@carllee1983/dbcli 1.37.1 → 1.38.1

package/dist/cli.mjs

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "1.37.1",
+    version: "1.38.1",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -23087,7 +23087,7 @@ var init_capabilities = __esm(() => {
       queries: cap("limited", "local-write", "Snippet management works with Redis-specific saved-query limitations."),
       insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
       update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
       export: cap("unsupported", "none", "Redis export is not supported."),
       blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
       check: cap("unsupported", "none", "Data health check is SQL-only."),
@@ -28927,6 +28927,7 @@ var init_assert_artifact = __esm(() => {
     "assertion",
     "migration",
     "backfill",
+    "table",
     "manual"
   ];
   AssertArtifactError = class AssertArtifactError extends Error {
@@ -92930,12 +92931,277 @@ var init_rollback = __esm(() => {
     note: "Preflight guards ran before post-rollback read-back verification."
   };
 });
+
+// src/core/verify/constraint.ts
+function normalizeConstraintCheck(raw) {
+  const check2 = raw ?? "";
+  if (!ALLOWED_CONSTRAINT_CHECKS.includes(check2)) {
+    throw new VerifyInputError(`Invalid --check '${check2}'. Allowed: ${ALLOWED_CONSTRAINT_CHECKS.join(", ")}`);
+  }
+  return check2;
+}
+function toColumns(raw) {
+  if (raw === undefined || raw === null)
+    return [];
+  const arr = Array.isArray(raw) ? raw : [raw];
+  return arr.map((c2) => requireNonEmpty(c2, "--column"));
+}
+function parseReferences(raw) {
+  const ref = requireNonEmpty(raw, "--references");
+  const parts = ref.split(".").map((p) => p.trim());
+  if (parts.length < 2 || parts.some((p) => p.length === 0)) {
+    throw new VerifyInputError(`--references must be '<table>.<column>' (got '${ref}')`);
+  }
+  const column = parts.pop();
+  const table = parts.join(".");
+  return { table, column };
+}
+function parseBaseline(raw) {
+  if (raw === undefined || raw === null || raw === "")
+    return 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    throw new VerifyInputError(`--baseline must be a non-negative integer (got '${String(raw)}')`);
+  }
+  return n;
+}
+function normalizeConstraintInput(raw) {
+  const check2 = normalizeConstraintCheck(raw.check);
+  const table = requireNonEmpty(raw.table, "--table");
+  const format = normalizeFormat(raw.format);
+  const columns = toColumns(raw.column);
+  const violationQueryRaw = raw.violationQuery;
+  const hasViolationQuery = typeof violationQueryRaw === "string" && violationQueryRaw.trim().length > 0;
+  let references;
+  if (check2 === "fk") {
+    if (columns.length !== 1) {
+      throw new VerifyInputError("--check fk requires exactly one --column (the child FK column).");
+    }
+    references = parseReferences(raw.references);
+    if (hasViolationQuery) {
+      throw new VerifyInputError("--violation-query is only valid with --check custom.");
+    }
+  } else if (check2 === "not-null" || check2 === "unique") {
+    if (columns.length < 1) {
+      throw new VerifyInputError(`--check ${check2} requires at least one --column.`);
+    }
+    if (raw.references !== undefined) {
+      throw new VerifyInputError("--references is only valid with --check fk.");
+    }
+    if (hasViolationQuery) {
+      throw new VerifyInputError("--violation-query is only valid with --check custom.");
+    }
+  } else {
+    if (!hasViolationQuery) {
+      throw new VerifyInputError("--check custom requires --violation-query.");
+    }
+    if (columns.length > 0) {
+      throw new VerifyInputError("--column is not valid with --check custom.");
+    }
+    if (raw.references !== undefined) {
+      throw new VerifyInputError("--references is only valid with --check fk.");
+    }
+  }
+  const subjectNameRaw = raw.subjectName;
+  const summaryRaw = raw.summary;
+  return {
+    table,
+    check: check2,
+    columns,
+    ...references ? { references } : {},
+    ...check2 === "custom" ? { violationQuery: violationQueryRaw.trim() } : {},
+    allowPreexisting: raw.allowPreexisting === true,
+    baseline: parseBaseline(raw.baseline),
+    afterWrite: raw.afterWrite === true,
+    format,
+    ...subjectNameRaw && subjectNameRaw.trim().length > 0 ? { subjectName: subjectNameRaw.trim() } : {},
+    ...summaryRaw && summaryRaw.trim().length > 0 ? { summary: summaryRaw.trim() } : {}
+  };
+}
+function buildConstraintSubject(input) {
+  return {
+    kind: "table",
+    name: input.subjectName ?? input.table,
+    command: "verify constraint"
+  };
+}
+function buildConstraintAfterWriteCommand(input, baseline) {
+  const flags = [`--check ${input.check}`, `--table ${shellQuote2(input.table)}`];
+  if (input.check === "fk") {
+    flags.push(`--column ${shellQuote2(input.columns[0])}`);
+    flags.push(`--references ${shellQuote2(`${input.references.table}.${input.references.column}`)}`);
+  } else if (input.check === "custom") {
+    flags.push(`--violation-query ${shellQuote2(input.violationQuery)}`);
+  } else {
+    for (const c2 of input.columns)
+      flags.push(`--column ${shellQuote2(c2)}`);
+  }
+  if (input.subjectName)
+    flags.push(`--subject-name ${shellQuote2(input.subjectName)}`);
+  if (input.summary)
+    flags.push(`--summary ${shellQuote2(input.summary)}`);
+  if (input.format !== "table")
+    flags.push(`--format ${input.format}`);
+  if (baseline !== undefined && baseline > 0) {
+    flags.push("--allow-preexisting", `--baseline ${baseline}`);
+  }
+  return renderAfterWriteCommand("constraint", flags);
+}
+async function runConstraintGuards(runners) {
+  return runGuardSequence([
+    ["blacklist", () => runners.blacklistGuard()],
+    ["schema", () => runners.schemaGuard()],
+    ["violation-query-readonly", () => runners.violationReadonlyGuard()]
+  ]);
+}
+function constraintDefaultSummary(status2, check2, table) {
+  switch (status2) {
+    case "verified":
+      return `Constraint '${check2}' holds on ${table} (violation count within threshold).`;
+    case "not_verified":
+      return `Constraint '${check2}' is violated on ${table} (violation count exceeds threshold).`;
+    case "blocked":
+      return `Constraint '${check2}' verification was blocked before the violation count on ${table}.`;
+    default:
+      return `Constraint '${check2}' verification could not produce a trustworthy verdict on ${table}.`;
+  }
+}
+async function runConstraintPreflight(input, runners) {
+  const guards = await runConstraintGuards(runners);
+  const ready = allGuardsPassed(guards, 3);
+  let baseline;
+  if (ready) {
+    const outcome = await runners.runViolationCount();
+    if (outcome.ran && typeof outcome.count === "number")
+      baseline = outcome.count;
+  }
+  return {
+    scenario: "constraint",
+    mode: "preflight",
+    status: ready ? "ready" : "blocked",
+    check: input.check,
+    table: input.table,
+    violationSql: runners.violationSql,
+    ...baseline !== undefined ? { baseline } : {},
+    guards,
+    afterWriteCommand: buildConstraintAfterWriteCommand(input, baseline)
+  };
+}
+async function runConstraintAfterWrite(input, runners, clock = {}) {
+  const subject = buildConstraintSubject(input);
+  const guards = await runConstraintGuards(runners);
+  if (!allGuardsPassed(guards, 3)) {
+    const failed = guards.find((g) => g.status === "failed");
+    const blockedReason = failed?.reason ?? "A required guard failed before the violation count.";
+    const artifact3 = buildVerificationArtifact({
+      status: "blocked",
+      subject,
+      summary: input.summary ?? constraintDefaultSummary("blocked", input.check, input.table),
+      evidence: [CONSTRAINT_TASK_PACK_EVIDENCE],
+      blockedReason,
+      now: clock.now,
+      idFactory: clock.idFactory
+    });
+    return {
+      scenario: "constraint",
+      mode: "after-write",
+      status: "blocked",
+      check: input.check,
+      table: input.table,
+      guards,
+      artifact: artifact3,
+      blockedReason
+    };
+  }
+  const outcome = await runners.runViolationCount();
+  const threshold = input.allowPreexisting ? input.baseline : 0;
+  const assertionOutcome = outcome.ran && typeof outcome.count === "number" ? { ran: true, pass: outcome.count <= threshold, auditRef: outcome.auditRef } : { ran: false, reason: outcome.reason, auditRef: outcome.auditRef };
+  const status2 = mapAssertionToStatus(assertionOutcome);
+  const evidence2 = {
+    kind: "assert",
+    command: `constraint:${input.check} <${redactSqlForEvidence(runners.violationSql)}> threshold <=${threshold}`,
+    exitCode: status2 === "verified" ? 0 : 1,
+    ...outcome.auditRef ? { auditRef: outcome.auditRef } : {},
+    ...status2 === "indeterminate" && outcome.reason ? { note: outcome.reason } : {}
+  };
+  const artifact2 = buildVerificationArtifact({
+    status: status2,
+    subject,
+    summary: input.summary ?? constraintDefaultSummary(status2, input.check, input.table),
+    evidence: [CONSTRAINT_TASK_PACK_EVIDENCE, evidence2],
+    ...status2 === "indeterminate" && outcome.reason ? { blockedReason: outcome.reason } : {},
+    now: clock.now,
+    idFactory: clock.idFactory
+  });
+  return {
+    scenario: "constraint",
+    mode: "after-write",
+    status: status2,
+    check: input.check,
+    table: input.table,
+    guards,
+    ...outcome.ran && typeof outcome.count === "number" ? { assertion: { violations: outcome.count, threshold, passed: status2 === "verified" } } : {},
+    artifact: artifact2
+  };
+}
+var ALLOWED_CONSTRAINT_CHECKS, CONSTRAINT_TASK_PACK_EVIDENCE;
+var init_constraint = __esm(() => {
+  init_scenario();
+  init_verification();
+  init_scenario();
+  ALLOWED_CONSTRAINT_CHECKS = ["fk", "not-null", "unique", "custom"];
+  CONSTRAINT_TASK_PACK_EVIDENCE = {
+    kind: "task-pack-plan",
+    taskName: "constraint-verify",
+    note: "Preflight guards ran before the read-only violation count."
+  };
+});
+
+// src/core/verify/constraint-query.ts
+function quoteIdent(name2, engine) {
+  const useBacktick = engine === "mysql" || engine === "mariadb";
+  const q = useBacktick ? "`" : '"';
+  const esc = (seg) => `${q}${seg.split(q).join(q + q)}${q}`;
+  return name2.split(".").map((seg) => esc(seg.trim())).join(".");
+}
+function buildNotNullViolationQuery(a) {
+  const where = a.columns.map((c2) => `${quoteIdent(c2, a.engine)} IS NULL`).join(" OR ");
+  return `SELECT COUNT(*) AS violation_count FROM ${quoteIdent(a.table, a.engine)} WHERE ${where}`;
+}
+function buildUniqueViolationQuery(a) {
+  const cols = a.columns.map((c2) => quoteIdent(c2, a.engine)).join(", ");
+  return `SELECT COUNT(*) AS violation_count FROM (SELECT 1 FROM ${quoteIdent(a.table, a.engine)} GROUP BY ${cols} HAVING COUNT(*) > 1) AS dups`;
+}
+function buildFkViolationQuery(a) {
+  const col = quoteIdent(a.column, a.engine);
+  const ref = quoteIdent(a.refColumn, a.engine);
+  return `SELECT COUNT(*) AS violation_count FROM ${quoteIdent(a.table, a.engine)} AS c LEFT JOIN ${quoteIdent(a.refTable, a.engine)} AS p ON c.${col} = p.${ref} WHERE c.${col} IS NOT NULL AND p.${ref} IS NULL`;
+}
+function buildViolationQuery(input, engine) {
+  switch (input.check) {
+    case "custom":
+      return input.violationQuery;
+    case "not-null":
+      return buildNotNullViolationQuery({ engine, table: input.table, columns: input.columns });
+    case "unique":
+      return buildUniqueViolationQuery({ engine, table: input.table, columns: input.columns });
+    case "fk":
+      return buildFkViolationQuery({
+        engine,
+        table: input.table,
+        column: input.columns[0],
+        refTable: input.references.table,
+        refColumn: input.references.column
+      });
+  }
+}
 // src/core/verify/index.ts
 var init_verify = __esm(() => {
   init_scenario();
   init_safe_backfill();
   init_migration();
   init_rollback();
+  init_constraint();
 });
 
 // src/commands/verify.ts
@@ -93197,6 +93463,96 @@ function buildRollbackRunners(ctx, input) {
     }
   };
 }
+function constraintEngineOf(system) {
+  return system;
+}
+function buildConstraintRunners(ctx, input) {
+  const { adapter, config } = ctx;
+  const blacklist = config.blacklist ?? { tables: [], columns: {} };
+  const schema = config.schema ?? {};
+  const schemaLookup = { tables: schema, cacheAvailable: Object.keys(schema).length > 0 };
+  const analyze = (sql) => analyzeQueryRisk({ sql: sql.trim(), permission: config.permission, blacklist, schemaLookup });
+  const engine = constraintEngineOf(config.connection.system);
+  const violationSql = buildViolationQuery(input, engine);
+  const columnsExist = async (table, cols) => {
+    const ts = await adapter.getTableSchema(table);
+    const present = new Set(ts.columns.map((c2) => c2.name.toLowerCase()));
+    const missing = cols.filter((c2) => !present.has(c2.trim().toLowerCase()));
+    return missing.length > 0 ? `unknown column(s) on ${table}: ${missing.join(", ")}` : null;
+  };
+  return {
+    violationSql,
+    blacklistGuard: async () => {
+      const bm = new BlacklistManager(config);
+      const targets = [input.table, ...input.references ? [input.references.table] : []];
+      for (const t2 of targets) {
+        if (bm.isTableBlacklisted(t2) && !bm.canOverrideBlacklist()) {
+          return { ok: false, reason: boundedReason(`Target table '${t2}' is blacklisted.`) };
+        }
+      }
+      return { ok: true };
+    },
+    schemaGuard: async () => {
+      try {
+        if (input.check !== "custom") {
+          const miss = await columnsExist(input.table, input.columns);
+          if (miss)
+            return { ok: false, reason: boundedReason(miss) };
+        } else {
+          await adapter.getTableSchema(input.table);
+        }
+        if (input.references) {
+          const refMiss = await columnsExist(input.references.table, [input.references.column]);
+          if (refMiss)
+            return { ok: false, reason: boundedReason(refMiss) };
+        }
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, reason: boundedReason(`schema check failed: ${e.message}`) };
+      }
+    },
+    violationReadonlyGuard: async () => {
+      const r = analyze(violationSql);
+      if (!isPlainSelectVerifyQuery(r.operation, violationSql)) {
+        return {
+          ok: false,
+          reason: boundedReason(`violation query must be a read-only plain SELECT (got ${r.operation}).`)
+        };
+      }
+      return { ok: true };
+    },
+    runViolationCount: async () => {
+      try {
+        const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
+        const executor3 = new QueryExecutor(adapter, config.permission, blacklistValidator, config, ctx.options);
+        const result = await executor3.execute(violationSql, { autoLimit: true });
+        const scalar = firstScalar(result);
+        const auditRef = await writeAuditEntry(config, "verify", ctx.options, {
+          success: true,
+          sql: violationSql
+        });
+        if (scalar === null) {
+          return {
+            ran: false,
+            reason: boundedReason("violation query returned no count"),
+            auditRef
+          };
+        }
+        const count = typeof scalar === "number" ? scalar : Number(scalar);
+        if (!Number.isFinite(count)) {
+          return {
+            ran: false,
+            reason: boundedReason(`violation count not numeric: ${scalar}`),
+            auditRef
+          };
+        }
+        return { ran: true, count, auditRef };
+      } catch (e) {
+        return { ran: false, reason: boundedReason(e.message) };
+      }
+    }
+  };
+}
 function formatPreflightTable(r) {
   const lines = [
     `Scenario:    ${r.scenario}`,
@@ -93405,6 +93761,81 @@ function buildRollbackAfterWriteJson(r, artifactPath) {
     ...r.blockedReason ? { blockedReason: r.blockedReason } : {}
   };
 }
+function formatConstraintPreflightTable(r) {
+  const lines = [
+    `Scenario:    ${r.scenario}`,
+    `Mode:        preflight`,
+    `Check:       ${r.check}`,
+    `Table:       ${r.table}`,
+    `Status:      ${r.status}`,
+    "Guards:"
+  ];
+  for (const g of r.guards) {
+    lines.push(`  - ${g.name}: ${g.status}${g.reason ? ` (${g.reason})` : ""}`);
+  }
+  if (r.baseline !== undefined)
+    lines.push("", `Baseline violations: ${r.baseline}`);
+  lines.push("", "Violation query (read-only; this command never executes a write):");
+  lines.push(`  ${r.violationSql}`);
+  lines.push("", "After-write command (run AFTER you apply your change externally):");
+  lines.push(`  ${r.afterWriteCommand}`);
+  lines.push("", "Note: default verdict requires 0 violations; add --allow-preexisting --baseline <N> to tolerate pre-existing ones.");
+  return lines.join(`
+`);
+}
+function formatConstraintAfterWriteTable(r, artifactPath) {
+  const lines = [
+    `Scenario:    ${r.scenario}`,
+    `Mode:        after-write`,
+    `Check:       ${r.check}`,
+    `Table:       ${r.table}`,
+    `Status:      ${r.status}`
+  ];
+  if (r.assertion)
+    lines.push(`Violations:  ${r.assertion.violations} (threshold <= ${r.assertion.threshold}) -> ${r.assertion.passed ? "PASS" : "FAIL"}`);
+  if (r.blockedReason)
+    lines.push(`Reason:      ${r.blockedReason}`);
+  lines.push(`Summary:     ${r.artifact.summary}`);
+  lines.push(`Artifact id: ${r.artifact.id}`);
+  if (artifactPath)
+    lines.push(`Artifact:    ${artifactPath}`);
+  lines.push("", `Next: dbcli verification show ${r.artifact.id}`);
+  return lines.join(`
+`);
+}
+function buildConstraintPreflightJson(r) {
+  return {
+    scenario: r.scenario,
+    mode: r.mode,
+    status: r.status,
+    check: r.check,
+    table: r.table,
+    violationSql: r.violationSql,
+    ...r.baseline !== undefined ? { baseline: r.baseline } : {},
+    guards: r.guards.map((g) => ({
+      name: g.name,
+      status: g.status,
+      ...g.reason ? { reason: g.reason } : {}
+    })),
+    afterWriteCommand: r.afterWriteCommand
+  };
+}
+function buildConstraintAfterWriteJson(r, artifactPath) {
+  return {
+    scenario: r.scenario,
+    mode: r.mode,
+    status: r.status,
+    check: r.check,
+    table: r.table,
+    artifact: {
+      id: r.artifact.id,
+      ...artifactPath ? { path: artifactPath } : {},
+      subject: r.artifact.subject
+    },
+    ...r.assertion ? { assertion: r.assertion } : {},
+    ...r.blockedReason ? { blockedReason: r.blockedReason } : {}
+  };
+}
 async function executeScenario(def, options, command) {
   let input;
   try {
@@ -93471,7 +93902,7 @@ function registerScenario(parent, def) {
   def.configureOptions(command);
   command.action((options, cmd) => executeScenario(def, options, cmd));
 }
-var SQL_SYSTEMS7, safeBackfillScenario, migrationScenario, rollbackScenario, BUILTIN_VERIFY_SCENARIOS, verifyCommand;
+var SQL_SYSTEMS7, safeBackfillScenario, migrationScenario, rollbackScenario, constraintScenario, BUILTIN_VERIFY_SCENARIOS, verifyCommand;
 var init_verify2 = __esm(() => {
   init_esm();
   init_adapters();
@@ -93627,10 +94058,61 @@ var init_verify2 = __esm(() => {
       return result.status === "verified" && !artifactError;
     }
   };
+  constraintScenario = {
+    name: "constraint",
+    description: "Preflight or after-write verification that a data-integrity invariant holds across your change (--check fk|not-null|unique|custom); never executes a write",
+    subjectKind: "table",
+    configureOptions(command) {
+      return command.requiredOption("--table <table>", "Table the invariant is checked on").requiredOption("--check <kind>", "Constraint kind: fk | not-null | unique | custom").option("--column <name>", "Column to check (repeatable for not-null/unique; the child FK column for fk)", (val, prev = []) => [...prev, val]).option("--references <table.column>", "Referenced <table>.<column> (required for --check fk)").option("--violation-query <sql>", "Read-only SELECT counting violations (required for --check custom)").option("--allow-preexisting", "Tolerate pre-existing violations: verified when count <= --baseline", false).option("--baseline <n>", "Baseline violation count measured at preflight (use with --allow-preexisting)").option("--after-write", "Re-run the violation count and write a verification artifact", false).option("--format <format>", "Output format: table (default) or json", "table").option("--subject-name <name>", "Optional artifact subject name (default: table)").option("--summary <text>", "Optional artifact summary override (after-write mode)");
+    },
+    normalize(options) {
+      return normalizeConstraintInput({
+        table: options.table,
+        check: options.check,
+        column: options.column,
+        references: options.references,
+        violationQuery: options.violationQuery,
+        allowPreexisting: options.allowPreexisting === true,
+        baseline: options.baseline,
+        afterWrite: options.afterWrite === true,
+        format: options.format,
+        subjectName: options.subjectName,
+        summary: options.summary
+      });
+    },
+    createRunners(context, input) {
+      return buildConstraintRunners(context, input);
+    },
+    runPreflight(input, runners) {
+      return runConstraintPreflight(input, runners);
+    },
+    runAfterWrite(input, runners) {
+      return runConstraintAfterWrite(input, runners);
+    },
+    renderPreflight(result, format) {
+      return format === "json" ? JSON.stringify(buildConstraintPreflightJson(result), null, 2) : formatConstraintPreflightTable(result);
+    },
+    artifactOf(result) {
+      return result.artifact;
+    },
+    afterWriteJson(result, artifactPath) {
+      return buildConstraintAfterWriteJson(result, artifactPath);
+    },
+    renderAfterWriteTable(result, artifactPath) {
+      return formatConstraintAfterWriteTable(result, artifactPath);
+    },
+    isPreflightReady(result) {
+      return result.status === "ready";
+    },
+    isAfterWriteVerified(result, artifactError) {
+      return result.status === "verified" && !artifactError;
+    }
+  };
   BUILTIN_VERIFY_SCENARIOS = [
     safeBackfillScenario,
     migrationScenario,
-    rollbackScenario
+    rollbackScenario,
+    constraintScenario
   ];
   verifyCommand = new Command("verify").description("Run verification scenarios (preflight or after-write). Never executes writes.");
   for (const scenario2 of BUILTIN_VERIFY_SCENARIOS) {
@@ -96730,30 +97212,30 @@ class PostgreSQLDDLGenerator {
   dropIndex(indexName, _table) {
     return { sql: `DROP INDEX ${q(indexName)};`, warnings: [] };
   }
-  addConstraint(constraint) {
-    const t2 = q(constraint.table);
+  addConstraint(constraint2) {
+    const t2 = q(constraint2.table);
     const warnings = [];
-    switch (constraint.type) {
+    switch (constraint2.type) {
       case "foreign_key": {
-        const name2 = constraint.name || `fk_${constraint.table}_${constraint.column}`;
-        const onDelete = constraint.onDelete ? ` ON DELETE ${constraint.onDelete.toUpperCase().replace("_", " ")}` : "";
+        const name2 = constraint2.name || `fk_${constraint2.table}_${constraint2.column}`;
+        const onDelete = constraint2.onDelete ? ` ON DELETE ${constraint2.onDelete.toUpperCase().replace("_", " ")}` : "";
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} FOREIGN KEY (${q(constraint.column)}) REFERENCES ${q(constraint.references.table)}(${q(constraint.references.column)})${onDelete};`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} FOREIGN KEY (${q(constraint2.column)}) REFERENCES ${q(constraint2.references.table)}(${q(constraint2.references.column)})${onDelete};`,
           warnings
         };
       }
       case "unique": {
-        const name2 = constraint.name || `uq_${constraint.table}_${constraint.columns.join("_")}`;
-        const cols = constraint.columns.map(q).join(", ");
+        const name2 = constraint2.name || `uq_${constraint2.table}_${constraint2.columns.join("_")}`;
+        const cols = constraint2.columns.map(q).join(", ");
         return {
           sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} UNIQUE (${cols});`,
           warnings
         };
       }
       case "check": {
-        const name2 = constraint.name || `ck_${constraint.table}`;
+        const name2 = constraint2.name || `ck_${constraint2.table}`;
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} CHECK (${constraint.expression});`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} CHECK (${constraint2.expression});`,
           warnings
         };
       }
@@ -96903,30 +97385,30 @@ class MySQLDDLGenerator {
       warnings: table ? [] : ["MySQL requires ON <table> \u2014 specify table for this operation"]
     };
   }
-  addConstraint(constraint) {
-    const t2 = q2(constraint.table);
+  addConstraint(constraint2) {
+    const t2 = q2(constraint2.table);
     const warnings = [];
-    switch (constraint.type) {
+    switch (constraint2.type) {
       case "foreign_key": {
-        const name2 = constraint.name || `fk_${constraint.table}_${constraint.column}`;
-        const onDelete = constraint.onDelete ? ` ON DELETE ${constraint.onDelete.toUpperCase().replace("_", " ")}` : "";
+        const name2 = constraint2.name || `fk_${constraint2.table}_${constraint2.column}`;
+        const onDelete = constraint2.onDelete ? ` ON DELETE ${constraint2.onDelete.toUpperCase().replace("_", " ")}` : "";
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} FOREIGN KEY (${q2(constraint.column)}) REFERENCES ${q2(constraint.references.table)}(${q2(constraint.references.column)})${onDelete};`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} FOREIGN KEY (${q2(constraint2.column)}) REFERENCES ${q2(constraint2.references.table)}(${q2(constraint2.references.column)})${onDelete};`,
           warnings
         };
       }
       case "unique": {
-        const name2 = constraint.name || `uq_${constraint.table}_${constraint.columns.join("_")}`;
-        const cols = constraint.columns.map(q2).join(", ");
+        const name2 = constraint2.name || `uq_${constraint2.table}_${constraint2.columns.join("_")}`;
+        const cols = constraint2.columns.map(q2).join(", ");
         return {
           sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} UNIQUE (${cols});`,
           warnings
         };
       }
       case "check": {
-        const name2 = constraint.name || `ck_${constraint.table}`;
+        const name2 = constraint2.name || `ck_${constraint2.table}`;
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} CHECK (${constraint.expression});`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} CHECK (${constraint2.expression});`,
           warnings: ["CHECK constraints enforced in MySQL 8.0.16+ and MariaDB 10.2.1+ only"]
         };
       }

package/dist/core.mjs

@@ -13537,7 +13537,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
     queries: cap("limited", "local-write", "Snippet management works with Redis-specific saved-query limitations."),
     insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
     update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-    delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+    delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
     export: cap("unsupported", "none", "Redis export is not supported."),
     blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
     check: cap("unsupported", "none", "Data health check is SQL-only."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "1.37.1",
+  "version": "1.38.1",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {