primitive-admin 1.1.0-alpha.3 → 1.1.0-alpha.31

package/dist/src/commands/databases.js

@@ -1,6 +1,9 @@
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "fs";
+import * as path from "path";
+import * as TOML from "@iarna/toml";
 import { ApiClient } from "../lib/api-client.js";
 import { getCurrentAppId } from "../lib/config.js";
-import { success, error, info, keyValue, formatTable, formatId, formatDate, json, } from "../lib/output.js";
+import { success, error, info, warn, keyValue, result as printResult, formatTable, formatId, formatDate, json, } from "../lib/output.js";
 function resolveAppId(appId, options) {
     const resolved = appId || options.app || getCurrentAppId();
     if (!resolved) {
@@ -18,8 +21,17 @@ Examples:
   $ primitive databases list
   $ primitive databases create "My Database"
   $ primitive databases get <database-id>
+  $ primitive databases records models <database-id>
+  $ primitive databases records describe <database-id> <model-name>
+  $ primitive databases records query <database-id> <model-name> --filter '{"name":"Alice"}'
+  $ primitive databases operations list <database-id>
+  $ primitive databases operations execute <database-id> <operation-name> --params '{"key":"value"}'
+  $ primitive databases indexes list <database-id>
+  $ primitive databases indexes create <database-id> --model contacts --field email
+  $ primitive databases records delete <database-id> <model-name> <record-id> --yes
+  $ primitive databases records delete-all <database-id> <model-name> --yes
+  $ primitive databases records delete-all <database-id> <model-name> --filter '{"status":"draft"}' --yes
   $ primitive databases permissions list <database-id>
-  $ primitive databases group-permissions list <database-id>
 `);
     // List databases
     databases
@@ -45,6 +57,7 @@ Examples:
             console.log(formatTable(list, [
                 { header: "ID", key: "databaseId", format: formatId },
                 { header: "TITLE", key: "title" },
+                { header: "TYPE", key: "databaseType", format: (v) => v || "—" },
                 { header: "PERMISSION", key: "permission" },
                 { header: "CREATED", key: "createdAt", format: formatDate },
             ]));
@@ -60,12 +73,29 @@ Examples:
         .description("Create a new database")
         .argument("<title>", "Database title")
         .option("--app <app-id>", "App ID")
+        .requiredOption("--type <database-type>", "Database type (required)")
+        .option("--cel-context <json>", "Initial CEL context as JSON (referenced from access rules as database.celContext.*)")
+        .option("--metadata <json>", "Initial CEL context as JSON (legacy alias for --cel-context)")
         .option("--json", "Output as JSON")
         .action(async (title, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.createDatabase(resolvedAppId, { title });
+            const params = { title, databaseType: options.type };
+            // `--cel-context` is the new user-facing name; `--metadata` remains
+            // supported for backwards compatibility. When both are provided,
+            // --cel-context wins.
+            const contextSource = options.celContext ?? options.metadata;
+            if (contextSource) {
+                try {
+                    params.metadata = JSON.parse(contextSource);
+                }
+                catch {
+                    error(`Invalid ${options.celContext ? "--cel-context" : "--metadata"} JSON.`);
+                    process.exit(1);
+                }
+            }
+            const result = await client.createDatabase(resolvedAppId, params);
             if (options.json) {
                 json(result);
                 return;
@@ -73,6 +103,9 @@ Examples:
             success("Database created.");
             keyValue("Database ID", result.databaseId);
             keyValue("Title", result.title);
+            if (result.databaseType) {
+                keyValue("Database Type", result.databaseType);
+            }
         }
         catch (err) {
             error(err.message);
@@ -95,10 +128,53 @@ Examples:
                 json(result);
                 return;
             }
+            printResult("Database ID", result.databaseId);
+            printResult("Title", result.title);
+            printResult("Database Type", result.databaseType || "none");
+            printResult("Permission", result.permission || "none");
+            printResult("Created", formatDate(result.createdAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Update database
+    databases
+        .command("update")
+        .description("Update a database (title, type)")
+        .argument("<database-id>", "Database ID")
+        .option("--app <app-id>", "App ID")
+        .option("--title <title>", "New title")
+        .option("--type <database-type>", "Database type (use 'none' to clear)")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        const params = {};
+        if (options.title) {
+            params.title = options.title;
+        }
+        if (options.type !== undefined) {
+            params.databaseType =
+                options.type === "none"
+                    ? null
+                    : options.type;
+        }
+        if (Object.keys(params).length === 0) {
+            error("Provide at least one of --title or --type.");
+            process.exit(1);
+        }
+        try {
+            const result = await client.updateDatabase(resolvedAppId, databaseId, params);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success("Database updated.");
             keyValue("Database ID", result.databaseId);
             keyValue("Title", result.title);
-            keyValue("Permission", result.permission);
-            keyValue("Created", formatDate(result.createdAt));
+            keyValue("Database Type", result.databaseType || "none");
         }
         catch (err) {
             error(err.message);
@@ -176,43 +252,260 @@ Examples:
             process.exit(1);
         }
     });
-    // Grant permission
+    // Add manager action handler
+    const addManagerAction = async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.addDatabaseManager(resolvedAppId, databaseId, options.userId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Manager added: user ${options.userId}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    };
+    // Remove manager action handler
+    const removeManagerAction = async (databaseId, userId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.yes) {
+            const inquirer = await import("inquirer");
+            const { confirm } = await inquirer.default.prompt([
+                {
+                    type: "confirm",
+                    name: "confirm",
+                    message: `Remove manager ${userId} from database ${databaseId}?`,
+                    default: false,
+                },
+            ]);
+            if (!confirm) {
+                info("Cancelled.");
+                return;
+            }
+        }
+        const client = new ApiClient();
+        try {
+            await client.removeDatabaseManager(resolvedAppId, databaseId, userId);
+            success(`Manager removed: user ${userId}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    };
+    // Add manager (primary command)
+    permissions
+        .command("add-manager")
+        .description("Add a user as a manager of a database")
+        .argument("<database-id>", "Database ID")
+        .requiredOption("--user-id <user-id>", "User ID to add as manager")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(addManagerAction);
+    // Remove manager (primary command)
+    permissions
+        .command("remove-manager")
+        .description("Remove a manager from a database")
+        .argument("<database-id>", "Database ID")
+        .argument("<user-id>", "User ID to remove")
+        .option("--app <app-id>", "App ID")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .action(removeManagerAction);
+    // Grant permission (deprecated alias for add-manager)
     permissions
         .command("grant")
-        .description("Grant a user permission on a database")
+        .description("(deprecated: use add-manager) Grant a user permission on a database")
         .argument("<database-id>", "Database ID")
         .requiredOption("--user-id <user-id>", "User ID to grant permission to")
-        .requiredOption("--permission <permission>", "Permission level: owner, read-write, or reader")
+        .option("--permission <permission>", "Permission level (ignored, always 'manager')")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(addManagerAction);
+    // Revoke permission (deprecated alias for remove-manager)
+    permissions
+        .command("revoke")
+        .description("(deprecated: use remove-manager) Revoke a user's permission on a database")
+        .argument("<database-id>", "Database ID")
+        .argument("<user-id>", "User ID to revoke")
+        .option("--app <app-id>", "App ID")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .action(removeManagerAction);
+    // ---- Records subcommand group ----
+    const records = databases
+        .command("records")
+        .description("Inspect and query records in a database");
+    // List models
+    records
+        .command("models")
+        .description("List model names in a database")
+        .argument("<database-id>", "Database ID")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.grantDatabasePermission(resolvedAppId, databaseId, {
-                userId: options.userId,
-                permission: options.permission,
-            });
+            const result = await client.listDatabaseModels(resolvedAppId, databaseId);
+            const models = result.models || [];
+            if (options.json) {
+                json(models);
+                return;
+            }
+            if (models.length === 0) {
+                info("No models found.");
+                return;
+            }
+            for (const m of models) {
+                console.log(`  ${m}`);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Describe model
+    records
+        .command("describe")
+        .description("Show inferred schema for a model")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.describeDatabaseModel(resolvedAppId, databaseId, modelName);
+            const fields = result.fields || [];
+            if (options.json) {
+                json(fields);
+                return;
+            }
+            if (fields.length === 0) {
+                info("No fields detected.");
+                return;
+            }
+            console.log(formatTable(fields, [
+                { header: "FIELD", key: "field_name" },
+                { header: "TYPE", key: "inferred_type" },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Query records (direct introspection via admin-data route)
+    records
+        .command("query")
+        .description("Query records in a database model (admin only)")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name to query")
+        .option("--app <app-id>", "App ID")
+        .option("--filter <json>", "Filter as JSON (e.g. '{\"name\":\"Alice\"}')")
+        .option("--filter-file <path>", "Read filter from a JSON or TOML file")
+        .option("--limit <n>", "Maximum number of records to return", parseInt)
+        .option("--cursor <cursor>", "Pagination cursor from previous query")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        if (options.filter && options.filterFile) {
+            error("Cannot use both --filter and --filter-file.");
+            process.exit(1);
+        }
+        let filter;
+        if (options.filterFile) {
+            try {
+                const content = readFileSync(options.filterFile, "utf-8");
+                if (options.filterFile.endsWith(".toml")) {
+                    const parsed = TOML.parse(content);
+                    filter = parsed.filter || parsed;
+                }
+                else {
+                    filter = JSON.parse(content);
+                }
+            }
+            catch (err) {
+                error(`Failed to read filter file: ${err.message}`);
+                process.exit(1);
+            }
+        }
+        else if (options.filter) {
+            try {
+                filter = JSON.parse(options.filter);
+            }
+            catch {
+                error("Invalid --filter JSON.");
+                process.exit(1);
+            }
+        }
+        try {
+            const result = await client.queryDatabaseRecords(resolvedAppId, databaseId, modelName, { filter, limit: options.limit, cursor: options.cursor });
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Permission '${options.permission}' granted to user ${options.userId}.`);
+            const records = result.data || [];
+            if (records.length === 0) {
+                info("No records found.");
+                return;
+            }
+            // Auto-detect columns from record keys
+            const allKeys = new Set();
+            for (const rec of records) {
+                for (const key of Object.keys(rec)) {
+                    allKeys.add(key);
+                }
+            }
+            // Put id first, then type, then the rest sorted
+            const orderedKeys = [];
+            if (allKeys.has("id")) {
+                orderedKeys.push("id");
+                allKeys.delete("id");
+            }
+            if (allKeys.has("type")) {
+                orderedKeys.push("type");
+                allKeys.delete("type");
+            }
+            orderedKeys.push(...[...allKeys].sort());
+            const columns = orderedKeys.map((key) => ({
+                header: key.toUpperCase(),
+                key,
+                format: (v) => {
+                    if (v === null || v === undefined)
+                        return "—";
+                    if (typeof v === "object")
+                        return JSON.stringify(v);
+                    return String(v);
+                },
+            }));
+            console.log(formatTable(records, columns));
+            if (result.nextCursor) {
+                info(`More results available. Use --cursor ${result.nextCursor}`);
+            }
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Revoke permission
-    permissions
-        .command("revoke")
-        .description("Revoke a user's permission on a database")
+    // Delete a single record
+    records
+        .command("delete")
+        .description("Delete a single record from a database model (admin only)")
         .argument("<database-id>", "Database ID")
-        .argument("<user-id>", "User ID to revoke")
+        .argument("<model-name>", "Model name")
+        .argument("<record-id>", "Record ID to delete")
         .option("--app <app-id>", "App ID")
         .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (databaseId, userId, options) => {
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, recordId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         if (!options.yes) {
             const inquirer = await import("inquirer");
@@ -220,7 +513,7 @@ Examples:
                 {
                     type: "confirm",
                     name: "confirm",
-                    message: `Revoke permission for user ${userId} on database ${databaseId}?`,
+                    message: `Delete record ${recordId} from ${modelName}? This cannot be undone.`,
                     default: false,
                 },
             ]);
@@ -231,44 +524,344 @@ Examples:
         }
         const client = new ApiClient();
         try {
-            await client.revokeDatabasePermission(resolvedAppId, databaseId, userId);
-            success(`Permission revoked for user ${userId}.`);
+            const result = await client.deleteDatabaseRecord(resolvedAppId, databaseId, modelName, recordId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Record ${recordId} deleted from ${modelName}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Delete all records for a model
+    records
+        .command("delete-all")
+        .description("Delete all records for a model (queries then batch deletes, admin only)")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name")
+        .option("--app <app-id>", "App ID")
+        .option("--filter <json>", "Filter as JSON to select which records to delete")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        let filter;
+        if (options.filter) {
+            try {
+                filter = JSON.parse(options.filter);
+            }
+            catch {
+                error("Invalid --filter JSON.");
+                process.exit(1);
+            }
+        }
+        try {
+            // First, query to find all matching records
+            let allRecords = [];
+            let cursor;
+            let hasMore = true;
+            while (hasMore) {
+                const result = await client.queryDatabaseRecords(resolvedAppId, databaseId, modelName, { filter, limit: 100, cursor });
+                const records = result?.data || [];
+                allRecords = allRecords.concat(records);
+                cursor = result?.nextCursor;
+                hasMore = !!cursor && records.length > 0;
+            }
+            if (allRecords.length === 0) {
+                if (options.json) {
+                    json({ deleted: 0, modelName });
+                    return;
+                }
+                info("No matching records found.");
+                return;
+            }
+            if (!options.yes) {
+                const inquirer = await import("inquirer");
+                const { confirm } = await inquirer.default.prompt([
+                    {
+                        type: "confirm",
+                        name: "confirm",
+                        message: `Delete ${allRecords.length} record(s) from ${modelName}? This cannot be undone.`,
+                        default: false,
+                    },
+                ]);
+                if (!confirm) {
+                    info("Cancelled.");
+                    return;
+                }
+            }
+            // Batch delete in chunks of 50
+            const BATCH_SIZE = 50;
+            let deleted = 0;
+            for (let i = 0; i < allRecords.length; i += BATCH_SIZE) {
+                const chunk = allRecords.slice(i, i + BATCH_SIZE);
+                const operations = chunk.map((r) => ({
+                    op: "delete",
+                    modelName,
+                    id: r.id,
+                }));
+                await client.batchDeleteDatabaseRecords(resolvedAppId, databaseId, operations);
+                deleted += chunk.length;
+            }
+            if (options.json) {
+                json({ deleted, modelName });
+                return;
+            }
+            success(`Deleted ${deleted} record(s) from ${modelName}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ---- CEL context subcommand group ----
+    // `cel-context` is the user-facing name for the dict that feeds CEL
+    // access rules and filter placeholders. `metadata` is kept as a hidden
+    // alias for backwards compatibility with existing scripts.
+    const registerCelContextGroup = (name, hidden) => {
+        const group = databases
+            .command(name, { hidden })
+            .description(hidden
+            ? "Manage database CEL context (alias of 'cel-context')"
+            : "Manage database CEL context (the dict referenced by access rules and filters)");
+        group
+            .command("get")
+            .description("Read database CEL context")
+            .argument("<database-id>", "Database ID")
+            .option("--app <app-id>", "App ID")
+            .option("--json", "Output as JSON")
+            .action(async (databaseId, options) => {
+            const resolvedAppId = resolveAppId(undefined, options);
+            const client = new ApiClient();
+            try {
+                const result = await client.getDatabaseCelContext(resolvedAppId, databaseId);
+                if (options.json) {
+                    json(result);
+                    return;
+                }
+                printResult("Database ID", result.databaseId);
+                const ctx = result.celContext ?? result.metadata;
+                if (ctx && Object.keys(ctx).length > 0) {
+                    printResult("CEL Context", JSON.stringify(ctx, null, 2));
+                }
+                else {
+                    info("No CEL context set.");
+                }
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+        });
+        group
+            .command("update")
+            .description("Update database CEL context (merge with existing)")
+            .argument("<database-id>", "Database ID")
+            .requiredOption("--data <json>", "CEL context fields as JSON (merged with existing)")
+            .option("--app <app-id>", "App ID")
+            .option("--json", "Output as JSON")
+            .action(async (databaseId, options) => {
+            const resolvedAppId = resolveAppId(undefined, options);
+            const client = new ApiClient();
+            let data;
+            try {
+                data = JSON.parse(options.data);
+            }
+            catch {
+                error("Invalid --data JSON.");
+                process.exit(1);
+                return;
+            }
+            try {
+                const result = await client.updateDatabaseCelContext(resolvedAppId, databaseId, data);
+                if (options.json) {
+                    json(result);
+                    return;
+                }
+                success("CEL context updated.");
+                const ctx = result.celContext ?? result.metadata;
+                if (ctx) {
+                    keyValue("CEL Context", JSON.stringify(ctx));
+                }
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+        });
+    };
+    registerCelContextGroup("cel-context", false);
+    // Hidden legacy alias — `primitive databases metadata get/update` still works.
+    registerCelContextGroup("metadata", true);
+    // ---- Operations subcommand group ----
+    const operations = databases
+        .command("operations")
+        .description("List and execute registered operations on a database");
+    // List operations
+    operations
+        .command("list")
+        .description("List registered operations available on a database")
+        .argument("<database-id>", "Database ID")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.listDatabaseOperations(resolvedAppId, databaseId);
+            const list = Array.isArray(result) ? result : [];
+            if (options.json) {
+                json(list);
+                return;
+            }
+            if (list.length === 0) {
+                info("No operations found.");
+                return;
+            }
+            console.log(formatTable(list, [
+                { header: "NAME", key: "name" },
+                { header: "TYPE", key: "type" },
+                { header: "MODEL", key: "modelName" },
+                { header: "ACCESS", key: "access" },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Execute operation
+    operations
+        .command("execute")
+        .description("Execute a registered operation on a database")
+        .argument("<database-id>", "Database ID")
+        .argument("<operation-name>", "Operation name")
+        .option("--params <json>", "Operation parameters as JSON")
+        .option("--limit <n>", "Max records to return (for queries)")
+        .option("--cursor <cursor>", "Pagination cursor")
+        .option("--token <jwt>", "Execute as a specific user (dev/test — JWT visible in process args)")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .option("--timing", "Show server-side timing breakdown")
+        .action(async (databaseId, operationName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        let params;
+        if (options.params) {
+            try {
+                params = JSON.parse(options.params);
+            }
+            catch {
+                error("Invalid --params JSON.");
+                process.exit(1);
+                return;
+            }
+        }
+        const body = {};
+        if (params)
+            body.params = params;
+        if (options.limit)
+            body.limit = parseInt(options.limit, 10);
+        if (options.cursor)
+            body.cursor = options.cursor;
+        try {
+            const result = await client.executeDatabaseOperation(resolvedAppId, databaseId, operationName, body, options.token, { timing: !!options.timing });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            // Smart display based on result shape
+            if (result.data && Array.isArray(result.data)) {
+                if (result.data.length === 0) {
+                    info("No records found.");
+                }
+                else {
+                    const cols = Object.keys(result.data[0]).filter((k) => k !== "type");
+                    console.log(formatTable(result.data, cols.map((c) => ({
+                        header: c.toUpperCase(),
+                        key: c,
+                        format: (v) => {
+                            if (v === null || v === undefined)
+                                return "—";
+                            if (typeof v === "object") {
+                                const s = JSON.stringify(v);
+                                return s.length > 50 ? s.slice(0, 47) + "..." : s;
+                            }
+                            const s = String(v);
+                            return s.length > 50 ? s.slice(0, 47) + "..." : s;
+                        },
+                    }))));
+                }
+                if (result.hasMore) {
+                    info(`More records available. Use --cursor ${result.cursor} to continue.`);
+                }
+            }
+            else if (result.count !== undefined) {
+                console.log(`Count: ${result.count}`);
+            }
+            else if (result.result !== undefined) {
+                // Aggregate result
+                json(result);
+            }
+            else if (result.results && Array.isArray(result.results)) {
+                // Batch/mutation results
+                success(`Operation executed (${result.results.length} result${result.results.length === 1 ? "" : "s"}).`);
+            }
+            else if (result.success !== undefined) {
+                success("Operation executed.");
+            }
+            else {
+                json(result);
+            }
+            // Display timing if present
+            if (result._timing) {
+                console.log("");
+                console.log("Timing:");
+                for (const [key, value] of Object.entries(result._timing)) {
+                    console.log(`  ${key}: ${value}ms`);
+                }
+            }
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // ---- Group Permissions subcommand group ----
-    const groupPermissions = databases
-        .command("group-permissions")
-        .description("Manage group permissions on a database");
-    // List group permissions
-    groupPermissions
+    // ---- Indexes subcommand group ----
+    const indexes = databases
+        .command("indexes")
+        .description("Manage indexes on a database");
+    // List indexes
+    indexes
         .command("list")
-        .description("List group permissions for a database")
+        .description("List indexes for a database or model")
         .argument("<database-id>", "Database ID")
+        .option("--model <model-name>", "Filter by model name")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.listDatabaseGroupPermissions(resolvedAppId, databaseId);
-            const list = Array.isArray(result) ? result : result?.permissions ?? [];
+            const result = await client.listDatabaseIndexes(resolvedAppId, databaseId, options.model);
+            const list = result.indexes || [];
             if (options.json) {
                 json(list);
                 return;
             }
             if (list.length === 0) {
-                info("No group permissions found.");
+                info("No indexes found.");
                 return;
             }
             console.log(formatTable(list, [
-                { header: "GROUP_TYPE", key: "groupType" },
-                { header: "GROUP_ID", key: "groupId" },
-                { header: "PERMISSION", key: "permission" },
-                { header: "GRANTED", key: "grantedAt", format: formatDate },
+                { header: "MODEL", key: "model_name" },
+                { header: "FIELD", key: "field_name" },
+                { header: "TYPE", key: "field_type" },
+                { header: "UNIQUE", key: "is_unique", format: (v) => (v ? "Yes" : "No") },
             ]));
         }
         catch (err) {
@@ -276,46 +869,48 @@ Examples:
             process.exit(1);
         }
     });
-    // Grant group permission
-    groupPermissions
-        .command("grant")
-        .description("Grant a group permission on a database")
+    // Register index
+    indexes
+        .command("create")
+        .description("Create an index on a model field")
         .argument("<database-id>", "Database ID")
-        .requiredOption("--group-type <type>", "Group type")
-        .requiredOption("--group-id <id>", "Group ID")
-        .requiredOption("--permission <permission>", "Permission level: read-write or reader")
+        .requiredOption("--model <model-name>", "Model name")
+        .requiredOption("--field <field-name>", "Field name to index")
+        .option("--type <field-type>", "Field type: string, number, or boolean", "string")
+        .option("--unique", "Make this a unique index")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.grantDatabaseGroupPermission(resolvedAppId, databaseId, {
-                groupType: options.groupType,
-                groupId: options.groupId,
-                permission: options.permission,
+            const result = await client.registerDatabaseIndex(resolvedAppId, databaseId, {
+                modelName: options.model,
+                fieldName: options.field,
+                fieldType: options.type,
+                unique: !!options.unique,
             });
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Permission '${options.permission}' granted to group ${options.groupType}/${options.groupId}.`);
+            success(`Index created on ${options.model}.${options.field} (${options.type}${options.unique ? ", unique" : ""}).`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Revoke group permission
-    groupPermissions
-        .command("revoke")
-        .description("Revoke a group's permission on a database")
+    // Drop index
+    indexes
+        .command("drop")
+        .description("Drop an index from a model field")
         .argument("<database-id>", "Database ID")
-        .argument("<group-type>", "Group type")
-        .argument("<group-id>", "Group ID")
+        .requiredOption("--model <model-name>", "Model name")
+        .requiredOption("--field <field-name>", "Field name")
         .option("--app <app-id>", "App ID")
         .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (databaseId, groupType, groupId, options) => {
+        .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         if (!options.yes) {
             const inquirer = await import("inquirer");
@@ -323,7 +918,7 @@ Examples:
                 {
                     type: "confirm",
                     name: "confirm",
-                    message: `Revoke permission for group ${groupType}/${groupId} on database ${databaseId}?`,
+                    message: `Drop index on ${options.model}.${options.field}?`,
                     default: false,
                 },
             ]);
@@ -334,8 +929,230 @@ Examples:
         }
         const client = new ApiClient();
         try {
-            await client.revokeDatabaseGroupPermission(resolvedAppId, databaseId, groupType, groupId);
-            success(`Permission revoked for group ${groupType}/${groupId}.`);
+            await client.dropDatabaseIndex(resolvedAppId, databaseId, {
+                modelName: options.model,
+                fieldName: options.field,
+            });
+            success(`Index dropped on ${options.model}.${options.field}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ---- Export / Import commands ----
+    databases
+        .command("export")
+        .description("Export a database (records, indexes, constraints)")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .argument("<database-id>", "Database ID to export")
+        .option("--app <app-id>", "App ID")
+        .option("--output <dir>", "Output directory", "./primitive-export")
+        .option("--json", "Output as JSON")
+        .action(async (first, second, options) => {
+        let resolvedAppId;
+        let databaseId;
+        if (second && !second.startsWith("-")) {
+            resolvedAppId = resolveAppId(first, options);
+            databaseId = second;
+        }
+        else {
+            resolvedAppId = resolveAppId(undefined, options);
+            databaseId = first;
+        }
+        if (!databaseId) {
+            error("Database ID is required.");
+            process.exit(1);
+        }
+        const client = new ApiClient();
+        try {
+            await exportSingleDatabase(client, resolvedAppId, databaseId, options.output, options.json);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    databases
+        .command("import")
+        .description("Import a database from an export directory")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .argument("<path>", "Path to database export directory")
+        .option("--app <app-id>", "App ID")
+        .option("--overwrite", "Replace existing database if ID collides")
+        .option("--dry-run", "Show what would be imported without making changes")
+        .option("--json", "Output as JSON")
+        .action(async (first, second, options) => {
+        let resolvedAppId;
+        let importPath;
+        if (second && !second.startsWith("-")) {
+            resolvedAppId = resolveAppId(first, options);
+            importPath = second;
+        }
+        else {
+            resolvedAppId = resolveAppId(undefined, options);
+            importPath = first;
+        }
+        if (!importPath) {
+            error("Import path is required.");
+            process.exit(1);
+        }
+        const client = new ApiClient();
+        try {
+            // Determine if this is a manifest-based export or a single database
+            let dbDirs = [];
+            const manifestPath = path.join(importPath, "manifest.json");
+            if (existsSync(path.join(importPath, "metadata.json"))) {
+                // Single database directory
+                dbDirs = [importPath];
+            }
+            else if (existsSync(manifestPath)) {
+                const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+                for (const dbId of manifest.databases || []) {
+                    const dbDir = path.join(importPath, "databases", dbId);
+                    if (existsSync(dbDir)) {
+                        dbDirs.push(dbDir);
+                    }
+                }
+            }
+            else if (existsSync(path.join(importPath, "databases"))) {
+                const entries = readdirSync(path.join(importPath, "databases"), { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.isDirectory()) {
+                        dbDirs.push(path.join(importPath, "databases", entry.name));
+                    }
+                }
+            }
+            else {
+                error("No valid database export data found at the specified path.");
+                process.exit(1);
+            }
+            if (dbDirs.length === 0) {
+                info("No databases to import.");
+                return;
+            }
+            const summary = { created: 0, updated: 0, skipped: 0, recordsImported: 0, indexesRegistered: 0 };
+            for (const dbDir of dbDirs) {
+                await importSingleDatabase(client, resolvedAppId, dbDir, options.overwrite || false, options.dryRun || false, summary);
+            }
+            if (options.json) {
+                json(summary);
+            }
+            else {
+                success("Database import complete:");
+                keyValue("  Databases created", String(summary.created));
+                if (summary.updated > 0)
+                    keyValue("  Databases updated", String(summary.updated));
+                if (summary.skipped > 0)
+                    keyValue("  Databases skipped", String(summary.skipped));
+                keyValue("  Records imported", String(summary.recordsImported));
+                if (summary.indexesRegistered > 0)
+                    keyValue("  Indexes registered", String(summary.indexesRegistered));
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ============================================
+    // Schema commands (issue #666)
+    // ============================================
+    const schema = databases
+        .command("schema")
+        .description("Manage the TOML schema attached to a database type");
+    schema
+        .command("generate")
+        .description("Scaffold a starting TOML schema for <database-type> from existing operations + DO introspection, and insert it into the local database-types/<type>.toml file.")
+        .argument("<database-type>", "Database type name")
+        .option("--app <app-id>", "App ID")
+        .option("--sync-dir <path>", "Override path to the sync directory (defaults to ./.primitive/sync/<env>/<appId>/)")
+        .option("-f, --force", "Overwrite an existing [models.*] block in the local file")
+        .option("--json", "Output the generated TOML as JSON")
+        .action(async (databaseType, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            // 1. Call the server's :scaffold endpoint.
+            const result = await client.scaffoldDatabaseTypeSchema(resolvedAppId, databaseType);
+            const scaffoldedToml = result?.schema ?? "";
+            if (options.json) {
+                json({ schema: scaffoldedToml });
+                return;
+            }
+            // 2. Locate the local `database-types/<type>.toml` file. Per the
+            // plan-of-record CLI sync layout, the file lives at
+            // `<sync-dir>/database-types/<type>.toml`. We don't need to know the
+            // exact sync dir for the happy path — just look for an existing
+            // file relative to the CWD's `.primitive/sync/` directory tree.
+            const candidateFiles = [];
+            if (options.syncDir) {
+                candidateFiles.push(path.join(options.syncDir, "database-types", `${databaseType}.toml`));
+            }
+            else {
+                // Search any env/appId subtree under .primitive/sync that matches.
+                const root = path.join(process.cwd(), ".primitive", "sync");
+                if (existsSync(root)) {
+                    for (const env of readdirSync(root)) {
+                        const envDir = path.join(root, env);
+                        try {
+                            for (const app of readdirSync(envDir)) {
+                                const candidate = path.join(envDir, app, "database-types", `${databaseType}.toml`);
+                                if (existsSync(candidate)) {
+                                    candidateFiles.push(candidate);
+                                }
+                            }
+                        }
+                        catch {
+                            // skip non-dirs
+                        }
+                    }
+                }
+            }
+            if (candidateFiles.length === 0) {
+                // No local file found — print the scaffold to stdout and tell
+                // the user where to put it.
+                info(`No local database-types/${databaseType}.toml found under .primitive/sync/. Generated TOML:`);
+                console.log("");
+                console.log(scaffoldedToml);
+                return;
+            }
+            // 3. For each candidate, splice the scaffolded TOML at a stable
+            // anchor (before the first `[[operations]]` block, or at EOF). Per
+            // the plan-of-record, textual insertion is deliberate — `@iarna/toml`
+            // parse/stringify drops comments, so we splice as a raw string.
+            for (const targetPath of candidateFiles) {
+                const original = readFileSync(targetPath, "utf-8");
+                // Detect existing [models.*] block. If present, refuse unless --force.
+                const hasModelsBlock = /\n\[models\./.test("\n" + original);
+                if (hasModelsBlock && !options.force) {
+                    error(`${targetPath} already has [models.*] blocks. Re-run with --force to overwrite.`);
+                    process.exit(1);
+                }
+                // Strip existing [models.*] blocks if --force.
+                let cleaned = original;
+                if (hasModelsBlock && options.force) {
+                    cleaned = stripModelsBlocks(original);
+                }
+                // Splice: insert before the first [[operations]] block, otherwise
+                // at the end of file.
+                let merged;
+                const opsAnchor = cleaned.indexOf("\n[[operations]]");
+                if (opsAnchor >= 0) {
+                    merged =
+                        cleaned.slice(0, opsAnchor + 1) +
+                            scaffoldedToml +
+                            "\n" +
+                            cleaned.slice(opsAnchor + 1);
+                }
+                else {
+                    const sep = cleaned.endsWith("\n") ? "" : "\n";
+                    merged = cleaned + sep + scaffoldedToml + "\n";
+                }
+                writeFileSync(targetPath, merged);
+                success(`Inserted schema into ${targetPath}`);
+            }
+            info("Review the generated schema, fix types the generator guessed wrong, then run `primitive sync push` (or `primitive sync push --dry-run`).");
         }
         catch (err) {
             error(err.message);
@@ -343,4 +1160,196 @@ Examples:
         }
     });
 }
+/** Remove every existing `[models.*]` block from a TOML file body. */
+function stripModelsBlocks(text) {
+    const lines = text.split("\n");
+    const result = [];
+    let skipping = false;
+    for (const line of lines) {
+        const isModelsHeader = /^\s*\[models\b/.test(line);
+        const isOtherHeader = /^\s*\[(?!models\b)/.test(line);
+        if (isModelsHeader) {
+            skipping = true;
+            continue;
+        }
+        if (skipping && isOtherHeader) {
+            skipping = false;
+        }
+        if (!skipping)
+            result.push(line);
+    }
+    return result.join("\n");
+}
+// ============================================
+// Database export/import helpers
+// ============================================
+async function exportSingleDatabase(client, appId, databaseId, outputDir, jsonOutput) {
+    const dbDir = path.join(outputDir, "databases", databaseId);
+    mkdirSync(dbDir, { recursive: true });
+    // 1. Fetch database metadata
+    const dbMeta = await client.getDatabase(appId, databaseId);
+    // Warn about databaseType sync
+    if (dbMeta.databaseType) {
+        warn(`This database uses type "${dbMeta.databaseType}". Make sure to \`primitive sync push\` the type config before importing into a new app.`);
+    }
+    // 2. Write metadata
+    const metadata = {
+        databaseId: dbMeta.databaseId || databaseId,
+        title: dbMeta.title,
+        databaseType: dbMeta.databaseType || null,
+        metadata: dbMeta.metadata || null,
+    };
+    writeFileSync(path.join(dbDir, "metadata.json"), JSON.stringify(metadata, null, 2));
+    // 3. Export records: list models, then query each
+    const models = await client.listDatabaseModels(appId, databaseId);
+    let totalRecords = 0;
+    const recordsFile = path.join(dbDir, "records.jsonl");
+    // Clear file
+    writeFileSync(recordsFile, "");
+    for (const modelName of models) {
+        let cursor;
+        let hasMore = true;
+        while (hasMore) {
+            const result = await client.queryDatabaseRecords(appId, databaseId, modelName, {
+                limit: 100,
+                cursor,
+            });
+            const records = result?.data || [];
+            for (const record of records) {
+                const line = JSON.stringify({ _type: modelName, _id: record.id, _data: record });
+                appendFileSync(recordsFile, line + "\n");
+                totalRecords++;
+            }
+            cursor = result?.nextCursor;
+            hasMore = !!cursor && records.length > 0;
+        }
+    }
+    // 4. Export indexes
+    const indexes = await client.listDatabaseIndexes(appId, databaseId);
+    writeFileSync(path.join(dbDir, "indexes.json"), JSON.stringify(indexes, null, 2));
+    // 5. Export unique constraints
+    const constraints = await client.listDatabaseUniqueConstraints(appId, databaseId);
+    writeFileSync(path.join(dbDir, "constraints.json"), JSON.stringify(constraints, null, 2));
+    if (jsonOutput) {
+        json({
+            databaseId,
+            title: metadata.title,
+            databaseType: metadata.databaseType,
+            models: models.length,
+            records: totalRecords,
+            indexes: indexes.length,
+            constraints: constraints.length,
+            exportPath: dbDir,
+        });
+    }
+    else {
+        success(`Exported database ${databaseId} (${metadata.title || "untitled"}) to ${dbDir}`);
+        keyValue("  Models", String(models.length));
+        keyValue("  Records", String(totalRecords));
+        keyValue("  Indexes", String(indexes.length));
+    }
+}
+async function importSingleDatabase(client, appId, dbDir, overwrite, dryRun, summary) {
+    const metadataPath = path.join(dbDir, "metadata.json");
+    if (!existsSync(metadataPath)) {
+        warn(`Skipping ${dbDir}: no metadata.json found`);
+        summary.skipped++;
+        return;
+    }
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf-8"));
+    const databaseId = metadata.databaseId;
+    if (dryRun) {
+        info(`[dry-run] Would import database ${databaseId} (${metadata.title || "untitled"})`);
+        summary.created++;
+        return;
+    }
+    // Check if database type exists — warn if not
+    if (metadata.databaseType) {
+        warn(`Database uses type "${metadata.databaseType}". Ensure the type config exists in the target app (use \`primitive sync push\`).`);
+    }
+    // Check if database exists — use the original ID for overwrite scenarios
+    let targetDatabaseId = databaseId;
+    let exists = false;
+    try {
+        await client.getDatabase(appId, databaseId);
+        exists = true;
+    }
+    catch {
+        exists = false;
+    }
+    if (exists && !overwrite) {
+        warn(`Skipping ${databaseId}: already exists (use --overwrite to replace)`);
+        summary.skipped++;
+        return;
+    }
+    // Create database if it doesn't exist
+    // Note: server auto-generates the ID, so we capture it for subsequent operations
+    if (!exists) {
+        const createData = {
+            title: metadata.title || "Imported Database",
+        };
+        if (metadata.databaseType) {
+            createData.databaseType = metadata.databaseType;
+        }
+        if (metadata.metadata) {
+            createData.metadata = metadata.metadata;
+        }
+        const created = await client.createDatabase(appId, createData);
+        targetDatabaseId = created.databaseId || created.id || databaseId;
+        summary.created++;
+    }
+    else {
+        summary.updated++;
+    }
+    // Register indexes
+    const indexesPath = path.join(dbDir, "indexes.json");
+    if (existsSync(indexesPath)) {
+        const indexes = JSON.parse(readFileSync(indexesPath, "utf-8"));
+        for (const idx of indexes) {
+            try {
+                await client.registerDatabaseIndex(appId, targetDatabaseId, {
+                    modelName: idx.modelName || idx.model_name,
+                    fieldName: idx.fieldName || idx.field_name,
+                    fieldType: idx.fieldType || idx.field_type || "string",
+                    unique: idx.isUnique || idx.is_unique || false,
+                });
+                summary.indexesRegistered++;
+            }
+            catch {
+                // Index may already exist
+            }
+        }
+    }
+    // Register unique constraints
+    const constraintsPath = path.join(dbDir, "constraints.json");
+    if (existsSync(constraintsPath)) {
+        const constraints = JSON.parse(readFileSync(constraintsPath, "utf-8"));
+        for (const c of constraints) {
+            try {
+                await client.registerDatabaseUniqueConstraint(appId, targetDatabaseId, {
+                    modelName: c.modelName || c.model_name,
+                    constraintName: c.constraintName || c.constraint_name,
+                    fields: c.fields ? (typeof c.fields === "string" ? JSON.parse(c.fields) : c.fields) : [],
+                });
+            }
+            catch {
+                // Constraint may already exist
+            }
+        }
+    }
+    // Import records
+    const recordsPath = path.join(dbDir, "records.jsonl");
+    if (existsSync(recordsPath)) {
+        const lines = readFileSync(recordsPath, "utf-8").split("\n").filter(Boolean);
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            const { _type, _id, _data } = record;
+            // Remove 'id' and 'type' from _data to avoid duplication
+            const { id: _ignoredId, type: _ignoredType, ...data } = _data;
+            await client.saveDatabaseRecord(appId, targetDatabaseId, _type, _id, data);
+            summary.recordsImported++;
+        }
+    }
+    info(`Imported database ${databaseId} (${metadata.title || "untitled"})`);
+}
 //# sourceMappingURL=databases.js.map