@carllee1983/dbcli 1.25.0 → 1.29.0

package/dist/core.d.ts

@@ -0,0 +1,2806 @@
+// Generated by dts-bundle-generator v9.5.1
+
+import { z } from 'zod';
+
+/**
+ * Database adapter type definitions and interfaces
+ * Defines the contract that all database adapters must implement
+ */
+export type DatabaseSystem = "postgresql" | "mysql" | "mariadb" | "mongodb" | "redis" | "elasticsearch";
+type SqlDatabaseSystem = Extract<DatabaseSystem, "postgresql" | "mysql" | "mariadb">;
+type QueryableDatabaseSystem = Exclude<DatabaseSystem, SqlDatabaseSystem>;
+/**
+ * Connection configuration for database adapters
+ */
+export interface ConnectionOptions {
+	/** Database system type */
+	system: DatabaseSystem;
+	/** Database host address or hostname */
+	host: string;
+	/** Database port number */
+	port: number;
+	/** Database user name */
+	user: string;
+	/** Database password */
+	password: string;
+	/** Database name */
+	database: string;
+	/** MongoDB connection URI (optional, for MongoDB connections) */
+	uri?: string;
+	/** MongoDB auth database — used when building URI from host/port/user/password (default: 'admin') */
+	authSource?: string;
+	/** Connection timeout in milliseconds (default: 5000) */
+	timeout?: number;
+	/** Elasticsearch protocol (http or https) */
+	protocol?: "http" | "https";
+	/** Elasticsearch nodes for round-robin (optional) */
+	nodes?: string[];
+	/** Elasticsearch Cloud ID (optional) */
+	cloudId?: string;
+	/** Elasticsearch API Key (optional) */
+	apiKey?: string;
+	/** Elasticsearch CA Certificate Path (optional) */
+	caPath?: string;
+	/** Whether to reject unauthorized TLS connections (default: true) */
+	rejectUnauthorized?: boolean;
+}
+export type SqlConnectionOptions = ConnectionOptions & {
+	system: SqlDatabaseSystem;
+};
+export type QueryableConnectionOptions = ConnectionOptions & {
+	system: QueryableDatabaseSystem;
+};
+/**
+ * Schema information for a single column
+ */
+export interface ColumnSchema {
+	/** Column name */
+	name: string;
+	/** Column data type */
+	type: string;
+	/** Whether column allows NULL values */
+	nullable: boolean;
+	/** Default value for column (if any) */
+	default?: string;
+	/** Whether column is primary key */
+	primaryKey?: boolean;
+	/** Foreign key reference if applicable */
+	foreignKey?: {
+		table: string;
+		column: string;
+	};
+	/** Whether column is auto-incremented */
+	autoIncrement?: boolean;
+	/** Column comment/description */
+	comment?: string | null;
+	/** Enum values if column is ENUM type */
+	enumValues?: string[];
+	/** MongoDB only: 0..1 fraction of sampled docs that contained this dot-path. Undefined for SQL. */
+	presence?: number;
+	/** MongoDB only: true when this dot-path matches a blacklist pattern. Undefined for SQL. */
+	redacted?: boolean;
+}
+/**
+ * Complete schema information for a table
+ */
+export interface TableSchema {
+	/** Table name */
+	name: string;
+	/** Array of columns in the table */
+	columns: ColumnSchema[];
+	/** Approximate row count (if available) */
+	rowCount?: number;
+	/** Storage engine (PostgreSQL/MySQL) */
+	engine?: string;
+	/** Primary key column names */
+	primaryKey?: string[];
+	/** Foreign key constraints with metadata */
+	foreignKeys?: Array<{
+		name: string;
+		columns: string[];
+		refTable: string;
+		refColumns: string[];
+	}>;
+	/** Table indexes with column information */
+	indexes?: Array<{
+		name: string;
+		columns: string[];
+		unique: boolean;
+	}>;
+	/** Column count (used by listTables when full column details are not loaded) */
+	columnCount?: number;
+	/** Estimated row count in table */
+	estimatedRowCount?: number;
+	/** Type of table (table or view) */
+	tableType?: "table" | "view";
+}
+/**
+ * Connection error with categorized error code and troubleshooting hints
+ */
+export declare class ConnectionError extends Error {
+	/** Error category code */
+	code: "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "ENOTFOUND" | "SQL_SYNTAX_ERROR" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "UNKNOWN";
+	/** Array of actionable troubleshooting hints */
+	hints: string[];
+	constructor(
+	/** Error category code */
+	code: "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "ENOTFOUND" | "SQL_SYNTAX_ERROR" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "UNKNOWN", 
+	/** User-friendly error message */
+	message: string, 
+	/** Array of actionable troubleshooting hints */
+	hints: string[]);
+}
+/**
+ * Result of a database query or command execution
+ */
+export interface ExecutionResult<T> {
+	/** Array of result rows as objects (for SELECT queries) */
+	rows: T[];
+	/** Number of rows affected by the operation (for INSERT/UPDATE/DELETE) */
+	affectedRows: number;
+	/** Last inserted ID if applicable (for INSERT operations) */
+	lastInsertId?: number | string;
+	/** Convenience row count — used by formatters; mirrors rows.length on read paths */
+	rowCount?: number;
+	/** Column ordering for the rows, used by formatters that render tabular output */
+	columnNames?: string[];
+	/** Optional warnings — emitted today only by RedisAdapter (size guard / blacklist filter). */
+	warnings?: RedisWarning[];
+}
+type RedisWarning = {
+	code: "REDIS_SIZE_REWRITE";
+	command: string;
+	original: string[];
+	rewritten: string[];
+} | {
+	code: "REDIS_SIZE_TRUNCATE";
+	command: string;
+	kept: number;
+	droppedAtLeast: number;
+} | {
+	code: "REDIS_BLACKLIST_FILTERED";
+	count: number;
+};
+/**
+ * Database adapter interface - contract for all database implementations
+ * Defines methods that all database adapters must implement
+ */
+export interface DatabaseAdapter {
+	/**
+	 * Establish connection and verify credentials
+	 * Throws ConnectionError with categorized error type on failure
+	 * @throws {ConnectionError} If connection fails (server down, auth failed, timeout, etc.)
+	 */
+	connect(): Promise<void>;
+	/**
+	 * Close connection and release resources
+	 * Should never throw; safe to call multiple times
+	 * Handles cleanup gracefully even if already disconnected
+	 */
+	disconnect(): Promise<void>;
+	/**
+	 * Execute arbitrary SQL query with parameterized values
+	 * Prevents SQL injection by using parameter binding
+	 * @param sql Query string with parameter placeholders ($1, $2, etc. for PostgreSQL or ? for MySQL)
+	 * @param params Array of parameter values in order
+	 * @returns Execution result containing rows and metadata
+	 * @throws {ConnectionError} If query execution fails
+	 */
+	execute<T>(sql: string, params?: (string | number | boolean | null)[], options?: {
+		noLimit?: boolean;
+	}): Promise<ExecutionResult<T>>;
+	/**
+	 * List all tables in the connected database
+	 * Includes metadata such as row count and storage engine
+	 * @returns Array of table schemas with basic information
+	 * @throws {ConnectionError} If query fails
+	 */
+	listTables(): Promise<TableSchema[]>;
+	/**
+	 * Fetch complete schema for a single table
+	 * Includes all columns with types and constraints
+	 * @param tableName Name of table to inspect
+	 * @param options Optional adapter-specific knobs (e.g. mongo `sampleSize`); SQL adapters ignore them.
+	 * @returns Complete table schema including all column details
+	 * @throws {ConnectionError} If query fails
+	 */
+	getTableSchema(tableName: string, options?: {
+		sampleSize?: number;
+		sampleMethod?: "random" | "natural";
+	}): Promise<TableSchema>;
+	/**
+	 * Test connection with lightweight probe query
+	 * Executes SELECT 1 or equivalent to verify connection is alive
+	 * @returns true if connection successful
+	 * @throws {ConnectionError} If connection test fails
+	 */
+	testConnection(): Promise<boolean>;
+	/**
+	 * Get the database server version string
+	 * @returns Raw version string from the server (e.g. "8.0.35", "15.4", "10.11.6-MariaDB")
+	 * @throws {ConnectionError} If not connected or query fails
+	 */
+	getServerVersion(): Promise<string>;
+}
+interface QueryableAdapter {
+	/**
+	 * Establish connection and verify credentials
+	 * Throws ConnectionError with categorized error type on failure
+	 * @throws {ConnectionError} If connection fails (server down, auth failed, timeout, etc.)
+	 */
+	connect(): Promise<void>;
+	/**
+	 * Close connection and release resources
+	 * Should never throw; safe to call multiple times
+	 * Handles cleanup gracefully even if already disconnected
+	 */
+	disconnect(): Promise<void>;
+	/**
+	 * Execute arbitrary query with parameterized values
+	 * Accepts JSON query strings for MongoDB operations
+	 * @param query Query string (JSON format for MongoDB)
+	 * @param params Array of parameter values in order
+	 * @param options Optional execution controls (e.g. result-cardinality limit)
+	 * @returns Execution result containing rows and metadata
+	 * @throws {ConnectionError} If query execution fails
+	 */
+	execute<T>(query: string, params?: unknown[], options?: {
+		limit?: number;
+		noLimit?: boolean;
+	}): Promise<ExecutionResult<T>>;
+	/**
+	 * List all collections in the connected database
+	 * Includes metadata such as document count
+	 * @param options Optional filter for system indices
+	 * @returns Array of collection info with basic information
+	 * @throws {ConnectionError} If query fails
+	 */
+	listCollections(options?: {
+		includeSystem?: boolean;
+	}): Promise<{
+		name: string;
+		documentCount?: number;
+	}[]>;
+	/**
+	 * SQL-compatible collection listing for shared command surfaces.
+	 * @param options Optional filter for system indices
+	 */
+	listTables?(options?: {
+		includeSystem?: boolean;
+	}): Promise<TableSchema[]>;
+	/**
+	 * SQL-compatible schema lookup for shared command surfaces.
+	 * @param tableName Name of collection/table to inspect
+	 * @param options Optional adapter-specific knobs (e.g. mongo `sampleSize`).
+	 */
+	getTableSchema?(tableName: string, options?: {
+		sampleSize?: number;
+		sampleMethod?: "random" | "natural";
+	}): Promise<TableSchema>;
+	/**
+	 * Test connection with lightweight probe query
+	 * Executes a ping or equivalent to verify connection is alive
+	 * @returns true if connection successful
+	 * @throws {ConnectionError} If connection test fails
+	 */
+	testConnection(): Promise<boolean>;
+	/**
+	 * Get the database server version string
+	 * @returns Raw version string from the server
+	 * @throws {ConnectionError} If not connected or query fails
+	 */
+	getServerVersion(): Promise<string>;
+	/**
+	 * Insert a single document/row
+	 * @param collection Collection or table name
+	 * @param data Data object to insert
+	 * @returns Execution result
+	 */
+	insert(collection: string, data: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
+	/**
+	 * Update documents/rows matching filter
+	 * @param collection Collection or table name
+	 * @param filter Filter object
+	 * @param update Update operations (e.g. {$set: ...})
+	 * @returns Execution result
+	 */
+	update(collection: string, filter: Record<string, unknown>, update: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
+	/**
+	 * Delete documents/rows matching filter
+	 * @param collection Collection or table name
+	 * @param filter Filter object
+	 * @returns Execution result
+	 */
+	delete(collection: string, filter: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
+}
+interface BlacklistConfig {
+	/** Table names to block all operations on */
+	tables: string[];
+	/** Column names to omit per table: { tableName: [col1, col2] } */
+	columns: Record<string, string[]>;
+}
+interface RedisMaskRule {
+	/** Redis-native glob (e.g. "user:*"). */
+	keyPattern: string;
+	/** Hash field names to mask. Absent/empty → mask the whole value. */
+	fields?: string[];
+}
+interface BlacklistState {
+	/** Set of lowercase table names for O(1) case-insensitive lookup */
+	tables: Set<string>;
+	/** Map of table name -> Set of blacklisted column names */
+	columns: Map<string, Set<string>>;
+}
+/**
+ * Error thrown when an operation is blocked by blacklist rules
+ */
+export declare class BlacklistError extends Error {
+	readonly tableName: string;
+	readonly operation: string;
+	constructor(message: string, tableName: string, operation: string);
+}
+/**
+ * Factory for creating database adapters
+ * Implements factory pattern to route to correct adapter based on system type
+ * Enables system-aware instantiation without coupling CLI commands to specific drivers
+ */
+export declare class AdapterFactory {
+	static createSqlAdapter(options: SqlConnectionOptions): DatabaseAdapter;
+	static createQueryableAdapter(options: QueryableConnectionOptions): QueryableAdapter;
+	static createAdapter(options: SqlConnectionOptions): DatabaseAdapter;
+	static createAdapter(options: QueryableConnectionOptions): QueryableAdapter;
+	static createAdapter(options: ConnectionOptions): DatabaseAdapter | QueryableAdapter;
+	static createMongoDBAdapter(options: ConnectionOptions): QueryableAdapter;
+	static createRedisAdapter(options: ConnectionOptions, blacklistRules?: string[], maskRules?: RedisMaskRule[]): QueryableAdapter;
+	static createElasticsearchAdapter(options: ConnectionOptions): QueryableAdapter;
+}
+interface SqlConnectionConfig {
+	system: "postgresql" | "mysql" | "mariadb";
+	host: string | {
+		$env: string;
+	};
+	port: number | {
+		$env: string;
+	};
+	user: string | {
+		$env: string;
+	};
+	password: string | {
+		$env: string;
+	};
+	database: string | {
+		$env: string;
+	};
+}
+interface MongoDBConnectionConfig {
+	system: "mongodb";
+	uri?: string | {
+		$env: string;
+	};
+	host: string | {
+		$env: string;
+	};
+	port: number | {
+		$env: string;
+	};
+	user: string | {
+		$env: string;
+	};
+	password: string | {
+		$env: string;
+	};
+	database: string | {
+		$env: string;
+	};
+}
+interface RedisConnectionConfig {
+	system: "redis";
+	host: string | {
+		$env: string;
+	};
+	port: number | {
+		$env: string;
+	};
+	user: string | {
+		$env: string;
+	};
+	password: string | {
+		$env: string;
+	};
+	/** Redis logical DB index, kept as string for env-binding parity */
+	database: string | {
+		$env: string;
+	};
+}
+interface ElasticsearchConnectionConfig {
+	system: "elasticsearch";
+	protocol?: "http" | "https";
+	host: string | {
+		$env: string;
+	};
+	port: number | {
+		$env: string;
+	};
+	user: string | {
+		$env: string;
+	};
+	password: string | {
+		$env: string;
+	};
+	database: string | {
+		$env: string;
+	};
+	nodes?: string[];
+	cloudId?: string | {
+		$env: string;
+	};
+	apiKey?: string | {
+		$env: string;
+	};
+	caPath?: string;
+	rejectUnauthorized?: boolean;
+}
+type ConnectionConfig = SqlConnectionConfig | MongoDBConnectionConfig | RedisConnectionConfig | ElasticsearchConnectionConfig;
+/**
+ * Permission level (coarse-grained access control)
+ */
+export type Permission = "query-only" | "read-write" | "data-admin" | "admin";
+interface Metadata {
+	createdAt?: string;
+	version: string;
+}
+interface DbcliConfig {
+	connection: ConnectionConfig;
+	permission: Permission;
+	schema?: Record<string, unknown>;
+	metadata?: Metadata;
+	blacklist?: BlacklistConfig;
+}
+type SqlStatementType = "SELECT" | "INSERT" | "UPDATE" | "DELETE" | "UNKNOWN";
+interface QueryMetadata {
+	/** SQL statement type (SELECT, INSERT, UPDATE, DELETE) */
+	statement: SqlStatementType;
+	/** Number of rows affected by INSERT/UPDATE/DELETE operations */
+	affectedRows?: number;
+	/** Query execution time in milliseconds */
+	executionTimeMs?: number;
+	/** Security notification when columns were omitted due to blacklist */
+	securityNotification?: string;
+}
+/**
+ * Generic query result wrapper with rows and metadata
+ * Used to wrap database query results with structured metadata for AI parsing
+ * @template T - Type of individual row objects
+ *
+ * Example: SELECT query result
+ * ```typescript
+ * const result: QueryResult<{id: number; name: string}> = {
+ *   rows: [{id: 1, name: 'Alice'}],
+ *   rowCount: 1,
+ *   columnNames: ['id', 'name'],
+ *   columnTypes: ['integer', 'varchar'],
+ *   executionTimeMs: 42,
+ *   metadata: { statement: 'SELECT' }
+ * }
+ * ```
+ */
+export interface QueryResult<T> {
+	/** Array of result rows */
+	rows: T[];
+	/** Total number of rows in result set */
+	rowCount: number;
+	/** Column names in order (matches Object.keys(rows[0]) for consistent ordering) */
+	columnNames: string[];
+	/** Optional: column data types (PostgreSQL: "integer", "varchar"; MySQL: "INT", "VARCHAR") */
+	columnTypes?: string[];
+	/** Optional: query execution time in milliseconds (only database execution, not formatting) */
+	executionTimeMs?: number;
+	/** Optional: metadata about query type and affected rows */
+	metadata?: QueryMetadata;
+}
+/**
+ * Manager class for loading and querying blacklist rules.
+ * Instantiate once per CLI invocation.
+ */
+export declare class BlacklistManager {
+	private config;
+	private state;
+	private overrideEnabled;
+	constructor(config: DbcliConfig, overrideEnvValue?: string);
+	/**
+	 * Deserialize config.blacklist JSON into efficient Set/Map structures.
+	 * Case-insensitive table names (stored as lowercase).
+	 * Case-sensitive column names.
+	 *
+	 * @returns BlacklistState with Set<string> for tables, Map<string, Set<string>> for columns
+	 */
+	loadBlacklist(): BlacklistState;
+	/**
+	 * Check if a table is blacklisted.
+	 * Case-insensitive comparison.
+	 *
+	 * @param tableName Table name to check
+	 * @returns true if the table is blacklisted
+	 */
+	isTableBlacklisted(tableName: string): boolean;
+	/**
+	 * Check if a specific column in a table is blacklisted.
+	 * Table name is case-insensitive; column name is case-sensitive.
+	 *
+	 * @param tableName Table name
+	 * @param columnName Column name
+	 * @returns true if the column is blacklisted
+	 */
+	isColumnBlacklisted(tableName: string, columnName: string): boolean;
+	/**
+	 * Get all blacklisted column names for a specific table.
+	 *
+	 * @param tableName Table name
+	 * @returns Array of blacklisted column names, or empty array if none
+	 */
+	getBlacklistedColumns(tableName: string): string[];
+	/**
+	 * Check if the blacklist override is enabled via environment variable.
+	 * When true, all blacklist checks are bypassed.
+	 *
+	 * @returns true if DBCLI_OVERRIDE_BLACKLIST=true
+	 */
+	canOverrideBlacklist(): boolean;
+	/**
+	 * Get current blacklist state (for diagnostic purposes).
+	 */
+	getState(): BlacklistState;
+}
+interface FilterColumnsResult {
+	filteredRows: Record<string, unknown>[];
+	omittedColumns: string[];
+}
+/**
+ * Validator class for enforcing blacklist rules.
+ * Instantiate once per CLI invocation with a BlacklistManager.
+ */
+export declare class BlacklistValidator {
+	private manager;
+	constructor(manager: BlacklistManager);
+	/**
+	 * Check if an operation on a table is allowed.
+	 * Throws BlacklistError if the table is blacklisted and override is not active.
+	 *
+	 * @param operation SQL operation type: SELECT, INSERT, UPDATE, DELETE
+	 * @param tableName Table name to check
+	 * @param _tableList Unused (reserved for future multi-table validation)
+	 * @throws BlacklistError if table is blacklisted
+	 */
+	checkTableBlacklist(operation: string, tableName: string, _tableList?: string[]): void;
+	/**
+	 * Reject a write that touches blacklisted columns.
+	 * Computes the intersection of `fields` with the table's column blacklist
+	 * and throws BlacklistError when non-empty. When override is enabled,
+	 * emits a console warning and returns without throwing.
+	 *
+	 * @param tableName Table or collection name
+	 * @param fields Top-level field/column names being written
+	 * @param operation SQL operation type (defaults to 'WRITE')
+	 * @throws BlacklistError when any field is blacklisted and override is off
+	 */
+	checkColumnBlacklistOnWrite(tableName: string, fields: string[], operation?: string): void;
+	/**
+	 * Filter blacklisted columns from query result rows.
+	 * Returns new row objects without blacklisted columns (immutable).
+	 *
+	 * @param tableName Table name to look up column blacklist
+	 * @param rows Query result rows
+	 * @param columnList Column names in result set
+	 * @returns Filtered rows and list of omitted column names
+	 */
+	filterColumns(tableName: string, rows: Record<string, unknown>[], columnList: string[]): FilterColumnsResult;
+	/**
+	 * Build a security notification message for omitted columns.
+	 *
+	 * @param _tableName Table name (reserved for future per-table messages)
+	 * @param omittedColumns List of column names that were omitted
+	 * @returns Security notification string, or empty string if no columns omitted
+	 */
+	buildSecurityNotification(_tableName: string, omittedColumns: string[]): string;
+}
+declare const DbcliConfigSchema: z.ZodObject<{
+	connection: z.ZodUnion<[
+		z.ZodObject<{
+			system: z.ZodEnum<[
+				"postgresql",
+				"mysql",
+				"mariadb"
+			]>;
+			host: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			port: z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			user: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			password: z.ZodDefault<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			database: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "postgresql" | "mysql" | "mariadb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+		}, {
+			user: string | {
+				$env: string;
+			};
+			system: "postgresql" | "mysql" | "mariadb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			password?: string | {
+				$env: string;
+			} | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"mongodb">;
+			uri: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			host: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			port: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "mongodb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			uri?: string | {
+				$env: string;
+			} | undefined;
+		}, {
+			system: "mongodb";
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			host?: string | {
+				$env: string;
+			} | undefined;
+			port?: number | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+			uri?: string | {
+				$env: string;
+			} | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"redis">;
+			host: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			port: z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "redis";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+		}, {
+			system: "redis";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"elasticsearch">;
+			protocol: z.ZodDefault<z.ZodOptional<z.ZodEnum<[
+				"http",
+				"https"
+			]>>>;
+			host: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			port: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			nodes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+			cloudId: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			apiKey: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			caPath: z.ZodOptional<z.ZodString>;
+			rejectUnauthorized: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "elasticsearch";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			rejectUnauthorized: boolean;
+			protocol: "http" | "https";
+			nodes?: string[] | undefined;
+			cloudId?: string | {
+				$env: string;
+			} | undefined;
+			apiKey?: string | {
+				$env: string;
+			} | undefined;
+			caPath?: string | undefined;
+		}, {
+			system: "elasticsearch";
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			host?: string | {
+				$env: string;
+			} | undefined;
+			port?: number | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+			rejectUnauthorized?: boolean | undefined;
+			protocol?: "http" | "https" | undefined;
+			nodes?: string[] | undefined;
+			cloudId?: string | {
+				$env: string;
+			} | undefined;
+			apiKey?: string | {
+				$env: string;
+			} | undefined;
+			caPath?: string | undefined;
+		}>
+	]>;
+	permission: z.ZodDefault<z.ZodEnum<[
+		"query-only",
+		"read-write",
+		"data-admin",
+		"admin"
+	]>>;
+	schema: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+	metadata: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		createdAt: z.ZodOptional<z.ZodString>;
+		version: z.ZodDefault<z.ZodString>;
+		schemaLastUpdated: z.ZodOptional<z.ZodString>;
+		schemaTableCount: z.ZodOptional<z.ZodNumber>;
+	}, "strip", z.ZodTypeAny, {
+		version: string;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	}, {
+		version?: string | undefined;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	}>>>;
+	blacklist: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, "strip", z.ZodTypeAny, {
+		columns: Record<string, string[]>;
+		tables: string[];
+	}, {
+		columns?: Record<string, string[]> | undefined;
+		tables?: string[] | undefined;
+	}>>>;
+	audit: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		enabled: z.ZodDefault<z.ZodBoolean>;
+		rotation: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+			max_bytes: z.ZodDefault<z.ZodNumber>;
+			max_entries: z.ZodDefault<z.ZodNumber>;
+		}, "strip", z.ZodTypeAny, {
+			max_bytes: number;
+			max_entries: number;
+		}, {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		}>>>;
+	}, "strip", z.ZodTypeAny, {
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	}, {
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	}>>>;
+	redis: z.ZodOptional<z.ZodObject<{
+		mask: z.ZodDefault<z.ZodArray<z.ZodObject<{
+			keyPattern: z.ZodString;
+			fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+		}, "strip", z.ZodTypeAny, {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}, {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}>, "many">>;
+	}, "strip", z.ZodTypeAny, {
+		mask: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[];
+	}, {
+		mask?: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[] | undefined;
+	}>>;
+}, "strip", z.ZodTypeAny, {
+	schema: Record<string, any>;
+	blacklist: {
+		columns: Record<string, string[]>;
+		tables: string[];
+	};
+	audit: {
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	};
+	metadata: {
+		version: string;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	};
+	connection: {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "mongodb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		uri?: string | {
+			$env: string;
+		} | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "elasticsearch";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		rejectUnauthorized: boolean;
+		protocol: "http" | "https";
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+	};
+	permission: "admin" | "query-only" | "read-write" | "data-admin";
+	redis?: {
+		mask: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[];
+	} | undefined;
+}, {
+	connection: {
+		system: "mongodb";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
+	} | {
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+	} | {
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+	} | {
+		system: "elasticsearch";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		rejectUnauthorized?: boolean | undefined;
+		protocol?: "http" | "https" | undefined;
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+	};
+	redis?: {
+		mask?: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[] | undefined;
+	} | undefined;
+	schema?: Record<string, any> | undefined;
+	blacklist?: {
+		columns?: Record<string, string[]> | undefined;
+		tables?: string[] | undefined;
+	} | undefined;
+	audit?: {
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	} | undefined;
+	metadata?: {
+		version?: string | undefined;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	} | undefined;
+	permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+}>;
+/**
+ * Types inferred from Zod schemas
+ */
+type DbcliConfig$1 = z.infer<typeof DbcliConfigSchema>;
+declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
+	version: z.ZodLiteral<2>;
+	default: z.ZodString;
+	connections: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[
+		z.ZodObject<{
+			system: z.ZodEnum<[
+				"postgresql",
+				"mysql",
+				"mariadb"
+			]>;
+			host: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			port: z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			user: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			password: z.ZodDefault<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			database: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+		} & {
+			permission: z.ZodDefault<z.ZodEnum<[
+				"query-only",
+				"read-write",
+				"data-admin",
+				"admin"
+			]>>;
+			envFile: z.ZodOptional<z.ZodString>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "postgresql" | "mysql" | "mariadb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			envFile?: string | undefined;
+		}, {
+			user: string | {
+				$env: string;
+			};
+			system: "postgresql" | "mysql" | "mariadb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			password?: string | {
+				$env: string;
+			} | undefined;
+			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+			envFile?: string | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"mongodb">;
+			uri: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			host: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			port: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+		} & {
+			permission: z.ZodDefault<z.ZodEnum<[
+				"query-only",
+				"read-write",
+				"data-admin",
+				"admin"
+			]>>;
+			envFile: z.ZodOptional<z.ZodString>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "mongodb";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			uri?: string | {
+				$env: string;
+			} | undefined;
+			envFile?: string | undefined;
+		}, {
+			system: "mongodb";
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			host?: string | {
+				$env: string;
+			} | undefined;
+			port?: number | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+			uri?: string | {
+				$env: string;
+			} | undefined;
+			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+			envFile?: string | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"redis">;
+			host: z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			port: z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+		} & {
+			permission: z.ZodDefault<z.ZodEnum<[
+				"query-only",
+				"read-write",
+				"data-admin",
+				"admin"
+			]>>;
+			envFile: z.ZodOptional<z.ZodString>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "redis";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			envFile?: string | undefined;
+		}, {
+			system: "redis";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+			envFile?: string | undefined;
+		}>,
+		z.ZodObject<{
+			system: z.ZodLiteral<"elasticsearch">;
+			protocol: z.ZodDefault<z.ZodOptional<z.ZodEnum<[
+				"http",
+				"https"
+			]>>>;
+			host: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			port: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodNumber,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			user: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			password: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			database: z.ZodDefault<z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>>;
+			nodes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+			cloudId: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			apiKey: z.ZodOptional<z.ZodUnion<[
+				z.ZodString,
+				z.ZodObject<{
+					$env: z.ZodString;
+				}, "strict", z.ZodTypeAny, {
+					$env: string;
+				}, {
+					$env: string;
+				}>
+			]>>;
+			caPath: z.ZodOptional<z.ZodString>;
+			rejectUnauthorized: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+		} & {
+			permission: z.ZodDefault<z.ZodEnum<[
+				"query-only",
+				"read-write",
+				"data-admin",
+				"admin"
+			]>>;
+			envFile: z.ZodOptional<z.ZodString>;
+		}, "strip", z.ZodTypeAny, {
+			password: string | {
+				$env: string;
+			};
+			user: string | {
+				$env: string;
+			};
+			system: "elasticsearch";
+			host: string | {
+				$env: string;
+			};
+			port: number | {
+				$env: string;
+			};
+			database: string | {
+				$env: string;
+			};
+			rejectUnauthorized: boolean;
+			protocol: "http" | "https";
+			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			nodes?: string[] | undefined;
+			cloudId?: string | {
+				$env: string;
+			} | undefined;
+			apiKey?: string | {
+				$env: string;
+			} | undefined;
+			caPath?: string | undefined;
+			envFile?: string | undefined;
+		}, {
+			system: "elasticsearch";
+			password?: string | {
+				$env: string;
+			} | undefined;
+			user?: string | {
+				$env: string;
+			} | undefined;
+			host?: string | {
+				$env: string;
+			} | undefined;
+			port?: number | {
+				$env: string;
+			} | undefined;
+			database?: string | {
+				$env: string;
+			} | undefined;
+			rejectUnauthorized?: boolean | undefined;
+			protocol?: "http" | "https" | undefined;
+			nodes?: string[] | undefined;
+			cloudId?: string | {
+				$env: string;
+			} | undefined;
+			apiKey?: string | {
+				$env: string;
+			} | undefined;
+			caPath?: string | undefined;
+			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+			envFile?: string | undefined;
+		}>
+	]>>, Record<string, {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "mongodb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "elasticsearch";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		rejectUnauthorized: boolean;
+		protocol: "http" | "https";
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		envFile?: string | undefined;
+	}>, Record<string, {
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "mongodb";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "elasticsearch";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		rejectUnauthorized?: boolean | undefined;
+		protocol?: "http" | "https" | undefined;
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	}>>;
+	schema: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+	schemas: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>>;
+	metadata: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		createdAt: z.ZodOptional<z.ZodString>;
+		version: z.ZodDefault<z.ZodString>;
+		schemaLastUpdated: z.ZodOptional<z.ZodString>;
+		schemaTableCount: z.ZodOptional<z.ZodNumber>;
+	}, "strip", z.ZodTypeAny, {
+		version: string;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	}, {
+		version?: string | undefined;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	}>>>;
+	blacklist: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, "strip", z.ZodTypeAny, {
+		columns: Record<string, string[]>;
+		tables: string[];
+	}, {
+		columns?: Record<string, string[]> | undefined;
+		tables?: string[] | undefined;
+	}>>>;
+	audit: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		enabled: z.ZodDefault<z.ZodBoolean>;
+		rotation: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+			max_bytes: z.ZodDefault<z.ZodNumber>;
+			max_entries: z.ZodDefault<z.ZodNumber>;
+		}, "strip", z.ZodTypeAny, {
+			max_bytes: number;
+			max_entries: number;
+		}, {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		}>>>;
+	}, "strip", z.ZodTypeAny, {
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	}, {
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	}>>>;
+	redis: z.ZodOptional<z.ZodObject<{
+		mask: z.ZodDefault<z.ZodArray<z.ZodObject<{
+			keyPattern: z.ZodString;
+			fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+		}, "strip", z.ZodTypeAny, {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}, {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}>, "many">>;
+	}, "strip", z.ZodTypeAny, {
+		mask: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[];
+	}, {
+		mask?: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[] | undefined;
+	}>>;
+}, "strip", z.ZodTypeAny, {
+	schema: Record<string, any>;
+	blacklist: {
+		columns: Record<string, string[]>;
+		tables: string[];
+	};
+	audit: {
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	};
+	version: 2;
+	default: string;
+	metadata: {
+		version: string;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	};
+	connections: Record<string, {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "mongodb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "elasticsearch";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		rejectUnauthorized: boolean;
+		protocol: "http" | "https";
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		envFile?: string | undefined;
+	}>;
+	schemas: Record<string, Record<string, any>>;
+	redis?: {
+		mask: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[];
+	} | undefined;
+}, {
+	version: 2;
+	default: string;
+	connections: Record<string, {
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "mongodb";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "elasticsearch";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		rejectUnauthorized?: boolean | undefined;
+		protocol?: "http" | "https" | undefined;
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	}>;
+	redis?: {
+		mask?: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[] | undefined;
+	} | undefined;
+	schema?: Record<string, any> | undefined;
+	blacklist?: {
+		columns?: Record<string, string[]> | undefined;
+		tables?: string[] | undefined;
+	} | undefined;
+	audit?: {
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	} | undefined;
+	metadata?: {
+		version?: string | undefined;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	} | undefined;
+	schemas?: Record<string, Record<string, any>> | undefined;
+}>, {
+	schema: Record<string, any>;
+	blacklist: {
+		columns: Record<string, string[]>;
+		tables: string[];
+	};
+	audit: {
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	};
+	version: 2;
+	default: string;
+	metadata: {
+		version: string;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	};
+	connections: Record<string, {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "mongodb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		envFile?: string | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		system: "elasticsearch";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		rejectUnauthorized: boolean;
+		protocol: "http" | "https";
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		envFile?: string | undefined;
+	}>;
+	schemas: Record<string, Record<string, any>>;
+	redis?: {
+		mask: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[];
+	} | undefined;
+}, {
+	version: 2;
+	default: string;
+	connections: Record<string, {
+		user: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "mongodb";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "redis";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	} | {
+		system: "elasticsearch";
+		password?: string | {
+			$env: string;
+		} | undefined;
+		user?: string | {
+			$env: string;
+		} | undefined;
+		host?: string | {
+			$env: string;
+		} | undefined;
+		port?: number | {
+			$env: string;
+		} | undefined;
+		database?: string | {
+			$env: string;
+		} | undefined;
+		rejectUnauthorized?: boolean | undefined;
+		protocol?: "http" | "https" | undefined;
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+		caPath?: string | undefined;
+		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+		envFile?: string | undefined;
+	}>;
+	redis?: {
+		mask?: {
+			keyPattern: string;
+			fields?: string[] | undefined;
+		}[] | undefined;
+	} | undefined;
+	schema?: Record<string, any> | undefined;
+	blacklist?: {
+		columns?: Record<string, string[]> | undefined;
+		tables?: string[] | undefined;
+	} | undefined;
+	audit?: {
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	} | undefined;
+	metadata?: {
+		version?: string | undefined;
+		createdAt?: string | undefined;
+		schemaLastUpdated?: string | undefined;
+		schemaTableCount?: number | undefined;
+	} | undefined;
+	schemas?: Record<string, Record<string, any>> | undefined;
+}>;
+export type DbcliConfigV2 = z.infer<typeof DbcliConfigV2Schema>;
+/**
+ * QueryExecutor class for executing SQL queries with permission checks
+ */
+export declare class QueryExecutor {
+	private adapter;
+	private permission;
+	private blacklistValidator?;
+	private config?;
+	private options;
+	constructor(adapter: DatabaseAdapter, permission: Permission, blacklistValidator?: BlacklistValidator | undefined, config?: DbcliConfig$1 | undefined, options?: {
+		config?: string;
+	});
+	/**
+	 * Execute a SQL query with permission enforcement and error handling
+	 *
+	 * @param sql The SQL query string
+	 * @param options Execution options (autoLimit, limitValue)
+	 * @returns QueryResult with rows and metadata
+	 * @throws PermissionError if query violates permission level
+	 * @throws BlacklistError if table is blacklisted
+	 * @throws Error for database execution errors
+	 */
+	execute(sql: string, options?: {
+		autoLimit?: boolean;
+		limitValue?: number;
+	}): Promise<QueryResult<Record<string, unknown>>>;
+}
+interface SchemaIndex {
+	tables: Record<string, {
+		location: "hot" | "cold";
+		file: string;
+		estimatedSize: number;
+		lastModified: string;
+	}>;
+	hotTables: string[];
+	metadata: {
+		version: string;
+		lastRefreshed: string;
+		totalTables: number;
+	};
+}
+interface CacheStats {
+	hotTables: number;
+	cachedTables: number;
+	cacheSize: number;
+	cacheHitRate: string;
+	maxItems: number;
+	maxSize: number;
+}
+interface LoaderOptions {
+	maxCacheItems?: number;
+	maxCacheSize?: number;
+	hotTableThreshold?: number;
+	enableStreaming?: boolean;
+	streamingTimeout?: number;
+	/** V2 named connection — layered files under `.dbcli/schemas/<name>/` */
+	connectionName?: string;
+}
+declare class SchemaCacheManager {
+	private cache;
+	private index;
+	private hotSchemas;
+	private dbcliPath;
+	/** Root for index.json, hot-schemas.json, cold/ (V2: per-connection subfolder) */
+	private schemaRoot;
+	private maxItems;
+	private maxSize;
+	/**
+	 * Constructor
+	 * @param dbcliPath Path to .dbcli directory
+	 * @param options Cache configuration (optional `connectionName` for V2 isolation)
+	 */
+	constructor(dbcliPath: string, options?: {
+		maxCacheItems?: number;
+		maxCacheSize?: number;
+		connectionName?: string;
+	});
+	/**
+	 * Initialize: Load index and hot schemas
+	 *
+	 * Performance: < 10ms for typical cases (hot-schemas < 1MB)
+	 * Graceful degradation: If files missing, continues with empty cache
+	 */
+	initialize(): Promise<void>;
+	/**
+	 * Get table schema - Three-tier lookup strategy
+	 *
+	 * 1. Hot schemas (< 1ms) - in-memory map lookup
+	 * 2. LRU cache (< 5ms) - in-memory cache hit
+	 * 3. Cold load (10-50ms) - from file, then cache
+	 *
+	 * @param tableName Name of table to retrieve
+	 * @returns TableSchema or null if not found
+	 */
+	getTableSchema(tableName: string): Promise<TableSchema | null>;
+	/**
+	 * Find fields by name across hot tables
+	 *
+	 * Performance: < 1ms for typical field searches (O(n) over hot tables only)
+	 * Note: Cold tables not searched for efficiency
+	 *
+	 * @param fieldName Column name to search for
+	 * @returns Array of { table, column } matches
+	 */
+	findFieldsByName(fieldName: string): Promise<Array<{
+		table: string;
+		column: ColumnSchema;
+	}>>;
+	/**
+	 * Get cache statistics
+	 *
+	 * @returns Cache stats including hit rate and capacity
+	 */
+	/**
+	 * Remove a table from all cache tiers (hot + LRU)
+	 * Used after DROP TABLE to keep cache consistent
+	 */
+	invalidateTable(tableName: string): void;
+	/**
+	 * Insert or update a table schema in cache
+	 * Used after CREATE TABLE or ALTER TABLE to keep cache consistent
+	 */
+	refreshTable(tableName: string, schema: TableSchema): void;
+	getStats(): CacheStats;
+}
+/**
+ * Schema Layered Loader
+ * Manages hierarchical schema loading: hot on startup, cold on-demand
+ */
+export declare class SchemaLayeredLoader {
+	private dbcliPath;
+	/** V2 named connection for `.dbcli/schemas/<name>/` */
+	private connectionName;
+	private options;
+	private cache;
+	private index;
+	private loadTime;
+	/**
+	 * Constructor
+	 * @param dbcliPath Path to .dbcli directory
+	 * @param options Loader configuration
+	 */
+	constructor(dbcliPath: string, options?: LoaderOptions);
+	/**
+	 * Initialize: Main entry point for startup
+	 *
+	 * Performance Target: < 100ms (including file I/O, JSON parsing, hot-table preload)
+	 * For 100+ tables: Should still meet target through layered approach
+	 *
+	 * Flow:
+	 * 1. Load index (schemas/index.json)
+	 * 2. Initialize cache manager
+	 * 3. Preload hot tables
+	 * 4. Return cache, index, and timing
+	 *
+	 * @returns Initialization result with cache, index, and load time
+	 */
+	initialize(): Promise<{
+		cache: SchemaCacheManager;
+		index: SchemaIndex | null;
+		loadTime: number;
+	}>;
+	/**
+	 * Load cold table on-demand
+	 *
+	 * Called when first querying a table not in hot cache
+	 *
+	 * @param tableName Name of cold table to load
+	 * @param cache SchemaCacheManager instance
+	 * @returns TableSchema or null if not found
+	 */
+	loadColdTable(tableName: string, cache: SchemaCacheManager): Promise<TableSchema | null>;
+	/**
+	 * Ensure required directories exist
+	 *
+	 * Creates:
+	 * - .dbcli/schemas/
+	 * - .dbcli/schemas/cold/
+	 *
+	 * @private
+	 */
+	private ensureDirectories;
+	/**
+	 * Get performance benchmark data
+	 *
+	 * Used for monitoring and tuning
+	 *
+	 * @returns Benchmark metrics
+	 */
+	getBenchmark(): {
+		initTime: number;
+		hotTables: number;
+		totalTables: number;
+		estimatedSize: number;
+	};
+}
+/**
+ * Detect config version from raw parsed JSON
+ */
+export declare function detectConfigVersion(raw: unknown): 1 | 2;
+/**
+ * Resolved connection result — what commands receive
+ * Supports SQL, MongoDB, Redis, and Elasticsearch connections
+ */
+export interface ResolvedConnection {
+	name: string;
+	connection: {
+		system: "postgresql" | "mysql" | "mariadb" | "mongodb" | "redis" | "elasticsearch";
+		host: string | {
+			$env: string;
+		};
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		password: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		uri?: string | {
+			$env: string;
+		};
+		protocol?: "http" | "https";
+		nodes?: string[];
+		cloudId?: string | {
+			$env: string;
+		};
+		apiKey?: string | {
+			$env: string;
+		};
+		caPath?: string;
+		rejectUnauthorized?: boolean;
+	};
+	permission: "query-only" | "read-write" | "data-admin" | "admin";
+	envFile?: string;
+}
+/**
+ * Resolve a named connection from v2 config
+ */
+export declare function resolveConnection(config: DbcliConfigV2, name: string | undefined): ResolvedConnection;
+/**
+ * Load env file for a connection if specified
+ */
+export declare function loadConnectionEnv(resolved: ResolvedConnection, basePath: string): Promise<void>;
+/**
+ * Read and validate a v2 config from disk
+ */
+export declare function readV2Config(path: string): Promise<DbcliConfigV2>;
+/**
+ * List all connection names in a v2 config
+ */
+export declare function listConnections(config: DbcliConfigV2): Array<{
+	name: string;
+	system: string;
+	host: string | {
+		$env: string;
+	};
+	port: number | {
+		$env: string;
+	};
+	database: string | {
+		$env: string;
+	};
+	uri?: string | {
+		$env: string;
+	};
+	isDefault: boolean;
+}>;
+export declare function resolveConfigStoragePath(path: string): Promise<string>;
+/**
+ * Read and fully resolve a `.dbcli` project config: handles project-binding
+ * indirection, v1/v2 formats, per-connection `.env` loading and `{$env}`
+ * expansion. `path` is the `.dbcli` directory (or legacy file). Returns the
+ * default config if none exists. Thin wrapper over the same entrypoint the
+ * CLI commands use.
+ */
+export declare const readConfig: (path: string, connectionName?: string) => Promise<DbcliConfig$1>;
+
+export {
+	DbcliConfig$1 as DbcliConfig,
+};
+
+export {};