@carllee1983/dbcli 1.56.0 → 1.58.0

package/dist/cli-runtime.mjs

@@ -51,7 +51,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "1.56.0",
+    version: "1.58.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -125,12 +125,14 @@ var init_package = __esm(() => {
       "test:unit": "bun test tests/unit tests/core",
       "test:integration": "bun test tests/integration",
       "test:gherkin": "bun test tests/gherkin",
-      "test:docker": "docker compose -f docker-compose.test.yml up -d --wait && bun test tests/integration/adapters; docker compose -f docker-compose.test.yml down",
+      "test:docker": "docker compose -f docker-compose.test.yml up -d --wait && bun test tests/integration; docker compose -f docker-compose.test.yml down",
+      "services:check": "bun run scripts/check-test-services.ts",
       "docs:check": "bun run scripts/check-user-docs.ts",
       "contract:check": "bun run scripts/check-cli-contract.ts",
       "skill:check": "bun run scripts/check-skill-parity.ts",
       "platform:check": "bun run scripts/check-platform-parity.ts",
       "agent-core:check": "bun run scripts/check-agent-core-purity.ts",
+      "core-stdout:check": "bun run scripts/check-core-no-stdout.ts",
       typecheck: "tsc --noEmit --pretty false",
       "test:perf": "bun test ./tests/perf/*.bench.ts",
       lint: "eslint src tests scripts --ext .ts --max-warnings=0",
@@ -6232,7 +6234,11 @@ function resolveEnvReferences(config, env, parentKey) {
 }
 function parseEnvPassword(content) {
   const match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
-  return match?.[1] != null ? match[1].trim() : null;
+  if (match?.[1] == null)
+    return null;
+  const raw = match[1].trim();
+  const quoted = raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'");
+  return quoted && raw.length >= 2 ? raw.slice(1, -1) : raw;
 }
 var _globalConnectionName, DEFAULT_CONFIG, configModule;
 var init_config = __esm(() => {
@@ -8939,6 +8945,12 @@ var init_messages = __esm(() => {
       invalid_config: "Invalid configuration: {field}",
       connection_failed: "Failed to connect to database: {message}",
       permission_denied: "Permission denied (required: {required})",
+      permission_requires_level: "{type} operation requires {minimum} permission or higher (current level: {permission})",
+      elasticsearch_requires_level: "Elasticsearch {type} operation requires {minimum} permission or higher (current level: {permission})",
+      escalated_write_requires_admin: "This statement opens as a read but contains an executable {keyword}. A write hidden inside a read statement requires admin permission (current level: {permission}).",
+      multiple_statements_refused: "SQL containing multiple statements is refused below admin permission, because only the first statement determines the permission check. Run each statement separately.",
+      unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires read-write+ for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
+      permission_denied_reason: "Permission denied: {reason}",
       table_not_found: "Table not found: {table}",
       unsupported_lang: "Language '{lang}' not supported, using English",
       invalid_json: "Invalid JSON: {message}",
@@ -8960,7 +8972,8 @@ Provide options: --env-host, --env-port, --env-user, --env-password, --env-datab
 Or use interactive mode: run "dbcli init --use-env-refs" without --no-interactive`,
       env_var_not_defined: `Cannot test connection: environment variable {envKey} is not defined.
 Set {envKey} in .env or environment variables.
-Hint: run 'export {envKey}=<value>' and retry`
+Hint: run 'export {envKey}=<value>' and retry`,
+      invalid_output_format: "--format {format} is not supported here \u2014 use text or json"
     },
     success: {
       inserted: "Successfully inserted {count} row(s)",
@@ -8971,19 +8984,22 @@ Hint: run 'export {envKey}=<value>' and retry`
     insert: {
       description: "Insert data into a table",
       prompt_data: "Enter JSON data to insert: ",
-      confirm: "Insert {count} row(s) into {table}? (y/n): "
+      confirm: "Insert {count} row(s) into {table}? (y/n): ",
+      elasticsearch_unsupported: "Elasticsearch does not support the insert command; for now, use an external tool (e.g. curl or Kibana DevTools) to write documents"
     },
     update: {
       description: "Update data in a table",
       prompt_where: "Enter WHERE clause (e.g., id=1): ",
       prompt_set: 'Enter JSON updates (e.g., {"status": "active"}): ',
-      confirm: "Update rows in {table}? (y/n): "
+      confirm: "Update rows in {table}? (y/n): ",
+      elasticsearch_unsupported: "Elasticsearch does not support the update command; for now, use an external tool (e.g. curl or Kibana DevTools) to update documents"
     },
     delete: {
       description: "Delete data from a table",
       prompt_where: "Enter WHERE clause (e.g., id=1): ",
       confirm: "Delete rows from {table}? (y/n): ",
-      admin_only: "Delete command requires data-admin or admin permission"
+      admin_only: "Delete command requires data-admin or admin permission",
+      elasticsearch_unsupported: "Elasticsearch does not support the delete command; for now, use an external tool (e.g. curl or Kibana DevTools) to delete documents"
     },
     export: {
       description: "Export query results",
@@ -9058,6 +9074,20 @@ Reference: {referencePath}`,
       add_enum_description: "Create an enum type (PostgreSQL only)",
       alter_enum_description: "Add a value to an enum type",
       drop_enum_description: "Drop an enum type"
+    },
+    password: {
+      description: "Change the password of a single connection, leaving every other setting untouched",
+      arg_connection: "Connection name (defaults to the current default connection)",
+      opt_stdin: "Read the new password from stdin (for rotation scripts)",
+      opt_password: "New password given inline (visible in shell history and process list)",
+      opt_skip_test: "Skip verifying the new password against the database before saving",
+      prompt: "New password for connection '{name}'",
+      source_conflict: "--password and --stdin cannot be used together; pick one source.",
+      needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
+      empty: "The new password is empty; nothing was changed.",
+      updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
+      converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
+      skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
     }
   };
 });
@@ -9223,6 +9253,12 @@ var init_messages2 = __esm(() => {
       invalid_config: "\u914D\u7F6E\u7121\u6548\uFF1A{field}",
       connection_failed: "\u7121\u6CD5\u9023\u63A5\u5230\u8CC7\u6599\u5EAB\uFF1A{message}",
       permission_denied: "\u6B0A\u9650\u88AB\u62D2\uFF08\u9700\u8981\uFF1A{required}\uFF09",
+      permission_requires_level: "{type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+      elasticsearch_requires_level: "Elasticsearch {type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+      escalated_write_requires_admin: "\u6B64\u8A9E\u53E5\u8868\u9762\u4E0A\u662F\u8B80\u53D6\uFF0C\u4F46\u5BE6\u969B\u5305\u542B\u53EF\u57F7\u884C\u7684 {keyword}\u3002\u8B80\u53D6\u8A9E\u53E5\u4E2D\u96B1\u85CF\u5BEB\u5165\u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09\u3002",
+      multiple_statements_refused: "\u4F4E\u65BC admin \u6B0A\u9650\u6642\u62D2\u7D55\u57F7\u884C\u5305\u542B\u591A\u500B\u8A9E\u53E5\u7684 SQL\uFF0C\u56E0\u70BA\u6B0A\u9650\u6AA2\u67E5\u53EA\u6703\u4F9D\u64DA\u7B2C\u4E00\u500B\u8A9E\u53E5\u5224\u65B7\u3002\u8ACB\u5C07\u5404\u8A9E\u53E5\u5206\u958B\u57F7\u884C\u3002",
+      unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u81F3\u5C11\u9700\u8981 read-write \u4EE5\u4E0A\u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
+      permission_denied_reason: "\u6B0A\u9650\u88AB\u62D2\uFF1A{reason}",
       table_not_found: "\u627E\u4E0D\u5230\u8868\u683C\uFF1A{table}",
       unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
       invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
@@ -9244,7 +9280,8 @@ var init_messages2 = __esm(() => {
 \u6216\u4F7F\u7528\u4E92\u52D5\u6A21\u5F0F\uFF1A\u57F7\u884C "dbcli init --use-env-refs"\uFF08\u4E0D\u52A0 --no-interactive\uFF09`,
       env_var_not_defined: `\u7121\u6CD5\u6E2C\u8A66\u9023\u7DDA\uFF1A\u74B0\u5883\u8B8A\u6578 {envKey} \u672A\u5B9A\u7FA9\u3002
 \u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u6578\u4E2D\u8A2D\u5B9A {envKey}\u3002
-\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`
+\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`,
+      invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json"
     },
     success: {
       inserted: "\u6210\u529F\u63D2\u5165 {count} \u5217",
@@ -9255,19 +9292,22 @@ var init_messages2 = __esm(() => {
     insert: {
       description: "\u63D2\u5165\u8CC7\u6599\u5230\u8868\u683C",
       prompt_data: "\u8F38\u5165\u8981\u63D2\u5165\u7684 JSON \u8CC7\u6599\uFF1A",
-      confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A"
+      confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 insert \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u5BEB\u5165"
     },
     update: {
       description: "\u66F4\u65B0\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
       prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
       prompt_set: '\u8F38\u5165 JSON \u66F4\u65B0 (\u4F8B\u5982\uFF1A{"status": "active"})\uFF1A',
-      confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A"
+      confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 update \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u66F4\u65B0"
     },
     delete: {
       description: "\u522A\u9664\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
       prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
       confirm: "\u522A\u9664 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
-      admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650"
+      admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 delete \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u522A\u9664"
     },
     export: {
       description: "\u532F\u51FA\u67E5\u8A62\u7D50\u679C",
@@ -9342,6 +9382,20 @@ var init_messages2 = __esm(() => {
       add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
       alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
       drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+    },
+    password: {
+      description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
+      arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
+      opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
+      opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
+      opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
+      prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
+      source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
+      needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
+      empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
+      updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
+      converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
+      skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
     }
   };
 });
@@ -9398,6 +9452,60 @@ var init_shell2 = __esm(() => {
   };
 });
 
+// resources/lang/en/ceremony.json
+var ceremony_default;
+var init_ceremony = __esm(() => {
+  ceremony_default = {
+    updated: "Updated {count} row(s) in {table}",
+    deleted: "Deleted {count} row(s) from {table}",
+    inserted: "Inserted {count} row(s) into {table}",
+    matched_nothing: "No rows matched in {table} \u2014 nothing changed",
+    cancelled: "Cancelled. {table} was not changed",
+    dry_run: "Preview only. {table} was not changed",
+    elapsed: "Took {seconds}s",
+    failed: "Failed: {reason}",
+    unknown_error: "unknown error",
+    confirm_sql: "Generated SQL:",
+    confirm_command: "Command to run:",
+    confirm_params: "Parameters:",
+    confirm_destructive_warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
+    confirm_destructive_prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone.",
+    confirm_destructive_warning_ddl: "\u26A0\uFE0F  Warning: this schema change is destructive and cannot be undone!",
+    confirm_ddl_prompt: "Are you sure you want to run this {operation}? This cannot be undone.",
+    confirm_prompt: "Proceed with this operation?",
+    recovery_none: "This cannot be undone automatically \u2014 restore from a backup to get the previous values back.",
+    recovery_retry: "Re-run with --recovery to write a recovery plan, then read it with: dbcli recover",
+    blacklist_hint: "Run `dbcli blacklist list` to see what is protected"
+  };
+});
+
+// resources/lang/zh-TW/ceremony.json
+var ceremony_default2;
+var init_ceremony2 = __esm(() => {
+  ceremony_default2 = {
+    updated: "\u5DF2\u66F4\u65B0 {table} \u7684 {count} \u5217",
+    deleted: "\u5DF2\u5F9E {table} \u522A\u9664 {count} \u5217",
+    inserted: "\u5DF2\u5BEB\u5165 {count} \u5217\u5230 {table}",
+    matched_nothing: "{table} \u6C92\u6709\u4EFB\u4F55\u5217\u7B26\u5408\u689D\u4EF6\uFF0C\u8CC7\u6599\u672A\u8B8A\u52D5",
+    cancelled: "\u5DF2\u53D6\u6D88\uFF0C{table} \u672A\u8B8A\u52D5",
+    dry_run: "\u50C5\u9810\u89BD\uFF0C{table} \u672A\u8B8A\u52D5",
+    elapsed: "\u8017\u6642 {seconds} \u79D2",
+    failed: "\u5931\u6557\uFF1A{reason}",
+    unknown_error: "\u672A\u77E5\u7684\u932F\u8AA4",
+    confirm_sql: "\u7522\u751F\u7684 SQL\uFF1A",
+    confirm_command: "\u5373\u5C07\u57F7\u884C\u7684\u6307\u4EE4\uFF1A",
+    confirm_params: "\u53C3\u6578\uFF1A",
+    confirm_destructive_warning: "\u26A0\uFE0F  \u8B66\u544A\uFF1ADELETE \u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+    confirm_destructive_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B DELETE \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+    confirm_destructive_warning_ddl: "\u26A0\uFE0F  \u8B66\u544A\uFF1A\u9019\u500B schema \u8B8A\u66F4\u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+    confirm_ddl_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B {operation} \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+    confirm_prompt: "\u8981\u7E7C\u7E8C\u57F7\u884C\u9019\u500B\u64CD\u4F5C\u55CE\uFF1F",
+    recovery_none: "\u6B64\u64CD\u4F5C\u7121\u6CD5\u81EA\u52D5\u9084\u539F\uFF0C\u8981\u53D6\u56DE\u5148\u524D\u7684\u8CC7\u6599\u8ACB\u5F9E\u5099\u4EFD\u56DE\u5FA9\u3002",
+    recovery_retry: "\u52A0\u4E0A --recovery \u91CD\u8DD1\u53EF\u7522\u751F\u56DE\u5FA9\u8A08\u756B\uFF0C\u518D\u7528 dbcli recover \u8B80\u53D6",
+    blacklist_hint: "\u57F7\u884C `dbcli blacklist list` \u67E5\u770B\u53D7\u4FDD\u8B77\u7684\u9805\u76EE"
+  };
+});
+
 // src/i18n/message-loader.ts
 class MessageLoader {
   static instance = null;
@@ -9464,9 +9572,15 @@ var init_message_loader = __esm(() => {
   init_messages2();
   init_shell();
   init_shell2();
+  init_ceremony();
+  init_ceremony2();
   BUNDLED_MESSAGES = {
-    en: { ...messages_default, shell: shell_default },
-    "zh-TW": { ...messages_default2, shell: shell_default2 }
+    en: { ...messages_default, shell: shell_default, ceremony: ceremony_default },
+    "zh-TW": {
+      ...messages_default2,
+      shell: shell_default2,
+      ceremony: ceremony_default2
+    }
   };
   messageLoader = MessageLoader.getInstance();
 });
@@ -9632,7 +9746,8 @@ async function selectFallback(message, choices) {
   return choices[0] ?? "";
 }
 async function confirmFallback(message) {
-  const answer = await readLineFromStdin(`${message} (y/n): `);
+  process.stderr.write(`${message} (y/n): `);
+  const answer = await readLineFromStdin();
   return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
 }
 async function text(message, defaultValue) {
@@ -9651,20 +9766,28 @@ async function select(message, choices) {
     return await selectFallback(message, choices);
   return await inquirer.select({ message, choices });
 }
+async function secret(message) {
+  const inquirer = await loadInquirer();
+  if (!inquirer) {
+    throw new Error("Masked input is unavailable; pass the value with --stdin or --password instead.");
+  }
+  return await inquirer.password({ message, mask: "*" });
+}
 async function confirm(message) {
   if (!process.stdin.isTTY)
     return await confirmFallback(message);
   const inquirer = await loadInquirer();
   if (!inquirer)
     return await confirmFallback(message);
-  return await inquirer.confirm({ message });
+  return await inquirer.confirm({ message }, { output: process.stderr });
 }
 var promptsUnavailableReported = false, promptUser;
 var init_prompts = __esm(() => {
   promptUser = {
     text,
     select,
-    confirm
+    confirm,
+    secret
   };
 });
 
@@ -18515,33 +18638,7 @@ var init_sql_lexical = __esm(() => {
   DOLLAR_QUOTE_DELIMITER = /^\$(?:(?:[A-Za-z_]|[\u0080-\uFFFF])(?:[A-Za-z0-9_]|[\u0080-\uFFFF])*)?\$/;
 });
 
-// src/core/permission-guard.ts
-var exports_permission_guard = {};
-__export(exports_permission_guard, {
-  toSqlDialect: () => toSqlDialect,
-  stripCommentsAndStrings: () => stripCommentsAndStrings,
-  removeParameterMarkers: () => removeParameterMarkers,
-  permissionAtLeast: () => permissionAtLeast,
-  normalizeSQL: () => normalizeSQL,
-  mapKeywordToType: () => mapKeywordToType,
-  isDestructiveOperation: () => isDestructiveOperation,
-  findWriteKeyword: () => findWriteKeyword,
-  extractFirstKeyword: () => extractFirstKeyword,
-  extractAllKeywords: () => extractAllKeywords,
-  enforceRedisPermission: () => enforceRedisPermission,
-  enforcePermission: () => enforcePermission,
-  enforceElasticsearchPermission: () => enforceElasticsearchPermission,
-  determineConfidence: () => determineConfidence,
-  detectCompositePatterns: () => detectCompositePatterns,
-  containsMultipleStatements: () => containsMultipleStatements,
-  classifyStatement: () => classifyStatement,
-  classifyRedisCommand: () => classifyRedisCommand,
-  classifyElasticsearchRequest: () => classifyElasticsearchRequest,
-  checkPermission: () => checkPermission,
-  SQL_WRITE_OR_DDL_KEYWORDS: () => SQL_WRITE_OR_DDL_KEYWORDS,
-  SQL_DIALECTS: () => SQL_DIALECTS,
-  PermissionError: () => PermissionError
-});
+// src/core/permission/sql-analysis.ts
 function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
@@ -18788,6 +18885,29 @@ function determineConfidence(type, _keyword, _sql) {
 function removeParameterMarkers(sql) {
   return sql.replace(/\$\d+/g, "").replace(/\?/g, "");
 }
+var init_sql_analysis = __esm(() => {
+  init_sql_lexical();
+});
+
+// src/core/permission-guard.ts
+var exports_permission_guard = {};
+__export(exports_permission_guard, {
+  toSqlDialect: () => toSqlDialect,
+  permitsOperation: () => permitsOperation,
+  permissionAtLeast: () => permissionAtLeast,
+  minimumPermissionFor: () => minimumPermissionFor,
+  findWriteKeyword: () => findWriteKeyword,
+  enforcePermissionForType: () => enforcePermissionForType,
+  enforcePermission: () => enforcePermission,
+  containsMultipleStatements: () => containsMultipleStatements,
+  classifyStatement: () => classifyStatement,
+  classificationForType: () => classificationForType,
+  checkPermissionForClassification: () => checkPermissionForClassification,
+  checkPermission: () => checkPermission,
+  SQL_WRITE_OR_DDL_KEYWORDS: () => SQL_WRITE_OR_DDL_KEYWORDS,
+  SQL_DIALECTS: () => SQL_DIALECTS,
+  PermissionError: () => PermissionError
+});
 function classifyStatement(sql) {
   const normalized = normalizeSQL(sql);
   const stripped = stripCommentsAndStrings(normalized);
@@ -18853,15 +18973,33 @@ function checkPermission(sql, permission, dialect) {
   if (permission !== "admin" && containsMultipleStatements(sql, dialect)) {
     return {
       allowed: false,
-      reason: "SQL containing multiple statements is refused below admin permission, because only " + "the first statement determines the permission check. Run each statement separately.",
-      classification
+      reason: t("errors.multiple_statements_refused"),
+      classification,
+      requiredPermission: "admin"
     };
   }
+  return checkPermissionForClassification(classification, permission);
+}
+function minimumPermissionFor(type) {
+  return TIER_GRANTS.find((tier) => tier.types.includes(type))?.permission ?? "admin";
+}
+function refusalReason(type, permission) {
+  return t_vars("errors.permission_requires_level", {
+    type,
+    minimum: minimumPermissionFor(type),
+    permission
+  });
+}
+function checkPermissionForClassification(classification, permission) {
   if (permission !== "admin" && classification.escalatedFrom) {
     return {
       allowed: false,
-      reason: `This statement opens as a read but contains an executable ` + `${classification.escalatedFrom}. A write hidden inside a read statement ` + `requires admin permission (current level: ${permission}).`,
-      classification
+      reason: t_vars("errors.escalated_write_requires_admin", {
+        keyword: classification.escalatedFrom,
+        permission
+      }),
+      classification,
+      requiredPermission: "admin"
     };
   }
   if (permission === "admin") {
@@ -18871,220 +19009,64 @@ function checkPermission(sql, permission, dialect) {
       classification
     };
   }
-  if (permission === "data-admin") {
-    const allowedTypes = ["SELECT", "INSERT", "UPDATE", "DELETE", "SHOW", "DESCRIBE", "EXPLAIN"];
-    if (allowedTypes.includes(classification.type)) {
-      return {
-        allowed: true,
-        reason: `${classification.type} operation allowed in data-admin mode`,
-        classification
-      };
-    }
-    return {
-      allowed: false,
-      reason: `${classification.type} operation requires admin permission`,
-      classification
-    };
-  }
-  if (permission === "read-write") {
-    const allowedTypes = ["SELECT", "INSERT", "UPDATE", "SHOW", "DESCRIBE", "EXPLAIN"];
-    if (allowedTypes.includes(classification.type)) {
-      return {
-        allowed: true,
-        reason: `${classification.type} operation allowed in read-write mode`,
-        classification
-      };
-    }
-    return {
-      allowed: false,
-      reason: `${classification.type} operation requires data-admin or admin permission`,
-      classification
-    };
-  }
-  if (permission === "query-only") {
-    const allowedTypes = ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN"];
+  const tierIndex = TIER_GRANTS.findIndex((tier) => tier.permission === permission);
+  if (tierIndex !== -1) {
+    const allowedTypes = TIER_GRANTS.slice(0, tierIndex + 1).flatMap((tier) => tier.types);
     if (allowedTypes.includes(classification.type)) {
       return {
         allowed: true,
-        reason: `${classification.type} operation allowed in query-only mode`,
+        reason: `${classification.type} operation allowed in ${permission} mode`,
         classification
       };
     }
-    const isUnknown = classification.type === "UNKNOWN";
+    const isUnknown = permission === "query-only" && classification.type === "UNKNOWN";
     return {
       allowed: false,
-      reason: isUnknown ? `Unrecognised SQL statement (current level: query-only). Security policy requires read-write+ for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.` : `${classification.type} operation requires read-write or admin permission`,
-      classification
+      reason: isUnknown ? t("errors.unknown_statement_query_only") : refusalReason(classification.type, permission),
+      classification,
+      requiredPermission: isUnknown ? "read-write" : minimumPermissionFor(classification.type)
     };
   }
   return {
     allowed: false,
     reason: `Unknown permission level: ${permission}`,
-    classification
+    classification,
+    requiredPermission: "admin"
   };
 }
-function enforcePermission(sql, permission, dialect) {
-  const result = checkPermission(sql, permission, dialect);
-  if (!result.allowed) {
-    throw new PermissionError(result.reason, result.classification, permission);
-  }
-  return result.classification;
-}
-function classifyRedisCommand(command) {
-  const head = command.trim().split(/\s+/)[0]?.toUpperCase() ?? "";
-  const required = REDIS_COMMAND_PERMISSION[head];
-  let type;
-  if (!required)
-    type = "UNKNOWN";
-  else if (required === "query-only")
-    type = "SELECT";
-  else if (required === "read-write")
-    type = "UPDATE";
-  else if (required === "data-admin")
-    type = "DELETE";
-  else
-    type = "DROP";
+function classificationForType(type) {
   return {
-    command: head,
-    requiredPermission: required ?? "unknown",
     type,
-    isDangerous: required === "admin" || required === "data-admin"
-  };
-}
-function permissionAtLeast(actual, required) {
-  return PERMISSION_RANK[actual] >= PERMISSION_RANK[required];
-}
-function enforceRedisPermission(command, permission) {
-  const classification = classifyRedisCommand(command);
-  const required = classification.requiredPermission;
-  const stmt = {
-    type: classification.type,
-    isDangerous: classification.isDangerous,
-    keywords: [classification.command],
+    isDangerous: isDestructiveOperation(type),
+    keywords: [type],
     isComposite: false,
-    confidence: required === "unknown" ? "LOW" : "HIGH"
+    confidence: "HIGH"
   };
-  if (required === "unknown") {
-    throw new PermissionError(`Redis command "${classification.command}" is not whitelisted; refusing to execute`, stmt, "admin");
-  }
-  if (!permissionAtLeast(permission, required)) {
-    throw new PermissionError(`Redis command "${classification.command}" requires ${required} permission`, stmt, required);
-  }
-  return classification;
 }
-function classifyElasticsearchRequest(request) {
-  const method = request.method.toUpperCase();
-  const path = request.apiPath.toLowerCase();
-  if (path.includes("_bulk")) {
-    return classifyElasticsearchBulk(request.body ?? "");
-  }
-  if (path.includes("_search") || path.includes("_count") || path.includes("_mapping") || path.includes("_settings") || path.includes("_alias") || method === "GET" && (path.includes("_doc") || path.includes("_source"))) {
-    return {
-      type: "SELECT",
-      isDangerous: false,
-      keywords: [method, path],
-      isComposite: false,
-      confidence: "HIGH"
-    };
-  }
-  if (path.includes("_update") || method === "POST" && path.includes("_doc")) {
-    return {
-      type: "UPDATE",
-      isDangerous: false,
-      keywords: [method, path],
-      isComposite: false,
-      confidence: "HIGH"
-    };
-  }
-  if (method === "PUT" && (path.includes("_doc") || path.includes("_create"))) {
-    return {
-      type: "INSERT",
-      isDangerous: false,
-      keywords: [method, path],
-      isComposite: false,
-      confidence: "HIGH"
-    };
-  }
-  if (method === "DELETE") {
-    return {
-      type: "DELETE",
-      isDangerous: true,
-      keywords: [method, path],
-      isComposite: false,
-      confidence: "HIGH"
-    };
-  }
-  return {
-    type: "DROP",
-    isDangerous: true,
-    keywords: [method, path],
-    isComposite: false,
-    confidence: "LOW"
-  };
+function permitsOperation(type, permission) {
+  return checkPermissionForClassification(classificationForType(type), permission).allowed;
 }
-function classifyElasticsearchBulk(body) {
-  const lines = body.split(`
-`).filter((l) => l.trim().length > 0);
-  let highestType = "SELECT";
-  let isDangerous = false;
-  for (const line of lines) {
-    try {
-      const action = JSON.parse(line);
-      const op = Object.keys(action)[0];
-      if (op === "delete") {
-        highestType = "DELETE";
-        isDangerous = true;
-        break;
-      }
-      if (op === "update" && highestType !== "DELETE") {
-        highestType = "UPDATE";
-      }
-      if ((op === "index" || op === "create") && !["DELETE", "UPDATE"].includes(highestType)) {
-        highestType = "INSERT";
-      }
-    } catch {}
+function enforcePermissionForType(type, permission) {
+  const classification = classificationForType(type);
+  const result = checkPermissionForClassification(classification, permission);
+  if (!result.allowed) {
+    throw new PermissionError(result.reason, classification, minimumPermissionFor(type));
   }
-  return {
-    type: highestType,
-    isDangerous,
-    keywords: ["BULK"],
-    isComposite: true,
-    confidence: "HIGH"
-  };
 }
-function enforceElasticsearchPermission(request, permission) {
-  const classification = classifyElasticsearchRequest(request);
-  const result = checkElasticsearchPermission(classification, permission);
+function enforcePermission(sql, permission, dialect) {
+  const result = checkPermission(sql, permission, dialect);
   if (!result.allowed) {
-    throw new PermissionError(result.reason, classification, permission);
+    throw new PermissionError(result.reason, result.classification, result.requiredPermission ?? "admin");
   }
-  return classification;
+  return result.classification;
 }
-function checkElasticsearchPermission(classification, permission) {
-  if (permission === "admin")
-    return { allowed: true, reason: "Admin" };
-  if (permission === "data-admin") {
-    const allowed = ["SELECT", "INSERT", "UPDATE", "DELETE"];
-    if (allowed.includes(classification.type))
-      return { allowed: true, reason: "Data-Admin" };
-  }
-  if (permission === "read-write") {
-    const allowed = ["SELECT", "INSERT", "UPDATE"];
-    if (allowed.includes(classification.type))
-      return { allowed: true, reason: "Read-Write" };
-  }
-  if (permission === "query-only") {
-    if (classification.type === "SELECT")
-      return { allowed: true, reason: "Query-Only" };
-  }
-  return {
-    allowed: false,
-    reason: `Elasticsearch ${classification.type} operation requires higher permission tier`
-  };
+function permissionAtLeast(actual, required) {
+  return PERMISSION_RANK[actual] >= PERMISSION_RANK[required];
 }
-var PermissionError, SQL_DIALECTS, SQL_WRITE_OR_DDL_KEYWORDS, SQL_LOCK_CLAUSE, ESCALATABLE_READ_TYPES, REDIS_COMMAND_PERMISSION, PERMISSION_RANK;
+var PermissionError, SQL_DIALECTS, SQL_WRITE_OR_DDL_KEYWORDS, SQL_LOCK_CLAUSE, ESCALATABLE_READ_TYPES, TIER_GRANTS, PERMISSION_RANK;
 var init_permission_guard = __esm(() => {
-  init_sql_lexical();
+  init_message_loader();
+  init_sql_analysis();
   PermissionError = class PermissionError extends Error {
     classification;
     requiredPermission;
@@ -19100,90 +19082,11 @@ var init_permission_guard = __esm(() => {
   SQL_WRITE_OR_DDL_KEYWORDS = /(?<![.\w])(INSERT|UPDATE|DELETE|MERGE|UPSERT|REPLACE|TRUNCATE|DROP|ALTER|CREATE|GRANT|REVOKE|RENAME|INTO)\b(?!\s*\()/i;
   SQL_LOCK_CLAUSE = /\bFOR\s+(?:NO\s+KEY\s+)?UPDATE\b|\bFOR\s+(?:KEY\s+)?SHARE\b/gi;
   ESCALATABLE_READ_TYPES = new Set(["SELECT", "EXPLAIN", "DESCRIBE"]);
-  REDIS_COMMAND_PERMISSION = {
-    GET: "query-only",
-    MGET: "query-only",
-    STRLEN: "query-only",
-    EXISTS: "query-only",
-    TTL: "query-only",
-    PTTL: "query-only",
-    TYPE: "query-only",
-    SCAN: "query-only",
-    HGET: "query-only",
-    HGETALL: "query-only",
-    HKEYS: "query-only",
-    HVALS: "query-only",
-    HLEN: "query-only",
-    HEXISTS: "query-only",
-    HMGET: "query-only",
-    LRANGE: "query-only",
-    LLEN: "query-only",
-    LINDEX: "query-only",
-    SMEMBERS: "query-only",
-    SCARD: "query-only",
-    SISMEMBER: "query-only",
-    ZRANGE: "query-only",
-    ZREVRANGE: "query-only",
-    ZRANGEBYSCORE: "query-only",
-    ZCARD: "query-only",
-    ZSCORE: "query-only",
-    PING: "query-only",
-    ECHO: "query-only",
-    SET: "read-write",
-    SETEX: "read-write",
-    SETNX: "read-write",
-    PSETEX: "read-write",
-    MSET: "read-write",
-    MSETNX: "read-write",
-    APPEND: "read-write",
-    INCR: "read-write",
-    INCRBY: "read-write",
-    DECR: "read-write",
-    DECRBY: "read-write",
-    HSET: "read-write",
-    HSETNX: "read-write",
-    HMSET: "read-write",
-    HINCRBY: "read-write",
-    LPUSH: "read-write",
-    RPUSH: "read-write",
-    LPOP: "read-write",
-    RPOP: "read-write",
-    LSET: "read-write",
-    LREM: "read-write",
-    SADD: "read-write",
-    SREM: "read-write",
-    ZADD: "read-write",
-    ZREM: "read-write",
-    XADD: "read-write",
-    XDEL: "data-admin",
-    XLEN: "query-only",
-    XREAD: "query-only",
-    XRANGE: "query-only",
-    XREVRANGE: "query-only",
-    EXPIRE: "read-write",
-    EXPIREAT: "read-write",
-    PEXPIRE: "read-write",
-    PERSIST: "read-write",
-    RENAME: "read-write",
-    DEL: "data-admin",
-    UNLINK: "data-admin",
-    HDEL: "data-admin",
-    FLUSHDB: "admin",
-    FLUSHALL: "admin",
-    CONFIG: "admin",
-    INFO: "admin",
-    CLIENT: "admin",
-    DEBUG: "admin",
-    SHUTDOWN: "admin",
-    KEYS: "admin",
-    MONITOR: "admin",
-    SAVE: "admin",
-    BGSAVE: "admin",
-    BGREWRITEAOF: "admin",
-    REPLICAOF: "admin",
-    SLAVEOF: "admin",
-    ACL: "admin"
-  };
+  TIER_GRANTS = [
+    { permission: "query-only", types: ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN"] },
+    { permission: "read-write", types: ["INSERT", "UPDATE"] },
+    { permission: "data-admin", types: ["DELETE"] }
+  ];
   PERMISSION_RANK = {
     "query-only": 1,
     "read-write": 2,
@@ -21874,6 +21777,7 @@ function inferColumnType(value) {
 }
 var init_query_executor = __esm(() => {
   init_permission_guard();
+  init_sql_analysis();
   init_error_suggester();
   init_sql_tables();
   init_applied_limit();
@@ -22173,6 +22077,263 @@ function assertFanOutReadOnlySql(sql, dialect) {
 var init_query_fanout = __esm(() => {
   init_cli_error();
   init_permission_guard();
+  init_sql_analysis();
+});
+
+// src/core/permission/elasticsearch.ts
+function classifyElasticsearchRequest(request) {
+  const method = request.method.toUpperCase();
+  const path2 = request.apiPath.toLowerCase();
+  if (path2.includes("_bulk")) {
+    return classifyElasticsearchBulk(request.body ?? "");
+  }
+  const readMethod = method === "GET" || method === "HEAD";
+  const searchPath = path2.includes("_search") || path2.includes("_count");
+  if (searchPath && (readMethod || method === "POST") || readMethod && (path2.includes("_mapping") || path2.includes("_settings") || path2.includes("_alias") || path2.includes("_doc") || path2.includes("_source"))) {
+    return {
+      type: "SELECT",
+      isDangerous: false,
+      keywords: [method, path2],
+      isComposite: false,
+      confidence: "HIGH"
+    };
+  }
+  if (path2.includes("_update") || method === "POST" && path2.includes("_doc")) {
+    return {
+      type: "UPDATE",
+      isDangerous: false,
+      keywords: [method, path2],
+      isComposite: false,
+      confidence: "HIGH"
+    };
+  }
+  if (method === "PUT" && (path2.includes("_doc") || path2.includes("_create"))) {
+    return {
+      type: "INSERT",
+      isDangerous: false,
+      keywords: [method, path2],
+      isComposite: false,
+      confidence: "HIGH"
+    };
+  }
+  if (method === "DELETE") {
+    if (ES_DOCUMENT_PATH.test(path2)) {
+      return {
+        type: "DELETE",
+        isDangerous: true,
+        keywords: [method, path2],
+        isComposite: false,
+        confidence: "HIGH"
+      };
+    }
+    return {
+      type: "DROP",
+      isDangerous: true,
+      keywords: [method, path2],
+      isComposite: false,
+      confidence: "HIGH"
+    };
+  }
+  return {
+    type: "DROP",
+    isDangerous: true,
+    keywords: [method, path2],
+    isComposite: false,
+    confidence: "LOW"
+  };
+}
+function classifyElasticsearchBulk(body) {
+  const lines = body.split(`
+`).filter((l) => l.trim().length > 0);
+  let highestType = "SELECT";
+  let isDangerous = false;
+  for (const line of lines) {
+    try {
+      const action = JSON.parse(line);
+      const op = Object.keys(action)[0];
+      if (op === "delete") {
+        highestType = "DELETE";
+        isDangerous = true;
+        break;
+      }
+      if (op === "update" && highestType !== "DELETE") {
+        highestType = "UPDATE";
+      }
+      if ((op === "index" || op === "create") && !["DELETE", "UPDATE"].includes(highestType)) {
+        highestType = "INSERT";
+      }
+    } catch {}
+  }
+  return {
+    type: highestType,
+    isDangerous,
+    keywords: ["BULK"],
+    isComposite: true,
+    confidence: "HIGH"
+  };
+}
+function enforceElasticsearchPermission(request, permission) {
+  const classification = classifyElasticsearchRequest(request);
+  const result = checkElasticsearchPermission(classification, permission);
+  if (!result.allowed) {
+    throw new PermissionError(result.reason, classification, result.requiredPermission ?? "admin");
+  }
+  return classification;
+}
+function checkElasticsearchPermission(classification, permission) {
+  if (permitsOperation(classification.type, permission)) {
+    return { allowed: true, reason: `${classification.type} allowed in ${permission} mode` };
+  }
+  const minimum = minimumPermissionFor(classification.type);
+  return {
+    allowed: false,
+    reason: t_vars("errors.elasticsearch_requires_level", {
+      type: classification.type,
+      minimum,
+      permission
+    }),
+    requiredPermission: minimum
+  };
+}
+var ES_DOCUMENT_PATH;
+var init_elasticsearch = __esm(() => {
+  init_permission_guard();
+  init_message_loader();
+  ES_DOCUMENT_PATH = /\/(?:_doc|_source)\/[^/?]+/;
+});
+
+// src/core/permission/redis.ts
+var exports_redis = {};
+__export(exports_redis, {
+  enforceRedisPermission: () => enforceRedisPermission,
+  classifyRedisCommand: () => classifyRedisCommand
+});
+function classifyRedisCommand(command) {
+  const head = command.trim().split(/\s+/)[0]?.toUpperCase() ?? "";
+  const required = REDIS_COMMAND_PERMISSION[head];
+  let type;
+  if (!required)
+    type = "UNKNOWN";
+  else if (required === "query-only")
+    type = "SELECT";
+  else if (required === "read-write")
+    type = "UPDATE";
+  else if (required === "data-admin")
+    type = "DELETE";
+  else
+    type = "DROP";
+  return {
+    command: head,
+    requiredPermission: required ?? "unknown",
+    type,
+    isDangerous: required === "admin" || required === "data-admin"
+  };
+}
+function enforceRedisPermission(command, permission) {
+  const classification = classifyRedisCommand(command);
+  const required = classification.requiredPermission;
+  const stmt = {
+    type: classification.type,
+    isDangerous: classification.isDangerous,
+    keywords: [classification.command],
+    isComposite: false,
+    confidence: required === "unknown" ? "LOW" : "HIGH"
+  };
+  if (required === "unknown") {
+    throw new PermissionError(`Redis command "${classification.command}" is not whitelisted; refusing to execute`, stmt, "admin");
+  }
+  if (!permissionAtLeast(permission, required)) {
+    throw new PermissionError(`Redis command "${classification.command}" requires ${required} permission`, stmt, required);
+  }
+  return classification;
+}
+var REDIS_COMMAND_PERMISSION;
+var init_redis = __esm(() => {
+  init_permission_guard();
+  REDIS_COMMAND_PERMISSION = {
+    GET: "query-only",
+    MGET: "query-only",
+    STRLEN: "query-only",
+    EXISTS: "query-only",
+    TTL: "query-only",
+    PTTL: "query-only",
+    TYPE: "query-only",
+    SCAN: "query-only",
+    HGET: "query-only",
+    HGETALL: "query-only",
+    HKEYS: "query-only",
+    HVALS: "query-only",
+    HLEN: "query-only",
+    HEXISTS: "query-only",
+    HMGET: "query-only",
+    LRANGE: "query-only",
+    LLEN: "query-only",
+    LINDEX: "query-only",
+    SMEMBERS: "query-only",
+    SCARD: "query-only",
+    SISMEMBER: "query-only",
+    ZRANGE: "query-only",
+    ZREVRANGE: "query-only",
+    ZRANGEBYSCORE: "query-only",
+    ZCARD: "query-only",
+    ZSCORE: "query-only",
+    PING: "query-only",
+    ECHO: "query-only",
+    SET: "read-write",
+    SETEX: "read-write",
+    SETNX: "read-write",
+    PSETEX: "read-write",
+    MSET: "read-write",
+    MSETNX: "read-write",
+    APPEND: "read-write",
+    INCR: "read-write",
+    INCRBY: "read-write",
+    DECR: "read-write",
+    DECRBY: "read-write",
+    HSET: "read-write",
+    HSETNX: "read-write",
+    HMSET: "read-write",
+    HINCRBY: "read-write",
+    LPUSH: "read-write",
+    RPUSH: "read-write",
+    LPOP: "read-write",
+    RPOP: "read-write",
+    LSET: "read-write",
+    LREM: "read-write",
+    SADD: "read-write",
+    SREM: "read-write",
+    ZADD: "read-write",
+    ZREM: "read-write",
+    XADD: "read-write",
+    XDEL: "data-admin",
+    XLEN: "query-only",
+    XREAD: "query-only",
+    XRANGE: "query-only",
+    XREVRANGE: "query-only",
+    EXPIRE: "read-write",
+    EXPIREAT: "read-write",
+    PEXPIRE: "read-write",
+    PERSIST: "read-write",
+    RENAME: "read-write",
+    DEL: "data-admin",
+    UNLINK: "data-admin",
+    HDEL: "data-admin",
+    FLUSHDB: "admin",
+    FLUSHALL: "admin",
+    CONFIG: "admin",
+    INFO: "admin",
+    CLIENT: "admin",
+    DEBUG: "admin",
+    SHUTDOWN: "admin",
+    KEYS: "admin",
+    MONITOR: "admin",
+    SAVE: "admin",
+    BGSAVE: "admin",
+    BGREWRITEAOF: "admin",
+    REPLICAOF: "admin",
+    SLAVEOF: "admin",
+    ACL: "admin"
+  };
 });
 
 // src/commands/query-table-schema.ts
@@ -22469,7 +22630,7 @@ async function preflightQuery(query, options, context, fieldSelection, multiConn
     if (multiConnection) {
       throw new Error("Redis queries do not support multiple connections");
     }
-    const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_permission_guard(), exports_permission_guard));
+    const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_redis(), exports_redis));
     enforceRedisPermission2(query, config.permission);
     return;
   }
@@ -22890,7 +23051,7 @@ var init_query = __esm(() => {
   init_field_projection();
   init_connection_selector();
   init_query_fanout();
-  init_permission_guard();
+  init_elasticsearch();
   init_slow_query_advisory();
   ALLOWED_FORMATS3 = ["table", "json", "csv"];
   defaultQueryCommandRuntime = {
@@ -22949,7 +23110,7 @@ function registerQCommand(program2, run) {
   });
 }
 function registerInsertCommand(program2, run) {
-  program2.command("insert <table>").description(t("insert.description")).option("--data <json>", "JSON object to insert").option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format for --plan: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
+  program2.command("insert <table>").description(t("insert.description")).option("--data <json>", "JSON object to insert").option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
     try {
       await run(table, options, command);
     } catch (error) {
@@ -22963,7 +23124,7 @@ function registerInsertCommand(program2, run) {
   });
 }
 function registerUpdateCommand(program2, run) {
-  program2.command("update <table>").description(t("update.description")).option("--where <condition>", 'WHERE clause (required, e.g. "id=1")').option("--set <json>", `JSON with fields to update (required, e.g. '{"name":"Bob"}')`).option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format for --plan: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
+  program2.command("update <table>").description(t("update.description")).option("--where <condition>", 'WHERE clause (required, e.g. "id=1")').option("--set <json>", `JSON with fields to update (required, e.g. '{"name":"Bob"}')`).option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
     try {
       await run(table, options, command);
     } catch (error) {
@@ -22977,7 +23138,7 @@ function registerUpdateCommand(program2, run) {
   });
 }
 function registerDeleteCommand(program2, run) {
-  program2.command("delete <table>").description(t("delete.description")).option("--where <condition>", 'WHERE clause (required, e.g. "id=1")').option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format for --plan: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
+  program2.command("delete <table>").description(t("delete.description")).option("--where <condition>", 'WHERE clause (required, e.g. "id=1")').option("--dry-run", "Show generated SQL without executing").option("--force", "Skip confirmation prompt").option("--plan", "Analyze risk without connecting or executing").option("--format <type>", "Output format: text or json", "text").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(async (table, options, command) => {
     try {
       await run(table, options, command);
     } catch (error) {
@@ -23698,7 +23859,7 @@ function deepHasScript(value) {
   return Object.values(obj).some(deepHasScript);
 }
 var NAME_RE2, ES_SIZE_CAP = 1000, ES_MAX_RESULT_WINDOW = 1e4, esStrategy;
-var init_elasticsearch = __esm(() => {
+var init_elasticsearch2 = __esm(() => {
   init_types5();
   NAME_RE2 = /:([a-zA-Z_][a-zA-Z0-9_]*)/g;
   esStrategy = {
@@ -23796,7 +23957,7 @@ function applyRedisSizeGuard(command, noLimit) {
   return { command, warnings };
 }
 var REDIS_NAME_RE, REDIS_RANGE_CAP = 1000, RANGE_VERBS, SCAN_VERBS, REDIS_READONLY_VERBS, REDIS_HARD_REJECT, redisStrategy;
-var init_redis = __esm(() => {
+var init_redis2 = __esm(() => {
   init_types5();
   REDIS_NAME_RE = /:([a-zA-Z_][a-zA-Z0-9_]*)/g;
   RANGE_VERBS = new Set(["LRANGE", "ZRANGE", "ZRANGEBYSCORE", "ZRANGEBYLEX"]);
@@ -23995,8 +24156,8 @@ function getStrategy(family) {
 }
 var init_strategies = __esm(() => {
   init_sql();
-  init_elasticsearch();
-  init_redis();
+  init_elasticsearch2();
+  init_redis2();
   init_mongodb();
 });
 
@@ -25228,8 +25389,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("INSERT", tableName);
-      enforcePermission("INSERT INTO dummy", this.permission);
-      return await this.executeMutation("insert", this.buildInsertSql(tableName, data, schema), timestamp, options, { prompt: "Proceed with this operation?" });
+      enforcePermissionForType("INSERT", this.permission);
+      return await this.executeMutation("insert", this.buildInsertSql(tableName, data, schema), timestamp, options, { destructive: false });
     } catch (error) {
       return this.handleMutationError("insert", timestamp, error);
     }
@@ -25238,8 +25399,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("UPDATE", tableName);
-      enforcePermission("UPDATE dummy", this.permission);
-      return await this.executeMutation("update", this.buildUpdateSql(tableName, data, where, schema), timestamp, options, { prompt: "Proceed with this operation?" });
+      enforcePermissionForType("UPDATE", this.permission);
+      return await this.executeMutation("update", this.buildUpdateSql(tableName, data, where, schema), timestamp, options, { destructive: false });
     } catch (error) {
       return this.handleMutationError("update", timestamp, error);
     }
@@ -25248,19 +25409,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("DELETE", tableName);
-      if (this.permission !== "data-admin" && this.permission !== "admin") {
-        return {
-          status: "error",
-          operation: "delete",
-          rows_affected: 0,
-          timestamp,
-          error: "Permission denied: DELETE operation requires Data-Admin or Admin permission."
-        };
-      }
-      return await this.executeMutation("delete", this.buildDeleteSql(tableName, where, schema), timestamp, options, {
-        warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
-        prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone."
-      });
+      enforcePermissionForType("DELETE", this.permission);
+      return await this.executeMutation("delete", this.buildDeleteSql(tableName, where, schema), timestamp, options, { destructive: true });
     } catch (error) {
       return this.handleMutationError("delete", timestamp, error);
     }
@@ -25274,31 +25424,31 @@ class DataExecutor {
   checkBlacklist(operation, tableName) {
     this.blacklistValidator?.checkTableBlacklist(operation, tableName, []);
   }
-  async executeMutation(operation, statement, timestamp, options, confirmation) {
+  async executeMutation(operation, statement, timestamp, options, { destructive }) {
     if (options?.dryRun) {
-      return this.successResult(operation, 0, timestamp, statement.sql);
+      return this.outcomeResult("dry_run", operation, 0, timestamp, statement.sql);
     }
     if (!options?.force) {
-      if (confirmation.warning) {
-        console.log(`
-${confirmation.warning}`);
+      if (!options?.confirm) {
+        throw new Error(`Refusing to ${operation} without confirmation: no confirmation handler was supplied. ` + "Pass options.confirm to ask the user, or options.force to proceed unattended.");
       }
-      console.log(`
-Generated SQL:`);
-      console.log(`  ${statement.sql}`);
-      console.log(`
-Parameters:`);
-      console.log(`  ${JSON.stringify(statement.params, null, 2)}`);
-      if (!await promptUser.confirm(confirmation.prompt)) {
-        return this.successResult(operation, 0, timestamp, statement.sql);
+      const proceed = await options.confirm({
+        operation,
+        engine: "sql",
+        sql: statement.sql,
+        params: statement.params,
+        destructive
+      });
+      if (!proceed) {
+        return this.outcomeResult("cancelled", operation, 0, timestamp, statement.sql);
       }
     }
     const result = await this.adapter.execute(statement.sql, statement.params);
-    return this.successResult(operation, result.affectedRows, timestamp, statement.sql);
+    return this.outcomeResult("success", operation, result.affectedRows, timestamp, statement.sql);
   }
-  successResult(operation, rowsAffected, timestamp, sql) {
+  outcomeResult(status2, operation, rowsAffected, timestamp, sql) {
     return {
-      status: "success",
+      status: status2,
       operation,
       rows_affected: rowsAffected,
       timestamp,
@@ -25309,13 +25459,13 @@ Parameters:`);
     if (error instanceof BlacklistError) {
       throw error;
     }
-    if (error instanceof PermissionError && operation !== "delete") {
+    if (error instanceof PermissionError) {
       return {
         status: "error",
         operation,
         rows_affected: 0,
         timestamp,
-        error: `Permission denied: Query-only mode only allows SELECT. Use Read-Write or Admin mode to execute ${operation.toUpperCase()}.`
+        error: t_vars("errors.permission_denied_reason", { reason: error.message })
       };
     }
     const errorMessage2 = error instanceof Error ? error.message : String(error);
@@ -25373,8 +25523,152 @@ Parameters:`);
 }
 var init_data_executor = __esm(() => {
   init_permission_guard();
+  init_message_loader();
+  init_blacklist();
+});
+
+// src/commands/mutation-confirm.ts
+async function confirmDirectMutation(request) {
+  if (request.force === true)
+    return true;
+  return confirmMutationInteractively({
+    operation: request.operation,
+    engine: request.engine,
+    sql: request.preview,
+    params: [],
+    destructive: request.destructive
+  });
+}
+var confirmMutationInteractively = async (request) => {
+  if (request.destructive) {
+    process.stderr.write(`
+${t("ceremony.confirm_destructive_warning")}
+`);
+  }
+  const label = request.engine === "sql" ? "ceremony.confirm_sql" : "ceremony.confirm_command";
+  process.stderr.write(`
+${t(label)}
+  ${request.sql}
+`);
+  if (request.params.length > 0) {
+    process.stderr.write(`
+${t("ceremony.confirm_params")}
+  ${JSON.stringify(request.params, null, 2)}
+`);
+  }
+  return promptUser.confirm(t(request.destructive ? "ceremony.confirm_destructive_prompt" : "ceremony.confirm_prompt"));
+}, confirmDdlInteractively = async (request) => {
+  process.stderr.write(`
+${t("ceremony.confirm_destructive_warning_ddl")}
+`);
+  process.stderr.write(`
+${t("ceremony.confirm_sql")}
+  ${request.sql}
+`);
+  return promptUser.confirm(t_vars("ceremony.confirm_ddl_prompt", { operation: request.operation }));
+};
+var init_mutation_confirm = __esm(() => {
+  init_message_loader();
   init_prompts();
+});
+
+// src/commands/mutation-audit.ts
+function auditOutcomeForMutation(result, table, recoveryRef) {
+  return {
+    success: result.status === "success" || result.status === "dry_run",
+    target: table,
+    ...recoveryRef && { recovery_ref: recoveryRef },
+    ...result.sql && { sql: result.sql },
+    metadata: {
+      rows_affected: result.rows_affected,
+      outcome: result.status,
+      ...result.status === "dry_run" && { dry_run: true }
+    },
+    ...result.status === "error" && {
+      error: new Error(result.error ?? `${result.operation} failed`)
+    }
+  };
+}
+
+// src/commands/mutation-outcome.ts
+function shouldRenderForHuman(context) {
+  if (context.format === "json")
+    return false;
+  return context.isTTY;
+}
+function humanOutputContext(options) {
+  return { isTTY: process.stdout.isTTY === true, ...options.format && { format: options.format } };
+}
+function renderMutationOutcome(result, table, elapsedMs) {
+  if (result.status === "error") {
+    return [
+      t_vars("ceremony.failed", { reason: result.error ?? t("ceremony.unknown_error") }),
+      t("ceremony.recovery_retry")
+    ];
+  }
+  if (result.status === "cancelled") {
+    return [t_vars("ceremony.cancelled", { table })];
+  }
+  if (result.status === "dry_run") {
+    return [t_vars("ceremony.dry_run", { table })];
+  }
+  const elapsed = t_vars("ceremony.elapsed", { seconds: (elapsedMs / 1000).toFixed(2) });
+  if (result.rows_affected === 0) {
+    return [t_vars("ceremony.matched_nothing", { table }), elapsed];
+  }
+  return [
+    t_vars(VERB_KEY[result.operation], { count: result.rows_affected, table }),
+    elapsed,
+    t("ceremony.recovery_none")
+  ];
+}
+function printMutationOutcome(result, table, elapsedMs, context, envelopeExtras = {}) {
+  if (shouldRenderForHuman(context)) {
+    const writeLine = result.status === "error" ? console.error : console.log;
+    for (const line of renderMutationOutcome(result, table, elapsedMs))
+      writeLine(line);
+    return;
+  }
+  console.log(JSON.stringify({ ...mutationEnvelope(result), ...envelopeExtras }, null, 2));
+}
+function printMutationFailure(error, operation, context) {
+  if (shouldRenderForHuman(context)) {
+    console.error(t_vars("ceremony.failed", { reason: error.message }));
+    if (error instanceof BlacklistError) {
+      console.error(t("ceremony.blacklist_hint"));
+    }
+    return;
+  }
+  console.log(JSON.stringify({ status: "error", operation, rows_affected: 0, error: error.message }, null, 2));
+}
+function cancelledOutcome(operation, preview) {
+  return {
+    status: "cancelled",
+    operation,
+    rows_affected: 0,
+    sql: preview,
+    timestamp: new Date().toISOString()
+  };
+}
+function mutationEnvelope(result) {
+  return {
+    status: result.status,
+    operation: result.operation,
+    rows_affected: result.rows_affected,
+    ...result.timestamp && { timestamp: result.timestamp },
+    ...result.sql && { sql: result.sql },
+    ...result.error && { error: result.error }
+  };
+}
+var VERB_KEY;
+var init_mutation_outcome = __esm(() => {
+  init_message_loader();
   init_blacklist();
+  VERB_KEY = {
+    insert: "ceremony.inserted",
+    update: "ceremony.updated",
+    delete: "ceremony.deleted"
+  };
 });
 
 // src/core/mongo/dry-run-formatter.ts
@@ -26218,6 +26512,9 @@ async function insertCommand(table, options, command) {
       throw new Error("Table name required");
     }
     table = table.trim();
+    if (options.format !== undefined && options.format !== "text" && options.format !== "json") {
+      throw new Error(t_vars("errors.invalid_output_format", { format: options.format }));
+    }
     let jsonInput = "";
     if (options.data) {
       jsonInput = options.data;
@@ -26258,30 +26555,40 @@ async function insertCommand(table, options, command) {
       return;
     }
     if (config.connection.system === "redis") {
-      enforcePermission("INSERT INTO dummy", config.permission);
+      enforcePermissionForType("INSERT", config.permission);
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       blacklistValidator.checkTableBlacklist("INSERT", table, []);
       blacklistValidator.checkColumnBlacklistOnWrite(table, Object.keys(data), "INSERT");
+      const preview = `SET ${table} ... (Redis Insert)`;
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "insert",
           rows_affected: 0,
-          sql: `SET ${table} ... (Redis Insert)`,
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "insert", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "insert",
+        engine: "redis",
+        preview,
+        destructive: false,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("insert", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? []);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.insert(table, data);
         const output = {
           status: "success",
@@ -26289,12 +26596,8 @@ async function insertCommand(table, options, command) {
           rows_affected: result.affectedRows,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "insert", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options));
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26306,7 +26609,7 @@ async function insertCommand(table, options, command) {
         operation: "insert",
         rows_affected: 0,
         timestamp: new Date().toISOString(),
-        error: "Elasticsearch \u4E0D\u652F\u63F4 insert \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u5BEB\u5165"
+        error: t("insert.elasticsearch_unsupported")
       };
       await writeAuditEntry(config, "insert", options, {
         success: false,
@@ -26317,44 +26620,49 @@ async function insertCommand(table, options, command) {
       process.exit(1);
     }
     if (config.connection.system === "mongodb") {
-      enforcePermission("INSERT INTO dummy", config.permission);
+      enforcePermissionForType("INSERT", config.permission);
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       blacklistValidator.checkTableBlacklist("INSERT", table, []);
       blacklistValidator.checkColumnBlacklistOnWrite(table, Object.keys(data), "INSERT");
+      const preview = previewInsert(table, data);
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "insert",
           rows_affected: 0,
-          sql: previewInsert(table, data),
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "insert", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "insert",
+        engine: "mongodb",
+        preview,
+        destructive: false,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("insert", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createMongoDBAdapter(config.connection);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.insert(table, data);
         const output = {
           status: "success",
           operation: "insert",
           rows_affected: result.affectedRows,
-          timestamp: new Date().toISOString(),
-          lastInsertId: result.lastInsertId
+          timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "insert", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options), { lastInsertId: result.lastInsertId });
+        await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26368,31 +26676,20 @@ async function insertCommand(table, options, command) {
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
+      const startedAt = performance.now();
       const result = await executor3.executeInsert(table, data, schema, {
         dryRun: options.dryRun,
-        force: options.force
-      });
-      const output = {
-        status: result.status,
-        operation: result.operation,
-        rows_affected: result.rows_affected,
-        timestamp: result.timestamp,
-        ...result.sql && { sql: result.sql },
-        ...result.error && { error: result.error }
-      };
-      console.log(JSON.stringify(output, null, 2));
-      await writeAuditEntry(config, "insert", options, {
-        success: result.status === "success",
-        target: table,
-        ...result.sql && { sql: result.sql },
-        metadata: {
-          rows_affected: result.rows_affected,
-          ...options.dryRun && { dry_run: true }
-        },
-        ...result.status === "error" && {
-          error: new Error(result.error ?? "insert failed")
-        }
+        force: options.force,
+        confirm: confirmMutationInteractively
       });
+      const elapsedMs = performance.now() - startedAt;
+      const recoveryEnvelopeId = result.status === "error" && options.recovery === true ? crypto5.randomUUID() : undefined;
+      const auditId = await writeAuditEntry(config, "insert", options, auditOutcomeForMutation(result, table, recoveryEnvelopeId));
+      if (recoveryEnvelopeId !== undefined) {
+        const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
+        emitRecoveryEnvelope2(new Error(result.error ?? "INSERT failed"), { operation: "insert", table, writeOperation: "INSERT" }, { envelopeId: recoveryEnvelopeId, auditRef: auditId ?? undefined });
+      }
+      printMutationOutcome(result, table, elapsedMs, humanOutputContext(options));
       if (result.status === "error") {
         process.exit(1);
       }
@@ -26418,13 +26715,7 @@ async function insertCommand(table, options, command) {
       emitRecoveryEnvelope2(error, { operation: "insert", table, writeOperation: "INSERT" }, { envelopeId, auditRef: auditId ?? undefined });
     }
     if (error instanceof BlacklistError) {
-      const output2 = {
-        status: "error",
-        operation: "insert",
-        rows_affected: 0,
-        error: error.message
-      };
-      console.log(JSON.stringify(output2, null, 2));
+      printMutationFailure(error, "insert", humanOutputContext(options));
       process.exit(1);
     }
     if (error instanceof PermissionError) {
@@ -26437,13 +26728,7 @@ async function insertCommand(table, options, command) {
       printLocalizedCliError(formatCliError(presentConnectionError(error)), error);
       process.exit(1);
     }
-    const output = {
-      status: "error",
-      operation: "insert",
-      rows_affected: 0,
-      error: error.message
-    };
-    console.log(JSON.stringify(output, null, 2));
+    printMutationFailure(error, "insert", humanOutputContext(options));
     process.exit(1);
   }
 }
@@ -26453,6 +26738,8 @@ var init_insert = __esm(() => {
   init_connection_error_message();
   init_adapters();
   init_data_executor();
+  init_mutation_confirm();
+  init_mutation_outcome();
   init_config();
   init_permission_guard();
   init_blacklist_validator();
@@ -26481,6 +26768,9 @@ async function updateCommand(table, options, command) {
       throw new Error("Table name required");
     }
     table = table.trim();
+    if (options.format !== undefined && options.format !== "text" && options.format !== "json") {
+      throw new Error(t_vars("errors.invalid_output_format", { format: options.format }));
+    }
     if (!options.plan && (!options.where || options.where.trim() === "")) {
       throw new Error('UPDATE requires --where clause (e.g. --where "id=1")');
     }
@@ -26541,29 +26831,39 @@ async function updateCommand(table, options, command) {
       return;
     }
     if (config.connection?.system === "redis") {
-      enforcePermission("UPDATE dummy", config.permission);
+      enforcePermissionForType("UPDATE", config.permission);
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       blacklistValidator.checkTableBlacklist("UPDATE", table, []);
+      const preview = `HSET ${table} ... (Redis Update)`;
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "update",
           rows_affected: 0,
-          sql: `HSET ${table} ... (Redis Update)`,
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "update", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "update",
+        engine: "redis",
+        preview,
+        destructive: false,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("update", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? []);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.update(table, {}, setData);
         const output = {
           status: "success",
@@ -26571,12 +26871,8 @@ async function updateCommand(table, options, command) {
           rows_affected: result.affectedRows,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "update", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26588,7 +26884,7 @@ async function updateCommand(table, options, command) {
         operation: "update",
         rows_affected: 0,
         timestamp: new Date().toISOString(),
-        error: "Elasticsearch \u4E0D\u652F\u63F4 update \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u66F4\u65B0"
+        error: t("update.elasticsearch_unsupported")
       };
       await writeAuditEntry(config, "update", options, {
         success: false,
@@ -26599,7 +26895,7 @@ async function updateCommand(table, options, command) {
       process.exit(1);
     }
     if (config.connection?.system === "mongodb") {
-      enforcePermission("UPDATE dummy", config.permission);
+      enforcePermissionForType("UPDATE", config.permission);
       const hasOperator = Object.keys(setData).some((key) => key.startsWith("$"));
       const updateDoc = hasOperator ? setData : { $set: setData };
       const writtenFields = new Set;
@@ -26625,25 +26921,35 @@ async function updateCommand(table, options, command) {
       } catch {
         filter = parseWhereClause(options.where);
       }
+      const preview = previewUpdate(table, filter, updateDoc);
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "update",
           rows_affected: 0,
-          sql: previewUpdate(table, filter, updateDoc),
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "update", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "update",
+        engine: "mongodb",
+        preview,
+        destructive: false,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("update", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createMongoDBAdapter(config.connection);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.update(table, filter, updateDoc);
         const output = {
           status: "success",
@@ -26651,12 +26957,8 @@ async function updateCommand(table, options, command) {
           rows_affected: result.affectedRows,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "update", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options));
+        await writeAuditEntry(config, "update", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26676,31 +26978,20 @@ async function updateCommand(table, options, command) {
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
+      const startedAt = performance.now();
       const result = await executor3.executeUpdate(table, setData, whereConditions, schema, {
         dryRun: options.dryRun,
-        force: options.force
-      });
-      const output = {
-        status: result.status,
-        operation: result.operation,
-        rows_affected: result.rows_affected,
-        timestamp: result.timestamp,
-        ...result.sql && { sql: result.sql },
-        ...result.error && { error: result.error }
-      };
-      console.log(JSON.stringify(output, null, 2));
-      await writeAuditEntry(config, "update", options, {
-        success: result.status === "success",
-        target: table,
-        ...result.sql && { sql: result.sql },
-        metadata: {
-          rows_affected: result.rows_affected,
-          ...options.dryRun && { dry_run: true }
-        },
-        ...result.status === "error" && {
-          error: new Error(result.error ?? "update failed")
-        }
+        force: options.force,
+        confirm: confirmMutationInteractively
       });
+      const elapsedMs = performance.now() - startedAt;
+      const recoveryEnvelopeId = result.status === "error" && options.recovery === true ? crypto6.randomUUID() : undefined;
+      const auditId = await writeAuditEntry(config, "update", options, auditOutcomeForMutation(result, table, recoveryEnvelopeId));
+      if (recoveryEnvelopeId !== undefined) {
+        const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
+        emitRecoveryEnvelope2(new Error(result.error ?? "UPDATE failed"), { operation: "update", table, writeOperation: "UPDATE" }, { envelopeId: recoveryEnvelopeId, auditRef: auditId ?? undefined });
+      }
+      printMutationOutcome(result, table, elapsedMs, humanOutputContext(options));
       if (result.status === "error") {
         process.exit(1);
       }
@@ -26726,13 +27017,7 @@ async function updateCommand(table, options, command) {
       emitRecoveryEnvelope2(error, { operation: "update", table, writeOperation: "UPDATE" }, { envelopeId, auditRef: auditId ?? undefined });
     }
     if (error instanceof BlacklistError) {
-      const output2 = {
-        status: "error",
-        operation: "update",
-        rows_affected: 0,
-        error: error.message
-      };
-      console.log(JSON.stringify(output2, null, 2));
+      printMutationFailure(error, "update", humanOutputContext(options));
       process.exit(1);
     }
     if (error instanceof PermissionError) {
@@ -26745,13 +27030,7 @@ async function updateCommand(table, options, command) {
       printLocalizedCliError(formatCliError(presentConnectionError(error)), error);
       process.exit(1);
     }
-    const output = {
-      status: "error",
-      operation: "update",
-      rows_affected: 0,
-      error: error.message
-    };
-    console.log(JSON.stringify(output, null, 2));
+    printMutationFailure(error, "update", humanOutputContext(options));
     process.exit(1);
   }
 }
@@ -26761,6 +27040,8 @@ var init_update = __esm(() => {
   init_connection_error_message();
   init_adapters();
   init_data_executor();
+  init_mutation_confirm();
+  init_mutation_outcome();
   init_config();
   init_permission_guard();
   init_blacklist_validator();
@@ -26789,6 +27070,9 @@ async function deleteCommand(table, options, command) {
       throw new Error("Table name required");
     }
     table = table.trim();
+    if (options.format !== undefined && options.format !== "text" && options.format !== "json") {
+      throw new Error(t_vars("errors.invalid_output_format", { format: options.format }));
+    }
     if (!options.plan && (!options.where || options.where.trim() === "")) {
       throw new Error('DELETE requires --where clause (e.g. --where "id=1")');
     }
@@ -26835,14 +27119,8 @@ async function deleteCommand(table, options, command) {
       });
       return;
     }
-    if (config.permission !== "data-admin" && config.permission !== "admin") {
-      throw new PermissionError(t("delete.admin_only"), {
-        type: "DELETE",
-        isDangerous: true,
-        keywords: ["DELETE"],
-        isComposite: false,
-        confidence: "HIGH"
-      }, config.permission);
+    if (!permitsOperation("DELETE", config.permission)) {
+      throw new PermissionError(t("delete.admin_only"), classificationForType("DELETE"), minimumPermissionFor("DELETE"));
     }
     if (config.connection?.system === "redis") {
       const blacklistManager = new BlacklistManager(config);
@@ -26854,25 +27132,35 @@ async function deleteCommand(table, options, command) {
       } catch {
         filter = parseWhereClause(options.where);
       }
+      const preview = `DEL ${table} (Redis Delete)`;
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "delete",
           rows_affected: 0,
-          sql: `DEL ${table} (Redis Delete)`,
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "delete", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "delete",
+        engine: "redis",
+        preview,
+        destructive: true,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("delete", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? []);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.delete(table, filter);
         const output = {
           status: "success",
@@ -26880,12 +27168,8 @@ async function deleteCommand(table, options, command) {
           rows_affected: result.affectedRows,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "delete", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26897,7 +27181,7 @@ async function deleteCommand(table, options, command) {
         operation: "delete",
         rows_affected: 0,
         timestamp: new Date().toISOString(),
-        error: "Elasticsearch \u4E0D\u652F\u63F4 delete \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u522A\u9664"
+        error: t("delete.elasticsearch_unsupported")
       };
       await writeAuditEntry(config, "delete", options, {
         success: false,
@@ -26917,25 +27201,35 @@ async function deleteCommand(table, options, command) {
       } catch {
         filter = parseWhereClause(options.where);
       }
+      const preview = previewDelete(table, filter);
       if (options.dryRun) {
         const output = {
-          status: "success",
+          status: "dry_run",
           operation: "delete",
           rows_affected: 0,
-          sql: previewDelete(table, filter),
+          sql: preview,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "delete", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: 0, dry_run: true }
-        });
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
+        return;
+      }
+      if (!await confirmDirectMutation({
+        operation: "delete",
+        engine: "mongodb",
+        preview,
+        destructive: true,
+        force: options.force
+      })) {
+        const output = cancelledOutcome("delete", preview);
+        printMutationOutcome(output, table, 0, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
         return;
       }
       const adapter2 = AdapterFactory.createMongoDBAdapter(config.connection);
       await adapter2.connect();
       try {
+        const startedAt = performance.now();
         const result = await adapter2.delete(table, filter);
         const output = {
           status: "success",
@@ -26943,12 +27237,8 @@ async function deleteCommand(table, options, command) {
           rows_affected: result.affectedRows,
           timestamp: new Date().toISOString()
         };
-        console.log(JSON.stringify(output, null, 2));
-        await writeAuditEntry(config, "delete", options, {
-          success: true,
-          target: table,
-          metadata: { rows_affected: result.affectedRows }
-        });
+        printMutationOutcome(output, table, performance.now() - startedAt, humanOutputContext(options));
+        await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(output, table));
         return;
       } finally {
         await adapter2.disconnect();
@@ -26968,31 +27258,20 @@ async function deleteCommand(table, options, command) {
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
+      const startedAt = performance.now();
       const result = await executor3.executeDelete(table, whereConditions, schema, {
         dryRun: options.dryRun,
-        force: options.force
-      });
-      const output = {
-        status: result.status,
-        operation: result.operation,
-        rows_affected: result.rows_affected,
-        timestamp: result.timestamp,
-        ...result.sql && { sql: result.sql },
-        ...result.error && { error: result.error }
-      };
-      console.log(JSON.stringify(output, null, 2));
-      await writeAuditEntry(config, "delete", options, {
-        success: result.status === "success",
-        target: table,
-        ...result.sql && { sql: result.sql },
-        metadata: {
-          rows_affected: result.rows_affected,
-          ...options.dryRun && { dry_run: true }
-        },
-        ...result.status === "error" && {
-          error: new Error(result.error ?? "delete failed")
-        }
+        force: options.force,
+        confirm: confirmMutationInteractively
       });
+      const elapsedMs = performance.now() - startedAt;
+      const recoveryEnvelopeId = result.status === "error" && options.recovery === true ? crypto7.randomUUID() : undefined;
+      const auditId = await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(result, table, recoveryEnvelopeId));
+      if (recoveryEnvelopeId !== undefined) {
+        const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
+        emitRecoveryEnvelope2(new Error(result.error ?? "DELETE failed"), { operation: "delete", table, writeOperation: "DELETE" }, { envelopeId: recoveryEnvelopeId, auditRef: auditId ?? undefined });
+      }
+      printMutationOutcome(result, table, elapsedMs, humanOutputContext(options));
       if (result.status === "error") {
         process.exit(1);
       }
@@ -27018,17 +27297,11 @@ async function deleteCommand(table, options, command) {
       emitRecoveryEnvelope2(error, { operation: "delete", table, writeOperation: "DELETE" }, { envelopeId, auditRef: auditId ?? undefined });
     }
     if (error instanceof BlacklistError) {
-      const output2 = {
-        status: "error",
-        operation: "delete",
-        rows_affected: 0,
-        error: error.message
-      };
-      console.log(JSON.stringify(output2, null, 2));
+      printMutationFailure(error, "delete", humanOutputContext(options));
       process.exit(1);
     }
     if (error instanceof PermissionError) {
-      console.error(t_vars("errors.permission_denied", { required: "data-admin" }));
+      console.error(t_vars("errors.permission_denied", { required: error.requiredPermission }));
       console.error(`   Operation: ${error.classification.type}`);
       console.error(`   Message: ${error.message}`);
       process.exit(1);
@@ -27037,13 +27310,7 @@ async function deleteCommand(table, options, command) {
       printLocalizedCliError(formatCliError(presentConnectionError(error)), error);
       process.exit(1);
     }
-    const output = {
-      status: "error",
-      operation: "delete",
-      rows_affected: 0,
-      error: error.message
-    };
-    console.log(JSON.stringify(output, null, 2));
+    printMutationFailure(error, "delete", humanOutputContext(options));
     process.exit(1);
   }
 }
@@ -27053,6 +27320,8 @@ var init_delete = __esm(() => {
   init_connection_error_message();
   init_adapters();
   init_data_executor();
+  init_mutation_confirm();
+  init_mutation_outcome();
   init_config();
   init_permission_guard();
   init_blacklist_validator();
@@ -27216,7 +27485,7 @@ async function exportCommand(sql, options, command) {
   }
 }
 async function redisExportBranch(command, options, config) {
-  const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_permission_guard(), exports_permission_guard));
+  const { enforceRedisPermission: enforceRedisPermission2 } = await Promise.resolve().then(() => (init_redis(), exports_redis));
   enforceRedisPermission2(command, config.permission);
   const redisAdapter = AdapterFactory.createRedisAdapter(config.connection, config.blacklist?.tables ?? [], config.redis?.mask ?? []);
   await redisAdapter.connect();
@@ -44092,6 +44361,7 @@ var init_repl_engine = __esm(() => {
   init_meta_commands();
   init_history_manager();
   init_permission_guard();
+  init_redis();
   init_query_result_formatter();
   init_message_loader();
   init_sql_tables();
@@ -45220,13 +45490,16 @@ class DDLExecutor {
         };
       }
       if (isDestructiveOperation2(operation) && !options.force) {
-        const confirmed = await promptUser.confirm(`This is a destructive operation (${operation.kind}). Proceed?`);
+        if (!options.confirm) {
+          throw new DDLExecutionError(`Refusing to run ${operation.kind} without confirmation: no confirmation handler was ` + "supplied. Pass options.confirm to ask the user, or options.force to proceed unattended.");
+        }
+        const confirmed = await options.confirm({ operation: operation.kind, sql });
         if (!confirmed) {
           return {
-            status: "success",
+            status: "cancelled",
             operation: operation.kind,
             sql,
-            warnings: [...warnings, "Operation cancelled by user"],
+            warnings,
             timestamp: timestamp2,
             dryRun: false
           };
@@ -45301,8 +45574,15 @@ class DDLExecutor {
     } catch {}
   }
 }
+var DDLExecutionError;
 var init_ddl_executor = __esm(() => {
-  init_prompts();
+  DDLExecutionError = class DDLExecutionError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "DDLExecutionError";
+      Object.setPrototypeOf(this, DDLExecutionError.prototype);
+    }
+  };
 });
 
 // src/commands/migrate.ts
@@ -45346,7 +45626,8 @@ async function runDDL(operation, opts, command) {
     const executor3 = new DDLExecutor(adapter, generator, config.permission, blacklistManager);
     const result = await executor3.execute(operation, {
       execute: opts.execute,
-      force: opts.force
+      force: opts.force,
+      confirm: confirmDdlInteractively
     });
     console.log(JSON.stringify({
       status: result.status,
@@ -45388,6 +45669,7 @@ var init_migrate = __esm(() => {
   init_adapters();
   init_ddl2();
   init_ddl_executor();
+  init_mutation_confirm();
   init_config_path();
   migrateCommand = new Command("migrate").description(t("migrate.description"));
   addExecOpts(migrateCommand.command("create <table>").description(t("migrate.create_description")).option("--column <spec...>", 'Column definitions (e.g., "id:serial:pk" "name:varchar(50):not-null")')).action(async (table, opts, command) => {
@@ -45685,6 +45967,258 @@ var init_use = __esm(() => {
   });
 });
 
+// src/core/config-v2-mutations.ts
+function envVarNameFor(connName, field) {
+  const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return `DBCLI_${slug}_${field.toUpperCase()}`;
+}
+var init_config_v2_mutations = () => {};
+
+// src/core/env-file-writer.ts
+import { chmod as chmod2, mkdir as mkdir18, readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
+import { dirname as dirname16 } from "path";
+function escapeForRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function upsertEnvVar(envPath, varName, value) {
+  let content = "";
+  try {
+    content = await readFile9(envPath, "utf8");
+  } catch (cause) {
+    const code = cause.code;
+    if (code !== "ENOENT")
+      throw cause;
+    await mkdir18(dirname16(envPath), { recursive: true });
+  }
+  const line = `${varName}="${value}"`;
+  const existing = new RegExp(`^${escapeForRegExp(varName)}=.*$`, "m");
+  if (existing.test(content)) {
+    content = content.replace(existing, () => line);
+  } else {
+    content = content.length && !content.endsWith(`
+`) ? `${content}
+${line}
+` : `${content}${line}
+`;
+  }
+  await writeFile9(envPath, content, { mode: SECRET_FILE_MODE });
+  await chmod2(envPath, SECRET_FILE_MODE);
+}
+var SECRET_FILE_MODE = 384;
+var init_env_file_writer = () => {};
+
+// src/core/connection-credential.ts
+import { join as join39 } from "path";
+async function readRawConfig(storagePath) {
+  const configPath = join39(storagePath, "config.json");
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    throw new ConfigError(`\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94\uFF1A${configPath}`);
+  }
+  return JSON.parse(await file.text());
+}
+function envRefName(value) {
+  if (typeof value === "object" && value !== null && "$env" in value) {
+    return String(value.$env);
+  }
+  return;
+}
+async function resolvePasswordTarget(projectPath, connectionName) {
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  if (detectConfigVersion(raw) !== 2) {
+    if (connectionName && connectionName !== V1_CONNECTION_NAME) {
+      throw new ConfigError(`\u9019\u662F v1 \u8A2D\u5B9A\uFF0C\u53EA\u6709\u4E00\u689D\u9023\u7DDA\uFF0C\u7121\u6CD5\u6307\u5B9A\u9023\u7DDA\u540D\u7A31 '${connectionName}'\u3002` + `\u9700\u8981\u591A\u9023\u7DDA\u8ACB\u5148\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2\u3002`);
+    }
+    const connection2 = raw.connection ?? {};
+    const customRef = envRefName(connection2.password);
+    if (customRef !== undefined && customRef !== V1_VAR_NAME) {
+      throw new ConfigError(`\u9019\u500B v1 \u8A2D\u5B9A\u7684\u5BC6\u78BC\u4F86\u81EA\u74B0\u5883\u8B8A\u6578 '${customRef}'\uFF0Cdbcli \u7121\u6CD5\u4EE3\u70BA\u8F2A\u66FF\u3002` + `\u8ACB\u76F4\u63A5\u66F4\u65B0\u8A72\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2 \u5F8C\u518D\u8F2A\u66FF\u3002`);
+    }
+    return {
+      connection: V1_CONNECTION_NAME,
+      envFile: DEFAULT_ENV_FILE,
+      varName: V1_VAR_NAME,
+      convertedToEnvRef: false
+    };
+  }
+  const config = await readV2Config(projectPath);
+  const targetName = connectionName ?? config.default;
+  const connection = config.connections[targetName];
+  if (!connection) {
+    throw new ConfigError(connectionNotFoundMessage(targetName, Object.keys(config.connections)));
+  }
+  const referencedVar = envRefName(connection.password);
+  return {
+    connection: targetName,
+    envFile: connection.envFile ?? DEFAULT_ENV_FILE,
+    varName: referencedVar ?? envVarNameFor(targetName, "password"),
+    convertedToEnvRef: referencedVar === undefined
+  };
+}
+function assertSingleLine(value) {
+  if (value.includes(`
+`) || value.includes("\r")) {
+    throw new ConfigError("\u5BC6\u78BC\u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
+  }
+}
+async function stripV1LiteralPassword(storagePath, raw) {
+  const connection = raw.connection ?? {};
+  if (typeof connection.password !== "string")
+    return;
+  const stripped = { ...raw, connection: { ...connection } };
+  delete stripped.connection.password;
+  await writeConfigWithIntegrity(storagePath, JSON.stringify(stripped, null, 2));
+}
+async function setConnectionPassword(projectPath, connectionName, password) {
+  assertConfigMutationApproved();
+  assertSingleLine(password);
+  const target = await resolvePasswordTarget(projectPath, connectionName);
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  await upsertEnvVar(join39(storagePath, target.envFile), target.varName, password);
+  if (detectConfigVersion(raw) !== 2) {
+    await stripV1LiteralPassword(storagePath, raw);
+    return target;
+  }
+  const config = await readV2Config(projectPath);
+  const connection = config.connections[target.connection];
+  const needsEnvFile = connection.envFile === undefined;
+  if (target.convertedToEnvRef || needsEnvFile) {
+    await writeV2Config(projectPath, {
+      ...config,
+      connections: {
+        ...config.connections,
+        [target.connection]: {
+          ...connection,
+          envFile: target.envFile,
+          ...target.convertedToEnvRef && { password: { $env: target.varName } }
+        }
+      }
+    });
+  }
+  return target;
+}
+var DEFAULT_ENV_FILE = ".env.local", V1_VAR_NAME = "DBCLI_PASSWORD", V1_CONNECTION_NAME = "default";
+var init_connection_credential = __esm(() => {
+  init_config_binding();
+  init_config_v2();
+  init_config_integrity();
+  init_config_mutation_guard();
+  init_config_v2_mutations();
+  init_errors3();
+  init_env_file_writer();
+});
+
+// src/commands/credential.ts
+var exports_credential = {};
+__export(exports_credential, {
+  resolveNewPassword: () => resolveNewPassword,
+  passwordCommand: () => passwordCommand
+});
+async function readAllStdin() {
+  return await Bun.stdin.text();
+}
+async function resolveNewPassword(options, io) {
+  if (options.password !== undefined && options.stdin) {
+    throw new ConfigError(t("password.source_conflict"));
+  }
+  let value;
+  if (options.password !== undefined) {
+    value = options.password;
+  } else if (options.stdin) {
+    value = (await io.readStdin()).replace(/\r?\n$/, "");
+  } else if (io.isTTY) {
+    value = await io.prompt();
+  } else {
+    throw new ConfigError(t("password.needs_source"));
+  }
+  if (value.length === 0) {
+    throw new ConfigError(t("password.empty"));
+  }
+  return value;
+}
+async function verifyNewPassword(configPath, target, connectionName, password) {
+  const storagePath = await resolveConfigStoragePath(configPath);
+  const previous = process.env[target.varName];
+  process.env[target.varName] = password;
+  try {
+    const config = await configModule.read(storagePath, connectionName);
+    const adapter = AdapterFactory.createAdapter({
+      ...config.connection,
+      password
+    });
+    try {
+      await adapter.connect();
+      await adapter.testConnection();
+    } finally {
+      await adapter.disconnect().catch(() => {
+        return;
+      });
+    }
+  } finally {
+    if (previous === undefined)
+      delete process.env[target.varName];
+    else
+      process.env[target.varName] = previous;
+  }
+}
+var passwordCommand;
+var init_credential = __esm(() => {
+  init_esm();
+  init_adapters();
+  init_config();
+  init_config_mutation_guard();
+  init_config_binding();
+  init_connection_credential();
+  init_config_path();
+  init_prompts();
+  init_errors3();
+  init_message_loader();
+  passwordCommand = new Command("password").description(t("password.description")).argument("[connection]", t("password.arg_connection")).option("--stdin", t("password.opt_stdin")).option("--password <value>", t("password.opt_password")).option("--skip-test", t("password.opt_skip_test")).option("--format <format>", "Output format (text, json)", "text").action(async (connection, options) => {
+    try {
+      assertConfigMutationApproved();
+      const configPath = resolveConfigPath(passwordCommand);
+      const target = await resolvePasswordTarget(configPath, connection);
+      const value = await resolveNewPassword({
+        password: typeof options.password === "string" ? options.password : undefined,
+        stdin: options.stdin === true
+      }, {
+        isTTY: Boolean(process.stdin.isTTY),
+        readStdin: readAllStdin,
+        prompt: () => promptUser.secret(t_vars("password.prompt", { name: target.connection }))
+      });
+      if (options.skipTest !== true) {
+        await verifyNewPassword(configPath, target, connection, value);
+      }
+      const written = await setConnectionPassword(configPath, connection, value);
+      if (options.format === "json") {
+        console.log(JSON.stringify({ success: true, ...written }, null, 2));
+      } else {
+        console.log(t_vars("password.updated", {
+          name: written.connection,
+          envFile: written.envFile,
+          varName: written.varName
+        }));
+        if (written.convertedToEnvRef) {
+          console.log(t_vars("password.converted", { varName: written.varName }));
+        }
+        if (options.skipTest === true) {
+          console.log(t("password.skipped_test"));
+        }
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.format === "json") {
+        console.error(JSON.stringify({ success: false, error: message }, null, 2));
+      } else {
+        console.error(t_vars("errors.message", { message }));
+      }
+      process.exit(1);
+    }
+  });
+});
+
 // src/proxy/relay.ts
 class TcpRelay {
   clientBytes = 0;
@@ -45759,8 +46293,8 @@ var init_sql_metadata = __esm(() => {
 });
 
 // src/proxy/events.ts
-import { appendFile as appendFile2, mkdir as mkdir18, readFile as readFile9, stat as stat9 } from "fs/promises";
-import { dirname as dirname16 } from "path";
+import { appendFile as appendFile2, mkdir as mkdir19, readFile as readFile10, stat as stat9 } from "fs/promises";
+import { dirname as dirname17 } from "path";
 function hasSql(e) {
   return e.type === "query_observed" || e.type === "query_completed" || e.type === "query_errored";
 }
@@ -45799,7 +46333,7 @@ class EventWriter {
   }
   async writeInternal(event) {
     if (!this.dirEnsured) {
-      await mkdir18(dirname16(this.path), { recursive: true });
+      await mkdir19(dirname17(this.path), { recursive: true });
       this.dirEnsured = true;
     }
     if (!this.initialized) {
@@ -45823,7 +46357,7 @@ class EventWriter {
     try {
       const s = await stat9(this.path);
       this.currentSizeBytes = s.size;
-      const raw = await readFile9(this.path, "utf8");
+      const raw = await readFile10(this.path, "utf8");
       this.currentEntryCount = raw.split(`
 `).filter(Boolean).length;
     } catch {
@@ -46420,7 +46954,7 @@ var init_server = __esm(() => {
 });
 
 // src/proxy/event-reader.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 async function readEvents(path4, opts) {
   const candidates = opts.includeRotated ? [path4, `${path4}.1`] : [path4];
   const files = [];
@@ -46429,7 +46963,7 @@ async function readEvents(path4, opts) {
   for (const file of candidates) {
     let raw;
     try {
-      raw = await readFile10(file, "utf8");
+      raw = await readFile11(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -46860,7 +47394,7 @@ __export(exports_proxy, {
   proxyCommand: () => proxyCommand,
   parseHostPort: () => parseHostPort
 });
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 function parseHostPort(value) {
   const idx = value.lastIndexOf(":");
   if (idx <= 0 || idx === value.length - 1) {
@@ -46923,7 +47457,7 @@ async function runProxy(subcommandEngine, options, command) {
       target: options.target,
       connection
     });
-    const eventsPath = options.events ?? join39(".dbcli", "proxy", "events.jsonl");
+    const eventsPath = options.events ?? join40(".dbcli", "proxy", "events.jsonl");
     const slowMs = Number(options.slowMs ?? 1000);
     if (!Number.isFinite(slowMs) || slowMs < 0) {
       throw new Error(`Invalid --slow-ms "${options.slowMs}". Expected a non-negative number`);
@@ -46972,7 +47506,7 @@ async function runProxy(subcommandEngine, options, command) {
   }
 }
 function addCommonOptions(cmd) {
-  return cmd.option("--listen <host:port>", "Local proxy listen address (required)").option("--target <host:port>", "Upstream DB target (optional when config provides host/port)").option("--events <path>", "Event JSONL path", join39(".dbcli", "proxy", "events.jsonl")).option("--slow-ms <number>", "Threshold (ms); queries at/above it get slow:true in the event + a terminal warning", "1000").option("--redact <mode>", "SQL redaction: none | literals", "none").option("--format <format>", "Runtime status output: text | json", "text");
+  return cmd.option("--listen <host:port>", "Local proxy listen address (required)").option("--target <host:port>", "Upstream DB target (optional when config provides host/port)").option("--events <path>", "Event JSONL path", join40(".dbcli", "proxy", "events.jsonl")).option("--slow-ms <number>", "Threshold (ms); queries at/above it get slow:true in the event + a terminal warning", "1000").option("--redact <mode>", "SQL redaction: none | literals", "none").option("--format <format>", "Runtime status output: text | json", "text");
 }
 function parseNonNegInt(value, flag, fallback) {
   if (value === undefined)
@@ -46990,7 +47524,7 @@ async function runAnalyze(options) {
     const top = parseNonNegInt(options.top, "top", 20);
     const slowMs = parseNonNegInt(options.slowMs, "slow-ms", 1000);
     const nPlusOne = parseNonNegInt(options.nPlusOne, "n-plus-one", 10);
-    const eventsPath = options.events ?? join39(".dbcli", "proxy", "events.jsonl");
+    const eventsPath = options.events ?? join40(".dbcli", "proxy", "events.jsonl");
     const { events, malformedLines, files } = await readEvents(eventsPath, {
       includeRotated: options.includeRotated !== false
     });
@@ -47043,7 +47577,7 @@ var init_proxy = __esm(() => {
     });
   }
   ANALYZE_FORMATS = ["json", "text", "markdown"];
-  proxyCommand.command("analyze").description("Analyze a proxy event log offline (no DB connection)").option("--events <path>", "Event JSONL path", join39(".dbcli", "proxy", "events.jsonl")).option("--format <format>", "Output format: json | text | markdown (QueryLens)", "json").option("--top <number>", "Rows shown in text + suggestedCommands depth", "20").option("--slow-ms <number>", "Slow-query threshold (ms) for slowCount", "1000").option("--n-plus-one <number>", "Min repeats per (session,fingerprint) to flag N+1", "10").option("--no-include-rotated", "Do not merge the rotated <events>.1 segment").action(async (options) => {
+  proxyCommand.command("analyze").description("Analyze a proxy event log offline (no DB connection)").option("--events <path>", "Event JSONL path", join40(".dbcli", "proxy", "events.jsonl")).option("--format <format>", "Output format: json | text | markdown (QueryLens)", "json").option("--top <number>", "Rows shown in text + suggestedCommands depth", "20").option("--slow-ms <number>", "Slow-query threshold (ms) for slowCount", "1000").option("--n-plus-one <number>", "Min repeats per (session,fingerprint) to flag N+1", "10").option("--no-include-rotated", "Do not merge the rotated <events>.1 segment").action(async (options) => {
     await runAnalyze(options);
   });
   addCommonOptions(proxyCommand).action(async (options, command) => {
@@ -47377,9 +47911,9 @@ var init_semantic2 = __esm(() => {
 });
 
 // src/core/design/index.ts
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 function defaultDesignFile(workspaceRoot) {
-  return join40(workspaceRoot, DEFAULT_FILE3);
+  return join41(workspaceRoot, DEFAULT_FILE3);
 }
 function parseDesignSpec(raw, filePath = DEFAULT_FILE3) {
   const parsed = specSchema.safeParse(raw);
@@ -48210,8 +48744,8 @@ var exports_backfill = {};
 __export(exports_backfill, {
   backfillCommand: () => backfillCommand
 });
-import { dirname as dirname17, resolve as resolve10 } from "path";
-import { mkdir as mkdir19 } from "fs/promises";
+import { dirname as dirname18, resolve as resolve10 } from "path";
+import { mkdir as mkdir20 } from "fs/promises";
 function identityFor(config, name) {
   const connection = config.connections[name];
   if (!connection) {
@@ -48261,7 +48795,7 @@ var init_backfill = __esm(() => {
       return;
     }
     const out = resolve10(options.out ?? `.dbcli/backfills/${artifact2.source.sha256.slice(0, 12)}.json`);
-    await mkdir19(dirname17(out), { recursive: true });
+    await mkdir20(dirname18(out), { recursive: true });
     await Bun.write(out, JSON.stringify(artifact2, null, 2) + `
 `);
     console.log(JSON.stringify({ path: out, artifact: artifact2 }, null, 2));
@@ -48270,8 +48804,8 @@ var init_backfill = __esm(() => {
 
 // src/core/evidence-pack/index.ts
 import { createHash as createHash8, randomUUID as randomUUID6 } from "crypto";
-import { link as link3, lstat as lstat5, mkdir as mkdir20, realpath as realpath2, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
-import { basename as basename9, dirname as dirname18, relative as relative5, resolve as resolve11, sep as sep7 } from "path";
+import { link as link3, lstat as lstat5, mkdir as mkdir21, realpath as realpath2, unlink as unlink8, writeFile as writeFile10 } from "fs/promises";
+import { basename as basename9, dirname as dirname19, relative as relative5, resolve as resolve11, sep as sep7 } from "path";
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -48522,7 +49056,7 @@ async function realExistingAncestor(path4) {
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
-      const parent = dirname18(candidate);
+      const parent = dirname19(candidate);
       if (parent === candidate)
         throw error;
       candidate = parent;
@@ -48534,12 +49068,12 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   const requestedTarget = resolve11(workspace, outputPath);
   if (!isInside(workspace, requestedTarget))
     throw new EvidencePackValidationError("output path must stay inside the workspace");
-  const parent = dirname18(requestedTarget);
+  const parent = dirname19(requestedTarget);
   const existingAncestor2 = await realExistingAncestor(parent);
   if (!isInside(workspace, existingAncestor2) && existingAncestor2 !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
   }
-  await mkdir20(parent, { recursive: true });
+  await mkdir21(parent, { recursive: true });
   const realParent = await realpath2(parent);
   if (!isInside(workspace, realParent) && realParent !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
@@ -48556,7 +49090,7 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   }
   const temp = resolve11(realParent, `.${basename9(target)}.${process.pid}.${randomUUID6()}.tmp`);
   try {
-    await writeFile9(temp, `${JSON.stringify(pack, null, 2)}
+    await writeFile10(temp, `${JSON.stringify(pack, null, 2)}
 `, "utf8");
     try {
       await link3(temp, target);
@@ -48633,7 +49167,7 @@ var exports_evidence = {};
 __export(exports_evidence, {
   evidenceCommand: () => evidenceCommand
 });
-import { join as join41, relative as relative6, resolve as resolve12, sep as sep8 } from "path";
+import { join as join42, relative as relative6, resolve as resolve12, sep as sep8 } from "path";
 import { realpath as realpath3 } from "fs/promises";
 import { createHash as createHash9 } from "crypto";
 function safeMessage(error) {
@@ -48709,7 +49243,7 @@ async function auditEntries(configPath, config) {
     throw new EvidencePackValidationError("audit evidence is disabled");
   const storagePath = await resolveConfigStoragePath(configPath);
   const connectionName = config.effectiveConnectionName || getGlobalConnectionName() || "default";
-  const file = join41(storagePath, ".dbcli", "audit", `${connectionName}.jsonl`);
+  const file = join42(storagePath, ".dbcli", "audit", `${connectionName}.jsonl`);
   return { connectionName, entries: await readEntries(file, { include_rotated: true }) };
 }
 function auditReference(entry, connectionName) {
@@ -50073,8 +50607,8 @@ __export(exports_impact, {
   impactCommand: () => impactCommand
 });
 import { randomUUID as randomUUID7 } from "crypto";
-import { link as link4, lstat as lstat8, mkdir as mkdir21, realpath as realpath5, unlink as unlink9, writeFile as writeFile10 } from "fs/promises";
-import { basename as basename10, dirname as dirname19, relative as relative8, resolve as resolve14, sep as sep10 } from "path";
+import { link as link4, lstat as lstat8, mkdir as mkdir22, realpath as realpath5, unlink as unlink9, writeFile as writeFile11 } from "fs/promises";
+import { basename as basename10, dirname as dirname20, relative as relative8, resolve as resolve14, sep as sep10 } from "path";
 function collectOption3(value, previous) {
   return [...previous, value];
 }
@@ -50278,7 +50812,7 @@ async function realExistingAncestor2(path4) {
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
-      const parent = dirname19(candidate);
+      const parent = dirname20(candidate);
       if (parent === candidate)
         throw error;
       candidate = parent;
@@ -50290,11 +50824,11 @@ async function resolveOutput(workspaceRoot, outputPath) {
   const target = resolve14(workspace, outputPath);
   if (!isInside2(workspace, target))
     throw new Error("output path must stay inside the workspace");
-  const parent = dirname19(target);
+  const parent = dirname20(target);
   const existingAncestor2 = await realExistingAncestor2(parent);
   if (!isInside2(workspace, existingAncestor2) && existingAncestor2 !== workspace)
     throw new Error("output path must stay inside the workspace");
-  await mkdir21(parent, { recursive: true });
+  await mkdir22(parent, { recursive: true });
   const realParent = await realpath5(parent);
   if (!isInside2(workspace, realParent) && realParent !== workspace)
     throw new Error("output path must stay inside the workspace");
@@ -50302,7 +50836,7 @@ async function resolveOutput(workspaceRoot, outputPath) {
 }
 async function assertOutputParent(workspaceRoot, path4) {
   const workspace = await realpath5(workspaceRoot);
-  const parent = await realpath5(dirname19(path4));
+  const parent = await realpath5(dirname20(path4));
   if (!isInside2(workspace, parent) && parent !== workspace) {
     throw new Error("output path must stay inside the workspace");
   }
@@ -50316,9 +50850,9 @@ async function writeOutput(workspaceRoot, path4, content) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  const temp = resolve14(dirname19(path4), `.${basename10(path4)}.${process.pid}.${randomUUID7()}.tmp`);
+  const temp = resolve14(dirname20(path4), `.${basename10(path4)}.${process.pid}.${randomUUID7()}.tmp`);
   try {
-    await writeFile10(temp, content, "utf8");
+    await writeFile11(temp, content, "utf8");
     await assertOutputParent(workspaceRoot, path4);
     await link4(temp, path4);
   } catch (error) {
@@ -50457,6 +50991,7 @@ function buildProgram() {
   program2.addCommand(shellCommand);
   program2.addCommand(migrateCommand);
   program2.addCommand(useCommand);
+  program2.addCommand(passwordCommand);
   program2.addCommand(queriesCommand);
   program2.addCommand(explainCommand);
   program2.addCommand(lintCommand);
@@ -50510,6 +51045,7 @@ var init_program = __esm(() => {
   init_shell3();
   init_migrate();
   init_use();
+  init_credential();
   init_proxy();
   init_semantic2();
   init_design2();
@@ -50533,9 +51069,9 @@ __export(exports_completion, {
   detectShell: () => detectShell,
   completionCommand: () => completionCommand
 });
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 import { homedir as homedir4 } from "os";
-import { mkdir as mkdir22 } from "fs/promises";
+import { mkdir as mkdir23 } from "fs/promises";
 function resolveHome() {
   return process.env.HOME ?? homedir4();
 }
@@ -50785,11 +51321,11 @@ function getInstallPath2(shell) {
   const home = resolveHome();
   switch (shell) {
     case "bash":
-      return join42(home, ".bashrc");
+      return join43(home, ".bashrc");
     case "zsh":
-      return join42(home, ".zshrc");
+      return join43(home, ".zshrc");
     case "fish":
-      return join42(home, ".config", "fish", "completions", "dbcli.fish");
+      return join43(home, ".config", "fish", "completions", "dbcli.fish");
     default:
       throw new Error(`Unsupported shell: ${shell}. Supported: bash, zsh, fish`);
   }
@@ -50807,8 +51343,8 @@ function detectShell() {
 async function installCompletion(shell, script) {
   const targetPath = getInstallPath2(shell);
   if (shell === "fish") {
-    const dir = join42(resolveHome(), ".config", "fish", "completions");
-    await mkdir22(dir, { recursive: true });
+    const dir = join43(resolveHome(), ".config", "fish", "completions");
+    await mkdir23(dir, { recursive: true });
     await Bun.file(targetPath).write(script);
     console.log(colors.success(`\u2713 Fish completion installed to ${targetPath}`));
     return;
@@ -51147,6 +51683,12 @@ var COMMAND_LOADERS = {
       program2.addCommand(migrateCommand2);
     };
   },
+  password: async () => {
+    const { passwordCommand: passwordCommand2 } = await Promise.resolve().then(() => (init_credential(), exports_credential));
+    return (program2) => {
+      program2.addCommand(passwordCommand2);
+    };
+  },
   use: async () => {
     const { useCommand: useCommand2 } = await Promise.resolve().then(() => (init_use(), exports_use));
     return (program2) => {
@@ -51287,7 +51829,7 @@ async function buildProgramFor(argv) {
 
 // src/cli-runtime.ts
 init_cli_error();
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 import { writeSync as writeSync2 } from "fs";
 import { format } from "util";
 function installSynchronousRedirectedStdout() {
@@ -51425,7 +51967,7 @@ program2.hook("preAction", (thisCommand, actionCommand) => {
       try {
         let cache = null;
         try {
-          const cacheFile = Bun.file(join43(configPath, "version-check.json"));
+          const cacheFile = Bun.file(join44(configPath, "version-check.json"));
           if (await cacheFile.exists()) {
             cache = await cacheFile.json();
           }