@carllee1983/dbcli 1.55.1 → 1.57.0

package/dist/cli-runtime.mjs

@@ -51,7 +51,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "1.55.1",
+    version: "1.57.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -61,7 +61,6 @@ var init_package = __esm(() => {
       dbcli: "./dist/cli.mjs"
     },
     exports: {
-      ".": "./dist/cli.mjs",
       "./core": {
         types: "./dist/core.d.ts",
         import: "./dist/core.mjs"
@@ -6233,7 +6232,11 @@ function resolveEnvReferences(config, env, parentKey) {
 }
 function parseEnvPassword(content) {
   const match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
-  return match?.[1] != null ? match[1].trim() : null;
+  if (match?.[1] == null)
+    return null;
+  const raw = match[1].trim();
+  const quoted = raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'");
+  return quoted && raw.length >= 2 ? raw.slice(1, -1) : raw;
 }
 var _globalConnectionName, DEFAULT_CONFIG, configModule;
 var init_config = __esm(() => {
@@ -9059,6 +9062,20 @@ Reference: {referencePath}`,
       add_enum_description: "Create an enum type (PostgreSQL only)",
       alter_enum_description: "Add a value to an enum type",
       drop_enum_description: "Drop an enum type"
+    },
+    password: {
+      description: "Change the password of a single connection, leaving every other setting untouched",
+      arg_connection: "Connection name (defaults to the current default connection)",
+      opt_stdin: "Read the new password from stdin (for rotation scripts)",
+      opt_password: "New password given inline (visible in shell history and process list)",
+      opt_skip_test: "Skip verifying the new password against the database before saving",
+      prompt: "New password for connection '{name}'",
+      source_conflict: "--password and --stdin cannot be used together; pick one source.",
+      needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
+      empty: "The new password is empty; nothing was changed.",
+      updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
+      converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
+      skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
     }
   };
 });
@@ -9343,6 +9360,20 @@ var init_messages2 = __esm(() => {
       add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
       alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
       drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+    },
+    password: {
+      description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
+      arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
+      opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
+      opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
+      opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
+      prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
+      source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
+      needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
+      empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
+      updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
+      converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
+      skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
     }
   };
 });
@@ -9652,6 +9683,13 @@ async function select(message, choices) {
     return await selectFallback(message, choices);
   return await inquirer.select({ message, choices });
 }
+async function secret(message) {
+  const inquirer = await loadInquirer();
+  if (!inquirer) {
+    throw new Error("Masked input is unavailable; pass the value with --stdin or --password instead.");
+  }
+  return await inquirer.password({ message, mask: "*" });
+}
 async function confirm(message) {
   if (!process.stdin.isTTY)
     return await confirmFallback(message);
@@ -9665,7 +9703,8 @@ var init_prompts = __esm(() => {
   promptUser = {
     text,
     select,
-    confirm
+    confirm,
+    secret
   };
 });
 
@@ -45686,6 +45725,258 @@ var init_use = __esm(() => {
   });
 });
 
+// src/core/config-v2-mutations.ts
+function envVarNameFor(connName, field) {
+  const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return `DBCLI_${slug}_${field.toUpperCase()}`;
+}
+var init_config_v2_mutations = () => {};
+
+// src/core/env-file-writer.ts
+import { chmod as chmod2, mkdir as mkdir18, readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
+import { dirname as dirname16 } from "path";
+function escapeForRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function upsertEnvVar(envPath, varName, value) {
+  let content = "";
+  try {
+    content = await readFile9(envPath, "utf8");
+  } catch (cause) {
+    const code = cause.code;
+    if (code !== "ENOENT")
+      throw cause;
+    await mkdir18(dirname16(envPath), { recursive: true });
+  }
+  const line = `${varName}="${value}"`;
+  const existing = new RegExp(`^${escapeForRegExp(varName)}=.*$`, "m");
+  if (existing.test(content)) {
+    content = content.replace(existing, () => line);
+  } else {
+    content = content.length && !content.endsWith(`
+`) ? `${content}
+${line}
+` : `${content}${line}
+`;
+  }
+  await writeFile9(envPath, content, { mode: SECRET_FILE_MODE });
+  await chmod2(envPath, SECRET_FILE_MODE);
+}
+var SECRET_FILE_MODE = 384;
+var init_env_file_writer = () => {};
+
+// src/core/connection-credential.ts
+import { join as join39 } from "path";
+async function readRawConfig(storagePath) {
+  const configPath = join39(storagePath, "config.json");
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    throw new ConfigError(`\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94\uFF1A${configPath}`);
+  }
+  return JSON.parse(await file.text());
+}
+function envRefName(value) {
+  if (typeof value === "object" && value !== null && "$env" in value) {
+    return String(value.$env);
+  }
+  return;
+}
+async function resolvePasswordTarget(projectPath, connectionName) {
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  if (detectConfigVersion(raw) !== 2) {
+    if (connectionName && connectionName !== V1_CONNECTION_NAME) {
+      throw new ConfigError(`\u9019\u662F v1 \u8A2D\u5B9A\uFF0C\u53EA\u6709\u4E00\u689D\u9023\u7DDA\uFF0C\u7121\u6CD5\u6307\u5B9A\u9023\u7DDA\u540D\u7A31 '${connectionName}'\u3002` + `\u9700\u8981\u591A\u9023\u7DDA\u8ACB\u5148\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2\u3002`);
+    }
+    const connection2 = raw.connection ?? {};
+    const customRef = envRefName(connection2.password);
+    if (customRef !== undefined && customRef !== V1_VAR_NAME) {
+      throw new ConfigError(`\u9019\u500B v1 \u8A2D\u5B9A\u7684\u5BC6\u78BC\u4F86\u81EA\u74B0\u5883\u8B8A\u6578 '${customRef}'\uFF0Cdbcli \u7121\u6CD5\u4EE3\u70BA\u8F2A\u66FF\u3002` + `\u8ACB\u76F4\u63A5\u66F4\u65B0\u8A72\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2 \u5F8C\u518D\u8F2A\u66FF\u3002`);
+    }
+    return {
+      connection: V1_CONNECTION_NAME,
+      envFile: DEFAULT_ENV_FILE,
+      varName: V1_VAR_NAME,
+      convertedToEnvRef: false
+    };
+  }
+  const config = await readV2Config(projectPath);
+  const targetName = connectionName ?? config.default;
+  const connection = config.connections[targetName];
+  if (!connection) {
+    throw new ConfigError(connectionNotFoundMessage(targetName, Object.keys(config.connections)));
+  }
+  const referencedVar = envRefName(connection.password);
+  return {
+    connection: targetName,
+    envFile: connection.envFile ?? DEFAULT_ENV_FILE,
+    varName: referencedVar ?? envVarNameFor(targetName, "password"),
+    convertedToEnvRef: referencedVar === undefined
+  };
+}
+function assertSingleLine(value) {
+  if (value.includes(`
+`) || value.includes("\r")) {
+    throw new ConfigError("\u5BC6\u78BC\u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
+  }
+}
+async function stripV1LiteralPassword(storagePath, raw) {
+  const connection = raw.connection ?? {};
+  if (typeof connection.password !== "string")
+    return;
+  const stripped = { ...raw, connection: { ...connection } };
+  delete stripped.connection.password;
+  await writeConfigWithIntegrity(storagePath, JSON.stringify(stripped, null, 2));
+}
+async function setConnectionPassword(projectPath, connectionName, password) {
+  assertConfigMutationApproved();
+  assertSingleLine(password);
+  const target = await resolvePasswordTarget(projectPath, connectionName);
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  await upsertEnvVar(join39(storagePath, target.envFile), target.varName, password);
+  if (detectConfigVersion(raw) !== 2) {
+    await stripV1LiteralPassword(storagePath, raw);
+    return target;
+  }
+  const config = await readV2Config(projectPath);
+  const connection = config.connections[target.connection];
+  const needsEnvFile = connection.envFile === undefined;
+  if (target.convertedToEnvRef || needsEnvFile) {
+    await writeV2Config(projectPath, {
+      ...config,
+      connections: {
+        ...config.connections,
+        [target.connection]: {
+          ...connection,
+          envFile: target.envFile,
+          ...target.convertedToEnvRef && { password: { $env: target.varName } }
+        }
+      }
+    });
+  }
+  return target;
+}
+var DEFAULT_ENV_FILE = ".env.local", V1_VAR_NAME = "DBCLI_PASSWORD", V1_CONNECTION_NAME = "default";
+var init_connection_credential = __esm(() => {
+  init_config_binding();
+  init_config_v2();
+  init_config_integrity();
+  init_config_mutation_guard();
+  init_config_v2_mutations();
+  init_errors3();
+  init_env_file_writer();
+});
+
+// src/commands/credential.ts
+var exports_credential = {};
+__export(exports_credential, {
+  resolveNewPassword: () => resolveNewPassword,
+  passwordCommand: () => passwordCommand
+});
+async function readAllStdin() {
+  return await Bun.stdin.text();
+}
+async function resolveNewPassword(options, io) {
+  if (options.password !== undefined && options.stdin) {
+    throw new ConfigError(t("password.source_conflict"));
+  }
+  let value;
+  if (options.password !== undefined) {
+    value = options.password;
+  } else if (options.stdin) {
+    value = (await io.readStdin()).replace(/\r?\n$/, "");
+  } else if (io.isTTY) {
+    value = await io.prompt();
+  } else {
+    throw new ConfigError(t("password.needs_source"));
+  }
+  if (value.length === 0) {
+    throw new ConfigError(t("password.empty"));
+  }
+  return value;
+}
+async function verifyNewPassword(configPath, target, connectionName, password) {
+  const storagePath = await resolveConfigStoragePath(configPath);
+  const previous = process.env[target.varName];
+  process.env[target.varName] = password;
+  try {
+    const config = await configModule.read(storagePath, connectionName);
+    const adapter = AdapterFactory.createAdapter({
+      ...config.connection,
+      password
+    });
+    try {
+      await adapter.connect();
+      await adapter.testConnection();
+    } finally {
+      await adapter.disconnect().catch(() => {
+        return;
+      });
+    }
+  } finally {
+    if (previous === undefined)
+      delete process.env[target.varName];
+    else
+      process.env[target.varName] = previous;
+  }
+}
+var passwordCommand;
+var init_credential = __esm(() => {
+  init_esm();
+  init_adapters();
+  init_config();
+  init_config_mutation_guard();
+  init_config_binding();
+  init_connection_credential();
+  init_config_path();
+  init_prompts();
+  init_errors3();
+  init_message_loader();
+  passwordCommand = new Command("password").description(t("password.description")).argument("[connection]", t("password.arg_connection")).option("--stdin", t("password.opt_stdin")).option("--password <value>", t("password.opt_password")).option("--skip-test", t("password.opt_skip_test")).option("--format <format>", "Output format (text, json)", "text").action(async (connection, options) => {
+    try {
+      assertConfigMutationApproved();
+      const configPath = resolveConfigPath(passwordCommand);
+      const target = await resolvePasswordTarget(configPath, connection);
+      const value = await resolveNewPassword({
+        password: typeof options.password === "string" ? options.password : undefined,
+        stdin: options.stdin === true
+      }, {
+        isTTY: Boolean(process.stdin.isTTY),
+        readStdin: readAllStdin,
+        prompt: () => promptUser.secret(t_vars("password.prompt", { name: target.connection }))
+      });
+      if (options.skipTest !== true) {
+        await verifyNewPassword(configPath, target, connection, value);
+      }
+      const written = await setConnectionPassword(configPath, connection, value);
+      if (options.format === "json") {
+        console.log(JSON.stringify({ success: true, ...written }, null, 2));
+      } else {
+        console.log(t_vars("password.updated", {
+          name: written.connection,
+          envFile: written.envFile,
+          varName: written.varName
+        }));
+        if (written.convertedToEnvRef) {
+          console.log(t_vars("password.converted", { varName: written.varName }));
+        }
+        if (options.skipTest === true) {
+          console.log(t("password.skipped_test"));
+        }
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.format === "json") {
+        console.error(JSON.stringify({ success: false, error: message }, null, 2));
+      } else {
+        console.error(t_vars("errors.message", { message }));
+      }
+      process.exit(1);
+    }
+  });
+});
+
 // src/proxy/relay.ts
 class TcpRelay {
   clientBytes = 0;
@@ -45760,8 +46051,8 @@ var init_sql_metadata = __esm(() => {
 });
 
 // src/proxy/events.ts
-import { appendFile as appendFile2, mkdir as mkdir18, readFile as readFile9, stat as stat9 } from "fs/promises";
-import { dirname as dirname16 } from "path";
+import { appendFile as appendFile2, mkdir as mkdir19, readFile as readFile10, stat as stat9 } from "fs/promises";
+import { dirname as dirname17 } from "path";
 function hasSql(e) {
   return e.type === "query_observed" || e.type === "query_completed" || e.type === "query_errored";
 }
@@ -45800,7 +46091,7 @@ class EventWriter {
   }
   async writeInternal(event) {
     if (!this.dirEnsured) {
-      await mkdir18(dirname16(this.path), { recursive: true });
+      await mkdir19(dirname17(this.path), { recursive: true });
       this.dirEnsured = true;
     }
     if (!this.initialized) {
@@ -45824,7 +46115,7 @@ class EventWriter {
     try {
       const s = await stat9(this.path);
       this.currentSizeBytes = s.size;
-      const raw = await readFile9(this.path, "utf8");
+      const raw = await readFile10(this.path, "utf8");
       this.currentEntryCount = raw.split(`
 `).filter(Boolean).length;
     } catch {
@@ -46421,7 +46712,7 @@ var init_server = __esm(() => {
 });
 
 // src/proxy/event-reader.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 async function readEvents(path4, opts) {
   const candidates = opts.includeRotated ? [path4, `${path4}.1`] : [path4];
   const files = [];
@@ -46430,7 +46721,7 @@ async function readEvents(path4, opts) {
   for (const file of candidates) {
     let raw;
     try {
-      raw = await readFile10(file, "utf8");
+      raw = await readFile11(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -46861,7 +47152,7 @@ __export(exports_proxy, {
   proxyCommand: () => proxyCommand,
   parseHostPort: () => parseHostPort
 });
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 function parseHostPort(value) {
   const idx = value.lastIndexOf(":");
   if (idx <= 0 || idx === value.length - 1) {
@@ -46924,7 +47215,7 @@ async function runProxy(subcommandEngine, options, command) {
       target: options.target,
       connection
     });
-    const eventsPath = options.events ?? join39(".dbcli", "proxy", "events.jsonl");
+    const eventsPath = options.events ?? join40(".dbcli", "proxy", "events.jsonl");
     const slowMs = Number(options.slowMs ?? 1000);
     if (!Number.isFinite(slowMs) || slowMs < 0) {
       throw new Error(`Invalid --slow-ms "${options.slowMs}". Expected a non-negative number`);
@@ -46973,7 +47264,7 @@ async function runProxy(subcommandEngine, options, command) {
   }
 }
 function addCommonOptions(cmd) {
-  return cmd.option("--listen <host:port>", "Local proxy listen address (required)").option("--target <host:port>", "Upstream DB target (optional when config provides host/port)").option("--events <path>", "Event JSONL path", join39(".dbcli", "proxy", "events.jsonl")).option("--slow-ms <number>", "Threshold (ms); queries at/above it get slow:true in the event + a terminal warning", "1000").option("--redact <mode>", "SQL redaction: none | literals", "none").option("--format <format>", "Runtime status output: text | json", "text");
+  return cmd.option("--listen <host:port>", "Local proxy listen address (required)").option("--target <host:port>", "Upstream DB target (optional when config provides host/port)").option("--events <path>", "Event JSONL path", join40(".dbcli", "proxy", "events.jsonl")).option("--slow-ms <number>", "Threshold (ms); queries at/above it get slow:true in the event + a terminal warning", "1000").option("--redact <mode>", "SQL redaction: none | literals", "none").option("--format <format>", "Runtime status output: text | json", "text");
 }
 function parseNonNegInt(value, flag, fallback) {
   if (value === undefined)
@@ -46991,7 +47282,7 @@ async function runAnalyze(options) {
     const top = parseNonNegInt(options.top, "top", 20);
     const slowMs = parseNonNegInt(options.slowMs, "slow-ms", 1000);
     const nPlusOne = parseNonNegInt(options.nPlusOne, "n-plus-one", 10);
-    const eventsPath = options.events ?? join39(".dbcli", "proxy", "events.jsonl");
+    const eventsPath = options.events ?? join40(".dbcli", "proxy", "events.jsonl");
     const { events, malformedLines, files } = await readEvents(eventsPath, {
       includeRotated: options.includeRotated !== false
     });
@@ -47044,7 +47335,7 @@ var init_proxy = __esm(() => {
     });
   }
   ANALYZE_FORMATS = ["json", "text", "markdown"];
-  proxyCommand.command("analyze").description("Analyze a proxy event log offline (no DB connection)").option("--events <path>", "Event JSONL path", join39(".dbcli", "proxy", "events.jsonl")).option("--format <format>", "Output format: json | text | markdown (QueryLens)", "json").option("--top <number>", "Rows shown in text + suggestedCommands depth", "20").option("--slow-ms <number>", "Slow-query threshold (ms) for slowCount", "1000").option("--n-plus-one <number>", "Min repeats per (session,fingerprint) to flag N+1", "10").option("--no-include-rotated", "Do not merge the rotated <events>.1 segment").action(async (options) => {
+  proxyCommand.command("analyze").description("Analyze a proxy event log offline (no DB connection)").option("--events <path>", "Event JSONL path", join40(".dbcli", "proxy", "events.jsonl")).option("--format <format>", "Output format: json | text | markdown (QueryLens)", "json").option("--top <number>", "Rows shown in text + suggestedCommands depth", "20").option("--slow-ms <number>", "Slow-query threshold (ms) for slowCount", "1000").option("--n-plus-one <number>", "Min repeats per (session,fingerprint) to flag N+1", "10").option("--no-include-rotated", "Do not merge the rotated <events>.1 segment").action(async (options) => {
     await runAnalyze(options);
   });
   addCommonOptions(proxyCommand).action(async (options, command) => {
@@ -47378,9 +47669,9 @@ var init_semantic2 = __esm(() => {
 });
 
 // src/core/design/index.ts
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 function defaultDesignFile(workspaceRoot) {
-  return join40(workspaceRoot, DEFAULT_FILE3);
+  return join41(workspaceRoot, DEFAULT_FILE3);
 }
 function parseDesignSpec(raw, filePath = DEFAULT_FILE3) {
   const parsed = specSchema.safeParse(raw);
@@ -48211,8 +48502,8 @@ var exports_backfill = {};
 __export(exports_backfill, {
   backfillCommand: () => backfillCommand
 });
-import { dirname as dirname17, resolve as resolve10 } from "path";
-import { mkdir as mkdir19 } from "fs/promises";
+import { dirname as dirname18, resolve as resolve10 } from "path";
+import { mkdir as mkdir20 } from "fs/promises";
 function identityFor(config, name) {
   const connection = config.connections[name];
   if (!connection) {
@@ -48262,7 +48553,7 @@ var init_backfill = __esm(() => {
       return;
     }
     const out = resolve10(options.out ?? `.dbcli/backfills/${artifact2.source.sha256.slice(0, 12)}.json`);
-    await mkdir19(dirname17(out), { recursive: true });
+    await mkdir20(dirname18(out), { recursive: true });
     await Bun.write(out, JSON.stringify(artifact2, null, 2) + `
 `);
     console.log(JSON.stringify({ path: out, artifact: artifact2 }, null, 2));
@@ -48271,8 +48562,8 @@ var init_backfill = __esm(() => {
 
 // src/core/evidence-pack/index.ts
 import { createHash as createHash8, randomUUID as randomUUID6 } from "crypto";
-import { link as link3, lstat as lstat5, mkdir as mkdir20, realpath as realpath2, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
-import { basename as basename9, dirname as dirname18, relative as relative5, resolve as resolve11, sep as sep7 } from "path";
+import { link as link3, lstat as lstat5, mkdir as mkdir21, realpath as realpath2, unlink as unlink8, writeFile as writeFile10 } from "fs/promises";
+import { basename as basename9, dirname as dirname19, relative as relative5, resolve as resolve11, sep as sep7 } from "path";
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -48523,7 +48814,7 @@ async function realExistingAncestor(path4) {
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
-      const parent = dirname18(candidate);
+      const parent = dirname19(candidate);
       if (parent === candidate)
         throw error;
       candidate = parent;
@@ -48535,12 +48826,12 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   const requestedTarget = resolve11(workspace, outputPath);
   if (!isInside(workspace, requestedTarget))
     throw new EvidencePackValidationError("output path must stay inside the workspace");
-  const parent = dirname18(requestedTarget);
+  const parent = dirname19(requestedTarget);
   const existingAncestor2 = await realExistingAncestor(parent);
   if (!isInside(workspace, existingAncestor2) && existingAncestor2 !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
   }
-  await mkdir20(parent, { recursive: true });
+  await mkdir21(parent, { recursive: true });
   const realParent = await realpath2(parent);
   if (!isInside(workspace, realParent) && realParent !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
@@ -48557,7 +48848,7 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   }
   const temp = resolve11(realParent, `.${basename9(target)}.${process.pid}.${randomUUID6()}.tmp`);
   try {
-    await writeFile9(temp, `${JSON.stringify(pack, null, 2)}
+    await writeFile10(temp, `${JSON.stringify(pack, null, 2)}
 `, "utf8");
     try {
       await link3(temp, target);
@@ -48634,7 +48925,7 @@ var exports_evidence = {};
 __export(exports_evidence, {
   evidenceCommand: () => evidenceCommand
 });
-import { join as join41, relative as relative6, resolve as resolve12, sep as sep8 } from "path";
+import { join as join42, relative as relative6, resolve as resolve12, sep as sep8 } from "path";
 import { realpath as realpath3 } from "fs/promises";
 import { createHash as createHash9 } from "crypto";
 function safeMessage(error) {
@@ -48710,7 +49001,7 @@ async function auditEntries(configPath, config) {
     throw new EvidencePackValidationError("audit evidence is disabled");
   const storagePath = await resolveConfigStoragePath(configPath);
   const connectionName = config.effectiveConnectionName || getGlobalConnectionName() || "default";
-  const file = join41(storagePath, ".dbcli", "audit", `${connectionName}.jsonl`);
+  const file = join42(storagePath, ".dbcli", "audit", `${connectionName}.jsonl`);
   return { connectionName, entries: await readEntries(file, { include_rotated: true }) };
 }
 function auditReference(entry, connectionName) {
@@ -50074,8 +50365,8 @@ __export(exports_impact, {
   impactCommand: () => impactCommand
 });
 import { randomUUID as randomUUID7 } from "crypto";
-import { link as link4, lstat as lstat8, mkdir as mkdir21, realpath as realpath5, unlink as unlink9, writeFile as writeFile10 } from "fs/promises";
-import { basename as basename10, dirname as dirname19, relative as relative8, resolve as resolve14, sep as sep10 } from "path";
+import { link as link4, lstat as lstat8, mkdir as mkdir22, realpath as realpath5, unlink as unlink9, writeFile as writeFile11 } from "fs/promises";
+import { basename as basename10, dirname as dirname20, relative as relative8, resolve as resolve14, sep as sep10 } from "path";
 function collectOption3(value, previous) {
   return [...previous, value];
 }
@@ -50279,7 +50570,7 @@ async function realExistingAncestor2(path4) {
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
-      const parent = dirname19(candidate);
+      const parent = dirname20(candidate);
       if (parent === candidate)
         throw error;
       candidate = parent;
@@ -50291,11 +50582,11 @@ async function resolveOutput(workspaceRoot, outputPath) {
   const target = resolve14(workspace, outputPath);
   if (!isInside2(workspace, target))
     throw new Error("output path must stay inside the workspace");
-  const parent = dirname19(target);
+  const parent = dirname20(target);
   const existingAncestor2 = await realExistingAncestor2(parent);
   if (!isInside2(workspace, existingAncestor2) && existingAncestor2 !== workspace)
     throw new Error("output path must stay inside the workspace");
-  await mkdir21(parent, { recursive: true });
+  await mkdir22(parent, { recursive: true });
   const realParent = await realpath5(parent);
   if (!isInside2(workspace, realParent) && realParent !== workspace)
     throw new Error("output path must stay inside the workspace");
@@ -50303,7 +50594,7 @@ async function resolveOutput(workspaceRoot, outputPath) {
 }
 async function assertOutputParent(workspaceRoot, path4) {
   const workspace = await realpath5(workspaceRoot);
-  const parent = await realpath5(dirname19(path4));
+  const parent = await realpath5(dirname20(path4));
   if (!isInside2(workspace, parent) && parent !== workspace) {
     throw new Error("output path must stay inside the workspace");
   }
@@ -50317,9 +50608,9 @@ async function writeOutput(workspaceRoot, path4, content) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  const temp = resolve14(dirname19(path4), `.${basename10(path4)}.${process.pid}.${randomUUID7()}.tmp`);
+  const temp = resolve14(dirname20(path4), `.${basename10(path4)}.${process.pid}.${randomUUID7()}.tmp`);
   try {
-    await writeFile10(temp, content, "utf8");
+    await writeFile11(temp, content, "utf8");
     await assertOutputParent(workspaceRoot, path4);
     await link4(temp, path4);
   } catch (error) {
@@ -50458,6 +50749,7 @@ function buildProgram() {
   program2.addCommand(shellCommand);
   program2.addCommand(migrateCommand);
   program2.addCommand(useCommand);
+  program2.addCommand(passwordCommand);
   program2.addCommand(queriesCommand);
   program2.addCommand(explainCommand);
   program2.addCommand(lintCommand);
@@ -50511,6 +50803,7 @@ var init_program = __esm(() => {
   init_shell3();
   init_migrate();
   init_use();
+  init_credential();
   init_proxy();
   init_semantic2();
   init_design2();
@@ -50534,9 +50827,9 @@ __export(exports_completion, {
   detectShell: () => detectShell,
   completionCommand: () => completionCommand
 });
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 import { homedir as homedir4 } from "os";
-import { mkdir as mkdir22 } from "fs/promises";
+import { mkdir as mkdir23 } from "fs/promises";
 function resolveHome() {
   return process.env.HOME ?? homedir4();
 }
@@ -50786,11 +51079,11 @@ function getInstallPath2(shell) {
   const home = resolveHome();
   switch (shell) {
     case "bash":
-      return join42(home, ".bashrc");
+      return join43(home, ".bashrc");
     case "zsh":
-      return join42(home, ".zshrc");
+      return join43(home, ".zshrc");
     case "fish":
-      return join42(home, ".config", "fish", "completions", "dbcli.fish");
+      return join43(home, ".config", "fish", "completions", "dbcli.fish");
     default:
       throw new Error(`Unsupported shell: ${shell}. Supported: bash, zsh, fish`);
   }
@@ -50808,8 +51101,8 @@ function detectShell() {
 async function installCompletion(shell, script) {
   const targetPath = getInstallPath2(shell);
   if (shell === "fish") {
-    const dir = join42(resolveHome(), ".config", "fish", "completions");
-    await mkdir22(dir, { recursive: true });
+    const dir = join43(resolveHome(), ".config", "fish", "completions");
+    await mkdir23(dir, { recursive: true });
     await Bun.file(targetPath).write(script);
     console.log(colors.success(`\u2713 Fish completion installed to ${targetPath}`));
     return;
@@ -51148,6 +51441,12 @@ var COMMAND_LOADERS = {
       program2.addCommand(migrateCommand2);
     };
   },
+  password: async () => {
+    const { passwordCommand: passwordCommand2 } = await Promise.resolve().then(() => (init_credential(), exports_credential));
+    return (program2) => {
+      program2.addCommand(passwordCommand2);
+    };
+  },
   use: async () => {
     const { useCommand: useCommand2 } = await Promise.resolve().then(() => (init_use(), exports_use));
     return (program2) => {
@@ -51288,7 +51587,7 @@ async function buildProgramFor(argv) {
 
 // src/cli-runtime.ts
 init_cli_error();
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 import { writeSync as writeSync2 } from "fs";
 import { format } from "util";
 function installSynchronousRedirectedStdout() {
@@ -51426,7 +51725,7 @@ program2.hook("preAction", (thisCommand, actionCommand) => {
       try {
         let cache = null;
         try {
-          const cacheFile = Bun.file(join43(configPath, "version-check.json"));
+          const cacheFile = Bun.file(join44(configPath, "version-check.json"));
           if (await cacheFile.exists()) {
             cache = await cacheFile.json();
           }