor failed: ${report.error}`);
+    process.exit(1);
+  }
+
+  console.log('');
+  info(`api connection (DATABASE_URL):    role=${report.api.role}  superuser=${report.api.isSuperuser}  bypassrls=${report.api.bypassRls}`);
+  info(`operator connection (ADMIN_URL):  role=${report.admin.role}  superuser=${report.admin.isSuperuser}  bypassrls=${report.admin.bypassRls}`);
+  console.log('');
+
+  for (const c of report.checks as Array<{ name: string; status: string; detail: string; remediation?: string }>) {
+    if (c.status === 'pass') success(`${c.name} — ${c.detail}`);
+    else if (c.status === 'warn') warn(`${c.name} — ${c.detail}`);
+    else fail(`${c.name} — ${c.detail}`);
+    if (c.status === 'fail' && c.remediation) info(`    fix: ${c.remediation}`);
+  }
+
+  console.log('');
+  if (report.ok) {
+    success('db:doctor — database is least-privilege and RLS-subject');
+    process.exit(0);
+  } else {
+    fail('db:doctor — the api connection is NOT correctly least-privilege (see failures above)');
+    process.exit(1);
+  }
+}
+
 export async function dbPsqlCommand(flags: Record<string, string>): Promise<void> {
   step('Resolving deployed config...');
   let config;
@@ -180,9 +332,67 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
     }
   }
 
-  // Interactive mode: not supported for private RDS
-  fail('Interactive psql mode not supported for private RDS instances.');
-  info('Use -c flag to execute SQL queries via Lambda: everystack db:psql -c "SELECT * FROM users;"');
-  info('The Lambda function executes queries from within the VPC where it can reach the database.');
-  process.exit(1);
+  // Interactive mode — break-glass admin psql.
+  //
+  // Authorization IS your AWS identity: resolving the admin URL requires reading
+  // the SST secret store (SSM passphrase + S3 blob + KMS decrypt). If your
+  // profile can't, you don't get a session — the permission is the policy, no
+  // confirmation prompt. CloudTrail records the decrypt, so the access is
+  // audited for free. The URL is resolved in-process and handed to psql via PG*
+  // env vars: it never touches your terminal, argv, clipboard, or psql history.
+  if (!flags.stage) {
+    fail('--stage is required for an interactive session. Example: everystack db:psql --stage production');
+    info('Or run a one-off query via Lambda: everystack db:psql -c "SELECT 1" --stage production');
+    process.exit(1);
+  }
+
+  step('Resolving the admin connection from the secret store...');
+  let secrets: Record<string, string>;
+  try {
+    const { loadSstSecrets } = await import('../utils/secrets.js');
+    const { parseAppName } = await import('../discover.js');
+    const appName = await parseAppName();
+    secrets = await loadSstSecrets({ appName, stage: flags.stage, region: config.region });
+  } catch (err: any) {
+    fail('Could not read the secret store — your AWS profile lacks secrets access.');
+    info('db:psql opens an ADMIN session; it requires SSM + S3 + KMS access to the SST state.');
+    info('If you should have it, check your IAM permissions; otherwise you should not be in psql.');
+    process.exit(1);
+  }
+
+  const keyName = flags['secret-name'] || ADMIN_URL_KEYS.find((k) => secrets[k]);
+  const adminUrl = keyName ? secrets[keyName] : undefined;
+  if (!adminUrl) {
+    fail(`No admin database URL found for stage "${flags.stage}".`);
+    // Names only — never values.
+    info(`Looked for: ${ADMIN_URL_KEYS.join(', ')}. Available secret names: ${Object.keys(secrets).join(', ') || '(none)'}.`);
+    info('Provision one with `everystack db:provision`, or point at an existing key with --secret-name <KEY>.');
+    process.exit(1);
+  }
+
+  let pgEnv: Record<string, string>;
+  try {
+    pgEnv = pgEnvFromUrl(adminUrl);
+  } catch {
+    fail(`The resolved ${keyName} is not a valid postgres connection URL.`);
+    process.exit(1);
+  }
+
+  // Confirm the target (host/user/db are infra identifiers, not the credential);
+  // the password is in PGPASSWORD and is never displayed.
+  success(
+    `Admin psql → ${flags.stage} as ${pgEnv.PGUSER ?? '?'}@${pgEnv.PGHOST ?? '?'}/${pgEnv.PGDATABASE ?? ''} (credential not displayed)`,
+  );
+
+  const { spawn } = await import('node:child_process');
+  const child = spawn('psql', [], { stdio: 'inherit', env: { ...process.env, ...pgEnv } });
+  child.on('error', (err: any) => {
+    if (err.code === 'ENOENT') {
+      fail('psql not found on PATH. Install the PostgreSQL client to use interactive mode.');
+    } else {
+      fail(`Failed to launch psql: ${err.message}`);
+    }
+    process.exit(1);
+  });
+  child.on('close', (code) => process.exit(code ?? 0));
 }

package/src/cli/commands/logs.ts

@@ -133,6 +133,62 @@ function resolveFunctionForOrigin(
   }
 }
 
+/** One FilterLogEvents page (the subset of the AWS shape this command reads). */
+interface FilterLogEventsPage {
+  events?: Array<{ eventId?: string; timestamp?: number; message?: string }>;
+  nextToken?: string;
+}
+
+/** Carries the tail window across polls so a re-query can't reprint events. */
+export interface TailState {
+  /** Highest event timestamp printed so far. Only moves forward. */
+  lastTimestamp: number;
+  /** eventId → timestamp for events at the boundary millisecond — the only ones
+   *  an inclusive-startTime re-query can return again. Pruned each drain so it
+   *  never grows past one millisecond's worth of events. */
+  seen: Map<string, number>;
+}
+
+/**
+ * Drain one poll's worth of pages, printing only events not seen before and
+ * advancing the window forward.
+ *
+ * The loop bug this fixes: FilterLogEvents `startTime` is INCLUSIVE, so a poll
+ * with `startTime = lastTimestamp` re-returns every event sharing that newest
+ * millisecond. The old code advanced `lastTimestamp` only on a strictly-greater
+ * comparison and never deduped, so the boundary batch reprinted on every 2s poll
+ * forever. Here we dedup by `eventId` and advance to the max timestamp, then
+ * prune `seen` to just the boundary millisecond (the only ids that can recur).
+ *
+ * Exported for unit testing without the AWS SDK or the setTimeout poll loop.
+ */
+export async function drainLogEvents(
+  send: (params: { startTime: number; nextToken?: string }) => Promise<FilterLogEventsPage>,
+  state: TailState,
+  emit: (line: string) => void,
+): Promise<void> {
+  let nextToken: string | undefined;
+  do {
+    const page = await send({ startTime: state.lastTimestamp, nextToken });
+    for (const event of page.events ?? []) {
+      const id = event.eventId;
+      const ts = event.timestamp ?? state.lastTimestamp;
+      if (id && state.seen.has(id)) continue; // already printed this one
+      const timestamp = event.timestamp ? new Date(event.timestamp).toISOString() : '';
+      emit(`[${timestamp}] ${(event.message || '').trimEnd()}`);
+      if (id) state.seen.set(id, ts);
+      if (ts > state.lastTimestamp) state.lastTimestamp = ts;
+    }
+    nextToken = page.nextToken;
+  } while (nextToken);
+
+  // Only events at exactly lastTimestamp can be returned again (startTime is
+  // inclusive); drop everything older so `seen` stays bounded.
+  for (const [id, ts] of state.seen) {
+    if (ts < state.lastTimestamp) state.seen.delete(id);
+  }
+}
+
 export async function logsTailCommand(flags: Record<string, string>): Promise<void> {
   step('Resolving deployed config...');
   let config;
@@ -174,42 +230,20 @@ export async function logsTailCommand(flags: Record<string, string>): Promise<vo
 
     success(`Streaming logs from ${logGroupName}...\n`);
 
-    // Poll for new logs every 2 seconds
-    let nextToken: string | undefined;
-    let lastTimestamp = startTime;
+    // Poll for new logs every 2 seconds. State carries the window + dedup set
+    // across polls — see drainLogEvents for why both are required.
+    const state: TailState = { lastTimestamp: startTime, seen: new Map() };
+    const send = (params: { startTime: number; nextToken?: string }) =>
+      client.send(new FilterLogEventsCommand({
+        logGroupName,
+        startTime: params.startTime,
+        filterPattern,
+        ...(params.nextToken ? { nextToken: params.nextToken } : {}),
+      }));
 
     const poll = async () => {
       try {
-        const params: any = {
-          logGroupName,
-          startTime: lastTimestamp,
-          filterPattern,
-        };
-
-        if (nextToken) {
-          params.nextToken = nextToken;
-        }
-
-        const response = await client.send(new FilterLogEventsCommand(params));
-
-        if (response.events && response.events.length > 0) {
-          for (const event of response.events) {
-            if (event.timestamp && event.timestamp > lastTimestamp) {
-              lastTimestamp = event.timestamp;
-            }
-
-            const timestamp = event.timestamp
-              ? new Date(event.timestamp).toISOString()
-              : '';
-            const message = event.message || '';
-
-            console.log(`[${timestamp}] ${message.trimEnd()}`);
-          }
-        }
-
-        nextToken = response.nextToken;
-
-        // Continue polling
+        await drainLogEvents(send, state, (line) => console.log(line));
         setTimeout(poll, 2000);
       } catch (err: any) {
         if (err.name === 'ResourceNotFoundException') {

package/src/cli/commands/security.ts

@@ -0,0 +1,185 @@
+/**
+ * `everystack security:audit` — the gate behind the two-surface security model.
+ *
+ * Goes RED (non-zero exit) on any data-returning SECURITY DEFINER function or any
+ * public view that exposes a non-public column, so CI fails before the leak ships.
+ * Two instruments over one classifier:
+ *
+ *   everystack security:audit                 static scan of migration SQL (pre-merge)
+ *   everystack security:audit --stage <name>  live catalog scan of a deployed stage
+ *
+ * See docs/security.md ("Auditing the surface") and docs/plans/nothing-skips-rls.md.
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {
+  audit,
+  parseFunctionsFromSql,
+  parseViewsAndGrantsFromSql,
+  type Waivers,
+  type AuditReport,
+  type FunctionDescriptor,
+  type ViewDescriptor,
+} from '../security-audit.js';
+import {
+  FUNCTIONS_SQL,
+  RELATIONS_SQL,
+  catalogFunctionToDescriptor,
+  catalogRelationToDescriptor,
+} from '../security-catalog.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
+import { step, success, fail, info, warn } from '../output.js';
+
+const MIGRATION_DIRS = ['drizzle', 'db/migrations', 'migrations', 'db/drizzle'];
+const WAIVER_FILES = ['security-audit.json', '.security-audit.json'];
+
+export async function securityAuditCommand(flags: Record<string, string>): Promise<void> {
+  const waivers = await loadWaivers(flags.config);
+
+  const useCatalog = flags.catalog === 'true' || typeof flags.stage === 'string';
+
+  let report: AuditReport;
+  try {
+    report = useCatalog
+      ? await runCatalogAudit(flags, waivers)
+      : await runStaticAudit(flags, waivers);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  printReport(report, useCatalog ? 'catalog' : 'static');
+  process.exit(report.red > 0 ? 1 : 0);
+}
+
+// ---------------------------------------------------------------------------
+// Static instrument — parse migration SQL, no database.
+// ---------------------------------------------------------------------------
+
+async function runStaticAudit(flags: Record<string, string>, waivers: Waivers): Promise<AuditReport> {
+  const dir = await resolveMigrationDir(flags.dir);
+  step(`Scanning migration SQL in ${dir} ...`);
+
+  const entries = (await fs.readdir(dir)).filter((f) => f.endsWith('.sql')).sort();
+  if (entries.length === 0) {
+    throw new Error(`No .sql files found in ${dir}. Pass --dir <path> to point at your migrations.`);
+  }
+
+  let sql = '';
+  for (const entry of entries) {
+    sql += '\n' + (await fs.readFile(path.join(dir, entry), 'utf8'));
+  }
+
+  const functions = parseFunctionsFromSql(sql);
+  const views = parseViewsAndGrantsFromSql(sql);
+  info(`Found ${functions.length} function(s), ${views.length} view(s) across ${entries.length} migration file(s).`);
+  return audit(functions, views, waivers);
+}
+
+async function resolveMigrationDir(flag?: string): Promise<string> {
+  if (flag) {
+    const abs = path.resolve(flag);
+    await fs.access(abs);
+    return abs;
+  }
+  for (const candidate of MIGRATION_DIRS) {
+    const abs = path.resolve(candidate);
+    try {
+      const stat = await fs.stat(abs);
+      if (stat.isDirectory()) return abs;
+    } catch {
+      // try next
+    }
+  }
+  throw new Error(`No migration directory found (looked for ${MIGRATION_DIRS.join(', ')}). Pass --dir <path>.`);
+}
+
+// ---------------------------------------------------------------------------
+// Catalog instrument — introspect the live database via the ops Lambda.
+// ---------------------------------------------------------------------------
+
+async function runCatalogAudit(flags: Record<string, string>, waivers: Waivers): Promise<AuditReport> {
+  step('Resolving deployed config...');
+  const config = await resolveConfig(flags.stage);
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+
+  step('Introspecting database catalog (functions + relations)...');
+  const fnRows = await catalogQuery(config.region, opsFunction(config), FUNCTIONS_SQL);
+  const relRows = await catalogQuery(config.region, opsFunction(config), RELATIONS_SQL);
+
+  const functions: FunctionDescriptor[] = fnRows.map(catalogFunctionToDescriptor);
+  const views: ViewDescriptor[] = relRows.map(catalogRelationToDescriptor);
+  info(`Catalog: ${functions.length} function(s), ${views.length} relation(s).`);
+  return audit(functions, views, waivers);
+}
+
+async function catalogQuery(region: string, fn: string, sql: string): Promise<any[]> {
+  const result: any = await invokeAction(region, fn, 'db:query', { sql });
+  if (result?.error) throw new Error(`Catalog query failed: ${result.error}`);
+  return result?.rows ?? [];
+}
+
+// ---------------------------------------------------------------------------
+// Waivers + reporting.
+// ---------------------------------------------------------------------------
+
+async function loadWaivers(flag?: string): Promise<Waivers> {
+  const candidates = flag ? [flag] : WAIVER_FILES;
+  for (const candidate of candidates) {
+    const abs = path.resolve(candidate);
+    try {
+      const raw = await fs.readFile(abs, 'utf8');
+      const parsed = JSON.parse(raw);
+      info(`Loaded waivers from ${candidate}.`);
+      return { secdef: parsed.secdef ?? {}, publicColumns: parsed.publicColumns ?? {} };
+    } catch (err: any) {
+      if (err.code !== 'ENOENT') throw new Error(`Could not read waiver config ${candidate}: ${err.message}`);
+    }
+  }
+  return {};
+}
+
+function printReport(report: AuditReport, instrument: 'static' | 'catalog'): void {
+  const reds = [
+    ...report.functions.filter((f) => f.severity === 'red'),
+    ...report.views.filter((v) => v.severity === 'red'),
+  ];
+  const warns = [
+    ...report.functions.filter((f) => f.severity === 'warn'),
+    ...report.views.filter((v) => v.severity === 'warn'),
+  ];
+  const waived = report.functions.filter((f) => f.waived);
+
+  if (reds.length > 0) {
+    console.log('');
+    info('RED — must fix or waive with justification:');
+    for (const f of reds) {
+      fail(`${f.key}`);
+      for (const r of f.reasons) info(`    ${r}`);
+    }
+  }
+
+  if (warns.length > 0) {
+    console.log('');
+    info('WARN — review (does not fail the build):');
+    for (const f of warns) {
+      warn(`${f.key}`);
+      for (const r of f.reasons) info(`    ${r}`);
+    }
+  }
+
+  if (waived.length > 0) {
+    console.log('');
+    info(`Waived (${waived.length}): ${waived.map((f) => f.key).join(', ')}`);
+  }
+
+  console.log('');
+  const summary = `security:audit (${instrument}) — ${report.red} red, ${report.warn} warn`;
+  if (report.red > 0) {
+    fail(summary);
+  } else {
+    success(summary);
+  }
+}

package/src/cli/index.ts

@@ -6,7 +6,7 @@ import { updateCommand } from './commands/update.js';
 import { certsCommand } from './commands/certs.js';
 import { channelsCommand } from './commands/channels.js';
 import { branchesCommand } from './commands/branches.js';
-import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand } from './commands/db.js';
+import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db.js';
 import { consoleCommand } from './commands/console.js';
 import { cachePurgeCommand } from './commands/cache.js';
 import { statusCommand } from './commands/status.js';
@@ -14,6 +14,7 @@ import { diagCommand } from './commands/diag.js';
 import { analyzeSSRCommand } from './commands/analyze.js';
 import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
 import { secretsCommand } from './commands/secrets.js';
+import { securityAuditCommand } from './commands/security.js';
 import { fail } from './output.js';
 
 const args = process.argv.slice(2);
@@ -114,6 +115,12 @@ async function main() {
     case 'db:psql':
       await dbPsqlCommand(flags);
       break;
+    case 'db:doctor':
+      await dbDoctorCommand(flags);
+      break;
+    case 'db:provision':
+      await dbProvisionCommand(flags);
+      break;
     case 'console':
       await consoleCommand(flags);
       break;
@@ -143,6 +150,9 @@ async function main() {
     case 'logs:query':
       await logsQueryCommand(flags);
       break;
+    case 'security:audit':
+      await securityAuditCommand(flags);
+      break;
     case 'secrets': {
       // secrets <subcommand> [positional...] [--flags]
       // Extract positional args: everything after subcommand that isn't a flag or flag value
@@ -176,9 +186,14 @@ Usage:
   everystack db:migrate        [--stage <name>]  Run database migrations on deployed Lambda
   everystack db:seed           [--stage <name>]  Seed database on deployed Lambda (dev only)
   everystack db:reset          [--stage <name>]  Drop all schemas + re-run migrations (dev only)
-  everystack db:psql           [--stage <name>] -c <command>  Execute SQL query via Lambda (private RDS)
+  everystack db:psql           --stage <name>  Interactive ADMIN psql (IAM-gated; resolves the admin URL in-process)
+  everystack db:psql           [--stage <name>] -c <command>  Run one query via Lambda (works for private RDS)
+  everystack db:doctor         [--stage <name>]  Check the DB is least-privilege + RLS-subject (api vs operator connection)
+  everystack db:provision      [--stage <name>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB)
   everystack console           --stage <name> [--sandbox]  Interactive REPL on deployed Lambda
   everystack status            [--stage <name>] [--hours <n>]  Platform health: CDN, Lambda, rollup summary
+  everystack security:audit    [--dir <path>] [--config <file>]  Static scan of migration SQL (pre-merge gate)
+  everystack security:audit    --stage <name> [--config <file>]  Live catalog scan of a deployed stage (post-deploy)
   everystack certs:generate    [--output ./certs]
   everystack certs:configure   [--input ./certs] [--keyid main]
   everystack cache:purge       [--stage <name>]                  Bust all cached content (global epoch)

package/src/cli/observability.ts

@@ -10,6 +10,8 @@
  *   {prefix}/events/YYYY/MM/DD/HH/{ts}-{id}.ndjson   (one JSON LogEvent per line)
  * Hour partitions are UTC. Canonical writer + query semantics:
  *   packages/logging/src/service/s3-log-storage.ts
+ * A contract test fails loudly if the writer drifts from what this reader assumes:
+ *   packages/logging/__tests__/service/cli-reader-format.contract.test.ts
  *
  * We read the format rather than import the class because @everystack/logging
  * pulls React Native (admin/ui) through its peer graph — wrong for a standalone CLI.