@everystack/cli 0.2.39 → 0.3.3

package/src/cli/commands/db-generate.ts

@@ -0,0 +1,211 @@
+/**
+ * `everystack db:generate` — the brownfield migration generator.
+ *
+ *   db:generate --stage <name> [--name <label>]   introspect the live DB → diff the Models
+ *                                                  → write the next drizzle migration file
+ *
+ * The one generator — both layers in one ordered migration. It compiles the app's Models,
+ * introspects the deployed database through the ops Lambda `db:query` action (the same
+ * read-only path security:audit and db:authz use) for BOTH the structure (columns +
+ * constraints) and the authorization (rls + grants + policies), diffs them, and writes a
+ * reviewable `NNNN_<name>.sql` migration plus its journal entry: data DDL first, then the
+ * authz reconcile the Models' `abilities` declare. It never touches the database — you
+ * review the file, then `db:migrate` applies it. (`db:authz` remains the read-only
+ * pull/diff/audit surface for the authz layer alone.)
+ *
+ * The pure core lives in migration-generate.ts; this shell is the IO: load models, run the
+ * introspection query, write the file.
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import type { ModelDescriptor, Module } from '@everystack/model';
+import { introspectSchema } from '../schema-introspect.js';
+import { compileDrizzleSource } from '../schema-source.js';
+import { compileModuleMigration } from '../migration-compile.js';
+import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, HELD_DROP_PREFIX, type Journal } from '../migration-generate.js';
+import { introspectContract, type QueryRunner } from '../authz-contract.js';
+import { FUNCTIONS_SQL, catalogFunctionToDescriptor } from '../security-catalog.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
+import { step, success, fail, info, warn } from '../output.js';
+
+const DEFAULT_MODELS = 'models/index.ts';
+const DEFAULT_MIGRATIONS = 'drizzle';
+const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
+
+/** A QueryRunner backed by the ops Lambda `db:query` action (read-only). */
+function lambdaRunner(region: string, fn: string): QueryRunner {
+  return async (sql: string) => {
+    const result: any = await invokeAction(region, fn, 'db:query', { sql });
+    if (result?.error) throw new Error(`Introspection query failed: ${result.error}`);
+    return result?.rows ?? [];
+  };
+}
+
+/** Map a FUNCTIONS_SQL row to the minimal shape the authz contract records. */
+const mapFunctionRow = (row: any) => {
+  const d = catalogFunctionToDescriptor(row);
+  return { schema: d.schema, name: d.name, securityDefiner: d.securityDefiner, hasSearchPath: d.hasSearchPath, owner: d.owner, ownerBypassesRls: d.ownerBypassesRls };
+};
+
+/** Import the app's Model barrel and return its `models` array (runs under tsx, so TS imports work). */
+async function loadModels(modelsPath: string): Promise<ModelDescriptor[]> {
+  const abs = path.resolve(modelsPath);
+  let mod: any;
+  try {
+    mod = await import(pathToFileURL(abs).href);
+  } catch (err: any) {
+    throw new Error(`Could not load models from ${modelsPath}: ${err.message}`);
+  }
+  const models = mod.models ?? mod.default;
+  if (!Array.isArray(models)) throw new Error(`${modelsPath} must export a \`models\` array (got ${typeof models}).`);
+  return models;
+}
+
+/**
+ * Import the app's barrel and return its `modules` array — the greenfield (`--init`) input. A
+ * Module carries the package's extensions + functions on top of its models, so it can emit the
+ * COMPLETE migration. Falls back to wrapping a bare `models` array in one module (an app on the
+ * older models-only barrel still gets a schema+authz init, just no package functions).
+ */
+async function loadModules(modelsPath: string): Promise<Module[]> {
+  const abs = path.resolve(modelsPath);
+  let mod: any;
+  try {
+    mod = await import(pathToFileURL(abs).href);
+  } catch (err: any) {
+    throw new Error(`Could not load modules from ${modelsPath}: ${err.message}`);
+  }
+  if (Array.isArray(mod.modules)) return mod.modules;
+  const models = mod.models ?? mod.default;
+  if (Array.isArray(models)) return [{ models, extensions: [], functions: [] }];
+  throw new Error(`${modelsPath} must export a \`modules\` (or \`models\`) array.`);
+}
+
+/**
+ * `db:generate --init` — the greenfield generator. Compiles the app's Modules into ONE
+ * complete migration (extensions + schema + authz + package functions/triggers) with NO live
+ * database — the model IS the source. Writes it as the next migration in a (typically empty)
+ * `drizzle/`. Roles are excluded by design (they are `db:provision`). Use it to (re)initialize
+ * a clean migration history: clear `drizzle/`, then `db:generate --init`.
+ */
+async function dbGenerateInit(modelsPath: string, migrationsDir: string, schemaOut: string, name: string): Promise<void> {
+  step(`Loading modules from ${modelsPath}...`);
+  const modules = await loadModules(modelsPath);
+  const models = modules.flatMap((m) => m.models);
+  info(`${modules.length} module(s), ${models.length} model(s).`);
+
+  step(`Writing the drizzle schema → ${path.relative(process.cwd(), schemaOut)}...`);
+  await fs.writeFile(schemaOut, compileDrizzleSource(models), 'utf8');
+
+  const statements = compileModuleMigration(modules);
+
+  const journalPath = path.join(migrationsDir, 'meta', '_journal.json');
+  let journal: Journal;
+  try {
+    journal = JSON.parse(await fs.readFile(journalPath, 'utf8'));
+  } catch {
+    journal = { version: '7', dialect: 'postgresql', entries: [] };
+  }
+  const { filename, journal: nextJournal } = planMigrationFile(journal, name, Date.now());
+  const filePath = path.join(migrationsDir, filename);
+  await fs.mkdir(path.join(migrationsDir, 'meta'), { recursive: true });
+  await fs.writeFile(filePath, formatMigrationFile(statements), 'utf8');
+  await fs.writeFile(journalPath, JSON.stringify(nextJournal, null, 2) + '\n', 'utf8');
+
+  console.log('');
+  success(`Wrote ${path.relative(process.cwd(), filePath)} (${statements.length} statement(s)) — the complete greenfield migration.`);
+  warn('Roles are NOT in this migration — run `everystack db:provision` (the role chain) before `db:migrate`.');
+  process.exit(0);
+}
+
+export async function dbGenerateCommand(flags: Record<string, string>): Promise<void> {
+  const modelsPath = flags.models || DEFAULT_MODELS;
+  const migrationsDir = path.resolve(flags.dir || DEFAULT_MIGRATIONS);
+  const schemaOut = path.resolve(flags['schema-out'] || DEFAULT_SCHEMA_OUT);
+  const name = flags.name || 'generated';
+  const allowDrops = flags['allow-drops'] === 'true';
+
+  // --init: greenfield, no live DB — the model emits the whole migration (extensions + schema +
+  // authz + package functions). The brownfield path below introspects the deployed DB and diffs.
+  if (flags.init === 'true') {
+    try {
+      await dbGenerateInit(modelsPath, migrationsDir, schemaOut, flags.name || 'init');
+    } catch (err: any) {
+      fail(err.message);
+      process.exit(1);
+    }
+    return;
+  }
+
+  let models: ModelDescriptor[];
+  let current;
+  let liveAuthz;
+  try {
+    step(`Loading models from ${modelsPath}...`);
+    models = await loadModels(modelsPath);
+    info(`${models.length} model(s).`);
+    // The drizzle runtime schema is a derived artifact — refresh it from the models
+    // every run (it needs no DB), so a relation-only change with no DDL diff still
+    // updates it. The drift-guard test asserts this file matches the models.
+    step(`Writing the drizzle schema → ${path.relative(process.cwd(), schemaOut)}...`);
+    await fs.writeFile(schemaOut, compileDrizzleSource(models), 'utf8');
+    step('Resolving deployed config...');
+    const config = await resolveConfig(flags.stage);
+    info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+    const runner = lambdaRunner(config.region, opsFunction(config));
+    step('Introspecting live database (columns + constraints)...');
+    current = await introspectSchema(runner);
+    step('Introspecting authorization (rls + grants + policies)...');
+    liveAuthz = await introspectContract(runner, mapFunctionRow, FUNCTIONS_SQL);
+  } catch (err: any) {
+    fail(err.message);
+    info('Ensure your IAM user/role has lambda:InvokeFunction and the stage is deployed.');
+    process.exit(1);
+  }
+
+  // One ordered migration carries both layers: data DDL first, then the authz reconcile
+  // (RLS/policies/grants) the Models' abilities declare, diffed against the live contract.
+  const statements = generateMigrationSql(models, current, { allowDrops, liveAuthz });
+  const unmodeled = unmodeledTables(models, current);
+  if (unmodeled.length) {
+    info(`${unmodeled.length} table(s) in the database are not declared by any model — left untouched (db:generate manages only declared tables).`);
+  }
+  console.log('');
+  if (statements.length === 0) {
+    success('db:generate — the live database already matches the models. No migration written.');
+    process.exit(0);
+  }
+
+  const journalPath = path.join(migrationsDir, 'meta', '_journal.json');
+  let journal: Journal;
+  try {
+    journal = JSON.parse(await fs.readFile(journalPath, 'utf8'));
+  } catch {
+    journal = { version: '7', dialect: 'postgresql', entries: [] };
+  }
+
+  const { filename, journal: nextJournal } = planMigrationFile(journal, name, Date.now());
+  const filePath = path.join(migrationsDir, filename);
+  try {
+    await fs.mkdir(path.join(migrationsDir, 'meta'), { recursive: true });
+    await fs.writeFile(filePath, formatMigrationFile(statements), 'utf8');
+    await fs.writeFile(journalPath, JSON.stringify(nextJournal, null, 2) + '\n', 'utf8');
+  } catch (err: any) {
+    fail(`Could not write the migration: ${err.message}`);
+    process.exit(1);
+  }
+
+  success(`Wrote ${path.relative(process.cwd(), filePath)} (${statements.length} statement(s)).`);
+  const warnings = statements.filter((s) => s.includes('-- WARNING')).length;
+  const notices = statements.filter((s) => s.startsWith('-- NOTICE')).length;
+  const held = statements.filter((s) => s.startsWith(HELD_DROP_PREFIX)).length;
+  if (warnings) warn(`${warnings} statement(s) carry a -- WARNING (possible data loss) — read them before db:migrate.`);
+  if (notices) info(`${notices} -- NOTICE comment(s) (renames / manual follow-ups) — review and edit if needed.`);
+  if (held) warn(`${held} destructive change(s) (DROP) held back as comments — re-run with --allow-drops to emit them, or apply the shown statements by hand.`);
+  console.log('');
+  warn('db:generate did NOT touch the database. Review the migration, then `everystack db:migrate --stage <name>` to apply it.');
+  process.exit(0);
+}

package/src/cli/commands/db-pull.ts

@@ -0,0 +1,83 @@
+/**
+ * `everystack db:pull` — generate `field()` Models from a live database (the brownfield on-ramp).
+ *
+ *   db:pull --stage <name> [--schema public] [--out models/index.ts]
+ *
+ * The reverse of db:generate: that writes migrations FROM Models; this writes Models FROM the
+ * database. It introspects the deployed schema through the read-only ops Lambda `db:query`
+ * action and renders the TypeScript a Model is written in — a starting point you review and
+ * refine (it flags, as inline comments, anything the field builder can't yet express).
+ *
+ * The rendered source is the artifact: it goes to stdout (so `db:pull > models.ts` works) or
+ * to `--out`. Every progress/diagnostic line goes to stderr, so the stdout pipe stays pure
+ * source. The renderer (model-render.ts) is pure; this shell is the IO.
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { introspectSchema } from '../schema-introspect.js';
+import { renderModelSource } from '../model-render.js';
+import type { QueryRunner } from '../authz-contract.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
+import { fail } from '../output.js';
+
+// Progress → stderr, so stdout carries only the rendered source (this command is codegen,
+// not a report — the shared output helpers write to stdout, which would corrupt a redirect).
+const note = (m: string) => console.error(`  > ${m}`);
+const ok = (m: string) => console.error(`  ✓ ${m}`);
+const detail = (m: string) => console.error(`  ${m}`);
+const caution = (m: string) => console.error(`  ! ${m}`);
+
+/** A QueryRunner backed by the ops Lambda `db:query` action (read-only). */
+function lambdaRunner(region: string, fn: string): QueryRunner {
+  return async (sql: string) => {
+    const result: any = await invokeAction(region, fn, 'db:query', { sql });
+    if (result?.error) throw new Error(`Introspection query failed: ${result.error}`);
+    return result?.rows ?? [];
+  };
+}
+
+export async function dbPullCommand(flags: Record<string, string>): Promise<void> {
+  const schema = flags.schema || 'public';
+
+  let current;
+  try {
+    note('Resolving deployed config...');
+    const config = await resolveConfig(flags.stage);
+    detail(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+    note(`Introspecting live database (schema: ${schema})...`);
+    current = await introspectSchema(lambdaRunner(config.region, opsFunction(config)));
+  } catch (err: any) {
+    fail(err.message);
+    detail('Ensure your IAM user/role has lambda:InvokeFunction and the stage is deployed.');
+    process.exit(1);
+  }
+
+  const pulled = current.tables.filter((t) => t.table.startsWith(`${schema}.`));
+  if (pulled.length === 0) {
+    fail(`No tables found in schema "${schema}".`);
+    process.exit(1);
+  }
+
+  const source = renderModelSource(current, { schema });
+
+  if (flags.out) {
+    const outPath = path.resolve(flags.out);
+    try {
+      await fs.mkdir(path.dirname(outPath), { recursive: true });
+      await fs.writeFile(outPath, source, 'utf8');
+    } catch (err: any) {
+      fail(`Could not write ${flags.out}: ${err.message}`);
+      process.exit(1);
+    }
+    ok(`Wrote ${path.relative(process.cwd(), outPath)} — ${pulled.length} model(s).`);
+  } else {
+    process.stdout.write(source);
+    ok(`Rendered ${pulled.length} model(s) from schema "${schema}" (stdout — redirect or pass --out to save).`);
+  }
+
+  const flagged = (source.match(/\/\/ (FIXME|TODO|composite|CHECK|FK →)/g) ?? []).length;
+  if (flagged) caution(`${flagged} inline comment(s) flag things to review (unmapped types, checks, cross-schema FKs).`);
+  process.exit(0);
+}

package/src/cli/commands/db-snapshot.ts

@@ -0,0 +1,113 @@
+/**
+ * db:snapshot / db:snapshots — RDS *physical* snapshots, the thin `aws rds` control-plane wrapper.
+ *
+ * Unlike db:backup (logical pg_dump, runs in the ops Lambda), these are plain RDS management calls
+ * made directly from the CLI with the operator's IAM — no Lambda, no VPC, no pg_dump layer. They
+ * only apply when the DB is an RDS instance; for any other Postgres, use db:backup. See
+ * docs/plans/db-backup-restore.md.
+ */
+
+import { resolveConfig, type CliConfig } from '../config.js';
+import { createRdsSnapshot, describeRdsSnapshots, type RdsSnapshotSummary } from '../aws.js';
+import { utcStamp } from '../backup.js';
+import { rdsSnapshotIdentifier } from '../rds-snapshot.js';
+import { step, success, fail, info } from '../output.js';
+
+/**
+ * Resolve the RDS DB instance identifier: explicit `--instance` wins, else the deployed
+ * `databaseInstanceId` stack output. A missing or `placeholder` value means the DB isn't RDS (or
+ * the stage is in dev mode) — fail with a pointer to db:backup rather than calling AWS with junk.
+ */
+function resolveInstanceId(config: CliConfig, flags: Record<string, string>): string {
+  const id = flags.instance ?? config.databaseInstanceId;
+  if (!id || id === 'placeholder') {
+    fail(
+      'No RDS instance id available. db:snapshot needs an RDS instance.\n' +
+      '  - If your DB is RDS: redeploy so the `databaseInstanceId` output is present, or pass --instance <id>.\n' +
+      '  - If your DB is not RDS (Aurora, a container, self-hosted): use `everystack db:backup` for a portable logical backup.',
+    );
+    process.exit(1);
+  }
+  return id;
+}
+
+/** Only an authorization failure warrants the IAM hint; other RDS errors (state, quota) don't. */
+function isAccessDenied(err: any): boolean {
+  const name = String(err?.name ?? '');
+  return /AccessDenied|Unauthorized|NotAuthorized/i.test(name);
+}
+
+function fmtSize(gib?: number): string {
+  return gib == null ? '-' : `${gib} GiB`;
+}
+
+function fmtDate(d?: Date): string {
+  return d ? d.toISOString().replace('.000Z', 'Z') : '(creating)';
+}
+
+export async function dbSnapshotCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config: CliConfig;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  const instanceId = resolveInstanceId(config, flags);
+  const snapshotId = rdsSnapshotIdentifier(flags.stage ?? 'manual', utcStamp(new Date()));
+
+  info(`Region: ${config.region}, Instance: ${instanceId}`);
+  step(`Creating RDS snapshot ${snapshotId}...`);
+
+  try {
+    const snap = await createRdsSnapshot(config.region, instanceId, snapshotId);
+    success(`Snapshot ${snap.identifier} (${snap.status}) — physical RDS image of ${instanceId}.`);
+    info('It becomes restorable once status is "available". Track it with `everystack db:snapshots`.');
+  } catch (err: any) {
+    fail(`Snapshot failed: ${err.message}`);
+    if (isAccessDenied(err)) {
+      info('Ensure your IAM identity has rds:CreateDBSnapshot on this instance.');
+    } else if (/not currently in the available state|InvalidDBInstanceState/i.test(String(err?.message ?? err?.name))) {
+      info('The instance is busy (another snapshot may be in progress). Wait for it to finish, then retry.');
+    }
+    process.exit(1);
+  }
+}
+
+export async function dbSnapshotsCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config: CliConfig;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  const instanceId = resolveInstanceId(config, flags);
+  step(`Listing manual RDS snapshots for ${instanceId}...`);
+
+  let snaps: RdsSnapshotSummary[];
+  try {
+    snaps = await describeRdsSnapshots(config.region, instanceId);
+  } catch (err: any) {
+    fail(`List failed: ${err.message}`);
+    if (isAccessDenied(err)) {
+      info('Ensure your IAM identity has rds:DescribeDBSnapshots.');
+    }
+    process.exit(1);
+  }
+
+  if (snaps.length === 0) {
+    info('No manual snapshots. Create one with `everystack db:snapshot`.');
+    return;
+  }
+
+  for (const s of snaps) {
+    const enc = s.encrypted ? ' [encrypted]' : '';
+    info(`${s.identifier}  ${s.status.padEnd(10)}  ${fmtSize(s.sizeGiB).padEnd(8)}  pg${s.engineVersion ?? '?'}  ${fmtDate(s.created)}${enc}`);
+  }
+  success(`${snaps.length} snapshot${snaps.length === 1 ? '' : 's'}.`);
+}

package/src/cli/commands/deploy.ts

@@ -0,0 +1,46 @@
+/**
+ * `everystack deploy` — deploy the stack's infrastructure.
+ *
+ * A thin wrapper over `sst deploy` so a consumer never has to type or know about SST: the
+ * framework owns the infra tool, the consumer just runs `everystack deploy --stage <name>`.
+ * Infra only — migrations (`db:migrate`) and OTA (`update`) stay explicit, the same split
+ * `sst deploy` itself has.
+ *
+ * The arg build is pure (unit-tested); the command streams sst's output through and exits
+ * with its code so CI sees a failed deploy.
+ */
+
+import { spawn } from 'node:child_process';
+import { step, success, fail, info } from '../output.js';
+
+/** The `sst` argv `everystack deploy` runs. Pure, so the mapping is unit-tested. */
+export function buildDeployArgs(flags: Record<string, string>): string[] {
+  const stage = flags.stage || 'dev';
+  return ['sst', 'deploy', '--stage', stage];
+}
+
+export async function deployCommand(flags: Record<string, string>): Promise<void> {
+  const stage = flags.stage || 'dev';
+  const args = buildDeployArgs(flags);
+
+  step(`Deploying stage "${stage}"...`);
+  await new Promise<void>((resolve) => {
+    // `npx` resolves the consumer's local sst (the same way the export step runs expo).
+    const child = spawn('npx', args, { stdio: 'inherit', env: { ...process.env, FORCE_COLOR: '1' } });
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        fail(`Deploy failed (exit ${code}).`);
+        process.exit(code ?? 1);
+      }
+    });
+    child.on('error', (err) => {
+      fail(`Could not run sst: ${err.message}`);
+      info('Install it as a dev dependency: `pnpm add -D sst`.');
+      process.exit(1);
+    });
+  });
+  success(`Deployed stage "${stage}".`);
+  info('Next: `everystack db:migrate --stage ' + stage + '` to apply migrations, `everystack update` to publish the app bundle.');
+}

package/src/cli/config.ts

@@ -24,6 +24,10 @@ export interface CliConfig {
   mediaBucket?: string;
   kvsArn?: string;
   distributionId?: string;
+  /** RDS DB instance identifier (for db:snapshot). Absent when the DB isn't RDS or in dev mode. */
+  databaseInstanceId?: string;
+  /** Private S3 bucket holding logical backups (for db:backup:download presign). */
+  backupsBucket?: string;
 }
 
 /** Operator invoke target — dedicated ops function when deployed, else the API function. */
@@ -44,6 +48,8 @@ interface SstOutputs {
   mediaBucket?: string;
   kvsArn?: string;
   distributionId?: string;
+  databaseInstanceId?: string;
+  backupsBucket?: string;
 }
 
 export async function resolveConfig(stage?: string): Promise<CliConfig> {
@@ -115,5 +121,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
     mediaBucket: outputs.mediaBucket,
     kvsArn: outputs.kvsArn,
     distributionId: outputs.distributionId,
+    databaseInstanceId: outputs.databaseInstanceId,
+    backupsBucket: outputs.backupsBucket,
   };
 }

package/src/cli/index.ts

@@ -3,10 +3,16 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { updateCommand } from './commands/update.js';
+import { deployCommand } from './commands/deploy.js';
 import { certsCommand } from './commands/certs.js';
 import { channelsCommand } from './commands/channels.js';
 import { branchesCommand } from './commands/branches.js';
 import { dbMigrateCommand, dbSeedCommand, dbResetCommand, dbPsqlCommand, dbDoctorCommand, dbProvisionCommand } from './commands/db.js';
+import { dbAuthzPullCommand, dbAuthzDiffCommand, dbAuthzTestCommand, dbAuthzOwnerCommand, dbAuthzReportCommand } from './commands/db-authz.js';
+import { dbGenerateCommand } from './commands/db-generate.js';
+import { dbPullCommand } from './commands/db-pull.js';
+import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot.js';
+import { dbBackupProbeCommand, dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup.js';
 import { consoleCommand } from './commands/console.js';
 import { cachePurgeCommand } from './commands/cache.js';
 import { statusCommand } from './commands/status.js';
@@ -91,6 +97,9 @@ async function main() {
     case 'update':
       await updateCommand(flags);
       break;
+    case 'deploy':
+      await deployCommand(flags);
+      break;
     case 'certs:generate':
       await certsCommand('generate', flags);
       break;
@@ -121,6 +130,50 @@ async function main() {
     case 'db:provision':
       await dbProvisionCommand(flags);
       break;
+    case 'db:snapshot':
+      await dbSnapshotCommand(flags);
+      break;
+    case 'db:snapshots':
+      await dbSnapshotsCommand(flags);
+      break;
+    case 'db:backup:probe':
+      await dbBackupProbeCommand(flags);
+      break;
+    case 'db:backup':
+      await dbBackupCommand(flags);
+      break;
+    case 'db:backups':
+      await dbBackupsCommand(flags);
+      break;
+    case 'db:restore':
+      await dbRestoreCommand(flags);
+      break;
+    case 'db:backup:download': {
+      const backupId = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await dbBackupDownloadCommand(flags, backupId);
+      break;
+    }
+    case 'db:generate':
+      await dbGenerateCommand(flags);
+      break;
+    case 'db:pull':
+      await dbPullCommand(flags);
+      break;
+    case 'db:authz:pull':
+      await dbAuthzPullCommand(flags);
+      break;
+    case 'db:authz:diff':
+      await dbAuthzDiffCommand(flags);
+      break;
+    case 'db:authz:test':
+      await dbAuthzTestCommand(flags);
+      break;
+    case 'db:authz:owner':
+      await dbAuthzOwnerCommand(flags);
+      break;
+    case 'db:authz:report':
+      await dbAuthzReportCommand(flags);
+      break;
     case 'console':
       await consoleCommand(flags);
       break;
@@ -181,6 +234,7 @@ function printHelp() {
 everystack - CLI for Expo apps on everystack
 
 Usage:
+  everystack deploy            [--stage <name>]  Deploy infrastructure (wraps sst deploy — no need to know SST)
   everystack update            --branch <name> --message <msg> [--platform ios|android|web|all] [--stage <name>] [--skip-export]
   everystack update            --channel <name> --message <msg> [--platform ios|android|web|all] [--stage <name>] [--skip-export]
   everystack db:migrate        [--stage <name>]  Run database migrations on deployed Lambda
@@ -190,6 +244,20 @@ Usage:
   everystack db:psql           [--stage <name>] -c <command>  Run one query via Lambda (works for private RDS)
   everystack db:doctor         [--stage <name>]  Check the DB is least-privilege + RLS-subject (api vs operator connection)
   everystack db:provision      [--stage <name>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB)
+  everystack db:snapshot       [--stage <name>] [--instance <id>]  Take a physical RDS snapshot (instant DR point; RDS only — use db:backup for portable logical backups)
+  everystack db:snapshots      [--stage <name>] [--instance <id>]  List manual RDS snapshots for the instance
+  everystack db:backup:probe   [--stage <name>]  Verify the pg_dump layer is attached + version-compatible with the server
+  everystack db:backup         [--stage <name>]  Logical pg_dump of the DB → private S3 backups bucket (prints the backup id)
+  everystack db:backups        [--stage <name>]  List logical backups (id, size, created)
+  everystack db:restore        --from <id> [--stage <name>] --confirm  Restore a backup INTO the stage's DB (DESTRUCTIVE)
+  everystack db:backup:download <id> [--stage <name>]  Presigned URL to download a backup's dump (valid 1h)
+  everystack db:generate       [--stage <name>] [--name <label>] [--models models/index.ts] [--allow-drops]  Diff models vs the live DB → write the next migration (never touches the DB; DROPs held back unless --allow-drops)
+  everystack db:pull           [--stage <name>] [--schema public] [--out <file>]  Introspect the live DB → render field() Models (the brownfield on-ramp; stdout unless --out)
+  everystack db:authz:pull     [--stage <name>] [--dir authz]  Introspect live authz (rls/grants/policies/secdef) → reviewable contract files
+  everystack db:authz:diff     [--stage <name>] [--dir authz]  Validate the live DB against the committed contract (non-zero exit on drift)
+  everystack db:authz:test     [--stage <name>] [--dir authz]  Red-team enforcement: SET ROLE + attempt per role/table/command (non-zero exit on a hole)
+  everystack db:authz:owner    [--stage <name>] [--models models/index.ts]  Red-team owner isolation: two JWT identities per owner-scoped table — catches IDOR (non-zero exit on a leak)
+  everystack db:authz:report   [--dir authz]  Render the committed contract as a human-readable authorization review (no DB)
   everystack console           --stage <name> [--sandbox]  Interactive REPL on deployed Lambda
   everystack status            [--stage <name>] [--hours <n>]  Platform health: CDN, Lambda, rollup summary
   everystack security:audit    [--dir <path>] [--config <file>]  Static scan of migration SQL (pre-merge gate)