@carllee1983/dbcli 1.42.0 → 1.43.0

package/dist/cli.mjs

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "1.42.0",
+    version: "1.43.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -66,6 +66,10 @@ var init_package = __esm(() => {
       "./core": {
         types: "./dist/core.d.ts",
         import: "./dist/core.mjs"
+      },
+      "./agent-core": {
+        types: "./dist/agent-core.d.ts",
+        import: "./dist/agent-core.mjs"
       }
     },
     license: "MIT",
@@ -123,6 +127,7 @@ var init_package = __esm(() => {
       "docs:check": "bun run scripts/check-user-docs.ts",
       "skill:check": "bun run scripts/check-skill-parity.ts",
       "platform:check": "bun run scripts/check-platform-parity.ts",
+      "agent-core:check": "bun run scripts/check-agent-core-purity.ts",
       typecheck: "tsc --noEmit --pretty false",
       "test:perf": "bun test ./tests/perf/*.bench.ts",
       lint: "eslint src tests scripts --ext .ts --max-warnings=0",
@@ -158,14 +163,15 @@ var init_package = __esm(() => {
       "dts-bundle-generator": "^9.5.1",
       eslint: "^10.4.0",
       "happy-dom": "^20.10.6",
-      postcss: "^8.5.14",
+      postcss: "^8.5.25",
       prettier: "^3.8.3",
       tailwindcss: "3.4.1",
       typescript: "^5.9.3",
       "typescript-eslint": "^8.59.4"
     },
     overrides: {
-      "brace-expansion": "^5.0.6"
+      "brace-expansion": "^5.0.9",
+      postcss: "^8.5.25"
     }
   };
 });
@@ -7110,24 +7116,6 @@ var init_zod = __esm(() => {
 });
 
 // src/utils/validation.ts
-var exports_validation = {};
-__export(exports_validation, {
-  validateFormat: () => validateFormat,
-  RedisMaskRuleSchema: () => RedisMaskRuleSchema,
-  RedisConnectionConfigSchema: () => RedisConnectionConfigSchema,
-  RedisConfigSchema: () => RedisConfigSchema,
-  PermissionSchema: () => PermissionSchema,
-  NamedConnectionSchema: () => NamedConnectionSchema,
-  MongoDBConnectionConfigSchema: () => MongoDBConnectionConfigSchema,
-  MetadataSchema: () => MetadataSchema,
-  ElasticsearchConnectionConfigSchema: () => ElasticsearchConnectionConfigSchema,
-  DbcliConfigV2Schema: () => DbcliConfigV2Schema,
-  DbcliConfigSchema: () => DbcliConfigSchema,
-  ConnectionConfigSchema: () => ConnectionConfigSchema,
-  BlacklistConfigSchema: () => BlacklistConfigSchema,
-  AuditRotationConfigSchema: () => AuditRotationConfigSchema,
-  AuditConfigSchema: () => AuditConfigSchema
-});
 function validateFormat(value, allowedFormats, commandName) {
   if (!allowedFormats.includes(value)) {
     const allowed = allowedFormats.join(", ");
@@ -7267,30 +7255,35 @@ var init_validation = __esm(() => {
   });
 });
 
-// src/utils/errors.ts
-var EnvParseError, ConfigError;
+// src/agent-core/errors.ts
+var ConfigError;
 var init_errors2 = __esm(() => {
-  EnvParseError = class EnvParseError extends Error {
+  ConfigError = class ConfigError extends Error {
     constructor(message) {
       super(message);
-      this.name = "EnvParseError";
-      if (Error.captureStackTrace) {
-        Error.captureStackTrace(this, EnvParseError);
-      }
+      this.name = "ConfigError";
+      if (Error.captureStackTrace)
+        Error.captureStackTrace(this, ConfigError);
     }
   };
-  ConfigError = class ConfigError extends Error {
+});
+
+// src/utils/errors.ts
+var EnvParseError;
+var init_errors3 = __esm(() => {
+  init_errors2();
+  EnvParseError = class EnvParseError extends Error {
     constructor(message) {
       super(message);
-      this.name = "ConfigError";
+      this.name = "EnvParseError";
       if (Error.captureStackTrace) {
-        Error.captureStackTrace(this, ConfigError);
+        Error.captureStackTrace(this, EnvParseError);
       }
     }
   };
 });
 
-// src/core/env-loader.ts
+// src/agent-core/env-loader.ts
 function parseEnvContent(content) {
   const entries = [];
   for (const line of content.split(`
@@ -7312,22 +7305,22 @@ function parseEnvContent(content) {
 }
 async function loadEnvFile(filePath) {
   const file = Bun.file(filePath);
-  const exists = await file.exists();
-  if (!exists) {
+  if (!await file.exists())
     throw new ConfigError(`\u627E\u4E0D\u5230 env \u6A94\u6848\uFF1A${filePath}`);
-  }
-  const content = await file.text();
-  const entries = parseEnvContent(content);
-  for (const [key, value] of entries) {
-    if (process.env[key] === undefined) {
+  for (const [key, value] of parseEnvContent(await file.text())) {
+    if (process.env[key] === undefined)
       process.env[key] = value;
-    }
   }
 }
 var init_env_loader = __esm(() => {
   init_errors2();
 });
 
+// src/core/env-loader.ts
+var init_env_loader2 = __esm(() => {
+  init_env_loader();
+});
+
 // src/core/config-binding.ts
 import { createHash } from "crypto";
 import { mkdir, unlink } from "fs/promises";
@@ -7464,9 +7457,66 @@ async function patchConnectionSchema(dbcliPath, connectionName, schema, metadata
 }
 var init_config_v2 = __esm(() => {
   init_validation();
+  init_errors3();
+  init_env_loader2();
+  init_config_binding();
+});
+
+// src/agent-core/applied-limit.ts
+function trimAppliedLimit(rows, limit) {
+  const truncated = rows.length > limit;
+  return {
+    rows: truncated ? rows.slice(0, limit) : [...rows],
+    metadata: { truncated, limitApplied: limit }
+  };
+}
+
+// src/agent-core/connection-selector.ts
+function resolveConnectionSelector(inputs) {
+  if (inputs.root !== undefined && inputs.command !== undefined && inputs.root !== inputs.command) {
+    throw new Error(`Conflicting connection selectors: root value '${inputs.root}' does not match command value '${inputs.command}'`);
+  }
+  const explicit = inputs.command ?? inputs.root;
+  if (explicit !== undefined)
+    return explicit;
+  const environment = inputs.environment?.trim();
+  return environment ? environment : undefined;
+}
+function parseConnectionNames(selector) {
+  const names = selector.split(",").map((name2) => name2.trim());
+  if (names.some((name2) => name2 === "")) {
+    throw new Error("Connection selector contains an empty connection name");
+  }
+  const seen = new Set;
+  for (const name2 of names) {
+    if (seen.has(name2)) {
+      throw new Error(`Connection selector contains duplicate connection name '${name2}'`);
+    }
+    seen.add(name2);
+  }
+  return names;
+}
+
+// src/agent-core/env-ref.ts
+function resolveEnvRef(value, fieldName, env = process.env) {
+  if (typeof value === "string")
+    return value;
+  const envKey = value.$env;
+  const resolved = env[envKey];
+  if (resolved === undefined) {
+    throw new ConfigError(`Environment variable not defined: ${envKey} (field: ${fieldName})
+` + `Please set ${envKey} in an env file or your environment.`);
+  }
+  return resolved;
+}
+var init_env_ref = __esm(() => {
   init_errors2();
+});
+
+// src/agent-core/public.ts
+var init_public = __esm(() => {
   init_env_loader();
-  init_config_binding();
+  init_env_ref();
 });
 
 // node_modules/lru-cache/dist/esm/node/index.min.js
@@ -8450,6 +8500,11 @@ __export(exports_config, {
 });
 import { join as join8 } from "path";
 import { mkdir as mkdir3 } from "fs/promises";
+function assertNoConnectionSelectorOnV1(connectionName) {
+  if (connectionName === undefined)
+    return;
+  throw new ConfigError(`\u9023\u7DDA '${connectionName}' \u4E0D\u5B58\u5728\uFF1A\u6B64\u5C08\u6848\u4F7F\u7528\u55AE\u4E00\u9023\u7DDA (v1) \u8A2D\u5B9A\uFF0C\u6C92\u6709\u5177\u540D\u9023\u7DDA\u3002` + ` \u79FB\u9664 --use / DBCLI_CONNECTION\uFF0C\u6216\u6539\u7528 'dbcli init --conn-name <name>' \u5347\u7D1A\u70BA\u591A\u9023\u7DDA (v2) \u8A2D\u5B9A\u3002`);
+}
 function setGlobalConnectionName(name2) {
   _globalConnectionName = name2;
 }
@@ -8480,18 +8535,10 @@ async function getSchemaIsolationConnectionName(dbcliPath) {
 function isEnvReference(value) {
   return typeof value === "object" && value !== null && "$env" in value && typeof value.$env === "string";
 }
-function resolveEnvReferences(config, env, parentKey, strict = false) {
+function resolveEnvReferences(config, env, parentKey) {
   if (isEnvReference(config)) {
     const envKey = config.$env;
-    const value = env[envKey];
-    if (!value) {
-      if (!strict) {
-        return config;
-      }
-      throw new ConfigError(`Environment variable not defined: ${envKey}
-` + `Please set ${envKey} in .env or your environment.
-` + `Hint: check your .env file or run 'export ${envKey}=<value>'`);
-    }
+    const value = resolveEnvRef(config, parentKey ?? "<root>", env);
     if (parentKey === "port") {
       const portNum = parseInt(value, 10);
       if (isNaN(portNum) || portNum < 1 || portNum > 65535) {
@@ -8502,12 +8549,12 @@ function resolveEnvReferences(config, env, parentKey, strict = false) {
     return value;
   }
   if (Array.isArray(config)) {
-    return config.map((item) => resolveEnvReferences(item, env, parentKey, strict));
+    return config.map((item) => resolveEnvReferences(item, env, parentKey));
   }
   if (typeof config === "object" && config !== null) {
     const resolved = {};
     for (const [key, value] of Object.entries(config)) {
-      resolved[key] = resolveEnvReferences(value, env, key, strict);
+      resolved[key] = resolveEnvReferences(value, env, key);
     }
     return resolved;
   }
@@ -8520,9 +8567,10 @@ function parseEnvPassword(content) {
 var _globalConnectionName, DEFAULT_CONFIG, configModule;
 var init_config = __esm(() => {
   init_validation();
-  init_errors2();
+  init_errors3();
   init_config_v2();
   init_config_binding();
+  init_public();
   DEFAULT_CONFIG = {
     connection: {
       system: "postgresql",
@@ -8583,7 +8631,7 @@ var init_config = __esm(() => {
                   process.env.DBCLI_PASSWORD = legacyPassword;
                 }
               }
-              const resolvedConnection = resolveEnvReferences(resolved.connection, process.env, undefined, false);
+              const resolvedConnection = resolveEnvReferences(resolved.connection, process.env);
               if (!resolvedConnection.password && legacyPassword) {
                 resolvedConnection.password = legacyPassword;
               }
@@ -8620,7 +8668,8 @@ var init_config = __esm(() => {
                 redis: v2Config.redis
               });
             }
-            const resolvedConfig = resolveEnvReferences(config, process.env, undefined, false);
+            assertNoConnectionSelectorOnV1(effectiveConnectionName);
+            const resolvedConfig = resolveEnvReferences(config, process.env);
             const envPath = join8(storagePath, ".env.local");
             const envFile = Bun.file(envPath);
             if (await envFile.exists()) {
@@ -8636,9 +8685,10 @@ var init_config = __esm(() => {
         const file = Bun.file(path2);
         const exists = await file.exists();
         if (exists) {
+          assertNoConnectionSelectorOnV1(effectiveConnectionName);
           const content = await file.text();
           const raw = JSON.parse(content);
-          const resolved = resolveEnvReferences(raw, process.env, undefined, false);
+          const resolved = resolveEnvReferences(raw, process.env);
           return DbcliConfigSchema.parse(resolved);
         }
         return { ...DEFAULT_CONFIG };
@@ -8954,18 +9004,21 @@ var init_binder = __esm(() => {
 function applySnippetGuard(sqlBody, opts) {
   const trimmed = sqlBody.trim().replace(/;\s*$/, "");
   if (opts.noLimit)
-    return trimmed;
+    return { sql: trimmed };
   const masked = stripCommentsAndStrings(trimmed);
   const literal = matchOuterLiteralLimit(masked);
-  if (literal !== null && literal < GUARD_LIMIT)
-    return trimmed;
-  return `SELECT * FROM (${trimmed}) AS _dbcli_guard LIMIT ${GUARD_LIMIT}`;
+  if (literal !== null && literal < SNIPPET_GUARD_LIMIT)
+    return { sql: trimmed };
+  return {
+    sql: `SELECT * FROM (${trimmed}) AS _dbcli_guard LIMIT ${SNIPPET_GUARD_LIMIT + 1}`,
+    guardLimit: SNIPPET_GUARD_LIMIT
+  };
 }
 function matchOuterLiteralLimit(masked) {
   const m = masked.match(/\bLIMIT\s+(\d+)\s*$/i);
   return m ? parseInt(m[1], 10) : null;
 }
-var GUARD_LIMIT = 1000;
+var SNIPPET_GUARD_LIMIT = 1000;
 var init_size_guard = __esm(() => {
   init_parser();
 });
@@ -8999,11 +9052,12 @@ var init_sql = __esm(() => {
       if (rewritten.undeclared.length > 0) {
         warnings.push(`SQL references undeclared params: ${rewritten.undeclared.join(", ")}`);
       }
-      const wrapped = applySnippetGuard(rewritten.sql, { noLimit: opts.noLimit });
+      const guarded = applySnippetGuard(rewritten.sql, { noLimit: opts.noLimit });
       return {
-        driver: { sql: wrapped, values: rewritten.values },
+        driver: { sql: guarded.sql, values: rewritten.values },
         rewrittenBody: rewritten.sql,
-        warnings
+        warnings,
+        ...guarded.guardLimit !== undefined ? { guardLimit: guarded.guardLimit } : {}
       };
     }
   };
@@ -10469,6 +10523,15 @@ ${t("upgrade.failed")}`));
   });
 });
 
+// src/core/connection-selector.ts
+function createConnectionSelectorOption() {
+  return new Option("--use <connection>", CONNECTION_SELECTOR_DESCRIPTION);
+}
+var CONNECTION_SELECTOR_DESCRIPTION = "Use a specific named connection for this invocation (v2 config)";
+var init_connection_selector = __esm(() => {
+  init_esm();
+});
+
 // src/adapters/defaults.ts
 function getDefaultsForSystem(system) {
   switch (system) {
@@ -10567,7 +10630,7 @@ function parseEnvDatabase(env) {
   return null;
 }
 var init_env_parser = __esm(() => {
-  init_errors2();
+  init_errors3();
 });
 
 // node_modules/@inquirer/core/dist/lib/key.js
@@ -10575,7 +10638,7 @@ var isTabKey = (key) => key.name === "tab", isEnterKey = (key) => key.name === "
 
 // node_modules/@inquirer/core/dist/lib/errors.js
 var AbortPromptError, CancelPromptError, ExitPromptError, HookError, ValidationError;
-var init_errors3 = __esm(() => {
+var init_errors4 = __esm(() => {
   AbortPromptError = class AbortPromptError extends Error {
     name = "AbortPromptError";
     message = "Prompt was aborted";
@@ -10673,7 +10736,7 @@ function handleChange() {
 }
 var hookStorage, effectScheduler;
 var init_hook_engine = __esm(() => {
-  init_errors3();
+  init_errors4();
   hookStorage = new AsyncLocalStorage;
   effectScheduler = {
     queue(cb) {
@@ -12109,7 +12172,7 @@ var init_create_prompt = __esm(() => {
   init_screen_manager();
   init_promise_polyfill();
   init_hook_engine();
-  init_errors3();
+  init_errors4();
   import_mute_stream = __toESM(require_lib(), 1);
   nativeSetImmediate = globalThis.setImmediate;
 });
@@ -12121,7 +12184,7 @@ var init_dist5 = __esm(() => {
   init_use_keypress();
   init_make_theme();
   init_create_prompt();
-  init_errors3();
+  init_errors4();
 });
 
 // node_modules/@inquirer/confirm/dist/index.js
@@ -12457,6 +12520,8 @@ var init_capabilities = __esm(() => {
 
 // src/adapters/error-mapper.ts
 function mapError(error, system, options) {
+  if (error instanceof ConnectionError)
+    return error;
   const err = error;
   const errMsg = String(err?.message || String(error));
   const errCode = String(err?.code || "");
@@ -13136,7 +13201,7 @@ class MySQLAdapter {
         JOIN information_schema.KEY_COLUMN_USAGE kcu
           ON rc.CONSTRAINT_NAME = kcu.CONSTRAINT_NAME AND rc.TABLE_NAME = kcu.TABLE_NAME
         WHERE kcu.TABLE_NAME = ? AND rc.CONSTRAINT_SCHEMA = DATABASE()
-        GROUP BY rc.CONSTRAINT_NAME
+        GROUP BY rc.CONSTRAINT_NAME, rc.REFERENCED_TABLE_NAME
       `;
       const fkResult = await this.execute(fkQuery, [tableName]);
       const fkResults = fkResult.rows;
@@ -13375,13 +13440,14 @@ class MongoDBAdapter {
     let docs;
     if (Array.isArray(parsed)) {
       const stages = parsed;
-      const lastStage = stages[stages.length - 1];
-      const alreadyHasLimit = !!lastStage && typeof lastStage === "object" && "$limit" in lastStage;
-      const finalStages = typeof limit === "number" && limit > 0 && !alreadyHasLimit ? [...stages, { $limit: limit }] : stages;
+      const alreadyHasLimit = stages.some((stage) => stage !== null && typeof stage === "object" && ("$limit" in stage));
+      const limitedStages = typeof limit === "number" && limit > 0 && !alreadyHasLimit ? [...stages, { $limit: limit }] : stages;
+      const finalStages = options?.projection ? [...limitedStages, { $project: options.projection }] : limitedStages;
       docs = await collection.aggregate(finalStages).toArray();
     } else {
       const cap2 = typeof limit === "number" && limit > 0 ? limit : 0;
-      docs = await collection.find(parsed).limit(cap2).toArray();
+      const cursor = options?.projection ? collection.find(parsed, { projection: options.projection }) : collection.find(parsed);
+      docs = await cursor.limit(cap2).toArray();
     }
     return { rows: docs, affectedRows: docs.length };
   }
@@ -17303,6 +17369,35 @@ var init_json_formatter = __esm(() => {
 });
 
 // src/formatters/query-result-formatter.ts
+function truncateSerializedCell(serialized, limit) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new Error("Table cell truncation limit must be a positive integer");
+  }
+  const codePoints = Array.from(serialized);
+  if (codePoints.length <= limit)
+    return serialized;
+  const omitted = codePoints.length - limit;
+  return `${codePoints.slice(0, limit).join("")}\u2026(+${omitted} chars)`;
+}
+function toPublicQueryResult(result) {
+  const appliedLimit = result.appliedLimit;
+  const metadata = result.metadata || appliedLimit ? {
+    ...result.metadata,
+    ...appliedLimit ? {
+      truncated: appliedLimit.truncated,
+      limit_applied: appliedLimit.limitApplied
+    } : {}
+  } : undefined;
+  return {
+    rows: result.rows,
+    rowCount: result.rowCount,
+    columnNames: result.columnNames,
+    columnTypes: result.columnTypes,
+    executionTimeMs: result.executionTimeMs,
+    metadata
+  };
+}
+
 class QueryResultFormatter {
   format(result, options) {
     const format = options?.format || "table";
@@ -17313,10 +17408,10 @@ class QueryResultFormatter {
         return this.formatCSV(result);
       case "table":
       default:
-        return this.formatTable(result);
+        return this.formatTable(result, options?.truncate);
     }
   }
-  formatTable(result) {
+  formatTable(result, truncate) {
     if (result.rows.length === 0) {
       return this.formatEmptyTable(result);
     }
@@ -17325,18 +17420,11 @@ class QueryResultFormatter {
       style: { compact: false, "padding-left": 1, "padding-right": 1 }
     });
     result.rows.forEach((row) => {
-      table.push(result.columnNames.map((col) => this.cellToString(row[col])));
+      table.push(result.columnNames.map((col) => this.cellToString(row[col], truncate)));
     });
     let output = table.toString();
-    const footerLines = [];
-    footerLines.push(`Rows: ${result.rowCount}`);
-    if (result.executionTimeMs !== undefined) {
-      footerLines.push(`Execution time: ${result.executionTimeMs}ms`);
-    }
-    if (footerLines.length > 0) {
-      output += `
-` + footerLines.join(" | ");
-    }
+    output += `
+` + this.formatTableFooter(result);
     if (result.metadata?.securityNotification) {
       output += `
 ` + result.metadata.securityNotification;
@@ -17349,15 +17437,8 @@ class QueryResultFormatter {
       style: { compact: false, "padding-left": 1, "padding-right": 1 }
     });
     let output = table.toString();
-    const footerLines = [];
-    footerLines.push(`Rows: ${result.rowCount}`);
-    if (result.executionTimeMs !== undefined) {
-      footerLines.push(`Execution time: ${result.executionTimeMs}ms`);
-    }
-    if (footerLines.length > 0) {
-      output += `
-` + footerLines.join(" | ");
-    }
+    output += `
+` + this.formatTableFooter(result);
     if (result.metadata?.securityNotification) {
       output += `
 ` + result.metadata.securityNotification;
@@ -17366,23 +17447,29 @@ class QueryResultFormatter {
   }
   formatJSON(result, compact) {
     const spacing = compact ? undefined : 2;
-    const output = {
-      rows: result.rows,
-      rowCount: result.rowCount,
-      columnNames: result.columnNames,
-      columnTypes: result.columnTypes,
-      executionTimeMs: result.executionTimeMs,
-      metadata: result.metadata
-    };
-    return JSON.stringify(output, null, spacing);
+    return JSON.stringify(toPublicQueryResult(result), null, spacing);
+  }
+  formatTableFooter(result) {
+    const footerLines = [];
+    const appliedLimit = result.appliedLimit;
+    const rowsText = appliedLimit?.truncated ? `Rows: ${result.rowCount} (truncated; limit ${appliedLimit.limitApplied})` : `Rows: ${result.rowCount}`;
+    footerLines.push(rowsText);
+    if (result.executionTimeMs !== undefined) {
+      footerLines.push(`Execution time: ${result.executionTimeMs}ms`);
+    }
+    return footerLines.join(" | ");
   }
   formatCSV(result) {
+    const truncationNotice = result.appliedLimit?.truncated ? `# truncated; limit ${result.appliedLimit.limitApplied} \u2014 rerun with --no-limit or --limit N for the full result` : undefined;
     if (result.rows.length === 0) {
       let csvOutput = result.columnNames.map((name2) => this.escapeCSVField(name2)).join(",");
       if (result.metadata?.securityNotification) {
         csvOutput += `
 # ` + result.metadata.securityNotification;
       }
+      if (truncationNotice)
+        csvOutput += `
+` + truncationNotice;
       return csvOutput;
     }
     const lines = [];
@@ -17394,6 +17481,8 @@ class QueryResultFormatter {
     if (result.metadata?.securityNotification) {
       lines.push(`# ${result.metadata.securityNotification}`);
     }
+    if (truncationNotice)
+      lines.push(truncationNotice);
     return lines.join(`
 `);
   }
@@ -17408,17 +17497,20 @@ class QueryResultFormatter {
     }
     return str;
   }
-  cellToString(value) {
+  cellToString(value, truncate) {
     if (value === null || value === undefined) {
       return "";
     }
+    let serialized;
     if (typeof value === "object") {
-      return JSON.stringify(value);
+      serialized = JSON.stringify(value);
+    } else {
+      serialized = String(value);
     }
-    return String(value);
+    return typeof truncate === "number" ? truncateSerializedCell(serialized, truncate) : serialized;
   }
 }
-var Table2;
+var Table2, DEFAULT_TABLE_CELL_LIMIT = 120;
 var init_query_result_formatter = __esm(() => {
   Table2 = require_table();
 });
@@ -17438,60 +17530,49 @@ function requireSqlConnection(connection) {
   return connection;
 }
 async function listAction(options, command) {
+  validateFormat(options.format, ALLOWED_FORMATS, "list");
+  const config = await configModule.read(resolveConfigPath(command, options));
+  if (!config.connection) {
+    throw new Error("Database not configured. Run: dbcli init");
+  }
+  if (config.connection.system === "mongodb") {
+    return await mongoListBranch(config, options.format);
+  }
+  if (config.connection.system === "redis") {
+    return await redisListBranch(config, options.format);
+  }
+  if (config.connection.system === "elasticsearch") {
+    return await elasticsearchListBranch(config, options.format, options.includeSystem === true);
+  }
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
+  await adapter.connect();
   try {
-    validateFormat(options.format, ALLOWED_FORMATS, "list");
-    const config = await configModule.read(resolveConfigPath(command, options));
-    if (!config.connection) {
-      console.error("Database not configured. Run: dbcli init");
-      process.exit(1);
-    }
-    if (config.connection.system === "mongodb") {
-      return mongoListBranch(config, options.format);
-    }
-    if (config.connection.system === "redis") {
-      return redisListBranch(config, options.format);
+    const tables = await adapter.listTables();
+    if (tables.length === 0) {
+      console.log(t("list.no_tables"));
+      return;
     }
-    if (config.connection.system === "elasticsearch") {
-      return elasticsearchListBranch(config, options.format, options.includeSystem === true);
+    if (options.format === "json") {
+      const listOutput = tables.map((t2) => ({
+        name: t2.name,
+        columnCount: t2.columnCount ?? t2.columns.length,
+        rowCount: t2.rowCount ?? 0,
+        engine: t2.engine,
+        estimatedRowCount: t2.estimatedRowCount ?? t2.rowCount ?? 0,
+        tableType: t2.tableType ?? "table"
+      }));
+      console.log(JSON.stringify(listOutput, null, 2));
+    } else {
+      const formatter = new TableListFormatter;
+      console.log(formatter.format(tables));
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
-    await adapter.connect();
-    try {
-      const tables = await adapter.listTables();
-      if (tables.length === 0) {
-        console.log(t("list.no_tables"));
-        return;
-      }
-      if (options.format === "json") {
-        const listOutput = tables.map((t2) => ({
-          name: t2.name,
-          columnCount: t2.columnCount ?? t2.columns.length,
-          rowCount: t2.rowCount ?? 0,
-          engine: t2.engine,
-          estimatedRowCount: t2.estimatedRowCount ?? t2.rowCount ?? 0,
-          tableType: t2.tableType ?? "table"
-        }));
-        console.log(JSON.stringify(listOutput, null, 2));
-      } else {
-        const formatter = new TableListFormatter;
-        console.log(formatter.format(tables));
-      }
-      const tableCount = tables.filter((t2) => t2.tableType !== "view").length;
-      const viewCount = tables.filter((t2) => t2.tableType === "view").length;
-      const viewSuffix = viewCount > 0 ? ` (${viewCount} views)` : "";
-      console.log(`
+    const tableCount = tables.filter((t2) => t2.tableType !== "view").length;
+    const viewCount = tables.filter((t2) => t2.tableType === "view").length;
+    const viewSuffix = viewCount > 0 ? ` (${viewCount} views)` : "";
+    console.log(`
 \u2713 Found ${tableCount} tables${viewSuffix}`);
-    } finally {
-      await adapter.disconnect();
-    }
-  } catch (error) {
-    if (error instanceof Error) {
-      console.error(t_vars("errors.message", { message: error.message }));
-      if (error instanceof ConnectionError) {
-        error.hints.forEach((hint) => console.error(`   Hint: ${hint}`));
-      }
-    }
-    process.exit(1);
+  } finally {
+    await adapter.disconnect();
   }
 }
 async function mongoListBranch(config, format) {
@@ -17583,8 +17664,9 @@ var init_list = __esm(() => {
   init_formatters();
   init_config();
   init_validation();
+  init_connection_selector();
   ALLOWED_FORMATS = ["table", "json"];
-  listCommand = new Command().name("list").description("List all tables in the database with metadata").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").option("--include-system", "Elasticsearch only: include system indices whose names start with dot", false).action(listAction);
+  listCommand = new Command().name("list").description("List all tables in the database with metadata").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).option("--include-system", "Elasticsearch only: include system indices whose names start with dot", false).action(listAction);
 });
 
 // src/core/schema-diff.ts
@@ -17982,6 +18064,180 @@ var init_blacklist = __esm(() => {
   };
 });
 
+// src/core/field-projection.ts
+function parseFieldSelection(raw) {
+  if (raw === undefined)
+    return;
+  const tokens = raw.split(",").map((token) => token.trim());
+  if (tokens.length === 0 || tokens.some((token) => token === "")) {
+    throw new Error("--fields must not contain empty fields");
+  }
+  let mode;
+  const paths = [];
+  const seen = new Set;
+  for (const token of tokens) {
+    const tokenMode = token.startsWith("-") ? "exclude" : "include";
+    const path4 = tokenMode === "exclude" ? token.slice(1) : token;
+    if (path4 === "")
+      throw new Error("--fields exclusion requires a field name after -");
+    if (mode !== undefined && mode !== tokenMode) {
+      throw new Error("--fields cannot mix included and excluded fields");
+    }
+    validatePath(path4);
+    if (seen.has(path4))
+      throw new Error(`--fields contains duplicate field: ${path4}`);
+    mode = tokenMode;
+    seen.add(path4);
+    paths.push(path4);
+  }
+  if (!mode || paths.length === 0)
+    throw new Error("--fields must contain at least one field");
+  return { mode, paths };
+}
+function projectRows(rows, selection) {
+  if (selection.mode === "include") {
+    return {
+      rows: rows.map((row) => {
+        const projected = {};
+        for (const path4 of selection.paths) {
+          const result = readPath(row, path4.split("."));
+          defineData(projected, path4, result.found ? result.value ?? null : null);
+        }
+        return projected;
+      }),
+      columnNames: [...selection.paths]
+    };
+  }
+  const projectedRows = omitFieldPaths(rows, selection.paths);
+  const columnNames = collectColumnNames(projectedRows);
+  return { rows: normalizeRows(projectedRows, columnNames), columnNames };
+}
+function hasFieldPath(row, path4) {
+  return readPath(row, path4.split(".")).found;
+}
+function omitFieldPaths(rows, paths) {
+  return rows.map((row) => {
+    let projected = cloneRecord(row);
+    for (const path4 of paths)
+      projected = omitPath(projected, path4.split("."));
+    return projected;
+  });
+}
+function toMongoProjection(selection) {
+  const projection = {};
+  const value = selection.mode === "include" ? 1 : 0;
+  for (const path4 of selection.paths)
+    defineData(projection, path4, value);
+  if (selection.mode === "include" && !selection.paths.includes("_id")) {
+    defineData(projection, "_id", 0);
+  }
+  return projection;
+}
+function validatePath(path4) {
+  const segments = path4.split(".");
+  if (segments.some((segment) => segment === "")) {
+    throw new Error(`--fields contains an invalid dotted path: ${path4}`);
+  }
+  const unsafe = segments.find((segment) => UNSAFE_SEGMENTS.has(segment));
+  if (unsafe)
+    throw new Error(`--fields contains an unsafe field segment: ${unsafe}`);
+}
+function readPath(value, segments) {
+  if (segments.length === 0)
+    return { found: true, value };
+  if (Array.isArray(value)) {
+    const results = value.map((item) => readPath(item, segments));
+    return {
+      found: results.some((result) => result.found),
+      value: results.map((result) => result.found ? result.value : undefined)
+    };
+  }
+  if (!isRecord(value))
+    return { found: false };
+  const exactPath = segments.join(".");
+  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
+    return { found: true, value: value[exactPath] };
+  }
+  const [head, ...tail] = segments;
+  if (!Object.prototype.hasOwnProperty.call(value, head))
+    return { found: false };
+  return readPath(value[head], tail);
+}
+function omitPath(value, segments) {
+  if (segments.length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitPath(item, segments));
+  if (!isPlainRecord(value))
+    return value;
+  const exactPath = segments.join(".");
+  const [head, ...tail] = segments;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (key === exactPath)
+      continue;
+    if (key === head) {
+      if (tail.length > 0)
+        defineData(out, key, omitPath(child, tail));
+      continue;
+    }
+    defineData(out, key, child);
+  }
+  return out;
+}
+function cloneRecord(value, omittedKey) {
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (key !== omittedKey)
+      defineData(out, key, child);
+  }
+  return out;
+}
+function collectColumnNames(rows) {
+  const names = [];
+  const seen = new Set;
+  for (const row of rows) {
+    for (const name2 of Object.keys(row)) {
+      if (!seen.has(name2)) {
+        seen.add(name2);
+        names.push(name2);
+      }
+    }
+  }
+  return names;
+}
+function normalizeRows(rows, columnNames) {
+  return rows.map((row) => {
+    const normalized = {};
+    for (const column of columnNames) {
+      const value = Object.prototype.hasOwnProperty.call(row, column) ? row[column] : null;
+      defineData(normalized, column, value ?? null);
+    }
+    return normalized;
+  });
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isPlainRecord(value) {
+  if (!isRecord(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function defineData(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
+var UNSAFE_SEGMENTS;
+var init_field_projection = __esm(() => {
+  UNSAFE_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+});
+
 // src/core/blacklist-validator.ts
 class BlacklistValidator {
   manager;
@@ -18034,19 +18290,11 @@ class BlacklistValidator {
     if (blacklistedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }
-    const omittedColumns = columnList.filter((col) => blacklistedColumns.includes(col));
+    const omittedColumns = blacklistedColumns.filter((path4) => columnList.includes(path4) || rows.some((row) => hasFieldPath(row, path4)));
     if (omittedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }
-    const filteredRows = rows.map((row) => {
-      const newRow = {};
-      for (const [key, value] of Object.entries(row)) {
-        if (!omittedColumns.includes(key)) {
-          newRow[key] = value;
-        }
-      }
-      return newRow;
-    });
+    const filteredRows = omitFieldPaths(rows, omittedColumns);
     return { filteredRows, omittedColumns };
   }
   buildSecurityNotification(_tableName, omittedColumns) {
@@ -18061,6 +18309,7 @@ class BlacklistValidator {
 var init_blacklist_validator = __esm(() => {
   init_blacklist();
   init_message_loader();
+  init_field_projection();
 });
 
 // src/core/verification/types.ts
@@ -18216,13 +18465,26 @@ var init_artifact_writer = () => {};
 
 // src/utils/redaction.ts
 function optionParts(token) {
+  if (token.startsWith("-f") && !token.startsWith("--") && token.length > 2) {
+    return { name: "-f", inlineValue: token.slice(2) };
+  }
   const equals = token.indexOf("=");
   return equals === -1 ? { name: token, inlineValue: undefined } : { name: token.slice(0, equals), inlineValue: token.slice(equals + 1) };
 }
+function isOptionToken(token) {
+  return token.startsWith("--") || token.startsWith("-f");
+}
+function isKnownBooleanFlag(command, name2) {
+  if (command === "lint")
+    return LINT_BOOLEAN_FLAGS.has(name2);
+  if (command === "query")
+    return QUERY_BOOLEAN_FLAGS.has(name2);
+  return false;
+}
 function findSensitiveSubcommand(argv) {
   for (let index = 1;index < argv.length; index++) {
     const token = argv[index];
-    if (token.startsWith("--")) {
+    if (isOptionToken(token)) {
       const { name: name2, inlineValue } = optionParts(token);
       if (inlineValue === undefined && (REDACTED_VALUE_FLAGS.has(name2) || KEEP_VALUE_FLAGS.has(name2))) {
         index++;
@@ -18245,7 +18507,7 @@ function sensitiveArgvValues(argv) {
       afterEndOfOptions = true;
       continue;
     }
-    if (!afterEndOfOptions && token.startsWith("--")) {
+    if (!afterEndOfOptions && isOptionToken(token)) {
       const { name: name2, inlineValue } = optionParts(token);
       if (REDACTED_VALUE_FLAGS.has(name2)) {
         const value = inlineValue ?? argv[index + 1];
@@ -18264,7 +18526,7 @@ function sensitiveArgvValues(argv) {
           index++;
       } else if (inlineValue === undefined && KEEP_VALUE_FLAGS.has(name2)) {
         index++;
-      } else if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name2)) {
+      } else if (isKnownBooleanFlag(sensitiveCommand?.command, name2)) {
         continue;
       } else if (!sensitiveCommand || index < sensitiveCommand.index) {
         continue;
@@ -18295,7 +18557,7 @@ function redactArgv(argv) {
       afterEndOfOptions = true;
       continue;
     }
-    if (!afterEndOfOptions && tok.startsWith("--")) {
+    if (!afterEndOfOptions && isOptionToken(tok)) {
       const { name: name2, inlineValue } = optionParts(tok);
       if (REDACTED_VALUE_FLAGS.has(name2)) {
         out.push(`${name2} <redacted>`);
@@ -18314,7 +18576,7 @@ function redactArgv(argv) {
         }
         continue;
       }
-      if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name2)) {
+      if (isKnownBooleanFlag(sensitiveCommand?.command, name2)) {
         out.push(tok);
         continue;
       }
@@ -18346,7 +18608,7 @@ function redactSql(sql) {
   const redacted = sql.replace(/\$(\w*)\$[\s\S]*?\$\1\$/g, "'?'").replace(/(['"])(?:(?!\1|\\).|\\.)*\1/g, "'?'").replace(/\b\d+(\.\d+)?\b/g, "0");
   return redactSensitive(redacted);
 }
-var SQL_SUBCOMMANDS, REDACTED_VALUE_FLAGS, KEEP_VALUE_FLAGS, LINT_BOOLEAN_FLAGS;
+var SQL_SUBCOMMANDS, REDACTED_VALUE_FLAGS, KEEP_VALUE_FLAGS, LINT_BOOLEAN_FLAGS, QUERY_BOOLEAN_FLAGS;
 var init_redaction = __esm(() => {
   SQL_SUBCOMMANDS = new Set(["query", "export", "lint"]);
   REDACTED_VALUE_FLAGS = new Set([
@@ -18360,7 +18622,9 @@ var init_redaction = __esm(() => {
     "--password",
     "--token",
     "--secret",
-    "--bulk"
+    "--bulk",
+    "--query-file",
+    "-f"
   ]);
   KEEP_VALUE_FLAGS = new Set([
     "--format",
@@ -18369,9 +18633,12 @@ var init_redaction = __esm(() => {
     "--output",
     "--limit",
     "--collection",
-    "--index"
+    "--index",
+    "--fields",
+    "--truncate"
   ]);
   LINT_BOOLEAN_FLAGS = new Set(["--no-schema", "--recovery"]);
+  QUERY_BOOLEAN_FLAGS = new Set(["--ui", "--no-limit", "--no-truncate", "--recovery"]);
 });
 
 // src/core/verification/assert-artifact.ts
@@ -19387,9 +19654,9 @@ var init_engine_hints = __esm(() => {
 });
 
 // src/core/audit/integration-helper.ts
-async function getAuditLogger(config, configPath) {
+async function getAuditLogger(config, configPath, connectionName) {
   const storagePath = await resolveConfigStoragePath(configPath);
-  const connName = config.effectiveConnectionName || getGlobalConnectionName() || "default";
+  const connName = connectionName || config.effectiveConnectionName || getGlobalConnectionName() || "default";
   const key = `${storagePath}:${connName}`;
   if (!_loggers.has(key)) {
     if (!_sessionIdService) {
@@ -19410,7 +19677,7 @@ async function getAuditLogger(config, configPath) {
 }
 async function writeAuditEntry(config, commandName, options, outcome) {
   try {
-    const logger = await getAuditLogger(config, options.config || ".dbcli");
+    const logger = await getAuditLogger(config, options.config || ".dbcli", typeof options.connectionName === "string" ? options.connectionName : undefined);
     const engine = config.connection?.system || "postgresql";
     const target = outcome.target || getOperationTarget(engine, commandName, options, outcome.sql);
     let tier = getEngineCapability(engine, commandName).tier;
@@ -20029,24 +20296,48 @@ function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
 }
-function stripCommentsAndStrings2(sql) {
+function stripCommentsAndStrings2(sql, options = {}) {
   let result = "";
   let i = 0;
   while (i < sql.length) {
     const char = sql[i];
-    if (char === "-" && sql[i + 1] === "-") {
+    const mysqlDialect = options.dialect === "mysql" || options.dialect === "mariadb";
+    const dashFollowerCode = sql.charCodeAt(i + 2);
+    const dashStartsComment = char === "-" && sql[i + 1] === "-" && (!mysqlDialect || sql[i + 2] === undefined || dashFollowerCode <= 32 || dashFollowerCode === 127);
+    if (dashStartsComment) {
       while (i < sql.length && sql[i] !== `
 `) {
         i++;
       }
       if (i < sql.length) {
         result += `
+`;
+        i++;
+      }
+      continue;
+    }
+    if (mysqlDialect && char === "#") {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      if (i < sql.length) {
+        result += `
 `;
         i++;
       }
       continue;
     }
     if (char === "/" && sql[i + 1] === "*") {
+      const executableMysqlComment = mysqlDialect && (sql.startsWith("/*!", i) || sql.startsWith("/*M!", i));
+      if (executableMysqlComment) {
+        const prefixLength = sql.startsWith("/*M!", i) ? 4 : 3;
+        const closingIndex = sql.indexOf("*/", i + prefixLength);
+        const bodyEnd = closingIndex === -1 ? sql.length : closingIndex;
+        const executableBody = sql.slice(i + prefixLength, bodyEnd).replace(/^\d+/, " ");
+        result += " " + stripCommentsAndStrings2(executableBody, options) + " ";
+        i = closingIndex === -1 ? sql.length : closingIndex + 2;
+        continue;
+      }
       i += 2;
       while (i < sql.length) {
         if (sql[i] === "*" && sql[i + 1] === "/") {
@@ -20058,16 +20349,51 @@ function stripCommentsAndStrings2(sql) {
       result += " ";
       continue;
     }
-    if (char === "'" || char === '"') {
-      const quote = char;
+    if (options.dialect === "postgresql" && char === "$") {
+      const delimiter = sql.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0];
+      if (delimiter) {
+        i += delimiter.length;
+        const closingIndex = sql.indexOf(delimiter, i);
+        i = closingIndex === -1 ? sql.length : closingIndex + delimiter.length;
+        result += " ";
+        continue;
+      }
+    }
+    if (mysqlDialect && char === "`") {
       i++;
-      while (i < sql.length && sql[i] !== quote) {
-        if (sql[i] === "\\") {
+      while (i < sql.length) {
+        if (sql[i] === "`") {
+          if (sql[i + 1] === "`") {
+            i += 2;
+            continue;
+          }
           i++;
+          break;
         }
         i++;
       }
-      if (i < sql.length) {
+      result += " ";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      const quote = char;
+      const quoteIndex = i;
+      const postgresEscapeString = options.dialect === "postgresql" && quote === "'" && /[eE]/.test(sql[quoteIndex - 1] ?? "") && !/[A-Za-z0-9_$]/.test(sql[quoteIndex - 2] ?? "");
+      const backslashEscapes = options.dialect === undefined || postgresEscapeString;
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === quote) {
+          if (sql[i + 1] === quote) {
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          i += 2;
+          continue;
+        }
         i++;
       }
       result += " ";
@@ -21625,7 +21951,7 @@ function parseJsonSafely(text2) {
     return;
   }
 }
-function readPath(obj, path4) {
+function readPath2(obj, path4) {
   let cur = obj;
   for (const key of path4) {
     if (cur === null || cur === undefined || typeof cur !== "object")
@@ -21638,14 +21964,14 @@ function checkTruthyPath(text2, path4) {
   const obj = parseJsonSafely(text2);
   if (obj === undefined)
     return false;
-  const v = readPath(obj, path4);
+  const v = readPath2(obj, path4);
   return v !== null && v !== undefined && v !== "" && v !== false;
 }
 function checkExactValue(text2, path4, expected) {
   const obj = parseJsonSafely(text2);
   if (obj === undefined)
     return false;
-  return readPath(obj, path4) === expected;
+  return readPath2(obj, path4) === expected;
 }
 
 // src/core/recovery/apply-verify.ts
@@ -22144,15 +22470,13 @@ async function schemaAction(table, options, command) {
     const storagePath = await resolveConfigStoragePath(configPath);
     config = await configModule.read(configPath);
     if (!config.connection) {
-      console.error("Database not configured. Run: dbcli init");
-      process.exit(1);
+      throw new Error("Database not configured. Run: dbcli init");
     }
     let inferenceOptions;
     if (options.sampleSize !== undefined) {
       const parsed = Number(options.sampleSize);
       if (!Number.isFinite(parsed) || parsed < 1) {
-        console.error(`--sample-size must be a positive integer (received ${options.sampleSize})`);
-        process.exit(1);
+        throw new Error(`--sample-size must be a positive integer (received ${options.sampleSize})`);
       }
       if (config.connection.system === "mongodb") {
         inferenceOptions = { sampleSize: Math.floor(parsed) };
@@ -22162,8 +22486,7 @@ async function schemaAction(table, options, command) {
     }
     if (options.sampleMethod && options.sampleMethod !== "random") {
       if (options.sampleMethod !== "natural") {
-        console.error(`--sample-method must be 'random' or 'natural' (received '${options.sampleMethod}')`);
-        process.exit(1);
+        throw new Error(`--sample-method must be 'random' or 'natural' (received '${options.sampleMethod}')`);
       }
       if (config.connection.system === "mongodb") {
         inferenceOptions = { ...inferenceOptions ?? {}, sampleMethod: "natural" };
@@ -22185,12 +22508,10 @@ async function schemaAction(table, options, command) {
     }
     if (config.connection.system === "redis") {
       if (options.reset || options.refresh) {
-        console.error("schema --reset/--refresh is not supported for Redis connections.");
-        process.exit(1);
+        throw new Error("schema --reset/--refresh is not supported for Redis connections.");
       }
       if (!table) {
-        console.error("Redis schema inspection requires a key name: dbcli schema <key>");
-        process.exit(1);
+        throw new Error("Redis schema inspection requires a key name: dbcli schema <key>");
       }
       const redisAdapter = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? []);
       await redisAdapter.connect();
@@ -22284,13 +22605,7 @@ Key: ${schema.name}`);
       const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
       emitRecoveryEnvelope2(error, { operation: "schema", table }, { envelopeId, auditRef: auditId ?? undefined });
     }
-    if (error instanceof Error) {
-      console.error(t_vars("errors.message", { message: error.message }));
-      if (error instanceof ConnectionError) {
-        error.hints.forEach((hint) => console.error(`   Hint: ${hint}`));
-      }
-    }
-    process.exit(1);
+    throw error;
   }
 }
 async function handleSingleTableSchema(adapter, tableName, format, inferenceOptions, mongoMeta) {
@@ -22554,9 +22869,45 @@ var init_schema = __esm(() => {
   init_core();
   init_integration_helper();
   init_validation();
+  init_connection_selector();
   init_error_suggester();
   ALLOWED_FORMATS2 = ["table", "json"];
-  schemaCommand = new Command().name("schema").description("Display table schema, scan database schema, or refresh existing schema with detected changes").argument("[table]", "Optional: table name to inspect (if omitted, scans all tables)").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").option("--refresh", "Refresh schema by detecting changes from database", false).option("--reset", "Clear all existing schema data and re-fetch from database", false).option("--force", "Skip confirmation when updating schema data", false).option("--sample-size <n>", "MongoDB only: number of documents to sample for schema inference (default 50, max 1000). Ignored on SQL connections.").option("--sample-method <method>", 'MongoDB only: "random" (default, uses $sample) or "natural" (uses find().limit()). Ignored on SQL connections.', "random").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(schemaAction);
+  schemaCommand = new Command().name("schema").description("Display table schema, scan database schema, or refresh existing schema with detected changes").argument("[table]", "Optional: table name to inspect (if omitted, scans all tables)").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).option("--refresh", "Refresh schema by detecting changes from database", false).option("--reset", "Clear all existing schema data and re-fetch from database", false).option("--force", "Skip confirmation when updating schema data", false).option("--sample-size <n>", "MongoDB only: number of documents to sample for schema inference (default 50, max 1000). Ignored on SQL connections.").option("--sample-method <method>", 'MongoDB only: "random" (default, uses $sample) or "natural" (uses find().limit()). Ignored on SQL connections.', "random").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(schemaAction);
+});
+
+// src/formatters/multi-query-result-formatter.ts
+class MultiQueryResultFormatter {
+  format(outcomes, options) {
+    if (options.format === "json") {
+      return JSON.stringify({
+        results: outcomes.map((outcome) => outcome.status === "ok" ? {
+          connection: outcome.connection,
+          status: outcome.status,
+          ...toPublicQueryResult(outcome.result)
+        } : outcome)
+      }, null, 2);
+    }
+    const formatter = new QueryResultFormatter;
+    return outcomes.map((outcome) => {
+      const heading = `Connection: ${outcome.connection} [${outcome.status}]`;
+      if (outcome.status === "ok") {
+        return `${heading}
+${formatter.format(outcome.result, {
+          format: "table",
+          truncate: options.truncate
+        })}`;
+      }
+      const prefix = outcome.error.code ? `${outcome.error.code}: ` : "";
+      const hints = outcome.error.hints.map((hint) => `Hint: ${hint}`);
+      return [heading, `${prefix}${outcome.error.message}`, ...hints].join(`
+`);
+    }).join(`
+
+`);
+  }
+}
+var init_multi_query_result_formatter = __esm(() => {
+  init_query_result_formatter();
 });
 
 // src/formatters/html-formatter.ts
@@ -22594,6 +22945,9 @@ var init_opener = () => {};
 // src/core/limits.ts
 var DEFAULT_QUERY_ONLY_LIMIT = 1000;
 
+// src/core/applied-limit.ts
+var init_applied_limit = () => {};
+
 // src/core/query-executor.ts
 class QueryExecutor {
   adapter;
@@ -22601,6 +22955,7 @@ class QueryExecutor {
   blacklistValidator;
   config;
   options;
+  pendingDiagnostics = [];
   constructor(adapter, permission, blacklistValidator, config, options = {}) {
     this.adapter = adapter;
     this.permission = permission;
@@ -22608,19 +22963,31 @@ class QueryExecutor {
     this.config = config;
     this.options = options;
   }
+  takeDiagnostics() {
+    const diagnostics = this.pendingDiagnostics;
+    this.pendingDiagnostics = [];
+    return diagnostics;
+  }
   async execute(sql, options) {
     const start = performance.now();
+    this.pendingDiagnostics = [];
     try {
       const classification = enforcePermission(sql, this.permission);
-      if (classification.isDangerous && this.permission === "admin") {
-        console.error(`\u26A0 Warning: executing ${classification.type} operation (admin mode)`);
-      }
+      const dangerousOperationWarning = classification.isDangerous && this.permission === "admin" ? `\u26A0 Warning: executing ${classification.type} operation (admin mode)` : undefined;
       const AUTO_LIMIT_TYPES = new Set(["SELECT"]);
       let executeSql = sql;
-      if (this.permission === "query-only" && AUTO_LIMIT_TYPES.has(classification.type) && !executeSql.match(/LIMIT\s+\d+/i) && options?.autoLimit !== false) {
-        const limitValue = options?.limitValue || DEFAULT_QUERY_ONLY_LIMIT;
-        executeSql = `${executeSql} LIMIT ${limitValue}`;
-        console.error(`Query-only mode: auto-limiting to ${limitValue} rows`);
+      let appliedLimit;
+      let autoLimitWarning;
+      if (AUTO_LIMIT_TYPES.has(classification.type) && !hasUserAuthoredLimit(executeSql) && options?.autoLimit !== false) {
+        const requestedLimit = options?.limitValue ?? (this.permission === "query-only" ? DEFAULT_QUERY_ONLY_LIMIT : undefined);
+        if (requestedLimit !== undefined) {
+          const fetchLimit = requestedLimit + (options?.detectTruncation === true ? 1 : 0);
+          appliedLimit = options?.detectTruncation === true ? requestedLimit : undefined;
+          executeSql = `${executeSql.replace(/;\s*$/, "")} LIMIT ${fetchLimit}`;
+          if (options?.limitValue === undefined && this.permission === "query-only") {
+            autoLimitWarning = `Query-only mode: auto-limiting to ${requestedLimit} rows`;
+          }
+        }
       }
       if (this.blacklistValidator) {
         const tableName = extractTableName(sql);
@@ -22630,26 +22997,39 @@ class QueryExecutor {
       }
       const resultData = await this.adapter.execute(executeSql);
       const executionTimeMs = Math.round(performance.now() - start);
-      const rows = resultData.rows;
+      const limitedResult = appliedLimit === undefined ? undefined : trimAppliedLimit(resultData.rows, appliedLimit);
+      const rows = limitedResult?.rows ?? resultData.rows;
       const affectedRows = resultData.affectedRows;
+      const visibleAffectedRows = limitedResult ? rows.length : affectedRows;
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
-      const columnTypes = columnNames.map((col) => {
-        const value = rows[0]?.[col];
-        return inferColumnType(value);
-      });
       let filteredRows = rows;
       let securityNotification;
+      let omittedColumns = [];
       if (this.blacklistValidator) {
         const tableName = extractTableName(sql);
         if (tableName) {
           const filterResult = this.blacklistValidator.filterColumns(tableName, rows, columnNames);
           filteredRows = filterResult.filteredRows;
           if (filterResult.omittedColumns.length > 0) {
+            omittedColumns = filterResult.omittedColumns;
             columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
             securityNotification = this.blacklistValidator.buildSecurityNotification(tableName, filterResult.omittedColumns);
           }
         }
       }
+      if (options?.fieldSelection) {
+        const fieldSelection = options.fieldSelection.mode === "include" ? {
+          mode: "include",
+          paths: options.fieldSelection.paths.filter((path4) => !omittedColumns.some((omitted) => path4 === omitted || path4.startsWith(`${omitted}.`)))
+        } : options.fieldSelection;
+        const projection = projectRows(filteredRows, fieldSelection);
+        filteredRows = projection.rows;
+        columnNames = projection.columnNames;
+      }
+      const columnTypes = columnNames.map((column) => {
+        const value = filteredRows.find((row) => row[column] !== undefined)?.[column];
+        return inferColumnType(value);
+      });
       const result = {
         rows: filteredRows,
         rowCount: filteredRows.length,
@@ -22658,20 +23038,30 @@ class QueryExecutor {
         executionTimeMs,
         metadata: {
           statement: classification.type,
-          affectedRows,
+          affectedRows: visibleAffectedRows,
           ...securityNotification ? { securityNotification } : {}
-        }
+        },
+        ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
       };
       if (this.config) {
         await writeAuditEntry(this.config, "query", this.options, {
           success: true,
           sql,
           metadata: {
-            rows_affected: affectedRows,
+            rows_affected: visibleAffectedRows,
             execution_ms: executionTimeMs
           }
         });
       }
+      if (this.options.recovery !== true) {
+        const diagnostics = [dangerousOperationWarning, autoLimitWarning].filter((diagnostic) => diagnostic !== undefined);
+        if (this.options.deferDiagnostics === true) {
+          this.pendingDiagnostics = diagnostics;
+        } else {
+          for (const diagnostic of diagnostics)
+            console.error(diagnostic);
+        }
+      }
       return result;
     } catch (error) {
       if (this.config) {
@@ -22705,6 +23095,10 @@ class QueryExecutor {
     }
   }
 }
+function hasUserAuthoredLimit(sql) {
+  const executableSql = stripCommentsAndStrings2(sql).replace(/`(?:``|[^`])*`/g, " ");
+  return /\bLIMIT\s+(?:\(\s*)?(?:\d+|ALL\b|\?|\$\d+|:[A-Za-z_][A-Za-z0-9_]*)/i.test(executableSql);
+}
 function inferColumnType(value) {
   if (value === null || value === undefined) {
     return "null";
@@ -22727,7 +23121,9 @@ var init_query_executor = __esm(() => {
   init_permission_guard();
   init_error_suggester();
   init_engine_hints();
+  init_applied_limit();
   init_integration_helper();
+  init_field_projection();
 });
 
 // src/core/mongo/field-masker.ts
@@ -22783,6 +23179,152 @@ function findCaseInsensitive(columns, name2) {
 var REDACTED2 = "[REDACTED]";
 var init_field_masker = () => {};
 
+// src/core/query-input.ts
+function trimOuterWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end) {
+    const character = String.fromCodePoint(value.codePointAt(start));
+    if (character === "\uFEFF" || !WHITESPACE.test(character))
+      break;
+    start += character.length;
+  }
+  while (end > start) {
+    const codePoint = value.codePointAt(end - 1);
+    const character = String.fromCodePoint(codePoint);
+    if (character === "\uFEFF" || !WHITESPACE.test(character))
+      break;
+    end -= character.length;
+  }
+  return value.slice(start, end);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function resolveQueryInput(sources, readers = defaultReaders) {
+  const hasPositional = sources.positional !== undefined;
+  const hasQueryFile = sources.queryFile !== undefined;
+  if (hasPositional && hasQueryFile) {
+    throw new Error("Query source conflict: provide either positional query text or --query-file <path>, not both");
+  }
+  if (!hasPositional && !hasQueryFile) {
+    throw new Error("Exactly one query source is required: provide positional query text or --query-file <path>");
+  }
+  let input;
+  if (hasPositional) {
+    input = sources.positional;
+  } else if (sources.queryFile === "-") {
+    if (readers.stdinIsInteractive?.() === true) {
+      throw new Error("Reading the query from stdin requires piped input; pipe the query in or use --query-file <path>");
+    }
+    try {
+      input = await readers.readStdin();
+    } catch (error) {
+      throw new Error(`Failed to read query from stdin: ${errorMessage(error)}`);
+    }
+  } else {
+    const path4 = sources.queryFile;
+    try {
+      input = await readers.readFile(path4);
+    } catch (error) {
+      throw new Error(`Failed to read query file "${path4}": ${errorMessage(error)}`);
+    }
+  }
+  const withoutBom = input.startsWith("\uFEFF") ? input.slice(1) : input;
+  const query = trimOuterWhitespace(withoutBom);
+  if (query.length === 0) {
+    throw new Error("Query input is empty");
+  }
+  return query;
+}
+var defaultReaders, WHITESPACE;
+var init_query_input = __esm(() => {
+  defaultReaders = {
+    readFile: (path4) => Bun.file(path4).text(),
+    readStdin: () => Bun.stdin.text(),
+    stdinIsInteractive: () => {
+      try {
+        return process.stdin.isTTY === true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  WHITESPACE = /\s/u;
+});
+
+// src/utils/cli-error.ts
+function mapCliError(error, includeStack = false) {
+  const candidate = error !== null && (typeof error === "object" || typeof error === "function") ? error : undefined;
+  const message = typeof candidate?.message === "string" && candidate.message.trim() !== "" ? candidate.message : typeof error === "string" && error.trim() !== "" ? error : "An unexpected error occurred";
+  const code = typeof candidate?.code === "string" || typeof candidate?.code === "number" ? String(candidate.code) : undefined;
+  const hints = Array.isArray(candidate?.hints) ? candidate.hints.filter((hint) => typeof hint === "string" && hint !== "") : [];
+  const stack = includeStack && typeof candidate?.stack === "string" && candidate.stack !== "" ? candidate.stack : undefined;
+  return { message, ...code && { code }, hints, ...stack && { stack } };
+}
+function formatCliError(presentation) {
+  const lines = [presentation.message];
+  if (presentation.code)
+    lines.push(`Code: ${presentation.code}`);
+  for (const hint of presentation.hints)
+    lines.push(`Hint: ${hint}`);
+  if (presentation.stack)
+    lines.push("Stack:", presentation.stack);
+  return lines.join(`
+`);
+}
+function presentCliError(error) {
+  const includeStack = getLogger().level >= 2 /* VERBOSE */;
+  process.stderr.write(`${formatCliError(mapCliError(error, includeStack))}
+`);
+}
+function printLocalizedCliError(message, error) {
+  console.error(message);
+  const stack = mapCliError(error, getLogger().level >= 2 /* VERBOSE */).stack;
+  if (stack)
+    console.error(`Stack:
+${stack}`);
+}
+var init_cli_error = __esm(() => {
+  init_logger();
+});
+
+// src/core/query-fanout.ts
+async function runQueryFanOut(connectionNames, execute) {
+  const settled = await Promise.allSettled(connectionNames.map((name2) => execute(name2)));
+  return settled.map((outcome, index) => {
+    const connection = connectionNames[index];
+    return outcome.status === "fulfilled" ? { connection, status: "ok", result: outcome.value } : { connection, status: "error", error: mapCliError(outcome.reason) };
+  });
+}
+function aggregateFanOutExitCode(outcomes) {
+  const successCount = outcomes.filter((outcome) => outcome.status === "ok").length;
+  if (successCount === outcomes.length)
+    return 0;
+  if (successCount === 0)
+    return 1;
+  return 2;
+}
+function assertFanOutReadOnlySql(sql, dialect) {
+  const classification = enforcePermission(sql, "query-only");
+  const executableSql = stripCommentsAndStrings2(sql, { dialect });
+  const statements = executableSql.split(";").map((statement) => statement.trim()).filter(Boolean);
+  if (statements.length !== 1) {
+    throw new Error("Multi-connection SQL must contain exactly one read-only statement");
+  }
+  const containsWrite = SQL_WRITE_OR_DDL_KEYWORDS.test(executableSql);
+  const explainExecutes = classification.type === "EXPLAIN" && /\bANALYZE\b/i.test(executableSql);
+  if (classification.type === "SELECT" && containsWrite || explainExecutes && containsWrite) {
+    throw new Error("Multi-connection SQL must be proven read-only before any connection executes");
+  }
+}
+var SQL_WRITE_OR_DDL_KEYWORDS;
+var init_query_fanout = __esm(() => {
+  init_cli_error();
+  init_permission_guard();
+  SQL_WRITE_OR_DDL_KEYWORDS = /\b(INSERT|UPDATE|DELETE|MERGE|UPSERT|REPLACE|TRUNCATE|DROP|ALTER|CREATE|GRANT|REVOKE|RENAME|INTO)\b/i;
+});
+
 // src/commands/query-size-guard.ts
 var exports_query_size_guard = {};
 __export(exports_query_size_guard, {
@@ -22827,90 +23369,45 @@ function requireSqlConnection2(connection) {
 }
 async function queryCommand(sql, options, command) {
   let config;
+  let resolvedSql = sql ?? "";
+  let configPath = options.config ?? ".dbcli";
+  let connectionName;
+  let multiConnectionRequest = false;
   try {
-    if (!sql || sql.trim() === "") {
-      throw new Error("SQL query required");
+    resolvedSql = await resolveQueryInput({ positional: sql, queryFile: options.queryFile });
+    const fieldSelection = parseFieldSelection(options.fields);
+    if (options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit <= 0)) {
+      throw new Error("--limit must be a positive integer");
     }
     if (options.format) {
       validateFormat(options.format, [...ALLOWED_FORMATS3, "html"], "query");
     }
-    sql = sql.trim();
-    const configPath = resolveConfigPath(command, options);
-    config = await configModule.read(configPath);
-    if (!config.connection) {
-      throw new Error('Run "dbcli init" first');
-    }
-    if (config.connection.system === "mongodb") {
-      return await mongoQueryBranch(sql, options, config);
-    }
-    if (config.connection.system === "redis") {
-      return await redisQueryBranch(sql, options, config);
-    }
-    if (config.connection.system === "elasticsearch") {
-      return await elasticsearchQueryBranch(sql, options, config);
-    }
-    const { extractTableName: extractTableName2 } = await Promise.resolve().then(() => (init_engine_hints(), exports_engine_hints));
-    const mainTable = extractTableName2(sql);
-    if (mainTable && config.schema && !options.noLimit) {
-      const tableSchema = config.schema[mainTable];
-      if (tableSchema) {
-        const { shouldBlockQuery: shouldBlockQuery2 } = await Promise.resolve().then(() => (init_query_size_guard(), exports_query_size_guard));
-        const guard = shouldBlockQuery2(sql, tableSchema);
-        if (guard.blocked) {
-          throw new Error(`\u26A0 ${guard.reason}`);
-        }
-      }
-    }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection2(config.connection));
-    await adapter.connect();
-    try {
-      const blacklistManager = new BlacklistManager(config);
-      const blacklistValidator = new BlacklistValidator(blacklistManager);
-      const executor3 = new QueryExecutor(adapter, config.permission, blacklistValidator, config, options);
-      const autoLimit = !options.noLimit;
-      const result = await executor3.execute(sql, {
-        autoLimit,
-        limitValue: options.limit
-      });
-      if (options.ui || options.format === "html") {
-        const html = await generateHtmlReport({
-          meta: {
-            name: "Query Results",
-            key: "raw-sql",
-            params: [],
-            tags: [],
-            description: sql.length > 100 ? sql.slice(0, 97) + "..." : sql
-          },
-          rows: result.rows
-        });
-        if (options.ui) {
-          const tempPath = join20(tmpdir(), `dbcli-query-${Date.now()}.html`);
-          await Bun.write(tempPath, html);
-          await openInBrowser(tempPath);
-        } else {
-          console.log(html);
-        }
-        return;
-      }
-      const formatter = new QueryResultFormatter;
-      const output = formatter.format(result, {
-        format: options.format || "table"
-      });
-      console.log(output);
-    } finally {
-      await adapter.disconnect();
+    const tableCellLimit = resolveTableCellLimit(options);
+    configPath = resolveConfigPath(command, options);
+    multiConnectionRequest = options.connectionSelector?.includes(",") ?? false;
+    const connectionNames = options.connectionSelector === undefined ? [] : parseConnectionNames(options.connectionSelector);
+    multiConnectionRequest = connectionNames.length > 1;
+    if (multiConnectionRequest) {
+      await runMultiConnectionQuery(resolvedSql, options, configPath, connectionNames, fieldSelection, tableCellLimit);
+      return;
     }
+    connectionName = connectionNames[0];
+    config = await configModule.read(configPath, connectionName);
+    const context = { config, configPath, connectionName };
+    await preflightQuery(resolvedSql, options, context, fieldSelection, false);
+    const execution = await executeConnectionQuery(resolvedSql, options, context, fieldSelection);
+    await presentSingleResult(resolvedSql, options, execution, tableCellLimit);
   } catch (error) {
     let auditId = null;
     let envelopeId;
-    if (options.recovery === true) {
+    if (options.recovery === true && !multiConnectionRequest) {
       envelopeId = crypto3.randomUUID();
     }
     const alreadyAudited = error?.__auditWritten === true;
     if (config && !alreadyAudited) {
-      auditId = await writeAuditEntry(config, "query", options, {
+      auditId = await writeAuditEntry(config, "query", { ...options, config: configPath, connectionName }, {
         success: false,
-        sql,
+        sql: resolvedSql,
         error,
         ...envelopeId && { recovery_ref: envelopeId }
       });
@@ -22919,62 +23416,288 @@ async function queryCommand(sql, options, command) {
       const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
       emitRecoveryEnvelope2(error, {
         operation: "query",
-        table: (await Promise.resolve().then(() => (init_engine_hints(), exports_engine_hints))).extractTableName(sql) ?? undefined
+        table: (await Promise.resolve().then(() => (init_engine_hints(), exports_engine_hints))).extractTableName(resolvedSql) ?? undefined
       }, {
         envelopeId,
         auditRef: auditId ?? undefined
       });
     }
-    if (error instanceof BlacklistError) {
-      console.error(error.message);
-      process.exit(1);
-    }
-    if (error instanceof PermissionError) {
-      console.error(t_vars("errors.permission_denied", { required: error.requiredPermission }));
-      console.error(`   Operation: ${error.classification.type}`);
-      console.error(`   Message: ${error.message}`);
-      process.exit(1);
-    }
-    if (error instanceof ConnectionError) {
-      console.error(t_vars("errors.connection_failed", { message: error.message }));
-      process.exit(1);
+    throw error;
+  }
+}
+async function runMultiConnectionQuery(query, options, configPath, connectionNames, fieldSelection, tableCellLimit) {
+  if (options.recovery === true) {
+    throw new Error("--recovery is not supported with multiple connections");
+  }
+  if (options.ui === true || !["table", "json"].includes(options.format ?? "table")) {
+    throw new Error("Multiple connections support only --format table or --format json");
+  }
+  const contexts = [];
+  for (const connectionName of connectionNames) {
+    const config = await configModule.read(configPath, connectionName);
+    contexts.push({ config, configPath, connectionName });
+  }
+  for (const context of contexts) {
+    await preflightQuery(query, options, context, fieldSelection, true);
+  }
+  const executions = new Map;
+  const contextsByName = new Map(contexts.map((context) => [context.connectionName, context]));
+  const outcomes = await runQueryFanOut(connectionNames, async (selectedName) => {
+    const context = contextsByName.get(selectedName);
+    const execution = scopeMultiConnectionNotices(await executeConnectionQuery(query, options, context, fieldSelection));
+    executions.set(selectedName, execution);
+    return execution.result;
+  });
+  const format = options.format ?? "table";
+  const formatter = new MultiQueryResultFormatter;
+  console.log(formatter.format(outcomes, {
+    format,
+    truncate: format === "table" ? tableCellLimit : false
+  }));
+  for (const connection of connectionNames) {
+    const execution = executions.get(connection);
+    if (!execution)
+      continue;
+    for (const diagnostic of execution.diagnostics)
+      console.error(diagnostic);
+  }
+  process.exitCode = aggregateFanOutExitCode(outcomes);
+}
+function scopeMultiConnectionNotices(execution) {
+  if (execution.notices.length === 0)
+    return execution;
+  const securityNotification = execution.notices.map((notice) => notice.trim().replace(/^\u2139\s*/, "")).filter(Boolean).join(`
+`);
+  if (!securityNotification)
+    return { ...execution, notices: [] };
+  return {
+    ...execution,
+    result: {
+      ...execution.result,
+      metadata: {
+        statement: execution.result.metadata?.statement ?? "SELECT",
+        ...execution.result.metadata,
+        securityNotification
+      }
+    },
+    notices: []
+  };
+}
+async function preflightQuery(query, options, context, fieldSelection, multiConnection) {
+  const { config } = context;
+  if (!config.connection)
+    throw new Error('Run "dbcli init" first');
+  const system = config.connection.system;
+  if (fieldSelection && (system === "redis" || system === "elasticsearch")) {
+    throw new Error(`--fields is not supported for ${system} queries`);
+  }
+  if (system === "redis") {
+    if (multiConnection) {
+      throw new Error("Redis queries do not support multiple connections");
     }
-    console.error(t_vars("errors.message", { message: error.message }));
-    process.exit(1);
+    const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_permission_guard(), exports_permission_guard));
+    enforceRedisPermission2(query, config.permission);
+    return;
+  }
+  if (system === "mongodb") {
+    await preflightMongoQuery(query, options, config, multiConnection);
+    return;
+  }
+  if (system === "elasticsearch") {
+    preflightElasticsearchQuery(query, options, config, multiConnection);
+    return;
   }
+  if (multiConnection)
+    assertFanOutReadOnlySql(query, system);
+  await preflightSqlSizeGuard(query, options, config);
+}
+async function preflightSqlSizeGuard(query, options, config) {
+  const { extractTableName: extractTableName2 } = await Promise.resolve().then(() => (init_engine_hints(), exports_engine_hints));
+  const mainTable = extractTableName2(query);
+  if (!mainTable || !config.schema || options.noLimit)
+    return;
+  const tableSchema = config.schema[mainTable];
+  if (!tableSchema)
+    return;
+  const { shouldBlockQuery: shouldBlockQuery2 } = await Promise.resolve().then(() => (init_query_size_guard(), exports_query_size_guard));
+  const guard = shouldBlockQuery2(query, tableSchema);
+  if (guard.blocked)
+    throw new Error(`\u26A0 ${guard.reason}`);
 }
-async function mongoQueryBranch(queryStr, options, config) {
+async function preflightMongoQuery(query, options, config, multiConnection) {
   const collection = options.collection;
-  const format = options.format ?? "table";
-  if (!collection) {
+  if (!collection)
     throw new Error("MongoDB \u67E5\u8A62\u9700\u8981\u6307\u5B9A --collection <name>");
-  }
   const SQL_PATTERN = /^\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER|SHOW|DESCRIBE)\b/i;
-  if (SQL_PATTERN.test(queryStr)) {
+  if (SQL_PATTERN.test(query)) {
     throw new Error(`\u9019\u662F MongoDB \u9023\u7DDA\uFF0C\u8ACB\u4F7F\u7528 JSON filter \u8A9E\u6CD5\u3002
 \u7BC4\u4F8B\uFF1Adbcli query '{"field": "value"}' --collection <name>`);
   }
+  let parsedQuery;
   try {
-    JSON.parse(queryStr);
+    parsedQuery = JSON.parse(query);
   } catch {
     throw new Error("MongoDB \u67E5\u8A62\u5FC5\u9808\u662F\u6709\u6548\u7684 JSON\uFF08object filter \u6216 array pipeline\uFF09");
   }
-  const blacklistManager = new BlacklistManager(config);
-  const blacklistValidator = new BlacklistValidator(blacklistManager);
+  if (multiConnection && (parsedQuery === null || typeof parsedQuery !== "object" && !Array.isArray(parsedQuery))) {
+    throw new Error("MongoDB multi-connection query must be an object filter or array pipeline");
+  }
+  if (multiConnection && Array.isArray(parsedQuery) && parsedQuery.some((stage) => stage !== null && typeof stage === "object" && (Object.prototype.hasOwnProperty.call(stage, "$out") || Object.prototype.hasOwnProperty.call(stage, "$merge")))) {
+    throw new Error("MongoDB multi-connection pipelines cannot contain $out or $merge");
+  }
+  const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
   blacklistValidator.checkTableBlacklist("SELECT", collection, []);
-  if (config.schema && !options.noLimit) {
-    const tableSchema = config.schema[collection];
-    if (tableSchema) {
-      const { shouldBlockQuery: shouldBlockQuery2 } = await Promise.resolve().then(() => (init_query_size_guard(), exports_query_size_guard));
-      const isFiltered = queryStr.length > 2;
-      const hasLimit = options.limit !== undefined;
-      const dummySql = `SELECT * FROM ${collection}${isFiltered ? " WHERE" : ""}${hasLimit ? " LIMIT" : ""}`;
-      const guard = shouldBlockQuery2(dummySql, tableSchema);
-      if (guard.blocked) {
-        throw new Error(`\u26A0 ${guard.reason}`);
+  if (!config.schema || options.noLimit)
+    return;
+  const tableSchema = config.schema[collection];
+  if (!tableSchema)
+    return;
+  const { shouldBlockQuery: shouldBlockQuery2 } = await Promise.resolve().then(() => (init_query_size_guard(), exports_query_size_guard));
+  const isFiltered = query.length > 2;
+  const hasLimit = options.limit !== undefined;
+  const dummySql = `SELECT * FROM ${collection}${isFiltered ? " WHERE" : ""}${hasLimit ? " LIMIT" : ""}`;
+  const guard = shouldBlockQuery2(dummySql, tableSchema);
+  if (guard.blocked)
+    throw new Error(`\u26A0 ${guard.reason}`);
+}
+function preflightElasticsearchQuery(query, options, config, multiConnection) {
+  const indexName = options.index ?? options.collection;
+  if (!indexName) {
+    throw new Error("Elasticsearch \u67E5\u8A62\u9700\u8981\u6307\u5B9A --collection <index> \u6216 --index <index>");
+  }
+  const body = query.trim().startsWith("{") ? query : undefined;
+  if (body !== undefined)
+    JSON.parse(body);
+  enforceElasticsearchPermission({ method: "POST", apiPath: `/${indexName}/_search`, body }, multiConnection ? "query-only" : config.permission);
+  const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
+  blacklistValidator.checkTableBlacklist("SELECT", indexName, []);
+}
+async function executeConnectionQuery(query, options, context, fieldSelection) {
+  const { config, configPath, connectionName } = context;
+  const system = config.connection.system;
+  const auditOptions = { ...options, config: configPath, connectionName };
+  const start = performance.now();
+  try {
+    let execution;
+    if (system === "mongodb") {
+      execution = await mongoQueryBranch(query, options, context, fieldSelection);
+    } else if (system === "redis") {
+      execution = await redisQueryBranch(query, options, context);
+    } else if (system === "elasticsearch") {
+      execution = await elasticsearchQueryBranch(query, options, context);
+    } else {
+      execution = await sqlQueryBranch(query, options, context, fieldSelection);
+    }
+    await writeAuditEntry(config, "query", auditOptions, {
+      success: true,
+      sql: query,
+      target: queryAuditTarget(system, query, options),
+      metadata: {
+        rows_affected: execution.result.rowCount,
+        execution_ms: execution.result.executionTimeMs ?? Math.round(performance.now() - start)
       }
+    });
+    return execution;
+  } catch (error) {
+    if (options.recovery !== true) {
+      const metadata = error instanceof BlacklistRejection ? {
+        rejection_reason: "blacklist",
+        matched_pattern: error.matchedPattern,
+        ...error.matchedKey ? { matched_key: error.matchedKey } : {},
+        execution_ms: Math.round(performance.now() - start)
+      } : { execution_ms: Math.round(performance.now() - start) };
+      await writeAuditEntry(config, "query", auditOptions, {
+        success: false,
+        sql: query,
+        target: queryAuditTarget(system, query, options),
+        error,
+        metadata
+      });
+      error.__auditWritten = true;
+    }
+    throw error;
+  }
+}
+function queryAuditTarget(system, query, options) {
+  if (system === "mongodb")
+    return options.collection;
+  if (system === "elasticsearch")
+    return options.index ?? options.collection;
+  if (system === "redis")
+    return query.trim().split(/\s+/)[1] || "<unknown-key>";
+  return;
+}
+async function sqlQueryBranch(query, options, context, fieldSelection) {
+  const { config } = context;
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection2(config.connection));
+  let executionError;
+  try {
+    await adapter.connect();
+    const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
+    const executor3 = new QueryExecutor(adapter, config.permission, blacklistValidator, undefined, {
+      ...options,
+      deferDiagnostics: true
+    });
+    const result = await executor3.execute(query, {
+      autoLimit: !options.noLimit,
+      limitValue: options.limit,
+      detectTruncation: true,
+      fieldSelection
+    });
+    return { result, diagnostics: executor3.takeDiagnostics(), notices: [] };
+  } catch (error) {
+    executionError = error;
+    throw error;
+  } finally {
+    await disconnectPreservingError(adapter, executionError);
+  }
+}
+async function presentSingleResult(query, options, execution, tableCellLimit) {
+  const noticeText = execution.notices.map((notice) => notice.trim().replace(/^\u2139\s*/, "")).filter(Boolean).join(`
+`);
+  if (options.ui || options.format === "html") {
+    const html = await generateHtmlReport({
+      meta: {
+        name: "Query Results",
+        key: "raw-sql",
+        params: [],
+        tags: [],
+        description: query.length > 100 ? query.slice(0, 97) + "..." : query
+      },
+      rows: execution.result.rows,
+      ...execution.result.appliedLimit ? { appliedLimit: execution.result.appliedLimit } : {},
+      ...execution.result.metadata?.securityNotification || noticeText ? {
+        securityNotification: execution.result.metadata?.securityNotification ?? noticeText
+      } : {}
+    });
+    if (options.ui) {
+      const tempPath = join20(tmpdir(), `dbcli-query-${Date.now()}.html`);
+      await Bun.write(tempPath, html);
+      await openInBrowser(tempPath);
+    } else {
+      console.log(html);
     }
+  } else {
+    const format = options.format ?? "table";
+    const formatter = new QueryResultFormatter;
+    console.log(formatter.format(execution.result, {
+      format,
+      truncate: format === "table" ? tableCellLimit : false
+    }));
+  }
+  if (!options.ui && options.format !== "html") {
+    for (const notice of execution.notices)
+      console.log(notice);
   }
+  if (options.recovery !== true) {
+    for (const diagnostic of execution.diagnostics)
+      console.error(diagnostic);
+  }
+}
+async function mongoQueryBranch(queryStr, options, context, fieldSelection) {
+  const { config } = context;
+  const collection = options.collection;
+  const parsedQuery = JSON.parse(queryStr);
   let effectiveLimit;
   if (options.noLimit) {
     effectiveLimit = undefined;
@@ -22982,177 +23705,195 @@ async function mongoQueryBranch(queryStr, options, config) {
     effectiveLimit = options.limit;
   } else if (config.permission === "query-only") {
     effectiveLimit = DEFAULT_QUERY_ONLY_LIMIT;
-    console.error(`Query-only mode: auto-limiting to ${effectiveLimit} rows`);
   }
+  const hasUserAuthoredLimit2 = Array.isArray(parsedQuery) && parsedQuery.some((stage) => stage !== null && typeof stage === "object" && Object.prototype.hasOwnProperty.call(stage, "$limit"));
+  const appliedLimit = effectiveLimit !== undefined && effectiveLimit > 0 && !hasUserAuthoredLimit2 ? effectiveLimit : undefined;
   const mongoAdapter = AdapterFactory.createMongoDBAdapter(config.connection);
-  await mongoAdapter.connect();
-  const start = performance.now();
+  let executionError;
   try {
-    const result = await mongoAdapter.execute(queryStr, [collection], effectiveLimit !== undefined ? { limit: effectiveLimit } : undefined);
+    await mongoAdapter.connect();
+    const start = performance.now();
+    const projection = fieldSelection ? toMongoProjection(fieldSelection) : undefined;
+    const executeOptions = appliedLimit !== undefined || projection !== undefined ? {
+      ...appliedLimit !== undefined ? { limit: appliedLimit + 1 } : {},
+      ...projection !== undefined ? { projection } : {}
+    } : undefined;
+    const result = await mongoAdapter.execute(queryStr, [collection], executeOptions);
     const executionTimeMs = Math.round(performance.now() - start);
-    await writeAuditEntry(config, "query", options, {
-      success: true,
-      target: collection,
-      metadata: {
-        rows_affected: result.rows.length,
-        execution_ms: executionTimeMs
-      }
-    });
+    const limitedResult = appliedLimit === undefined ? undefined : trimAppliedLimit(result.rows, appliedLimit);
+    const visibleRows = limitedResult?.rows ?? result.rows;
     const blacklistCfg = config.blacklist ?? { tables: [], columns: {} };
-    const maskedRows = maskMongoRows(result.rows, collection, blacklistCfg);
-    const columnNames = maskedRows[0] ? Object.keys(maskedRows[0]) : [];
+    const maskedRows = maskMongoRows(visibleRows, collection, blacklistCfg);
+    const projected = fieldSelection ? projectRows(maskedRows, fieldSelection) : undefined;
+    const outputRows = projected?.rows ?? maskedRows;
+    const columnNames = projected?.columnNames ?? (outputRows[0] ? Object.keys(outputRows[0]) : []);
     const queryResult = {
-      rows: maskedRows,
-      rowCount: maskedRows.length,
-      columnNames
+      rows: outputRows,
+      rowCount: outputRows.length,
+      columnNames,
+      executionTimeMs,
+      ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
     };
-    const formatter = new QueryResultFormatter;
-    const output = formatter.format(queryResult, {
-      format
-    });
-    console.log(output);
+    const notices = [];
     if ((blacklistCfg.columns[collection] ?? []).length > 0) {
-      console.log(`
+      notices.push(`
 \u2139 Some fields may have been redacted as [REDACTED] per .dbcli blacklist.`);
     }
+    const diagnostics = [];
+    if (options.recovery !== true && appliedLimit !== undefined && options.limit === undefined && config.permission === "query-only") {
+      diagnostics.push(`Query-only mode: auto-limiting to ${appliedLimit} rows`);
+    }
+    return {
+      result: queryResult,
+      diagnostics,
+      notices
+    };
+  } catch (error) {
+    executionError = error;
+    throw error;
   } finally {
-    await mongoAdapter.disconnect();
+    await disconnectPreservingError(mongoAdapter, executionError);
   }
 }
-async function redisQueryBranch(command, options, config) {
-  const format = options.format ?? "table";
-  const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_permission_guard(), exports_permission_guard));
-  const head = command.trim().split(/\s+/)[0]?.toUpperCase() ?? "";
-  if (head === "KEYS" && options.recovery !== true) {
-    console.error('\u26A0 Warning: "KEYS" command is dangerous on production servers.');
+function describeRedisWarning(warning) {
+  switch (warning.code) {
+    case "REDIS_SIZE_TRUNCATE":
+      return `\u26A0 REDIS_SIZE_TRUNCATE: ${warning.command} reply kept ${warning.kept} entries and dropped at least ${warning.droppedAtLeast}. Use --no-limit for the full reply.`;
+    case "REDIS_SIZE_REWRITE":
+      return `\u26A0 REDIS_SIZE_REWRITE: ${warning.command} was rewritten to bound the reply (${warning.original.join(" ")} \u2192 ${warning.rewritten.join(" ")}). Use --no-limit to run it as written.`;
+    case "REDIS_BLACKLIST_FILTERED":
+      return `\u26A0 REDIS_BLACKLIST_FILTERED: ${warning.count} key(s) were withheld by the blacklist.`;
   }
-  enforceRedisPermission2(command, config.permission);
+}
+async function redisQueryBranch(command, options, context) {
+  const { config } = context;
+  const head = command.trim().split(/\s+/)[0]?.toUpperCase() ?? "";
   const redisAdapter = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? []);
-  await redisAdapter.connect();
-  const start = performance.now();
+  let executionError;
   try {
+    await redisAdapter.connect();
     const result = await redisAdapter.execute(command, undefined, {
       noLimit: options.noLimit ?? false
     });
-    const executionTimeMs = Math.round(performance.now() - start);
-    const target = command.trim().split(/\s+/)[1] || "<unknown-key>";
-    await writeAuditEntry(config, "query", options, {
-      success: true,
-      target,
-      metadata: {
-        rows_affected: result.rows.length,
-        execution_ms: executionTimeMs
-      }
-    });
     const columnNames = result.rows[0] ? Object.keys(result.rows[0]) : ["value"];
+    const sizeTruncation = result.warnings?.find((w2) => w2.code === "REDIS_SIZE_TRUNCATE");
     const queryResult = {
       rows: result.rows,
       rowCount: result.rows.length,
-      columnNames
+      columnNames,
+      ...sizeTruncation ? { appliedLimit: { truncated: true, limitApplied: sizeTruncation.kept } } : {}
     };
-    const formatter = new QueryResultFormatter;
-    const output = formatter.format(queryResult, {
-      format
-    });
-    console.log(output);
-  } catch (err) {
-    if (err instanceof BlacklistRejection) {
-      await writeAuditEntry(config, "query", options, {
-        success: false,
-        error: err,
-        metadata: {
-          rejection_reason: "blacklist",
-          matched_pattern: err.matchedPattern,
-          ...err.matchedKey ? { matched_key: err.matchedKey } : {}
-        }
-      });
-    } else {
-      await writeAuditEntry(config, "query", options, {
-        success: false,
-        error: err
-      });
-    }
-    err.__auditWritten = true;
-    throw err;
+    const diagnostics = options.recovery === true ? [] : [
+      ...head === "KEYS" ? ['\u26A0 Warning: "KEYS" command is dangerous on production servers.'] : [],
+      ...(result.warnings ?? []).map(describeRedisWarning)
+    ];
+    return {
+      result: queryResult,
+      diagnostics,
+      notices: []
+    };
+  } catch (error) {
+    executionError = error;
+    throw error;
   } finally {
-    await redisAdapter.disconnect();
+    await disconnectPreservingError(redisAdapter, executionError);
   }
 }
-async function elasticsearchQueryBranch(queryStr, options, config) {
+async function elasticsearchQueryBranch(queryStr, options, context) {
+  const { config } = context;
   const indexName = options.index ?? options.collection;
-  const format = options.format ?? "table";
-  if (!indexName) {
-    throw new Error("Elasticsearch \u67E5\u8A62\u9700\u8981\u6307\u5B9A --collection <index> \u6216 --index <index>");
-  }
-  const { enforceElasticsearchPermission: enforceElasticsearchPermission2 } = await Promise.resolve().then(() => (init_permission_guard(), exports_permission_guard));
-  enforceElasticsearchPermission2({
-    method: "POST",
-    apiPath: `/${indexName}/_search`,
-    body: queryStr.trim().startsWith("{") ? queryStr : undefined
-  }, config.permission);
   let effectiveLimit;
   if (options.noLimit) {
     effectiveLimit = 1e4;
-    console.error("Elasticsearch --no-limit is capped at size 10000; for more rows use saved-query with search_after.");
   } else {
     effectiveLimit = options.limit || DEFAULT_QUERY_ONLY_LIMIT;
   }
-  const blacklistManager = new BlacklistManager(config);
-  const blacklistValidator = new BlacklistValidator(blacklistManager);
-  blacklistValidator.checkTableBlacklist("SELECT", indexName, []);
+  let hasUserAuthoredSize = false;
+  if (queryStr.trim().startsWith("{")) {
+    const parsed = JSON.parse(queryStr);
+    hasUserAuthoredSize = parsed !== null && typeof parsed === "object" && Object.prototype.hasOwnProperty.call(parsed, "size");
+  }
+  const appliedLimit = !options.noLimit && !hasUserAuthoredSize ? effectiveLimit : undefined;
+  const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
   const esAdapter = AdapterFactory.createElasticsearchAdapter(config.connection);
-  await esAdapter.connect();
-  const start = performance.now();
+  let executionError;
   try {
+    await esAdapter.connect();
+    const start = performance.now();
     const result = await esAdapter.execute(queryStr, [indexName], {
-      limit: effectiveLimit
+      limit: appliedLimit === undefined ? effectiveLimit : appliedLimit + 1
     });
     const executionTimeMs = Math.round(performance.now() - start);
-    await writeAuditEntry(config, "query", options, {
-      success: true,
-      target: indexName,
-      metadata: {
-        rows_affected: result.rows.length,
-        execution_ms: executionTimeMs
-      }
-    });
-    const columnNames = result.rows[0] ? Object.keys(result.rows[0]) : [];
-    const filterResult = blacklistValidator.filterColumns(indexName, result.rows, columnNames);
+    const limitedResult = appliedLimit === undefined ? undefined : trimAppliedLimit(result.rows, appliedLimit);
+    const visibleRows = limitedResult?.rows ?? result.rows;
+    const columnNames = visibleRows[0] ? Object.keys(visibleRows[0]) : [];
+    const filterResult = blacklistValidator.filterColumns(indexName, visibleRows, columnNames);
     const queryResult = {
       rows: filterResult.filteredRows,
       rowCount: filterResult.filteredRows.length,
-      columnNames: columnNames.filter((col) => !filterResult.omittedColumns.includes(col))
+      columnNames: columnNames.filter((col) => !filterResult.omittedColumns.includes(col)),
+      executionTimeMs,
+      ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
     };
-    const formatter = new QueryResultFormatter;
-    const output = formatter.format(queryResult, {
-      format
-    });
-    console.log(output);
     const securityNote = blacklistValidator.buildSecurityNotification(indexName, filterResult.omittedColumns);
-    if (securityNote) {
-      console.log(`
-\u2139 ${securityNote}`);
-    }
+    return {
+      result: queryResult,
+      diagnostics: options.noLimit && options.recovery !== true ? [
+        "Elasticsearch --no-limit is capped at size 10000; for more rows use saved-query with search_after."
+      ] : [],
+      notices: securityNote ? [`
+\u2139 ${securityNote}`] : []
+    };
+  } catch (error) {
+    executionError = error;
+    throw error;
   } finally {
-    await esAdapter.disconnect();
+    await disconnectPreservingError(esAdapter, executionError);
+  }
+}
+async function disconnectPreservingError(adapter, executionError) {
+  try {
+    await adapter.disconnect();
+  } catch (disconnectError) {
+    if (executionError === undefined)
+      throw disconnectError;
+  }
+}
+function resolveTableCellLimit(options) {
+  if (options.truncate !== undefined && (!Number.isSafeInteger(options.truncate) || options.truncate <= 0)) {
+    throw new Error("--truncate must be a positive integer");
   }
+  if (options.truncate !== undefined && options.noTruncate === true) {
+    throw new Error("--truncate and --no-truncate cannot be used together");
+  }
+  if (options.truncate !== undefined && (options.ui === true || (options.format ?? "table") !== "table")) {
+    throw new Error("--truncate is supported only with --format table");
+  }
+  if (options.noTruncate === true)
+    return false;
+  return options.truncate ?? DEFAULT_TABLE_CELL_LIMIT;
 }
 var ALLOWED_FORMATS3;
 var init_query = __esm(() => {
-  init_message_loader();
   init_adapters();
   init_formatters();
+  init_query_result_formatter();
+  init_multi_query_result_formatter();
   init_html_formatter();
   init_opener();
   init_query_executor();
   init_config();
-  init_permission_guard();
   init_blacklist_validator();
-  init_blacklist();
   init_validation();
+  init_applied_limit();
   init_integration_helper();
   init_field_masker();
   init_types4();
+  init_query_input();
+  init_field_projection();
+  init_connection_selector();
+  init_query_fanout();
+  init_permission_guard();
   ALLOWED_FORMATS3 = ["table", "json", "csv"];
 });
 
@@ -23645,7 +24386,8 @@ function prepareExecution(snippet, opts, cliParams, fileParams) {
     driver: prepared.driver,
     warnings: prepared.warnings,
     rewrittenSql: prepared.rewrittenBody,
-    execHints: prepared.execHints
+    execHints: prepared.execHints,
+    ...prepared.guardLimit !== undefined ? { guardLimit: prepared.guardLimit } : {}
   };
 }
 var init_runner = __esm(() => {
@@ -23711,8 +24453,13 @@ async function qMongoBranch(snippet, prepared, options, config) {
     const executionTimeMs = Math.round(performance.now() - start);
     const blacklistCfg = config.blacklist ?? { tables: [], columns: {} };
     const masked = maskMongoRows(result.rows, collection, blacklistCfg);
+    const securityNotification = (blacklistCfg.columns[collection] ?? []).length > 0 ? "Some fields may have been redacted as [REDACTED] per .dbcli blacklist." : undefined;
     if (options.ui || options.format === "html") {
-      const html = await generateHtmlReport({ meta: snippet.query.meta, rows: masked });
+      const html = await generateHtmlReport({
+        meta: snippet.query.meta,
+        rows: masked,
+        ...securityNotification ? { securityNotification } : {}
+      });
       if (options.ui) {
         const tempPath = join21(tmpdir2(), `dbcli-report-${Date.now()}.html`);
         await Bun.write(tempPath, html);
@@ -23776,6 +24523,9 @@ function formatDryRun(input) {
   }
   lines.push(input.driverSql);
   lines.push("Bind values: " + JSON.stringify(input.values));
+  if (input.guardLimit !== undefined) {
+    lines.push(`Size guard: capped at ${input.guardLimit} rows; the extra row is fetched only to detect truncation and is discarded. Use --no-limit to remove the cap.`);
+  }
   return lines.join(`
 `);
 }
@@ -23806,7 +24556,8 @@ async function qCommand(name2, options, command) {
         family: engineFamily(engine),
         driverSql: prepared.driver.sql,
         values: prepared.driver.values,
-        execHints: prepared.execHints
+        execHints: prepared.execHints,
+        ...prepared.guardLimit !== undefined ? { guardLimit: prepared.guardLimit } : {}
       }));
       await writeAuditEntry(config, "q", options, {
         success: true,
@@ -23839,12 +24590,17 @@ async function qCommand(name2, options, command) {
       const start = performance.now();
       const result = await adapter.execute(prepared.driver.sql, family === "sql" ? prepared.driver.values : indexParams);
       const executionTimeMs = Math.round(performance.now() - start);
-      const columnNames = result.rows[0] ? Object.keys(result.rows[0]) : [];
-      const filtered = family === "redis" ? { filteredRows: result.rows, omittedColumns: [] } : blacklistValidator.filterColumns(targetName, result.rows, columnNames);
+      const limitedResult = prepared.guardLimit === undefined ? undefined : trimAppliedLimit(result.rows, prepared.guardLimit);
+      const resultRows = limitedResult?.rows ?? result.rows;
+      const columnNames = resultRows[0] ? Object.keys(resultRows[0]) : [];
+      const filtered = family === "redis" ? { filteredRows: resultRows, omittedColumns: [] } : blacklistValidator.filterColumns(targetName, resultRows, columnNames);
+      const securityNotification = family === "redis" || filtered.omittedColumns.length === 0 ? undefined : blacklistValidator.buildSecurityNotification(targetName, filtered.omittedColumns);
       if (options.ui || options.format === "html") {
         const html = await generateHtmlReport({
           meta: snippet.query.meta,
-          rows: filtered.filteredRows
+          rows: filtered.filteredRows,
+          ...limitedResult ? { appliedLimit: limitedResult.metadata } : {},
+          ...securityNotification ? { securityNotification } : {}
         });
         if (options.ui) {
           const tempPath = join22(tmpdir3(), `dbcli-report-${Date.now()}.html`);
@@ -23874,10 +24630,9 @@ async function qCommand(name2, options, command) {
         metadata: {
           statement: "SELECT",
           affectedRows: 0,
-          ...filtered.omittedColumns.length > 0 ? {
-            securityNotification: blacklistValidator.buildSecurityNotification(targetName, filtered.omittedColumns)
-          } : {}
-        }
+          ...securityNotification ? { securityNotification } : {}
+        },
+        ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
       }, { format: options.format ?? "table" });
       console.log(out);
       await writeAuditEntry(config, "q", options, {
@@ -23959,22 +24714,22 @@ async function handleQError(error, snippetName, options, config) {
     emitRecoveryEnvelope2(error, { operation: "q", snippet: snippetName }, { envelopeId, auditRef: auditId ?? undefined });
   }
   if (error instanceof SavedQueryError) {
-    console.error(error.message);
+    printLocalizedCliError(error.message, error);
     process.exit(1);
   }
   if (error instanceof BlacklistError) {
-    console.error(error.message);
+    printLocalizedCliError(error.message, error);
     process.exit(1);
   }
   if (error instanceof PermissionError) {
-    console.error(t_vars("errors.permission_denied", { required: error.requiredPermission }));
+    printLocalizedCliError(t_vars("errors.permission_denied", { required: error.requiredPermission }), error);
     process.exit(1);
   }
   if (error instanceof ConnectionError) {
-    console.error(t_vars("errors.connection_failed", { message: error.message }));
+    printLocalizedCliError(t_vars("errors.connection_failed", { message: error.message }), error);
     process.exit(1);
   }
-  console.error(t_vars("errors.message", { message: error.message }));
+  printLocalizedCliError(t_vars("errors.message", { message: error.message }), error);
   process.exit(1);
 }
 function evaluateExpectation(row, expects) {
@@ -24086,6 +24841,8 @@ var init_q = __esm(() => {
   init_integration_helper();
   init_saved_queries();
   init_colors();
+  init_applied_limit();
+  init_cli_error();
   init_strategies();
 });
 
@@ -24957,7 +25714,7 @@ Parameters:`);
       if (error instanceof BlacklistError) {
         throw error;
       }
-      const errorMessage = error instanceof Error ? error.message : String(error);
+      const errorMessage2 = error instanceof Error ? error.message : String(error);
       if (error instanceof PermissionError) {
         return {
           status: "error",
@@ -24972,7 +25729,7 @@ Parameters:`);
         operation: "insert",
         rows_affected: 0,
         timestamp,
-        error: `INSERT failed: ${errorMessage}`
+        error: `INSERT failed: ${errorMessage2}`
       };
     }
   }
@@ -25023,7 +25780,7 @@ Parameters:`);
       if (error instanceof BlacklistError) {
         throw error;
       }
-      const errorMessage = error instanceof Error ? error.message : String(error);
+      const errorMessage2 = error instanceof Error ? error.message : String(error);
       if (error instanceof PermissionError) {
         return {
           status: "error",
@@ -25038,7 +25795,7 @@ Parameters:`);
         operation: "update",
         rows_affected: 0,
         timestamp,
-        error: `UPDATE failed: ${errorMessage}`
+        error: `UPDATE failed: ${errorMessage2}`
       };
     }
   }
@@ -25099,13 +25856,13 @@ Parameters:`);
       if (error instanceof BlacklistError) {
         throw error;
       }
-      const errorMessage = error instanceof Error ? error.message : String(error);
+      const errorMessage2 = error instanceof Error ? error.message : String(error);
       return {
         status: "error",
         operation: "delete",
         rows_affected: 0,
         timestamp,
-        error: `DELETE failed: ${errorMessage}`
+        error: `DELETE failed: ${errorMessage2}`
       };
     }
   }
@@ -26215,7 +26972,7 @@ async function insertCommand(table, options, command) {
       process.exit(1);
     }
     if (error instanceof ConnectionError) {
-      console.error(t_vars("errors.connection_failed", { message: error.message }));
+      printLocalizedCliError(t_vars("errors.connection_failed", { message: error.message }), error);
       process.exit(1);
     }
     const output = {
@@ -26230,6 +26987,7 @@ async function insertCommand(table, options, command) {
 }
 var init_insert = __esm(() => {
   init_message_loader();
+  init_cli_error();
   init_adapters();
   init_data_executor();
   init_config();
@@ -26516,7 +27274,7 @@ async function updateCommand(table, options, command) {
       process.exit(1);
     }
     if (error instanceof ConnectionError) {
-      console.error(t_vars("errors.connection_failed", { message: error.message }));
+      printLocalizedCliError(t_vars("errors.connection_failed", { message: error.message }), error);
       process.exit(1);
     }
     const output = {
@@ -26531,6 +27289,7 @@ async function updateCommand(table, options, command) {
 }
 var init_update = __esm(() => {
   init_message_loader();
+  init_cli_error();
   init_adapters();
   init_data_executor();
   init_config();
@@ -26801,7 +27560,7 @@ async function deleteCommand(table, options, command) {
       process.exit(1);
     }
     if (error instanceof ConnectionError) {
-      console.error(t_vars("errors.connection_failed", { message: error.message }));
+      printLocalizedCliError(t_vars("errors.connection_failed", { message: error.message }), error);
       process.exit(1);
     }
     const output = {
@@ -26816,6 +27575,7 @@ async function deleteCommand(table, options, command) {
 }
 var init_delete = __esm(() => {
   init_message_loader();
+  init_cli_error();
   init_adapters();
   init_data_executor();
   init_config();
@@ -26898,10 +27658,20 @@ async function exportCommand(sql, options, command) {
     }
     const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection6(config.connection));
     await adapter.connect();
+    const executor3 = new QueryExecutor(adapter, config.permission, undefined, undefined, {
+      recovery: options.recovery,
+      deferDiagnostics: true
+    });
+    let formatted;
+    let rowCount;
     try {
-      const executor3 = new QueryExecutor(adapter, config.permission);
-      const result = await executor3.execute(sql, { autoLimit: true });
-      let formatted;
+      const result = await executor3.execute(sql, {
+        autoLimit: options.noLimit !== true,
+        ...typeof options.limit === "number" ? { limitValue: options.limit } : {},
+        detectTruncation: true
+      });
+      assertExportNotSilentlyTruncated(result.appliedLimit, options);
+      rowCount = result.rowCount;
       if (options.format === "html") {
         formatted = await generateHtmlReport({
           meta: {
@@ -26911,7 +27681,9 @@ async function exportCommand(sql, options, command) {
             tags: [],
             description: sql
           },
-          rows: result.rows
+          rows: result.rows,
+          ...result.appliedLimit ? { appliedLimit: result.appliedLimit } : {},
+          ...result.metadata?.securityNotification ? { securityNotification: result.metadata.securityNotification } : {}
         });
       } else {
         const formatter = new QueryResultFormatter;
@@ -26919,21 +27691,6 @@ async function exportCommand(sql, options, command) {
           format: options.format
         });
       }
-      if (options.output) {
-        const file = Bun.file(options.output);
-        const exists = await file.exists();
-        if (exists && !options.force) {
-          const confirmed = await promptUser.confirm(t_vars("export.overwrite_confirmation", { file: options.output }));
-          if (!confirmed) {
-            console.error("Operation cancelled by user");
-            return;
-          }
-        }
-        await file.write(formatted);
-        console.error(t_vars("export.exported", { count: result.rowCount, file: options.output }));
-      } else {
-        console.log(formatted);
-      }
       await writeAuditEntry(config, "export", options, {
         success: true,
         target: extractTableName(sql) ?? "*",
@@ -26947,6 +27704,11 @@ async function exportCommand(sql, options, command) {
     } finally {
       await adapter.disconnect();
     }
+    const emitted = await emitExportOutput(formatted, rowCount, options);
+    if (emitted && options.recovery !== true) {
+      for (const diagnostic of executor3.takeDiagnostics())
+        console.error(diagnostic);
+    }
   } catch (error) {
     let auditId = null;
     let envelopeId;
@@ -26967,22 +27729,7 @@ async function exportCommand(sql, options, command) {
       const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
       emitRecoveryEnvelope2(error, { operation: "export", table: m?.[1] }, { envelopeId, auditRef: auditId ?? undefined });
     }
-    if (error instanceof PermissionError) {
-      console.error(t_vars("errors.permission_denied", { required: error.requiredPermission }));
-      console.error(`   Operation: ${error.classification.type}`);
-      console.error(`   Message: ${error.message}`);
-      process.exit(1);
-    }
-    if (error instanceof ConnectionError) {
-      console.error(t_vars("errors.connection_failed", { message: error.message }));
-      process.exit(1);
-    }
-    if (error instanceof BlacklistError) {
-      console.error(error.message);
-      process.exit(1);
-    }
-    console.error(t_vars("errors.message", { message: error.message }));
-    process.exit(1);
+    throw error;
   }
 }
 async function redisExportBranch(command, options, config) {
@@ -26990,6 +27737,8 @@ async function redisExportBranch(command, options, config) {
   enforceRedisPermission2(command, config.permission);
   const redisAdapter = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? [], config.redis?.mask ?? []);
   await redisAdapter.connect();
+  let formatted;
+  let rowCount;
   try {
     const result = await redisAdapter.execute(command);
     const columnNames = result.rows[0] ? Object.keys(result.rows[0]) : ["value"];
@@ -26999,31 +27748,14 @@ async function redisExportBranch(command, options, config) {
       columnNames
     };
     const formatter = new QueryResultFormatter;
-    const formatted = formatter.format(queryResult, { format: options.format });
-    if (options.output) {
-      const file = Bun.file(options.output);
-      const exists = await file.exists();
-      if (exists && !options.force) {
-        const confirmed = await promptUser.confirm(t_vars("export.overwrite_confirmation", { file: options.output }));
-        if (!confirmed) {
-          console.error("Operation cancelled by user");
-          return;
-        }
-      }
-      await file.write(formatted);
-      console.error(t_vars("export.exported", {
-        count: result.rowCount ?? result.rows.length ?? 0,
-        file: options.output
-      }));
-    } else {
-      console.log(formatted);
-    }
+    formatted = formatter.format(queryResult, { format: options.format });
+    rowCount = result.rowCount ?? result.rows.length ?? 0;
     const target = command.trim().split(/\s+/)[1] || "<unknown-key>";
     await writeAuditEntry(config, "export", options, {
       success: true,
       target,
       metadata: {
-        rows_affected: result.rowCount ?? result.rows.length ?? 0,
+        rows_affected: rowCount,
         output_format: options.format,
         ...options.output && { output_file: options.output }
       }
@@ -27031,9 +27763,20 @@ async function redisExportBranch(command, options, config) {
   } finally {
     await redisAdapter.disconnect();
   }
+  await emitExportOutput(formatted, rowCount, options);
+}
+function assertExportNotSilentlyTruncated(appliedLimit, options) {
+  if (!appliedLimit?.truncated)
+    return;
+  if (options.noLimit === true || typeof options.limit === "number")
+    return;
+  throw new Error(`Export would silently drop rows \u2014 ${appliedLimit.limitApplied}-row auto-limit reached.
+  Re-run with --no-limit to export everything,
+  or --limit ${appliedLimit.limitApplied} to accept the cap explicitly.`);
 }
 async function buildEsExportRows(query, options, adapter) {
   const cap2 = options.noLimit ? Number.POSITIVE_INFINITY : options.limit ?? ES_EXPORT_CAP;
+  const capped = Number.isFinite(cap2);
   const isDsl = query.trim().startsWith("{");
   if (isDsl) {
     const index2 = options.index ?? options.collection;
@@ -27041,47 +27784,54 @@ async function buildEsExportRows(query, options, adapter) {
       throw new Error("Elasticsearch DSL export requires --index <name>");
     }
     const res = await adapter.execute(query, [index2], {
-      limit: cap2 === Number.POSITIVE_INFINITY ? 1e4 : cap2
+      limit: capped ? cap2 + 1 : 1e4
     });
-    return { rows: res.rows, target: index2 };
+    return { rows: res.rows, target: index2, ...capped ? { cap: cap2 } : {} };
   }
   const index = query.trim();
-  const rows = await scrollAll(adapter, index, cap2 === Number.POSITIVE_INFINITY ? 1e6 : cap2);
-  return { rows, target: index };
+  const rows = await scrollAll(adapter, index, capped ? cap2 + 1 : 1e6);
+  return { rows, target: index, ...capped ? { cap: cap2 } : {} };
 }
 async function esExportBranch(query, options, config) {
   const blacklistManager = new BlacklistManager(config);
   const blacklistValidator = new BlacklistValidator(blacklistManager);
   const adapter = AdapterFactory.createElasticsearchAdapter(config.connection);
   await adapter.connect();
+  let formatted;
+  let rowCount;
+  const diagnostics = [];
   try {
-    const { rows, target } = await buildEsExportRows(query, options, adapter);
+    const {
+      rows: fetched,
+      target,
+      cap: cap2
+    } = await buildEsExportRows(query, options, adapter);
     blacklistValidator.checkTableBlacklist("SELECT", target, []);
-    if (!options.noLimit && rows.length >= ES_EXPORT_CAP) {
-      console.error(`Warning: result capped at ${ES_EXPORT_CAP} rows. Use --no-limit to export the full index.`);
-    }
+    const limitedResult = cap2 === undefined ? undefined : trimAppliedLimit(fetched, cap2);
+    assertExportNotSilentlyTruncated(limitedResult?.metadata, options);
+    const rows = limitedResult?.rows ?? fetched;
+    rowCount = rows.length;
     const columns = collectColumnUnion(rows);
-    const formatted = formatMongoRows(rows, columns, options.format);
-    if (options.output) {
-      const file = Bun.file(options.output);
-      const exists = await file.exists();
-      if (exists && !options.force) {
-        const confirmed = await promptUser.confirm(t_vars("export.overwrite_confirmation", { file: options.output }));
-        if (!confirmed) {
-          console.error("Operation cancelled by user");
-          return;
-        }
-      }
-      await file.write(formatted);
-      console.error(t_vars("export.exported", { count: rows.length, file: options.output }));
+    if (options.format === "html") {
+      formatted = await generateHtmlReport({
+        meta: {
+          name: "Exported Report",
+          key: "export",
+          params: [],
+          tags: [],
+          description: query
+        },
+        rows,
+        ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
+      });
     } else {
-      console.log(formatted);
+      formatted = formatMongoRows(rows, columns, options.format, options.recovery === true ? undefined : diagnostics);
     }
     await writeAuditEntry(config, "export", options, {
       success: true,
       target,
       metadata: {
-        rows_affected: rows.length,
+        rows_affected: rowCount,
         output_format: options.format,
         ...options.output && { output_file: options.output }
       }
@@ -27089,22 +27839,23 @@ async function esExportBranch(query, options, config) {
   } finally {
     await adapter.disconnect();
   }
+  const emitted = await emitExportOutput(formatted, rowCount, options);
+  if (emitted && options.recovery !== true) {
+    for (const diagnostic of diagnostics)
+      console.error(diagnostic);
+  }
 }
 async function mongoExportBranch(query, options, config) {
   if (SQL_PATTERN.test(query)) {
-    console.error("\u9019\u662F MongoDB \u9023\u7DDA\uFF0C\u8ACB\u4F7F\u7528 JSON filter \u6216 aggregation pipeline\u3002");
-    console.error(`\u7BC4\u4F8B\uFF1Adbcli export '{"status":"open"}' --collection orders --format jsonl`);
-    process.exit(1);
+    throw new Error("\u9019\u662F MongoDB \u9023\u7DDA\uFF0C\u8ACB\u4F7F\u7528 JSON filter \u6216 aggregation pipeline\u3002" + ` \u7BC4\u4F8B\uFF1Adbcli export '{"status":"open"}' --collection orders --format jsonl`);
   }
   if (!options.collection) {
-    console.error("MongoDB export \u9700\u8981\u6307\u5B9A --collection <name>");
-    process.exit(1);
+    throw new Error("MongoDB export \u9700\u8981\u6307\u5B9A --collection <name>");
   }
   try {
     JSON.parse(query);
   } catch {
-    console.error("MongoDB \u67E5\u8A62\u5FC5\u9808\u662F\u6709\u6548\u7684 JSON\uFF08object filter \u6216 array pipeline\uFF09");
-    process.exit(1);
+    throw new Error("MongoDB \u67E5\u8A62\u5FC5\u9808\u662F\u6709\u6548\u7684 JSON\uFF08object filter \u6216 array pipeline\uFF09");
   }
   const collection = options.collection;
   const blacklistManager = new BlacklistManager(config);
@@ -27117,42 +27868,45 @@ async function mongoExportBranch(query, options, config) {
     effectiveLimit = options.limit;
   } else if (config.permission === "query-only") {
     effectiveLimit = DEFAULT_QUERY_ONLY_LIMIT;
-    console.error(`Query-only mode: auto-limiting to ${effectiveLimit} rows`);
   }
   const adapter = AdapterFactory.createMongoDBAdapter(config.connection);
   await adapter.connect();
+  let formatted;
+  let rowCount;
+  let hasBlacklistedColumns = false;
+  const diagnostics = [];
   try {
-    const result = await adapter.execute(query, [collection], effectiveLimit !== undefined ? { limit: effectiveLimit } : undefined);
+    const result = await adapter.execute(query, [collection], effectiveLimit !== undefined ? { limit: effectiveLimit + 1 } : undefined);
+    const limitedResult = effectiveLimit === undefined ? undefined : trimAppliedLimit(result.rows, effectiveLimit);
+    assertExportNotSilentlyTruncated(limitedResult?.metadata, options);
     const blacklistCfg = config.blacklist ?? { tables: [], columns: {} };
-    const maskedRows = maskMongoRows(result.rows, collection, blacklistCfg);
+    const maskedRows = maskMongoRows(limitedResult?.rows ?? result.rows, collection, blacklistCfg);
+    rowCount = maskedRows.length;
+    hasBlacklistedColumns = (blacklistCfg.columns[collection] ?? []).length > 0;
     const visibleColumns = collectColumnUnion(maskedRows);
-    const formatted = formatMongoRows(maskedRows, visibleColumns, options.format);
-    if (options.output) {
-      const file = Bun.file(options.output);
-      const exists = await file.exists();
-      if (exists && !options.force) {
-        const confirmed = await promptUser.confirm(t_vars("export.overwrite_confirmation", { file: options.output }));
-        if (!confirmed) {
-          console.error("Operation cancelled by user");
-          return;
-        }
-      }
-      await file.write(formatted);
-      console.error(t_vars("export.exported", {
-        count: maskedRows.length,
-        file: options.output
-      }));
+    if (options.format === "html") {
+      formatted = await generateHtmlReport({
+        meta: {
+          name: "Exported Report",
+          key: "export",
+          params: [],
+          tags: [],
+          description: query
+        },
+        rows: maskedRows,
+        ...limitedResult ? { appliedLimit: limitedResult.metadata } : {},
+        ...hasBlacklistedColumns ? {
+          securityNotification: "Some fields may have been redacted as [REDACTED] per .dbcli blacklist."
+        } : {}
+      });
     } else {
-      console.log(formatted);
-    }
-    if ((blacklistCfg.columns[collection] ?? []).length > 0) {
-      console.error(`\u2139 Some fields may have been redacted as [REDACTED] per .dbcli blacklist.`);
+      formatted = formatMongoRows(maskedRows, visibleColumns, options.format, options.recovery === true ? undefined : diagnostics);
     }
     await writeAuditEntry(config, "export", options, {
       success: true,
       target: collection,
       metadata: {
-        rows_affected: maskedRows.length,
+        rows_affected: rowCount,
         output_format: options.format,
         ...options.output && { output_file: options.output }
       }
@@ -27160,6 +27914,19 @@ async function mongoExportBranch(query, options, config) {
   } finally {
     await adapter.disconnect();
   }
+  const emitted = await emitExportOutput(formatted, rowCount, options);
+  if (!emitted)
+    return;
+  if (options.recovery !== true) {
+    for (const diagnostic of diagnostics)
+      console.error(diagnostic);
+  }
+  if (hasBlacklistedColumns) {
+    console.error(`\u2139 Some fields may have been redacted as [REDACTED] per .dbcli blacklist.`);
+  }
+  if (options.recovery !== true && options.limit === undefined && !options.noLimit && config.permission === "query-only") {
+    console.error(`Query-only mode: auto-limiting to ${effectiveLimit} rows`);
+  }
 }
 function collectColumnUnion(rows) {
   const seen = new Set;
@@ -27174,7 +27941,7 @@ function collectColumnUnion(rows) {
   }
   return order;
 }
-function formatMongoRows(rows, columns, format) {
+function formatMongoRows(rows, columns, format, diagnostics) {
   if (format === "jsonl") {
     return rows.map((row) => JSON.stringify(row)).join(`
 `);
@@ -27194,12 +27961,29 @@ function formatMongoRows(rows, columns, format) {
       return escapeCsvField(value);
     }).join(",");
   });
-  if (nestedSeen) {
-    console.error("Warning: nested object/array fields were JSON-stringified for CSV. Use --format jsonl to preserve structure.");
+  if (nestedSeen && diagnostics) {
+    diagnostics.push("Warning: nested object/array fields were JSON-stringified for CSV. Use --format jsonl to preserve structure.");
   }
   return [headerLine, ...dataLines].join(`
 `);
 }
+async function emitExportOutput(formatted, rowCount, options) {
+  if (!options.output) {
+    console.log(formatted);
+    return true;
+  }
+  const file = Bun.file(options.output);
+  if (await file.exists() && !options.force) {
+    const confirmed = await promptUser.confirm(t_vars("export.overwrite_confirmation", { file: options.output }));
+    if (!confirmed) {
+      console.error("Operation cancelled by user");
+      return false;
+    }
+  }
+  await file.write(formatted);
+  console.error(t_vars("export.exported", { count: rowCount, file: options.output }));
+  return true;
+}
 function escapeCsvField(value) {
   if (value === null || value === undefined)
     return "";
@@ -27218,10 +28002,9 @@ var init_export = __esm(() => {
   init_html_formatter();
   init_query_executor();
   init_config();
-  init_permission_guard();
   init_prompts();
   init_blacklist_validator();
-  init_blacklist();
+  init_applied_limit();
   init_integration_helper();
   init_engine_hints();
   init_field_masker();
@@ -28134,86 +28917,73 @@ function requireSqlConnection7(connection) {
   return connection;
 }
 async function checkAction(table, options) {
+  validateFormat(options.format, ALLOWED_FORMATS6, "check");
+  const config = await configModule.read(options.config);
+  if (!config.connection) {
+    throw new Error("Database not configured. Run: dbcli init");
+  }
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection7(config.connection));
+  await adapter.connect();
   try {
-    validateFormat(options.format, ALLOWED_FORMATS6, "check");
-    const config = await configModule.read(options.config);
-    if (!config.connection) {
-      console.error("Database not configured. Run: dbcli init");
-      process.exit(1);
-    }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection7(config.connection));
-    await adapter.connect();
-    try {
-      const checker = new HealthChecker(adapter);
-      const blacklistManager = new BlacklistManager(config);
-      const blacklistedColumns = getBlacklistedColumnSet(blacklistManager);
-      const blacklistedTables = getBlacklistedTableSet(blacklistManager);
-      const checkTypes = options.checks ? options.checks.split(",") : undefined;
-      const sampleSize = parseInt(options.sample, 10) || 1e4;
-      if (table) {
-        if (blacklistedTables.has(table.toLowerCase())) {
-          console.error(`Table "${table}" is blacklisted`);
-          process.exit(1);
+    const checker = new HealthChecker(adapter);
+    const blacklistManager = new BlacklistManager(config);
+    const blacklistedColumns = getBlacklistedColumnSet(blacklistManager);
+    const blacklistedTables = getBlacklistedTableSet(blacklistManager);
+    const checkTypes = options.checks ? options.checks.split(",") : undefined;
+    const sampleSize = parseInt(options.sample, 10) || 1e4;
+    if (table) {
+      if (blacklistedTables.has(table.toLowerCase())) {
+        throw new Error(`Table "${table}" is blacklisted`);
+      }
+      const schema = await adapter.getTableSchema(table);
+      const report = await checker.check(schema, {
+        checks: checkTypes,
+        sample: sampleSize,
+        blacklistedColumns
+      });
+      outputReport(report, options.format);
+    } else if (options.all) {
+      const tables = await adapter.listTables();
+      const reports = [];
+      const skipped = [];
+      for (const t2 of tables) {
+        if (blacklistedTables.has(t2.name.toLowerCase())) {
+          skipped.push(`${t2.name} (blacklisted)`);
+          continue;
+        }
+        if (t2.tableType === "view") {
+          skipped.push(`${t2.name} (view)`);
+          continue;
+        }
+        const category = getSizeCategory(t2.estimatedRowCount);
+        if (category === "huge" && !options.includeLarge) {
+          skipped.push(`${t2.name} (~${(t2.estimatedRowCount || 0).toLocaleString()} rows, huge)`);
+          continue;
         }
-        const schema = await adapter.getTableSchema(table);
+        const schema = await adapter.getTableSchema(t2.name);
         const report = await checker.check(schema, {
           checks: checkTypes,
           sample: sampleSize,
           blacklistedColumns
         });
-        outputReport(report, options.format);
-      } else if (options.all) {
-        const tables = await adapter.listTables();
-        const reports = [];
-        const skipped = [];
-        for (const t2 of tables) {
-          if (blacklistedTables.has(t2.name.toLowerCase())) {
-            skipped.push(`${t2.name} (blacklisted)`);
-            continue;
-          }
-          if (t2.tableType === "view") {
-            skipped.push(`${t2.name} (view)`);
-            continue;
-          }
-          const category = getSizeCategory(t2.estimatedRowCount);
-          if (category === "huge" && !options.includeLarge) {
-            skipped.push(`${t2.name} (~${(t2.estimatedRowCount || 0).toLocaleString()} rows, huge)`);
-            continue;
-          }
-          const schema = await adapter.getTableSchema(t2.name);
-          const report = await checker.check(schema, {
-            checks: checkTypes,
-            sample: sampleSize,
-            blacklistedColumns
-          });
-          reports.push(report);
+        reports.push(report);
+      }
+      if (options.format === "json") {
+        console.log(JSON.stringify({ reports, skipped }, null, 2));
+      } else {
+        for (const report of reports) {
+          outputReport(report, "table");
+          console.log("");
         }
-        if (options.format === "json") {
-          console.log(JSON.stringify({ reports, skipped }, null, 2));
-        } else {
-          for (const report of reports) {
-            outputReport(report, "table");
-            console.log("");
-          }
-          if (skipped.length > 0) {
-            console.log(`Skipped: ${skipped.join(", ")}`);
-          }
+        if (skipped.length > 0) {
+          console.log(`Skipped: ${skipped.join(", ")}`);
         }
-      } else {
-        console.error("Specify a table name or use --all");
-        process.exit(1);
-      }
-    } finally {
-      await adapter.disconnect();
-    }
-  } catch (error) {
-    if (error instanceof Error) {
-      console.error(error.message);
-      if (error instanceof ConnectionError) {
-        error.hints.forEach((hint) => console.error(`   Hint: ${hint}`));
       }
+    } else {
+      throw new Error("Specify a table name or use --all");
     }
-    process.exit(1);
+  } finally {
+    await adapter.disconnect();
   }
 }
 function outputReport(report, format) {
@@ -28265,8 +29035,9 @@ var init_check = __esm(() => {
   init_health_checker();
   init_size_category();
   init_validation();
+  init_connection_selector();
   ALLOWED_FORMATS6 = ["json", "table"];
-  checkCommand = new Command().name("check").description("Run data health checks on tables").argument("[table]", "Table to check (omit for --all)").option("--all", "Check all tables (skips huge tables unless --include-large)", false).option("--include-large", "Include huge tables in --all scan", false).option("--checks <types>", "Comma-separated checks: nulls,duplicates,orphans,emptyStrings", undefined).option("--sample <number>", "Sample size for large tables (default: 10000)", "10000").option("--format <format>", "Output format: json (default) or table", "json").option("--config <path>", "Path to .dbcli config file", ".dbcli").action(checkAction);
+  checkCommand = new Command().name("check").description("Run data health checks on tables").argument("[table]", "Table to check (omit for --all)").option("--all", "Check all tables (skips huge tables unless --include-large)", false).option("--include-large", "Include huge tables in --all scan", false).option("--checks <types>", "Comma-separated checks: nulls,duplicates,orphans,emptyStrings", undefined).option("--sample <number>", "Sample size for large tables (default: 10000)", "10000").option("--format <format>", "Output format: json (default) or table", "json").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).action(checkAction);
 });
 
 // src/core/orm-drift/table-identity.ts
@@ -81533,12 +82304,12 @@ async function runDiagnostic(input) {
   })();
   const timer = new Promise((resolve7) => setTimeout(() => resolve7("timeout"), input.timeoutMs));
   let outcome;
-  let errorMessage = null;
+  let errorMessage2 = null;
   try {
     outcome = await Promise.race([exec2, timer]);
   } catch (err) {
     outcome = "error";
-    errorMessage = err.message;
+    errorMessage2 = err.message;
   }
   const durationMs = Math.round(performance.now() - start);
   if (outcome === "timeout") {
@@ -81557,7 +82328,7 @@ async function runDiagnostic(input) {
       rowCount: 0,
       rows: [],
       status: "error",
-      reason: errorMessage ?? "unknown error",
+      reason: errorMessage2 ?? "unknown error",
       durationMs
     };
   }
@@ -91636,7 +92407,7 @@ class DDLExecutor {
         dryRun: false
       };
     } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
+      const errorMessage2 = error instanceof Error ? error.message : String(error);
       return {
         status: "error",
         operation: operation.kind,
@@ -91644,7 +92415,7 @@ class DDLExecutor {
         warnings: [],
         timestamp,
         dryRun,
-        error: `DDL execution failed: ${errorMessage}`
+        error: `DDL execution failed: ${errorMessage2}`
       };
     }
   }
@@ -91997,7 +92768,7 @@ var init_use = __esm(() => {
   init_esm();
   init_config_v2();
   init_config();
-  init_errors2();
+  init_errors3();
   init_message_loader();
   init_config_binding();
   useCommand = new Command("use").description("Switch or display the default database connection (v2 config)").argument("[name]", "Connection name to switch to").option("--list", "List all connections").action(async (name2, options) => {
@@ -93257,30 +94028,73 @@ var init_proxy = __esm(() => {
 // src/program.ts
 var exports_program = {};
 __export(exports_program, {
+  normalizeLimitFlags: () => normalizeLimitFlags,
   buildProgram: () => buildProgram
 });
+function parsePositiveInteger(value) {
+  if (!/^\d+$/.test(value)) {
+    throw new InvalidArgumentError("must be a positive integer");
+  }
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new InvalidArgumentError("must be a positive integer");
+  }
+  return parsed;
+}
+function normalizeLimitFlags(options) {
+  const limit = options.limit;
+  if (typeof limit === "boolean") {
+    return { ...options, limit: undefined, noLimit: limit === false };
+  }
+  return { ...options, noLimit: false };
+}
+function findLongOptionValue(rawArgs, option) {
+  let value;
+  for (let index = 0;index < rawArgs.length; index++) {
+    const token = rawArgs[index];
+    if (token === "--")
+      break;
+    if (token === option) {
+      value = rawArgs[index + 1];
+      index++;
+    } else if (token.startsWith(`${option}=`)) {
+      value = token.slice(option.length + 1);
+    }
+  }
+  return value;
+}
+function hasLongOption(rawArgs, option) {
+  for (const token of rawArgs) {
+    if (token === "--")
+      return false;
+    if (token === option || token.startsWith(`${option}=`))
+      return true;
+  }
+  return false;
+}
 function buildProgram() {
-  const program2 = new Command().name("dbcli").description("Database CLI for AI agents").version(package_default.version).option("--no-color", "Disable colored output").option("-v, --verbose", "Increase verbosity (-v verbose, -vv debug)", (_, prev) => prev + 1, 0).option("-q, --quiet", "Suppress non-essential output").option("--config <path>", "Path to .dbcli config file", ".dbcli").option("--use <connection>", "Use a specific named connection (v2 config)").enablePositionalOptions();
+  const program2 = new Command().name("dbcli").description("Database CLI for AI agents").version(package_default.version).option("--no-color", "Disable colored output").option("-v, --verbose", "Increase verbosity (-v verbose, -vv debug)", (_, prev) => prev + 1, 0).option("-q, --quiet", "Suppress non-essential output").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).enablePositionalOptions();
   program2.addCommand(initCommand);
   program2.addCommand(listCommand);
   program2.addCommand(schemaCommand);
-  program2.command("query <sql>").description(t("query.description")).option("--format <type>", "Output format: table, json, csv, html", "table").option("--ui", "Show interactive dashboard in browser", false).option("--limit <number>", "Limit result rows (overrides auto-limit)", (val) => parseInt(val, 10)).option("--no-limit", "Disable auto-limit in query-only mode").option("--collection <name>", "MongoDB collection name; Elasticsearch index name").option("--index <name>", "Elasticsearch index name (alias for --collection)").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (sql, options, command) => {
-    try {
-      await queryCommand(sql, options, command);
-    } catch (error) {
-      if (options.recovery === true) {
-        const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
-        emitRecoveryEnvelope2(error, { operation: "query" });
-      }
-      console.error(error.message);
-      process.exit(1);
-    }
+  program2.command("query [sql]").description(t("query.description")).option("-f, --query-file <path>", "Read query text from a UTF-8 file, or - for stdin").option("--format <type>", "Output format: table, json, csv, html", "table").option("--ui", "Show interactive dashboard in browser", false).option("--limit <number>", "Limit result rows (overrides auto-limit)", parsePositiveInteger).option("--no-limit", "Disable auto-limit in query-only mode").option("--collection <name>", "MongoDB collection name; Elasticsearch index name").option("--index <name>", "Elasticsearch index name (alias for --collection)").option("--fields <list>", "Include fields, or exclude them with --fields=-field_a,-field_b").option("--truncate <number>", "Limit serialized table cells to N Unicode characters", parsePositiveInteger).option("--no-truncate", "Disable the default table-cell truncation").addOption(createConnectionSelectorOption()).option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (sql, options, command) => {
+    const rawArgs = command.parent?.rawArgs ?? [];
+    const rawTruncate = findLongOptionValue(rawArgs, "--truncate");
+    const rootUse = command.parent?.opts().use;
+    const commandUse = options.use;
+    const connectionSelector = rootUse !== undefined || commandUse !== undefined ? resolveConnectionSelector({ root: rootUse, command: commandUse }) : undefined;
+    await queryCommand(sql, {
+      ...normalizeLimitFlags(options),
+      connectionSelector,
+      truncate: rawTruncate === undefined ? undefined : parsePositiveInteger(rawTruncate),
+      noTruncate: hasLongOption(rawArgs, "--no-truncate")
+    }, command);
   });
   program2.command("plan <sql>").description("Analyze SQL risk without executing").option("--format <type>", "Output format: text, json", "text").action(async (sql, options, command) => {
     await planCommand(sql, options, command);
   });
   program2.command("q <name>").description(t("q.description")).option("--format <type>", "Output format: table, json, csv, html", "table").option("--ui", "Show interactive dashboard in browser", false).option("--no-limit", "Disable size guard wrap (LIMIT 1000)").option("--dry-run", "Show final SQL + bind values; do not execute").option("--param <kv>", "Pass parameter as key=value (repeatable)", (val, prev = []) => prev.concat([val]), []).option("--param-file <path>", "JSON file containing param values").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).option("--verify", "Run verification check after execution if defined", false).action(async (name2, options, command) => {
-    await qCommand(name2, options, command);
+    await qCommand(name2, normalizeLimitFlags(options), command);
   });
   program2.command("insert <table>").description(t("insert.description")).option("--data <json>", "JSON object to insert").option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format for --plan: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
     try {
@@ -93290,7 +94104,7 @@ function buildProgram() {
         const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
         emitRecoveryEnvelope2(error, { operation: "insert", table, writeOperation: "INSERT" });
       }
-      console.error(error.message);
+      printLocalizedCliError(error.message, error);
       process.exit(1);
     }
   });
@@ -93302,7 +94116,7 @@ function buildProgram() {
         const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
         emitRecoveryEnvelope2(error, { operation: "update", table, writeOperation: "UPDATE" });
       }
-      console.error(error.message);
+      printLocalizedCliError(error.message, error);
       process.exit(1);
     }
   });
@@ -93314,24 +94128,12 @@ function buildProgram() {
         const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
         emitRecoveryEnvelope2(error, { operation: "delete", table, writeOperation: "DELETE" });
       }
-      console.error(error.message);
+      printLocalizedCliError(error.message, error);
       process.exit(1);
     }
   });
-  program2.command("export <sql>").description(t("export.description")).option("--format <format>", "Output format: json, jsonl, csv, html", "json").option("--output <path>", "Output file path (if omitted, write to stdout)", undefined).option("--force", "Skip overwrite confirmation", false).option("--collection <name>", "MongoDB collection name; Elasticsearch index name").option("--index <name>", "Elasticsearch index name (alias for --collection)").option("--limit <number>", "Limit result rows (overrides auto-limit)", (val) => parseInt(val, 10)).option("--no-limit", "Disable auto-limit in query-only mode").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (sql, options, command) => {
-    try {
-      const { validateFormat: validateFormat2 } = await Promise.resolve().then(() => (init_validation(), exports_validation));
-      validateFormat2(options.format, ["json", "jsonl", "csv", "html"], "export");
-      return await exportCommand(sql, options, command);
-    } catch (error) {
-      if (options.recovery === true) {
-        const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
-        const m = sql.match(/\bFROM\s+[`"']?(\w+)[`"']?/i);
-        emitRecoveryEnvelope2(error, { operation: "export", table: m?.[1] });
-      }
-      console.error(error.message);
-      process.exit(1);
-    }
+  program2.command("export <sql>").description(t("export.description")).option("--format <format>", "Output format: json, jsonl, csv, html", "json").option("--output <path>", "Output file path (if omitted, write to stdout)", undefined).option("--force", "Skip overwrite confirmation", false).option("--collection <name>", "MongoDB collection name; Elasticsearch index name").option("--index <name>", "Elasticsearch index name (alias for --collection)").addOption(createConnectionSelectorOption()).option("--limit <number>", "Limit result rows (overrides auto-limit)", (val) => parseInt(val, 10)).option("--no-limit", "Disable auto-limit in query-only mode").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (sql, options, command) => {
+    return await exportCommand(sql, normalizeLimitFlags(options), command);
   });
   const skillCmd = registerSkillCommand(program2);
   registerSkillTasksCommand(skillCmd);
@@ -93402,6 +94204,8 @@ var init_program = __esm(() => {
   init_migrate();
   init_use();
   init_proxy();
+  init_connection_selector();
+  init_cli_error();
   init_package();
 });
 
@@ -93412,8 +94216,49 @@ init_upgrade();
 init_version_check();
 init_skill();
 init_config();
+init_connection_selector();
 init_program();
+init_cli_error();
 import { join as join35 } from "path";
+import { writeSync as writeSync2 } from "fs";
+import { format } from "util";
+function installSynchronousRedirectedStdout() {
+  if (process.stdout.isTTY)
+    return;
+  const retrySignal = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  const writeAll = (bytes) => {
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      let written;
+      try {
+        written = writeSync2(1, bytes, offset, bytes.byteLength - offset);
+      } catch (error) {
+        const code = error.code;
+        if (code === "EAGAIN" || code === "EWOULDBLOCK") {
+          Atomics.wait(retrySignal, 0, 0, 1);
+          continue;
+        }
+        throw error;
+      }
+      if (written === 0)
+        throw new Error("Unable to write CLI output to stdout");
+      offset += written;
+    }
+  };
+  process.stdout.write = (chunk, encodingOrCallback, callback) => {
+    const encoding = typeof encodingOrCallback === "string" ? encodingOrCallback : undefined;
+    const onComplete = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk, encoding) : Buffer.from(chunk);
+    writeAll(bytes);
+    onComplete?.();
+    return true;
+  };
+  console.log = (...args) => {
+    writeAll(Buffer.from(`${format(...args)}
+`));
+  };
+}
+installSynchronousRedirectedStdout();
 var _bgVersionCheckResult;
 function shouldSkipBackgroundChecks() {
   return process.env.DBCLI_NO_UPDATE_CHECK === "1" || process.env.DBCLI_NO_UPDATE_CHECK === "true" || false;
@@ -93422,8 +94267,11 @@ var QUIET_OUTPUT_COMMANDS = new Set(["upgrade", "completion"]);
 var program2 = buildProgram();
 program2.hook("preAction", (thisCommand, actionCommand) => {
   const opts = thisCommand.opts();
-  const useConnection = opts.use;
-  setGlobalConnectionName(useConnection);
+  setGlobalConnectionName(resolveConnectionSelector({
+    root: opts.use,
+    command: actionCommand.opts().use,
+    environment: process.env.DBCLI_CONNECTION
+  }));
   if (opts.color === false) {
     process.env.NO_COLOR = "1";
   }
@@ -93472,7 +94320,12 @@ program2.hook("postAction", async (thisCommand, actionCommand) => {
 if (!process.argv.slice(2).length) {
   program2.outputHelp();
 }
-program2.parse(process.argv);
+try {
+  await program2.parseAsync(process.argv);
+} catch (error) {
+  presentCliError(error);
+  process.exitCode = 1;
+}
 var cli_default = program2;
 export {
   cli_default as default