@carllee1983/dbcli 11.0.0 → 12.1.0

package/dist/core.d.ts

@@ -2,290 +2,6 @@
 
 import { z } from 'zod';
 
-/**
- * Database adapter type definitions and interfaces
- * Defines the contract that all database adapters must implement
- */
-export type DatabaseSystem = "postgresql" | "mysql" | "mariadb" | "sqlite" | "mongodb" | "redis" | "elasticsearch";
-type SqlDatabaseSystem = Extract<DatabaseSystem, "postgresql" | "mysql" | "mariadb" | "sqlite">;
-type SqlExecutionMode = "normal" | "native-read-only";
-type QueryableDatabaseSystem = Exclude<DatabaseSystem, SqlDatabaseSystem>;
-/**
- * Connection configuration for database adapters
- */
-export interface ConnectionOptions {
-	/** Database system type */
-	system: DatabaseSystem;
-	/** Database host address or hostname */
-	host: string;
-	/** Database port number */
-	port: number;
-	/** Database user name */
-	user: string;
-	/** Database password */
-	password: string;
-	/** Database name */
-	database: string;
-	/** SQLite database file path (required for SQLite connections, absent otherwise) */
-	file?: string;
-	/** MongoDB connection URI (optional, for MongoDB connections) */
-	uri?: string;
-	/** MongoDB auth database — used when building URI from host/port/user/password (default: 'admin') */
-	authSource?: string;
-	/** MongoDB replica set name (optional, field-based config) */
-	replicaSet?: string;
-	/** MongoDB TLS switch (optional, field-based config; implied true when srv) */
-	tls?: boolean;
-	/** MongoDB extra driver options appended to the URI query string (field-based config, plain strings only) */
-	options?: Record<string, string>;
-	/** MongoDB SRV lookup — build a mongodb+srv:// URI from host (optional, field-based config) */
-	srv?: boolean;
-	/** Connection timeout in milliseconds (default: 5000) */
-	timeout?: number;
-	/**
-	 * Statement timeout in milliseconds. Falls back to `timeout` when unset, and
-	 * to the server default when neither is given — an unset statement timeout
-	 * means the server decides, not that 5000ms applies. 0 removes the limit.
-	 */
-	statementTimeout?: number;
-	/** Elasticsearch protocol (http or https) */
-	protocol?: "http" | "https";
-	/** Elasticsearch nodes for round-robin (optional) */
-	nodes?: string[];
-	/** Elasticsearch Cloud ID (optional) */
-	cloudId?: string;
-	/** Elasticsearch API Key (optional) */
-	apiKey?: string;
-	/** Elasticsearch CA Certificate Path (optional) */
-	caPath?: string;
-	/** Whether to reject unauthorized TLS connections (default: true) */
-	rejectUnauthorized?: boolean;
-}
-export type SqlConnectionOptions = ConnectionOptions & {
-	system: SqlDatabaseSystem;
-};
-export type QueryableConnectionOptions = ConnectionOptions & {
-	system: QueryableDatabaseSystem;
-};
-/**
- * Schema information for a single column
- */
-export interface ColumnSchema {
-	/** Column name */
-	name: string;
-	/** Column data type */
-	type: string;
-	/** Whether column allows NULL values */
-	nullable: boolean;
-	/** Default value for column (if any) */
-	default?: string;
-	/** Whether column is primary key */
-	primaryKey?: boolean;
-	/** Foreign key reference if applicable */
-	foreignKey?: {
-		table: string;
-		column: string;
-	};
-	/** Whether column is auto-incremented */
-	autoIncrement?: boolean;
-	/** Column comment/description */
-	comment?: string | null;
-	/** Enum values if column is ENUM type */
-	enumValues?: string[];
-	/** MongoDB only: 0..1 fraction of sampled docs that contained this dot-path. Undefined for SQL. */
-	presence?: number;
-	/** MongoDB only: true when this dot-path matches a blacklist pattern. Undefined for SQL. */
-	redacted?: boolean;
-}
-/**
- * Complete schema information for a table
- */
-export interface TableSchema {
-	/** Table name */
-	name: string;
-	/** Exact database schema/catalog namespace, when reliably available */
-	schema?: string;
-	/** Array of columns in the table */
-	columns: ColumnSchema[];
-	/** Approximate row count (if available) */
-	rowCount?: number;
-	/** Storage engine (PostgreSQL/MySQL) */
-	engine?: string;
-	/** Primary key column names */
-	primaryKey?: string[];
-	/** Foreign key constraints with metadata */
-	foreignKeys?: Array<{
-		name: string;
-		columns: string[];
-		refSchema?: string;
-		refTable: string;
-		refColumns: string[];
-	}>;
-	/** Table indexes with column information */
-	indexes?: Array<{
-		name: string;
-		columns: string[];
-		unique: boolean;
-	}>;
-	/** Column count (used by listTables when full column details are not loaded) */
-	columnCount?: number;
-	/** Estimated row count in table */
-	estimatedRowCount?: number;
-	/** Type of table (table or view) */
-	tableType?: "table" | "view";
-}
-type ConnectionErrorCode = "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "ENOTFOUND" | "EHOSTUNREACH" | "CONNECTION_LOST" | "TOO_MANY_CONNECTIONS" | "TLS_ERROR" | "SERVER_NOT_READY" | "CONNECTION_REJECTED" | "SQL_SYNTAX_ERROR" | "STATEMENT_TIMEOUT" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "QUERY_ONLY_BOUNDARY_FAILED" | "UNKNOWN";
-export declare class ConnectionError extends Error {
-	/** Error category code */
-	code: ConnectionErrorCode;
-	/** Array of actionable troubleshooting hints */
-	hints: string[];
-	/**
-	 * The ceiling that was in force, in milliseconds. Set on STATEMENT_TIMEOUT so
-	 * consumers can state it without parsing `message`; the recovery envelope needs
-	 * it to tell an agent what `--statement-timeout <ms>` it was already up against.
-	 */
-	limitMs?: number | undefined;
-	/** Whether an interactive caller may safely retry the statement after reconnecting. */
-	readonly retrySafe: boolean;
-	constructor(
-	/** Error category code */
-	code: ConnectionErrorCode, 
-	/** User-friendly error message */
-	message: string, 
-	/** Array of actionable troubleshooting hints */
-	hints: string[], 
-	/**
-	 * The ceiling that was in force, in milliseconds. Set on STATEMENT_TIMEOUT so
-	 * consumers can state it without parsing `message`; the recovery envelope needs
-	 * it to tell an agent what `--statement-timeout <ms>` it was already up against.
-	 */
-	limitMs?: number | undefined, 
-	/** Whether an interactive caller may safely retry the statement after reconnecting. */
-	retrySafe?: boolean);
-}
-/**
- * Result of a database query or command execution
- */
-export interface ExecutionResult<T> {
-	/** Array of result rows as objects (for SELECT queries) */
-	rows: T[];
-	/** Number of rows affected by the operation (for INSERT/UPDATE/DELETE) */
-	affectedRows: number;
-	/** Last inserted ID if applicable (for INSERT operations) */
-	lastInsertId?: number | string;
-	/** Convenience row count — used by formatters; mirrors rows.length on read paths */
-	rowCount?: number;
-	/** Column ordering for the rows, used by formatters that render tabular output */
-	columnNames?: string[];
-	/** Optional warnings — emitted today only by RedisAdapter (size guard / blacklist filter). */
-	warnings?: RedisWarning[];
-}
-type RedisWarning = {
-	code: "REDIS_SIZE_REWRITE";
-	command: string;
-	original: string[];
-	rewritten: string[];
-} | {
-	code: "REDIS_SIZE_TRUNCATE";
-	command: string;
-	kept: number;
-	droppedAtLeast: number;
-} | {
-	code: "REDIS_BLACKLIST_FILTERED";
-	count: number;
-};
-interface TableSchemaOptions {
-	/** MongoDB: 取樣文件數 */
-	sampleSize?: number;
-	/** MongoDB: 取樣方式 */
-	sampleMethod?: "random" | "natural";
-	/**
-	 * 精確列數要掃全表。掃描整個資料庫時設為 false，改用引擎的估計值——
-	 * 一百張表的資料庫做不起一百次全表 COUNT。預設 true。
-	 */
-	exactRowCount?: boolean;
-}
-/**
- * Database adapter interface - contract for all database implementations
- * Defines methods that all database adapters must implement
- */
-export interface DatabaseAdapter {
-	/**
-	 * Establish connection and verify credentials
-	 * Throws ConnectionError with categorized error type on failure
-	 * @throws {ConnectionError} If connection fails (server down, auth failed, timeout, etc.)
-	 */
-	connect(): Promise<void>;
-	/**
-	 * Close connection and release resources
-	 * Should never throw; safe to call multiple times
-	 * Handles cleanup gracefully even if already disconnected
-	 */
-	disconnect(): Promise<void>;
-	/**
-	 * Execute arbitrary SQL query with parameterized values
-	 * Prevents SQL injection by using parameter binding
-	 * @param sql Query string with parameter placeholders ($1, $2, etc. for PostgreSQL or ? for MySQL)
-	 * @param params Array of parameter values in order
-	 * @returns Execution result containing rows and metadata
-	 * @throws {ConnectionError} If query execution fails
-	 */
-	execute<T>(sql: string, params?: (string | number | boolean | null)[], options?: {
-		noLimit?: boolean;
-		sqlMode?: SqlExecutionMode;
-	}): Promise<ExecutionResult<T>>;
-	/**
-	 * List all tables in the connected database
-	 * Includes metadata such as row count and storage engine
-	 * @returns Array of table schemas with basic information
-	 * @throws {ConnectionError} If query fails
-	 */
-	listTables(): Promise<TableSchema[]>;
-	/**
-	 * Fetch complete schema for a single table
-	 * Includes all columns with types and constraints
-	 * @param tableName Name of table to inspect
-	 * @param options Optional adapter-specific knobs (e.g. mongo `sampleSize`); SQL adapters ignore them.
-	 * @returns Complete table schema including all column details
-	 * @throws {ConnectionError} If query fails
-	 */
-	getTableSchema(tableName: string, options?: TableSchemaOptions): Promise<TableSchema>;
-	/**
-	 * Test connection with lightweight probe query
-	 * Executes SELECT 1 or equivalent to verify connection is alive
-	 * @returns true if connection successful
-	 * @throws {ConnectionError} If connection test fails
-	 */
-	testConnection(): Promise<boolean>;
-	/**
-	 * Get the database server version string
-	 * @returns Raw version string from the server (e.g. "8.0.35", "15.4", "10.11.6-MariaDB")
-	 * @throws {ConnectionError} If not connected or query fails
-	 */
-	getServerVersion(): Promise<string>;
-}
-type SideEffectTier = "readonly" | "dry-run" | "local-write" | "db-write" | "interactive" | "none";
-interface BlacklistConfig {
-	/** Table names to block all operations on */
-	tables: string[];
-	/** Column names to omit per table: { tableName: [col1, col2] } */
-	columns: Record<string, string[]>;
-}
-interface BlacklistState {
-	/** Set of lowercase table names for O(1) case-insensitive lookup */
-	tables: Set<string>;
-	/** Map of table name -> Set of blacklisted column names */
-	columns: Map<string, Set<string>>;
-}
-/**
- * Error thrown when an operation is blocked by blacklist rules
- */
-export declare class BlacklistError extends Error {
-	readonly tableName: string;
-	readonly operation: string;
-	constructor(message: string, tableName: string, operation: string);
-}
 /**
  * Type definitions for data modification operations
  * Defines results and options for data modification (INSERT, UPDATE, DELETE) operations
@@ -375,7 +91,32 @@ export interface MutationConfirmationRequest {
  * Returns true to proceed, false to abandon the mutation.
  */
 export type MutationConfirmer = (request: MutationConfirmationRequest) => Promise<boolean>;
+interface BlacklistConfig {
+	/** Table names to block all operations on */
+	tables: string[];
+	/** Column names to omit per table: { tableName: [col1, col2] } */
+	columns: Record<string, string[]>;
+}
+interface BlacklistState {
+	/** Set of lowercase table names for O(1) case-insensitive lookup */
+	tables: Set<string>;
+	/** Map of table name -> Set of blacklisted column names */
+	columns: Map<string, Set<string>>;
+}
+/**
+ * Error thrown when an operation is blocked by blacklist rules
+ */
+export declare class BlacklistError extends Error {
+	readonly tableName: string;
+	readonly operation: string;
+	constructor(message: string, tableName: string, operation: string);
+}
+interface SqlTlsConfig {
+	mode: "verify-full";
+	caPath: string;
+}
 interface SqlConnectionConfig {
+	sqlTls?: SqlTlsConfig;
 	system: "postgresql" | "mysql" | "mariadb";
 	host: string | {
 		$env: string;
@@ -494,22 +235,296 @@ interface ElasticsearchConnectionConfig {
 	caPath?: string;
 	rejectUnauthorized?: boolean;
 }
-type ConnectionConfig = SqlConnectionConfig | SqliteConnectionConfig | MongoDBConnectionConfig | RedisConnectionConfig | ElasticsearchConnectionConfig;
+type ConnectionConfig = SqlConnectionConfig | SqliteConnectionConfig | MongoDBConnectionConfig | RedisConnectionConfig | ElasticsearchConnectionConfig;
+/**
+ * Permission level (coarse-grained access control)
+ */
+export type Permission = "query-only" | "read-write" | "data-admin" | "admin";
+interface Metadata {
+	createdAt?: string;
+	version: string;
+}
+interface DbcliConfig {
+	connection: ConnectionConfig;
+	permission: Permission;
+	schema?: Record<string, unknown>;
+	metadata?: Metadata;
+	blacklist?: BlacklistConfig;
+}
+/**
+ * Database adapter type definitions and interfaces
+ * Defines the contract that all database adapters must implement
+ */
+export type DatabaseSystem = "postgresql" | "mysql" | "mariadb" | "sqlite" | "mongodb" | "redis" | "elasticsearch";
+type SqlDatabaseSystem = Extract<DatabaseSystem, "postgresql" | "mysql" | "mariadb" | "sqlite">;
+type SqlExecutionMode = "normal" | "native-read-only";
+type QueryableDatabaseSystem = Exclude<DatabaseSystem, SqlDatabaseSystem>;
+/**
+ * Connection configuration for database adapters
+ */
+export interface ConnectionOptions {
+	/** Explicit verified SQL TLS; currently PostgreSQL only. */
+	sqlTls?: SqlTlsConfig;
+	/** Database system type */
+	system: DatabaseSystem;
+	/** Database host address or hostname */
+	host: string;
+	/** Database port number */
+	port: number;
+	/** Database user name */
+	user: string;
+	/** Database password */
+	password: string;
+	/** Database name */
+	database: string;
+	/** SQLite database file path (required for SQLite connections, absent otherwise) */
+	file?: string;
+	/** MongoDB connection URI (optional, for MongoDB connections) */
+	uri?: string;
+	/** MongoDB auth database — used when building URI from host/port/user/password (default: 'admin') */
+	authSource?: string;
+	/** MongoDB replica set name (optional, field-based config) */
+	replicaSet?: string;
+	/** MongoDB TLS switch (optional, field-based config; implied true when srv) */
+	tls?: boolean;
+	/** MongoDB extra driver options appended to the URI query string (field-based config, plain strings only) */
+	options?: Record<string, string>;
+	/** MongoDB SRV lookup — build a mongodb+srv:// URI from host (optional, field-based config) */
+	srv?: boolean;
+	/** Connection timeout in milliseconds (default: 5000) */
+	timeout?: number;
+	/**
+	 * Statement timeout in milliseconds. Falls back to `timeout` when unset, and
+	 * to the server default when neither is given — an unset statement timeout
+	 * means the server decides, not that 5000ms applies. 0 removes the limit.
+	 */
+	statementTimeout?: number;
+	/** Elasticsearch protocol (http or https) */
+	protocol?: "http" | "https";
+	/** Elasticsearch nodes for round-robin (optional) */
+	nodes?: string[];
+	/** Elasticsearch Cloud ID (optional) */
+	cloudId?: string;
+	/** Elasticsearch API Key (optional) */
+	apiKey?: string;
+	/** Elasticsearch CA Certificate Path (optional) */
+	caPath?: string;
+	/** Whether to reject unauthorized TLS connections (default: true) */
+	rejectUnauthorized?: boolean;
+}
+export type SqlConnectionOptions = ConnectionOptions & {
+	system: SqlDatabaseSystem;
+};
+export type QueryableConnectionOptions = ConnectionOptions & {
+	system: QueryableDatabaseSystem;
+};
+/**
+ * Schema information for a single column
+ */
+export interface ColumnSchema {
+	/** Column name */
+	name: string;
+	/** Column data type */
+	type: string;
+	/** Whether column allows NULL values */
+	nullable: boolean;
+	/** Default value for column (if any) */
+	default?: string;
+	/** Whether column is primary key */
+	primaryKey?: boolean;
+	/** Foreign key reference if applicable */
+	foreignKey?: {
+		table: string;
+		column: string;
+	};
+	/** Whether column is auto-incremented */
+	autoIncrement?: boolean;
+	/** Column comment/description */
+	comment?: string | null;
+	/** Enum values if column is ENUM type */
+	enumValues?: string[];
+	/** MongoDB only: 0..1 fraction of sampled docs that contained this dot-path. Undefined for SQL. */
+	presence?: number;
+	/** MongoDB only: true when this dot-path matches a blacklist pattern. Undefined for SQL. */
+	redacted?: boolean;
+}
+/**
+ * Complete schema information for a table
+ */
+export interface TableSchema {
+	/** Some metadata was omitted to protect blacklisted identities. No protected names. */
+	metadataOmitted?: boolean;
+	/** Table name */
+	name: string;
+	/** Exact database schema/catalog namespace, when reliably available */
+	schema?: string;
+	/** Array of columns in the table */
+	columns: ColumnSchema[];
+	/** Approximate row count (if available) */
+	rowCount?: number;
+	/** Storage engine (PostgreSQL/MySQL) */
+	engine?: string;
+	/** Primary key column names */
+	primaryKey?: string[];
+	/** Foreign key constraints with metadata */
+	foreignKeys?: Array<{
+		name: string;
+		columns: string[];
+		refSchema?: string;
+		refTable: string;
+		refColumns: string[];
+	}>;
+	/** Table indexes with column information */
+	indexes?: Array<{
+		name: string;
+		columns: string[];
+		unique: boolean;
+		/** False when expressions/predicates prevent complete column-only representation. */
+		columnsComplete?: boolean;
+	}>;
+	/** Column count (used by listTables when full column details are not loaded) */
+	columnCount?: number;
+	/** Estimated row count in table */
+	estimatedRowCount?: number;
+	/** Type of table (table or view) */
+	tableType?: "table" | "view";
+}
+type ConnectionErrorCode = "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "DB_PERMISSION_DENIED" | "ENOTFOUND" | "EHOSTUNREACH" | "CONNECTION_LOST" | "TOO_MANY_CONNECTIONS" | "TLS_ERROR" | "SERVER_NOT_READY" | "CONNECTION_REJECTED" | "SQL_SYNTAX_ERROR" | "STATEMENT_TIMEOUT" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "QUERY_ONLY_BOUNDARY_FAILED" | "UNKNOWN";
+export declare class ConnectionError extends Error {
+	/** Error category code */
+	code: ConnectionErrorCode;
+	/** Array of actionable troubleshooting hints */
+	hints: string[];
+	/**
+	 * The ceiling that was in force, in milliseconds. Set on STATEMENT_TIMEOUT so
+	 * consumers can state it without parsing `message`; the recovery envelope needs
+	 * it to tell an agent what `--statement-timeout <ms>` it was already up against.
+	 */
+	limitMs?: number | undefined;
+	/** Whether an interactive caller may safely retry the statement after reconnecting. */
+	readonly retrySafe: boolean;
+	constructor(
+	/** Error category code */
+	code: ConnectionErrorCode, 
+	/** User-friendly error message */
+	message: string, 
+	/** Array of actionable troubleshooting hints */
+	hints: string[], 
+	/**
+	 * The ceiling that was in force, in milliseconds. Set on STATEMENT_TIMEOUT so
+	 * consumers can state it without parsing `message`; the recovery envelope needs
+	 * it to tell an agent what `--statement-timeout <ms>` it was already up against.
+	 */
+	limitMs?: number | undefined, 
+	/** Whether an interactive caller may safely retry the statement after reconnecting. */
+	retrySafe?: boolean);
+}
+/**
+ * Result of a database query or command execution
+ */
+export interface ExecutionResult<T> {
+	/** Array of result rows as objects (for SELECT queries) */
+	rows: T[];
+	/** Number of rows affected by the operation (for INSERT/UPDATE/DELETE) */
+	affectedRows: number;
+	/** Last inserted ID if applicable (for INSERT operations) */
+	lastInsertId?: number | string;
+	/** Convenience row count — used by formatters; mirrors rows.length on read paths */
+	rowCount?: number;
+	/** Column ordering for the rows, used by formatters that render tabular output */
+	columnNames?: string[];
+	/** Optional warnings — emitted today only by RedisAdapter (size guard / blacklist filter). */
+	warnings?: RedisWarning[];
+}
+type RedisWarning = {
+	code: "REDIS_SIZE_REWRITE";
+	command: string;
+	original: string[];
+	rewritten: string[];
+} | {
+	code: "REDIS_SIZE_TRUNCATE";
+	command: string;
+	kept: number;
+	droppedAtLeast: number;
+} | {
+	code: "REDIS_BLACKLIST_FILTERED";
+	count: number;
+};
+interface TableSchemaOptions {
+	/** Single-object schema command: validate presence/type and mark incomplete index metadata. */
+	metadataProtection?: boolean;
+	/** Explicit SQL namespace; local tableName remains literal. Never performs an exact count. */
+	namespace?: string;
+	/** MongoDB: 取樣文件數 */
+	sampleSize?: number;
+	/** MongoDB: 取樣方式 */
+	sampleMethod?: "random" | "natural";
+	/**
+	 * 精確列數要掃全表。掃描整個資料庫時設為 false，改用引擎的估計值——
+	 * 一百張表的資料庫做不起一百次全表 COUNT。預設 true。
+	 */
+	exactRowCount?: boolean;
+}
 /**
- * Permission level (coarse-grained access control)
+ * Database adapter interface - contract for all database implementations
+ * Defines methods that all database adapters must implement
  */
-export type Permission = "query-only" | "read-write" | "data-admin" | "admin";
-interface Metadata {
-	createdAt?: string;
-	version: string;
-}
-interface DbcliConfig {
-	connection: ConnectionConfig;
-	permission: Permission;
-	schema?: Record<string, unknown>;
-	metadata?: Metadata;
-	blacklist?: BlacklistConfig;
+export interface DatabaseAdapter {
+	/**
+	 * Establish connection and verify credentials
+	 * Throws ConnectionError with categorized error type on failure
+	 * @throws {ConnectionError} If connection fails (server down, auth failed, timeout, etc.)
+	 */
+	connect(): Promise<void>;
+	/**
+	 * Close connection and release resources
+	 * Should never throw; safe to call multiple times
+	 * Handles cleanup gracefully even if already disconnected
+	 */
+	disconnect(): Promise<void>;
+	/**
+	 * Execute arbitrary SQL query with parameterized values
+	 * Prevents SQL injection by using parameter binding
+	 * @param sql Query string with parameter placeholders ($1, $2, etc. for PostgreSQL or ? for MySQL)
+	 * @param params Array of parameter values in order
+	 * @returns Execution result containing rows and metadata
+	 * @throws {ConnectionError} If query execution fails
+	 */
+	execute<T>(sql: string, params?: (string | number | boolean | null)[], options?: {
+		noLimit?: boolean;
+		sqlMode?: SqlExecutionMode;
+	}): Promise<ExecutionResult<T>>;
+	/**
+	 * List all tables in the connected database
+	 * Includes metadata such as row count and storage engine
+	 * @returns Array of table schemas with basic information
+	 * @throws {ConnectionError} If query fails
+	 */
+	listTables(): Promise<TableSchema[]>;
+	/**
+	 * Fetch complete schema for a single table
+	 * Includes all columns with types and constraints
+	 * @param tableName Name of table to inspect
+	 * @param options Optional adapter-specific knobs (e.g. mongo `sampleSize`); SQL adapters ignore them.
+	 * @returns Complete table schema including all column details
+	 * @throws {ConnectionError} If query fails
+	 */
+	getTableSchema(tableName: string, options?: TableSchemaOptions): Promise<TableSchema>;
+	/**
+	 * Test connection with lightweight probe query
+	 * Executes SELECT 1 or equivalent to verify connection is alive
+	 * @returns true if connection successful
+	 * @throws {ConnectionError} If connection test fails
+	 */
+	testConnection(): Promise<boolean>;
+	/**
+	 * Get the database server version string
+	 * @returns Raw version string from the server (e.g. "8.0.35", "15.4", "10.11.6-MariaDB")
+	 * @throws {ConnectionError} If not connected or query fails
+	 */
+	getServerVersion(): Promise<string>;
 }
+type SideEffectTier = "readonly" | "dry-run" | "local-write" | "db-write" | "interactive" | "none";
 interface AppliedLimitMetadata {
 	/** True only when the caller fetched and removed an additional row. */
 	truncated: boolean;
@@ -813,10 +828,20 @@ export declare class BlacklistValidator {
 	buildSecurityNotification(_tableName: string, omittedColumns: string[]): string;
 }
 declare const DbcliConfigSchema: z.ZodObject<{
-	connection: z.ZodUnion<[
+	connection: z.ZodEffects<z.ZodUnion<[
 		z.ZodObject<{
 			timeout: z.ZodOptional<z.ZodNumber>;
 			statementTimeout: z.ZodOptional<z.ZodNumber>;
+			sqlTls: z.ZodOptional<z.ZodObject<{
+				mode: z.ZodLiteral<"verify-full">;
+				caPath: z.ZodEffects<z.ZodString, string, string>;
+			}, "strict", z.ZodTypeAny, {
+				mode: "verify-full";
+				caPath: string;
+			}, {
+				mode: "verify-full";
+				caPath: string;
+			}>>;
 			system: z.ZodEnum<[
 				"postgresql",
 				"mysql",
@@ -876,10 +901,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "postgresql" | "mysql" | "mariadb";
 			host: string | {
 				$env: string;
 			};
+			system: "postgresql" | "mysql" | "mariadb";
 			port: number | {
 				$env: string;
 			};
@@ -891,11 +916,15 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			};
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
+			sqlTls?: {
+				mode: "verify-full";
+				caPath: string;
+			} | undefined;
 		}, {
-			system: "postgresql" | "mysql" | "mariadb";
 			host: string | {
 				$env: string;
 			};
+			system: "postgresql" | "mysql" | "mariadb";
 			port: number | {
 				$env: string;
 			};
@@ -910,6 +939,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			} | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
+			sqlTls?: {
+				mode: "verify-full";
+				caPath: string;
+			} | undefined;
 		}>,
 		z.ZodObject<{
 			timeout: z.ZodOptional<z.ZodNumber>;
@@ -983,10 +1016,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "sqlite";
 			host: string | {
 				$env: string;
 			};
+			system: "sqlite";
 			port: number | {
 				$env: string;
 			};
@@ -1115,10 +1148,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "mongodb";
 			host: string | {
 				$env: string;
 			};
+			system: "mongodb";
 			port: number | {
 				$env: string;
 			};
@@ -1129,9 +1162,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			};
 			srv: boolean;
-			uri?: string | {
-				$env: string;
-			} | undefined;
+			options?: Record<string, string> | undefined;
 			authSource?: string | {
 				$env: string;
 			} | undefined;
@@ -1139,7 +1170,9 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
-			options?: Record<string, string> | undefined;
+			uri?: string | {
+				$env: string;
+			} | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 		}, {
@@ -1150,26 +1183,26 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			host?: string | {
 				$env: string;
 			} | undefined;
-			port?: number | {
+			options?: Record<string, string> | undefined;
+			authSource?: string | {
 				$env: string;
 			} | undefined;
-			user?: string | {
+			replicaSet?: string | {
 				$env: string;
 			} | undefined;
-			database?: string | {
+			tls?: boolean | undefined;
+			uri?: string | {
 				$env: string;
 			} | undefined;
-			uri?: string | {
+			port?: number | {
 				$env: string;
 			} | undefined;
-			authSource?: string | {
+			user?: string | {
 				$env: string;
 			} | undefined;
-			replicaSet?: string | {
+			database?: string | {
 				$env: string;
 			} | undefined;
-			tls?: boolean | undefined;
-			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
@@ -1232,10 +1265,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "redis";
 			host: string | {
 				$env: string;
 			};
+			system: "redis";
 			port: number | {
 				$env: string;
 			};
@@ -1248,10 +1281,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 		}, {
-			system: "redis";
 			host: string | {
 				$env: string;
 			};
+			system: "redis";
 			port: number | {
 				$env: string;
 			};
@@ -1352,10 +1385,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "elasticsearch";
 			host: string | {
 				$env: string;
 			};
+			system: "elasticsearch";
 			port: number | {
 				$env: string;
 			};
@@ -1365,8 +1398,9 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			database: string | {
 				$env: string;
 			};
-			rejectUnauthorized: boolean;
 			protocol: "http" | "https";
+			rejectUnauthorized: boolean;
+			caPath?: string | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			nodes?: string[] | undefined;
@@ -1376,7 +1410,6 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			apiKey?: string | {
 				$env: string;
 			} | undefined;
-			caPath?: string | undefined;
 		}, {
 			system: "elasticsearch";
 			password?: string | {
@@ -1385,6 +1418,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			host?: string | {
 				$env: string;
 			} | undefined;
+			caPath?: string | undefined;
 			port?: number | {
 				$env: string;
 			} | undefined;
@@ -1394,7 +1428,6 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			database?: string | {
 				$env: string;
 			} | undefined;
-			rejectUnauthorized?: boolean | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			protocol?: "http" | "https" | undefined;
@@ -1405,9 +1438,133 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			apiKey?: string | {
 				$env: string;
 			} | undefined;
-			caPath?: string | undefined;
+			rejectUnauthorized?: boolean | undefined;
 		}>
-	]>;
+	]>, {
+		password: string | {
+			$env: string;
+		};
+		host: string | {
+			$env: string;
+		};
+		system: "mongodb";
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		srv: boolean;
+		options?: Record<string, string> | undefined;
+		authSource?: string | {
+			$env: string;
+		} | undefined;
+		replicaSet?: string | {
+			$env: string;
+		} | undefined;
+		tls?: boolean | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
+		timeout?: number | undefined;
+		statementTimeout?: number | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		host: string | {
+			$env: string;
+		};
+		system: "postgresql" | "mysql" | "mariadb";
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		timeout?: number | undefined;
+		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		host: string | {
+			$env: string;
+		};
+		system: "sqlite";
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		file: string | {
+			$env: string;
+		};
+		timeout?: number | undefined;
+		statementTimeout?: number | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		host: string | {
+			$env: string;
+		};
+		system: "redis";
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		timeout?: number | undefined;
+		statementTimeout?: number | undefined;
+	} | {
+		password: string | {
+			$env: string;
+		};
+		host: string | {
+			$env: string;
+		};
+		system: "elasticsearch";
+		port: number | {
+			$env: string;
+		};
+		user: string | {
+			$env: string;
+		};
+		database: string | {
+			$env: string;
+		};
+		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		caPath?: string | undefined;
+		timeout?: number | undefined;
+		statementTimeout?: number | undefined;
+		nodes?: string[] | undefined;
+		cloudId?: string | {
+			$env: string;
+		} | undefined;
+		apiKey?: string | {
+			$env: string;
+		} | undefined;
+	}, unknown>;
 	permission: z.ZodDefault<z.ZodEnum<[
 		"query-only",
 		"read-write",
@@ -1547,15 +1704,14 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			max_entries: number;
 		};
 	};
-	permission: "admin" | "query-only" | "read-write" | "data-admin";
 	connection: {
 		password: string | {
 			$env: string;
 		};
-		system: "mongodb";
 		host: string | {
 			$env: string;
 		};
+		system: "mongodb";
 		port: number | {
 			$env: string;
 		};
@@ -1566,27 +1722,27 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			$env: string;
 		};
 		srv: boolean;
-		uri?: string | {
-			$env: string;
-		} | undefined;
+		options?: Record<string, string> | undefined;
 		authSource?: string | {
 			$env: string;
 		} | undefined;
 		replicaSet?: string | {
 			$env: string;
 		} | undefined;
-		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
+		tls?: boolean | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
 		};
+		system: "postgresql" | "mysql" | "mariadb";
 		port: number | {
 			$env: string;
 		};
@@ -1598,14 +1754,18 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		};
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "sqlite";
 		host: string | {
 			$env: string;
 		};
+		system: "sqlite";
 		port: number | {
 			$env: string;
 		};
@@ -1624,10 +1784,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "redis";
 		host: string | {
 			$env: string;
 		};
+		system: "redis";
 		port: number | {
 			$env: string;
 		};
@@ -1643,10 +1803,10 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "elasticsearch";
 		host: string | {
 			$env: string;
 		};
+		system: "elasticsearch";
 		port: number | {
 			$env: string;
 		};
@@ -1656,8 +1816,9 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		rejectUnauthorized: boolean;
 		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		caPath?: string | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		nodes?: string[] | undefined;
@@ -1667,8 +1828,8 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		apiKey?: string | {
 			$env: string;
 		} | undefined;
-		caPath?: string | undefined;
 	};
+	permission: "query-only" | "read-write" | "data-admin" | "admin";
 	metadata: {
 		version: string;
 		createdAt?: string | undefined;
@@ -1682,127 +1843,6 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		}[];
 	} | undefined;
 }, {
-	connection: {
-		system: "mongodb";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		uri?: string | {
-			$env: string;
-		} | undefined;
-		authSource?: string | {
-			$env: string;
-		} | undefined;
-		replicaSet?: string | {
-			$env: string;
-		} | undefined;
-		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
-		srv?: boolean | undefined;
-		timeout?: number | undefined;
-		statementTimeout?: number | undefined;
-	} | {
-		system: "postgresql" | "mysql" | "mariadb";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		user: string | {
-			$env: string;
-		};
-		database: string | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		statementTimeout?: number | undefined;
-	} | {
-		system: "sqlite";
-		file: string | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		statementTimeout?: number | undefined;
-	} | {
-		system: "redis";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		statementTimeout?: number | undefined;
-	} | {
-		system: "elasticsearch";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		rejectUnauthorized?: boolean | undefined;
-		timeout?: number | undefined;
-		statementTimeout?: number | undefined;
-		protocol?: "http" | "https" | undefined;
-		nodes?: string[] | undefined;
-		cloudId?: string | {
-			$env: string;
-		} | undefined;
-		apiKey?: string | {
-			$env: string;
-		} | undefined;
-		caPath?: string | undefined;
-	};
 	redis?: {
 		mask?: {
 			keyPattern: string;
@@ -1822,7 +1862,8 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			max_entries?: number | undefined;
 		} | undefined;
 	} | undefined;
-	permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
+	connection?: unknown;
+	permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 	metadata?: {
 		version?: string | undefined;
 		createdAt?: string | undefined;
@@ -1841,6 +1882,16 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		z.ZodObject<{
 			timeout: z.ZodOptional<z.ZodNumber>;
 			statementTimeout: z.ZodOptional<z.ZodNumber>;
+			sqlTls: z.ZodOptional<z.ZodObject<{
+				mode: z.ZodLiteral<"verify-full">;
+				caPath: z.ZodEffects<z.ZodString, string, string>;
+			}, "strict", z.ZodTypeAny, {
+				mode: "verify-full";
+				caPath: string;
+			}, {
+				mode: "verify-full";
+				caPath: string;
+			}>>;
 			system: z.ZodEnum<[
 				"postgresql",
 				"mysql",
@@ -1909,10 +1960,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "postgresql" | "mysql" | "mariadb";
 			host: string | {
 				$env: string;
 			};
+			system: "postgresql" | "mysql" | "mariadb";
 			port: number | {
 				$env: string;
 			};
@@ -1922,16 +1973,20 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			database: string | {
 				$env: string;
 			};
-			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			permission: "query-only" | "read-write" | "data-admin" | "admin";
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
+			sqlTls?: {
+				mode: "verify-full";
+				caPath: string;
+			} | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}, {
-			system: "postgresql" | "mysql" | "mariadb";
 			host: string | {
 				$env: string;
 			};
+			system: "postgresql" | "mysql" | "mariadb";
 			port: number | {
 				$env: string;
 			};
@@ -1945,8 +2000,12 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			timeout?: number | undefined;
-			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 			statementTimeout?: number | undefined;
+			sqlTls?: {
+				mode: "verify-full";
+				caPath: string;
+			} | undefined;
+			permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>,
@@ -2031,10 +2090,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "sqlite";
 			host: string | {
 				$env: string;
 			};
+			system: "sqlite";
 			port: number | {
 				$env: string;
 			};
@@ -2047,7 +2106,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			file: string | {
 				$env: string;
 			};
-			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			permission: "query-only" | "read-write" | "data-admin" | "admin";
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			envFile?: string | undefined;
@@ -2073,8 +2132,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			timeout?: number | undefined;
-			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 			statementTimeout?: number | undefined;
+			permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>,
@@ -2178,10 +2237,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "mongodb";
 			host: string | {
 				$env: string;
 			};
+			system: "mongodb";
 			port: number | {
 				$env: string;
 			};
@@ -2192,10 +2251,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			};
 			srv: boolean;
-			permission: "admin" | "query-only" | "read-write" | "data-admin";
-			uri?: string | {
-				$env: string;
-			} | undefined;
+			permission: "query-only" | "read-write" | "data-admin" | "admin";
+			options?: Record<string, string> | undefined;
 			authSource?: string | {
 				$env: string;
 			} | undefined;
@@ -2203,7 +2260,9 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
-			options?: Record<string, string> | undefined;
+			uri?: string | {
+				$env: string;
+			} | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			envFile?: string | undefined;
@@ -2216,30 +2275,30 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			host?: string | {
 				$env: string;
 			} | undefined;
-			port?: number | {
+			options?: Record<string, string> | undefined;
+			authSource?: string | {
 				$env: string;
 			} | undefined;
-			user?: string | {
+			replicaSet?: string | {
 				$env: string;
 			} | undefined;
-			database?: string | {
+			tls?: boolean | undefined;
+			uri?: string | {
 				$env: string;
 			} | undefined;
-			uri?: string | {
+			port?: number | {
 				$env: string;
 			} | undefined;
-			authSource?: string | {
+			user?: string | {
 				$env: string;
 			} | undefined;
-			replicaSet?: string | {
+			database?: string | {
 				$env: string;
 			} | undefined;
-			tls?: boolean | undefined;
-			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
-			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 			statementTimeout?: number | undefined;
+			permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>,
@@ -2310,10 +2369,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "redis";
 			host: string | {
 				$env: string;
 			};
+			system: "redis";
 			port: number | {
 				$env: string;
 			};
@@ -2323,16 +2382,16 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			database: string | {
 				$env: string;
 			};
-			permission: "admin" | "query-only" | "read-write" | "data-admin";
+			permission: "query-only" | "read-write" | "data-admin" | "admin";
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}, {
-			system: "redis";
 			host: string | {
 				$env: string;
 			};
+			system: "redis";
 			port: number | {
 				$env: string;
 			};
@@ -2346,8 +2405,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			timeout?: number | undefined;
-			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 			statementTimeout?: number | undefined;
+			permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>,
@@ -2445,10 +2504,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			password: string | {
 				$env: string;
 			};
-			system: "elasticsearch";
 			host: string | {
 				$env: string;
 			};
+			system: "elasticsearch";
 			port: number | {
 				$env: string;
 			};
@@ -2458,9 +2517,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			database: string | {
 				$env: string;
 			};
-			rejectUnauthorized: boolean;
-			permission: "admin" | "query-only" | "read-write" | "data-admin";
 			protocol: "http" | "https";
+			rejectUnauthorized: boolean;
+			permission: "query-only" | "read-write" | "data-admin" | "admin";
+			caPath?: string | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			nodes?: string[] | undefined;
@@ -2470,7 +2530,6 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			apiKey?: string | {
 				$env: string;
 			} | undefined;
-			caPath?: string | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}, {
@@ -2481,6 +2540,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			host?: string | {
 				$env: string;
 			} | undefined;
+			caPath?: string | undefined;
 			port?: number | {
 				$env: string;
 			} | undefined;
@@ -2490,9 +2550,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			database?: string | {
 				$env: string;
 			} | undefined;
-			rejectUnauthorized?: boolean | undefined;
 			timeout?: number | undefined;
-			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 			statementTimeout?: number | undefined;
 			protocol?: "http" | "https" | undefined;
 			nodes?: string[] | undefined;
@@ -2502,7 +2560,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			apiKey?: string | {
 				$env: string;
 			} | undefined;
-			caPath?: string | undefined;
+			rejectUnauthorized?: boolean | undefined;
+			permission?: "query-only" | "read-write" | "data-admin" | "admin" | undefined;
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>
@@ -2510,10 +2569,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
 		};
+		system: "postgresql" | "mysql" | "mariadb";
 		port: number | {
 			$env: string;
 		};
@@ -2523,19 +2582,23 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "sqlite";
 		host: string | {
 			$env: string;
 		};
+		system: "sqlite";
 		port: number | {
 			$env: string;
 		};
@@ -2548,7 +2611,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		file: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2557,10 +2620,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "mongodb";
 		host: string | {
 			$env: string;
 		};
+		system: "mongodb";
 		port: number | {
 			$env: string;
 		};
@@ -2571,10 +2634,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		};
 		srv: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
-		uri?: string | {
-			$env: string;
-		} | undefined;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		options?: Record<string, string> | undefined;
 		authSource?: string | {
 			$env: string;
 		} | undefined;
@@ -2582,7 +2643,9 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2591,10 +2654,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "redis";
 		host: string | {
 			$env: string;
 		};
+		system: "redis";
 		port: number | {
 			$env: string;
 		};
@@ -2604,7 +2667,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2613,10 +2676,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "elasticsearch";
 		host: string | {
 			$env: string;
 		};
+		system: "elasticsearch";
 		port: number | {
 			$env: string;
 		};
@@ -2626,9 +2689,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		rejectUnauthorized: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		caPath?: string | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		nodes?: string[] | undefined;
@@ -2638,17 +2702,16 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		apiKey?: string | {
 			$env: string;
 		} | undefined;
-		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	}, unknown>>, Record<string, {
 		password: string | {
 			$env: string;
 		};
-		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
 		};
+		system: "postgresql" | "mysql" | "mariadb";
 		port: number | {
 			$env: string;
 		};
@@ -2658,19 +2721,23 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "sqlite";
 		host: string | {
 			$env: string;
 		};
+		system: "sqlite";
 		port: number | {
 			$env: string;
 		};
@@ -2683,7 +2750,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		file: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2692,10 +2759,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "mongodb";
 		host: string | {
 			$env: string;
 		};
+		system: "mongodb";
 		port: number | {
 			$env: string;
 		};
@@ -2706,10 +2773,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		};
 		srv: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
-		uri?: string | {
-			$env: string;
-		} | undefined;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		options?: Record<string, string> | undefined;
 		authSource?: string | {
 			$env: string;
 		} | undefined;
@@ -2717,7 +2782,9 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2726,10 +2793,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "redis";
 		host: string | {
 			$env: string;
 		};
+		system: "redis";
 		port: number | {
 			$env: string;
 		};
@@ -2739,7 +2806,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2748,10 +2815,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "elasticsearch";
 		host: string | {
 			$env: string;
 		};
+		system: "elasticsearch";
 		port: number | {
 			$env: string;
 		};
@@ -2761,9 +2828,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		rejectUnauthorized: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		caPath?: string | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		nodes?: string[] | undefined;
@@ -2773,7 +2841,6 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		apiKey?: string | {
 			$env: string;
 		} | undefined;
-		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	}>, Record<string, unknown>>;
@@ -2922,10 +2989,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
 		};
+		system: "postgresql" | "mysql" | "mariadb";
 		port: number | {
 			$env: string;
 		};
@@ -2935,19 +3002,23 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "sqlite";
 		host: string | {
 			$env: string;
 		};
+		system: "sqlite";
 		port: number | {
 			$env: string;
 		};
@@ -2960,7 +3031,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		file: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2969,10 +3040,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "mongodb";
 		host: string | {
 			$env: string;
 		};
+		system: "mongodb";
 		port: number | {
 			$env: string;
 		};
@@ -2983,10 +3054,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		};
 		srv: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
-		uri?: string | {
-			$env: string;
-		} | undefined;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		options?: Record<string, string> | undefined;
 		authSource?: string | {
 			$env: string;
 		} | undefined;
@@ -2994,7 +3063,9 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3003,10 +3074,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "redis";
 		host: string | {
 			$env: string;
 		};
+		system: "redis";
 		port: number | {
 			$env: string;
 		};
@@ -3016,7 +3087,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3025,10 +3096,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "elasticsearch";
 		host: string | {
 			$env: string;
 		};
+		system: "elasticsearch";
 		port: number | {
 			$env: string;
 		};
@@ -3038,9 +3109,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		rejectUnauthorized: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		caPath?: string | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		nodes?: string[] | undefined;
@@ -3050,7 +3122,6 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		apiKey?: string | {
 			$env: string;
 		} | undefined;
-		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	}>;
@@ -3117,10 +3188,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
 		};
+		system: "postgresql" | "mysql" | "mariadb";
 		port: number | {
 			$env: string;
 		};
@@ -3130,19 +3201,23 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
+		sqlTls?: {
+			mode: "verify-full";
+			caPath: string;
+		} | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
 		password: string | {
 			$env: string;
 		};
-		system: "sqlite";
 		host: string | {
 			$env: string;
 		};
+		system: "sqlite";
 		port: number | {
 			$env: string;
 		};
@@ -3155,7 +3230,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		file: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3164,10 +3239,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "mongodb";
 		host: string | {
 			$env: string;
 		};
+		system: "mongodb";
 		port: number | {
 			$env: string;
 		};
@@ -3178,10 +3253,8 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		};
 		srv: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
-		uri?: string | {
-			$env: string;
-		} | undefined;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		options?: Record<string, string> | undefined;
 		authSource?: string | {
 			$env: string;
 		} | undefined;
@@ -3189,7 +3262,9 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
-		options?: Record<string, string> | undefined;
+		uri?: string | {
+			$env: string;
+		} | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3198,10 +3273,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "redis";
 		host: string | {
 			$env: string;
 		};
+		system: "redis";
 		port: number | {
 			$env: string;
 		};
@@ -3211,7 +3286,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3220,10 +3295,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		password: string | {
 			$env: string;
 		};
-		system: "elasticsearch";
 		host: string | {
 			$env: string;
 		};
+		system: "elasticsearch";
 		port: number | {
 			$env: string;
 		};
@@ -3233,9 +3308,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		rejectUnauthorized: boolean;
-		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		protocol: "http" | "https";
+		rejectUnauthorized: boolean;
+		permission: "query-only" | "read-write" | "data-admin" | "admin";
+		caPath?: string | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		nodes?: string[] | undefined;
@@ -3245,7 +3321,6 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		apiKey?: string | {
 			$env: string;
 		} | undefined;
-		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	}>;