primitive-admin 1.1.0-alpha.4 → 1.1.0-alpha.41

package/dist/src/commands/databases.js

@@ -1,6 +1,12 @@
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "fs";
+import * as path from "path";
+import * as TOML from "@iarna/toml";
 import { ApiClient } from "../lib/api-client.js";
 import { getCurrentAppId } from "../lib/config.js";
-import { success, error, info, keyValue, formatTable, formatId, formatDate, json, } from "../lib/output.js";
+import { parseCsv, applyColumnMap, buildRows, chunk } from "../lib/csv.js";
+import { generateDbTypes, } from "../lib/db-codegen/dbGenerator.js";
+import { success, error, info, warn, keyValue, result as printResult, formatTable, formatId, formatDate, json, } from "../lib/output.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
 function resolveAppId(appId, options) {
     const resolved = appId || options.app || getCurrentAppId();
     if (!resolved) {
@@ -9,6 +15,49 @@ function resolveAppId(appId, options) {
     }
     return resolved;
 }
+/**
+ * Validate that the named operation is an import-compatible, save-like
+ * mutation before importing (issue #145, Codex finding (a)).
+ *
+ * The importer always builds `params: { modelName, id, data }`, and the batch
+ * endpoint rejects undeclared params per item. So we require the op to be a
+ * `mutation` whose declared `params` cover `modelName`, `id`, and `data`. This
+ * surfaces a clear up-front error instead of letting every row fail
+ * server-side. Exits non-zero on any mismatch.
+ */
+async function validateImportOperation(client, appId, databaseId, operationName) {
+    let ops;
+    try {
+        ops = await client.listDatabaseOperations(appId, databaseId);
+    }
+    catch (err) {
+        error(`Could not list operations for this database: ${err?.message || err}`);
+        process.exit(1);
+        return;
+    }
+    const op = (ops || []).find((o) => o?.name === operationName);
+    if (!op) {
+        error(`Operation "${operationName}" not found — create a mutation op (e.g. ` +
+            `\`seed_save\`) on this database type first.`);
+        process.exit(1);
+        return;
+    }
+    if (op.type !== "mutation") {
+        error(`Operation "${operationName}" is a "${op.type}" op, not an import-compatible ` +
+            `mutation. CSV import needs a save-like mutation taking {modelName, id, data}.`);
+        process.exit(1);
+        return;
+    }
+    const params = op.params || {};
+    const missing = ["modelName", "id", "data"].filter((p) => !(p in params));
+    if (missing.length > 0) {
+        error(`Operation "${operationName}" is not import-compatible: its params are missing ` +
+            `${missing.join(", ")}. CSV import builds {modelName, id, data} per item, so the ` +
+            `op must declare those params (like \`seed_save\`).`);
+        process.exit(1);
+        return;
+    }
+}
 export function registerDatabasesCommands(program) {
     const databases = program
         .command("databases")
@@ -18,8 +67,23 @@ Examples:
   $ primitive databases list
   $ primitive databases create "My Database"
   $ primitive databases get <database-id>
+  $ primitive databases records models <database-id>
+  $ primitive databases records describe <database-id> <model-name>
+  $ primitive databases records query <database-id> <model-name> --filter '{"name":"Alice"}'
+  $ primitive databases operations list <database-id>
+  $ primitive databases operations execute <database-id> <operation-name> --params '{"key":"value"}'
+  $ primitive databases indexes list <database-id>
+  $ primitive databases indexes create <database-id> --model contacts --field email
+  $ primitive databases records delete <database-id> <model-name> <record-id> --yes
+  $ primitive databases records delete-all <database-id> <model-name> --yes
+  $ primitive databases records delete-all <database-id> <model-name> --filter '{"status":"draft"}' --yes
   $ primitive databases permissions list <database-id>
-  $ primitive databases group-permissions list <database-id>
+
+Note: this group manages database *instances*. To manage database *type*
+configurations (schemas, rules, operations) — including deleting a type — use
+the 'database-types' group:
+  $ primitive database-types list
+  $ primitive database-types delete <database-type>   # refuses if instances exist; pass --force to override
 `);
     // List databases
     databases
@@ -45,6 +109,7 @@ Examples:
             console.log(formatTable(list, [
                 { header: "ID", key: "databaseId", format: formatId },
                 { header: "TITLE", key: "title" },
+                { header: "TYPE", key: "databaseType", format: (v) => v || "—" },
                 { header: "PERMISSION", key: "permission" },
                 { header: "CREATED", key: "createdAt", format: formatDate },
             ]));
@@ -60,12 +125,29 @@ Examples:
         .description("Create a new database")
         .argument("<title>", "Database title")
         .option("--app <app-id>", "App ID")
+        .requiredOption("--type <database-type>", "Database type (required)")
+        .option("--cel-context <json>", "Initial CEL context as JSON (referenced from access rules as database.celContext.*)")
+        .option("--metadata <json>", "Initial CEL context as JSON (legacy alias for --cel-context)")
         .option("--json", "Output as JSON")
         .action(async (title, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.createDatabase(resolvedAppId, { title });
+            const params = { title, databaseType: options.type };
+            // `--cel-context` is the new user-facing name; `--metadata` remains
+            // supported for backwards compatibility. When both are provided,
+            // --cel-context wins.
+            const contextSource = options.celContext ?? options.metadata;
+            if (contextSource) {
+                try {
+                    params.metadata = JSON.parse(contextSource);
+                }
+                catch {
+                    error(`Invalid ${options.celContext ? "--cel-context" : "--metadata"} JSON.`);
+                    process.exit(1);
+                }
+            }
+            const result = await client.createDatabase(resolvedAppId, params);
             if (options.json) {
                 json(result);
                 return;
@@ -73,6 +155,9 @@ Examples:
             success("Database created.");
             keyValue("Database ID", result.databaseId);
             keyValue("Title", result.title);
+            if (result.databaseType) {
+                keyValue("Database Type", result.databaseType);
+            }
         }
         catch (err) {
             error(err.message);
@@ -95,10 +180,53 @@ Examples:
                 json(result);
                 return;
             }
+            printResult("Database ID", result.databaseId);
+            printResult("Title", result.title);
+            printResult("Database Type", result.databaseType || "none");
+            printResult("Permission", result.permission || "none");
+            printResult("Created", formatDate(result.createdAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Update database
+    databases
+        .command("update")
+        .description("Update a database (title, type)")
+        .argument("<database-id>", "Database ID")
+        .option("--app <app-id>", "App ID")
+        .option("--title <title>", "New title")
+        .option("--type <database-type>", "Database type (use 'none' to clear)")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        const params = {};
+        if (options.title) {
+            params.title = options.title;
+        }
+        if (options.type !== undefined) {
+            params.databaseType =
+                options.type === "none"
+                    ? null
+                    : options.type;
+        }
+        if (Object.keys(params).length === 0) {
+            error("Provide at least one of --title or --type.");
+            process.exit(1);
+        }
+        try {
+            const result = await client.updateDatabase(resolvedAppId, databaseId, params);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success("Database updated.");
             keyValue("Database ID", result.databaseId);
             keyValue("Title", result.title);
-            keyValue("Permission", result.permission);
-            keyValue("Created", formatDate(result.createdAt));
+            keyValue("Database Type", result.databaseType || "none");
         }
         catch (err) {
             error(err.message);
@@ -115,15 +243,14 @@ Examples:
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         if (!options.yes) {
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Delete database ${databaseId}? This cannot be undone.`,
-                    default: false,
-                },
-            ]);
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Delete database ${databaseId}? This cannot be undone.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
             if (!confirm) {
                 info("Cancelled.");
                 return;
@@ -176,54 +303,269 @@ Examples:
             process.exit(1);
         }
     });
-    // Grant permission
+    // Add manager action handler
+    const addManagerAction = async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.addDatabaseManager(resolvedAppId, databaseId, options.userId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Manager added: user ${options.userId}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    };
+    // Remove manager action handler
+    const removeManagerAction = async (databaseId, userId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.yes) {
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Remove manager ${userId} from database ${databaseId}?`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+            if (!confirm) {
+                info("Cancelled.");
+                return;
+            }
+        }
+        const client = new ApiClient();
+        try {
+            await client.removeDatabaseManager(resolvedAppId, databaseId, userId);
+            success(`Manager removed: user ${userId}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    };
+    // Add manager (primary command)
+    permissions
+        .command("add-manager")
+        .description("Add a user as a manager of a database")
+        .argument("<database-id>", "Database ID")
+        .requiredOption("--user-id <user-id>", "User ID to add as manager")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(addManagerAction);
+    // Remove manager (primary command)
+    permissions
+        .command("remove-manager")
+        .description("Remove a manager from a database")
+        .argument("<database-id>", "Database ID")
+        .argument("<user-id>", "User ID to remove")
+        .option("--app <app-id>", "App ID")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .action(removeManagerAction);
+    // Grant permission (deprecated alias for add-manager)
     permissions
         .command("grant")
-        .description("Grant a user permission on a database")
+        .description("(deprecated: use add-manager) Grant a user permission on a database")
         .argument("<database-id>", "Database ID")
         .requiredOption("--user-id <user-id>", "User ID to grant permission to")
-        .requiredOption("--permission <permission>", "Permission level: owner, read-write, or reader")
+        .option("--permission <permission>", "Permission level (ignored, always 'manager')")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(addManagerAction);
+    // Revoke permission (deprecated alias for remove-manager)
+    permissions
+        .command("revoke")
+        .description("(deprecated: use remove-manager) Revoke a user's permission on a database")
+        .argument("<database-id>", "Database ID")
+        .argument("<user-id>", "User ID to revoke")
+        .option("--app <app-id>", "App ID")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .action(removeManagerAction);
+    // ---- Records subcommand group ----
+    const records = databases
+        .command("records")
+        .description("Inspect and query records in a database");
+    // List models
+    records
+        .command("models")
+        .description("List model names in a database")
+        .argument("<database-id>", "Database ID")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.grantDatabasePermission(resolvedAppId, databaseId, {
-                userId: options.userId,
-                permission: options.permission,
-            });
+            const result = await client.listDatabaseModels(resolvedAppId, databaseId);
+            const models = result.models || [];
+            if (options.json) {
+                json(models);
+                return;
+            }
+            if (models.length === 0) {
+                info("No models found.");
+                return;
+            }
+            for (const m of models) {
+                console.log(`  ${m}`);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Describe model
+    records
+        .command("describe")
+        .description("Show inferred schema for a model")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.describeDatabaseModel(resolvedAppId, databaseId, modelName);
+            const fields = result.fields || [];
+            if (options.json) {
+                json(fields);
+                return;
+            }
+            if (fields.length === 0) {
+                info("No fields detected.");
+                return;
+            }
+            console.log(formatTable(fields, [
+                { header: "FIELD", key: "field_name" },
+                { header: "TYPE", key: "inferred_type" },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Query records (direct introspection via admin-data route)
+    records
+        .command("query")
+        .description("Query records in a database model (admin only)")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name to query")
+        .option("--app <app-id>", "App ID")
+        .option("--filter <json>", "Filter as JSON (e.g. '{\"name\":\"Alice\"}')")
+        .option("--filter-file <path>", "Read filter from a JSON or TOML file")
+        .option("--limit <n>", "Maximum number of records to return", parseInt)
+        .option("--cursor <cursor>", "Pagination cursor from previous query")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        if (options.filter && options.filterFile) {
+            error("Cannot use both --filter and --filter-file.");
+            process.exit(1);
+        }
+        let filter;
+        if (options.filterFile) {
+            try {
+                const content = readFileSync(options.filterFile, "utf-8");
+                if (options.filterFile.endsWith(".toml")) {
+                    const parsed = TOML.parse(content);
+                    filter = parsed.filter || parsed;
+                }
+                else {
+                    filter = JSON.parse(content);
+                }
+            }
+            catch (err) {
+                error(`Failed to read filter file: ${err.message}`);
+                process.exit(1);
+            }
+        }
+        else if (options.filter) {
+            try {
+                filter = JSON.parse(options.filter);
+            }
+            catch {
+                error("Invalid --filter JSON.");
+                process.exit(1);
+            }
+        }
+        try {
+            const result = await client.queryDatabaseRecords(resolvedAppId, databaseId, modelName, { filter, limit: options.limit, cursor: options.cursor });
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Permission '${options.permission}' granted to user ${options.userId}.`);
+            const records = result.data || [];
+            if (records.length === 0) {
+                info("No records found.");
+                return;
+            }
+            // Auto-detect columns from record keys
+            const allKeys = new Set();
+            for (const rec of records) {
+                for (const key of Object.keys(rec)) {
+                    allKeys.add(key);
+                }
+            }
+            // Put id first, then type, then the rest sorted
+            const orderedKeys = [];
+            if (allKeys.has("id")) {
+                orderedKeys.push("id");
+                allKeys.delete("id");
+            }
+            if (allKeys.has("type")) {
+                orderedKeys.push("type");
+                allKeys.delete("type");
+            }
+            orderedKeys.push(...[...allKeys].sort());
+            const columns = orderedKeys.map((key) => ({
+                header: key.toUpperCase(),
+                key,
+                format: (v) => {
+                    if (v === null || v === undefined)
+                        return "—";
+                    if (typeof v === "object")
+                        return JSON.stringify(v);
+                    return String(v);
+                },
+            }));
+            console.log(formatTable(records, columns));
+            if (result.nextCursor) {
+                info(`More results available. Use --cursor ${result.nextCursor}`);
+            }
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Revoke permission
-    permissions
-        .command("revoke")
-        .description("Revoke a user's permission on a database")
+    // Delete a single record
+    records
+        .command("delete")
+        .description("Delete a single record from a database model (admin only)")
         .argument("<database-id>", "Database ID")
-        .argument("<user-id>", "User ID to revoke")
+        .argument("<model-name>", "Model name")
+        .argument("<record-id>", "Record ID to delete")
         .option("--app <app-id>", "App ID")
         .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (databaseId, userId, options) => {
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, recordId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         if (!options.yes) {
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Revoke permission for user ${userId} on database ${databaseId}?`,
-                    default: false,
-                },
-            ]);
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Delete record ${recordId} from ${modelName}? This cannot be undone.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
             if (!confirm) {
                 info("Cancelled.");
                 return;
@@ -231,22 +573,186 @@ Examples:
         }
         const client = new ApiClient();
         try {
-            await client.revokeDatabasePermission(resolvedAppId, databaseId, userId);
-            success(`Permission revoked for user ${userId}.`);
+            const result = await client.deleteDatabaseRecord(resolvedAppId, databaseId, modelName, recordId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Record ${recordId} deleted from ${modelName}.`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // ---- Group Permissions subcommand group ----
-    const groupPermissions = databases
-        .command("group-permissions")
-        .description("Manage group permissions on a database");
-    // List group permissions
-    groupPermissions
+    // Delete all records for a model
+    records
+        .command("delete-all")
+        .description("Delete all records for a model (queries then batch deletes, admin only)")
+        .argument("<database-id>", "Database ID")
+        .argument("<model-name>", "Model name")
+        .option("--app <app-id>", "App ID")
+        .option("--filter <json>", "Filter as JSON to select which records to delete")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, modelName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        let filter;
+        if (options.filter) {
+            try {
+                filter = JSON.parse(options.filter);
+            }
+            catch {
+                error("Invalid --filter JSON.");
+                process.exit(1);
+            }
+        }
+        try {
+            // First, query to find all matching records
+            let allRecords = [];
+            let cursor;
+            let hasMore = true;
+            while (hasMore) {
+                const result = await client.queryDatabaseRecords(resolvedAppId, databaseId, modelName, { filter, limit: 100, cursor });
+                const records = result?.data || [];
+                allRecords = allRecords.concat(records);
+                cursor = result?.nextCursor;
+                hasMore = !!cursor && records.length > 0;
+            }
+            if (allRecords.length === 0) {
+                if (options.json) {
+                    json({ deleted: 0, modelName });
+                    return;
+                }
+                info("No matching records found.");
+                return;
+            }
+            if (!options.yes) {
+                let confirm;
+                try {
+                    confirm = await confirmPrompt(`Delete ${allRecords.length} record(s) from ${modelName}? This cannot be undone.`);
+                }
+                catch (err) {
+                    error(err.message);
+                    process.exit(1);
+                }
+                if (!confirm) {
+                    info("Cancelled.");
+                    return;
+                }
+            }
+            // Batch delete in chunks of 50
+            const BATCH_SIZE = 50;
+            let deleted = 0;
+            for (let i = 0; i < allRecords.length; i += BATCH_SIZE) {
+                const chunk = allRecords.slice(i, i + BATCH_SIZE);
+                const operations = chunk.map((r) => ({
+                    op: "delete",
+                    modelName,
+                    id: r.id,
+                }));
+                await client.batchDeleteDatabaseRecords(resolvedAppId, databaseId, operations);
+                deleted += chunk.length;
+            }
+            if (options.json) {
+                json({ deleted, modelName });
+                return;
+            }
+            success(`Deleted ${deleted} record(s) from ${modelName}.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ---- CEL context subcommand group ----
+    // `cel-context` is the user-facing name for the dict that feeds CEL
+    // access rules and filter placeholders. `metadata` is kept as a hidden
+    // alias for backwards compatibility with existing scripts.
+    const registerCelContextGroup = (name, hidden) => {
+        const group = databases
+            .command(name, { hidden })
+            .description(hidden
+            ? "Manage database CEL context (alias of 'cel-context')"
+            : "Manage database CEL context (the dict referenced by access rules and filters)");
+        group
+            .command("get")
+            .description("Read database CEL context")
+            .argument("<database-id>", "Database ID")
+            .option("--app <app-id>", "App ID")
+            .option("--json", "Output as JSON")
+            .action(async (databaseId, options) => {
+            const resolvedAppId = resolveAppId(undefined, options);
+            const client = new ApiClient();
+            try {
+                const result = await client.getDatabaseCelContext(resolvedAppId, databaseId);
+                if (options.json) {
+                    json(result);
+                    return;
+                }
+                printResult("Database ID", result.databaseId);
+                const ctx = result.celContext ?? result.metadata;
+                if (ctx && Object.keys(ctx).length > 0) {
+                    printResult("CEL Context", JSON.stringify(ctx, null, 2));
+                }
+                else {
+                    info("No CEL context set.");
+                }
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+        });
+        group
+            .command("update")
+            .description("Update database CEL context (merge with existing)")
+            .argument("<database-id>", "Database ID")
+            .requiredOption("--data <json>", "CEL context fields as JSON (merged with existing)")
+            .option("--app <app-id>", "App ID")
+            .option("--json", "Output as JSON")
+            .action(async (databaseId, options) => {
+            const resolvedAppId = resolveAppId(undefined, options);
+            const client = new ApiClient();
+            let data;
+            try {
+                data = JSON.parse(options.data);
+            }
+            catch {
+                error("Invalid --data JSON.");
+                process.exit(1);
+                return;
+            }
+            try {
+                const result = await client.updateDatabaseCelContext(resolvedAppId, databaseId, data);
+                if (options.json) {
+                    json(result);
+                    return;
+                }
+                success("CEL context updated.");
+                const ctx = result.celContext ?? result.metadata;
+                if (ctx) {
+                    keyValue("CEL Context", JSON.stringify(ctx));
+                }
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+        });
+    };
+    registerCelContextGroup("cel-context", false);
+    // Hidden legacy alias — `primitive databases metadata get/update` still works.
+    registerCelContextGroup("metadata", true);
+    // ---- Operations subcommand group ----
+    const operations = databases
+        .command("operations")
+        .description("List and execute registered operations on a database");
+    // List operations
+    operations
         .command("list")
-        .description("List group permissions for a database")
+        .description("List registered operations available on a database")
         .argument("<database-id>", "Database ID")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
@@ -254,21 +760,21 @@ Examples:
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.listDatabaseGroupPermissions(resolvedAppId, databaseId);
-            const list = Array.isArray(result) ? result : result?.permissions ?? [];
+            const result = await client.listDatabaseOperations(resolvedAppId, databaseId);
+            const list = Array.isArray(result) ? result : [];
             if (options.json) {
                 json(list);
                 return;
             }
             if (list.length === 0) {
-                info("No group permissions found.");
+                info("No operations found.");
                 return;
             }
             console.log(formatTable(list, [
-                { header: "GROUP_TYPE", key: "groupType" },
-                { header: "GROUP_ID", key: "groupId" },
-                { header: "PERMISSION", key: "permission" },
-                { header: "GRANTED", key: "grantedAt", format: formatDate },
+                { header: "NAME", key: "name" },
+                { header: "TYPE", key: "type" },
+                { header: "MODEL", key: "modelName" },
+                { header: "ACCESS", key: "access" },
             ]));
         }
         catch (err) {
@@ -276,57 +782,193 @@ Examples:
             process.exit(1);
         }
     });
-    // Grant group permission
-    groupPermissions
-        .command("grant")
-        .description("Grant a group permission on a database")
+    // Execute operation
+    operations
+        .command("execute")
+        .description("Execute a registered operation on a database")
         .argument("<database-id>", "Database ID")
-        .requiredOption("--group-type <type>", "Group type")
-        .requiredOption("--group-id <id>", "Group ID")
-        .requiredOption("--permission <permission>", "Permission level: read-write or reader")
+        .argument("<operation-name>", "Operation name")
+        .option("--params <json>", "Operation parameters as JSON")
+        .option("--limit <n>", "Max records to return (for queries)")
+        .option("--cursor <cursor>", "Pagination cursor")
+        .option("--token <jwt>", "Execute as a specific user (dev/test — JWT visible in process args)")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .option("--timing", "Show server-side timing breakdown")
+        .action(async (databaseId, operationName, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        let params;
+        if (options.params) {
+            try {
+                params = JSON.parse(options.params);
+            }
+            catch {
+                error("Invalid --params JSON.");
+                process.exit(1);
+                return;
+            }
+        }
+        const body = {};
+        if (params)
+            body.params = params;
+        if (options.limit)
+            body.limit = parseInt(options.limit, 10);
+        if (options.cursor)
+            body.cursor = options.cursor;
+        try {
+            const result = await client.executeDatabaseOperation(resolvedAppId, databaseId, operationName, body, options.token, { timing: !!options.timing });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            // Smart display based on result shape
+            if (result.data && Array.isArray(result.data)) {
+                if (result.data.length === 0) {
+                    info("No records found.");
+                }
+                else {
+                    const cols = Object.keys(result.data[0]).filter((k) => k !== "type");
+                    console.log(formatTable(result.data, cols.map((c) => ({
+                        header: c.toUpperCase(),
+                        key: c,
+                        format: (v) => {
+                            if (v === null || v === undefined)
+                                return "—";
+                            if (typeof v === "object") {
+                                const s = JSON.stringify(v);
+                                return s.length > 50 ? s.slice(0, 47) + "..." : s;
+                            }
+                            const s = String(v);
+                            return s.length > 50 ? s.slice(0, 47) + "..." : s;
+                        },
+                    }))));
+                }
+                if (result.hasMore) {
+                    info(`More records available. Use --cursor ${result.cursor} to continue.`);
+                }
+            }
+            else if (result.count !== undefined) {
+                console.log(`Count: ${result.count}`);
+            }
+            else if (result.result !== undefined) {
+                // Aggregate result
+                json(result);
+            }
+            else if (result.results && Array.isArray(result.results)) {
+                // Batch/mutation results
+                success(`Operation executed (${result.results.length} result${result.results.length === 1 ? "" : "s"}).`);
+            }
+            else if (result.success !== undefined) {
+                success("Operation executed.");
+            }
+            else {
+                json(result);
+            }
+            // Display timing if present
+            if (result._timing) {
+                console.log("");
+                console.log("Timing:");
+                for (const [key, value] of Object.entries(result._timing)) {
+                    console.log(`  ${key}: ${value}ms`);
+                }
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ---- Indexes subcommand group ----
+    const indexes = databases
+        .command("indexes")
+        .description("Manage indexes on a database");
+    // List indexes
+    indexes
+        .command("list")
+        .description("List indexes for a database or model")
+        .argument("<database-id>", "Database ID")
+        .option("--model <model-name>", "Filter by model name")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.listDatabaseIndexes(resolvedAppId, databaseId, options.model);
+            const list = result.indexes || [];
+            if (options.json) {
+                json(list);
+                return;
+            }
+            if (list.length === 0) {
+                info("No indexes found.");
+                return;
+            }
+            console.log(formatTable(list, [
+                { header: "MODEL", key: "model_name" },
+                { header: "FIELD", key: "field_name" },
+                { header: "TYPE", key: "field_type" },
+                { header: "UNIQUE", key: "is_unique", format: (v) => (v ? "Yes" : "No") },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Register index
+    indexes
+        .command("create")
+        .description("Create an index on a model field")
+        .argument("<database-id>", "Database ID")
+        .requiredOption("--model <model-name>", "Model name")
+        .requiredOption("--field <field-name>", "Field name to index")
+        .option("--type <field-type>", "Field type: string, number, or boolean", "string")
+        .option("--unique", "Make this a unique index")
         .option("--app <app-id>", "App ID")
         .option("--json", "Output as JSON")
         .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.grantDatabaseGroupPermission(resolvedAppId, databaseId, {
-                groupType: options.groupType,
-                groupId: options.groupId,
-                permission: options.permission,
+            const result = await client.registerDatabaseIndex(resolvedAppId, databaseId, {
+                modelName: options.model,
+                fieldName: options.field,
+                fieldType: options.type,
+                unique: !!options.unique,
             });
             if (options.json) {
                 json(result);
                 return;
             }
-            success(`Permission '${options.permission}' granted to group ${options.groupType}/${options.groupId}.`);
+            success(`Index created on ${options.model}.${options.field} (${options.type}${options.unique ? ", unique" : ""}).`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Revoke group permission
-    groupPermissions
-        .command("revoke")
-        .description("Revoke a group's permission on a database")
+    // Drop index
+    indexes
+        .command("drop")
+        .description("Drop an index from a model field")
         .argument("<database-id>", "Database ID")
-        .argument("<group-type>", "Group type")
-        .argument("<group-id>", "Group ID")
+        .requiredOption("--model <model-name>", "Model name")
+        .requiredOption("--field <field-name>", "Field name")
         .option("--app <app-id>", "App ID")
         .option("-y, --yes", "Skip confirmation prompt")
-        .action(async (databaseId, groupType, groupId, options) => {
+        .action(async (databaseId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         if (!options.yes) {
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Revoke permission for group ${groupType}/${groupId} on database ${databaseId}?`,
-                    default: false,
-                },
-            ]);
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Drop index on ${options.model}.${options.field}?`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
             if (!confirm) {
                 info("Cancelled.");
                 return;
@@ -334,13 +976,750 @@ Examples:
         }
         const client = new ApiClient();
         try {
-            await client.revokeDatabaseGroupPermission(resolvedAppId, databaseId, groupType, groupId);
-            success(`Permission revoked for group ${groupType}/${groupId}.`);
+            await client.dropDatabaseIndex(resolvedAppId, databaseId, {
+                modelName: options.model,
+                fieldName: options.field,
+            });
+            success(`Index dropped on ${options.model}.${options.field}.`);
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
+    // Reindex an existing instance from its type schema (issue #974). The
+    // on-demand remedy that brings a pre-existing database into compliance after
+    // a schema declares a field `unique = true` — registers any declared-but-
+    // missing unique index so `upsertOn` ops resolve. Idempotent.
+    databases
+        .command("reindex")
+        .description("Reprovision a database's unique indexes from its type schema")
+        .argument("<database-id>", "Database ID")
+        .requiredOption("--from-schema", "Reprovision unique indexes declared in the type schema")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (databaseId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const res = await client.reindexDatabaseFromSchema(resolvedAppId, databaseId);
+            if (options.json) {
+                json(res);
+                return;
+            }
+            if (res.skipped) {
+                info(`Nothing to reindex (${res.reason}).`);
+                return;
+            }
+            success(`Reindexed from schema: ${res.registered} unique index${res.registered === 1 ? "" : "es"} provisioned.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ---- Export / Import commands ----
+    databases
+        .command("export")
+        .description("Export a database (records, indexes, constraints)")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .argument("<database-id>", "Database ID to export")
+        .option("--app <app-id>", "App ID")
+        .option("--output <dir>", "Output directory", "./primitive-export")
+        .option("--json", "Output as JSON")
+        .action(async (first, second, options) => {
+        let resolvedAppId;
+        let databaseId;
+        if (second && !second.startsWith("-")) {
+            resolvedAppId = resolveAppId(first, options);
+            databaseId = second;
+        }
+        else {
+            resolvedAppId = resolveAppId(undefined, options);
+            databaseId = first;
+        }
+        if (!databaseId) {
+            error("Database ID is required.");
+            process.exit(1);
+        }
+        const client = new ApiClient();
+        try {
+            await exportSingleDatabase(client, resolvedAppId, databaseId, options.output, options.json);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    databases
+        .command("import")
+        .description("Import a database from an export directory")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .argument("<path>", "Path to database export directory")
+        .option("--app <app-id>", "App ID")
+        .option("--overwrite", "Replace existing database if ID collides")
+        .option("--dry-run", "Show what would be imported without making changes")
+        .option("--json", "Output as JSON")
+        .action(async (first, second, options) => {
+        let resolvedAppId;
+        let importPath;
+        if (second && !second.startsWith("-")) {
+            resolvedAppId = resolveAppId(first, options);
+            importPath = second;
+        }
+        else {
+            resolvedAppId = resolveAppId(undefined, options);
+            importPath = first;
+        }
+        if (!importPath) {
+            error("Import path is required.");
+            process.exit(1);
+        }
+        const client = new ApiClient();
+        try {
+            // Determine if this is a manifest-based export or a single database
+            let dbDirs = [];
+            const manifestPath = path.join(importPath, "manifest.json");
+            if (existsSync(path.join(importPath, "metadata.json"))) {
+                // Single database directory
+                dbDirs = [importPath];
+            }
+            else if (existsSync(manifestPath)) {
+                const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+                for (const dbId of manifest.databases || []) {
+                    const dbDir = path.join(importPath, "databases", dbId);
+                    if (existsSync(dbDir)) {
+                        dbDirs.push(dbDir);
+                    }
+                }
+            }
+            else if (existsSync(path.join(importPath, "databases"))) {
+                const entries = readdirSync(path.join(importPath, "databases"), { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.isDirectory()) {
+                        dbDirs.push(path.join(importPath, "databases", entry.name));
+                    }
+                }
+            }
+            else {
+                error("No valid database export data found at the specified path.");
+                process.exit(1);
+            }
+            if (dbDirs.length === 0) {
+                info("No databases to import.");
+                return;
+            }
+            const summary = { created: 0, updated: 0, skipped: 0, recordsImported: 0, indexesRegistered: 0 };
+            for (const dbDir of dbDirs) {
+                await importSingleDatabase(client, resolvedAppId, dbDir, options.overwrite || false, options.dryRun || false, summary);
+            }
+            if (options.json) {
+                json(summary);
+            }
+            else {
+                success("Database import complete:");
+                keyValue("  Databases created", String(summary.created));
+                if (summary.updated > 0)
+                    keyValue("  Databases updated", String(summary.updated));
+                if (summary.skipped > 0)
+                    keyValue("  Databases skipped", String(summary.skipped));
+                keyValue("  Records imported", String(summary.recordsImported));
+                if (summary.indexesRegistered > 0)
+                    keyValue("  Indexes registered", String(summary.indexesRegistered));
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ============================================
+    // CSV import (issue #145, Phase 1)
+    // ============================================
+    databases
+        .command("import-csv")
+        .description("Import rows from a CSV file into a database via a registered batch (bulk) save operation")
+        .argument("<database-id>", "Database ID")
+        .argument("<file>", "Path to the CSV file")
+        .requiredOption("--model <name>", "Model name passed in each item's params")
+        .option("--operation <op>", "Registered mutation operation to use (must be a {modelName,id,data} save-like op)", "seed_save")
+        .option("--column-map <json>", 'Map CSV headers to field names, e.g. \'{"CSV Header":"fieldName"}\'')
+        .option("--types <json>", 'Coerce fields by type, e.g. \'{"price":"number","active":"boolean"}\'')
+        .option("--id-column <col>", "Use this CSV column for record ids (else a ULID is generated)")
+        .option("--batch-size <n>", "Records per batch request (default: 5000)", "5000")
+        .option("--delimiter <char>", "CSV field delimiter (default: ',')", ",")
+        .option("--app <app-id>", "App ID")
+        .option("--dry-run", "Parse + report row/batch counts without writing")
+        .option("--stop-on-error", "Abort the whole import on the first chunk error (default: best-effort continue)")
+        .option("--json", "Output a machine-readable result")
+        .action(async (databaseId, file, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        // Parse JSON flags up front for clear errors.
+        let columnMap;
+        if (options.columnMap) {
+            try {
+                columnMap = JSON.parse(options.columnMap);
+            }
+            catch {
+                error("Invalid --column-map JSON.");
+                process.exit(1);
+                return;
+            }
+        }
+        let types;
+        if (options.types) {
+            try {
+                types = JSON.parse(options.types);
+            }
+            catch {
+                error("Invalid --types JSON.");
+                process.exit(1);
+                return;
+            }
+        }
+        const batchSize = parseInt(options.batchSize, 10);
+        if (!Number.isInteger(batchSize) || batchSize < 1) {
+            error("--batch-size must be a positive integer.");
+            process.exit(1);
+            return;
+        }
+        // The server rejects batch requests over 100000 items; keep chunks under it.
+        if (batchSize > 100000) {
+            error("--batch-size cannot exceed 100000 (the server's per-request cap).");
+            process.exit(1);
+            return;
+        }
+        if (!existsSync(file)) {
+            error(`CSV file not found: ${file}`);
+            process.exit(1);
+            return;
+        }
+        try {
+            // 1. Read + parse the CSV.
+            const raw = readFileSync(file, "utf-8");
+            let rows = parseCsv(raw, options.delimiter);
+            // 2. Apply column map.
+            rows = applyColumnMap(rows, columnMap);
+            // 3. Coerce types, assign ids, shape into batch items.
+            const { batch, rowCount } = buildRows(rows, {
+                modelName: options.model,
+                types,
+                idColumn: options.idColumn,
+            });
+            const chunks = chunk(batch, batchSize);
+            // 4. Validate the chosen op is an import-compatible save-like mutation
+            //    BEFORE writing (op-not-found / incompatible → clear up-front error
+            //    rather than per-row server-side failure). Skip the round-trip only
+            //    when there is genuinely nothing to import in a dry run.
+            if (!options.dryRun || rowCount > 0) {
+                await validateImportOperation(client, resolvedAppId, databaseId, options.operation);
+            }
+            // 5. Empty / headers-only CSV: no request, report 0/0.
+            if (rowCount === 0) {
+                if (options.json) {
+                    json({ imported: 0, failed: 0, rows: 0, batches: 0, errors: [], dryRun: !!options.dryRun });
+                }
+                else {
+                    info("No data rows found in CSV — nothing to import.");
+                    success("Imported: 0, Failed: 0");
+                }
+                return;
+            }
+            // 6. Dry run: report counts, no writes.
+            if (options.dryRun) {
+                if (options.json) {
+                    json({ dryRun: true, rows: rowCount, batches: chunks.length, batchSize });
+                }
+                else {
+                    info(`Dry run — no records written.`);
+                    keyValue("  Rows", String(rowCount));
+                    keyValue("  Batches", String(chunks.length));
+                    keyValue("  Batch size", String(batchSize));
+                }
+                return;
+            }
+            // 7. Import chunk by chunk; accumulate imported/failed + per-chunk errors.
+            let imported = 0;
+            let failed = 0;
+            const errors = [];
+            let aborted = false;
+            for (let i = 0; i < chunks.length; i++) {
+                const piece = chunks[i];
+                try {
+                    const res = await client.executeBatch(resolvedAppId, databaseId, options.operation, piece);
+                    imported += res.imported ?? 0;
+                    failed += res.failed ?? 0;
+                    if (!options.json) {
+                        info(`Batch ${i + 1}/${chunks.length}: imported ${res.imported ?? 0}, failed ${res.failed ?? 0}`);
+                    }
+                }
+                catch (err) {
+                    const msg = err?.message || String(err);
+                    errors.push({ batch: i, error: msg });
+                    failed += piece.length;
+                    if (!options.json) {
+                        warn(`Batch ${i + 1}/${chunks.length} failed: ${msg}`);
+                    }
+                    if (options.stopOnError) {
+                        aborted = true;
+                        break;
+                    }
+                }
+            }
+            if (options.json) {
+                json({ imported, failed, rows: rowCount, batches: chunks.length, errors, aborted });
+            }
+            else {
+                if (aborted) {
+                    warn(`Aborted after a chunk error (--stop-on-error).`);
+                }
+                success(`Imported: ${imported}, Failed: ${failed}`);
+                if (errors.length > 0) {
+                    error(`${errors.length} batch(es) errored:`);
+                    for (const e of errors) {
+                        error(`  Batch ${e.batch + 1}: ${e.error}`);
+                    }
+                }
+            }
+            // Non-zero exit if any chunk errored.
+            if (errors.length > 0) {
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ============================================
+    // Schema commands (issue #666)
+    // ============================================
+    const schema = databases
+        .command("schema")
+        .description("Manage the TOML schema attached to a database type");
+    schema
+        .command("generate")
+        .description("Scaffold a starting TOML schema for <database-type> from existing operations + DO introspection, and insert it into the local database-types/<type>.toml file.")
+        .argument("<database-type>", "Database type name")
+        .option("--app <app-id>", "App ID")
+        .option("--sync-dir <path>", "Override path to the sync directory (defaults to ./.primitive/sync/<env>/<appId>/)")
+        .option("-f, --force", "Overwrite an existing [models.*] block in the local file")
+        .option("--json", "Output the generated TOML as JSON")
+        .action(async (databaseType, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            // 1. Call the server's :scaffold endpoint.
+            const result = await client.scaffoldDatabaseTypeSchema(resolvedAppId, databaseType);
+            const scaffoldedToml = result?.schema ?? "";
+            if (options.json) {
+                json({ schema: scaffoldedToml });
+                return;
+            }
+            // 2. Locate the local `database-types/<type>.toml` file. Per the
+            // plan-of-record CLI sync layout, the file lives at
+            // `<sync-dir>/database-types/<type>.toml`. We don't need to know the
+            // exact sync dir for the happy path — just look for an existing
+            // file relative to the CWD's `.primitive/sync/` directory tree.
+            const candidateFiles = [];
+            if (options.syncDir) {
+                candidateFiles.push(path.join(options.syncDir, "database-types", `${databaseType}.toml`));
+            }
+            else {
+                // Search any env/appId subtree under .primitive/sync that matches.
+                const root = path.join(process.cwd(), ".primitive", "sync");
+                if (existsSync(root)) {
+                    for (const env of readdirSync(root)) {
+                        const envDir = path.join(root, env);
+                        try {
+                            for (const app of readdirSync(envDir)) {
+                                const candidate = path.join(envDir, app, "database-types", `${databaseType}.toml`);
+                                if (existsSync(candidate)) {
+                                    candidateFiles.push(candidate);
+                                }
+                            }
+                        }
+                        catch {
+                            // skip non-dirs
+                        }
+                    }
+                }
+            }
+            if (candidateFiles.length === 0) {
+                // No local file found — print the scaffold to stdout and tell
+                // the user where to put it.
+                info(`No local database-types/${databaseType}.toml found under .primitive/sync/. Generated TOML:`);
+                console.log("");
+                console.log(scaffoldedToml);
+                return;
+            }
+            // 3. For each candidate, splice the scaffolded TOML at a stable
+            // anchor (before the first `[[operations]]` block, or at EOF). Per
+            // the plan-of-record, textual insertion is deliberate — `@iarna/toml`
+            // parse/stringify drops comments, so we splice as a raw string.
+            for (const targetPath of candidateFiles) {
+                const original = readFileSync(targetPath, "utf-8");
+                // Detect existing [models.*] block. If present, refuse unless --force.
+                const hasModelsBlock = /\n\[models\./.test("\n" + original);
+                if (hasModelsBlock && !options.force) {
+                    error(`${targetPath} already has [models.*] blocks. Re-run with --force to overwrite.`);
+                    process.exit(1);
+                }
+                // Strip existing [models.*] blocks if --force.
+                let cleaned = original;
+                if (hasModelsBlock && options.force) {
+                    cleaned = stripModelsBlocks(original);
+                }
+                // Splice: insert before the first [[operations]] block, otherwise
+                // at the end of file.
+                let merged;
+                const opsAnchor = cleaned.indexOf("\n[[operations]]");
+                if (opsAnchor >= 0) {
+                    merged =
+                        cleaned.slice(0, opsAnchor + 1) +
+                            scaffoldedToml +
+                            "\n" +
+                            cleaned.slice(opsAnchor + 1);
+                }
+                else {
+                    const sep = cleaned.endsWith("\n") ? "" : "\n";
+                    merged = cleaned + sep + scaffoldedToml + "\n";
+                }
+                writeFileSync(targetPath, merged);
+                success(`Inserted schema into ${targetPath}`);
+            }
+            info("Review the generated schema, fix types the generator guessed wrong, then run `primitive sync push` (or `primitive sync push --dry-run`).");
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // ============================================
+    // Codegen command (issue #814)
+    // ============================================
+    databases
+        .command("codegen")
+        .description("Generate TypeScript record + operation types from the local database-types/*.toml schema. Emits a <type>.generated.ts per database type (record interfaces, per-op input-params interfaces, and per-op result aliases).")
+        .argument("[database-type]", "Generate for a single database type (defaults to every database-types/*.toml found)")
+        .option("--app <app-id>", "App ID")
+        .option("--sync-dir <path>", "Override path to the sync directory (defaults to ./.primitive/sync/<env>/<appId>/)")
+        .option("-o, --output <dir>", "Output directory for *.generated.ts files (defaults to <sync-dir>/database-types/generated/)")
+        .option("--check", "Exit non-zero if generated output is out of date (CI guard); does not write.")
+        .option("--json", "Output the result summary as JSON")
+        .action(async (databaseType, options) => {
+        try {
+            // 1. Locate the database-types directory. Mirrors `schema generate`'s
+            //    sync-dir resolution: honor --sync-dir, else search any
+            //    env/appId subtree under ./.primitive/sync that has a
+            //    database-types/ directory.
+            const dbTypesDirs = [];
+            if (options.syncDir) {
+                dbTypesDirs.push(path.join(options.syncDir, "database-types"));
+            }
+            else {
+                const root = path.join(process.cwd(), ".primitive", "sync");
+                if (existsSync(root)) {
+                    for (const env of readdirSync(root)) {
+                        const envDir = path.join(root, env);
+                        try {
+                            for (const app of readdirSync(envDir)) {
+                                const candidate = path.join(envDir, app, "database-types");
+                                if (existsSync(candidate)) {
+                                    dbTypesDirs.push(candidate);
+                                }
+                            }
+                        }
+                        catch {
+                            // skip non-dirs
+                        }
+                    }
+                }
+            }
+            if (dbTypesDirs.length === 0) {
+                error("No database-types/ directory found. Pass --sync-dir or run `primitive sync pull` first.");
+                process.exit(1);
+            }
+            // 2. Collect the source .toml files (one per database type), filtered
+            //    to a single type when an argument is given.
+            const inputs = [];
+            const seenTypes = new Set();
+            for (const dir of dbTypesDirs) {
+                for (const fileName of readdirSync(dir)) {
+                    if (!fileName.endsWith(".toml"))
+                        continue;
+                    const typeName = fileName.slice(0, -".toml".length);
+                    if (databaseType && typeName !== databaseType)
+                        continue;
+                    if (seenTypes.has(typeName))
+                        continue;
+                    seenTypes.add(typeName);
+                    const tomlPath = path.join(dir, fileName);
+                    inputs.push({
+                        databaseType: typeName,
+                        tomlPath,
+                        tomlContent: readFileSync(tomlPath, "utf-8"),
+                    });
+                }
+            }
+            if (inputs.length === 0) {
+                error(databaseType
+                    ? `No database-types/${databaseType}.toml found under .primitive/sync/.`
+                    : "No database-types/*.toml files found to generate from.");
+                process.exit(1);
+            }
+            // 3. Resolve the output directory. Default: a `generated/` subdir of
+            //    the first source dir (keeps generated output beside the schema).
+            const outputDir = options.output
+                ? path.resolve(options.output)
+                : path.join(path.dirname(inputs[0].tomlPath), "generated");
+            // 4. Run codegen (or --check). When a single database-type filter
+            //    argument is given, the input set is partial — flag it so stale
+            //    cleanup is scoped to that type and sibling types' generated files
+            //    are left intact.
+            const codegenResult = await generateDbTypes({
+                inputs,
+                outputDir,
+                check: !!options.check,
+                singleType: !!databaseType,
+            });
+            if (options.check) {
+                if (codegenResult.mismatches.length > 0) {
+                    if (options.json) {
+                        json({ ok: false, mismatches: codegenResult.mismatches });
+                    }
+                    else {
+                        error(`Check failed: ${codegenResult.mismatches.length} file(s) out of date.`);
+                        for (const m of codegenResult.mismatches) {
+                            error(`  ${m.reason}: ${path.relative(process.cwd(), m.filePath)}`);
+                        }
+                        info("Run `primitive databases codegen` to regenerate.");
+                    }
+                    process.exit(1);
+                }
+                if (options.json) {
+                    json({ ok: true, checked: codegenResult.writtenFiles.length });
+                }
+                else {
+                    success(`Check passed: ${codegenResult.writtenFiles.length} file(s) up to date.`);
+                }
+                return;
+            }
+            if (options.json) {
+                json({
+                    written: codegenResult.writtenFiles,
+                    deleted: codegenResult.deletedFiles,
+                });
+                return;
+            }
+            success(`Generated ${codegenResult.writtenFiles.length} file(s)` +
+                (codegenResult.deletedFiles.length > 0
+                    ? `, deleted ${codegenResult.deletedFiles.length} stale file(s).`
+                    : "."));
+            for (const f of codegenResult.writtenFiles) {
+                keyValue("  wrote", path.relative(process.cwd(), f));
+            }
+            for (const f of codegenResult.deletedFiles) {
+                keyValue("  deleted", path.relative(process.cwd(), f));
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+}
+/** Remove every existing `[models.*]` block from a TOML file body. */
+function stripModelsBlocks(text) {
+    const lines = text.split("\n");
+    const result = [];
+    let skipping = false;
+    for (const line of lines) {
+        const isModelsHeader = /^\s*\[models\b/.test(line);
+        const isOtherHeader = /^\s*\[(?!models\b)/.test(line);
+        if (isModelsHeader) {
+            skipping = true;
+            continue;
+        }
+        if (skipping && isOtherHeader) {
+            skipping = false;
+        }
+        if (!skipping)
+            result.push(line);
+    }
+    return result.join("\n");
+}
+// ============================================
+// Database export/import helpers
+// ============================================
+async function exportSingleDatabase(client, appId, databaseId, outputDir, jsonOutput) {
+    const dbDir = path.join(outputDir, "databases", databaseId);
+    mkdirSync(dbDir, { recursive: true });
+    // 1. Fetch database metadata
+    const dbMeta = await client.getDatabase(appId, databaseId);
+    // Warn about databaseType sync
+    if (dbMeta.databaseType) {
+        warn(`This database uses type "${dbMeta.databaseType}". Make sure to \`primitive sync push\` the type config before importing into a new app.`);
+    }
+    // 2. Write metadata
+    const metadata = {
+        databaseId: dbMeta.databaseId || databaseId,
+        title: dbMeta.title,
+        databaseType: dbMeta.databaseType || null,
+        metadata: dbMeta.metadata || null,
+    };
+    writeFileSync(path.join(dbDir, "metadata.json"), JSON.stringify(metadata, null, 2));
+    // 3. Export records: list models, then query each
+    const models = await client.listDatabaseModels(appId, databaseId);
+    let totalRecords = 0;
+    const recordsFile = path.join(dbDir, "records.jsonl");
+    // Clear file
+    writeFileSync(recordsFile, "");
+    for (const modelName of models) {
+        let cursor;
+        let hasMore = true;
+        while (hasMore) {
+            const result = await client.queryDatabaseRecords(appId, databaseId, modelName, {
+                limit: 100,
+                cursor,
+            });
+            const records = result?.data || [];
+            for (const record of records) {
+                const line = JSON.stringify({ _type: modelName, _id: record.id, _data: record });
+                appendFileSync(recordsFile, line + "\n");
+                totalRecords++;
+            }
+            cursor = result?.nextCursor;
+            hasMore = !!cursor && records.length > 0;
+        }
+    }
+    // 4. Export indexes
+    const indexes = await client.listDatabaseIndexes(appId, databaseId);
+    writeFileSync(path.join(dbDir, "indexes.json"), JSON.stringify(indexes, null, 2));
+    // 5. Export unique constraints
+    const constraints = await client.listDatabaseUniqueConstraints(appId, databaseId);
+    writeFileSync(path.join(dbDir, "constraints.json"), JSON.stringify(constraints, null, 2));
+    if (jsonOutput) {
+        json({
+            databaseId,
+            title: metadata.title,
+            databaseType: metadata.databaseType,
+            models: models.length,
+            records: totalRecords,
+            indexes: indexes.length,
+            constraints: constraints.length,
+            exportPath: dbDir,
+        });
+    }
+    else {
+        success(`Exported database ${databaseId} (${metadata.title || "untitled"}) to ${dbDir}`);
+        keyValue("  Models", String(models.length));
+        keyValue("  Records", String(totalRecords));
+        keyValue("  Indexes", String(indexes.length));
+    }
+}
+async function importSingleDatabase(client, appId, dbDir, overwrite, dryRun, summary) {
+    const metadataPath = path.join(dbDir, "metadata.json");
+    if (!existsSync(metadataPath)) {
+        warn(`Skipping ${dbDir}: no metadata.json found`);
+        summary.skipped++;
+        return;
+    }
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf-8"));
+    const databaseId = metadata.databaseId;
+    if (dryRun) {
+        info(`[dry-run] Would import database ${databaseId} (${metadata.title || "untitled"})`);
+        summary.created++;
+        return;
+    }
+    // Check if database type exists — warn if not
+    if (metadata.databaseType) {
+        warn(`Database uses type "${metadata.databaseType}". Ensure the type config exists in the target app (use \`primitive sync push\`).`);
+    }
+    // Check if database exists — use the original ID for overwrite scenarios
+    let targetDatabaseId = databaseId;
+    let exists = false;
+    try {
+        await client.getDatabase(appId, databaseId);
+        exists = true;
+    }
+    catch {
+        exists = false;
+    }
+    if (exists && !overwrite) {
+        warn(`Skipping ${databaseId}: already exists (use --overwrite to replace)`);
+        summary.skipped++;
+        return;
+    }
+    // Create database if it doesn't exist
+    // Note: server auto-generates the ID, so we capture it for subsequent operations
+    if (!exists) {
+        const createData = {
+            title: metadata.title || "Imported Database",
+        };
+        if (metadata.databaseType) {
+            createData.databaseType = metadata.databaseType;
+        }
+        if (metadata.metadata) {
+            createData.metadata = metadata.metadata;
+        }
+        const created = await client.createDatabase(appId, createData);
+        targetDatabaseId = created.databaseId || created.id || databaseId;
+        summary.created++;
+    }
+    else {
+        summary.updated++;
+    }
+    // Register indexes
+    const indexesPath = path.join(dbDir, "indexes.json");
+    if (existsSync(indexesPath)) {
+        const indexes = JSON.parse(readFileSync(indexesPath, "utf-8"));
+        for (const idx of indexes) {
+            try {
+                await client.registerDatabaseIndex(appId, targetDatabaseId, {
+                    modelName: idx.modelName || idx.model_name,
+                    fieldName: idx.fieldName || idx.field_name,
+                    fieldType: idx.fieldType || idx.field_type || "string",
+                    unique: idx.isUnique || idx.is_unique || false,
+                });
+                summary.indexesRegistered++;
+            }
+            catch {
+                // Index may already exist
+            }
+        }
+    }
+    // Register unique constraints
+    const constraintsPath = path.join(dbDir, "constraints.json");
+    if (existsSync(constraintsPath)) {
+        const constraints = JSON.parse(readFileSync(constraintsPath, "utf-8"));
+        for (const c of constraints) {
+            try {
+                await client.registerDatabaseUniqueConstraint(appId, targetDatabaseId, {
+                    modelName: c.modelName || c.model_name,
+                    constraintName: c.constraintName || c.constraint_name,
+                    fields: c.fields ? (typeof c.fields === "string" ? JSON.parse(c.fields) : c.fields) : [],
+                });
+            }
+            catch {
+                // Constraint may already exist
+            }
+        }
+    }
+    // Import records
+    const recordsPath = path.join(dbDir, "records.jsonl");
+    if (existsSync(recordsPath)) {
+        const lines = readFileSync(recordsPath, "utf-8").split("\n").filter(Boolean);
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            const { _type, _id, _data } = record;
+            // Remove 'id' and 'type' from _data to avoid duplication
+            const { id: _ignoredId, type: _ignoredType, ...data } = _data;
+            await client.saveDatabaseRecord(appId, targetDatabaseId, _type, _id, data);
+            summary.recordsImported++;
+        }
+    }
+    info(`Imported database ${databaseId} (${metadata.title || "untitled"})`);
 }
 //# sourceMappingURL=databases.js.map