diff --git a/.agents/skills/webjs/references/built-ins.md b/.agents/skills/webjs/references/built-ins.md
index 1c48337a5..cde3d9ff3 100644
--- a/.agents/skills/webjs/references/built-ins.md
+++ b/.agents/skills/webjs/references/built-ins.md
@@ -216,6 +216,24 @@ An over-limit body responds `413` without buffering the whole payload.
 
 `before` runs to completion first (a non-zero exit aborts the boot). `parallel` (dev only) runs long-lived watchers alongside the server and tears them down on exit. `watch` (dev only) adds extra live-reload directories outside the app tree.
 
+### Bring your own ORM (`webjs.db`)
+
+Drizzle is the scaffold DEFAULT, not lock-in. The runtime never imports it, `db/connection.server.ts` is the app's own file, and `webjs db` is adapter-driven: a `db` block maps each verb to the shell command `webjs db <verb>` runs instead of the drizzle-kit default (node_modules/.bin on PATH like a `before` step, extra CLI args appended).
+
+```jsonc
+{ "webjs": {
+  "db": {
+    "generate": "prisma migrate dev --create-only",
+    "migrate":  "prisma migrate deploy",
+    "push":     "prisma db push",
+    "studio":   "prisma studio",
+    "reset":    "prisma migrate reset --force"
+  }
+} }
+```
+
+Any key is a verb (`reset` above adds `webjs db reset`). A verb the block does not name keeps its default (drizzle-kit for `generate` / `migrate` / `push` / `studio`, `db/seed.server.ts` for `seed`), so an app with no block is unchanged and the scaffold emits none. The payoff is that `webjs db migrate` stays one spelling across ORMs, so the scaffolded `dev.before` / `start.before`, the Dockerfile, CI, and the deploy docs all keep working after a swap. Write the bare binary (`prisma migrate deploy`), not `npx prisma ...`, since a pure Bun image has no `npx`. The swap itself is the app's own files: replace `db/connection.server.ts` with the new client, drop `drizzle.config.ts` / `db/columns.server.ts`, and keep server-only imports behind `.server.ts` as before.
+
 ### Doctor severity gate
 
 `webjs doctor` reports project health, and by default only a broken toolchain fails the exit. `--strict` makes EVERY warning fatal, which is unusable in CI, because four checks are environment-shaped: `GIT_HOOK` wants a local pre-commit hook a runner has no reason to have, `ENV_DRIFT` compares against a `.env` CI does not carry, `VENDOR_PIN` fetches the network, and `FRAMEWORK_RESOLVE` plus `FRAMEWORK_LINKS` depend on the environment. So per-check severity is CONFIG, keyed by the stable code every result carries.
diff --git a/AGENTS.md b/AGENTS.md
index 12655a2f6..1c0a333f9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -579,7 +579,7 @@ webjs version                      # print the installed @webjsdev/cli version (
 webjs help   [command]             # full usage banner, or per-command usage + Options + Examples (e.g. webjs help routes, #975). Flag forms: webjs --help / -h (banner), webjs <command> --help / -h (that command). typecheck/db/ui --help forward to their wrapped tool; an unknown topic exits 1
 webjs typecheck [tsc args...]      # the project's own tsc --noEmit
 webjs create <name> [--template api]
-webjs db <generate|migrate|push|studio|seed>   # wraps drizzle-kit (+ runs db/seed.server.ts)
+webjs db <generate|migrate|push|studio|seed|verb> [args]   # wraps drizzle-kit by default (+ runs db/seed.server.ts). Bring your own ORM (#1468): a `"webjs": { "db": { "<verb>": "<command>" } }` block in package.json runs that shell command instead (node_modules/.bin on PATH, extra args appended), any key is a verb, an unmapped verb keeps its default, so `webjs db migrate` is one spelling across ORMs and the scaffolded start.before / Dockerfile / CI keep working after a swap
 webjs ui init | add <names...> | list | view <name>
 webjs vendor pin|unpin|list|audit|outdated|update [--from PROVIDER]   # importmap pinning, .webjs/vendor/importmap.json
 ```
@@ -591,7 +591,7 @@ webjs vendor pin|unpin|list|audit|outdated|update [--from PROVIDER]   # importma
 ## Environment, server config, caching, observability
 
 - **Env vars.** `process.env.X` reads are server-only; `WEBJS_PUBLIC_`-prefixed names are exposed in the browser via an inline `<script>` (no build); `NODE_ENV` is defined both sides. See `references/built-ins.md`.
-- **The `package.json` `"webjs"` block.** Security headers (on by default, per-path `webjs.headers` overrides), CSP (opt-in nonce, `webjs.csp`), declarative `webjs.redirects` (#254), `webjs.trailingSlash` (#255), `webjs.basePath` (#256), ingress caps (`maxBodyBytes` / `maxMultipartBytes` / server timeouts), and dev/start task orchestration (`webjs.dev.before` / `webjs.dev.parallel` / `webjs.dev.regenerate` / `webjs.start.before`, #550 + #967, the orchestration `webjs dev`/`start` run so they match `npm run dev`/`start`; `regenerate` recompiles a stale served build output like `public/tailwind.css` ON REQUEST in dev, replacing a fragile `--watch`), and the doctor severity gate (`webjs.doctor.gate`, #1257, mapping a stable doctor code to `off` / `warn` / `error` so CI fails on a chosen subset of project-health checks instead of on every warning). Type it with `WebjsConfig` + the JSON Schema. See `references/built-ins.md`.
+- **The `package.json` `"webjs"` block.** Security headers (on by default, per-path `webjs.headers` overrides), CSP (opt-in nonce, `webjs.csp`), declarative `webjs.redirects` (#254), `webjs.trailingSlash` (#255), `webjs.basePath` (#256), ingress caps (`maxBodyBytes` / `maxMultipartBytes` / server timeouts), and dev/start task orchestration (`webjs.dev.before` / `webjs.dev.parallel` / `webjs.dev.regenerate` / `webjs.start.before`, #550 + #967, the orchestration `webjs dev`/`start` run so they match `npm run dev`/`start`; `regenerate` recompiles a stale served build output like `public/tailwind.css` ON REQUEST in dev, replacing a fragile `--watch`), the doctor severity gate (`webjs.doctor.gate`, #1257, mapping a stable doctor code to `off` / `warn` / `error` so CI fails on a chosen subset of project-health checks instead of on every warning), and the `webjs db` verb map (`webjs.db`, #1468, bring your own ORM: `{ "migrate": "prisma migrate deploy" }` makes `webjs db migrate` run that command instead of drizzle-kit, so the spelling every deploy surface uses is stable across ORMs; Drizzle stays the default by omission and the scaffold emits no block). Type it with `WebjsConfig` + the JSON Schema. See `references/built-ins.md`.
 - **Caching + file storage** (`references/built-ins.md`). HTTP `Cache-Control`, the `cache()` query helper + `revalidateTag`, the server HTML response cache (`export const revalidate` + `revalidatePath`, #241), content-hash asset URLs (`?v=`, #243), conditional GET (ETag, #240), and `FileStore` + `diskStore` (streaming, traversal-safe, signed URLs, S3-pluggable, #247).
 - **Observability** (`references/built-ins.md`). Access log, `requestId()` + `X-Request-Id`, the `onError` APM hook, `GET /__webjs/version` (#239).
 
diff --git a/packages/cli/README.md b/packages/cli/README.md
index d02535236..8822d94b0 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -49,7 +49,7 @@ webjs check                    # validate source-code conventions (CI gate)
 webjs doctor                   # verify the project/toolchain setup (per-check severity via webjs.doctor.gate, so CI can gate a subset)
 webjs test                     # run server + browser tests
 webjs vendor pin [--download]  # pin client deps to a committable importmap (offline/reproducible)
-webjs db <generate|migrate|push|studio|seed>   # drizzle-kit passthrough (+ seed)
+webjs db <generate|migrate|push|studio|seed>   # drizzle-kit passthrough (+ seed) by default; a package.json webjs.db block maps any verb to your own ORM's command
 
 webjs ui init                  # initialise @webjsdev/ui in this project
 webjs ui add <names...>        # copy components from the registry (https://webjs.dev/ui/registry/<name>.json)
diff --git a/packages/cli/bin/webjs.js b/packages/cli/bin/webjs.js
index 3e50c168e..f0b23e97f 100755
--- a/packages/cli/bin/webjs.js
+++ b/packages/cli/bin/webjs.js
@@ -112,6 +112,9 @@ const USAGE = `webjs commands:
   webjs db push                                   Push the schema straight to the dev DB (drizzle-kit push)
   webjs db studio                                 Open the database browser (drizzle-kit studio)
   webjs db seed                                   Run the app's db/seed.server.ts
+  webjs db <verb>                                 Any verb "webjs": { "db": { "<verb>": "<command>" } } maps in
+                                                  package.json runs that command instead (bring your own ORM);
+                                                  an unmapped verb keeps the drizzle-kit default above
   webjs ui <subcmd>                               AI-first component library CLI
                                                   (init / add / list / view / diff / info)
                                                   Requires @webjsdev/ui installed in the project
@@ -250,8 +253,15 @@ const HELP = {
     ],
   },
   db: {
-    usage: 'webjs db <generate|migrate|push|studio|seed>',
-    summary: 'Database tasks (wraps drizzle-kit); seed runs db/seed.server.ts.',
+    usage: 'webjs db <generate|migrate|push|studio|seed|verb> [args...]',
+    summary: 'Database tasks (wraps drizzle-kit by default); seed runs db/seed.server.ts.',
+    notes: [
+      'A "webjs": { "db": { "<verb>": "<command>" } } block in package.json maps a verb to',
+      'a shell command (run with node_modules/.bin on PATH, extra args appended), so',
+      'another ORM keeps the same spelling: { "migrate": "prisma migrate deploy" }.',
+      'Any key is a verb ("reset" adds `webjs db reset`); an unmapped one keeps its',
+      'drizzle-kit / seed default, so an app with no block is unchanged.',
+    ],
     examples: ['webjs db generate', 'webjs db migrate', 'webjs db studio', 'webjs db seed'],
   },
   ui: {
@@ -516,6 +526,31 @@ async function main() {
     case 'db': {
       const sub = rest[0];
       const args = rest.slice(1);
+      // A verb the app's `webjs.db` block maps (#1468) runs that command
+      // through the shell, the way a `before` step does (node_modules/.bin on
+      // PATH, so a bare `prisma migrate deploy` resolves), with the extra args
+      // appended. This is what makes Drizzle a default rather than lock-in:
+      // `webjs db migrate` stays the one spelling the scaffolded start.before,
+      // the Dockerfile, and the deploy docs use, whatever ORM is behind it.
+      // Checked FIRST so a mapped `seed` overrides the seed-file runner too.
+      if (!sub) {
+        console.error('webjs db: missing subcommand.\n' + USAGE);
+        process.exit(1);
+      }
+      const { readDbCommands } = await import('../lib/app-tasks.js');
+      const dbCommands = readDbCommands(process.cwd());
+      // Own-property lookup: the map is a plain object, so a bare index would
+      // answer `webjs db constructor` with an inherited function.
+      const mapped = Object.hasOwn(dbCommands, sub) ? dbCommands[sub] : undefined;
+      if (mapped) {
+        const { runBeforeSteps, shellQuote } = await import('../lib/run-tasks.js');
+        // Each arg is quoted so it reaches the ORM as one word, unexpanded,
+        // the way the drizzle-kit default's real argv already does.
+        const full = [mapped, ...args.map(shellQuote)].join(' ');
+        console.log(`webjs db ${sub}: running \`${full}\` (from package.json webjs.db)`);
+        const r = await runBeforeSteps([full], process.cwd());
+        process.exit(r.ok ? 0 : r.code);
+      }
       // `webjs db seed` runs the app's own seed script directly (not a
       // drizzle-kit command); Drizzle has no codegen, so there is no
       // `generate`-the-client step, only schema-to-SQL `generate`.
@@ -535,8 +570,14 @@ async function main() {
       // schema sync), studio. All wrap drizzle-kit; the verbose name stays
       // hidden behind `webjs db`.
       const map = { generate: ['generate'], migrate: ['migrate'], push: ['push'], studio: ['studio'] };
-      const kitArgs = map[sub];
-      if (!kitArgs) { console.error('Unknown db subcommand.\n' + USAGE); process.exit(1); }
+      const kitArgs = Object.hasOwn(map, sub) ? map[sub] : undefined;
+      if (!kitArgs) {
+        console.error(
+          `Unknown db subcommand "${sub}". Map it in package.json to add it: ` +
+          `"webjs": { "db": { "${sub}": "<command>" } }\n` + USAGE,
+        );
+        process.exit(1);
+      }
       // Resolve the app's own drizzle-kit bin and spawn it with the CURRENT
       // runtime (process.execPath). This drops the hard `npx` dependency (#570):
       // `npx` is absent in a pure oven/bun image, which broke `webjs db migrate`
@@ -548,7 +589,9 @@ async function main() {
       } catch {
         console.error(
           'webjs db: drizzle-kit is not installed in this project.\n' +
-          'Install it with `npm install -D drizzle-kit`, then re-run `webjs db ' + sub + '`.',
+          'Install it with `npm install -D drizzle-kit`, then re-run `webjs db ' + sub + '`.\n' +
+          'Using another ORM? Map the verb in package.json and the same command runs it:\n' +
+          '  "webjs": { "db": { "' + sub + '": "<your ORM\'s ' + sub + ' command>" } }',
         );
         process.exit(1);
       }
diff --git a/packages/cli/lib/app-tasks.js b/packages/cli/lib/app-tasks.js
index 1e09a1bd4..f0f0d19a5 100644
--- a/packages/cli/lib/app-tasks.js
+++ b/packages/cli/lib/app-tasks.js
@@ -38,16 +38,9 @@ import { join } from 'node:path';
  * @returns {{ dev: { before: string[], parallel: string[] }, start: { before: string[] } }}
  */
 export function readAppTasks(appDir, readFile) {
-  const read = readFile || ((p) => readFileSync(p, 'utf8'));
-  let pkg = {};
-  try {
-    pkg = JSON.parse(read(join(appDir, 'package.json')));
-  } catch {
-    // No package.json, or unparseable: a plain run with no orchestration.
-    return emptyTasks();
-  }
-  const webjs = pkg && typeof pkg === 'object' ? pkg.webjs : null;
-  if (!webjs || typeof webjs !== 'object') return emptyTasks();
+  const webjs = readWebjsBlock(appDir, readFile);
+  // No package.json, unparseable, or no block: a plain run with no orchestration.
+  if (!webjs) return emptyTasks();
 
   /** Keep only non-empty string entries; drop anything else defensively. */
   const cmds = (v) =>
@@ -62,7 +55,74 @@ export function readAppTasks(appDir, readFile) {
   };
 }
 
+/**
+ * The app's `package.json` `"webjs"` block, or `null` when there is no
+ * package.json, it does not parse, or the block is absent / not an object.
+ * Shared by every CLI-side reader here so the file is read one way.
+ *
+ * @param {string} appDir
+ * @param {(p: string) => string} [readFile] injectable reader for tests
+ * @returns {Record<string, unknown> | null}
+ */
+function readWebjsBlock(appDir, readFile) {
+  const read = readFile || ((p) => readFileSync(p, 'utf8'));
+  let pkg;
+  try {
+    pkg = JSON.parse(read(join(appDir, 'package.json')));
+  } catch {
+    return null;
+  }
+  const webjs = pkg && typeof pkg === 'object' ? pkg.webjs : null;
+  return webjs && typeof webjs === 'object' ? webjs : null;
+}
+
 /** @returns {{ dev: { before: string[], parallel: string[] }, start: { before: string[] } }} */
 function emptyTasks() {
   return { dev: { before: [], parallel: [] }, start: { before: [] } };
 }
+
+/**
+ * Read the `webjs db` verb map from an app's `package.json` `"webjs"` block
+ * (#1468). Drizzle is the scaffold DEFAULT, never lock-in: the runtime never
+ * imports it and `db/connection.server.ts` is the app's own file. But without
+ * this map the `webjs db` verbs contradicted that, since `generate` / `migrate`
+ * / `push` / `studio` resolved the app's drizzle-kit binary and exited 1 with
+ * any other ORM installed, while `webjs db migrate` is the spelling baked into
+ * the scaffolded `dev.before` / `start.before` tasks, the Dockerfile, and the
+ * deployment docs. Mapping a verb here keeps that spelling stable across ORMs,
+ * so an ORM swap is one config block plus the app's own `db/` files.
+ *
+ * Shape:
+ *   "webjs": {
+ *     "db": {
+ *       "migrate": "prisma migrate deploy",
+ *       "studio":  "prisma studio",
+ *       "reset":   "prisma migrate reset --force"
+ *     }
+ *   }
+ *
+ * Any key is a verb: a mapped verb runs its command through the shell (the
+ * same way a `before` step does, so a local-only binary resolves), with the
+ * extra CLI args appended. A verb the map does not name keeps its default (the
+ * drizzle-kit passthrough for the four kit verbs, `db/seed.server.ts` for
+ * `seed`), so an app with no block is unchanged. Non-string / blank values are
+ * dropped defensively, the same posture as `readAppTasks`.
+ *
+ * Pure (reads one file, never spawns / prints / exits) so it is unit-testable
+ * without a process.
+ *
+ * @param {string} appDir
+ * @param {(p: string) => string} [readFile] injectable reader for tests
+ * @returns {Record<string, string>} verb -> shell command (empty when unset)
+ */
+export function readDbCommands(appDir, readFile) {
+  const webjs = readWebjsBlock(appDir, readFile);
+  const db = webjs ? webjs.db : null;
+  if (!db || typeof db !== 'object' || Array.isArray(db)) return {};
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const [verb, cmd] of Object.entries(db)) {
+    if (typeof cmd === 'string' && cmd.trim().length > 0 && verb.trim().length > 0) out[verb] = cmd;
+  }
+  return out;
+}
diff --git a/packages/cli/lib/create.js b/packages/cli/lib/create.js
index 532635a6b..d8a35c7a4 100644
--- a/packages/cli/lib/create.js
+++ b/packages/cli/lib/create.js
@@ -551,6 +551,12 @@ export async function scaffoldApp(name, cwd, opts = {}) {
         }),
       },
       start: { before: isApi ? ['webjs db migrate'] : ['webjs db migrate', cssBuildCmd] },
+      // No `db` block on purpose (#1468). `webjs db` defaults to drizzle-kit,
+      // and Drizzle is the scaffold default by OMISSION: an app that swaps the
+      // ORM adds `"db": { "migrate": "prisma migrate deploy", ... }` here and
+      // the `webjs db migrate` spelling in `before` (and the Dockerfile, and
+      // CI) keeps working. Emitting the Drizzle mapping would only duplicate
+      // the default into every app.
       // Which doctor findings are FATAL is the app's own call (#1257), declared
       // here rather than in the CI workflow so `npm run doctor` locally and the
       // workflow step agree about what fails. UNMARKED_ASSET_LINKS starts at
diff --git a/packages/cli/lib/run-tasks.js b/packages/cli/lib/run-tasks.js
index 83c711036..a6ffdbb5e 100644
--- a/packages/cli/lib/run-tasks.js
+++ b/packages/cli/lib/run-tasks.js
@@ -44,7 +44,10 @@ export async function runBeforeSteps(steps, cwd, opts = {}) {
     if (opts.onStep) opts.onStep(step);
     const code = await new Promise((res) => {
       const c = spawn(step, { shell: true, stdio: 'inherit', cwd, env });
-      c.on('exit', (code) => res(code ?? 0));
+      // A child killed by a signal exits with `code` null and `signal` set.
+      // That is a failure (an OOM-killed `db migrate` must not boot the
+      // server over a half-applied schema), so it maps to 1, never 0.
+      c.on('exit', (code, signal) => res(code ?? (signal ? 1 : 0)));
       c.on('error', () => res(1));
     });
     if (code !== 0) return { ok: false, step, code };
@@ -52,6 +55,23 @@ export async function runBeforeSteps(steps, cwd, opts = {}) {
   return { ok: true };
 }
 
+/**
+ * Quote one argv entry for a POSIX shell so it survives `shell: true` as ONE
+ * word with no expansion. A plain word passes through untouched; anything
+ * else is single-quoted, with an embedded single quote spliced as `'\''`.
+ * Used by `webjs db <verb> [args]` (#1468) to append the CLI's args to a
+ * mapped command string, so `--name "add users"` reaches the ORM as one arg
+ * and a `$` / `;` / glob is never expanded, matching what the drizzle-kit
+ * default (a real argv, no shell) already guarantees.
+ *
+ * @param {string} arg
+ * @returns {string}
+ */
+export function shellQuote(arg) {
+  if (/^[A-Za-z0-9_\-.\/=:@,+%]+$/.test(arg)) return arg;
+  return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+
 /**
  * Spawn the configured dev `parallel` tasks (#550) as long-lived children and
  * return a killer that tears them ALL down (idempotent), so a watcher cannot
diff --git a/packages/cli/test/app-tasks/app-tasks.test.mjs b/packages/cli/test/app-tasks/app-tasks.test.mjs
index 5cfe3379e..ceb8e51d9 100644
--- a/packages/cli/test/app-tasks/app-tasks.test.mjs
+++ b/packages/cli/test/app-tasks/app-tasks.test.mjs
@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { readAppTasks } from '../../lib/app-tasks.js';
+import { readAppTasks, readDbCommands } from '../../lib/app-tasks.js';
 
 /** Build an injectable reader that returns the given package.json text. */
 function reader(pkgJson) {
@@ -48,3 +48,31 @@ test('counterfactual: a non-array before/parallel is ignored, not spread', () =>
   assert.deepEqual(tasks.dev.before, []);
   assert.deepEqual(tasks.dev.parallel, []);
 });
+
+// `webjs.db` (#1468): the bring-your-own-ORM verb map behind `webjs db`.
+
+test('readDbCommands reads the verb map, any key is a verb', () => {
+  const pkg = JSON.stringify({
+    webjs: { db: { migrate: 'prisma migrate deploy', reset: 'prisma migrate reset --force' } },
+  });
+  assert.deepEqual(readDbCommands('/app', reader(pkg)), {
+    migrate: 'prisma migrate deploy',
+    reset: 'prisma migrate reset --force',
+  });
+});
+
+test('readDbCommands yields an empty map with no block, no package.json, or bad JSON', () => {
+  assert.deepEqual(readDbCommands('/app', reader(JSON.stringify({ name: 'x' }))), {});
+  assert.deepEqual(readDbCommands('/app', reader(JSON.stringify({ webjs: { start: {} } }))), {});
+  assert.deepEqual(readDbCommands('/app', reader(null)), {});
+  assert.deepEqual(readDbCommands('/app', reader('not json')), {});
+});
+
+test('readDbCommands drops non-string / blank values and a non-object block', () => {
+  const pkg = JSON.stringify({
+    webjs: { db: { migrate: 'ok', push: '', studio: '   ', seed: 42, generate: null, reset: ['x'] } },
+  });
+  assert.deepEqual(readDbCommands('/app', reader(pkg)), { migrate: 'ok' });
+  assert.deepEqual(readDbCommands('/app', reader(JSON.stringify({ webjs: { db: 'prisma' } }))), {});
+  assert.deepEqual(readDbCommands('/app', reader(JSON.stringify({ webjs: { db: ['x'] } }))), {});
+});
diff --git a/packages/cli/test/run-tasks/run-tasks.test.mjs b/packages/cli/test/run-tasks/run-tasks.test.mjs
index 616078f1f..a8fddbdb0 100644
--- a/packages/cli/test/run-tasks/run-tasks.test.mjs
+++ b/packages/cli/test/run-tasks/run-tasks.test.mjs
@@ -4,7 +4,7 @@ import { EventEmitter } from 'node:events';
 import { mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { runBeforeSteps, startParallelTasks } from '../../lib/run-tasks.js';
+import { shellQuote, runBeforeSteps, startParallelTasks } from '../../lib/run-tasks.js';
 
 /**
  * A fake `spawn` that records the commands it was asked to run and emits a
@@ -106,3 +106,24 @@ test('startParallelTasks actually terminates a real long-running child process',
   // times out (proving the killer failed). No assertion needed beyond not hanging.
   await new Promise((r) => setTimeout(r, 200));
 });
+
+test('runBeforeSteps treats a signal-killed child as a failure, never exit 0', async () => {
+  // `exit` fires with code null + a signal for a killed child. A `db migrate`
+  // OOM-killed mid-way must abort the boot, not serve a half-applied schema.
+  const spawn = () => {
+    const c = new EventEmitter();
+    setImmediate(() => c.emit('exit', null, 'SIGKILL'));
+    return c;
+  };
+  const r = await runBeforeSteps(['x'], '/app', { spawn });
+  assert.deepEqual(r, { ok: false, step: 'x', code: 1 });
+});
+
+test('shellQuote passes a plain word through and single-quotes everything else', () => {
+  assert.equal(shellQuote('--name'), '--name');
+  assert.equal(shellQuote('db/migrations'), 'db/migrations');
+  assert.equal(shellQuote('add users'), "'add users'");
+  assert.equal(shellQuote('$HOME;rm'), "'$HOME;rm'");
+  assert.equal(shellQuote("it's"), "'it'\\''s'");
+  assert.equal(shellQuote(''), "''");
+});
diff --git a/packages/core/src/webjs-config.d.ts b/packages/core/src/webjs-config.d.ts
index 133e3c49a..89e95fec7 100644
--- a/packages/core/src/webjs-config.d.ts
+++ b/packages/core/src/webjs-config.d.ts
@@ -227,6 +227,17 @@ export interface WebjsConfig {
   dev?: WebjsDevTasks;
   start?: WebjsStartTasks;
 
+  /**
+   * The `webjs db` verb map (#1468), bring-your-own-ORM. Each key is a verb
+   * and its value the shell command `webjs db <verb>` runs instead of the
+   * drizzle-kit default (node_modules/.bin on PATH, extra args appended), so
+   * `webjs db migrate` keeps one spelling across ORMs:
+   * `{ migrate: 'prisma migrate deploy' }`. Any key is a verb; an unmapped one
+   * keeps its default, so an app with no block is unchanged. Read by the CLI
+   * (`packages/cli/lib/app-tasks.js`), NOT the server.
+   */
+  db?: Record<string, string>;
+
   /**
    * `webjs doctor` policy (#1257): which project-health checks the project
    * treats as fatal. Read by the CLI (`packages/cli/lib/doctor.js`), NOT the
diff --git a/packages/server/src/webjs-config-validate.js b/packages/server/src/webjs-config-validate.js
index ab4ed8f20..2fc798261 100644
--- a/packages/server/src/webjs-config-validate.js
+++ b/packages/server/src/webjs-config-validate.js
@@ -41,9 +41,9 @@ import { fileURLToPath } from 'node:url';
  * `integer` leaf types.
  *
  * So a value is type-checked only when its schema declares `type: "boolean"` or
- * `type: "integer"`, or an `enum`. Today that is 9 of the 17 top-level keys; the
- * other 8 (`headers`, `redirects`, `allowedOrigins`, `basePath`, `csp`, `dev`,
- * `start`, `doctor`) pass whatever they hold, `csp` because its schema is a
+ * `type: "integer"`, or an `enum`. Today that is 9 of the 18 top-level keys; the
+ * other 9 (`headers`, `redirects`, `allowedOrigins`, `basePath`, `csp`, `dev`,
+ * `start`, `db`, `doctor`) pass whatever they hold, `csp` because its schema is a
  * `oneOf` with no `type` at all and the rest because theirs is `array`,
  * `string`, or `object`. That is enough for the case this exists to close, a
  * typo'd top-level key silently dropped, plus the leaf kinds a schema can decide
diff --git a/packages/server/test/config/webjs-config-schema.test.js b/packages/server/test/config/webjs-config-schema.test.js
index eb986ddf7..75f07cf28 100644
--- a/packages/server/test/config/webjs-config-schema.test.js
+++ b/packages/server/test/config/webjs-config-schema.test.js
@@ -67,6 +67,7 @@ const KNOWN_KEYS = [
   // dev.watch is readDevWatchPathsFromApp (dev.js, #894).
   'dev',
   'start', // readAppTasks (cli/lib/app-tasks.js), CLI-read (#550)
+  'db', // readDbCommands (cli/lib/app-tasks.js), CLI-read (#1468)
   'doctor', // readDoctorPolicy (cli/lib/doctor.js), CLI-read (#1257)
 ];
 
@@ -158,6 +159,11 @@ test('key shapes match the reader contracts', () => {
 
   // csp is boolean | object (readCspConfig accepts true / object).
   assert.ok(Array.isArray(p.csp.oneOf), 'csp is a oneOf(boolean, object)');
+
+  // db is a free-form verb -> shell-command map (readDbCommands, #1468): any
+  // key is a verb, so it must NOT be sealed, and every value is a string.
+  assert.equal(p.db.type, 'object');
+  assert.deepEqual(p.db.additionalProperties, { type: 'string' }, 'db values are shell commands');
 });
 
 // The schema and the exported WebjsConfig type are two artifacts that must
diff --git a/packages/server/webjs-config.schema.json b/packages/server/webjs-config.schema.json
index 25bce1d49..ed3a3cd29 100644
--- a/packages/server/webjs-config.schema.json
+++ b/packages/server/webjs-config.schema.json
@@ -217,6 +217,11 @@
         }
       }
     },
+    "db": {
+      "description": "The `webjs db` verb map (#1468), bring-your-own-ORM. Read by the CLI (readDbCommands in packages/cli/lib/app-tasks.js), NOT the server. Each key is a verb and its value the shell command `webjs db <verb>` runs instead of the drizzle-kit default (run with node_modules/.bin on PATH, extra CLI args appended), so `webjs db migrate` keeps one spelling across ORMs: { \"migrate\": \"prisma migrate deploy\" }. Any key is a verb (a new one adds a subcommand); an unmapped verb keeps its default (drizzle-kit for generate / migrate / push / studio, db/seed.server.ts for seed), so an app with no block is unchanged.",
+      "type": "object",
+      "additionalProperties": { "type": "string" }
+    },
     "doctor": {
       "description": "`webjs doctor` policy (#1257). Read by the CLI (readDoctorPolicy in packages/cli/lib/doctor.js), NOT the server.",
       "type": "object",
diff --git a/test/cli/db.test.mjs b/test/cli/db.test.mjs
new file mode 100644
index 000000000..267870030
--- /dev/null
+++ b/test/cli/db.test.mjs
@@ -0,0 +1,141 @@
+/**
+ * Tests for the `webjs db` verb map (#1468), the bring-your-own-ORM seam.
+ *
+ * A `"webjs": { "db": { "<verb>": "<command>" } }` block in package.json makes
+ * `webjs db <verb>` run that command through the shell instead of the
+ * drizzle-kit default, with extra args appended, so `webjs db migrate` is one
+ * spelling across ORMs. With no block every verb keeps its default. Each test
+ * scaffolds a throwaway app dir with a package.json and a marker-writing
+ * command, then spawns the real CLI against it.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO = resolve(__dirname, '..', '..');
+const CLI = resolve(REPO, 'packages', 'cli', 'bin', 'webjs.js');
+
+/**
+ * Make an app dir whose package.json carries the given `webjs` block. The
+ * marker command is a `node -e` one-liner (portable across shells) that
+ * writes its argv to `marker.txt`, proving both that the mapped command ran
+ * and what args reached it.
+ */
+function app(webjs) {
+  const dir = mkdtempSync(join(tmpdir(), 'webjs-db-'));
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'db-test', type: 'module', webjs }, null, 2));
+  return dir;
+}
+
+/** The shell command that records its args in marker.txt (cwd-relative). */
+const MARK = `node -e "require('fs').writeFileSync('marker.txt', process.argv.slice(1).join(' '))" --`;
+
+function db(dir, ...args) {
+  return spawnSync(process.execPath, [CLI, 'db', ...args], { cwd: dir, encoding: 'utf8' });
+}
+
+test('a mapped verb runs its command with the extra args appended', () => {
+  const dir = app({ db: { migrate: MARK } });
+  try {
+    const r = db(dir, 'migrate', '--foo', 'bar');
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(existsSync(join(dir, 'marker.txt')), 'the mapped command ran');
+    assert.equal(readFileSync(join(dir, 'marker.txt'), 'utf8'), '--foo bar', 'args passed through');
+    assert.match(r.stdout, /webjs db migrate: running/, 'names what it ran');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('any key is a verb: a verb only the map declares runs too', () => {
+  const dir = app({ db: { reset: MARK } });
+  try {
+    const r = db(dir, 'reset');
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(existsSync(join(dir, 'marker.txt')), 'the map-only verb ran');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a mapped seed overrides the db/seed.server.ts runner', () => {
+  const dir = app({ db: { seed: MARK } });
+  try {
+    // No db/seed.server.ts exists here, so the default runner would exit 1.
+    const r = db(dir, 'seed');
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(existsSync(join(dir, 'marker.txt')), 'the mapped seed ran');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a mapped command\'s exit code is the CLI\'s exit code', () => {
+  const dir = app({ db: { migrate: 'node -e "process.exit(3)"' } });
+  try {
+    assert.equal(db(dir, 'migrate').status, 3, 'the failure propagates');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('with no block, a kit verb keeps its drizzle-kit default and names webjs.db as the BYO path', () => {
+  // A bare app has no drizzle-kit, so the default path fails with the
+  // install hint, which now also tells a non-Drizzle app how to map the verb.
+  // Under Bun the resolver can fall through to a GLOBAL drizzle-kit, in which
+  // case the kit itself runs and fails on the missing drizzle.config; either
+  // way the passthrough (not a mapped command) is what ran.
+  const dir = app({});
+  try {
+    const r = db(dir, 'migrate');
+    assert.equal(r.status, 1);
+    assert.doesNotMatch(r.stdout, /webjs db migrate: running/, 'no mapped command');
+    assert.ok(!existsSync(join(dir, 'marker.txt')));
+    const out = r.stderr + r.stdout;
+    if (/drizzle-kit is not installed/.test(out)) {
+      assert.match(out, /"webjs": \{ "db": \{ "migrate":/, 'the BYO mapping is suggested');
+    } else {
+      assert.match(out, /drizzle\.config/, 'a globally resolved drizzle-kit ran instead');
+    }
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('an unmapped unknown verb still exits 1 and says how to add it', () => {
+  const dir = app({ db: { migrate: MARK } });
+  try {
+    const r = db(dir, 'reset');
+    assert.equal(r.status, 1);
+    assert.match(r.stderr, /Unknown db subcommand "reset"/);
+    assert.match(r.stderr, /"webjs": \{ "db": \{ "reset": "<command>" \} \}/, 'names the map');
+    assert.ok(!existsSync(join(dir, 'marker.txt')), 'nothing ran');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('extra args reach the mapped command as whole, unexpanded words', () => {
+  const dir = app({ db: { generate: MARK } });
+  try {
+    const r = db(dir, 'generate', '--name', 'add users', '$HOME;echo', 'a*b');
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(readFileSync(join(dir, 'marker.txt'), 'utf8'), '--name add users $HOME;echo a*b');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('an inherited property name is not a mapped verb', () => {
+  // `webjs db constructor` must not run Object's constructor source through sh.
+  const dir = app({ db: { migrate: MARK } });
+  try {
+    for (const verb of ['constructor', 'toString', '__proto__']) {
+      const r = db(dir, verb);
+      assert.equal(r.status, 1, `${verb}: ${r.stdout}`);
+      assert.match(r.stderr, /Unknown db subcommand/, verb);
+    }
+    assert.ok(!existsSync(join(dir, 'marker.txt')), 'nothing ran');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a bare `webjs db` reports the missing subcommand, not "undefined"', () => {
+  const dir = app({ db: { migrate: MARK } });
+  try {
+    const r = db(dir);
+    assert.equal(r.status, 1);
+    assert.match(r.stderr, /missing subcommand/);
+    assert.doesNotMatch(r.stderr, /undefined/);
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
diff --git a/test/cli/help.test.mjs b/test/cli/help.test.mjs
index 6ec79fd10..bc44e8e1e 100644
--- a/test/cli/help.test.mjs
+++ b/test/cli/help.test.mjs
@@ -177,3 +177,14 @@ test('every HELP entry has a usage line and at least one example', async () => {
     assert.match(after, /\n {2}\S/, `${cmd} lists at least one example`);
   }
 });
+
+test('`webjs help db` documents the webjs.db verb map (#1468)', () => {
+  // Bring-your-own-ORM: the help must tell an agent that a verb can be mapped
+  // to another ORM's command in package.json, since the default wording only
+  // names drizzle-kit.
+  const r = help('db');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /"webjs": \{ "db": \{ "<verb>": "<command>" \} \}/, 'names the config block');
+  assert.match(r.stdout, /prisma migrate deploy/, 'shows a non-Drizzle mapping');
+  assert.match(r.stdout, /unmapped one keeps its/, 'says the default is unchanged');
+});
diff --git a/website/app/docs/configuration/page.ts b/website/app/docs/configuration/page.ts
index 6e0e2268a..632594315 100644
--- a/website/app/docs/configuration/page.ts
+++ b/website/app/docs/configuration/page.ts
@@ -34,7 +34,9 @@ export default function Configuration() {
 webjs db migrate      # drizzle-kit migrate
 webjs db push         # drizzle-kit push
 webjs db studio       # drizzle-kit studio
-webjs db seed         # run db/seed.server.ts</code-block>
+webjs db seed         # run db/seed.server.ts
+webjs db &lt;verb&gt;       # any verb the webjs.db block maps (bring your own ORM)</code-block>
+    <p>The four kit verbs default to drizzle-kit, and a <code>webjs.db</code> block in <code>package.json</code> remaps any verb (or adds one) to your own ORM's shell command, so <code>webjs db migrate</code> keeps one spelling across ORMs. See <a href="/docs/database#bring-your-own-orm">Bring your own ORM</a>.</p>
 
     <h3>webjs routes</h3>
     <code-block>webjs routes                    # a grouped tree of pages + route handlers
@@ -162,7 +164,7 @@ webjs routes --help     # one command's help (flag form)</code-block>
     <h2>Config typos are reported at boot</h2>
     <p>Every key in the <code>webjs</code> block is optional, which means an unknown one has no way to announce itself: write <code>"redirect"</code> for <code>"redirects"</code> and the key is simply never read, the feature sits at its default, and the app looks configured. So WebJs validates the block against its published JSON Schema once per boot, in development and in production alike, and prints a single warning naming what it ignored.</p>
     <p>It is a <strong>warning, never a failure</strong>. A typo costs one feature its setting, and refusing to boot over that would cost the whole app, usually mid-deploy.</p>
-    <p><strong>What it catches, and what it does not.</strong> It reports any unknown top-level key, whatever it is called. It also checks the value of 9 of the 17 known keys: one against an allowed set (<code>trailingSlash</code>), and eight against a boolean or whole-number type (<code>elide</code>, <code>seed</code>, <code>clientRouter</code>, <code>maxBodyBytes</code>, <code>maxMultipartBytes</code>, and the three timeouts). It does not descend into nested objects, so a key misspelled inside <code>webjs.dev</code> or <code>webjs.start</code> is missed, and it does not check the type of the other 8 (<code>headers</code>, <code>redirects</code>, <code>basePath</code>, <code>allowedOrigins</code>, <code>csp</code>, <code>dev</code>, <code>start</code>, <code>doctor</code>), whose schemas are the free-form ones a blunt check would start rejecting working configs over. Give one of those the wrong type outright, as in <code>"headers": "x"</code>, and it passes this check. Whether anything downstream then says so is up to that key's own reader, and the two array-valued ones do: <code>webjs.headers</code> and <code>webjs.redirects</code> each warn when the key is present but not an array, and again for every individual rule or entry they drop, naming what was ignored. An absent key is the default and says nothing.</p>
+    <p><strong>What it catches, and what it does not.</strong> It reports any unknown top-level key, whatever it is called. It also checks the value of 9 of the 18 known keys: one against an allowed set (<code>trailingSlash</code>), and eight against a boolean or whole-number type (<code>elide</code>, <code>seed</code>, <code>clientRouter</code>, <code>maxBodyBytes</code>, <code>maxMultipartBytes</code>, and the three timeouts). It does not descend into nested objects, so a key misspelled inside <code>webjs.dev</code> or <code>webjs.start</code> is missed, and it does not check the type of the other 9 (<code>headers</code>, <code>redirects</code>, <code>basePath</code>, <code>allowedOrigins</code>, <code>csp</code>, <code>dev</code>, <code>start</code>, <code>db</code>, <code>doctor</code>), whose schemas are the free-form ones a blunt check would start rejecting working configs over. Give one of those the wrong type outright, as in <code>"headers": "x"</code>, and it passes this check. Whether anything downstream then says so is up to that key's own reader, and the two array-valued ones do: <code>webjs.headers</code> and <code>webjs.redirects</code> each warn when the key is present but not an array, and again for every individual rule or entry they drop, naming what was ignored. An absent key is the default and says nothing.</p>
     <p>Editors catch more of this earlier still: a scaffolded app wires the schema into <code>.vscode/settings.json</code>, and the <code>WebjsConfig</code> type from <code>@webjsdev/core</code> types the block while you author it. And <code>webjs.doctor</code> is checked by a different tool entirely: the server never reads it, and <code>webjs doctor</code> exits non-zero on a malformed one, because a silently ignored gate would leave CI un-gated while looking gated.</p>
 
     <h2>Environment Variables</h2>
diff --git a/website/app/docs/database/page.ts b/website/app/docs/database/page.ts
index c493f0961..afcf8451e 100644
--- a/website/app/docs/database/page.ts
+++ b/website/app/docs/database/page.ts
@@ -127,6 +127,20 @@ export default async function Home() {
 webjs db migrate     # apply pending migrations (drizzle-kit migrate)
 webjs db push        # push the schema straight to the dev DB (drizzle-kit push)
 webjs db studio      # visual DB browser (drizzle-kit studio)
-webjs db seed        # run db/seed.server.ts</code-block>
+webjs db seed        # run db/seed.server.ts
+webjs db &lt;verb&gt;      # any verb webjs.db maps in package.json (see below)</code-block>
+
+    <h2 id="bring-your-own-orm">Bring your own ORM</h2>
+    <p>Drizzle is the <em>default</em>, not lock-in. The runtime never imports it, <code>db/connection.server.ts</code> is your own file, and the <code>webjs db</code> verbs are adapter-driven. A <code>db</code> block in the <code>package.json</code> <code>webjs</code> config maps each verb to the shell command <code>webjs db &lt;verb&gt;</code> runs instead of the drizzle-kit default, with <code>node_modules/.bin</code> on the PATH and any extra arguments appended, so a Prisma app looks like this.</p>
+    <code-block>"webjs": &#123;
+  "db": &#123;
+    "generate": "prisma migrate dev --create-only",
+    "migrate":  "prisma migrate deploy",
+    "push":     "prisma db push",
+    "studio":   "prisma studio",
+    "reset":    "prisma migrate reset --force"
+  &#125;
+&#125;</code-block>
+    <p>Any key is a verb, so <code>reset</code> above adds a <code>webjs db reset</code> command. A verb the block does not name keeps its default (drizzle-kit for the four kit verbs, <code>db/seed.server.ts</code> for <code>seed</code>), so an app with no block behaves exactly as before and the scaffold emits none. The point is that <code>webjs db migrate</code> stays one spelling whatever sits behind it, so the scaffolded <code>dev.before</code> and <code>start.before</code> steps, the Dockerfile, CI, and the deployment guide all keep working after a swap. Write the bare binary (<code>prisma migrate deploy</code>) rather than <code>npx prisma ...</code>, since a pure Bun image ships no <code>npx</code>. The rest of the swap is your own files: replace <code>db/connection.server.ts</code> with the new client, delete <code>drizzle.config.ts</code> and <code>db/columns.server.ts</code>, and keep the server-only imports behind <code>.server.ts</code> exactly as with Drizzle.</p>
   `;
 }