@carllee1983/dbcli 1.56.0 → 1.58.0

package/dist/core.mjs

@@ -118,24 +118,24 @@ var require_picocolors = __commonJS((exports, module) => {
 
 // node_modules/lru-cache/dist/esm/node/index.min.js
 import { tracingChannel as j, channel as G } from "diagnostics_channel";
-var w, W, C, D = () => w.hasSubscribers || W.hasSubscribers, I, L, P = (u, e, t, i) => {
-  typeof L.emitWarning == "function" ? L.emitWarning(u, e, t, i) : console.error(`[${t}] ${e}: ${u}`);
+var w, W, C, D = () => w.hasSubscribers || W.hasSubscribers, I, L, P = (u, e, t2, i) => {
+  typeof L.emitWarning == "function" ? L.emitWarning(u, e, t2, i) : console.error(`[${t2}] ${e}: ${u}`);
 }, H = (u) => !I.has(u), T = (u) => !!u && u === Math.floor(u) && u > 0 && isFinite(u), U = (u) => T(u) ? u <= Math.pow(2, 8) ? Uint8Array : u <= Math.pow(2, 16) ? Uint16Array : u <= Math.pow(2, 32) ? Uint32Array : u <= Number.MAX_SAFE_INTEGER ? O : null : null, O, R = class u {
   heap;
   length;
   static #o = false;
   static create(e) {
-    let t = U(e);
-    if (!t)
+    let t2 = U(e);
+    if (!t2)
       return [];
     u.#o = true;
-    let i = new u(e, t);
+    let i = new u(e, t2);
     return u.#o = false, i;
   }
-  constructor(e, t) {
+  constructor(e, t2) {
     if (!u.#o)
       throw new TypeError("instantiate Stack using Stack.create(n)");
-    this.heap = new t(e), this.length = 0;
+    this.heap = new t2(e), this.length = 0;
   }
   push(e) {
     this.heap[this.length++] = e;
@@ -206,7 +206,7 @@ var init_index_min = __esm(() => {
         return e.#a;
       }, get tail() {
         return e.#h;
-      }, free: e.#y, isBackgroundFetch: (t) => e.#e(t), backgroundFetch: (t, i, s, n) => e.#P(t, i, s, n), moveToTail: (t) => e.#L(t), indexes: (t) => e.#A(t), rindexes: (t) => e.#z(t), isStale: (t) => e.#p(t) };
+      }, free: e.#y, isBackgroundFetch: (t2) => e.#e(t2), backgroundFetch: (t2, i, s, n) => e.#P(t2, i, s, n), moveToTail: (t2) => e.#L(t2), indexes: (t2) => e.#A(t2), rindexes: (t2) => e.#z(t2), isStale: (t2) => e.#p(t2) };
     }
     get max() {
       return this.#o;
@@ -236,15 +236,15 @@ var init_index_min = __esm(() => {
       return this.#S;
     }
     constructor(e) {
-      let { max: t = 0, ttl: i, ttlResolution: s = 1, ttlAutopurge: n, updateAgeOnGet: r, updateAgeOnHas: h, allowStale: a, dispose: o, onInsert: p, disposeAfter: m, noDisposeOnSet: _, noUpdateTTL: c, maxSize: d = 0, maxEntrySize: f = 0, sizeCalculation: y, fetchMethod: l, memoMethod: S, noDeleteOnFetchRejection: F, noDeleteOnStaleGet: b, allowStaleOnFetchRejection: g, allowStaleOnFetchAbort: A, ignoreFetchAbort: z, perf: x } = e;
+      let { max: t2 = 0, ttl: i, ttlResolution: s = 1, ttlAutopurge: n, updateAgeOnGet: r, updateAgeOnHas: h, allowStale: a, dispose: o, onInsert: p, disposeAfter: m, noDisposeOnSet: _, noUpdateTTL: c, maxSize: d = 0, maxEntrySize: f = 0, sizeCalculation: y, fetchMethod: l, memoMethod: S, noDeleteOnFetchRejection: F, noDeleteOnStaleGet: b, allowStaleOnFetchRejection: g, allowStaleOnFetchAbort: A, ignoreFetchAbort: z, perf: x } = e;
       if (x !== undefined && typeof x?.now != "function")
         throw new TypeError("perf option must have a now() method if specified");
-      if (this.#m = x ?? C, t !== 0 && !T(t))
+      if (this.#m = x ?? C, t2 !== 0 && !T(t2))
         throw new TypeError("max option must be a nonnegative integer");
-      let E = t ? U(t) : Array;
+      let E = t2 ? U(t2) : Array;
       if (!E)
-        throw new Error("invalid max value: " + t);
-      if (this.#o = t, this.#c = d, this.maxEntrySize = f || this.#c, this.sizeCalculation = y, this.sizeCalculation) {
+        throw new Error("invalid max value: " + t2);
+      if (this.#o = t2, this.#c = d, this.maxEntrySize = f || this.#c, this.sizeCalculation = y, this.sizeCalculation) {
         if (!this.#c && !this.maxEntrySize)
           throw new TypeError("cannot set sizeCalculation without setting maxSize or maxEntrySize");
         if (typeof this.sizeCalculation != "function")
@@ -254,7 +254,7 @@ var init_index_min = __esm(() => {
         throw new TypeError("memoMethod must be a function if defined");
       if (this.#I = S, l !== undefined && typeof l != "function")
         throw new TypeError("fetchMethod must be a function if specified");
-      if (this.#M = l, this.#U = !!l, this.#s = new Map, this.#i = Array.from({ length: t }).fill(undefined), this.#t = Array.from({ length: t }).fill(undefined), this.#l = new E(t), this.#u = new E(t), this.#a = 0, this.#h = 0, this.#y = R.create(t), this.#n = 0, this.#b = 0, typeof o == "function" && (this.#w = o), typeof p == "function" && (this.#O = p), typeof m == "function" ? (this.#S = m, this.#r = []) : (this.#S = undefined, this.#r = undefined), this.#T = !!this.#w, this.#x = !!this.#O, this.#f = !!this.#S, this.noDisposeOnSet = !!_, this.noUpdateTTL = !!c, this.noDeleteOnFetchRejection = !!F, this.allowStaleOnFetchRejection = !!g, this.allowStaleOnFetchAbort = !!A, this.ignoreFetchAbort = !!z, this.maxEntrySize !== 0) {
+      if (this.#M = l, this.#U = !!l, this.#s = new Map, this.#i = Array.from({ length: t2 }).fill(undefined), this.#t = Array.from({ length: t2 }).fill(undefined), this.#l = new E(t2), this.#u = new E(t2), this.#a = 0, this.#h = 0, this.#y = R.create(t2), this.#n = 0, this.#b = 0, typeof o == "function" && (this.#w = o), typeof p == "function" && (this.#O = p), typeof m == "function" ? (this.#S = m, this.#r = []) : (this.#S = undefined, this.#r = undefined), this.#T = !!this.#w, this.#x = !!this.#O, this.#f = !!this.#S, this.noDisposeOnSet = !!_, this.noUpdateTTL = !!c, this.noDeleteOnFetchRejection = !!F, this.allowStaleOnFetchRejection = !!g, this.allowStaleOnFetchAbort = !!A, this.ignoreFetchAbort = !!z, this.maxEntrySize !== 0) {
         if (this.#c !== 0 && !T(this.#c))
           throw new TypeError("maxSize must be a positive integer if specified");
         if (!T(this.maxEntrySize))
@@ -277,13 +277,13 @@ var init_index_min = __esm(() => {
       return this.#s.has(e) ? 1 / 0 : 0;
     }
     #H() {
-      let e = new O(this.#o), t = new O(this.#o);
-      this.#d = e, this.#F = t;
+      let e = new O(this.#o), t2 = new O(this.#o);
+      this.#d = e, this.#F = t2;
       let i = this.ttlAutopurge ? Array.from({ length: this.#o }) : undefined;
       this.#g = i, this.#N = (h, a, o = this.#m.now()) => {
-        t[h] = a !== 0 ? o : 0, e[h] = a, s(h, a);
+        t2[h] = a !== 0 ? o : 0, e[h] = a, s(h, a);
       }, this.#D = (h) => {
-        t[h] = e[h] !== 0 ? this.#m.now() : 0, s(h, e[h]);
+        t2[h] = e[h] !== 0 ? this.#m.now() : 0, s(h, e[h]);
       };
       let s = this.ttlAutopurge ? (h, a) => {
         if (i?.[h] && (clearTimeout(i[h]), i[h] = undefined), a && a !== 0 && i) {
@@ -295,7 +295,7 @@ var init_index_min = __esm(() => {
       } : () => {};
       this.#v = (h, a) => {
         if (e[a]) {
-          let o = e[a], p = t[a];
+          let o = e[a], p = t2[a];
           if (!o || !p)
             return;
           h.ttl = o, h.start = p, h.now = n || r();
@@ -316,13 +316,13 @@ var init_index_min = __esm(() => {
         let a = this.#s.get(h);
         if (a === undefined)
           return 0;
-        let o = e[a], p = t[a];
+        let o = e[a], p = t2[a];
         if (!o || !p)
           return 1 / 0;
         let m = (n || r()) - p;
         return o - m;
       }, this.#p = (h) => {
-        let a = t[h], o = e[h];
+        let a = t2[h], o = e[h];
         return !!o && !!a && (n || r()) - a > o;
       };
     }
@@ -332,45 +332,45 @@ var init_index_min = __esm(() => {
     #p = () => false;
     #X() {
       let e = new O(this.#o);
-      this.#b = 0, this.#_ = e, this.#R = (t) => {
-        this.#b -= e[t], e[t] = 0;
-      }, this.#V = (t, i, s, n) => {
+      this.#b = 0, this.#_ = e, this.#R = (t2) => {
+        this.#b -= e[t2], e[t2] = 0;
+      }, this.#V = (t2, i, s, n) => {
         if (this.#e(i))
           return 0;
         if (!T(s))
           if (n) {
             if (typeof n != "function")
               throw new TypeError("sizeCalculation must be a function");
-            if (s = n(i, t), !T(s))
+            if (s = n(i, t2), !T(s))
               throw new TypeError("sizeCalculation return invalid (expect positive integer)");
           } else
             throw new TypeError("invalid size value (must be positive integer). When maxSize or maxEntrySize is used, sizeCalculation or size must be set.");
         return s;
-      }, this.#j = (t, i, s) => {
-        if (e[t] = i, this.#c) {
-          let n = this.#c - e[t];
+      }, this.#j = (t2, i, s) => {
+        if (e[t2] = i, this.#c) {
+          let n = this.#c - e[t2];
           for (;this.#b > n; )
             this.#G(true);
         }
-        this.#b += e[t], s && (s.entrySize = i, s.totalCalculatedSize = this.#b);
+        this.#b += e[t2], s && (s.entrySize = i, s.totalCalculatedSize = this.#b);
       };
     }
     #R = (e) => {};
-    #j = (e, t, i) => {};
-    #V = (e, t, i, s) => {
+    #j = (e, t2, i) => {};
+    #V = (e, t2, i, s) => {
       if (i || s)
         throw new TypeError("cannot set size without setting maxSize or maxEntrySize on cache");
       return 0;
     };
     *#A({ allowStale: e = this.allowStale } = {}) {
       if (this.#n)
-        for (let t = this.#h;this.#B(t) && ((e || !this.#p(t)) && (yield t), t !== this.#a); )
-          t = this.#u[t];
+        for (let t2 = this.#h;this.#B(t2) && ((e || !this.#p(t2)) && (yield t2), t2 !== this.#a); )
+          t2 = this.#u[t2];
     }
     *#z({ allowStale: e = this.allowStale } = {}) {
       if (this.#n)
-        for (let t = this.#a;this.#B(t) && ((e || !this.#p(t)) && (yield t), t !== this.#h); )
-          t = this.#l[t];
+        for (let t2 = this.#a;this.#B(t2) && ((e || !this.#p(t2)) && (yield t2), t2 !== this.#h); )
+          t2 = this.#l[t2];
     }
     #B(e) {
       return e !== undefined && this.#s.get(this.#i[e]) === e;
@@ -385,14 +385,14 @@ var init_index_min = __esm(() => {
     }
     *keys() {
       for (let e of this.#A()) {
-        let t = this.#i[e];
-        t !== undefined && !this.#e(this.#t[e]) && (yield t);
+        let t2 = this.#i[e];
+        t2 !== undefined && !this.#e(this.#t[e]) && (yield t2);
       }
     }
     *rkeys() {
       for (let e of this.#z()) {
-        let t = this.#i[e];
-        t !== undefined && !this.#e(this.#t[e]) && (yield t);
+        let t2 = this.#i[e];
+        t2 !== undefined && !this.#e(this.#t[e]) && (yield t2);
       }
     }
     *values() {
@@ -407,109 +407,109 @@ var init_index_min = __esm(() => {
       return this.entries();
     }
     [Symbol.toStringTag] = "LRUCache";
-    find(e, t = {}) {
+    find(e, t2 = {}) {
       for (let i of this.#A()) {
         let s = this.#t[i], n = this.#e(s) ? s.__staleWhileFetching : s;
         if (n !== undefined && e(n, this.#i[i], this))
-          return this.#C(this.#i[i], t);
+          return this.#C(this.#i[i], t2);
       }
     }
-    forEach(e, t = this) {
+    forEach(e, t2 = this) {
       for (let i of this.#A()) {
         let s = this.#t[i], n = this.#e(s) ? s.__staleWhileFetching : s;
-        n !== undefined && e.call(t, n, this.#i[i], this);
+        n !== undefined && e.call(t2, n, this.#i[i], this);
       }
     }
-    rforEach(e, t = this) {
+    rforEach(e, t2 = this) {
       for (let i of this.#z()) {
         let s = this.#t[i], n = this.#e(s) ? s.__staleWhileFetching : s;
-        n !== undefined && e.call(t, n, this.#i[i], this);
+        n !== undefined && e.call(t2, n, this.#i[i], this);
       }
     }
     purgeStale() {
       let e = false;
-      for (let t of this.#z({ allowStale: true }))
-        this.#p(t) && (this.#E(this.#i[t], "expire"), e = true);
+      for (let t2 of this.#z({ allowStale: true }))
+        this.#p(t2) && (this.#E(this.#i[t2], "expire"), e = true);
       return e;
     }
     info(e) {
-      let t = this.#s.get(e);
-      if (t === undefined)
+      let t2 = this.#s.get(e);
+      if (t2 === undefined)
         return;
-      let i = this.#t[t], s = this.#e(i) ? i.__staleWhileFetching : i;
+      let i = this.#t[t2], s = this.#e(i) ? i.__staleWhileFetching : i;
       if (s === undefined)
         return;
       let n = { value: s };
       if (this.#d && this.#F) {
-        let r = this.#d[t], h = this.#F[t];
+        let r = this.#d[t2], h = this.#F[t2];
         if (r && h) {
           let a = r - (this.#m.now() - h);
           n.ttl = a, n.start = Date.now();
         }
       }
-      return this.#_ && (n.size = this.#_[t]), n;
+      return this.#_ && (n.size = this.#_[t2]), n;
     }
     dump() {
       let e = [];
-      for (let t of this.#A({ allowStale: true })) {
-        let i = this.#i[t], s = this.#t[t], n = this.#e(s) ? s.__staleWhileFetching : s;
+      for (let t2 of this.#A({ allowStale: true })) {
+        let i = this.#i[t2], s = this.#t[t2], n = this.#e(s) ? s.__staleWhileFetching : s;
         if (n === undefined || i === undefined)
           continue;
         let r = { value: n };
         if (this.#d && this.#F) {
-          r.ttl = this.#d[t];
-          let h = this.#m.now() - this.#F[t];
+          r.ttl = this.#d[t2];
+          let h = this.#m.now() - this.#F[t2];
           r.start = Math.floor(Date.now() - h);
         }
-        this.#_ && (r.size = this.#_[t]), e.unshift([i, r]);
+        this.#_ && (r.size = this.#_[t2]), e.unshift([i, r]);
       }
       return e;
     }
     load(e) {
       this.clear();
-      for (let [t, i] of e) {
+      for (let [t2, i] of e) {
         if (i.start) {
           let s = Date.now() - i.start;
           i.start = this.#m.now() - s;
         }
-        this.#W(t, i.value, i);
+        this.#W(t2, i.value, i);
       }
     }
-    set(e, t, i = {}) {
+    set(e, t2, i = {}) {
       let { status: s = w.hasSubscribers ? {} : undefined } = i;
-      i.status = s, s && (s.op = "set", s.key = e, t !== undefined && (s.value = t), s.cache = this);
-      let n = this.#W(e, t, i);
+      i.status = s, s && (s.op = "set", s.key = e, t2 !== undefined && (s.value = t2), s.cache = this);
+      let n = this.#W(e, t2, i);
       return s && w.hasSubscribers && w.publish(s), n;
     }
-    #W(e, t, i, s) {
+    #W(e, t2, i, s) {
       let { ttl: n = this.ttl, start: r, noDisposeOnSet: h = this.noDisposeOnSet, sizeCalculation: a = this.sizeCalculation, status: o } = i;
-      if (t === undefined)
+      if (t2 === undefined)
         return o && (o.set = "deleted"), this.delete(e), this;
-      let { noUpdateTTL: p = this.noUpdateTTL } = i, m = this.#e(t);
-      o && !m && (o.value = t);
-      let _ = this.#V(e, t, i.size || 0, a, o);
+      let { noUpdateTTL: p = this.noUpdateTTL } = i, m = this.#e(t2);
+      o && !m && (o.value = t2);
+      let _ = this.#V(e, t2, i.size || 0, a, o);
       if (this.maxEntrySize && _ > this.maxEntrySize)
         return this.#E(e, "set"), o && (o.set = "miss", o.maxEntrySizeExceeded = true), this;
       let c = this.#n === 0 ? undefined : this.#s.get(e);
       if (c === undefined)
-        c = this.#n === 0 ? this.#h : this.#y.length !== 0 ? this.#y.pop() : this.#n === this.#o ? this.#G(false) : this.#n, this.#i[c] = e, this.#t[c] = t, this.#s.set(e, c), this.#l[this.#h] = c, this.#u[c] = this.#h, this.#h = c, this.#n++, this.#j(c, _, o), o && (o.set = "add"), p = false, this.#x && !m && this.#O?.(t, e, "add");
+        c = this.#n === 0 ? this.#h : this.#y.length !== 0 ? this.#y.pop() : this.#n === this.#o ? this.#G(false) : this.#n, this.#i[c] = e, this.#t[c] = t2, this.#s.set(e, c), this.#l[this.#h] = c, this.#u[c] = this.#h, this.#h = c, this.#n++, this.#j(c, _, o), o && (o.set = "add"), p = false, this.#x && !m && this.#O?.(t2, e, "add");
       else {
         this.#L(c);
         let d = this.#t[c];
-        if (t !== d) {
+        if (t2 !== d) {
           if (!h)
             if (this.#e(d)) {
               d !== s && d.__abortController.abort(new Error("replaced"));
               let { __staleWhileFetching: f } = d;
-              f !== undefined && f !== t && (this.#T && this.#w?.(f, e, "set"), this.#f && this.#r?.push([f, e, "set"]));
+              f !== undefined && f !== t2 && (this.#T && this.#w?.(f, e, "set"), this.#f && this.#r?.push([f, e, "set"]));
             } else
               this.#T && this.#w?.(d, e, "set"), this.#f && this.#r?.push([d, e, "set"]);
-          if (this.#R(c), this.#j(c, _, o), this.#t[c] = t, !m) {
-            let f = d && this.#e(d) ? d.__staleWhileFetching : d, y = f === undefined ? "add" : t !== f ? "replace" : "update";
-            o && (o.set = y, f !== undefined && (o.oldValue = f)), this.#x && this.onInsert?.(t, e, y);
+          if (this.#R(c), this.#j(c, _, o), this.#t[c] = t2, !m) {
+            let f = d && this.#e(d) ? d.__staleWhileFetching : d, y = f === undefined ? "add" : t2 !== f ? "replace" : "update";
+            o && (o.set = y, f !== undefined && (o.oldValue = f)), this.#x && this.onInsert?.(t2, e, y);
           }
         } else
-          m || (o && (o.set = "update"), this.#x && this.onInsert?.(t, e, "update"));
+          m || (o && (o.set = "update"), this.#x && this.onInsert?.(t2, e, "update"));
       }
       if (n !== 0 && !this.#d && this.#H(), this.#d && (p || this.#N(c, n, r), o && this.#v(o, c)), !h && this.#f && this.#r) {
         let d = this.#r, f;
@@ -530,26 +530,26 @@ var init_index_min = __esm(() => {
         }
       } finally {
         if (this.#f && this.#r) {
-          let e = this.#r, t;
-          for (;t = e?.shift(); )
-            this.#S?.(...t);
+          let e = this.#r, t2;
+          for (;t2 = e?.shift(); )
+            this.#S?.(...t2);
         }
       }
     }
     #G(e) {
-      let t = this.#a, i = this.#i[t], s = this.#t[t], n = this.#e(s);
+      let t2 = this.#a, i = this.#i[t2], s = this.#t[t2], n = this.#e(s);
       n && s.__abortController.abort(new Error("evicted"));
       let r = n ? s.__staleWhileFetching : s;
-      return (this.#T || this.#f) && r !== undefined && (this.#T && this.#w?.(r, i, "evict"), this.#f && this.#r?.push([r, i, "evict"])), this.#R(t), this.#g?.[t] && (clearTimeout(this.#g[t]), this.#g[t] = undefined), e && (this.#i[t] = undefined, this.#t[t] = undefined, this.#y.push(t)), this.#n === 1 ? (this.#a = this.#h = 0, this.#y.length = 0) : this.#a = this.#l[t], this.#s.delete(i), this.#n--, t;
+      return (this.#T || this.#f) && r !== undefined && (this.#T && this.#w?.(r, i, "evict"), this.#f && this.#r?.push([r, i, "evict"])), this.#R(t2), this.#g?.[t2] && (clearTimeout(this.#g[t2]), this.#g[t2] = undefined), e && (this.#i[t2] = undefined, this.#t[t2] = undefined, this.#y.push(t2)), this.#n === 1 ? (this.#a = this.#h = 0, this.#y.length = 0) : this.#a = this.#l[t2], this.#s.delete(i), this.#n--, t2;
     }
-    has(e, t = {}) {
-      let { status: i = w.hasSubscribers ? {} : undefined } = t;
-      t.status = i, i && (i.op = "has", i.key = e, i.cache = this);
-      let s = this.#Y(e, t);
+    has(e, t2 = {}) {
+      let { status: i = w.hasSubscribers ? {} : undefined } = t2;
+      t2.status = i, i && (i.op = "has", i.key = e, i.cache = this);
+      let s = this.#Y(e, t2);
       return w.hasSubscribers && w.publish(i), s;
     }
-    #Y(e, t = {}) {
-      let { updateAgeOnHas: i = this.updateAgeOnHas, status: s } = t, n = this.#s.get(e);
+    #Y(e, t2 = {}) {
+      let { updateAgeOnHas: i = this.updateAgeOnHas, status: s } = t2, n = this.#s.get(e);
       if (n !== undefined) {
         let r = this.#t[n];
         if (this.#e(r) && r.__staleWhileFetching === undefined)
@@ -562,14 +562,14 @@ var init_index_min = __esm(() => {
         s && (s.has = "miss");
       return false;
     }
-    peek(e, t = {}) {
-      let { status: i = D() ? {} : undefined } = t;
-      i && (i.op = "peek", i.key = e, i.cache = this), t.status = i;
-      let s = this.#J(e, t);
+    peek(e, t2 = {}) {
+      let { status: i = D() ? {} : undefined } = t2;
+      i && (i.op = "peek", i.key = e, i.cache = this), t2.status = i;
+      let s = this.#J(e, t2);
       return w.hasSubscribers && w.publish(i), s;
     }
-    #J(e, t) {
-      let { status: i, allowStale: s = this.allowStale } = t, n = this.#s.get(e);
+    #J(e, t2) {
+      let { status: i, allowStale: s = this.allowStale } = t2, n = this.#s.get(e);
       if (n === undefined || !s && this.#p(n)) {
         i && (i.peek = n === undefined ? "miss" : "stale");
         return;
@@ -577,8 +577,8 @@ var init_index_min = __esm(() => {
       let r = this.#t[n], h = this.#e(r) ? r.__staleWhileFetching : r;
       return i && (h !== undefined ? (i.peek = "hit", i.value = h) : i.peek = "miss"), h;
     }
-    #P(e, t, i, s) {
-      let n = t === undefined ? undefined : this.#t[t];
+    #P(e, t2, i, s) {
+      let n = t2 === undefined ? undefined : this.#t[t2];
       if (this.#e(n))
         return n;
       let r = new AbortController, { signal: h } = i;
@@ -587,11 +587,11 @@ var init_index_min = __esm(() => {
         let { aborted: l } = r.signal, S = i.ignoreFetchAbort && f !== undefined, F = i.ignoreFetchAbort || !!(i.allowStaleOnFetchAbort && f !== undefined);
         if (i.status && (l && !y ? (i.status.fetchAborted = true, i.status.fetchError = r.signal.reason, S && (i.status.fetchAbortIgnored = true)) : i.status.fetchResolved = true), l && !S && !y)
           return m(r.signal.reason, F);
-        let b = c, g = this.#t[t];
-        return (g === c || g === undefined && S && y) && (f === undefined ? b.__staleWhileFetching !== undefined ? this.#t[t] = b.__staleWhileFetching : this.#E(e, "fetch") : (i.status && (i.status.fetchUpdated = true), this.#W(e, f, a.options, b))), f;
+        let b = c, g = this.#t[t2];
+        return (g === c || g === undefined && S && y) && (f === undefined ? b.__staleWhileFetching !== undefined ? this.#t[t2] = b.__staleWhileFetching : this.#E(e, "fetch") : (i.status && (i.status.fetchUpdated = true), this.#W(e, f, a.options, b))), f;
       }, p = (f) => (i.status && (i.status.fetchRejected = true, i.status.fetchError = f), m(f, false)), m = (f, y) => {
         let { aborted: l } = r.signal, S = l && i.allowStaleOnFetchAbort, F = S || i.allowStaleOnFetchRejection, b = F || i.noDeleteOnFetchRejection, g = c;
-        if (this.#t[t] === c && (!b || !y && g.__staleWhileFetching === undefined ? this.#E(e, "fetch") : S || (this.#t[t] = g.__staleWhileFetching)), F)
+        if (this.#t[t2] === c && (!b || !y && g.__staleWhileFetching === undefined ? this.#E(e, "fetch") : S || (this.#t[t2] = g.__staleWhileFetching)), F)
           return i.status && g.__staleWhileFetching !== undefined && (i.status.returnedStale = true), g.__staleWhileFetching;
         if (g.__returned === g)
           throw f;
@@ -603,22 +603,22 @@ var init_index_min = __esm(() => {
       };
       i.status && (i.status.fetchDispatched = true);
       let c = new Promise(_).then(o, p), d = Object.assign(c, { __abortController: r, __staleWhileFetching: n, __returned: undefined });
-      return t === undefined ? (this.#W(e, d, { ...a.options, status: undefined }), t = this.#s.get(e)) : this.#t[t] = d, d;
+      return t2 === undefined ? (this.#W(e, d, { ...a.options, status: undefined }), t2 = this.#s.get(e)) : this.#t[t2] = d, d;
     }
     #e(e) {
       if (!this.#U)
         return false;
-      let t = e;
-      return !!t && t instanceof Promise && t.hasOwnProperty("__staleWhileFetching") && t.__abortController instanceof AbortController;
+      let t2 = e;
+      return !!t2 && t2 instanceof Promise && t2.hasOwnProperty("__staleWhileFetching") && t2.__abortController instanceof AbortController;
     }
-    fetch(e, t = {}) {
-      let i = W.hasSubscribers, { status: s = D() ? {} : undefined } = t;
-      t.status = s, s && t.context && (s.context = t.context);
-      let n = this.#k(e, t);
+    fetch(e, t2 = {}) {
+      let i = W.hasSubscribers, { status: s = D() ? {} : undefined } = t2;
+      t2.status = s, s && t2.context && (s.context = t2.context);
+      let n = this.#k(e, t2);
       return s && i && (s.trace = true, W.tracePromise(() => n, s).catch(() => {})), n;
     }
-    async#k(e, t = {}) {
-      let { allowStale: i = this.allowStale, updateAgeOnGet: s = this.updateAgeOnGet, noDeleteOnStaleGet: n = this.noDeleteOnStaleGet, ttl: r = this.ttl, noDisposeOnSet: h = this.noDisposeOnSet, size: a = 0, sizeCalculation: o = this.sizeCalculation, noUpdateTTL: p = this.noUpdateTTL, noDeleteOnFetchRejection: m = this.noDeleteOnFetchRejection, allowStaleOnFetchRejection: _ = this.allowStaleOnFetchRejection, ignoreFetchAbort: c = this.ignoreFetchAbort, allowStaleOnFetchAbort: d = this.allowStaleOnFetchAbort, context: f, forceRefresh: y = false, status: l, signal: S } = t;
+    async#k(e, t2 = {}) {
+      let { allowStale: i = this.allowStale, updateAgeOnGet: s = this.updateAgeOnGet, noDeleteOnStaleGet: n = this.noDeleteOnStaleGet, ttl: r = this.ttl, noDisposeOnSet: h = this.noDisposeOnSet, size: a = 0, sizeCalculation: o = this.sizeCalculation, noUpdateTTL: p = this.noUpdateTTL, noDeleteOnFetchRejection: m = this.noDeleteOnFetchRejection, allowStaleOnFetchRejection: _ = this.allowStaleOnFetchRejection, ignoreFetchAbort: c = this.ignoreFetchAbort, allowStaleOnFetchAbort: d = this.allowStaleOnFetchAbort, context: f, forceRefresh: y = false, status: l, signal: S } = t2;
       if (l && (l.op = "fetch", l.key = e, y && (l.forceRefresh = true), l.cache = this), !this.#U)
         return l && (l.fetch = "get"), this.#C(e, { allowStale: i, updateAgeOnGet: s, noDeleteOnStaleGet: n, status: l });
       let F = { allowStale: i, updateAgeOnGet: s, noDeleteOnStaleGet: n, ttl: r, noDisposeOnSet: h, size: a, sizeCalculation: o, noUpdateTTL: p, noDeleteOnFetchRejection: m, allowStaleOnFetchRejection: _, allowStaleOnFetchAbort: d, ignoreFetchAbort: c, status: l, signal: S }, b = this.#s.get(e);
@@ -639,29 +639,29 @@ var init_index_min = __esm(() => {
         return l && (l.fetch = A ? "stale" : "refresh", E && A && (l.returnedStale = true)), E ? z.__staleWhileFetching : z.__returned = z;
       }
     }
-    forceFetch(e, t = {}) {
-      let i = W.hasSubscribers, { status: s = D() ? {} : undefined } = t;
-      t.status = s, s && t.context && (s.context = t.context);
-      let n = this.#K(e, t);
+    forceFetch(e, t2 = {}) {
+      let i = W.hasSubscribers, { status: s = D() ? {} : undefined } = t2;
+      t2.status = s, s && t2.context && (s.context = t2.context);
+      let n = this.#K(e, t2);
       return s && i && (s.trace = true, W.tracePromise(() => n, s).catch(() => {})), n;
     }
-    async#K(e, t = {}) {
-      let i = await this.#k(e, t);
+    async#K(e, t2 = {}) {
+      let i = await this.#k(e, t2);
       if (i === undefined)
         throw new Error("fetch() returned undefined");
       return i;
     }
-    memo(e, t = {}) {
-      let { status: i = w.hasSubscribers ? {} : undefined } = t;
-      t.status = i, i && (i.op = "memo", i.key = e, t.context && (i.context = t.context), i.cache = this);
-      let s = this.#Q(e, t);
+    memo(e, t2 = {}) {
+      let { status: i = w.hasSubscribers ? {} : undefined } = t2;
+      t2.status = i, i && (i.op = "memo", i.key = e, t2.context && (i.context = t2.context), i.cache = this);
+      let s = this.#Q(e, t2);
       return i && (i.value = s), w.hasSubscribers && w.publish(i), s;
     }
-    #Q(e, t = {}) {
+    #Q(e, t2 = {}) {
       let i = this.#I;
       if (!i)
         throw new Error("no memoMethod provided to constructor");
-      let { context: s, status: n, forceRefresh: r, ...h } = t;
+      let { context: s, status: n, forceRefresh: r, ...h } = t2;
       n && r && (n.forceRefresh = true);
       let a = this.#C(e, h), o = r || a === undefined;
       if (n && (n.memo = o ? "miss" : "hit", o || (n.value = a)), !o)
@@ -669,14 +669,14 @@ var init_index_min = __esm(() => {
       let p = i(e, a, { options: h, context: s });
       return n && (n.value = p), this.#W(e, p, h), p;
     }
-    get(e, t = {}) {
-      let { status: i = w.hasSubscribers ? {} : undefined } = t;
-      t.status = i, i && (i.op = "get", i.key = e, i.cache = this);
-      let s = this.#C(e, t);
+    get(e, t2 = {}) {
+      let { status: i = w.hasSubscribers ? {} : undefined } = t2;
+      t2.status = i, i && (i.op = "get", i.key = e, i.cache = this);
+      let s = this.#C(e, t2);
       return i && (s !== undefined && (i.value = s), w.hasSubscribers && w.publish(i)), s;
     }
-    #C(e, t = {}) {
-      let { allowStale: i = this.allowStale, updateAgeOnGet: s = this.updateAgeOnGet, noDeleteOnStaleGet: n = this.noDeleteOnStaleGet, status: r } = t, h = this.#s.get(e);
+    #C(e, t2 = {}) {
+      let { allowStale: i = this.allowStale, updateAgeOnGet: s = this.updateAgeOnGet, noDeleteOnStaleGet: n = this.noDeleteOnStaleGet, status: r } = t2, h = this.#s.get(e);
       if (h === undefined) {
         r && (r.get = "miss");
         return;
@@ -684,8 +684,8 @@ var init_index_min = __esm(() => {
       let a = this.#t[h], o = this.#e(a);
       return r && this.#v(r, h), this.#p(h) ? o ? (r && (r.get = "stale-fetching"), i && a.__staleWhileFetching !== undefined ? (r && (r.returnedStale = true), a.__staleWhileFetching) : undefined) : (n || this.#E(e, "expire"), r && (r.get = "stale"), i ? (r && (r.returnedStale = true), a) : undefined) : (r && (r.get = o ? "fetching" : "hit"), this.#L(h), s && this.#D(h), o ? a.__staleWhileFetching : a);
     }
-    #$(e, t) {
-      this.#u[t] = e, this.#l[e] = t;
+    #$(e, t2) {
+      this.#u[t2] = e, this.#l[e] = t2;
     }
     #L(e) {
       e !== this.#h && (e === this.#a ? this.#a = this.#l[e] : this.#$(this.#u[e], this.#l[e]), this.#$(this.#h, e), this.#h = e);
@@ -693,18 +693,18 @@ var init_index_min = __esm(() => {
     delete(e) {
       return this.#E(e, "delete");
     }
-    #E(e, t) {
-      w.hasSubscribers && w.publish({ op: "delete", delete: t, key: e, cache: this });
+    #E(e, t2) {
+      w.hasSubscribers && w.publish({ op: "delete", delete: t2, key: e, cache: this });
       let i = false;
       if (this.#n !== 0) {
         let s = this.#s.get(e);
         if (s !== undefined)
           if (this.#g?.[s] && (clearTimeout(this.#g?.[s]), this.#g[s] = undefined), i = true, this.#n === 1)
-            this.#q(t);
+            this.#q(t2);
           else {
             this.#R(s);
             let n = this.#t[s];
-            if (this.#e(n) ? n.__abortController.abort(new Error("deleted")) : (this.#T || this.#f) && (this.#T && this.#w?.(n, e, t), this.#f && this.#r?.push([n, e, t])), this.#s.delete(e), this.#i[s] = undefined, this.#t[s] = undefined, s === this.#h)
+            if (this.#e(n) ? n.__abortController.abort(new Error("deleted")) : (this.#T || this.#f) && (this.#T && this.#w?.(n, e, t2), this.#f && this.#r?.push([n, e, t2])), this.#s.delete(e), this.#i[s] = undefined, this.#t[s] = undefined, s === this.#h)
               this.#h = this.#u[s];
             else if (s === this.#a)
               this.#a = this.#l[s];
@@ -728,24 +728,24 @@ var init_index_min = __esm(() => {
       return this.#q("delete");
     }
     #q(e) {
-      for (let t of this.#z({ allowStale: true })) {
-        let i = this.#t[t];
+      for (let t2 of this.#z({ allowStale: true })) {
+        let i = this.#t[t2];
         if (this.#e(i))
           i.__abortController.abort(new Error("deleted"));
         else {
-          let s = this.#i[t];
+          let s = this.#i[t2];
           this.#T && this.#w?.(i, s, e), this.#f && this.#r?.push([i, s, e]);
         }
       }
       if (this.#s.clear(), this.#t.fill(undefined), this.#i.fill(undefined), this.#d && this.#F) {
         this.#d.fill(0), this.#F.fill(0);
-        for (let t of this.#g ?? [])
-          t !== undefined && clearTimeout(t);
+        for (let t2 of this.#g ?? [])
+          t2 !== undefined && clearTimeout(t2);
         this.#g?.fill(undefined);
       }
       if (this.#_ && this.#_.fill(0), this.#a = 0, this.#h = 0, this.#y.length = 0, this.#b = 0, this.#n = 0, this.#f && this.#r) {
-        let t = this.#r, i;
-        for (;i = t?.shift(); )
+        let t2 = this.#r, i;
+        for (;i = t2?.shift(); )
           this.#S?.(...i);
       }
     }
@@ -1679,6 +1679,12 @@ var messages_default = {
     invalid_config: "Invalid configuration: {field}",
     connection_failed: "Failed to connect to database: {message}",
     permission_denied: "Permission denied (required: {required})",
+    permission_requires_level: "{type} operation requires {minimum} permission or higher (current level: {permission})",
+    elasticsearch_requires_level: "Elasticsearch {type} operation requires {minimum} permission or higher (current level: {permission})",
+    escalated_write_requires_admin: "This statement opens as a read but contains an executable {keyword}. A write hidden inside a read statement requires admin permission (current level: {permission}).",
+    multiple_statements_refused: "SQL containing multiple statements is refused below admin permission, because only the first statement determines the permission check. Run each statement separately.",
+    unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires read-write+ for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
+    permission_denied_reason: "Permission denied: {reason}",
     table_not_found: "Table not found: {table}",
     unsupported_lang: "Language '{lang}' not supported, using English",
     invalid_json: "Invalid JSON: {message}",
@@ -1700,7 +1706,8 @@ Provide options: --env-host, --env-port, --env-user, --env-password, --env-datab
 Or use interactive mode: run "dbcli init --use-env-refs" without --no-interactive`,
     env_var_not_defined: `Cannot test connection: environment variable {envKey} is not defined.
 Set {envKey} in .env or environment variables.
-Hint: run 'export {envKey}=<value>' and retry`
+Hint: run 'export {envKey}=<value>' and retry`,
+    invalid_output_format: "--format {format} is not supported here \u2014 use text or json"
   },
   success: {
     inserted: "Successfully inserted {count} row(s)",
@@ -1711,19 +1718,22 @@ Hint: run 'export {envKey}=<value>' and retry`
   insert: {
     description: "Insert data into a table",
     prompt_data: "Enter JSON data to insert: ",
-    confirm: "Insert {count} row(s) into {table}? (y/n): "
+    confirm: "Insert {count} row(s) into {table}? (y/n): ",
+    elasticsearch_unsupported: "Elasticsearch does not support the insert command; for now, use an external tool (e.g. curl or Kibana DevTools) to write documents"
   },
   update: {
     description: "Update data in a table",
     prompt_where: "Enter WHERE clause (e.g., id=1): ",
     prompt_set: 'Enter JSON updates (e.g., {"status": "active"}): ',
-    confirm: "Update rows in {table}? (y/n): "
+    confirm: "Update rows in {table}? (y/n): ",
+    elasticsearch_unsupported: "Elasticsearch does not support the update command; for now, use an external tool (e.g. curl or Kibana DevTools) to update documents"
   },
   delete: {
     description: "Delete data from a table",
     prompt_where: "Enter WHERE clause (e.g., id=1): ",
     confirm: "Delete rows from {table}? (y/n): ",
-    admin_only: "Delete command requires data-admin or admin permission"
+    admin_only: "Delete command requires data-admin or admin permission",
+    elasticsearch_unsupported: "Elasticsearch does not support the delete command; for now, use an external tool (e.g. curl or Kibana DevTools) to delete documents"
   },
   export: {
     description: "Export query results",
@@ -1798,6 +1808,20 @@ Reference: {referencePath}`,
     add_enum_description: "Create an enum type (PostgreSQL only)",
     alter_enum_description: "Add a value to an enum type",
     drop_enum_description: "Drop an enum type"
+  },
+  password: {
+    description: "Change the password of a single connection, leaving every other setting untouched",
+    arg_connection: "Connection name (defaults to the current default connection)",
+    opt_stdin: "Read the new password from stdin (for rotation scripts)",
+    opt_password: "New password given inline (visible in shell history and process list)",
+    opt_skip_test: "Skip verifying the new password against the database before saving",
+    prompt: "New password for connection '{name}'",
+    source_conflict: "--password and --stdin cannot be used together; pick one source.",
+    needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
+    empty: "The new password is empty; nothing was changed.",
+    updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
+    converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
+    skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
   }
 };
 // resources/lang/zh-TW/messages.json
@@ -1959,6 +1983,12 @@ var messages_default2 = {
     invalid_config: "\u914D\u7F6E\u7121\u6548\uFF1A{field}",
     connection_failed: "\u7121\u6CD5\u9023\u63A5\u5230\u8CC7\u6599\u5EAB\uFF1A{message}",
     permission_denied: "\u6B0A\u9650\u88AB\u62D2\uFF08\u9700\u8981\uFF1A{required}\uFF09",
+    permission_requires_level: "{type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+    elasticsearch_requires_level: "Elasticsearch {type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+    escalated_write_requires_admin: "\u6B64\u8A9E\u53E5\u8868\u9762\u4E0A\u662F\u8B80\u53D6\uFF0C\u4F46\u5BE6\u969B\u5305\u542B\u53EF\u57F7\u884C\u7684 {keyword}\u3002\u8B80\u53D6\u8A9E\u53E5\u4E2D\u96B1\u85CF\u5BEB\u5165\u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09\u3002",
+    multiple_statements_refused: "\u4F4E\u65BC admin \u6B0A\u9650\u6642\u62D2\u7D55\u57F7\u884C\u5305\u542B\u591A\u500B\u8A9E\u53E5\u7684 SQL\uFF0C\u56E0\u70BA\u6B0A\u9650\u6AA2\u67E5\u53EA\u6703\u4F9D\u64DA\u7B2C\u4E00\u500B\u8A9E\u53E5\u5224\u65B7\u3002\u8ACB\u5C07\u5404\u8A9E\u53E5\u5206\u958B\u57F7\u884C\u3002",
+    unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u81F3\u5C11\u9700\u8981 read-write \u4EE5\u4E0A\u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
+    permission_denied_reason: "\u6B0A\u9650\u88AB\u62D2\uFF1A{reason}",
     table_not_found: "\u627E\u4E0D\u5230\u8868\u683C\uFF1A{table}",
     unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
     invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
@@ -1980,7 +2010,8 @@ var messages_default2 = {
 \u6216\u4F7F\u7528\u4E92\u52D5\u6A21\u5F0F\uFF1A\u57F7\u884C "dbcli init --use-env-refs"\uFF08\u4E0D\u52A0 --no-interactive\uFF09`,
     env_var_not_defined: `\u7121\u6CD5\u6E2C\u8A66\u9023\u7DDA\uFF1A\u74B0\u5883\u8B8A\u6578 {envKey} \u672A\u5B9A\u7FA9\u3002
 \u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u6578\u4E2D\u8A2D\u5B9A {envKey}\u3002
-\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`
+\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`,
+    invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json"
   },
   success: {
     inserted: "\u6210\u529F\u63D2\u5165 {count} \u5217",
@@ -1991,19 +2022,22 @@ var messages_default2 = {
   insert: {
     description: "\u63D2\u5165\u8CC7\u6599\u5230\u8868\u683C",
     prompt_data: "\u8F38\u5165\u8981\u63D2\u5165\u7684 JSON \u8CC7\u6599\uFF1A",
-    confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A"
+    confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A",
+    elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 insert \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u5BEB\u5165"
   },
   update: {
     description: "\u66F4\u65B0\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
     prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
     prompt_set: '\u8F38\u5165 JSON \u66F4\u65B0 (\u4F8B\u5982\uFF1A{"status": "active"})\uFF1A',
-    confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A"
+    confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
+    elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 update \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u66F4\u65B0"
   },
   delete: {
     description: "\u522A\u9664\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
     prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
     confirm: "\u522A\u9664 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
-    admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650"
+    admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650",
+    elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 delete \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u522A\u9664"
   },
   export: {
     description: "\u532F\u51FA\u67E5\u8A62\u7D50\u679C",
@@ -2078,6 +2112,20 @@ var messages_default2 = {
     add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
     alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
     drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+  },
+  password: {
+    description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
+    arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
+    opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
+    opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
+    opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
+    prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
+    source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
+    needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
+    empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
+    updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
+    converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
+    skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
   }
 };
 // resources/lang/en/shell.json
@@ -2124,11 +2172,61 @@ var shell_default2 = {
   rows_display: "{count} \u7B46\u8CC7\u6599",
   unknown_command: "\u672A\u77E5\u6307\u4EE4\uFF1A'{command}'\u3002\u8F38\u5165 '.help' \u67E5\u770B\u53EF\u7528\u6307\u4EE4\u3002"
 };
+// resources/lang/en/ceremony.json
+var ceremony_default = {
+  updated: "Updated {count} row(s) in {table}",
+  deleted: "Deleted {count} row(s) from {table}",
+  inserted: "Inserted {count} row(s) into {table}",
+  matched_nothing: "No rows matched in {table} \u2014 nothing changed",
+  cancelled: "Cancelled. {table} was not changed",
+  dry_run: "Preview only. {table} was not changed",
+  elapsed: "Took {seconds}s",
+  failed: "Failed: {reason}",
+  unknown_error: "unknown error",
+  confirm_sql: "Generated SQL:",
+  confirm_command: "Command to run:",
+  confirm_params: "Parameters:",
+  confirm_destructive_warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
+  confirm_destructive_prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone.",
+  confirm_destructive_warning_ddl: "\u26A0\uFE0F  Warning: this schema change is destructive and cannot be undone!",
+  confirm_ddl_prompt: "Are you sure you want to run this {operation}? This cannot be undone.",
+  confirm_prompt: "Proceed with this operation?",
+  recovery_none: "This cannot be undone automatically \u2014 restore from a backup to get the previous values back.",
+  recovery_retry: "Re-run with --recovery to write a recovery plan, then read it with: dbcli recover",
+  blacklist_hint: "Run `dbcli blacklist list` to see what is protected"
+};
+// resources/lang/zh-TW/ceremony.json
+var ceremony_default2 = {
+  updated: "\u5DF2\u66F4\u65B0 {table} \u7684 {count} \u5217",
+  deleted: "\u5DF2\u5F9E {table} \u522A\u9664 {count} \u5217",
+  inserted: "\u5DF2\u5BEB\u5165 {count} \u5217\u5230 {table}",
+  matched_nothing: "{table} \u6C92\u6709\u4EFB\u4F55\u5217\u7B26\u5408\u689D\u4EF6\uFF0C\u8CC7\u6599\u672A\u8B8A\u52D5",
+  cancelled: "\u5DF2\u53D6\u6D88\uFF0C{table} \u672A\u8B8A\u52D5",
+  dry_run: "\u50C5\u9810\u89BD\uFF0C{table} \u672A\u8B8A\u52D5",
+  elapsed: "\u8017\u6642 {seconds} \u79D2",
+  failed: "\u5931\u6557\uFF1A{reason}",
+  unknown_error: "\u672A\u77E5\u7684\u932F\u8AA4",
+  confirm_sql: "\u7522\u751F\u7684 SQL\uFF1A",
+  confirm_command: "\u5373\u5C07\u57F7\u884C\u7684\u6307\u4EE4\uFF1A",
+  confirm_params: "\u53C3\u6578\uFF1A",
+  confirm_destructive_warning: "\u26A0\uFE0F  \u8B66\u544A\uFF1ADELETE \u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+  confirm_destructive_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B DELETE \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+  confirm_destructive_warning_ddl: "\u26A0\uFE0F  \u8B66\u544A\uFF1A\u9019\u500B schema \u8B8A\u66F4\u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+  confirm_ddl_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B {operation} \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+  confirm_prompt: "\u8981\u7E7C\u7E8C\u57F7\u884C\u9019\u500B\u64CD\u4F5C\u55CE\uFF1F",
+  recovery_none: "\u6B64\u64CD\u4F5C\u7121\u6CD5\u81EA\u52D5\u9084\u539F\uFF0C\u8981\u53D6\u56DE\u5148\u524D\u7684\u8CC7\u6599\u8ACB\u5F9E\u5099\u4EFD\u56DE\u5FA9\u3002",
+  recovery_retry: "\u52A0\u4E0A --recovery \u91CD\u8DD1\u53EF\u7522\u751F\u56DE\u5FA9\u8A08\u756B\uFF0C\u518D\u7528 dbcli recover \u8B80\u53D6",
+  blacklist_hint: "\u57F7\u884C `dbcli blacklist list` \u67E5\u770B\u53D7\u4FDD\u8B77\u7684\u9805\u76EE"
+};
 
 // src/i18n/message-loader.ts
 var BUNDLED_MESSAGES = {
-  en: { ...messages_default, shell: shell_default },
-  "zh-TW": { ...messages_default2, shell: shell_default2 }
+  en: { ...messages_default, shell: shell_default, ceremony: ceremony_default },
+  "zh-TW": {
+    ...messages_default2,
+    shell: shell_default2,
+    ceremony: ceremony_default2
+  }
 };
 
 class MessageLoader {
@@ -2191,6 +2289,7 @@ class MessageLoader {
   }
 }
 var messageLoader = MessageLoader.getInstance();
+var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
 // src/utils/colors.ts
@@ -3268,12 +3367,12 @@ function detectMongoType(v) {
 function accumulateDocPaths(doc, prefix, acc) {
   for (const [k, v] of Object.entries(doc)) {
     const path = prefix === "" ? k : `${prefix}.${k}`;
-    const t = detectMongoType(v);
+    const t2 = detectMongoType(v);
     const slot = acc.get(path) ?? { types: new Set, count: 0 };
-    slot.types.add(t);
+    slot.types.add(t2);
     slot.count += 1;
     acc.set(path, slot);
-    if (t === "object" && v && typeof v === "object") {
+    if (t2 === "object" && v && typeof v === "object") {
       accumulateDocPaths(v, path, acc);
     }
   }
@@ -4784,18 +4883,7 @@ function continuesIdentifier(sql, index) {
   return run.replace(/^[0-9]+(?:[eE][0-9]+)?/, "").length > 0;
 }
 
-// src/core/permission-guard.ts
-class PermissionError extends Error {
-  classification;
-  requiredPermission;
-  constructor(message, classification, requiredPermission) {
-    super(message);
-    this.classification = classification;
-    this.requiredPermission = requiredPermission;
-    this.name = "PermissionError";
-    Object.setPrototypeOf(this, PermissionError.prototype);
-  }
-}
+// src/core/permission/sql-analysis.ts
 function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
@@ -5042,6 +5130,19 @@ function determineConfidence(type, _keyword, _sql) {
 function removeParameterMarkers(sql) {
   return sql.replace(/\$\d+/g, "").replace(/\?/g, "");
 }
+
+// src/core/permission-guard.ts
+class PermissionError extends Error {
+  classification;
+  requiredPermission;
+  constructor(message, classification, requiredPermission) {
+    super(message);
+    this.classification = classification;
+    this.requiredPermission = requiredPermission;
+    this.name = "PermissionError";
+    Object.setPrototypeOf(this, PermissionError.prototype);
+  }
+}
 function classifyStatement(sql) {
   const normalized = normalizeSQL(sql);
   const stripped = stripCommentsAndStrings(normalized);
@@ -5108,15 +5209,38 @@ function checkPermission(sql, permission, dialect) {
   if (permission !== "admin" && containsMultipleStatements(sql, dialect)) {
     return {
       allowed: false,
-      reason: "SQL containing multiple statements is refused below admin permission, because only " + "the first statement determines the permission check. Run each statement separately.",
-      classification
+      reason: t("errors.multiple_statements_refused"),
+      classification,
+      requiredPermission: "admin"
     };
   }
+  return checkPermissionForClassification(classification, permission);
+}
+var TIER_GRANTS = [
+  { permission: "query-only", types: ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN"] },
+  { permission: "read-write", types: ["INSERT", "UPDATE"] },
+  { permission: "data-admin", types: ["DELETE"] }
+];
+function minimumPermissionFor(type) {
+  return TIER_GRANTS.find((tier) => tier.types.includes(type))?.permission ?? "admin";
+}
+function refusalReason(type, permission) {
+  return t_vars("errors.permission_requires_level", {
+    type,
+    minimum: minimumPermissionFor(type),
+    permission
+  });
+}
+function checkPermissionForClassification(classification, permission) {
   if (permission !== "admin" && classification.escalatedFrom) {
     return {
       allowed: false,
-      reason: `This statement opens as a read but contains an executable ` + `${classification.escalatedFrom}. A write hidden inside a read statement ` + `requires admin permission (current level: ${permission}).`,
-      classification
+      reason: t_vars("errors.escalated_write_requires_admin", {
+        keyword: classification.escalatedFrom,
+        permission
+      }),
+      classification,
+      requiredPermission: "admin"
     };
   }
   if (permission === "admin") {
@@ -5126,62 +5250,51 @@ function checkPermission(sql, permission, dialect) {
       classification
     };
   }
-  if (permission === "data-admin") {
-    const allowedTypes = ["SELECT", "INSERT", "UPDATE", "DELETE", "SHOW", "DESCRIBE", "EXPLAIN"];
-    if (allowedTypes.includes(classification.type)) {
-      return {
-        allowed: true,
-        reason: `${classification.type} operation allowed in data-admin mode`,
-        classification
-      };
-    }
-    return {
-      allowed: false,
-      reason: `${classification.type} operation requires admin permission`,
-      classification
-    };
-  }
-  if (permission === "read-write") {
-    const allowedTypes = ["SELECT", "INSERT", "UPDATE", "SHOW", "DESCRIBE", "EXPLAIN"];
-    if (allowedTypes.includes(classification.type)) {
-      return {
-        allowed: true,
-        reason: `${classification.type} operation allowed in read-write mode`,
-        classification
-      };
-    }
-    return {
-      allowed: false,
-      reason: `${classification.type} operation requires data-admin or admin permission`,
-      classification
-    };
-  }
-  if (permission === "query-only") {
-    const allowedTypes = ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN"];
+  const tierIndex = TIER_GRANTS.findIndex((tier) => tier.permission === permission);
+  if (tierIndex !== -1) {
+    const allowedTypes = TIER_GRANTS.slice(0, tierIndex + 1).flatMap((tier) => tier.types);
     if (allowedTypes.includes(classification.type)) {
       return {
         allowed: true,
-        reason: `${classification.type} operation allowed in query-only mode`,
+        reason: `${classification.type} operation allowed in ${permission} mode`,
         classification
       };
     }
-    const isUnknown = classification.type === "UNKNOWN";
+    const isUnknown = permission === "query-only" && classification.type === "UNKNOWN";
     return {
       allowed: false,
-      reason: isUnknown ? `Unrecognised SQL statement (current level: query-only). Security policy requires read-write+ for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.` : `${classification.type} operation requires read-write or admin permission`,
-      classification
+      reason: isUnknown ? t("errors.unknown_statement_query_only") : refusalReason(classification.type, permission),
+      classification,
+      requiredPermission: isUnknown ? "read-write" : minimumPermissionFor(classification.type)
     };
   }
   return {
     allowed: false,
     reason: `Unknown permission level: ${permission}`,
-    classification
+    classification,
+    requiredPermission: "admin"
+  };
+}
+function classificationForType(type) {
+  return {
+    type,
+    isDangerous: isDestructiveOperation(type),
+    keywords: [type],
+    isComposite: false,
+    confidence: "HIGH"
   };
 }
+function enforcePermissionForType(type, permission) {
+  const classification = classificationForType(type);
+  const result = checkPermissionForClassification(classification, permission);
+  if (!result.allowed) {
+    throw new PermissionError(result.reason, classification, minimumPermissionFor(type));
+  }
+}
 function enforcePermission(sql, permission, dialect) {
   const result = checkPermission(sql, permission, dialect);
   if (!result.allowed) {
-    throw new PermissionError(result.reason, result.classification, permission);
+    throw new PermissionError(result.reason, result.classification, result.requiredPermission ?? "admin");
   }
   return result.classification;
 }
@@ -5285,7 +5398,7 @@ function extractTableNameFromError(errorMessage) {
 async function getAllTablesFromAdapter(adapter) {
   try {
     const tables = await adapter.listTables();
-    return tables.map((t) => t.name);
+    return tables.map((t2) => t2.name);
   } catch (error) {
     console.warn("Failed to list tables for suggestions:", error);
     return [];
@@ -5937,100 +6050,6 @@ function inferColumnType(value) {
   }
   return "unknown";
 }
-// src/utils/prompts.ts
-var promptsUnavailableReported = false;
-async function loadInquirer() {
-  try {
-    return await import("@inquirer/prompts");
-  } catch (error) {
-    if (!promptsUnavailableReported) {
-      promptsUnavailableReported = true;
-      const reason = error instanceof Error ? error.message : String(error);
-      process.stderr.write(`[dbcli] rich interactive prompts are unavailable (${reason}); falling back to plain-text input
-`);
-    }
-    return;
-  }
-}
-async function readLineFromStdin(prompt = "") {
-  return new Promise((resolve) => {
-    if (prompt) {
-      process.stdout.write(prompt);
-    }
-    let data = "";
-    const chunks = [];
-    const onData = (chunk) => {
-      chunks.push(chunk);
-      data = Buffer.concat(chunks).toString();
-      const lines = data.split(`
-`);
-      if (lines.length > 1) {
-        process.stdin.pause();
-        process.stdin.removeListener("data", onData);
-        process.stdin.removeListener("end", onEnd);
-        resolve((lines[0] ?? "").trim());
-      }
-    };
-    const onEnd = () => {
-      process.stdin.removeListener("data", onData);
-      resolve(data.trim());
-    };
-    process.stdin.on("data", onData);
-    process.stdin.on("end", onEnd);
-    process.stdin.resume();
-  });
-}
-async function textFallback(message, defaultValue) {
-  const displayMessage = defaultValue ? `${message} [${defaultValue}]: ` : `${message}: `;
-  const answer = await readLineFromStdin(displayMessage);
-  return answer.trim() || defaultValue || "";
-}
-async function selectFallback(message, choices) {
-  console.log(message);
-  choices.forEach((choice, index) => {
-    console.log(`  ${index + 1}) ${choice}`);
-  });
-  const answer = await readLineFromStdin("Select option (number): ");
-  const selectedIndex = parseInt(answer, 10) - 1;
-  if (selectedIndex >= 0 && selectedIndex < choices.length) {
-    return choices[selectedIndex] ?? choices[0] ?? "";
-  }
-  return choices[0] ?? "";
-}
-async function confirmFallback(message) {
-  const answer = await readLineFromStdin(`${message} (y/n): `);
-  return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
-}
-async function text(message, defaultValue) {
-  if (!process.stdin.isTTY)
-    return textFallback(message, defaultValue);
-  const inquirer = await loadInquirer();
-  if (!inquirer)
-    return textFallback(message, defaultValue);
-  return await inquirer.input({ message, default: defaultValue });
-}
-async function select(message, choices) {
-  if (!process.stdin.isTTY)
-    return await selectFallback(message, choices);
-  const inquirer = await loadInquirer();
-  if (!inquirer)
-    return await selectFallback(message, choices);
-  return await inquirer.select({ message, choices });
-}
-async function confirm(message) {
-  if (!process.stdin.isTTY)
-    return await confirmFallback(message);
-  const inquirer = await loadInquirer();
-  if (!inquirer)
-    return await confirmFallback(message);
-  return await inquirer.confirm({ message });
-}
-var promptUser = {
-  text,
-  select,
-  confirm
-};
-
 // src/types/blacklist.ts
 class BlacklistError extends Error {
   tableName;
@@ -6078,8 +6097,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("INSERT", tableName);
-      enforcePermission("INSERT INTO dummy", this.permission);
-      return await this.executeMutation("insert", this.buildInsertSql(tableName, data, schema), timestamp, options, { prompt: "Proceed with this operation?" });
+      enforcePermissionForType("INSERT", this.permission);
+      return await this.executeMutation("insert", this.buildInsertSql(tableName, data, schema), timestamp, options, { destructive: false });
     } catch (error) {
       return this.handleMutationError("insert", timestamp, error);
     }
@@ -6088,8 +6107,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("UPDATE", tableName);
-      enforcePermission("UPDATE dummy", this.permission);
-      return await this.executeMutation("update", this.buildUpdateSql(tableName, data, where, schema), timestamp, options, { prompt: "Proceed with this operation?" });
+      enforcePermissionForType("UPDATE", this.permission);
+      return await this.executeMutation("update", this.buildUpdateSql(tableName, data, where, schema), timestamp, options, { destructive: false });
     } catch (error) {
       return this.handleMutationError("update", timestamp, error);
     }
@@ -6098,19 +6117,8 @@ class DataExecutor {
     const timestamp = new Date().toISOString();
     try {
       this.checkBlacklist("DELETE", tableName);
-      if (this.permission !== "data-admin" && this.permission !== "admin") {
-        return {
-          status: "error",
-          operation: "delete",
-          rows_affected: 0,
-          timestamp,
-          error: "Permission denied: DELETE operation requires Data-Admin or Admin permission."
-        };
-      }
-      return await this.executeMutation("delete", this.buildDeleteSql(tableName, where, schema), timestamp, options, {
-        warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
-        prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone."
-      });
+      enforcePermissionForType("DELETE", this.permission);
+      return await this.executeMutation("delete", this.buildDeleteSql(tableName, where, schema), timestamp, options, { destructive: true });
     } catch (error) {
       return this.handleMutationError("delete", timestamp, error);
     }
@@ -6124,31 +6132,31 @@ class DataExecutor {
   checkBlacklist(operation, tableName) {
     this.blacklistValidator?.checkTableBlacklist(operation, tableName, []);
   }
-  async executeMutation(operation, statement, timestamp, options, confirmation) {
+  async executeMutation(operation, statement, timestamp, options, { destructive }) {
     if (options?.dryRun) {
-      return this.successResult(operation, 0, timestamp, statement.sql);
+      return this.outcomeResult("dry_run", operation, 0, timestamp, statement.sql);
     }
     if (!options?.force) {
-      if (confirmation.warning) {
-        console.log(`
-${confirmation.warning}`);
+      if (!options?.confirm) {
+        throw new Error(`Refusing to ${operation} without confirmation: no confirmation handler was supplied. ` + "Pass options.confirm to ask the user, or options.force to proceed unattended.");
       }
-      console.log(`
-Generated SQL:`);
-      console.log(`  ${statement.sql}`);
-      console.log(`
-Parameters:`);
-      console.log(`  ${JSON.stringify(statement.params, null, 2)}`);
-      if (!await promptUser.confirm(confirmation.prompt)) {
-        return this.successResult(operation, 0, timestamp, statement.sql);
+      const proceed = await options.confirm({
+        operation,
+        engine: "sql",
+        sql: statement.sql,
+        params: statement.params,
+        destructive
+      });
+      if (!proceed) {
+        return this.outcomeResult("cancelled", operation, 0, timestamp, statement.sql);
       }
     }
     const result = await this.adapter.execute(statement.sql, statement.params);
-    return this.successResult(operation, result.affectedRows, timestamp, statement.sql);
+    return this.outcomeResult("success", operation, result.affectedRows, timestamp, statement.sql);
   }
-  successResult(operation, rowsAffected, timestamp, sql) {
+  outcomeResult(status, operation, rowsAffected, timestamp, sql) {
     return {
-      status: "success",
+      status,
       operation,
       rows_affected: rowsAffected,
       timestamp,
@@ -6159,13 +6167,13 @@ Parameters:`);
     if (error instanceof BlacklistError) {
       throw error;
     }
-    if (error instanceof PermissionError && operation !== "delete") {
+    if (error instanceof PermissionError) {
       return {
         status: "error",
         operation,
         rows_affected: 0,
         timestamp,
-        error: `Permission denied: Query-only mode only allows SELECT. Use Read-Write or Admin mode to execute ${operation.toUpperCase()}.`
+        error: t_vars("errors.permission_denied_reason", { reason: error.message })
       };
     }
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -6427,8 +6435,8 @@ var ZodParsedType = util.arrayToEnum([
   "set"
 ]);
 var getParsedType = (data) => {
-  const t = typeof data;
-  switch (t) {
+  const t2 = typeof data;
+  switch (t2) {
     case "undefined":
       return ZodParsedType.undefined;
     case "string":
@@ -10755,43 +10763,11 @@ function listConnections(config) {
   });
 }
 // src/core/config-v2-mutations.ts
-import { join as join8 } from "path";
 var SQL_SYSTEMS = ["postgresql", "mysql", "mariadb"];
 function envVarNameFor(connName, field) {
   const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return `DBCLI_${slug}_${field.toUpperCase()}`;
 }
-async function writeConnectionSecret(projectPath, connName, field, value) {
-  assertConfigMutationApproved();
-  if (value.includes(`
-`) || value.includes("\r")) {
-    throw new Error("secret value \u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
-  }
-  const config = await readV2Config(projectPath);
-  const conn = config.connections[connName];
-  if (!conn)
-    throw new Error(`\u9023\u7DDA '${connName}' \u4E0D\u5B58\u5728`);
-  const storagePath = await resolveConfigStoragePath(projectPath);
-  const envFile = conn.envFile ?? `.env.${connName}`;
-  const envPath = join8(storagePath, envFile);
-  const varName = envVarNameFor(connName, field);
-  let content = "";
-  const file = Bun.file(envPath);
-  if (await file.exists())
-    content = await file.text();
-  const line = `${varName}=${value}`;
-  const re = new RegExp(`^${varName}=.*$`, "m");
-  if (re.test(content)) {
-    content = content.replace(re, line);
-  } else {
-    content = content.length && !content.endsWith(`
-`) ? `${content}
-${line}
-` : `${content}${line}
-`;
-  }
-  await Bun.write(envPath, content);
-}
 function removeConnection(config, name) {
   if (!(name in config.connections))
     throw new Error(`\u9023\u7DDA '${name}' \u4E0D\u5B58\u5728`);
@@ -10853,6 +10829,135 @@ function upsertConnection(config, input) {
     connections: { ...config.connections, [input.name]: connection }
   };
 }
+// src/core/connection-credential.ts
+import { join as join8 } from "path";
+
+// src/core/env-file-writer.ts
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname as dirname2 } from "path";
+var SECRET_FILE_MODE = 384;
+function escapeForRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function upsertEnvVar(envPath, varName, value) {
+  let content = "";
+  try {
+    content = await readFile2(envPath, "utf8");
+  } catch (cause) {
+    const code = cause.code;
+    if (code !== "ENOENT")
+      throw cause;
+    await mkdir3(dirname2(envPath), { recursive: true });
+  }
+  const line = `${varName}="${value}"`;
+  const existing = new RegExp(`^${escapeForRegExp(varName)}=.*$`, "m");
+  if (existing.test(content)) {
+    content = content.replace(existing, () => line);
+  } else {
+    content = content.length && !content.endsWith(`
+`) ? `${content}
+${line}
+` : `${content}${line}
+`;
+  }
+  await writeFile(envPath, content, { mode: SECRET_FILE_MODE });
+  await chmod2(envPath, SECRET_FILE_MODE);
+}
+
+// src/core/connection-credential.ts
+var DEFAULT_ENV_FILE = ".env.local";
+var V1_VAR_NAME = "DBCLI_PASSWORD";
+var V1_CONNECTION_NAME = "default";
+async function readRawConfig(storagePath) {
+  const configPath = join8(storagePath, "config.json");
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    throw new ConfigError(`\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94\uFF1A${configPath}`);
+  }
+  return JSON.parse(await file.text());
+}
+function envRefName(value) {
+  if (typeof value === "object" && value !== null && "$env" in value) {
+    return String(value.$env);
+  }
+  return;
+}
+async function resolvePasswordTarget(projectPath, connectionName) {
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  if (detectConfigVersion(raw) !== 2) {
+    if (connectionName && connectionName !== V1_CONNECTION_NAME) {
+      throw new ConfigError(`\u9019\u662F v1 \u8A2D\u5B9A\uFF0C\u53EA\u6709\u4E00\u689D\u9023\u7DDA\uFF0C\u7121\u6CD5\u6307\u5B9A\u9023\u7DDA\u540D\u7A31 '${connectionName}'\u3002` + `\u9700\u8981\u591A\u9023\u7DDA\u8ACB\u5148\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2\u3002`);
+    }
+    const connection2 = raw.connection ?? {};
+    const customRef = envRefName(connection2.password);
+    if (customRef !== undefined && customRef !== V1_VAR_NAME) {
+      throw new ConfigError(`\u9019\u500B v1 \u8A2D\u5B9A\u7684\u5BC6\u78BC\u4F86\u81EA\u74B0\u5883\u8B8A\u6578 '${customRef}'\uFF0Cdbcli \u7121\u6CD5\u4EE3\u70BA\u8F2A\u66FF\u3002` + `\u8ACB\u76F4\u63A5\u66F4\u65B0\u8A72\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2 \u5F8C\u518D\u8F2A\u66FF\u3002`);
+    }
+    return {
+      connection: V1_CONNECTION_NAME,
+      envFile: DEFAULT_ENV_FILE,
+      varName: V1_VAR_NAME,
+      convertedToEnvRef: false
+    };
+  }
+  const config = await readV2Config(projectPath);
+  const targetName = connectionName ?? config.default;
+  const connection = config.connections[targetName];
+  if (!connection) {
+    throw new ConfigError(connectionNotFoundMessage(targetName, Object.keys(config.connections)));
+  }
+  const referencedVar = envRefName(connection.password);
+  return {
+    connection: targetName,
+    envFile: connection.envFile ?? DEFAULT_ENV_FILE,
+    varName: referencedVar ?? envVarNameFor(targetName, "password"),
+    convertedToEnvRef: referencedVar === undefined
+  };
+}
+function assertSingleLine(value) {
+  if (value.includes(`
+`) || value.includes("\r")) {
+    throw new ConfigError("\u5BC6\u78BC\u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
+  }
+}
+async function stripV1LiteralPassword(storagePath, raw) {
+  const connection = raw.connection ?? {};
+  if (typeof connection.password !== "string")
+    return;
+  const stripped = { ...raw, connection: { ...connection } };
+  delete stripped.connection.password;
+  await writeConfigWithIntegrity(storagePath, JSON.stringify(stripped, null, 2));
+}
+async function setConnectionPassword(projectPath, connectionName, password) {
+  assertConfigMutationApproved();
+  assertSingleLine(password);
+  const target = await resolvePasswordTarget(projectPath, connectionName);
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  await upsertEnvVar(join8(storagePath, target.envFile), target.varName, password);
+  if (detectConfigVersion(raw) !== 2) {
+    await stripV1LiteralPassword(storagePath, raw);
+    return target;
+  }
+  const config = await readV2Config(projectPath);
+  const connection = config.connections[target.connection];
+  const needsEnvFile = connection.envFile === undefined;
+  if (target.convertedToEnvRef || needsEnvFile) {
+    await writeV2Config(projectPath, {
+      ...config,
+      connections: {
+        ...config.connections,
+        [target.connection]: {
+          ...connection,
+          envFile: target.envFile,
+          ...target.convertedToEnvRef && { password: { $env: target.varName } }
+        }
+      }
+    });
+  }
+  return target;
+}
 // src/utils/config-error-format.ts
 var SUPPORTED_SYSTEMS = [
   "postgresql",
@@ -10938,7 +11043,7 @@ function isZodError(error) {
 
 // src/core/config.ts
 import { join as join9 } from "path";
-import { mkdir as mkdir3 } from "fs/promises";
+import { mkdir as mkdir4 } from "fs/promises";
 // src/agent-core/env-ref.ts
 function resolveEnvRef(value, fieldName, env = process.env) {
   if (typeof value === "string")
@@ -11008,7 +11113,11 @@ function resolveEnvReferences(config, env, parentKey) {
 }
 function parseEnvPassword(content) {
   const match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
-  return match?.[1] != null ? match[1].trim() : null;
+  if (match?.[1] == null)
+    return null;
+  const raw = match[1].trim();
+  const quoted = raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'");
+  return quoted && raw.length >= 2 ? raw.slice(1, -1) : raw;
 }
 var configModule = {
   async read(path, connectionName, options = {}) {
@@ -11187,7 +11296,7 @@ ${formatConfigValidationError(error, raw)}`);
         isDirectory = false;
       }
       if (isDirectory || path.endsWith(".dbcli") || path === storagePath && isDirectory) {
-        await mkdir3(storagePath, { recursive: true });
+        await mkdir4(storagePath, { recursive: true });
         const hasEnvReferences = isEnvReference(config.connection.password);
         if (hasEnvReferences) {
           const configJson = JSON.stringify(config, null, 2);
@@ -11543,9 +11652,10 @@ var readConfig = (path, connectionName) => configModule.read(path, connectionNam
 export {
   writeV2Config,
   writeProjectBinding,
-  writeConnectionSecret,
   upsertConnection,
   setDefaultConnection,
+  setConnectionPassword,
+  resolvePasswordTarget,
   resolveConnection,
   resolveConfigStoragePath,
   removeConnection,