@carllee1983/dbcli 12.0.0 → 12.1.0

package/dist/cli-runtime.mjs

@@ -1618,7 +1618,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "12.0.0",
+    version: "12.1.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -1687,6 +1687,7 @@ var init_package = __esm(() => {
       prepublishOnly: "bun run build",
       audit: "bun run scripts/audit.ts",
       "release:check": "bash scripts/release-check.sh",
+      "release:extras": "bash scripts/release-extras.sh",
       "plugin:sync": "bun run scripts/sync-plugin-assets.ts --write",
       "plugin:check": "bun run scripts/sync-plugin-assets.ts",
       "manifest:sync": "bun run scripts/check-plugin-manifests.ts --write",
@@ -1935,6 +1936,1028 @@ async function checkForUpdate(currentVersion, cachePath, existingCache) {
   };
 }
 
+// resources/lang/en/messages.json
+var messages_default;
+var init_messages = __esm(() => {
+  messages_default = {
+    cli: {
+      agent_output_option: "Emit one Operation Envelope v1 (capabilities and capabilities check only)"
+    },
+    init: {
+      description: "Initialize dbcli configuration with .env parsing and interactive prompts",
+      welcome: "Welcome to dbcli",
+      prompt_connection_name: "Connection name",
+      connection_name_required: "Connection name is required. Provide --conn-name <name> (this is separate from the database --name).",
+      select_system: "Select database system:",
+      prompt_host: "Database host: ",
+      prompt_port: "Database port: ",
+      prompt_user: "Database user: ",
+      prompt_password: "Database password: ",
+      secret_alternatives_sql: "pass --password, supply the credential through .env or the process environment, or store a reference with --use-env-refs",
+      secret_alternatives_mongo_password: "pass --password, supply the credential through .env or the process environment, or paste the connection string with --uri",
+      secret_alternatives_mongo_uri: "pass the connection string with --uri",
+      mongo_uri_conflicts_fields: "--uri cannot be combined with {flags}: the connection string already carries those settings. Use one or the other (--name may be combined to override the database name).",
+      mongo_uri_with_env_refs: "--uri cannot be combined with --use-env-refs: the connection string is decomposed into config fields, and its credentials are not moved into environment variables. Either remove --use-env-refs so dbcli decomposes the string into the field config, or use the --env-* flags (--env-host, --env-user, --env-password, ...) to name one variable per field.",
+      mongo_uri_fallback_warning: "\u26A0\uFE0F  This connection string {reasons}, so it cannot become fields. It is stored as-is in uri, and its credentials will sit in plaintext in the config file.",
+      mongo_uri_reason_unix_socket: "uses a Unix domain socket",
+      mongo_uri_reason_multi_host: "contains more than one host (a field config holds only one)",
+      mongo_uri_reason_secret_option: "contains secret option(s) ({keys}) that would land in plaintext options",
+      mongo_uri_reason_duplicate_key: "repeats the query key(s) {keys} (a field config can hold only one value per key)",
+      mongo_uri_reason_non_scram: "uses the non-SCRAM auth mechanism {mechanism} (field config cannot express it)",
+      mongo_decomposed_header: "Connection string decomposed into these fields (password hidden):",
+      mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs does not apply to a pasted connection string: its credentials are written to the config file as they are, not as environment-variable references.",
+      mongo_setup_mode_paste: "Paste a connection string (copied from Atlas / Compass)",
+      mongo_string_invalid: "Not a valid MongoDB connection string (it is not echoed because it may carry credentials).",
+      mongo_string_bad_host: "The connection string has an invalid host or port (the port must be an integer from 1 to 65535).",
+      mongo_string_bad_credentials: "The connection string's credentials contain an unescaped reserved character such as @, : or /. Percent-encode it (for example @ as %40).",
+      mongo_string_tls_conflict: "The connection string sets tls and ssl to different values.",
+      mongo_string_bad_tls: "The connection string's {key} must be true or false.",
+      mongo_string_empty_option: "The connection string sets {key} but leaves it empty. Give it a value or remove it.",
+      prompt_name: "Database name: ",
+      prompt_permission: "Permission level (query-only, read-write, data-admin, admin): ",
+      env_parse_note: "Note: Unable to parse .env configuration, using interactive prompts",
+      connection_testing: "Testing database connection...",
+      connection_success: "\u2713 Database connection successful",
+      connection_failed: "\u2717 Database connection failed",
+      config_saved: "Configuration saved to .dbcli",
+      config_saved_global: "Global configuration saved to {path}",
+      config_exists_overwrite: "Configuration file .dbcli already exists. Overwrite? (y/n): ",
+      cancelled: "Cancelled. Configuration not changed.",
+      skip_test_env_ref: "Skipping connection test in env-ref mode",
+      skip_test: "Skipping connection test (--skip-test)",
+      connection_hints: "Hints:",
+      config_exists_use_force: ".dbcli exists. Use --force option to overwrite.",
+      connection_added: "Connection '{name}' added",
+      connection_removed: "Connection '{name}' removed",
+      connection_removed_default_cleared: "Connection '{name}' removed. Default connection cleared. Specify --use <name> or DBCLI_CONNECTION for database commands.",
+      connection_renamed: "Connection '{oldName}' renamed to '{newName}'",
+      v1_migration_prompt: "Detected old config format. Create new format and import existing connection as 'default'?",
+      config_saved_v2: "V2 configuration saved to .dbcli",
+      config_not_found: "Configuration file not found",
+      requires_v2_remove: "Removing a connection requires V2 config format",
+      requires_v2_rename: "Renaming a connection requires V2 config format",
+      connection_not_found: "Connection '{name}' does not exist",
+      cannot_remove_last: "Cannot remove the last connection",
+      connection_already_exists: "Connection '{name}' already exists",
+      rename_invalid_format: "Usage: --rename <old-name>:<new-name>",
+      prompt_sqlite_file: "SQLite database file path: ",
+      sql_tls_help: "Verified SQL TLS mode (verify-full; PostgreSQL/MySQL/MariaDB)",
+      sql_tls_ca_help: "PEM CA bundle for --sql-tls verify-full"
+    },
+    inspect: {
+      description: "Read-only snapshot of connection, permission, blacklist, objects, snippets, and suggested next commands.",
+      no_config: "No dbcli configuration found. Run `dbcli init` to start."
+    },
+    report: {
+      description: "Diagnostic report (health/capacity/perf) built from built-in snippets. Read-only, bounded.",
+      no_config: "No dbcli configuration found. Run `dbcli init` to start.",
+      section_invalid: "Unknown report section '{name}'. Allowed: health, capacity, perf"
+    },
+    guide: {
+      description: "Deterministic next-command planner for a fixed set of database goals.",
+      no_config: "No dbcli configuration found. Run `dbcli init` to start.",
+      missing_goal: "Missing goal. Try `dbcli guide --list` to see available goals.",
+      goal_invalid: "Unknown guide goal '{name}'. Run `dbcli guide --list` for valid IDs."
+    },
+    recovery: {
+      description: "Look up the structured recovery envelope for a known dbcli error code, or list all codes.",
+      missing_code: "Missing --code. Try `dbcli recovery --list` to see available codes.",
+      code_invalid: "Unknown recovery code '{name}'. Run `dbcli recovery --list` for valid codes.",
+      no_config: "No dbcli configuration found. Run `dbcli init` to start."
+    },
+    use: {
+      description: "Switch or display the default database connection",
+      switched: "Switched default connection to {name}",
+      current: "Current default connection: {name}",
+      current_none: "No default connection. Specify --use <name> or DBCLI_CONNECTION.",
+      unset: "Default connection cleared. Specify --use <name> or DBCLI_CONNECTION for database commands.",
+      unset_conflict: "--unset cannot be combined with a connection name, --list, --confirm-production, or --format json",
+      requires_v2: "This feature requires v2 config format. Use 'dbcli init --conn-name <name>' to create one",
+      available: "Available connections"
+    },
+    schema: {
+      description: "Retrieve table structure or list all tables",
+      fetching: "Fetching schema...",
+      success: "Schema updated",
+      not_found: "Table not found in database",
+      refresh_prompt: "Schema has changes. Apply? (y/n): ",
+      columns_header: "Columns",
+      scanning_database: "\uD83D\uDD0D Scanning database schema...",
+      tables_found: "\uD83D\uDCCD Found {count} table(s). Fetching schema details...",
+      processing_tables: "   Processed {processed}/{total} table(s)",
+      schema_exists_warning: "\u26A0\uFE0F Database schema already exists in .dbcli",
+      use_force_to_override: "   Use --force to override without confirmation"
+    },
+    list: {
+      description: "List all tables in the database",
+      no_tables: "No tables found in database"
+    },
+    query: {
+      description: "Execute SQL query",
+      executing: "Executing query...",
+      no_results: "No results returned",
+      result_count: "Results: {count} row(s)"
+    },
+    q: {
+      description: "Run a saved query snippet by @name",
+      missing_param: "Missing required parameters for snippet '{name}'",
+      engine_mismatch: "Engine mismatch for snippet '{name}'",
+      snippet_not_found: "Snippet not found: {name}",
+      dry_run_header: "Dry-run preview (no execution):"
+    },
+    audit: {
+      description: "Inspect, look up, clear, or check the health of the audit log",
+      tail: {
+        description: "Show recent audit entries (default: last 10 from current connection)"
+      },
+      show: {
+        description: "Look up a single audit entry by id (UUID prefix >=4) or --recovery-ref"
+      },
+      clear: {
+        description: "Delete audit log files (.jsonl + .jsonl.1) for the current connection",
+        prompt_header: "About to clear audit log for connection '{conn}':",
+        prompt_file_line: "  {file}       \u2014 {entries} entries, {size}",
+        prompt_continue: "Continue? [y/N] ",
+        requires_tty_or_yes: "Cannot prompt for confirmation in non-interactive session. Use --yes to clear without prompt.",
+        summary_cleared: "Cleared {count} entries from '{conn}'.",
+        summary_nothing: "Nothing to clear.",
+        summary_failed: "Failed to clear: {message}."
+      },
+      health: {
+        description: "Show AuditLogger health snapshot (size, entries, lock state, last write)"
+      },
+      write_gate: {
+        description: "Summarize tier-two write-gate decisions (ADR 0010's measurement)",
+        header: "Write-gate summary \u2014 connection: {conn}",
+        window: "Audit entries scanned: {scanned}, {from} \u2192 {to}",
+        decisions: "Tier-two evaluations: {count}, {from} \u2192 {to}",
+        tier_one: "Tier one, counted apart: {count} ({outcomes})",
+        no_decisions: "Tier two was never reached in this window. Per ADR 0010 that falsifies the criterion, not the gate: the shapes it looks for are not the shapes people write.",
+        no_entries: "The audit log is empty, so this says nothing about the gate either way. Run some writes, or check `dbcli audit health`."
+      },
+      disabled_hint: "Audit is disabled (audit.enabled = false in .dbcli). Use 'dbcli audit health' for details.",
+      no_entries: "No audit entries.",
+      show_no_match: "No audit entry matches '{prefix}'.",
+      show_ambiguous: "Ambiguous prefix '{prefix}': matches {count} entries. Please use a longer prefix.",
+      show_prefix_too_short: "Prefix must be at least 4 characters.",
+      show_recovery_no_match: "No audit entry has recovery_ref '{ref}'.",
+      show_recovery_ambiguous: "Multiple entries reference recovery_ref '{ref}': matches {count}. This should be rare; inspect file directly.",
+      show_mutex_violation: "Provide either <id> argument or --recovery-ref, not both.",
+      n_capped_warning: "--n value {requested} exceeds max {max}; capped to {max}.",
+      n_must_be_positive: "--n must be a positive integer."
+    },
+    queries: {
+      description: "Manage saved query snippets",
+      list_description: "List saved snippets",
+      show_description: "Show a snippet (frontmatter + SQL)",
+      new_description: "Create a new snippet file",
+      edit_description: "Open a snippet in $EDITOR",
+      check_description: "Validate all snippets",
+      delete_description: "Delete a local snippet file",
+      rename_description: "Rename a local snippet",
+      copy_description: "Copy a snippet from any tier into local",
+      import_description: "Import an external .sql file into local",
+      export_description: "Export a snippet's raw SQL to stdout or file",
+      created: "Created {file}",
+      first_run_hint: "Tip: commit .dbcli-shared/ to share snippets with your team.",
+      no_snippets: "No snippets found. Create one with: dbcli queries new @<name>",
+      check_ok: "\u2713 {count} snippets parsed successfully",
+      check_failed: "\u2717 {count} snippet(s) have errors",
+      search_description: "Search snippets by keywords (fuzzy ranking)",
+      suggest_description: "Suggest snippets by intent prefix",
+      search_no_keywords: "Provide at least one keyword, or try 'queries list' / 'queries suggest'.",
+      search_no_results: "No snippets matched. Try 'queries list' or 'queries suggest <intent>'.",
+      suggest_missing_intent: "Provide an intent (or prefix). Available: {available}",
+      suggest_invalid_intent: "Invalid intent '{value}'. Must match ^[a-z][a-z0-9.-]*$",
+      suggest_no_results: "No snippets with intent prefix '{intent}'. Available: {available}",
+      no_active_connection_hint: "No active connection; showing snippets across all engines."
+    },
+    errors: {
+      message: "Error: {message}",
+      query_only_boundary_failed: "Could not establish the query-only database boundary for {system}: {detail}",
+      query_only_boundary_verify: "Verify that {system} supports read-only transactions and that this account may start one",
+      query_only_boundary_not_executed: "The target statement was not executed; fix the database setting or connection before retrying",
+      query_only_cleanup_completed: "The query-only target completed, but transaction cleanup failed for {system}: {detail}",
+      query_only_cleanup_uncertain: "The query-only target failed and its outcome is uncertain because transaction cleanup also failed for {system}: {detail}",
+      query_only_cleanup_completed_retry: "The target statement ran; do not retry it unless repeating its external effects is safe",
+      query_only_cleanup_uncertain_retry: "The target may have produced effects before failing; do not retry it unless repeating them is safe",
+      query_only_cleanup_reconnect: "Reconnect before running another statement because this connection was discarded",
+      invalid_config: "Invalid configuration: {field}",
+      connection_failed: "Failed to connect to database: {message}",
+      permission_denied: "Permission denied (required: {required})",
+      permission_requires_level: "{type} operation requires {minimum} permission or higher (current level: {permission})",
+      elasticsearch_requires_level: "Elasticsearch {type} operation requires {minimum} permission or higher (current level: {permission})",
+      escalated_write_requires_admin: "This statement opens as a read but contains an executable {keyword}. A write hidden inside a read statement requires admin permission (current level: {permission}).",
+      multiple_statements_refused: "SQL containing multiple statements is refused below admin permission, because only the first statement determines the permission check. Run each statement separately.",
+      unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires admin for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
+      permission_denied_reason: "Permission denied: {reason}",
+      table_not_found: "Table not found: {table}",
+      unsupported_lang: "Language '{lang}' not supported, using English",
+      invalid_json: "Invalid JSON: {message}",
+      table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
+      redis_target_blacklisted: "Redis command refused by blacklist",
+      column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
+      table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
+      table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
+      column_already_blacklisted: "Error: Column '{table}.{column}' is already blacklisted",
+      column_not_in_blacklist: "Error: Column '{table}.{column}' is not in the blacklist",
+      invalid_table_name: "Error: Invalid table name: {table}",
+      invalid_column_format: "Error: Invalid column format. Use 'table.column'",
+      invalid_system: "Invalid database system: {system}",
+      invalid_permission: "Invalid permission level: {permission}",
+      invalid_port: "Invalid port: {port}",
+      require_user: "Non-interactive mode requires --user option",
+      require_name: "Non-interactive mode requires --name option",
+      env_refs_missing_options: `When using --use-env-refs, environment variable names must be specified.
+Provide options: --env-host, --env-port, --env-user, --env-password, --env-database
+Or use interactive mode: run "dbcli init --use-env-refs" without --no-interactive`,
+      env_var_not_defined: `Cannot test connection: environment variable {envKey} is not defined.
+Set {envKey} in .env or environment variables.
+Hint: run 'export {envKey}=<value>' and retry`,
+      invalid_output_format: "--format {format} is not supported here \u2014 use text or json",
+      sqlite_file_required: "A SQLite connection needs a file path. Pass --file <path> or run init interactively.",
+      sql_tls_unsupported: "Explicit SQL TLS is supported only for PostgreSQL, MySQL and MariaDB",
+      sql_tls_options_required: "Provide both --sql-tls verify-full and --sql-tls-ca <path>",
+      sql_tls_change_engine: "Explicit SQL TLS is supported only for PostgreSQL, MySQL and MariaDB; cannot discard it when editing a profile",
+      sql_tls_legacy_import: "SQL TLS legacy single-file import is unsupported. Keep the original profile; create a verified named profile in a separate config directory before switching. Do not remove SQL TLS.",
+      sql_tls_ca_absolute: "SQL TLS CA path must be absolute",
+      sql_tls_network_host: "Explicit SQL TLS requires a DNS or IP host, not a Unix socket",
+      sql_tls_ca_empty: "CA bundle contains no PEM certificates",
+      sql_tls_ca_load: "Cannot load SQL TLS CA bundle: {detail}",
+      sql_tls_ca_restore: "Restore a readable, valid PEM CA bundle at sqlTls.caPath; keep verify-full enabled.",
+      sql_tls_handshake: "TLS handshake failed: {detail}",
+      sql_tls_ca_hint: "Set sqlTls.caPath to the correct readable PEM CA bundle.",
+      sql_tls_identity_hint: "Verify the certificate validity and DNS/IP identity for {host}.",
+      sql_tls_no_downgrade: "Keep verify-full enabled; do not remove SQL TLS or retry without verification.",
+      sql_tls_driver_identity: "SQL TLS identity verification is unavailable in this driver",
+      sql_tls_peer_unverified: "SQL TLS peer is not authenticated",
+      sql_tls_peer_missing: "SQL TLS peer certificate is unavailable",
+      sql_tls_recovery_config: "TLS recovery requires an explicit --config <path> or --global and the intended TLS profile; defaults cannot identify the failed target.",
+      sql_tls_recovery_profile: "TLS recovery requires --use <name> (or DBCLI_CONNECTION); it cannot fall back to the default profile.",
+      sql_tls_recovery_required: "TLS recovery requires a profile with explicit sqlTls verify-full; plaintext recovery is refused.",
+      sql_tls_recovery_target: "TLS recovery requires an explicitly selected, verified TLS profile."
+    },
+    success: {
+      inserted: "Successfully inserted {count} row(s)",
+      updated: "Successfully updated {count} row(s)",
+      deleted: "Successfully deleted {count} row(s)",
+      no_changes: "No changes to apply"
+    },
+    insert: {
+      description: "Insert data into a table",
+      prompt_data: "Enter JSON data to insert: ",
+      confirm: "Insert {count} row(s) into {table}? (y/n): ",
+      elasticsearch_unsupported: "Elasticsearch does not support the insert command; for now, use an external tool (e.g. curl or Kibana DevTools) to write documents"
+    },
+    update: {
+      description: "Update data in a table",
+      prompt_where: "Enter WHERE clause (e.g., id=1): ",
+      prompt_set: 'Enter JSON updates (e.g., {"status": "active"}): ',
+      confirm: "Update rows in {table}? (y/n): ",
+      elasticsearch_unsupported: "Elasticsearch does not support the update command; for now, use an external tool (e.g. curl or Kibana DevTools) to update documents"
+    },
+    delete: {
+      description: "Delete data from a table",
+      prompt_where: "Enter WHERE clause (e.g., id=1): ",
+      confirm: "Delete rows from {table}? (y/n): ",
+      admin_only: "Delete command requires data-admin or admin permission",
+      elasticsearch_unsupported: "Elasticsearch does not support the delete command; for now, use an external tool (e.g. curl or Kibana DevTools) to delete documents"
+    },
+    export: {
+      description: "Export query results",
+      formats: "Supported formats: json, csv",
+      exported: "Exported {count} rows to {file}"
+    },
+    upgrade: {
+      description: "Check for updates and upgrade dbcli to the latest version",
+      checking: "Checking for updates...",
+      already_up_to_date: "\u2713 Already up to date (v{version})",
+      new_version_available: "New version available: v{version}",
+      current_version: "Current version : v{version}",
+      latest_version: "Latest version  : v{version}",
+      update_hint: '[INFO] dbcli v{version} available. Run "dbcli upgrade" to upgrade.',
+      install_hint: 'Run "dbcli upgrade" to install the update.',
+      upgrading: "Upgrading...",
+      success: "\u2713 Successfully upgraded to v{version}",
+      skill_recheck_hint: 'Hint: If you have installed AI skills, run "dbcli skill --install <platform>" to ensure they are up to date.',
+      failed: "\u2717 Upgrade failed. Try running manually:",
+      manual_hint: "bun add -g @carllee1983/dbcli@latest",
+      network_error: "\u26A0 Could not check for updates (network error or registry unavailable)"
+    },
+    skill: {
+      description: "Generate AI skill documentation",
+      context_description: "Generate AI-friendly database schema and query snippet context",
+      installed: `Skill: {path}
+Reference: {referencePath}`,
+      update_available: "Skill updates available for the following platforms:",
+      update_hint: 'Run "dbcli skill --install <platform>" to update.'
+    },
+    blacklist: {
+      description: "Manage sensitive data blacklist to prevent AI access",
+      list_title: "Current Blacklist Configuration",
+      tables_label: "Blacklisted tables",
+      columns_label: "Blacklisted columns",
+      none: "No tables or columns are currently blacklisted",
+      table_added: "\u2713 Table '{table}' added to blacklist",
+      table_removed: "\u2713 Table '{table}' removed from blacklist",
+      column_added: "\u2713 Column '{table}.{column}' added to blacklist",
+      column_removed: "\u2713 Column '{table}.{column}' removed from blacklist",
+      refuse_wildcard: "Refused: '{table}' contains wildcard characters, which are matched literally on {system} \u2014 the entry would never match anything. Write the exact name."
+    },
+    security: {
+      columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
+    },
+    warnings: {
+      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
+      redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
+    },
+    version: {
+      unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
+      doctor_pass: "{system} {version} (meets >= {minVersion})",
+      doctor_warn: "{system} {version} is below supported >= {minVersion}"
+    },
+    migrate: {
+      description: "Schema DDL operations (CREATE/DROP/ALTER TABLE, INDEX, CONSTRAINT, ENUM)",
+      dry_run_preview: "[DRY RUN] Generated SQL (not executed):",
+      executing: "Executing DDL...",
+      success: "DDL executed successfully",
+      confirm_drop: "This is a destructive operation ({operation}). Proceed?",
+      permission_required: "DDL operations require admin permission (current: {permission})",
+      blacklist_blocked: 'Table "{table}" is blacklisted \u2014 DDL operations are blocked',
+      schema_refreshed: 'Schema cache updated for table "{table}"',
+      no_sql_generated: "No SQL generated (operation not applicable for this database)",
+      create_description: "Create a new table",
+      drop_description: "Drop a table",
+      add_column_description: "Add a column to a table",
+      drop_column_description: "Drop a column from a table",
+      alter_column_description: "Alter a column in a table",
+      add_index_description: "Add an index to a table",
+      drop_index_description: "Drop an index",
+      add_constraint_description: "Add a constraint to a table",
+      drop_constraint_description: "Drop a constraint from a table",
+      add_enum_description: "Create an enum type (PostgreSQL only)",
+      alter_enum_description: "Add a value to an enum type",
+      drop_enum_description: "Drop an enum type"
+    },
+    password: {
+      description: "Change the password of a single connection, leaving every other setting untouched",
+      arg_connection: "Connection name (defaults to the current default connection)",
+      opt_stdin: "Read the new password from stdin (for rotation scripts)",
+      opt_password: "New password given inline (visible in shell history and process list)",
+      opt_skip_test: "Skip verifying the new password against the database before saving",
+      prompt: "New password for connection '{name}'",
+      source_conflict: "--password and --stdin cannot be used together; pick one source.",
+      needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
+      empty: "The new password is empty; nothing was changed.",
+      updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
+      converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
+      skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
+    }
+  };
+});
+
+// resources/lang/zh-TW/messages.json
+var messages_default2;
+var init_messages2 = __esm(() => {
+  messages_default2 = {
+    cli: {
+      agent_output_option: "\u8F38\u51FA\u4E00\u4EFD Operation Envelope v1\uFF08\u50C5\u652F\u63F4 capabilities \u8207 capabilities check\uFF09"
+    },
+    init: {
+      description: "\u521D\u59CB\u5316 dbcli \u914D\u7F6E\uFF0C\u89E3\u6790 .env \u4E26\u9032\u884C\u4E92\u52D5\u5F0F\u63D0\u793A",
+      welcome: "\u6B61\u8FCE\u4F7F\u7528 dbcli",
+      prompt_connection_name: "\u9023\u7DDA\u540D\u7A31",
+      connection_name_required: "\u9023\u7DDA\u540D\u7A31\u4E0D\u53EF\u7A7A\u767D\uFF0C\u8ACB\u63D0\u4F9B --conn-name <name>\uFF08\u8207\u8CC7\u6599\u5EAB\u540D\u7A31 --name \u4E0D\u540C\uFF09\u3002",
+      select_system: "\u9078\u64C7\u8CC7\u6599\u5EAB\u7CFB\u7D71\uFF1A",
+      prompt_host: "\u8CC7\u6599\u5EAB\u4E3B\u6A5F\uFF1A",
+      prompt_port: "\u8CC7\u6599\u5EAB\u57E0\u865F\uFF1A",
+      prompt_user: "\u8CC7\u6599\u5EAB\u4F7F\u7528\u8005\uFF1A",
+      prompt_password: "\u8CC7\u6599\u5EAB\u5BC6\u78BC\uFF1A",
+      secret_alternatives_sql: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --use-env-refs \u5B58\u6210\u53C3\u7167",
+      secret_alternatives_mongo_password: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --uri \u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32",
+      secret_alternatives_mongo_uri: "\u4EE5 --uri \u50B3\u5165\u9023\u7DDA\u5B57\u4E32",
+      mongo_uri_conflicts_fields: "--uri \u4E0D\u80FD\u8207 {flags} \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u5DF2\u5305\u542B\u9019\u4E9B\u8A2D\u5B9A\u3002\u8ACB\u64C7\u4E00\u4F7F\u7528\uFF08--name \u53EF\u4E26\u7528\uFF0C\u7528\u4F86\u8986\u84CB\u8CC7\u6599\u5EAB\u540D\u7A31\uFF09\u3002",
+      mongo_uri_with_env_refs: "--uri \u4E0D\u80FD\u8207 --use-env-refs \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u6703\u88AB\u62C6\u89E3\u6210\u6B04\u4F4D\u8A2D\u5B9A\u5BEB\u5165\uFF0C\u5E33\u5BC6\u4E0D\u6703\u88AB\u62BD\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002\u8ACB\u6539\u8D70\u4E0B\u5217\u4EFB\u4E00\u505A\u6CD5\uFF1A\u62FF\u6389 --use-env-refs\uFF0C\u8B93 dbcli \u62C6\u89E3\u5B57\u4E32\u5BEB\u5165\u6B04\u4F4D\u8A2D\u5B9A\uFF1B\u6216\u6539\u7528 --env-* flag\uFF08--env-host\u3001--env-user\u3001--env-password \u7B49\uFF09\u9010\u6B04\u7D66\u8B8A\u6578\u540D\u7A31\u3002",
+      mongo_uri_fallback_warning: "\u26A0\uFE0F  \u6B64\u9023\u7DDA\u5B57\u4E32{reasons}\uFF0C\u7121\u6CD5\u62C6\u6210\u6B04\u4F4D\u8A2D\u5B9A\uFF0C\u5DF2\u539F\u6A23\u5B58\u5165 uri\uFF1B\u5E33\u5BC6\u5C07\u660E\u6587\u5B58\u653E\u65BC\u8A2D\u5B9A\u6A94\u3002",
+      mongo_uri_reason_unix_socket: "\u4F7F\u7528 Unix domain socket\uFF08\u672C\u6A5F\u901A\u8A0A\u7AEF\uFF09",
+      mongo_uri_reason_multi_host: "\u542B\u591A\u7D44 host\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u53EA\u80FD\u8868\u9054\u4E00\u7D44\uFF09",
+      mongo_uri_reason_secret_option: "\u542B\u6A5F\u5BC6 option\uFF08{keys}\uFF09\uFF0C\u62C6\u9032 options \u6703\u660E\u6587\u843D\u76E4",
+      mongo_uri_reason_duplicate_key: "\u542B\u91CD\u8907\u7684 query \u9375\uFF08{keys}\uFF09\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u6BCF\u500B\u9375\u53EA\u80FD\u5B58\u4E00\u500B\u503C\uFF09",
+      mongo_uri_reason_non_scram: "\u4F7F\u7528\u975E SCRAM \u7684\u8A8D\u8B49\u6A5F\u5236 {mechanism}\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u7121\u6CD5\u8868\u9054\uFF09",
+      mongo_decomposed_header: "\u9023\u7DDA\u5B57\u4E32\u5DF2\u62C6\u89E3\u6210\u4E0B\u5217\u6B04\u4F4D\uFF08\u5BC6\u78BC\u5DF2\u906E\u853D\uFF09\uFF1A",
+      mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs \u4E0D\u9069\u7528\u65BC\u8CBC\u4E0A\u7684\u9023\u7DDA\u5B57\u4E32\uFF1A\u5E33\u5BC6\u6703\u4EE5\u5B57\u9762\u503C\u5BEB\u5165\u8A2D\u5B9A\u6A94\uFF0C\u4E0D\u6703\u8B8A\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002",
+      mongo_setup_mode_paste: "\u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32\uFF08Atlas / Compass \u8907\u88FD\u7684\uFF09",
+      mongo_string_invalid: "\u4E0D\u662F\u5408\u6CD5\u7684 MongoDB \u9023\u7DDA\u5B57\u4E32\uFF08\u5B57\u4E32\u53EF\u80FD\u5E36\u6709\u5E33\u5BC6\uFF0C\u6240\u4EE5\u4E0D\u5370\u51FA\uFF09\u3002",
+      mongo_string_bad_host: "\u9023\u7DDA\u5B57\u4E32\u7684 host \u6216\u57E0\u865F\u4E0D\u5408\u6CD5\uFF08\u57E0\u865F\u9808\u70BA 1 \u81F3 65535 \u7684\u6574\u6578\uFF09\u3002",
+      mongo_string_bad_credentials: "\u9023\u7DDA\u5B57\u4E32\u7684\u5E33\u865F\u6216\u5BC6\u78BC\u542B\u6709\u672A\u8DF3\u812B\u7684\u4FDD\u7559\u5B57\u5143\uFF08\u5982 @\u3001:\u3001/\uFF09\u3002\u8ACB\u505A\u767E\u5206\u6BD4\u7DE8\u78BC\uFF08\u4F8B\u5982 @ \u5BEB\u6210 %40\uFF09\u3002",
+      mongo_string_tls_conflict: "\u9023\u7DDA\u5B57\u4E32\u540C\u6642\u6307\u5B9A\u4E86 tls \u8207 ssl \u4E14\u503C\u4E0D\u540C\u3002",
+      mongo_string_bad_tls: "\u9023\u7DDA\u5B57\u4E32\u7684 {key} \u53EA\u63A5\u53D7 true \u6216 false\u3002",
+      mongo_string_empty_option: "\u9023\u7DDA\u5B57\u4E32\u6307\u5B9A\u4E86 {key} \u537B\u6C92\u6709\u503C\u3002\u8ACB\u7D66\u503C\u6216\u79FB\u9664\u3002",
+      prompt_name: "\u8CC7\u6599\u5EAB\u540D\u7A31\uFF1A",
+      prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, data-admin, admin\uFF09\uFF1A",
+      env_parse_note: "\u63D0\u793A\uFF1A\u7121\u6CD5\u89E3\u6790 .env \u914D\u7F6E\uFF0C\u4F7F\u7528\u4E92\u52D5\u5F0F\u63D0\u793A",
+      connection_testing: "\u6B63\u5728\u6E2C\u8A66\u8CC7\u6599\u5EAB\u9023\u63A5...",
+      connection_success: "\u2713 \u8CC7\u6599\u5EAB\u9023\u63A5\u6210\u529F",
+      connection_failed: "\u2717 \u8CC7\u6599\u5EAB\u9023\u63A5\u5931\u6557",
+      config_saved: "\u914D\u7F6E\u5DF2\u4FDD\u5B58\u81F3 .dbcli",
+      config_saved_global: "\u5168\u57DF\u8A2D\u5B9A\u5DF2\u5132\u5B58\u81F3 {path}",
+      config_exists_overwrite: "\u914D\u7F6E\u6A94\u6848 .dbcli \u5DF2\u5B58\u5728\u3002\u662F\u5426\u8986\u84CB\uFF1F (y/n)\uFF1A",
+      cancelled: "\u5DF2\u53D6\u6D88\u3002\u914D\u7F6E\u672A\u66F4\u6539\u3002",
+      skip_test_env_ref: "\u8DF3\u904E\u9023\u7DDA\u6E2C\u8A66\uFF08\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u6A21\u5F0F\uFF09",
+      skip_test: "\u8DF3\u904E\u9023\u7DDA\u6E2C\u8A66\uFF08--skip-test\uFF09",
+      connection_hints: "\u63D0\u793A\uFF1A",
+      config_exists_use_force: ".dbcli \u5DF2\u5B58\u5728\u3002\u4F7F\u7528 --force \u9078\u9805\u8986\u84CB\u3002",
+      connection_added: "\u5DF2\u65B0\u589E\u9023\u7DDA '{name}'",
+      connection_removed: "\u5DF2\u79FB\u9664\u9023\u7DDA '{name}'",
+      connection_removed_default_cleared: "\u5DF2\u79FB\u9664\u9023\u7DDA '{name}'\uFF0C\u9810\u8A2D\u9023\u7DDA\u5DF2\u6E05\u7A7A\u3002\u57F7\u884C\u8CC7\u6599\u5EAB\u6307\u4EE4\u6642\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
+      connection_renamed: "\u5DF2\u5C07\u9023\u7DDA '{oldName}' \u91CD\u65B0\u547D\u540D\u70BA '{newName}'",
+      v1_migration_prompt: "\u5075\u6E2C\u5230\u820A\u683C\u5F0F\u8A2D\u5B9A\uFF0C\u5C07\u5EFA\u7ACB\u65B0\u683C\u5F0F\u4E26\u5C07\u73FE\u6709\u9023\u7DDA\u532F\u5165\u70BA 'default'\uFF0C\u662F\u5426\u7E7C\u7E8C\uFF1F",
+      config_saved_v2: "V2 \u8A2D\u5B9A\u5DF2\u5132\u5B58\u81F3 .dbcli",
+      config_not_found: "\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94",
+      requires_v2_remove: "\u79FB\u9664\u9023\u7DDA\u9700\u8981 V2 \u683C\u5F0F\u8A2D\u5B9A",
+      requires_v2_rename: "\u91CD\u65B0\u547D\u540D\u9023\u7DDA\u9700\u8981 V2 \u683C\u5F0F\u8A2D\u5B9A",
+      connection_not_found: "\u9023\u7DDA '{name}' \u4E0D\u5B58\u5728",
+      cannot_remove_last: "\u7121\u6CD5\u79FB\u9664\u6700\u5F8C\u4E00\u500B\u9023\u7DDA",
+      connection_already_exists: "\u9023\u7DDA '{name}' \u5DF2\u5B58\u5728",
+      rename_invalid_format: "\u7528\u6CD5\uFF1A--rename <\u820A\u540D\u7A31>:<\u65B0\u540D\u7A31>",
+      prompt_sqlite_file: "SQLite \u8CC7\u6599\u5EAB\u6A94\u6848\u8DEF\u5F91\uFF1A",
+      sql_tls_help: "\u9A57\u8B49\u5F0F SQL TLS \u6A21\u5F0F\uFF08verify-full\uFF1BPostgreSQL\uFF0FMySQL\uFF0FMariaDB\uFF09",
+      sql_tls_ca_help: "\u4F9B --sql-tls verify-full \u4F7F\u7528\u7684 PEM CA bundle"
+    },
+    inspect: {
+      description: "\u552F\u8B80\u6AA2\u8996\uFF1A\u9023\u7DDA\u3001\u6B0A\u9650\u3001\u9ED1\u540D\u55AE\u3001\u7269\u4EF6\u3001\u7247\u6BB5\u8207\u5EFA\u8B70\u4E0B\u4E00\u6B65\u6307\u4EE4\u3002",
+      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002"
+    },
+    report: {
+      description: "\u8A3A\u65B7\u5831\u544A\uFF08health/capacity/perf\uFF09\uFF1A\u4EE5\u5167\u5EFA\u7247\u6BB5\u7522\u751F\u552F\u8B80\u3001\u6709\u754C\u7684\u8A3A\u65B7\u5FEB\u7167\u3002",
+      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002",
+      section_invalid: "\u672A\u77E5\u7684 report section '{name}'\u3002\u5141\u8A31\u503C\uFF1Ahealth\u3001capacity\u3001perf"
+    },
+    guide: {
+      description: "\u91DD\u5C0D\u56FA\u5B9A\u8CC7\u6599\u5EAB\u76EE\u6A19\u6E05\u55AE\uFF0C\u8F38\u51FA\u53EF\u9810\u6E2C\u7684\u4E0B\u4E00\u6B65\u6307\u4EE4\u8A08\u756B\u3002",
+      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002",
+      missing_goal: "\u7F3A\u5C11 goal \u53C3\u6578\u3002\u8ACB\u57F7\u884C `dbcli guide --list` \u67E5\u770B\u53EF\u7528\u76EE\u6A19\u3002",
+      goal_invalid: "\u672A\u77E5\u7684 guide goal '{name}'\u3002\u8ACB\u57F7\u884C `dbcli guide --list` \u53D6\u5F97\u6709\u6548\u76EE\u6A19 ID\u3002"
+    },
+    recovery: {
+      description: "\u67E5\u8A62\u5DF2\u77E5 dbcli \u932F\u8AA4\u78BC\u5C0D\u61C9\u7684\u7D50\u69CB\u5316\u6062\u5FA9\u65B9\u6848\uFF0C\u6216\u5217\u51FA\u6240\u6709\u652F\u63F4\u7684\u932F\u8AA4\u78BC\u3002",
+      missing_code: "\u7F3A\u5C11 --code \u53C3\u6578\u3002\u8ACB\u57F7\u884C `dbcli recovery --list` \u67E5\u770B\u53EF\u7528\u4EE3\u78BC\u3002",
+      code_invalid: "\u672A\u77E5\u7684 recovery code '{name}'\u3002\u8ACB\u57F7\u884C `dbcli recovery --list` \u53D6\u5F97\u6709\u6548\u4EE3\u78BC\u3002",
+      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002"
+    },
+    use: {
+      description: "\u5207\u63DB\u6216\u986F\u793A\u9810\u8A2D\u8CC7\u6599\u5EAB\u9023\u7DDA",
+      switched: "\u5DF2\u5207\u63DB\u9810\u8A2D\u9023\u7DDA\u70BA {name}",
+      current: "\u76EE\u524D\u7684\u9810\u8A2D\u9023\u7DDA\uFF1A{name}",
+      current_none: "\u76EE\u524D\u6C92\u6709\u9810\u8A2D\u9023\u7DDA\u3002\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
+      unset: "\u9810\u8A2D\u9023\u7DDA\u5DF2\u6E05\u7A7A\u3002\u57F7\u884C\u8CC7\u6599\u5EAB\u6307\u4EE4\u6642\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
+      unset_conflict: "--unset \u4E0D\u53EF\u8207\u9023\u7DDA\u540D\u7A31\u3001--list\u3001--confirm-production \u6216 --format json \u540C\u6642\u4F7F\u7528",
+      requires_v2: "\u6B64\u529F\u80FD\u9700\u8981\u65B0\u683C\u5F0F\u8A2D\u5B9A\u3002\u8ACB\u4F7F\u7528 dbcli init --conn-name <\u540D\u7A31> \u5EFA\u7ACB\u591A\u9023\u7DDA\u8A2D\u5B9A",
+      available: "\u53EF\u7528\u9023\u7DDA"
+    },
+    schema: {
+      description: "\u6AA2\u7D22\u8868\u683C\u7D50\u69CB\u6216\u5217\u51FA\u6240\u6709\u8868\u683C",
+      fetching: "\u6B63\u5728\u6293\u53D6\u6A21\u5F0F...",
+      success: "\u6A21\u5F0F\u5DF2\u66F4\u65B0",
+      not_found: "\u8CC7\u6599\u5EAB\u4E2D\u627E\u4E0D\u5230\u8868\u683C",
+      refresh_prompt: "\u6A21\u5F0F\u6709\u8B8A\u66F4\u3002\u662F\u5426\u5957\u7528\uFF1F (y/n)\uFF1A",
+      columns_header: "\u6B04\u4F4D",
+      scanning_database: "\uD83D\uDD0D \u6B63\u5728\u6383\u63CF\u8CC7\u6599\u5EAB\u67B6\u69CB...",
+      tables_found: "\uD83D\uDCCD \u627E\u5230 {count} \u500B\u8868\u683C\u3002\u6B63\u5728\u7372\u53D6\u67B6\u69CB\u8A73\u60C5...",
+      processing_tables: "   \u8655\u7406\u4E86 {processed}/{total} \u500B\u8868\u683C",
+      schema_exists_warning: "\u26A0\uFE0F \u8CC7\u6599\u5EAB\u67B6\u69CB\u5DF2\u5B58\u5728\u65BC .dbcli",
+      use_force_to_override: "   \u4F7F\u7528 --force \u9032\u884C\u8986\u84CB\u800C\u7121\u9700\u78BA\u8A8D"
+    },
+    list: {
+      description: "\u5217\u51FA\u8CC7\u6599\u5EAB\u4E2D\u7684\u6240\u6709\u8868\u683C",
+      no_tables: "\u8CC7\u6599\u5EAB\u4E2D\u672A\u627E\u5230\u8868\u683C"
+    },
+    query: {
+      description: "\u57F7\u884C SQL \u67E5\u8A62",
+      executing: "\u6B63\u5728\u57F7\u884C\u67E5\u8A62...",
+      no_results: "\u672A\u8FD4\u56DE\u4EFB\u4F55\u7D50\u679C",
+      result_count: "\u7D50\u679C\uFF1A{count} \u5217"
+    },
+    q: {
+      description: "\u4F9D @name \u57F7\u884C\u5DF2\u4FDD\u5B58\u7684\u67E5\u8A62\u7247\u6BB5",
+      missing_param: "\u7247\u6BB5 '{name}' \u7F3A\u5C11\u5FC5\u8981\u53C3\u6578",
+      engine_mismatch: "\u7247\u6BB5 '{name}' \u5F15\u64CE\u4E0D\u7B26",
+      snippet_not_found: "\u627E\u4E0D\u5230\u7247\u6BB5\uFF1A{name}",
+      dry_run_header: "Dry-run \u9810\u89BD\uFF08\u4E0D\u6703\u57F7\u884C\uFF09\uFF1A"
+    },
+    audit: {
+      description: "\u6AA2\u8996\u3001\u67E5\u8A62\u3001\u6E05\u7A7A\u6216\u6AA2\u67E5 audit log \u5065\u5EB7\u72C0\u614B",
+      tail: {
+        description: "\u986F\u793A\u6700\u8FD1\u7684 audit \u7D00\u9304\uFF08\u9810\u8A2D\uFF1A\u7576\u524D\u9023\u7DDA\u6700\u5F8C 10 \u7B46\uFF09"
+      },
+      show: {
+        description: "\u4F9D id\uFF08UUID \u524D\u7DB4 \u22654 \u78BC\uFF09\u6216 --recovery-ref \u67E5\u8A62\u55AE\u7B46 audit \u7D00\u9304"
+      },
+      clear: {
+        description: "\u522A\u9664\u7576\u524D\u9023\u7DDA\u7684 audit log \u6A94\u6848\uFF08.jsonl \u8207 .jsonl.1\uFF09",
+        prompt_header: "\u5373\u5C07\u6E05\u7A7A\u9023\u7DDA '{conn}' \u7684 audit log\uFF1A",
+        prompt_file_line: "  {file}       \u2014 {entries} \u7B46\uFF0C{size}",
+        prompt_continue: "\u78BA\u8A8D\u57F7\u884C\uFF1F[y/N] ",
+        requires_tty_or_yes: "\u975E\u4E92\u52D5 session \u7121\u6CD5\u986F\u793A\u78BA\u8A8D\u63D0\u793A\u3002\u8ACB\u4F7F\u7528 --yes \u76F4\u63A5\u6E05\u7A7A\u3002",
+        summary_cleared: "\u5DF2\u5F9E '{conn}' \u6E05\u9664 {count} \u7B46 audit \u7D00\u9304\u3002",
+        summary_nothing: "\u6C92\u6709\u53EF\u6E05\u9664\u7684\u5167\u5BB9\u3002",
+        summary_failed: "\u6E05\u9664\u5931\u6557\uFF1A{message}\u3002"
+      },
+      health: {
+        description: "\u986F\u793A AuditLogger \u5065\u5EB7\u72C0\u614B\uFF08\u6A94\u6848\u5927\u5C0F\u3001\u7B46\u6578\u3001lock \u72C0\u614B\u3001\u6700\u5F8C\u5BEB\u5165\u7D50\u679C\uFF09"
+      },
+      write_gate: {
+        description: "\u7D71\u8A08\u7B2C\u4E8C\u7D1A\u5BEB\u5165\u9598\u9580\u7684\u5224\u5B9A\uFF08ADR 0010 \u62BC\u6CE8\u7684\u90A3\u500B\u91CF\u6E2C\uFF09",
+        header: "\u5BEB\u5165\u9598\u9580\u6458\u8981 \u2014 \u9023\u7DDA\uFF1A{conn}",
+        window: "\u6383\u904E\u7684\u7A3D\u6838\u7D00\u9304\uFF1A{scanned} \u7B46\uFF0C{from} \u2192 {to}",
+        decisions: "\u7B2C\u4E8C\u7D1A\u5224\u5B9A\uFF1A{count} \u6B21\uFF0C{from} \u2192 {to}",
+        tier_one: "\u7B2C\u4E00\u7D1A\uFF0C\u5206\u958B\u8A08\u7B97\uFF1A{count} \u6B21\uFF08{outcomes}\uFF09",
+        no_decisions: "\u9019\u6BB5\u5340\u9593\u5167\u7B2C\u4E8C\u7D1A\u4E00\u6B21\u90FD\u6C92\u88AB\u89F8\u53CA\u3002\u4F9D ADR 0010\uFF0C\u9019\u63A8\u7FFB\u7684\u662F\u5224\u6E96\u800C\u4E0D\u662F\u9598\u9580\uFF1A\u5B83\u5728\u627E\u7684\u5F62\u72C0\u4E0D\u662F\u5927\u5BB6\u5BE6\u969B\u6703\u5BEB\u7684\u5F62\u72C0\u3002",
+        no_entries: "\u7A3D\u6838\u7D00\u9304\u662F\u7A7A\u7684\uFF0C\u6240\u4EE5\u9019\u5C0D\u9598\u9580\u6C92\u6709\u4EFB\u4F55\u7D50\u8AD6\u3002\u5148\u8DD1\u4E00\u4E9B\u5BEB\u5165\uFF0C\u6216\u7528 `dbcli audit health` \u6AA2\u67E5\u3002"
+      },
+      disabled_hint: "Audit \u5DF2\u505C\u7528\uFF08.dbcli \u4E2D audit.enabled = false\uFF09\u3002\u57F7\u884C `dbcli audit health` \u67E5\u770B\u8A73\u60C5\u3002",
+      no_entries: "\u6C92\u6709 audit \u7D00\u9304\u3002",
+      show_no_match: "\u627E\u4E0D\u5230\u7B26\u5408 '{prefix}' \u7684 audit \u7D00\u9304\u3002",
+      show_ambiguous: "\u524D\u7DB4 '{prefix}' \u4E0D\u5920\u7CBE\u78BA\uFF1A\u5339\u914D\u5230 {count} \u7B46\u7D00\u9304\uFF0C\u8ACB\u6539\u7528\u66F4\u9577\u7684\u524D\u7DB4\u3002",
+      show_prefix_too_short: "\u524D\u7DB4\u81F3\u5C11\u9700 4 \u500B\u5B57\u5143\u3002",
+      show_recovery_no_match: "\u6C92\u6709\u4EFB\u4F55 audit \u7D00\u9304\u7684 recovery_ref \u70BA '{ref}'\u3002",
+      show_recovery_ambiguous: "\u6709 {count} \u7B46\u7D00\u9304\u7684 recovery_ref \u70BA '{ref}'\uFF0C\u9019\u61C9\u5C6C\u7F55\u898B\u60C5\u6CC1\uFF1B\u8ACB\u76F4\u63A5\u6AA2\u8996\u6A94\u6848\u3002",
+      show_mutex_violation: "\u8ACB\u64C7\u4E00\u63D0\u4F9B <id> \u53C3\u6578\u6216 --recovery-ref\uFF0C\u5169\u8005\u4E0D\u53EF\u540C\u6642\u4F7F\u7528\u3002",
+      n_capped_warning: "--n \u503C {requested} \u8D85\u904E\u4E0A\u9650 {max}\uFF0C\u5DF2\u81EA\u52D5\u7E2E\u6E1B\u70BA {max}\u3002",
+      n_must_be_positive: "--n \u5FC5\u9808\u70BA\u6B63\u6574\u6578\u3002"
+    },
+    queries: {
+      description: "\u7BA1\u7406\u5DF2\u4FDD\u5B58\u7684\u67E5\u8A62\u7247\u6BB5",
+      list_description: "\u5217\u51FA\u6240\u6709\u7247\u6BB5",
+      show_description: "\u986F\u793A\u7247\u6BB5\u5167\u5BB9\uFF08frontmatter + SQL\uFF09",
+      new_description: "\u5EFA\u7ACB\u65B0\u7684\u7247\u6BB5\u6A94",
+      edit_description: "\u4EE5 $EDITOR \u958B\u555F\u7247\u6BB5",
+      check_description: "\u9A57\u8B49\u6240\u6709\u7247\u6BB5",
+      delete_description: "\u522A\u9664 local snippet \u6A94\u6848",
+      rename_description: "\u91CD\u65B0\u547D\u540D local snippet",
+      copy_description: "\u5C07\u4EFB\u4E00\u5C64\u7D1A\u7684 snippet \u8907\u88FD\u5230 local",
+      import_description: "\u532F\u5165\u5916\u90E8 .sql \u6A94\u6848\u5230 local",
+      export_description: "\u5C07 snippet \u539F\u59CB SQL \u8F38\u51FA\u5230 stdout \u6216\u6A94\u6848",
+      created: "\u5DF2\u5EFA\u7ACB {file}",
+      first_run_hint: "\u63D0\u793A\uFF1A\u5C07 .dbcli-shared/ commit \u9032\u7248\u63A7\u53EF\u8207\u5718\u968A\u5171\u4EAB\u7247\u6BB5\u3002",
+      no_snippets: "\u5C1A\u7121\u4EFB\u4F55\u7247\u6BB5\u3002\u57F7\u884C dbcli queries new @<name> \u5EFA\u7ACB\u3002",
+      check_ok: "\u2713 \u6210\u529F\u89E3\u6790 {count} \u500B\u7247\u6BB5",
+      check_failed: "\u2717 \u6709 {count} \u500B\u7247\u6BB5\u89E3\u6790\u5931\u6557",
+      search_description: "\u4F9D\u95DC\u9375\u5B57\u641C\u5C0B snippet\uFF08fuzzy \u6392\u5E8F\uFF09",
+      suggest_description: "\u4F9D intent prefix \u63A8\u85A6 snippet",
+      search_no_keywords: "\u81F3\u5C11\u63D0\u4F9B\u4E00\u500B\u95DC\u9375\u5B57\uFF0C\u6216\u8A66\u8A66 'queries list' / 'queries suggest'\u3002",
+      search_no_results: "\u6C92\u6709\u547D\u4E2D\u7684 snippet\u3002\u8A66\u8A66 'queries list' \u6216 'queries suggest <intent>'\u3002",
+      suggest_missing_intent: "\u8ACB\u63D0\u4F9B intent\uFF08\u6216 prefix\uFF09\u3002\u53EF\u7528\uFF1A{available}",
+      suggest_invalid_intent: "Intent '{value}' \u683C\u5F0F\u932F\u8AA4\uFF0C\u5FC5\u9808\u7B26\u5408 ^[a-z][a-z0-9.-]*$",
+      suggest_no_results: "\u6C92\u6709 intent prefix \u70BA '{intent}' \u7684 snippet\u3002\u53EF\u7528\uFF1A{available}",
+      no_active_connection_hint: "\u5C1A\u672A\u8A2D\u5B9A connection\uFF1B\u5217\u51FA\u6240\u6709\u5F15\u64CE\u7684 snippet\u3002"
+    },
+    errors: {
+      message: "\u932F\u8AA4\uFF1A{message}",
+      query_only_boundary_failed: "\u7121\u6CD5\u70BA {system} \u5EFA\u7ACB query-only \u8CC7\u6599\u5EAB\u908A\u754C\uFF1A{detail}",
+      query_only_boundary_verify: "\u8ACB\u78BA\u8A8D {system} \u652F\u63F4\u552F\u8B80\u4EA4\u6613\uFF0C\u4E14\u6B64\u5E33\u865F\u53EF\u4EE5\u555F\u52D5\u4EA4\u6613",
+      query_only_boundary_not_executed: "\u76EE\u6A19\u8A9E\u53E5\u5C1A\u672A\u57F7\u884C\uFF1B\u8ACB\u4FEE\u6B63\u8CC7\u6599\u5EAB\u8A2D\u5B9A\u6216\u9023\u7DDA\u5F8C\u518D\u8A66",
+      query_only_cleanup_completed: "query-only \u76EE\u6A19\u5DF2\u5B8C\u6210\uFF0C\u4F46 {system} \u7684\u4EA4\u6613\u6E05\u7406\u5931\u6557\uFF1A{detail}",
+      query_only_cleanup_uncertain: "query-only \u76EE\u6A19\u5931\u6557\uFF0C\u4E14 {system} \u7684\u4EA4\u6613\u6E05\u7406\u4E5F\u5931\u6557\uFF0C\u56E0\u6B64\u7D50\u679C\u4E0D\u78BA\u5B9A\uFF1A{detail}",
+      query_only_cleanup_completed_retry: "\u76EE\u6A19\u8A9E\u53E5\u5DF2\u57F7\u884C\uFF1B\u9664\u975E\u53EF\u5B89\u5168\u91CD\u8907\u5176\u5916\u90E8\u526F\u4F5C\u7528\uFF0C\u5426\u5247\u4E0D\u8981\u91CD\u8A66",
+      query_only_cleanup_uncertain_retry: "\u76EE\u6A19\u8A9E\u53E5\u53EF\u80FD\u5728\u5931\u6557\u524D\u7522\u751F\u526F\u4F5C\u7528\uFF1B\u9664\u975E\u53EF\u5B89\u5168\u91CD\u8907\u9019\u4E9B\u526F\u4F5C\u7528\uFF0C\u5426\u5247\u4E0D\u8981\u91CD\u8A66",
+      query_only_cleanup_reconnect: "\u6B64\u9023\u7DDA\u5DF2\u4E1F\u68C4\uFF1B\u57F7\u884C\u4E0B\u4E00\u53E5\u524D\u8ACB\u5148\u91CD\u65B0\u9023\u7DDA",
+      invalid_config: "\u914D\u7F6E\u7121\u6548\uFF1A{field}",
+      connection_failed: "\u7121\u6CD5\u9023\u63A5\u5230\u8CC7\u6599\u5EAB\uFF1A{message}",
+      permission_denied: "\u6B0A\u9650\u88AB\u62D2\uFF08\u9700\u8981\uFF1A{required}\uFF09",
+      permission_requires_level: "{type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+      elasticsearch_requires_level: "Elasticsearch {type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
+      escalated_write_requires_admin: "\u6B64\u8A9E\u53E5\u8868\u9762\u4E0A\u662F\u8B80\u53D6\uFF0C\u4F46\u5BE6\u969B\u5305\u542B\u53EF\u57F7\u884C\u7684 {keyword}\u3002\u8B80\u53D6\u8A9E\u53E5\u4E2D\u96B1\u85CF\u5BEB\u5165\u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09\u3002",
+      multiple_statements_refused: "\u4F4E\u65BC admin \u6B0A\u9650\u6642\u62D2\u7D55\u57F7\u884C\u5305\u542B\u591A\u500B\u8A9E\u53E5\u7684 SQL\uFF0C\u56E0\u70BA\u6B0A\u9650\u6AA2\u67E5\u53EA\u6703\u4F9D\u64DA\u7B2C\u4E00\u500B\u8A9E\u53E5\u5224\u65B7\u3002\u8ACB\u5C07\u5404\u8A9E\u53E5\u5206\u958B\u57F7\u884C\u3002",
+      unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u9700\u8981 admin \u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
+      permission_denied_reason: "\u6B0A\u9650\u88AB\u62D2\uFF1A{reason}",
+      table_not_found: "\u627E\u4E0D\u5230\u8868\u683C\uFF1A{table}",
+      unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
+      invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
+      table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
+      redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
+      column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
+      table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
+      table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
+      column_already_blacklisted: "\u932F\u8AA4: \u6B04\u4F4D '{table}.{column}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
+      column_not_in_blacklist: "\u932F\u8AA4: \u6B04\u4F4D '{table}.{column}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
+      invalid_table_name: "\u932F\u8AA4: \u7121\u6548\u7684\u8868\u683C\u540D\u7A31: {table}",
+      invalid_column_format: "\u932F\u8AA4: \u7121\u6548\u7684\u6B04\u4F4D\u683C\u5F0F\u3002\u4F7F\u7528 'table.column'",
+      invalid_system: "\u7121\u6548\u7684\u8CC7\u6599\u5EAB\u7CFB\u7D71\uFF1A{system}",
+      invalid_permission: "\u7121\u6548\u7684\u6B0A\u9650\u7B49\u7D1A\uFF1A{permission}",
+      invalid_port: "\u7121\u6548\u7684\u57E0\u865F\uFF1A{port}",
+      require_user: "\u975E\u4E92\u52D5\u6A21\u5F0F\u9700\u8981 --user \u9078\u9805",
+      require_name: "\u975E\u4E92\u52D5\u6A21\u5F0F\u9700\u8981 --name \u9078\u9805",
+      env_refs_missing_options: `\u4F7F\u7528 --use-env-refs \u6642\uFF0C\u5FC5\u9808\u6307\u5B9A\u74B0\u5883\u8B8A\u6578\u540D\u7A31\u3002
+\u8ACB\u63D0\u4F9B\u9078\u9805\uFF1A--env-host\u3001--env-port\u3001--env-user\u3001--env-password\u3001--env-database
+\u6216\u4F7F\u7528\u4E92\u52D5\u6A21\u5F0F\uFF1A\u57F7\u884C "dbcli init --use-env-refs"\uFF08\u4E0D\u52A0 --no-interactive\uFF09`,
+      env_var_not_defined: `\u7121\u6CD5\u6E2C\u8A66\u9023\u7DDA\uFF1A\u74B0\u5883\u8B8A\u6578 {envKey} \u672A\u5B9A\u7FA9\u3002
+\u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u6578\u4E2D\u8A2D\u5B9A {envKey}\u3002
+\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`,
+      invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json",
+      sqlite_file_required: "SQLite \u9023\u7DDA\u9700\u8981\u4E00\u500B\u6A94\u6848\u8DEF\u5F91\u3002\u8ACB\u7528 --file <path>\uFF0C\u6216\u4EE5\u4E92\u52D5\u6A21\u5F0F\u57F7\u884C init\u3002",
+      sql_tls_unsupported: "\u660E\u78BA SQL TLS \u76EE\u524D\u50C5\u652F\u63F4 PostgreSQL\u3001MySQL \u8207 MariaDB",
+      sql_tls_options_required: "\u8ACB\u540C\u6642\u63D0\u4F9B --sql-tls verify-full \u8207 --sql-tls-ca <path>",
+      sql_tls_change_engine: "\u660E\u78BA SQL TLS \u76EE\u524D\u50C5\u652F\u63F4 PostgreSQL\u3001MySQL \u8207 MariaDB\uFF1B\u7DE8\u8F2F\u9023\u7DDA\u6642\u4E0D\u80FD\u6368\u68C4\u6B64\u8981\u6C42",
+      sql_tls_legacy_import: "\u4E0D\u652F\u63F4\u5E36\u6709 SQL TLS \u7684\u820A\u7248\u55AE\u6A94\u81EA\u52D5\u532F\u5165\u3002\u8ACB\u4FDD\u7559\u539F\u9023\u7DDA\uFF0C\u5728\u53E6\u4E00\u500B\u8A2D\u5B9A\u76EE\u9304\u5EFA\u7ACB\u4E26\u9A57\u8B49\u5177\u540D\u9023\u7DDA\u5F8C\u518D\u5207\u63DB\uFF1B\u4E0D\u8981\u79FB\u9664 SQL TLS\u3002",
+      sql_tls_ca_absolute: "SQL TLS CA \u8DEF\u5F91\u5FC5\u9808\u70BA\u7D55\u5C0D\u8DEF\u5F91",
+      sql_tls_network_host: "\u660E\u78BA SQL TLS \u5FC5\u9808\u6307\u5B9A DNS \u6216 IP \u4E3B\u6A5F\uFF0C\u4E0D\u63A5\u53D7 Unix socket",
+      sql_tls_ca_empty: "CA bundle \u4E0D\u542B PEM \u6191\u8B49",
+      sql_tls_ca_load: "\u7121\u6CD5\u8F09\u5165 SQL TLS CA bundle\uFF1A{detail}",
+      sql_tls_ca_restore: "\u8ACB\u6062\u5FA9 sqlTls.caPath \u6307\u5411\u7684\u53EF\u8B80\u6709\u6548 PEM CA bundle\uFF0C\u4E26\u4FDD\u6301 verify-full\u3002",
+      sql_tls_handshake: "TLS \u63E1\u624B\u5931\u6557\uFF1A{detail}",
+      sql_tls_ca_hint: "\u8ACB\u5C07 sqlTls.caPath \u8A2D\u70BA\u6B63\u78BA\u4E14\u53EF\u8B80\u7684 PEM CA bundle\u3002",
+      sql_tls_identity_hint: "\u8ACB\u78BA\u8A8D\u6191\u8B49\u6709\u6548\u671F\u53CA {host} \u7684 DNS\uFF0FIP \u8EAB\u5206\u76F8\u7B26\u3002",
+      sql_tls_no_downgrade: "\u8ACB\u4FDD\u6301 verify-full\uFF1B\u4E0D\u8981\u79FB\u9664 SQL TLS\uFF0C\u4E5F\u4E0D\u8981\u95DC\u9589\u9A57\u8B49\u5F8C\u91CD\u8A66\u3002",
+      sql_tls_driver_identity: "\u6B64\u9A45\u52D5\u7A0B\u5F0F\u7121\u6CD5\u57F7\u884C SQL TLS \u8EAB\u5206\u9A57\u8B49",
+      sql_tls_peer_unverified: "SQL TLS \u5C0D\u7AEF\u5C1A\u672A\u901A\u904E\u9A57\u8B49",
+      sql_tls_peer_missing: "\u7121\u6CD5\u53D6\u5F97 SQL TLS \u5C0D\u7AEF\u6191\u8B49",
+      sql_tls_recovery_config: "TLS \u5FA9\u539F\u9808\u660E\u78BA\u6307\u5B9A --config <path> \u6216 --global \u8207\u9810\u671F\u7684 TLS profile\uFF1B\u9810\u8A2D\u503C\u7121\u6CD5\u8B58\u5225\u5931\u6557\u7684\u76EE\u6A19\u3002",
+      sql_tls_recovery_profile: "TLS \u5FA9\u539F\u9808\u6307\u5B9A --use <name>\uFF08\u6216 DBCLI_CONNECTION\uFF09\uFF1B\u4E0D\u80FD\u9000\u56DE\u9810\u8A2D profile\u3002",
+      sql_tls_recovery_required: "TLS \u5FA9\u539F\u9808\u4F7F\u7528\u660E\u78BA\u8A2D\u5B9A sqlTls verify-full \u7684 profile\uFF1B\u62D2\u7D55\u660E\u6587\u5FA9\u539F\u3002",
+      sql_tls_recovery_target: "TLS \u5FA9\u539F\u9808\u660E\u78BA\u9078\u53D6\u5DF2\u8A2D\u5B9A\u9A57\u8B49\u5F0F TLS \u7684 profile\u3002"
+    },
+    success: {
+      inserted: "\u6210\u529F\u63D2\u5165 {count} \u5217",
+      updated: "\u6210\u529F\u66F4\u65B0 {count} \u5217",
+      deleted: "\u6210\u529F\u522A\u9664 {count} \u5217",
+      no_changes: "\u6C92\u6709\u8B8A\u66F4\u8981\u5957\u7528"
+    },
+    insert: {
+      description: "\u63D2\u5165\u8CC7\u6599\u5230\u8868\u683C",
+      prompt_data: "\u8F38\u5165\u8981\u63D2\u5165\u7684 JSON \u8CC7\u6599\uFF1A",
+      confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 insert \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u5BEB\u5165"
+    },
+    update: {
+      description: "\u66F4\u65B0\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
+      prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
+      prompt_set: '\u8F38\u5165 JSON \u66F4\u65B0 (\u4F8B\u5982\uFF1A{"status": "active"})\uFF1A',
+      confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 update \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u66F4\u65B0"
+    },
+    delete: {
+      description: "\u522A\u9664\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
+      prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
+      confirm: "\u522A\u9664 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
+      admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650",
+      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 delete \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u522A\u9664"
+    },
+    export: {
+      description: "\u532F\u51FA\u67E5\u8A62\u7D50\u679C",
+      formats: "\u652F\u63F4\u7684\u683C\u5F0F\uFF1Ajson\u3001csv",
+      exported: "\u5DF2\u5C07 {count} \u5217\u532F\u51FA\u81F3 {file}"
+    },
+    upgrade: {
+      description: "\u6AA2\u67E5\u66F4\u65B0\u4E26\u5C07 dbcli \u5347\u7D1A\u81F3\u6700\u65B0\u7248\u672C",
+      checking: "\u6B63\u5728\u6AA2\u67E5\u66F4\u65B0...",
+      already_up_to_date: "\u2713 \u5DF2\u7D93\u662F\u6700\u65B0\u7248\u672C (v{version})",
+      new_version_available: "\u767C\u73FE\u65B0\u7248\u672C\uFF1Av{version}",
+      current_version: "\u76EE\u524D\u7248\u672C\uFF1Av{version}",
+      latest_version: "\u6700\u65B0\u7248\u672C\uFF1Av{version}",
+      update_hint: '[\u63D0\u793A] dbcli v{version} \u5DF2\u767C\u5E03\u3002\u57F7\u884C "dbcli upgrade" \u9032\u884C\u5347\u7D1A\u3002',
+      install_hint: '\u57F7\u884C "dbcli upgrade" \u5B89\u88DD\u66F4\u65B0\u3002',
+      upgrading: "\u6B63\u5728\u5347\u7D1A...",
+      success: "\u2713 \u6210\u529F\u5347\u7D1A\u81F3 v{version}",
+      skill_recheck_hint: '\u63D0\u793A\uFF1A\u82E5\u5DF2\u5B89\u88DD AI \u6280\u80FD\uFF0C\u8ACB\u57F7\u884C "dbcli skill --install <platform>" \u78BA\u8A8D\u6280\u80FD\u70BA\u6700\u65B0\u7248\u672C\u3002',
+      failed: "\u2717 \u5347\u7D1A\u5931\u6557\u3002\u8ACB\u5617\u8A66\u624B\u52D5\u57F7\u884C\uFF1A",
+      manual_hint: "bun add -g @carllee1983/dbcli@latest",
+      network_error: "\u26A0 \u7121\u6CD5\u6AA2\u67E5\u66F4\u65B0\uFF08\u7DB2\u8DEF\u932F\u8AA4\u6216\u8A3B\u518A\u8868\u4E0D\u53EF\u7528\uFF09"
+    },
+    skill: {
+      description: "\u751F\u6210 AI \u6280\u80FD\u6587\u6A94",
+      context_description: "\u751F\u6210 AI \u5354\u4F5C\u6240\u9700\u7684\u8CC7\u6599\u5EAB\u67B6\u69CB\u8207\u67E5\u8A62\u7247\u6BB5\u4E0A\u4E0B\u6587",
+      installed: `\u6280\u80FD: {path}
+\u53C3\u8003: {referencePath}`,
+      update_available: "\u4EE5\u4E0B\u5E73\u53F0\u7684\u6280\u80FD\u9700\u8981\u66F4\u65B0\uFF1A",
+      update_hint: '\u57F7\u884C "dbcli skill --install <platform>" \u9032\u884C\u66F4\u65B0\u3002'
+    },
+    blacklist: {
+      description: "\u7BA1\u7406\u654F\u611F\u8CC7\u6599\u9ED1\u540D\u55AE\u4EE5\u9632\u6B62 AI \u5B58\u53D6",
+      list_title: "\u76EE\u524D\u9ED1\u540D\u55AE\u914D\u7F6E",
+      tables_label: "\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C",
+      columns_label: "\u5DF2\u9ED1\u540D\u55AE\u7684\u6B04\u4F4D",
+      none: "\u76EE\u524D\u6C92\u6709\u9ED1\u540D\u55AE\u8868\u683C\u6216\u6B04\u4F4D",
+      table_added: "\u2713 \u8868\u683C '{table}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
+      table_removed: "\u2713 \u8868\u683C '{table}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
+      column_added: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
+      column_removed: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
+      refuse_wildcard: "\u5DF2\u62D2\u7D55\uFF1A'{table}' \u542B\u6709\u842C\u7528\u5B57\u5143\uFF0C\u800C {system} \u4E0A\u7684\u6BD4\u5C0D\u662F\u9010\u5B57\u9032\u884C\u7684\u2014\u2014\u9019\u7B46\u8A2D\u5B9A\u6C38\u9060\u4E0D\u6703\u547D\u4E2D\u4EFB\u4F55\u6771\u897F\u3002\u8ACB\u5BEB\u51FA\u78BA\u5207\u7684\u540D\u7A31\u3002"
+    },
+    security: {
+      columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
+    },
+    warnings: {
+      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
+      redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
+    },
+    version: {
+      unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
+      doctor_pass: "{system} {version}\uFF08\u7B26\u5408 >= {minVersion}\uFF09",
+      doctor_warn: "{system} {version} \u4F4E\u65BC\u652F\u63F4\u7248\u672C >= {minVersion}"
+    },
+    migrate: {
+      description: "Schema DDL \u64CD\u4F5C\uFF08CREATE/DROP/ALTER TABLE\u3001INDEX\u3001CONSTRAINT\u3001ENUM\uFF09",
+      dry_run_preview: "[\u9810\u89BD] \u7522\u751F\u7684 SQL\uFF08\u672A\u57F7\u884C\uFF09\uFF1A",
+      executing: "\u57F7\u884C DDL \u4E2D...",
+      success: "DDL \u57F7\u884C\u6210\u529F",
+      confirm_drop: "\u9019\u662F\u7834\u58DE\u6027\u64CD\u4F5C\uFF08{operation}\uFF09\uFF0C\u78BA\u5B9A\u7E7C\u7E8C\uFF1F",
+      permission_required: "DDL \u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\uFF1A{permission}\uFF09",
+      blacklist_blocked: '\u8868\u683C "{table}" \u5DF2\u88AB\u5217\u5165\u9ED1\u540D\u55AE \u2014 DDL \u64CD\u4F5C\u88AB\u963B\u64CB',
+      schema_refreshed: '\u5DF2\u66F4\u65B0\u8868\u683C "{table}" \u7684 Schema \u5FEB\u53D6',
+      no_sql_generated: "\u672A\u7522\u751F SQL\uFF08\u6B64\u64CD\u4F5C\u4E0D\u9069\u7528\u65BC\u6B64\u8CC7\u6599\u5EAB\uFF09",
+      create_description: "\u5EFA\u7ACB\u65B0\u8868\u683C",
+      drop_description: "\u522A\u9664\u8868\u683C",
+      add_column_description: "\u65B0\u589E\u6B04\u4F4D\u81F3\u8868\u683C",
+      drop_column_description: "\u522A\u9664\u8868\u683C\u6B04\u4F4D",
+      alter_column_description: "\u4FEE\u6539\u8868\u683C\u6B04\u4F4D",
+      add_index_description: "\u65B0\u589E\u7D22\u5F15\u81F3\u8868\u683C",
+      drop_index_description: "\u522A\u9664\u7D22\u5F15",
+      add_constraint_description: "\u65B0\u589E\u7D04\u675F\u81F3\u8868\u683C",
+      drop_constraint_description: "\u522A\u9664\u8868\u683C\u7D04\u675F",
+      add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
+      alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
+      drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+    },
+    password: {
+      description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
+      arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
+      opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
+      opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
+      opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
+      prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
+      source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
+      needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
+      empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
+      updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
+      converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
+      skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
+    }
+  };
+});
+
+// resources/lang/en/shell.json
+var shell_default;
+var init_shell = __esm(() => {
+  shell_default = {
+    welcome: "Connected to {system} ({database}@{host}:{port})",
+    welcome_permission: "Permission: {permission}",
+    prompt: "dbcli",
+    continuation_prompt: "   ...",
+    goodbye: "Goodbye.",
+    error_no_config: "No .dbcli config found. Run 'dbcli init' first.",
+    error_connection_failed: "Connection failed: {message}",
+    error_reconnecting: "Connection lost. Attempting to reconnect...",
+    error_reconnect_failed: "Reconnection failed: {message}",
+    error_reconnect_success: "Reconnected successfully.",
+    error_command_failed: "Command error: {message}",
+    error_sql_failed: "SQL error: {message}",
+    error_permission: "Permission denied. Required: {required} (current: {current})",
+    error_blacklisted: "Table '{table}' is blacklisted.",
+    sql_mode_hint: "SQL-only mode. Only SQL statements are accepted.",
+    multiline_cancelled: "Multiline input cancelled.",
+    timing_display: "Time: {ms}ms",
+    rows_display: "{count} row(s)",
+    unknown_command: "Unknown command: '{command}'. Type '.help' for available commands.",
+    subcommand_prefix_hint: "This line is being read as SQL and is waiting for its `;`. If you meant the dbcli subcommand, type {command} instead. Ctrl-C cancels.",
+    es: {
+      parse_empty: "Empty request",
+      parse_needs_method_path: 'Request requires a method and a path, e.g. "GET /index/_search"',
+      parse_needs_path: "Request requires a path",
+      refuse_dot_segment: "Refused: '{path}' contains a '..' segment once decoded, and dbcli cannot tell which path Elasticsearch would route it to. Write the path out without '..'.",
+      refuse_unparseable: "Refused: '{path}' is not the request the server would receive. It cannot be parsed as a path.",
+      refuse_not_canonical: "Refused: '{path}' is not the request the server would receive. Write it as '{canonical}'.",
+      refuse_source_param: "Refused: `source` in the query string is a request body by another route. Write the body as JSON.",
+      refuse_search_template: "Refused: '{path}' is a search template, whose body cannot be inspected \u2014 it is a string rendered on the cluster, or stored there. Write the query out in full.",
+      refuse_string_body: "Refused: a quoted string request body is not supported. Write the body as JSON.",
+      refuse_audit_strict: "Refused: the audit entry for this request could not be written, and audit.strict is on. Fix the audit sink (disk space, directory permissions, a stale lockfile in .dbcli/audit) or turn audit.strict off to accept unrecorded requests.",
+      blacklist_index: "index '{index}' is blacklist-protected",
+      blacklist_unscoped: "'{path}' names no index, so it cannot be checked against the blacklist. Scope the request to an index, e.g. GET /<index>/_search.",
+      blacklist_field: "field '{field}' is blacklist-protected and cannot be named in a request \u2014 sorting, aggregating or scripting on it would return its values.",
+      banner_title: "Elasticsearch shell \u2014 Kibana Dev Tools syntax",
+      banner_hint: 'Enter "<METHOD> /<path>" then an optional JSON body; submit with a blank line. Try: GET /_cat/indices',
+      banner_keys: 'Ctrl+C cancels the current block; Ctrl+D or "exit" quits.',
+      block_cancelled: "(block cancelled)",
+      goodbye: "Goodbye"
+    }
+  };
+});
+
+// resources/lang/zh-TW/shell.json
+var shell_default2;
+var init_shell2 = __esm(() => {
+  shell_default2 = {
+    welcome: "\u5DF2\u9023\u7DDA\u81F3 {system}\uFF08{database}@{host}:{port}\uFF09",
+    welcome_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF1A{permission}",
+    prompt: "dbcli",
+    continuation_prompt: "   ...",
+    goodbye: "\u518D\u898B\u3002",
+    error_no_config: "\u627E\u4E0D\u5230 .dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C 'dbcli init'\u3002",
+    error_connection_failed: "\u9023\u7DDA\u5931\u6557\uFF1A{message}",
+    error_reconnecting: "\u9023\u7DDA\u5DF2\u4E2D\u65B7\uFF0C\u5617\u8A66\u91CD\u65B0\u9023\u7DDA...",
+    error_reconnect_failed: "\u91CD\u65B0\u9023\u7DDA\u5931\u6557\uFF1A{message}",
+    error_reconnect_success: "\u91CD\u65B0\u9023\u7DDA\u6210\u529F\u3002",
+    error_command_failed: "\u6307\u4EE4\u932F\u8AA4\uFF1A{message}",
+    error_sql_failed: "SQL \u932F\u8AA4\uFF1A{message}",
+    error_permission: "\u6B0A\u9650\u4E0D\u8DB3\u3002\u9700\u8981\uFF1A{required}\uFF08\u76EE\u524D\uFF1A{current}\uFF09",
+    error_blacklisted: "\u8868\u683C '{table}' \u5DF2\u88AB\u5217\u5165\u9ED1\u540D\u55AE\u3002",
+    sql_mode_hint: "\u7D14 SQL \u6A21\u5F0F\u3002\u50C5\u63A5\u53D7 SQL \u8A9E\u53E5\u3002",
+    multiline_cancelled: "\u5DF2\u53D6\u6D88\u591A\u884C\u8F38\u5165\u3002",
+    timing_display: "\u8017\u6642\uFF1A{ms}ms",
+    rows_display: "{count} \u7B46\u8CC7\u6599",
+    unknown_command: "\u672A\u77E5\u6307\u4EE4\uFF1A'{command}'\u3002\u8F38\u5165 '.help' \u67E5\u770B\u53EF\u7528\u6307\u4EE4\u3002",
+    subcommand_prefix_hint: "\u9019\u4E00\u884C\u88AB\u7576\u6210 SQL\uFF0C\u6B63\u5728\u7B49\u5206\u865F\u3002\u5982\u679C\u4F60\u8981\u7684\u662F dbcli \u5B50\u6307\u4EE4\uFF0C\u8ACB\u6539\u6253 {command}\u3002Ctrl-C \u53EF\u53D6\u6D88\u3002",
+    es: {
+      parse_empty: "\u7A7A\u7684\u8ACB\u6C42",
+      parse_needs_method_path: '\u8ACB\u6C42\u9700\u8981\u4E00\u500B method \u8207\u4E00\u500B path\uFF0C\u4F8B\u5982 "GET /index/_search"',
+      parse_needs_path: "\u8ACB\u6C42\u9700\u8981\u4E00\u500B path",
+      refuse_dot_segment: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u89E3\u78BC\u5F8C\u542B\u6709 '..' \u5340\u6BB5\uFF0Cdbcli \u7121\u6CD5\u5224\u65B7 Elasticsearch \u6703\u628A\u5B83\u8DEF\u7531\u5230\u54EA\u500B\u8DEF\u5F91\u3002\u8ACB\u628A\u8DEF\u5F91\u5BEB\u6210\u4E0D\u542B '..' \u7684\u5F62\u5F0F\u3002",
+      refuse_unparseable: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u5B83\u7121\u6CD5\u88AB\u89E3\u6790\u6210\u4E00\u500B\u8DEF\u5F91\u3002",
+      refuse_not_canonical: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u8ACB\u5BEB\u6210 '{canonical}'\u3002",
+      refuse_source_param: "\u5DF2\u62D2\u7D55\uFF1Aquery string \u88E1\u7684 `source` \u662F\u53E6\u4E00\u689D\u8DEF\u5F91\u4E0A\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
+      refuse_search_template: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u662F search template\uFF0C\u5B83\u7684 body \u7121\u6CD5\u6AA2\u67E5\u2014\u2014\u90A3\u662F\u4E00\u500B\u5728\u53E2\u96C6\u4E0A\u7B97\u51FA\u4F86\u7684\u5B57\u4E32\uFF0C\u6216\u8005\u6839\u672C\u5B58\u5728\u53E2\u96C6\u88E1\u3002\u8ACB\u628A\u67E5\u8A62\u5B8C\u6574\u5BEB\u51FA\u4F86\u3002",
+      refuse_string_body: "\u5DF2\u62D2\u7D55\uFF1A\u4E0D\u652F\u63F4\u4EE5\u5F15\u865F\u5B57\u4E32\u5F62\u5F0F\u5BEB\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
+      refuse_audit_strict: "\u5DF2\u62D2\u7D55\uFF1A\u9019\u500B\u8ACB\u6C42\u7684\u7A3D\u6838\u7D00\u9304\u5BEB\u4E0D\u51FA\u53BB\uFF0C\u800C audit.strict \u662F\u958B\u7684\u3002\u8ACB\u4FEE\u597D\u7A3D\u6838\u8F38\u51FA\u7AEF\uFF08\u78C1\u789F\u7A7A\u9593\u3001\u76EE\u9304\u6B0A\u9650\u3001.dbcli/audit \u88E1\u6B98\u7559\u7684 lockfile\uFF09\uFF0C\u6216\u95DC\u6389 audit.strict \u4EE5\u63A5\u53D7\u6C92\u6709\u7D00\u9304\u7684\u8ACB\u6C42\u3002",
+      blacklist_index: "\u7D22\u5F15 '{index}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77",
+      blacklist_unscoped: "'{path}' \u6307\u4E0D\u51FA\u4EFB\u4F55\u7D22\u5F15\uFF0C\u56E0\u6B64\u7121\u6CD5\u5C0D\u7167\u9ED1\u540D\u55AE\u6AA2\u67E5\u3002\u8ACB\u628A\u8ACB\u6C42\u9650\u5B9A\u5230\u67D0\u500B\u7D22\u5F15\uFF0C\u4F8B\u5982 GET /<index>/_search\u3002",
+      blacklist_field: "\u6B04\u4F4D '{field}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77\uFF0C\u4E0D\u80FD\u51FA\u73FE\u5728\u8ACB\u6C42\u88E1\u2014\u2014\u5C0D\u5B83\u6392\u5E8F\u3001\u805A\u5408\u6216\u8DD1 script \u90FD\u6703\u628A\u5B83\u7684\u503C\u53D6\u56DE\u4F86\u3002",
+      banner_title: "Elasticsearch shell \u2014\u2014 Kibana Dev Tools \u8A9E\u6CD5",
+      banner_hint: '\u8F38\u5165 "<METHOD> /<path>"\uFF0C\u63A5\u8457\u5BEB\u53EF\u9078\u7684 JSON body\uFF1B\u7A7A\u4E00\u884C\u9001\u51FA\u3002\u53EF\u4EE5\u5148\u8A66\uFF1AGET /_cat/indices',
+      banner_keys: 'Ctrl+C \u53D6\u6D88\u76EE\u524D\u9019\u500B block\uFF1BCtrl+D \u6216 "exit" \u96E2\u958B\u3002',
+      block_cancelled: "\uFF08block \u5DF2\u53D6\u6D88\uFF09",
+      goodbye: "\u518D\u898B"
+    }
+  };
+});
+
+// resources/lang/en/ceremony.json
+var ceremony_default;
+var init_ceremony = __esm(() => {
+  ceremony_default = {
+    updated: "Updated {count} row(s) in {table}",
+    deleted: "Deleted {count} row(s) from {table}",
+    inserted: "Inserted {count} row(s) into {table}",
+    matched_nothing: "No rows matched in {table} \u2014 nothing changed",
+    cancelled: "Cancelled. {table} was not changed",
+    dry_run: "Preview only. {table} was not changed",
+    elapsed: "Took {seconds}s",
+    failed: "Failed: {reason}",
+    unknown_error: "unknown error",
+    confirm_sql: "Generated SQL:",
+    confirm_command: "Command to run:",
+    confirm_params: "Parameters:",
+    confirm_destructive_warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
+    confirm_destructive_prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone.",
+    confirm_destructive_warning_ddl: "\u26A0\uFE0F  Warning: this schema change is destructive and cannot be undone!",
+    confirm_ddl_prompt: "Are you sure you want to run this {operation}? This cannot be undone.",
+    confirm_prompt: "Proceed with this operation?",
+    gate_summary: "This will {operation} rows in {table}.",
+    gate_summary_untargeted: "This will run a {operation} statement.",
+    gate_statement: "Statement:",
+    gate_cancelled: "Cancelled. Nothing was run.",
+    gate_full_table_warning: "\u26A0\uFE0F  This affects EVERY row in {table} and cannot be undone.",
+    gate_ddl_warning: "\u26A0\uFE0F  This destroys {table} and cannot be undone.",
+    gate_ddl_warning_untargeted: "\u26A0\uFE0F  This is a destructive schema change and cannot be undone.",
+    gate_unparseable_warning: "\u26A0\uFE0F  dbcli could not parse this statement, so it is treated as affecting everything.",
+    gate_multiple_statements_warning: "\u26A0\uFE0F  This is more than one statement, and dbcli will not judge them one at a time.",
+    gate_multi_table_warning: "This write joins another table. How many rows of the target it touches depends on the data, not on the statement, so it cannot be checked before it runs.",
+    gate_nested_write_warning: "\u26A0\uFE0F  This statement carries a second write inside it, and dbcli will not read the tier of that write off this one.",
+    gate_typed_prompt: "Type {phrase} to run it",
+    gate_typed_mismatch: "That did not match {phrase}. Nothing was run.",
+    gate_refused: "Refused: this statement is not limited to specific rows and nobody is here to confirm it (reason={reason}).",
+    gate_refused_in_shell: "Refused: a dbcli subcommand started from the shell has no way to ask you, even though you are right here (reason={reason}).",
+    gate_remedy_no_where: "Add a WHERE clause \u2014 WHERE 1=1 if you really do mean every row \u2014 or a LIMIT, then run it again.",
+    gate_remedy_ddl_destruction: "No flag skips this. Run it from an interactive terminal, or apply the schema change through a reviewed migration.",
+    gate_remedy_unparseable: "dbcli could not parse this statement and will not guess. Simplify it, or run it from an interactive terminal.",
+    gate_remedy_multiple_statements: "Run one statement per command.",
+    gate_remedy_multi_table: "Rewrite it as a single-table statement \u2014 move the other table into a subquery in the WHERE \u2014 or run it where someone can confirm it.",
+    gate_remedy_nested_write: "Run the nested write as its own statement, or run this one where someone can confirm it.",
+    gate_remedy_non_unique_where: "Match on a primary key or a uniquely indexed column, or run it from an interactive terminal.",
+    gate_remedy_in_shell: "Type the statement at the dbcli> prompt instead \u2014 there the shell asks you to type the target table name.",
+    recovery_none: "This cannot be undone automatically \u2014 restore from a backup to get the previous values back.",
+    recovery_retry: "Re-run with --recovery to write a recovery plan, then read it with: dbcli recover",
+    blacklist_hint: "Run `dbcli blacklist list` to see what is protected"
+  };
+});
+
+// resources/lang/zh-TW/ceremony.json
+var ceremony_default2;
+var init_ceremony2 = __esm(() => {
+  ceremony_default2 = {
+    updated: "\u5DF2\u66F4\u65B0 {table} \u7684 {count} \u5217",
+    deleted: "\u5DF2\u5F9E {table} \u522A\u9664 {count} \u5217",
+    inserted: "\u5DF2\u5BEB\u5165 {count} \u5217\u5230 {table}",
+    matched_nothing: "{table} \u6C92\u6709\u4EFB\u4F55\u5217\u7B26\u5408\u689D\u4EF6\uFF0C\u8CC7\u6599\u672A\u8B8A\u52D5",
+    cancelled: "\u5DF2\u53D6\u6D88\uFF0C{table} \u672A\u8B8A\u52D5",
+    dry_run: "\u50C5\u9810\u89BD\uFF0C{table} \u672A\u8B8A\u52D5",
+    elapsed: "\u8017\u6642 {seconds} \u79D2",
+    failed: "\u5931\u6557\uFF1A{reason}",
+    unknown_error: "\u672A\u77E5\u7684\u932F\u8AA4",
+    confirm_sql: "\u7522\u751F\u7684 SQL\uFF1A",
+    confirm_command: "\u5373\u5C07\u57F7\u884C\u7684\u6307\u4EE4\uFF1A",
+    confirm_params: "\u53C3\u6578\uFF1A",
+    confirm_destructive_warning: "\u26A0\uFE0F  \u8B66\u544A\uFF1ADELETE \u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+    confirm_destructive_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B DELETE \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+    confirm_destructive_warning_ddl: "\u26A0\uFE0F  \u8B66\u544A\uFF1A\u9019\u500B schema \u8B8A\u66F4\u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
+    confirm_ddl_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B {operation} \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
+    confirm_prompt: "\u8981\u7E7C\u7E8C\u57F7\u884C\u9019\u500B\u64CD\u4F5C\u55CE\uFF1F",
+    gate_summary: "\u9019\u53E5\u6703\u5C0D {table} \u57F7\u884C {operation}\u3002",
+    gate_summary_untargeted: "\u9019\u53E5\u6703\u57F7\u884C {operation}\u3002",
+    gate_statement: "\u8A9E\u53E5\uFF1A",
+    gate_cancelled: "\u5DF2\u53D6\u6D88\uFF0C\u6C92\u6709\u57F7\u884C\u4EFB\u4F55\u8A9E\u53E5\u3002",
+    gate_full_table_warning: "\u26A0\uFE0F  \u9019\u53E5\u6703\u5F71\u97FF {table} \u7684\u6BCF\u4E00\u5217\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
+    gate_ddl_warning: "\u26A0\uFE0F  \u9019\u53E5\u6703\u6467\u6BC0 {table}\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
+    gate_ddl_warning_untargeted: "\u26A0\uFE0F  \u9019\u662F\u7834\u58DE\u6027\u7684 schema \u8B8A\u66F4\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
+    gate_unparseable_warning: "\u26A0\uFE0F  dbcli \u7121\u6CD5\u89E3\u6790\u9019\u53E5\uFF0C\u56E0\u6B64\u4E00\u5F8B\u8996\u70BA\u6703\u5F71\u97FF\u5168\u90E8\u8CC7\u6599\u3002",
+    gate_multiple_statements_warning: "\u26A0\uFE0F  \u9019\u88E1\u4E0D\u53EA\u4E00\u53E5\u8A9E\u53E5\uFF0Cdbcli \u4E0D\u6703\u9010\u53E5\u5224\u65B7\u3002",
+    gate_multi_table_warning: "\u9019\u500B\u5BEB\u5165\u63A5\u4E86\u53E6\u4E00\u5F35\u8868\u3002\u5B83\u6703\u52D5\u5230\u76EE\u6A19\u8868\u5E7E\u5217\u53D6\u6C7A\u65BC\u8CC7\u6599\u800C\u4E0D\u662F\u8A9E\u53E5\u672C\u8EAB\uFF0C\u57F7\u884C\u524D\u7121\u6CD5\u6AA2\u67E5\u3002",
+    gate_nested_write_warning: "\u26A0\uFE0F  \u9019\u53E5\u88E1\u9762\u9084\u593E\u8457\u53E6\u4E00\u500B\u5BEB\u5165\uFF0Cdbcli \u4E0D\u6703\u62FF\u9019\u53E5\u7684\u5C64\u7D1A\u4EE3\u66FF\u90A3\u500B\u5BEB\u5165\u7684\u5C64\u7D1A\u3002",
+    gate_typed_prompt: "\u8F38\u5165 {phrase} \u624D\u6703\u57F7\u884C",
+    gate_typed_mismatch: "\u8F38\u5165\u7684\u5167\u5BB9\u8207 {phrase} \u4E0D\u7B26\uFF0C\u6C92\u6709\u57F7\u884C\u4EFB\u4F55\u8A9E\u53E5\u3002",
+    gate_refused: "\u5DF2\u62D2\u7D55\uFF1A\u9019\u53E5\u6C92\u6709\u9650\u5B9A\u8981\u52D5\u54EA\u4E9B\u5217\uFF0C\u800C\u73FE\u5728\u6C92\u6709\u4EBA\u80FD\u78BA\u8A8D\uFF08reason={reason}\uFF09\u3002",
+    gate_refused_in_shell: "\u5DF2\u62D2\u7D55\uFF1A\u5F9E shell \u555F\u52D5\u7684 dbcli \u5B50\u6307\u4EE4\u6C92\u6709\u8FA6\u6CD5\u5411\u4F60\u63D0\u554F\uFF0C\u5373\u4F7F\u4F60\u4EBA\u5C31\u5728\u9019\u88E1\uFF08reason={reason}\uFF09\u3002",
+    gate_remedy_no_where: "\u88DC\u4E0A WHERE\uFF08\u771F\u7684\u8981\u5168\u8868\u5C31\u5BEB WHERE 1=1\uFF09\u6216 LIMIT\uFF0C\u7136\u5F8C\u91CD\u8DD1\u3002",
+    gate_remedy_ddl_destruction: "\u6C92\u6709\u4EFB\u4F55\u65D7\u6A19\u53EF\u4EE5\u8DF3\u904E\u9019\u4E00\u95DC\u3002\u8ACB\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\uFF0C\u6216\u6539\u8D70\u7D93\u904E\u5BE9\u67E5\u7684 migration\u3002",
+    gate_remedy_unparseable: "dbcli \u7121\u6CD5\u89E3\u6790\u9019\u53E5\uFF0C\u4E5F\u4E0D\u6703\u7528\u731C\u7684\u3002\u8ACB\u7C21\u5316\u8A9E\u53E5\uFF0C\u6216\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\u3002",
+    gate_remedy_multiple_statements: "\u4E00\u6B21\u53EA\u57F7\u884C\u4E00\u53E5\u8A9E\u53E5\u3002",
+    gate_remedy_multi_table: "\u6539\u5BEB\u6210\u55AE\u8868\u8A9E\u53E5\u2014\u2014\u628A\u53E6\u4E00\u5F35\u8868\u79FB\u9032 WHERE \u7684\u5B50\u67E5\u8A62\u88E1\u2014\u2014\u6216\u6539\u5728\u6709\u4EBA\u53EF\u4EE5\u78BA\u8A8D\u7684\u5730\u65B9\u57F7\u884C\u3002",
+    gate_remedy_nested_write: "\u628A\u88E1\u9762\u90A3\u500B\u5BEB\u5165\u62C6\u6210\u7368\u7ACB\u7684\u4E00\u53E5\u4F86\u57F7\u884C\uFF0C\u6216\u6539\u5728\u6709\u4EBA\u53EF\u4EE5\u78BA\u8A8D\u7684\u5730\u65B9\u57F7\u884C\u3002",
+    gate_remedy_non_unique_where: "\u6539\u7528\u4E3B\u9375\u6216\u552F\u4E00\u7D22\u5F15\u6B04\u4F4D\u7576\u689D\u4EF6\uFF0C\u6216\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\u3002",
+    gate_remedy_in_shell: "\u8ACB\u76F4\u63A5\u5728 dbcli> \u63D0\u793A\u7B26\u6253\u9019\u53E5\u8A9E\u53E5\u2014\u2014\u5728\u90A3\u88E1 dbcli \u6703\u8ACB\u4F60\u6253\u51FA\u76EE\u6A19\u8CC7\u6599\u8868\u7684\u540D\u7A31\u4F86\u78BA\u8A8D\u3002",
+    recovery_none: "\u6B64\u64CD\u4F5C\u7121\u6CD5\u81EA\u52D5\u9084\u539F\uFF0C\u8981\u53D6\u56DE\u5148\u524D\u7684\u8CC7\u6599\u8ACB\u5F9E\u5099\u4EFD\u56DE\u5FA9\u3002",
+    recovery_retry: "\u52A0\u4E0A --recovery \u91CD\u8DD1\u53EF\u7522\u751F\u56DE\u5FA9\u8A08\u756B\uFF0C\u518D\u7528 dbcli recover \u8B80\u53D6",
+    blacklist_hint: "\u57F7\u884C `dbcli blacklist list` \u67E5\u770B\u53D7\u4FDD\u8B77\u7684\u9805\u76EE"
+  };
+});
+
+// src/i18n/message-loader.ts
+class MessageLoader {
+  static instance = null;
+  messages = {};
+  fallbackMessages = {};
+  currentLang;
+  constructor() {
+    this.currentLang = Bun.env.DBCLI_LANG || "en", this.loadMessages();
+  }
+  static getInstance() {
+    if (!MessageLoader.instance)
+      MessageLoader.instance = new MessageLoader;
+    return MessageLoader.instance;
+  }
+  loadMessages() {
+    if (this.currentLang !== "en")
+      this.messages = BUNDLED_MESSAGES[this.currentLang] || {};
+    this.fallbackMessages = BUNDLED_MESSAGES.en || {};
+  }
+  t(key) {
+    let parts = key.split("."), value = this.messages;
+    for (let part of parts)
+      if (value && typeof value === "object")
+        value = value[part];
+      else {
+        value = void 0;
+        break;
+      }
+    if (typeof value === "string")
+      return value;
+    value = this.fallbackMessages;
+    for (let part of parts)
+      if (value && typeof value === "object")
+        value = value[part];
+      else {
+        value = void 0;
+        break;
+      }
+    if (typeof value === "string")
+      return value;
+    return key;
+  }
+  setLanguage(lang) {
+    this.currentLang = lang, this.messages = {}, this.loadMessages();
+  }
+  interpolate(key, vars) {
+    return this.t(key).replace(/\{([^{}]+)\}/g, (match, name) => Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : match);
+  }
+}
+var BUNDLED_MESSAGES, messageLoader, t = (key) => messageLoader.t(key), t_vars = (key, vars) => messageLoader.interpolate(key, vars);
+var init_message_loader = __esm(() => {
+  init_messages();
+  init_messages2();
+  init_shell();
+  init_shell2();
+  init_ceremony();
+  init_ceremony2();
+  BUNDLED_MESSAGES = {
+    en: { ...messages_default, shell: shell_default, ceremony: ceremony_default },
+    "zh-TW": {
+      ...messages_default2,
+      shell: shell_default2,
+      ceremony: ceremony_default2
+    }
+  };
+  messageLoader = MessageLoader.getInstance();
+});
+
 // node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   switch (typeof data) {
@@ -5119,7 +6142,261 @@ var init_zod = __esm(() => {
   init_external();
 });
 
+// src/adapters/capabilities.ts
+function cap(status, tier, note) {
+  return Object.freeze({ status, tier, note });
+}
+function getEngineCapabilities(system) {
+  return Object.freeze({ ...ENGINE_CAPABILITIES[system] });
+}
+function getEngineCapability(system, key) {
+  return ENGINE_CAPABILITIES[system][key];
+}
+function supportsCapability(system, key) {
+  return getEngineCapability(system, key).status === "supported";
+}
+function supportsSqlTls(system) {
+  return typeof system === "string" && Object.hasOwn(ENGINE_CAPABILITIES, system) && supportsCapability(system, "connectionTls");
+}
+var COMMAND_CAPABILITY_KEYS, ENGINE_INDEPENDENT, SQL_BASE, SQL_ONLY_UNSUPPORTED, SQL_MODE_LIMITED, VERIFIED_SQL_TLS, ENGINE_CAPABILITIES;
+var init_capabilities = __esm(() => {
+  COMMAND_CAPABILITY_KEYS = Object.freeze([
+    "connectionTls",
+    "init",
+    "use",
+    "list",
+    "schema",
+    "schemaSingle",
+    "schemaFullScan",
+    "query",
+    "lint",
+    "queryOutput",
+    "queryLimitGuard",
+    "q",
+    "queries",
+    "insert",
+    "update",
+    "delete",
+    "export",
+    "blacklistRead",
+    "blacklist",
+    "check",
+    "diff",
+    "migrate",
+    "shell",
+    "status",
+    "doctor",
+    "inspect",
+    "report",
+    "guide",
+    "completion",
+    "upgrade",
+    "recover",
+    "skill",
+    "auditTail",
+    "auditShow",
+    "auditClear",
+    "auditHealth",
+    "explain",
+    "plan",
+    "impactAssess",
+    "assert",
+    "snapshot",
+    "verify",
+    "semantic",
+    "design",
+    "proxy",
+    "proxyAnalyze",
+    "verification",
+    "verificationPrune",
+    "evidence",
+    "contract",
+    "recovery",
+    "backfillArtifact",
+    "password",
+    "capabilityDiscover",
+    "capabilityCheck"
+  ]);
+  ENGINE_INDEPENDENT = {
+    completion: cap("not-applicable", "none", "Shell completion is engine-independent."),
+    upgrade: cap("not-applicable", "local-write", "Package update checks are engine-independent."),
+    recover: cap("not-applicable", "dry-run", "Recovery operates on saved envelopes and gated command steps."),
+    skill: cap("not-applicable", "local-write", "Skill and task-pack generation are engine-independent."),
+    auditTail: cap("supported", "readonly", "Reads JSONL audit entries; never writes to engines."),
+    auditShow: cap("supported", "readonly", "Looks up a single audit entry by id prefix or recovery_ref."),
+    auditHealth: cap("supported", "readonly", "Renders AuditLogger.getHealth() snapshot."),
+    auditClear: cap("supported", "local-write", "Removes <conn>.jsonl + .jsonl.1 from local disk; never touches DB.")
+  }, SQL_BASE = {
+    connectionTls: cap("unsupported", "none", "Explicit verified SQL TLS is not supported by this engine."),
+    init: cap("supported", "interactive", "SQL connection initialization is supported."),
+    use: cap("supported", "local-write", "V2 config supports named SQL connections."),
+    list: cap("supported", "readonly", "Lists relational tables."),
+    schema: cap("supported", "readonly", "Unified schema command (single-table or full scan)."),
+    schemaSingle: cap("supported", "readonly", "Reads a single table schema."),
+    schemaFullScan: cap("supported", "readonly", "Full scan, refresh, and reset are supported."),
+    query: cap("supported", "readonly", "Runs SQL through permission and blacklist guards."),
+    lint: cap("supported", "readonly", "Statically analyzes SQL without connecting to the database."),
+    queryOutput: cap("supported", "readonly", "table/json/csv output is supported."),
+    queryLimitGuard: cap("supported", "readonly", "Query-only auto-limit and size guard are supported."),
+    q: cap("supported", "readonly", "Saved SQL snippets allow SELECT/WITH only."),
+    queries: cap("supported", "local-write", "Snippet management is available regardless of active connection."),
+    insert: cap("supported", "db-write", "Dedicated INSERT command is supported."),
+    update: cap("supported", "db-write", "Dedicated UPDATE command is supported."),
+    delete: cap("supported", "db-write", "Dedicated DELETE command is supported."),
+    export: cap("supported", "readonly", "SQL export is supported."),
+    blacklistRead: cap("supported", "readonly", "Reads the configured blacklist rules."),
+    blacklist: cap("supported", "local-write", "Blacklist management and enforcement are supported."),
+    check: cap("supported", "readonly", "Data health checks are SQL-only."),
+    diff: cap("supported", "readonly", "Relational schema snapshots are supported."),
+    migrate: cap("supported", "db-write", "DDL migrations are supported for SQL engines."),
+    shell: cap("supported", "interactive", "Interactive SQL shell is supported."),
+    status: cap("supported", "readonly", "Safe config summary is supported."),
+    doctor: cap("supported", "readonly", "Engine-specific diagnostics are supported."),
+    inspect: cap("supported", "readonly", "Agent context snapshot is supported."),
+    report: cap("supported", "readonly", "Diagnostic report is supported."),
+    guide: cap("supported", "readonly", "Deterministic next-command planner is supported."),
+    explain: cap("supported", "readonly", "EXPLAIN plans are read from SQL engines."),
+    plan: cap("supported", "readonly", "Offline write-risk analysis of SQL against the schema cache."),
+    impactAssess: cap("supported", "local-write", "Offline impact assessment of a SQL schema change; writes its report locally."),
+    assert: cap("supported", "local-write", "Data assertions over SQL results; optionally writes a verification artifact."),
+    snapshot: cap("supported", "local-write", "Captures a SQL result fingerprint under .dbcli/snapshots/."),
+    verify: cap("supported", "local-write", "Scenario verification over SQL; writes a verification artifact."),
+    semantic: cap("supported", "readonly", "Governed semantic context and drift over a SQL schema cache."),
+    design: cap("supported", "local-write", "Schema design authoring and comparison for SQL dialects; init writes a template."),
+    proxy: cap("supported", "interactive", "Local observing proxy for the MySQL, MariaDB and PostgreSQL wire protocols."),
+    password: cap("supported", "interactive", "Rotates the stored connection credential; refused under agent mode."),
+    proxyAnalyze: cap("not-applicable", "readonly", "Reads locally recorded proxy events; never contacts an engine."),
+    verification: cap("not-applicable", "readonly", "Inspects verification artifacts under .dbcli/verification/."),
+    verificationPrune: cap("not-applicable", "local-write", "Deletes local verification artifacts; dry-run unless --execute --force."),
+    evidence: cap("not-applicable", "local-write", "Composes, validates and renders evidence packs from local artifacts."),
+    contract: cap("not-applicable", "readonly", "Validates and inspects governed semantic contracts offline."),
+    recovery: cap("not-applicable", "readonly", "Renders recovery codes and their remediation steps from a static table."),
+    backfillArtifact: cap("not-applicable", "local-write", "Builds a backfill artifact from a source manifest and v2 connection identity."),
+    capabilityDiscover: cap("not-applicable", "readonly", "Emits the static capability catalog; opens no connection."),
+    capabilityCheck: cap("not-applicable", "readonly", "Evaluates required capability ids against the local configuration only."),
+    ...ENGINE_INDEPENDENT
+  }, SQL_ONLY_UNSUPPORTED = {
+    explain: cap("unsupported", "none", "src/commands/explain.ts refuses a non-SQL connection."),
+    plan: cap("unsupported", "none", "Risk analysis is SQL-dialect based; toSqlDialect resolves no dialect here."),
+    assert: cap("unsupported", "none", "src/commands/assert.ts refuses a non-SQL connection."),
+    snapshot: cap("unsupported", "none", "src/commands/snapshot.ts refuses a non-SQL connection."),
+    verify: cap("unsupported", "none", "src/commands/verify.ts refuses a non-SQL connection."),
+    proxy: cap("unsupported", "none", "The proxy speaks the MySQL and PostgreSQL wire protocols only.")
+  }, SQL_MODE_LIMITED = {
+    impactAssess: cap("limited", "local-write", "Runs against an ORM artifact; --against-cache needs a SQL connection."),
+    semantic: cap("limited", "readonly", "Governed context, search and drift work; draft validate needs a SQL connection."),
+    design: cap("limited", "local-write", "Authoring and ORM comparison work; --against-cache needs a SQL connection.")
+  }, VERIFIED_SQL_TLS = cap("supported", "readonly", "Uses profile-scoped verified SQL TLS; availability does not validate CA or handshake."), ENGINE_CAPABILITIES = Object.freeze({
+    postgresql: Object.freeze({
+      ...SQL_BASE,
+      connectionTls: VERIFIED_SQL_TLS,
+      check: cap("limited", "readonly", "SQL-only and strongest on MySQL/MariaDB.")
+    }),
+    sqlite: Object.freeze({
+      ...SQL_BASE,
+      init: cap("supported", "local-write", "Asks for a file path and a permission; the file must already exist."),
+      use: cap("supported", "local-write", "Switches connections and displays the file path."),
+      schemaFullScan: cap("unsupported", "none", "Full schema cache scan is not implemented for SQLite."),
+      lint: cap("unsupported", "none", "Static lint is not enabled for the SQLite dialect yet."),
+      queries: cap("supported", "local-write", "Snippets may declare `engine: sqlite` and bind with `?` placeholders."),
+      insert: cap("supported", "db-write", "Row insert through the shared data-executor path."),
+      update: cap("supported", "db-write", "Row update with a mandatory --where clause."),
+      delete: cap("supported", "db-write", "Row delete with a mandatory --where clause."),
+      export: cap("supported", "local-write", "Exports SELECT results to json, csv or html through the shared query path."),
+      check: cap("unsupported", "none", "Data health check is not enabled for SQLite."),
+      diff: cap("unsupported", "none", "Schema snapshots are not enabled for SQLite."),
+      migrate: cap("unsupported", "none", "SQLite ALTER TABLE covers few operations and a column change is a table rebuild; no DDL generator exists."),
+      shell: cap("unsupported", "none", "The REPL is not enabled for SQLite."),
+      doctor: cap("supported", "readonly", "Checks the file exists, is readable, and is writable when the permission allows writes."),
+      inspect: cap("unsupported", "none", "Inspection collectors are not enabled for SQLite."),
+      report: cap("unsupported", "none", "Report diagnostics query engine-specific statistics views."),
+      guide: cap("unsupported", "none", "Guides depend on engine-specific EXPLAIN output."),
+      explain: cap("unsupported", "none", "EXPLAIN handling is not enabled for SQLite."),
+      plan: cap("unsupported", "none", "Plan capture is not enabled for SQLite."),
+      impactAssess: cap("unsupported", "none", "Impact assessment is not enabled for SQLite."),
+      assert: cap("unsupported", "none", "Assertions are not enabled for SQLite."),
+      snapshot: cap("unsupported", "none", "Result snapshots are not enabled for SQLite."),
+      verify: cap("unsupported", "none", "Write verification is not enabled for SQLite."),
+      semantic: cap("unsupported", "none", "Semantic context work is not enabled for SQLite."),
+      design: cap("unsupported", "none", "Schema design work is not enabled for SQLite."),
+      proxy: cap("not-applicable", "none", "SQLite has no network protocol to proxy."),
+      proxyAnalyze: cap("not-applicable", "none", "There are no SQLite proxy events to analyse."),
+      password: cap("not-applicable", "none", "A SQLite connection has no credential to store or rotate."),
+      queryLimitGuard: cap("limited", "readonly", "Applies the same LIMIT rewrite as the other SQL engines; under query-only the handle is opened read-only, which a database with an unreplayed WAL cannot satisfy.")
+    }),
+    mysql: Object.freeze({ ...SQL_BASE, connectionTls: VERIFIED_SQL_TLS }),
+    mariadb: Object.freeze({ ...SQL_BASE, connectionTls: VERIFIED_SQL_TLS }),
+    mongodb: Object.freeze({
+      ...SQL_BASE,
+      ...SQL_ONLY_UNSUPPORTED,
+      ...SQL_MODE_LIMITED,
+      ...SQL_MODE_LIMITED,
+      ...SQL_MODE_LIMITED,
+      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
+      schemaSingle: cap("limited", "readonly", "MongoDB schema is sampled from documents."),
+      schemaFullScan: cap("limited", "readonly", "Full scan is sampled and document-oriented."),
+      query: cap("limited", "readonly", "Uses JSON filter or aggregation syntax, not SQL."),
+      queryLimitGuard: cap("limited", "readonly", "Applies result limits and collection size guard."),
+      queries: cap("limited", "local-write", "Snippet management works with MongoDB-specific saved-query limitations."),
+      q: cap("limited", "readonly", "Saved MongoDB snippets require collection frontmatter, accept JSON find/aggregate bodies, and JSON-encode parameter substitutions."),
+      insert: cap("limited", "db-write", "Document insert is supported with Mongo-specific behavior."),
+      update: cap("limited", "db-write", "Document update is supported with Mongo-specific behavior."),
+      delete: cap("limited", "db-write", "Document delete is supported with Mongo-specific behavior."),
+      export: cap("limited", "readonly", "MongoDB export is supported with document-query syntax."),
+      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
+      blacklist: cap("limited", "local-write", "Rule management works; enforcement differs from SQL column enforcement."),
+      check: cap("unsupported", "none", "Data health check is SQL-only."),
+      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
+      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
+      shell: cap("limited", "interactive", "MongoDB shell support is narrower than SQL shell support.")
+    }),
+    redis: Object.freeze({
+      ...SQL_BASE,
+      ...SQL_ONLY_UNSUPPORTED,
+      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
+      schemaSingle: cap("limited", "readonly", "Per-key synthetic schema only."),
+      schemaFullScan: cap("unsupported", "none", "Redis has no full schema cache scan."),
+      query: cap("limited", "readonly", "Runs allow-listed Redis commands."),
+      queryLimitGuard: cap("limited", "readonly", "SCAN/LRANGE/ZRANGE COUNT/stop rewrite; HGETALL/SMEMBERS/KEYS truncate at 1000; --no-limit bypasses."),
+      q: cap("limited", "readonly", "Saved Redis snippets use a read-only allowlist and range guards."),
+      queries: cap("limited", "local-write", "Snippet management works with Redis-specific saved-query limitations."),
+      insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
+      export: cap("unsupported", "none", "Redis export is not supported."),
+      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
+      blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
+      check: cap("unsupported", "none", "Data health check is SQL-only."),
+      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
+      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
+      shell: cap("limited", "interactive", "Single-line Redis REPL (no trailing semicolon needed) with auto-limit and key-glob blacklist; narrower than SQL shell.")
+    }),
+    elasticsearch: Object.freeze({
+      ...SQL_BASE,
+      ...SQL_ONLY_UNSUPPORTED,
+      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
+      schemaSingle: cap("limited", "readonly", "Schema flattens index mappings."),
+      schemaFullScan: cap("supported", "readonly", "Full scan iterates non-system indices."),
+      query: cap("limited", "readonly", "Uses JSON DSL or Lucene query strings with an index."),
+      queryLimitGuard: cap("limited", "readonly", "Applies Elasticsearch size guard."),
+      q: cap("limited", "readonly", "Saved ES snippets require index frontmatter and reject scripts."),
+      queries: cap("limited", "local-write", "Snippet management works with Elasticsearch-specific saved-query limitations."),
+      insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      export: cap("limited", "readonly", "Exports DSL hits or a full index via scroll, capped at 1000 rows (use --no-limit)."),
+      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
+      blacklist: cap("limited", "local-write", "Index-level and flattened-column enforcement differ from SQL."),
+      check: cap("unsupported", "none", "Data health check is SQL-only."),
+      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
+      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
+      shell: cap("limited", "interactive", "Dedicated Kibana Dev Tools-style REPL (method/path + JSON body, blank-line submit); read-focused.")
+    })
+  });
+});
+
 // src/utils/validation.ts
+import { isAbsolute } from "path";
 function parseTimeoutOption(value) {
   let parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < MIN_CONNECTION_TIMEOUT_MS || parsed > MAX_CONNECTION_TIMEOUT_MS)
@@ -5144,16 +6421,30 @@ function isSqliteMemoryTarget(value) {
   let query = queryStart === -1 ? "" : withoutScheme.slice(queryStart + 1);
   return new URLSearchParams(query).get("mode")?.toLowerCase() === "memory";
 }
+function rejectUnsupportedSqlTls(raw, ctx) {
+  if (raw !== null && typeof raw === "object" && "sqlTls" in raw && raw.sqlTls !== void 0 && (!("system" in raw) || !supportsSqlTls(raw.system)))
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      path: ["sqlTls"],
+      message: t("errors.sql_tls_unsupported")
+    });
+  return raw;
+}
 function validateFormat(value, allowedFormats, commandName) {
   if (!allowedFormats.includes(value)) {
     let allowed = allowedFormats.join(", ");
     throw Error(`Invalid format "${value}" for ${commandName}. Allowed: ${allowed}`);
   }
 }
-var EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, RESERVED_MONGODB_OPTION_KEYS, MongoDBOptionsSchema, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, SQLITE_MEMORY_TARGET_MESSAGE = "SQLite in-memory databases are refused: a memory target is a different database on every connection, so it cannot be the connection identity the blacklist, audit log and schema cache are scoped to. Point `file` at a database file on disk. See ADR-0038.", SqliteConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, DEFAULT_AUDIT_ROTATION, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, SqliteNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
+var SqlTlsConfigSchema, EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, RESERVED_MONGODB_OPTION_KEYS, MongoDBOptionsSchema, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, SQLITE_MEMORY_TARGET_MESSAGE = "SQLite in-memory databases are refused: a memory target is a different database on every connection, so it cannot be the connection identity the blacklist, audit log and schema cache are scoped to. Point `file` at a database file on disk. See ADR-0038.", SqliteConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, DEFAULT_AUDIT_ROTATION, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, SqliteNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
 var init_validation = __esm(() => {
+  init_message_loader();
   init_zod();
-  EnvRefSchema = objectType({
+  init_capabilities();
+  SqlTlsConfigSchema = objectType({
+    mode: literalType("verify-full"),
+    caPath: stringType().min(1).refine(isAbsolute, () => ({ message: t("errors.sql_tls_ca_absolute") }))
+  }).strict(), EnvRefSchema = objectType({
     $env: stringType()
   }).strict(), StringOrEnvRef = unionType([stringType().min(1), EnvRefSchema]), NumberOrEnvRef = unionType([numberType().int().min(1).max(65535), EnvRefSchema]), OptStringOrEnvRef = unionType([stringType(), EnvRefSchema]).optional().default(""), OptNumberOrEnvRef = unionType([numberType().int(), EnvRefSchema]).optional().default(27017), TimeoutField = {
     timeout: numberType().int().min(MIN_CONNECTION_TIMEOUT_MS).max(MAX_CONNECTION_TIMEOUT_MS).optional(),
@@ -5189,6 +6480,7 @@ var init_validation = __esm(() => {
     srv: booleanType().optional().default(!1),
     ...TimeoutField
   }), SqlConnectionConfigSchema = objectType({
+    sqlTls: SqlTlsConfigSchema.optional(),
     system: enumType(["postgresql", "mysql", "mariadb"]),
     host: StringOrEnvRef,
     port: NumberOrEnvRef,
@@ -5231,13 +6523,14 @@ var init_validation = __esm(() => {
     caPath: stringType().optional(),
     rejectUnauthorized: booleanType().optional().default(!0),
     ...TimeoutField
-  }), ConnectionConfigSchema = unionType([
+  });
+  ConnectionConfigSchema = preprocessType(rejectUnsupportedSqlTls, unionType([
     SqlConnectionConfigSchema,
     SqliteConnectionConfigSchema,
     MongoDBConnectionConfigSchema,
     RedisConnectionConfigSchema,
     ElasticsearchConnectionConfigSchema
-  ]), PermissionSchema = enumType(["query-only", "read-write", "data-admin", "admin"]).default("query-only"), EnvironmentLabelSchema = stringType().trim().transform((value) => value || void 0).optional(), MetadataSchema = objectType({
+  ])), PermissionSchema = enumType(["query-only", "read-write", "data-admin", "admin"]).default("query-only"), EnvironmentLabelSchema = stringType().trim().transform((value) => value || void 0).optional(), MetadataSchema = objectType({
     createdAt: stringType().datetime().optional(),
     version: stringType().default("1.0"),
     schemaLastUpdated: stringType().datetime().optional(),
@@ -5312,7 +6605,7 @@ var init_validation = __esm(() => {
     RedisNamedConnectionSchema,
     ElasticsearchNamedConnectionSchema
   ]), NamedConnectionSchema = preprocessType((raw, ctx) => {
-    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+    if (rejectUnsupportedSqlTls(raw, ctx), raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
       if ("blacklist" in raw)
         ctx.addIssue({
           code: ZodIssueCode.custom,
@@ -6755,1532 +8048,556 @@ class SchemaIndexBuilder {
   }
   static getFileForTable(tableName) {
     if (/^(old_|legacy_|archive_)/.test(tableName))
-      return "legacy.json";
-    return "infrequent.json";
-  }
-}
-var init_schema_index = __esm(() => {
-  init_schema_path();
-});
-
-// src/core/schema-loader.ts
-import { join as join7 } from "path";
-
-class SchemaLayeredLoader {
-  dbcliPath;
-  connectionName;
-  options;
-  cache = null;
-  index = null;
-  loadTime = 0;
-  constructor(dbcliPath, options) {
-    this.dbcliPath = dbcliPath, this.connectionName = options?.connectionName, this.options = {
-      maxCacheItems: options?.maxCacheItems || 100,
-      maxCacheSize: options?.maxCacheSize || 52428800,
-      hotTableThreshold: options?.hotTableThreshold || 20,
-      enableStreaming: options?.enableStreaming || !1,
-      streamingTimeout: options?.streamingTimeout || 30000
-    };
-  }
-  async initialize() {
-    let startTime = performance.now();
-    try {
-      if (await this.ensureDirectories(), this.index = await SchemaIndexBuilder.loadIndex(this.dbcliPath, this.connectionName), this.cache = new SchemaCacheManager(this.dbcliPath, {
-        maxCacheItems: this.options.maxCacheItems,
-        maxCacheSize: this.options.maxCacheSize,
-        connectionName: this.connectionName
-      }), await this.cache.initialize(), this.loadTime = performance.now() - startTime, this.loadTime > 50)
-        console.warn(`Schema initialization took ${this.loadTime.toFixed(2)}ms (target: < 100ms)`);
-      return {
-        cache: this.cache,
-        index: this.index,
-        loadTime: this.loadTime
-      };
-    } catch (error) {
-      if (console.error("Failed to initialize schema loader:", error), this.loadTime = performance.now() - startTime, !this.cache)
-        this.cache = new SchemaCacheManager(this.dbcliPath, {
-          maxCacheItems: this.options.maxCacheItems,
-          maxCacheSize: this.options.maxCacheSize,
-          connectionName: this.connectionName
-        });
-      return {
-        cache: this.cache,
-        index: this.index,
-        loadTime: this.loadTime
-      };
-    }
-  }
-  async loadColdTable(tableName, cache) {
-    try {
-      return await cache.getTableSchema(tableName);
-    } catch (error) {
-      return console.error(`Failed to load cold table ${tableName}:`, error), null;
-    }
-  }
-  async ensureDirectories() {
-    let base = resolveSchemaPath(this.dbcliPath, this.connectionName), dirs = [base, join7(base, "cold")];
-    for (let dir of dirs)
-      try {
-        if (!await Bun.file(dir).exists()) {
-          if (await Bun.spawn(["mkdir", "-p", dir]).exited !== 0)
-            console.error(`Failed to create directory: ${dir}`);
-        }
-      } catch (error) {
-        console.error(`Error ensuring directory ${dir}:`, error);
-      }
-  }
-  getBenchmark() {
-    if (!this.cache || !this.index)
-      return {
-        initTime: this.loadTime,
-        hotTables: 0,
-        totalTables: 0,
-        estimatedSize: 0
-      };
-    let estimatedSize = Object.values(this.index.tables).reduce((sum, table) => sum + (table.estimatedSize || 0), 0);
-    return {
-      initTime: this.loadTime,
-      hotTables: this.index.hotTables.length,
-      totalTables: this.index.metadata.totalTables,
-      estimatedSize
-    };
-  }
-}
-var init_schema_loader = __esm(() => {
-  init_schema_cache();
-  init_schema_index();
-  init_schema_path();
-});
-
-// src/core/config.ts
-import { join as join8 } from "path";
-import { mkdir as mkdir3 } from "fs/promises";
-function assertNoConnectionSelectorOnV1(connectionName) {
-  if (connectionName === void 0)
-    return;
-  throw new ConfigError(`\u9023\u7DDA '${connectionName}' \u4E0D\u5B58\u5728\uFF1A\u6B64\u5C08\u6848\u4F7F\u7528\u55AE\u4E00\u9023\u7DDA (v1) \u8A2D\u5B9A\uFF0C\u6C92\u6709\u5177\u540D\u9023\u7DDA\u3002` + " \u79FB\u9664 --use / DBCLI_CONNECTION\uFF0C\u6216\u6539\u7528 'dbcli init --conn-name <name>' \u5347\u7D1A\u70BA\u591A\u9023\u7DDA (v2) \u8A2D\u5B9A\u3002");
-}
-function setGlobalConnectionName(name) {
-  _globalConnectionName = name;
-}
-function getGlobalConnectionName() {
-  return _globalConnectionName;
-}
-async function getSchemaIsolationConnectionName(dbcliPath) {
-  let effectiveName = getGlobalConnectionName();
-  try {
-    let storagePath = await resolveConfigStoragePath(dbcliPath);
-    if (!((await Bun.file(storagePath).stat())?.isDirectory() ?? !1))
-      return;
-    let configJsonPath = join8(storagePath, "config.json"), configFile = Bun.file(configJsonPath);
-    if (!await configFile.exists())
-      return;
-    let raw = JSON.parse(await configFile.text());
-    if (detectConfigVersion(raw) !== 2)
-      return;
-    let v2Config = DbcliConfigV2Schema.parse(raw);
-    return resolveConnection(v2Config, effectiveName).name;
-  } catch {
-    return;
-  }
-}
-function isEnvReference(value) {
-  return typeof value === "object" && value !== null && "$env" in value && typeof value.$env === "string";
-}
-function resolveEnvReferences(config, env, parentKey) {
-  if (isEnvReference(config)) {
-    let envKey = config.$env, value = resolveEnvRef(config, parentKey ?? "<root>", env);
-    if (parentKey === "port") {
-      let portNum = parseInt(value, 10);
-      if (isNaN(portNum) || portNum < 1 || portNum > 65535)
-        throw new ConfigError(`${envKey} must be a valid port number (1-65535), got: ${value}`);
-      return portNum;
-    }
-    return value;
-  }
-  if (Array.isArray(config))
-    return config.map((item) => resolveEnvReferences(item, env, parentKey));
-  if (typeof config === "object" && config !== null) {
-    let resolved = {};
-    for (let [key, value] of Object.entries(config))
-      resolved[key] = resolveEnvReferences(value, env, key);
-    return resolved;
-  }
-  return config;
-}
-function parseEnvPassword(content) {
-  let match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
-  if (match?.[1] == null)
-    return null;
-  let raw = match[1].trim();
-  return (raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'")) && raw.length >= 2 ? raw.slice(1, -1) : raw;
-}
-var _globalConnectionName, DEFAULT_CONFIG, configModule;
-var init_config = __esm(() => {
-  init_validation();
-  init_errors3();
-  init_config_error_format();
-  init_config_v2();
-  init_config_binding();
-  init_public();
-  init_config_mutation_guard();
-  init_config_integrity();
-  DEFAULT_CONFIG = {
-    connection: {
-      system: "postgresql",
-      host: "localhost",
-      port: 5432,
-      user: "",
-      password: "",
-      database: ""
-    },
-    permission: "query-only",
-    schema: {},
-    metadata: {
-      version: "1.0"
-    },
-    blacklist: { tables: [], columns: {} },
-    audit: {
-      enabled: !0,
-      strict: !1,
-      rotation: { ...DEFAULT_AUDIT_ROTATION }
-    }
-  };
-  configModule = {
-    async read(path, connectionName, options = {}) {
-      let effectiveConnectionName = connectionName ?? _globalConnectionName, rawForDiagnostics;
-      try {
-        let binding = await readProjectBinding(path), storagePath = await resolveConfigStoragePath(path);
-        if (binding) {
-          if (!await Bun.file(join8(storagePath, "config.json")).exists())
-            throw new ConfigError(`Bound dbcli config not found: ${join8(storagePath, "config.json")}`);
-        }
-        let isDirectory = !1;
-        try {
-          isDirectory = (await Bun.file(storagePath).stat())?.isDirectory() ?? !1;
-        } catch {
-          isDirectory = !1;
-        }
-        if (isDirectory) {
-          let configPath = join8(storagePath, "config.json"), configFile = Bun.file(configPath);
-          if (await configFile.exists()) {
-            await assertAgentReadableFile(configPath);
-            let content = await configFile.text();
-            await assertConfigIntegrity(storagePath, content, { requireRecord: !0 });
-            let config = JSON.parse(content);
-            if (rawForDiagnostics = config, detectConfigVersion(config) === 2) {
-              let v2Config = DbcliConfigV2Schema.parse(config), resolved = resolveConnection(v2Config, effectiveConnectionName);
-              assertExplicitProductionSelection(resolved, effectiveConnectionName), await loadConnectionEnv(resolved, storagePath);
-              let envLocalPath = join8(storagePath, ".env.local"), envLocalFile = Bun.file(envLocalPath), legacyPassword = null;
-              if (await envLocalFile.exists()) {
-                let envContent = await envLocalFile.text();
-                if (legacyPassword = parseEnvPassword(envContent), legacyPassword && !process.env.DBCLI_PASSWORD)
-                  process.env.DBCLI_PASSWORD = legacyPassword;
-              }
-              let resolvedConnection = resolveEnvReferences(resolved.connection, process.env);
-              if (!resolvedConnection.password && legacyPassword)
-                resolvedConnection.password = legacyPassword;
-              let schema = (v2Config.schemas ?? {})[resolved.name] ?? v2Config.schema;
-              if (options.loadLayeredSchema !== !1)
-                try {
-                  await Promise.resolve().then(() => init_schema_loader());
-                  let loader = new SchemaLayeredLoader(storagePath, {
-                    connectionName: resolved.name
-                  }), { cache, index } = await loader.initialize();
-                  if (index && Object.keys(index.tables).length > 0) {
-                    let layeredSchema = {};
-                    for (let tableName of Object.keys(index.tables)) {
-                      let s = await cache.getTableSchema(tableName);
-                      if (s)
-                        layeredSchema[tableName] = s;
-                    }
-                    if (Object.keys(layeredSchema).length > 0)
-                      schema = layeredSchema;
-                  }
-                } catch {
-                  console.warn("Warning: Failed to load layered schema cache, falling back to config.json");
-                }
-              return {
-                ...DbcliConfigSchema.parse({
-                  connection: resolvedConnection,
-                  permission: resolved.permission,
-                  schema,
-                  metadata: v2Config.metadata,
-                  blacklist: v2Config.blacklist,
-                  audit: v2Config.audit,
-                  redis: v2Config.redis
-                }),
-                effectiveConnectionName: resolved.name,
-                ...resolved.environment && { effectiveEnvironment: resolved.environment }
-              };
-            }
-            assertNoConnectionSelectorOnV1(effectiveConnectionName);
-            let resolvedConfig = resolveEnvReferences(config, process.env), envPath = join8(storagePath, ".env.local"), envFile = Bun.file(envPath);
-            if (await envFile.exists()) {
-              let envContent = await envFile.text(), password = parseEnvPassword(envContent);
-              if (password && !resolvedConfig.connection.password)
-                resolvedConfig.connection.password = password;
-            }
-            return DbcliConfigSchema.parse(resolvedConfig);
-          }
-        }
-        let file = Bun.file(path);
-        if (await file.exists()) {
-          if (process.env.DBCLI_AGENT_MODE === "1")
-            throw new ConfigError(`Agent mode refuses legacy single-file config: ${path}. Run the human/admin migration workflow to move it to V2 home storage first.`);
-          assertNoConnectionSelectorOnV1(effectiveConnectionName);
-          let content = await file.text(), raw = JSON.parse(content);
-          rawForDiagnostics = raw;
-          let resolved = resolveEnvReferences(raw, process.env);
-          return DbcliConfigSchema.parse(resolved);
-        }
-        if (process.env.DBCLI_AGENT_MODE === "1")
-          throw new ConfigError(`Agent mode refuses a missing config: ${path}. Run the human/admin setup workflow to provision it.`);
-        return { ...DEFAULT_CONFIG };
-      } catch (error) {
-        if (error instanceof ConfigError)
-          throw error;
-        if (isZodError(error))
-          throw new ConfigError(`Failed to read .dbcli config: \u8A2D\u5B9A\u5167\u5BB9\u4E0D\u7B26\u5408\u7D50\u69CB
-${formatConfigValidationError(error, rawForDiagnostics)}`);
-        if (error instanceof Error && error.message.includes("JSON"))
-          throw new ConfigError(`Failed to parse .dbcli file: ${error.message}`);
-        throw new ConfigError(`Failed to read .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    },
-    validate(raw) {
-      try {
-        return DbcliConfigSchema.parse(raw);
-      } catch (error) {
-        if (isZodError(error))
-          throw new ConfigError(`Invalid .dbcli config structure:
-${formatConfigValidationError(error, raw)}`);
-        let errorMessage = error instanceof Error ? error.message : String(error);
-        throw new ConfigError(`Invalid .dbcli config structure: ${errorMessage}`);
-      }
-    },
-    merge(existing, updates) {
-      return {
-        ...existing,
-        ...updates,
-        connection: {
-          ...existing.connection,
-          ...updates.connection || {}
-        },
-        schema: {
-          ...existing.schema,
-          ...updates.schema || {}
-        },
-        metadata: {
-          ...existing.metadata,
-          ...updates.metadata || {},
-          createdAt: existing.metadata?.createdAt || (/* @__PURE__ */ new Date()).toISOString(),
-          version: existing.metadata?.version || "1.0"
-        }
-      };
-    },
-    async write(path, config) {
-      try {
-        assertConfigMutationApproved(), this.validate(config);
-        let storagePath = await resolveConfigStoragePath(path), isDirectory = !1;
-        try {
-          isDirectory = (await Bun.file(storagePath).stat())?.isDirectory() ?? !1;
-        } catch {
-          isDirectory = !1;
-        }
-        if (isDirectory || path.endsWith(".dbcli") || path === storagePath && isDirectory)
-          if (await mkdir3(storagePath, { recursive: !0 }), isEnvReference(config.connection.password)) {
-            let configJson = JSON.stringify(config, null, 2);
-            await writeConfigWithIntegrity(storagePath, configJson);
-          } else {
-            let password = config.connection.password, configWithoutPassword = {
-              ...config,
-              connection: {
-                ...config.connection,
-                password: void 0
-              }
-            };
-            delete configWithoutPassword.connection.password;
-            let configJson = JSON.stringify(configWithoutPassword, null, 2);
-            if (await writeConfigWithIntegrity(storagePath, configJson), password) {
-              let envPath = join8(storagePath, ".env.local"), envContent = `# Database Credentials - DO NOT commit to git
-
-DBCLI_PASSWORD=${password}
-`;
-              await Bun.file(envPath).write(envContent);
-            }
-          }
-        else {
-          let json = JSON.stringify(config, null, 2);
-          await Bun.file(path).write(json);
-        }
-      } catch (error) {
-        if (error instanceof ConfigError)
-          throw error;
-        throw new ConfigError(`Failed to write .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-  };
-});
-
-// src/core/correlation-id.ts
-function isCorrelationId(value) {
-  return typeof value === "string" && CORRELATION_ID_PATTERN.test(value);
-}
-function setGlobalCorrelationId(value) {
-  if (value !== void 0 && !isCorrelationId(value))
-    throw Error("Invalid correlation ID");
-  globalCorrelationId = value;
-}
-function getGlobalCorrelationId() {
-  return globalCorrelationId;
-}
-var CORRELATION_ID_PATTERN, globalCorrelationId;
-var init_correlation_id = __esm(() => {
-  CORRELATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
-});
-
-// src/utils/connection-timeout.ts
-function setGlobalConnectionTimeout(timeout) {
-  _globalConnectionTimeout = timeout;
-}
-function setGlobalStatementTimeout(timeout) {
-  _globalStatementTimeout = timeout;
-}
-function resolveConnectionTimeout(configured) {
-  return _globalConnectionTimeout ?? configured;
-}
-function resolveStatementTimeout(configured) {
-  return _globalStatementTimeout ?? configured;
-}
-function withResolvedTimeout(options) {
-  let timeout = resolveConnectionTimeout(options.timeout), statementTimeout = resolveStatementTimeout(options.statementTimeout);
-  if (timeout === options.timeout && statementTimeout === options.statementTimeout)
-    return options;
-  return { ...options, timeout, statementTimeout };
-}
-var _globalConnectionTimeout, _globalStatementTimeout;
-
-// src/core/connection-selector.ts
-function createConnectionSelectorOption() {
-  return new Option2("--use <connection>", CONNECTION_SELECTOR_DESCRIPTION);
-}
-var CONNECTION_SELECTOR_DESCRIPTION = "Use a specific named connection for this invocation (v2 config)";
-var init_connection_selector = __esm(() => {
-  init_esm();
-});
-
-// src/utils/config-path.ts
-function resolveConfigPath(command, options, fallback = ".dbcli") {
-  for (let current = command;current; current = current.parent ?? void 0) {
-    let source = current.getOptionValueSource("config");
-    if (source && source !== "default") {
-      let currentOptions = current.opts();
-      if (typeof currentOptions.config === "string" && currentOptions.config.length > 0)
-        return currentOptions.config;
-    }
-  }
-  if (typeof options?.config === "string" && options.config.length > 0 && options.config !== fallback)
-    return options.config;
-  for (let current = command;current; current = current.parent ?? void 0) {
-    let source = current.getOptionValueSource("global");
-    if (source && source !== "default" && current.opts().global === !0)
-      return getGlobalConfigPath();
-  }
-  if (options?.global === !0)
-    return getGlobalConfigPath();
-  if (typeof options?.config === "string" && options.config.length > 0)
-    return options.config;
-  return fallback;
-}
-var init_config_path = __esm(() => {
-  init_config_binding();
-});
-
-// src/utils/config-sidecar-path.ts
-import { dirname as dirname2, extname, join as join9 } from "path";
-function configSidecarPath(configPath, fileName) {
-  let directory = extname(configPath) !== "" && !configPath.endsWith(".dbcli") ? dirname2(configPath) : configPath;
-  return join9(directory, fileName);
-}
-var init_config_sidecar_path = () => {};
-
-// src/utils/skill-check-cache.ts
-import { mkdir as mkdir5, rename as rename3, unlink as unlink4, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname4 } from "path";
-function cachePath(configPath) {
-  return configSidecarPath(configPath, CACHE_FILE_NAME);
-}
-async function readSkillCheckCache(configPath, dbcliVersion, options = {}) {
-  try {
-    let file = Bun.file(cachePath(configPath));
-    if (!await file.exists())
-      return null;
-    let raw = await file.json();
-    if (raw.version !== 1 || !Array.isArray(raw.outdated))
-      return null;
-    if (raw.dbcliVersion !== dbcliVersion)
-      return null;
-    if (typeof raw.checkedAt !== "number")
-      return null;
-    let age = (options.now ?? Date.now()) - raw.checkedAt;
-    if (age < 0 || age > SKILL_CHECK_TTL_MS)
-      return null;
-    return raw.outdated;
-  } catch {
-    return null;
+      return "legacy.json";
+    return "infrequent.json";
   }
 }
-async function writeSkillCheckCache(configPath, dbcliVersion, outdated, options = {}) {
-  let path = cachePath(configPath), payload = {
-    version: 1,
-    dbcliVersion,
-    checkedAt: options.now ?? Date.now(),
-    outdated
-  };
-  try {
-    await mkdir5(dirname4(path), { recursive: !0 });
-    let temporary = `${path}.tmp-${process.pid}`;
-    await writeFile2(temporary, JSON.stringify(payload), "utf8"), await rename3(temporary, path);
-  } catch {}
-}
-async function invalidateSkillCheckCache(configPath) {
-  await unlink4(cachePath(configPath)).catch(() => {
-    return;
-  });
-}
-var SKILL_CHECK_TTL_MS = 86400000, CACHE_FILE_NAME = "skill-check.json";
-var init_skill_check_cache = __esm(() => {
-  init_config_sidecar_path();
+var init_schema_index = __esm(() => {
+  init_schema_path();
 });
 
-// src/core/slow-query-advisory.ts
-function slowQueryThresholdFor(options) {
-  if (options.recovery === !0)
-    return 0;
-  let threshold = options.slowMs ?? 1000;
-  return assertValidSlowQueryThreshold(threshold), threshold;
-}
-function assertValidSlowQueryThreshold(value) {
-  if (value === void 0)
-    return;
-  if (!Number.isSafeInteger(value) || value < 0)
-    throw Error("slow-ms must be a non-negative integer");
-}
-function parseSlowQueryThreshold(value) {
-  if (!/^\d+$/.test(value))
-    throw Error("slow-ms must be a non-negative integer");
-  let parsed = Number(value);
-  return assertValidSlowQueryThreshold(parsed), parsed;
-}
-function recommendationFor(system) {
-  return system === void 0 || GUIDE_SLOW_QUERY_SYSTEMS.includes(system) ? "Review safely with: dbcli guide slow-query --format markdown. This hint runs no additional database diagnostics." : `Re-check the query shape and the filters it scans; dbcli ships no slow-query diagnostics for ${system}. This hint runs no additional database diagnostics.`;
-}
-function buildSlowQueryAdvisory(executionTimeMs, options) {
-  let thresholdMs = slowQueryThresholdFor(options);
-  if (thresholdMs === 0 || executionTimeMs === void 0 || executionTimeMs < thresholdMs)
-    return;
-  return {
-    code: "SLOW_QUERY",
-    executionTimeMs,
-    thresholdMs,
-    recommendation: recommendationFor(options.system)
-  };
-}
-function attachSlowQueryAdvisory(result, options) {
-  let advisory = buildSlowQueryAdvisory(result.executionTimeMs, options);
-  if (!advisory)
-    return result;
-  return {
-    ...result,
-    metadata: {
-      statement: result.metadata?.statement ?? "UNKNOWN",
-      ...result.metadata,
-      performanceAdvisory: advisory
-    }
-  };
-}
-var GUIDE_SLOW_QUERY_SYSTEMS;
-var init_slow_query_advisory = __esm(() => {
-  GUIDE_SLOW_QUERY_SYSTEMS = ["mariadb", "mysql", "postgresql", "redis"];
-});
+// src/core/schema-loader.ts
+import { join as join7 } from "path";
 
-// resources/lang/en/messages.json
-var messages_default;
-var init_messages = __esm(() => {
-  messages_default = {
-    cli: {
-      agent_output_option: "Emit one Operation Envelope v1 (capabilities and capabilities check only)"
-    },
-    init: {
-      description: "Initialize dbcli configuration with .env parsing and interactive prompts",
-      welcome: "Welcome to dbcli",
-      prompt_connection_name: "Connection name",
-      connection_name_required: "Connection name is required. Provide --conn-name <name> (this is separate from the database --name).",
-      select_system: "Select database system:",
-      prompt_host: "Database host: ",
-      prompt_port: "Database port: ",
-      prompt_user: "Database user: ",
-      prompt_password: "Database password: ",
-      secret_alternatives_sql: "pass --password, supply the credential through .env or the process environment, or store a reference with --use-env-refs",
-      secret_alternatives_mongo_password: "pass --password, supply the credential through .env or the process environment, or paste the connection string with --uri",
-      secret_alternatives_mongo_uri: "pass the connection string with --uri",
-      mongo_uri_conflicts_fields: "--uri cannot be combined with {flags}: the connection string already carries those settings. Use one or the other (--name may be combined to override the database name).",
-      mongo_uri_with_env_refs: "--uri cannot be combined with --use-env-refs: the connection string is decomposed into config fields, and its credentials are not moved into environment variables. Either remove --use-env-refs so dbcli decomposes the string into the field config, or use the --env-* flags (--env-host, --env-user, --env-password, ...) to name one variable per field.",
-      mongo_uri_fallback_warning: "\u26A0\uFE0F  This connection string {reasons}, so it cannot become fields. It is stored as-is in uri, and its credentials will sit in plaintext in the config file.",
-      mongo_uri_reason_unix_socket: "uses a Unix domain socket",
-      mongo_uri_reason_multi_host: "contains more than one host (a field config holds only one)",
-      mongo_uri_reason_secret_option: "contains secret option(s) ({keys}) that would land in plaintext options",
-      mongo_uri_reason_duplicate_key: "repeats the query key(s) {keys} (a field config can hold only one value per key)",
-      mongo_uri_reason_non_scram: "uses the non-SCRAM auth mechanism {mechanism} (field config cannot express it)",
-      mongo_decomposed_header: "Connection string decomposed into these fields (password hidden):",
-      mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs does not apply to a pasted connection string: its credentials are written to the config file as they are, not as environment-variable references.",
-      mongo_setup_mode_paste: "Paste a connection string (copied from Atlas / Compass)",
-      mongo_string_invalid: "Not a valid MongoDB connection string (it is not echoed because it may carry credentials).",
-      mongo_string_bad_host: "The connection string has an invalid host or port (the port must be an integer from 1 to 65535).",
-      mongo_string_bad_credentials: "The connection string's credentials contain an unescaped reserved character such as @, : or /. Percent-encode it (for example @ as %40).",
-      mongo_string_tls_conflict: "The connection string sets tls and ssl to different values.",
-      mongo_string_bad_tls: "The connection string's {key} must be true or false.",
-      mongo_string_empty_option: "The connection string sets {key} but leaves it empty. Give it a value or remove it.",
-      prompt_name: "Database name: ",
-      prompt_permission: "Permission level (query-only, read-write, data-admin, admin): ",
-      env_parse_note: "Note: Unable to parse .env configuration, using interactive prompts",
-      connection_testing: "Testing database connection...",
-      connection_success: "\u2713 Database connection successful",
-      connection_failed: "\u2717 Database connection failed",
-      config_saved: "Configuration saved to .dbcli",
-      config_saved_global: "Global configuration saved to {path}",
-      config_exists_overwrite: "Configuration file .dbcli already exists. Overwrite? (y/n): ",
-      cancelled: "Cancelled. Configuration not changed.",
-      skip_test_env_ref: "Skipping connection test in env-ref mode",
-      skip_test: "Skipping connection test (--skip-test)",
-      connection_hints: "Hints:",
-      config_exists_use_force: ".dbcli exists. Use --force option to overwrite.",
-      connection_added: "Connection '{name}' added",
-      connection_removed: "Connection '{name}' removed",
-      connection_removed_default_cleared: "Connection '{name}' removed. Default connection cleared. Specify --use <name> or DBCLI_CONNECTION for database commands.",
-      connection_renamed: "Connection '{oldName}' renamed to '{newName}'",
-      v1_migration_prompt: "Detected old config format. Create new format and import existing connection as 'default'?",
-      config_saved_v2: "V2 configuration saved to .dbcli",
-      config_not_found: "Configuration file not found",
-      requires_v2_remove: "Removing a connection requires V2 config format",
-      requires_v2_rename: "Renaming a connection requires V2 config format",
-      connection_not_found: "Connection '{name}' does not exist",
-      cannot_remove_last: "Cannot remove the last connection",
-      connection_already_exists: "Connection '{name}' already exists",
-      rename_invalid_format: "Usage: --rename <old-name>:<new-name>",
-      prompt_sqlite_file: "SQLite database file path: "
-    },
-    inspect: {
-      description: "Read-only snapshot of connection, permission, blacklist, objects, snippets, and suggested next commands.",
-      no_config: "No dbcli configuration found. Run `dbcli init` to start."
-    },
-    report: {
-      description: "Diagnostic report (health/capacity/perf) built from built-in snippets. Read-only, bounded.",
-      no_config: "No dbcli configuration found. Run `dbcli init` to start.",
-      section_invalid: "Unknown report section '{name}'. Allowed: health, capacity, perf"
-    },
-    guide: {
-      description: "Deterministic next-command planner for a fixed set of database goals.",
-      no_config: "No dbcli configuration found. Run `dbcli init` to start.",
-      missing_goal: "Missing goal. Try `dbcli guide --list` to see available goals.",
-      goal_invalid: "Unknown guide goal '{name}'. Run `dbcli guide --list` for valid IDs."
-    },
-    recovery: {
-      description: "Look up the structured recovery envelope for a known dbcli error code, or list all codes.",
-      missing_code: "Missing --code. Try `dbcli recovery --list` to see available codes.",
-      code_invalid: "Unknown recovery code '{name}'. Run `dbcli recovery --list` for valid codes.",
-      no_config: "No dbcli configuration found. Run `dbcli init` to start."
-    },
-    use: {
-      description: "Switch or display the default database connection",
-      switched: "Switched default connection to {name}",
-      current: "Current default connection: {name}",
-      current_none: "No default connection. Specify --use <name> or DBCLI_CONNECTION.",
-      unset: "Default connection cleared. Specify --use <name> or DBCLI_CONNECTION for database commands.",
-      unset_conflict: "--unset cannot be combined with a connection name, --list, --confirm-production, or --format json",
-      requires_v2: "This feature requires v2 config format. Use 'dbcli init --conn-name <name>' to create one",
-      available: "Available connections"
-    },
-    schema: {
-      description: "Retrieve table structure or list all tables",
-      fetching: "Fetching schema...",
-      success: "Schema updated",
-      not_found: "Table not found in database",
-      refresh_prompt: "Schema has changes. Apply? (y/n): ",
-      columns_header: "Columns",
-      scanning_database: "\uD83D\uDD0D Scanning database schema...",
-      tables_found: "\uD83D\uDCCD Found {count} table(s). Fetching schema details...",
-      processing_tables: "   Processed {processed}/{total} table(s)",
-      schema_exists_warning: "\u26A0\uFE0F Database schema already exists in .dbcli",
-      use_force_to_override: "   Use --force to override without confirmation"
-    },
-    list: {
-      description: "List all tables in the database",
-      no_tables: "No tables found in database"
-    },
-    query: {
-      description: "Execute SQL query",
-      executing: "Executing query...",
-      no_results: "No results returned",
-      result_count: "Results: {count} row(s)"
-    },
-    q: {
-      description: "Run a saved query snippet by @name",
-      missing_param: "Missing required parameters for snippet '{name}'",
-      engine_mismatch: "Engine mismatch for snippet '{name}'",
-      snippet_not_found: "Snippet not found: {name}",
-      dry_run_header: "Dry-run preview (no execution):"
-    },
-    audit: {
-      description: "Inspect, look up, clear, or check the health of the audit log",
-      tail: {
-        description: "Show recent audit entries (default: last 10 from current connection)"
-      },
-      show: {
-        description: "Look up a single audit entry by id (UUID prefix >=4) or --recovery-ref"
-      },
-      clear: {
-        description: "Delete audit log files (.jsonl + .jsonl.1) for the current connection",
-        prompt_header: "About to clear audit log for connection '{conn}':",
-        prompt_file_line: "  {file}       \u2014 {entries} entries, {size}",
-        prompt_continue: "Continue? [y/N] ",
-        requires_tty_or_yes: "Cannot prompt for confirmation in non-interactive session. Use --yes to clear without prompt.",
-        summary_cleared: "Cleared {count} entries from '{conn}'.",
-        summary_nothing: "Nothing to clear.",
-        summary_failed: "Failed to clear: {message}."
-      },
-      health: {
-        description: "Show AuditLogger health snapshot (size, entries, lock state, last write)"
-      },
-      write_gate: {
-        description: "Summarize tier-two write-gate decisions (ADR 0010's measurement)",
-        header: "Write-gate summary \u2014 connection: {conn}",
-        window: "Audit entries scanned: {scanned}, {from} \u2192 {to}",
-        decisions: "Tier-two evaluations: {count}, {from} \u2192 {to}",
-        tier_one: "Tier one, counted apart: {count} ({outcomes})",
-        no_decisions: "Tier two was never reached in this window. Per ADR 0010 that falsifies the criterion, not the gate: the shapes it looks for are not the shapes people write.",
-        no_entries: "The audit log is empty, so this says nothing about the gate either way. Run some writes, or check `dbcli audit health`."
-      },
-      disabled_hint: "Audit is disabled (audit.enabled = false in .dbcli). Use 'dbcli audit health' for details.",
-      no_entries: "No audit entries.",
-      show_no_match: "No audit entry matches '{prefix}'.",
-      show_ambiguous: "Ambiguous prefix '{prefix}': matches {count} entries. Please use a longer prefix.",
-      show_prefix_too_short: "Prefix must be at least 4 characters.",
-      show_recovery_no_match: "No audit entry has recovery_ref '{ref}'.",
-      show_recovery_ambiguous: "Multiple entries reference recovery_ref '{ref}': matches {count}. This should be rare; inspect file directly.",
-      show_mutex_violation: "Provide either <id> argument or --recovery-ref, not both.",
-      n_capped_warning: "--n value {requested} exceeds max {max}; capped to {max}.",
-      n_must_be_positive: "--n must be a positive integer."
-    },
-    queries: {
-      description: "Manage saved query snippets",
-      list_description: "List saved snippets",
-      show_description: "Show a snippet (frontmatter + SQL)",
-      new_description: "Create a new snippet file",
-      edit_description: "Open a snippet in $EDITOR",
-      check_description: "Validate all snippets",
-      delete_description: "Delete a local snippet file",
-      rename_description: "Rename a local snippet",
-      copy_description: "Copy a snippet from any tier into local",
-      import_description: "Import an external .sql file into local",
-      export_description: "Export a snippet's raw SQL to stdout or file",
-      created: "Created {file}",
-      first_run_hint: "Tip: commit .dbcli-shared/ to share snippets with your team.",
-      no_snippets: "No snippets found. Create one with: dbcli queries new @<name>",
-      check_ok: "\u2713 {count} snippets parsed successfully",
-      check_failed: "\u2717 {count} snippet(s) have errors",
-      search_description: "Search snippets by keywords (fuzzy ranking)",
-      suggest_description: "Suggest snippets by intent prefix",
-      search_no_keywords: "Provide at least one keyword, or try 'queries list' / 'queries suggest'.",
-      search_no_results: "No snippets matched. Try 'queries list' or 'queries suggest <intent>'.",
-      suggest_missing_intent: "Provide an intent (or prefix). Available: {available}",
-      suggest_invalid_intent: "Invalid intent '{value}'. Must match ^[a-z][a-z0-9.-]*$",
-      suggest_no_results: "No snippets with intent prefix '{intent}'. Available: {available}",
-      no_active_connection_hint: "No active connection; showing snippets across all engines."
-    },
-    errors: {
-      message: "Error: {message}",
-      query_only_boundary_failed: "Could not establish the query-only database boundary for {system}: {detail}",
-      query_only_boundary_verify: "Verify that {system} supports read-only transactions and that this account may start one",
-      query_only_boundary_not_executed: "The target statement was not executed; fix the database setting or connection before retrying",
-      query_only_cleanup_completed: "The query-only target completed, but transaction cleanup failed for {system}: {detail}",
-      query_only_cleanup_uncertain: "The query-only target failed and its outcome is uncertain because transaction cleanup also failed for {system}: {detail}",
-      query_only_cleanup_completed_retry: "The target statement ran; do not retry it unless repeating its external effects is safe",
-      query_only_cleanup_uncertain_retry: "The target may have produced effects before failing; do not retry it unless repeating them is safe",
-      query_only_cleanup_reconnect: "Reconnect before running another statement because this connection was discarded",
-      invalid_config: "Invalid configuration: {field}",
-      connection_failed: "Failed to connect to database: {message}",
-      permission_denied: "Permission denied (required: {required})",
-      permission_requires_level: "{type} operation requires {minimum} permission or higher (current level: {permission})",
-      elasticsearch_requires_level: "Elasticsearch {type} operation requires {minimum} permission or higher (current level: {permission})",
-      escalated_write_requires_admin: "This statement opens as a read but contains an executable {keyword}. A write hidden inside a read statement requires admin permission (current level: {permission}).",
-      multiple_statements_refused: "SQL containing multiple statements is refused below admin permission, because only the first statement determines the permission check. Run each statement separately.",
-      unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires admin for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
-      permission_denied_reason: "Permission denied: {reason}",
-      table_not_found: "Table not found: {table}",
-      unsupported_lang: "Language '{lang}' not supported, using English",
-      invalid_json: "Invalid JSON: {message}",
-      table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
-      redis_target_blacklisted: "Redis command refused by blacklist",
-      column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
-      table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
-      table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
-      column_already_blacklisted: "Error: Column '{table}.{column}' is already blacklisted",
-      column_not_in_blacklist: "Error: Column '{table}.{column}' is not in the blacklist",
-      invalid_table_name: "Error: Invalid table name: {table}",
-      invalid_column_format: "Error: Invalid column format. Use 'table.column'",
-      invalid_system: "Invalid database system: {system}",
-      invalid_permission: "Invalid permission level: {permission}",
-      invalid_port: "Invalid port: {port}",
-      require_user: "Non-interactive mode requires --user option",
-      require_name: "Non-interactive mode requires --name option",
-      env_refs_missing_options: `When using --use-env-refs, environment variable names must be specified.
-Provide options: --env-host, --env-port, --env-user, --env-password, --env-database
-Or use interactive mode: run "dbcli init --use-env-refs" without --no-interactive`,
-      env_var_not_defined: `Cannot test connection: environment variable {envKey} is not defined.
-Set {envKey} in .env or environment variables.
-Hint: run 'export {envKey}=<value>' and retry`,
-      invalid_output_format: "--format {format} is not supported here \u2014 use text or json",
-      sqlite_file_required: "A SQLite connection needs a file path. Pass --file <path> or run init interactively."
-    },
-    success: {
-      inserted: "Successfully inserted {count} row(s)",
-      updated: "Successfully updated {count} row(s)",
-      deleted: "Successfully deleted {count} row(s)",
-      no_changes: "No changes to apply"
-    },
-    insert: {
-      description: "Insert data into a table",
-      prompt_data: "Enter JSON data to insert: ",
-      confirm: "Insert {count} row(s) into {table}? (y/n): ",
-      elasticsearch_unsupported: "Elasticsearch does not support the insert command; for now, use an external tool (e.g. curl or Kibana DevTools) to write documents"
-    },
-    update: {
-      description: "Update data in a table",
-      prompt_where: "Enter WHERE clause (e.g., id=1): ",
-      prompt_set: 'Enter JSON updates (e.g., {"status": "active"}): ',
-      confirm: "Update rows in {table}? (y/n): ",
-      elasticsearch_unsupported: "Elasticsearch does not support the update command; for now, use an external tool (e.g. curl or Kibana DevTools) to update documents"
-    },
-    delete: {
-      description: "Delete data from a table",
-      prompt_where: "Enter WHERE clause (e.g., id=1): ",
-      confirm: "Delete rows from {table}? (y/n): ",
-      admin_only: "Delete command requires data-admin or admin permission",
-      elasticsearch_unsupported: "Elasticsearch does not support the delete command; for now, use an external tool (e.g. curl or Kibana DevTools) to delete documents"
-    },
-    export: {
-      description: "Export query results",
-      formats: "Supported formats: json, csv",
-      exported: "Exported {count} rows to {file}"
-    },
-    upgrade: {
-      description: "Check for updates and upgrade dbcli to the latest version",
-      checking: "Checking for updates...",
-      already_up_to_date: "\u2713 Already up to date (v{version})",
-      new_version_available: "New version available: v{version}",
-      current_version: "Current version : v{version}",
-      latest_version: "Latest version  : v{version}",
-      update_hint: '[INFO] dbcli v{version} available. Run "dbcli upgrade" to upgrade.',
-      install_hint: 'Run "dbcli upgrade" to install the update.',
-      upgrading: "Upgrading...",
-      success: "\u2713 Successfully upgraded to v{version}",
-      skill_recheck_hint: 'Hint: If you have installed AI skills, run "dbcli skill --install <platform>" to ensure they are up to date.',
-      failed: "\u2717 Upgrade failed. Try running manually:",
-      manual_hint: "bun add -g @carllee1983/dbcli@latest",
-      network_error: "\u26A0 Could not check for updates (network error or registry unavailable)"
-    },
-    skill: {
-      description: "Generate AI skill documentation",
-      context_description: "Generate AI-friendly database schema and query snippet context",
-      installed: `Skill: {path}
-Reference: {referencePath}`,
-      update_available: "Skill updates available for the following platforms:",
-      update_hint: 'Run "dbcli skill --install <platform>" to update.'
-    },
-    blacklist: {
-      description: "Manage sensitive data blacklist to prevent AI access",
-      list_title: "Current Blacklist Configuration",
-      tables_label: "Blacklisted tables",
-      columns_label: "Blacklisted columns",
-      none: "No tables or columns are currently blacklisted",
-      table_added: "\u2713 Table '{table}' added to blacklist",
-      table_removed: "\u2713 Table '{table}' removed from blacklist",
-      column_added: "\u2713 Column '{table}.{column}' added to blacklist",
-      column_removed: "\u2713 Column '{table}.{column}' removed from blacklist",
-      refuse_wildcard: "Refused: '{table}' contains wildcard characters, which are matched literally on {system} \u2014 the entry would never match anything. Write the exact name."
-    },
-    security: {
-      columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
-    },
-    warnings: {
-      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
-      redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
-    },
-    version: {
-      unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
-      doctor_pass: "{system} {version} (meets >= {minVersion})",
-      doctor_warn: "{system} {version} is below supported >= {minVersion}"
-    },
-    migrate: {
-      description: "Schema DDL operations (CREATE/DROP/ALTER TABLE, INDEX, CONSTRAINT, ENUM)",
-      dry_run_preview: "[DRY RUN] Generated SQL (not executed):",
-      executing: "Executing DDL...",
-      success: "DDL executed successfully",
-      confirm_drop: "This is a destructive operation ({operation}). Proceed?",
-      permission_required: "DDL operations require admin permission (current: {permission})",
-      blacklist_blocked: 'Table "{table}" is blacklisted \u2014 DDL operations are blocked',
-      schema_refreshed: 'Schema cache updated for table "{table}"',
-      no_sql_generated: "No SQL generated (operation not applicable for this database)",
-      create_description: "Create a new table",
-      drop_description: "Drop a table",
-      add_column_description: "Add a column to a table",
-      drop_column_description: "Drop a column from a table",
-      alter_column_description: "Alter a column in a table",
-      add_index_description: "Add an index to a table",
-      drop_index_description: "Drop an index",
-      add_constraint_description: "Add a constraint to a table",
-      drop_constraint_description: "Drop a constraint from a table",
-      add_enum_description: "Create an enum type (PostgreSQL only)",
-      alter_enum_description: "Add a value to an enum type",
-      drop_enum_description: "Drop an enum type"
-    },
-    password: {
-      description: "Change the password of a single connection, leaving every other setting untouched",
-      arg_connection: "Connection name (defaults to the current default connection)",
-      opt_stdin: "Read the new password from stdin (for rotation scripts)",
-      opt_password: "New password given inline (visible in shell history and process list)",
-      opt_skip_test: "Skip verifying the new password against the database before saving",
-      prompt: "New password for connection '{name}'",
-      source_conflict: "--password and --stdin cannot be used together; pick one source.",
-      needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
-      empty: "The new password is empty; nothing was changed.",
-      updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
-      converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
-      skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
+class SchemaLayeredLoader {
+  dbcliPath;
+  connectionName;
+  options;
+  cache = null;
+  index = null;
+  loadTime = 0;
+  constructor(dbcliPath, options) {
+    this.dbcliPath = dbcliPath, this.connectionName = options?.connectionName, this.options = {
+      maxCacheItems: options?.maxCacheItems || 100,
+      maxCacheSize: options?.maxCacheSize || 52428800,
+      hotTableThreshold: options?.hotTableThreshold || 20,
+      enableStreaming: options?.enableStreaming || !1,
+      streamingTimeout: options?.streamingTimeout || 30000
+    };
+  }
+  async initialize() {
+    let startTime = performance.now();
+    try {
+      if (await this.ensureDirectories(), this.index = await SchemaIndexBuilder.loadIndex(this.dbcliPath, this.connectionName), this.cache = new SchemaCacheManager(this.dbcliPath, {
+        maxCacheItems: this.options.maxCacheItems,
+        maxCacheSize: this.options.maxCacheSize,
+        connectionName: this.connectionName
+      }), await this.cache.initialize(), this.loadTime = performance.now() - startTime, this.loadTime > 50)
+        console.warn(`Schema initialization took ${this.loadTime.toFixed(2)}ms (target: < 100ms)`);
+      return {
+        cache: this.cache,
+        index: this.index,
+        loadTime: this.loadTime
+      };
+    } catch (error) {
+      if (console.error("Failed to initialize schema loader:", error), this.loadTime = performance.now() - startTime, !this.cache)
+        this.cache = new SchemaCacheManager(this.dbcliPath, {
+          maxCacheItems: this.options.maxCacheItems,
+          maxCacheSize: this.options.maxCacheSize,
+          connectionName: this.connectionName
+        });
+      return {
+        cache: this.cache,
+        index: this.index,
+        loadTime: this.loadTime
+      };
     }
-  };
+  }
+  async loadColdTable(tableName, cache) {
+    try {
+      return await cache.getTableSchema(tableName);
+    } catch (error) {
+      return console.error(`Failed to load cold table ${tableName}:`, error), null;
+    }
+  }
+  async ensureDirectories() {
+    let base = resolveSchemaPath(this.dbcliPath, this.connectionName), dirs = [base, join7(base, "cold")];
+    for (let dir of dirs)
+      try {
+        if (!await Bun.file(dir).exists()) {
+          if (await Bun.spawn(["mkdir", "-p", dir]).exited !== 0)
+            console.error(`Failed to create directory: ${dir}`);
+        }
+      } catch (error) {
+        console.error(`Error ensuring directory ${dir}:`, error);
+      }
+  }
+  getBenchmark() {
+    if (!this.cache || !this.index)
+      return {
+        initTime: this.loadTime,
+        hotTables: 0,
+        totalTables: 0,
+        estimatedSize: 0
+      };
+    let estimatedSize = Object.values(this.index.tables).reduce((sum, table) => sum + (table.estimatedSize || 0), 0);
+    return {
+      initTime: this.loadTime,
+      hotTables: this.index.hotTables.length,
+      totalTables: this.index.metadata.totalTables,
+      estimatedSize
+    };
+  }
+}
+var init_schema_loader = __esm(() => {
+  init_schema_cache();
+  init_schema_index();
+  init_schema_path();
 });
 
-// resources/lang/zh-TW/messages.json
-var messages_default2;
-var init_messages2 = __esm(() => {
-  messages_default2 = {
-    cli: {
-      agent_output_option: "\u8F38\u51FA\u4E00\u4EFD Operation Envelope v1\uFF08\u50C5\u652F\u63F4 capabilities \u8207 capabilities check\uFF09"
-    },
-    init: {
-      description: "\u521D\u59CB\u5316 dbcli \u914D\u7F6E\uFF0C\u89E3\u6790 .env \u4E26\u9032\u884C\u4E92\u52D5\u5F0F\u63D0\u793A",
-      welcome: "\u6B61\u8FCE\u4F7F\u7528 dbcli",
-      prompt_connection_name: "\u9023\u7DDA\u540D\u7A31",
-      connection_name_required: "\u9023\u7DDA\u540D\u7A31\u4E0D\u53EF\u7A7A\u767D\uFF0C\u8ACB\u63D0\u4F9B --conn-name <name>\uFF08\u8207\u8CC7\u6599\u5EAB\u540D\u7A31 --name \u4E0D\u540C\uFF09\u3002",
-      select_system: "\u9078\u64C7\u8CC7\u6599\u5EAB\u7CFB\u7D71\uFF1A",
-      prompt_host: "\u8CC7\u6599\u5EAB\u4E3B\u6A5F\uFF1A",
-      prompt_port: "\u8CC7\u6599\u5EAB\u57E0\u865F\uFF1A",
-      prompt_user: "\u8CC7\u6599\u5EAB\u4F7F\u7528\u8005\uFF1A",
-      prompt_password: "\u8CC7\u6599\u5EAB\u5BC6\u78BC\uFF1A",
-      secret_alternatives_sql: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --use-env-refs \u5B58\u6210\u53C3\u7167",
-      secret_alternatives_mongo_password: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --uri \u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32",
-      secret_alternatives_mongo_uri: "\u4EE5 --uri \u50B3\u5165\u9023\u7DDA\u5B57\u4E32",
-      mongo_uri_conflicts_fields: "--uri \u4E0D\u80FD\u8207 {flags} \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u5DF2\u5305\u542B\u9019\u4E9B\u8A2D\u5B9A\u3002\u8ACB\u64C7\u4E00\u4F7F\u7528\uFF08--name \u53EF\u4E26\u7528\uFF0C\u7528\u4F86\u8986\u84CB\u8CC7\u6599\u5EAB\u540D\u7A31\uFF09\u3002",
-      mongo_uri_with_env_refs: "--uri \u4E0D\u80FD\u8207 --use-env-refs \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u6703\u88AB\u62C6\u89E3\u6210\u6B04\u4F4D\u8A2D\u5B9A\u5BEB\u5165\uFF0C\u5E33\u5BC6\u4E0D\u6703\u88AB\u62BD\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002\u8ACB\u6539\u8D70\u4E0B\u5217\u4EFB\u4E00\u505A\u6CD5\uFF1A\u62FF\u6389 --use-env-refs\uFF0C\u8B93 dbcli \u62C6\u89E3\u5B57\u4E32\u5BEB\u5165\u6B04\u4F4D\u8A2D\u5B9A\uFF1B\u6216\u6539\u7528 --env-* flag\uFF08--env-host\u3001--env-user\u3001--env-password \u7B49\uFF09\u9010\u6B04\u7D66\u8B8A\u6578\u540D\u7A31\u3002",
-      mongo_uri_fallback_warning: "\u26A0\uFE0F  \u6B64\u9023\u7DDA\u5B57\u4E32{reasons}\uFF0C\u7121\u6CD5\u62C6\u6210\u6B04\u4F4D\u8A2D\u5B9A\uFF0C\u5DF2\u539F\u6A23\u5B58\u5165 uri\uFF1B\u5E33\u5BC6\u5C07\u660E\u6587\u5B58\u653E\u65BC\u8A2D\u5B9A\u6A94\u3002",
-      mongo_uri_reason_unix_socket: "\u4F7F\u7528 Unix domain socket\uFF08\u672C\u6A5F\u901A\u8A0A\u7AEF\uFF09",
-      mongo_uri_reason_multi_host: "\u542B\u591A\u7D44 host\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u53EA\u80FD\u8868\u9054\u4E00\u7D44\uFF09",
-      mongo_uri_reason_secret_option: "\u542B\u6A5F\u5BC6 option\uFF08{keys}\uFF09\uFF0C\u62C6\u9032 options \u6703\u660E\u6587\u843D\u76E4",
-      mongo_uri_reason_duplicate_key: "\u542B\u91CD\u8907\u7684 query \u9375\uFF08{keys}\uFF09\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u6BCF\u500B\u9375\u53EA\u80FD\u5B58\u4E00\u500B\u503C\uFF09",
-      mongo_uri_reason_non_scram: "\u4F7F\u7528\u975E SCRAM \u7684\u8A8D\u8B49\u6A5F\u5236 {mechanism}\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u7121\u6CD5\u8868\u9054\uFF09",
-      mongo_decomposed_header: "\u9023\u7DDA\u5B57\u4E32\u5DF2\u62C6\u89E3\u6210\u4E0B\u5217\u6B04\u4F4D\uFF08\u5BC6\u78BC\u5DF2\u906E\u853D\uFF09\uFF1A",
-      mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs \u4E0D\u9069\u7528\u65BC\u8CBC\u4E0A\u7684\u9023\u7DDA\u5B57\u4E32\uFF1A\u5E33\u5BC6\u6703\u4EE5\u5B57\u9762\u503C\u5BEB\u5165\u8A2D\u5B9A\u6A94\uFF0C\u4E0D\u6703\u8B8A\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002",
-      mongo_setup_mode_paste: "\u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32\uFF08Atlas / Compass \u8907\u88FD\u7684\uFF09",
-      mongo_string_invalid: "\u4E0D\u662F\u5408\u6CD5\u7684 MongoDB \u9023\u7DDA\u5B57\u4E32\uFF08\u5B57\u4E32\u53EF\u80FD\u5E36\u6709\u5E33\u5BC6\uFF0C\u6240\u4EE5\u4E0D\u5370\u51FA\uFF09\u3002",
-      mongo_string_bad_host: "\u9023\u7DDA\u5B57\u4E32\u7684 host \u6216\u57E0\u865F\u4E0D\u5408\u6CD5\uFF08\u57E0\u865F\u9808\u70BA 1 \u81F3 65535 \u7684\u6574\u6578\uFF09\u3002",
-      mongo_string_bad_credentials: "\u9023\u7DDA\u5B57\u4E32\u7684\u5E33\u865F\u6216\u5BC6\u78BC\u542B\u6709\u672A\u8DF3\u812B\u7684\u4FDD\u7559\u5B57\u5143\uFF08\u5982 @\u3001:\u3001/\uFF09\u3002\u8ACB\u505A\u767E\u5206\u6BD4\u7DE8\u78BC\uFF08\u4F8B\u5982 @ \u5BEB\u6210 %40\uFF09\u3002",
-      mongo_string_tls_conflict: "\u9023\u7DDA\u5B57\u4E32\u540C\u6642\u6307\u5B9A\u4E86 tls \u8207 ssl \u4E14\u503C\u4E0D\u540C\u3002",
-      mongo_string_bad_tls: "\u9023\u7DDA\u5B57\u4E32\u7684 {key} \u53EA\u63A5\u53D7 true \u6216 false\u3002",
-      mongo_string_empty_option: "\u9023\u7DDA\u5B57\u4E32\u6307\u5B9A\u4E86 {key} \u537B\u6C92\u6709\u503C\u3002\u8ACB\u7D66\u503C\u6216\u79FB\u9664\u3002",
-      prompt_name: "\u8CC7\u6599\u5EAB\u540D\u7A31\uFF1A",
-      prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, data-admin, admin\uFF09\uFF1A",
-      env_parse_note: "\u63D0\u793A\uFF1A\u7121\u6CD5\u89E3\u6790 .env \u914D\u7F6E\uFF0C\u4F7F\u7528\u4E92\u52D5\u5F0F\u63D0\u793A",
-      connection_testing: "\u6B63\u5728\u6E2C\u8A66\u8CC7\u6599\u5EAB\u9023\u63A5...",
-      connection_success: "\u2713 \u8CC7\u6599\u5EAB\u9023\u63A5\u6210\u529F",
-      connection_failed: "\u2717 \u8CC7\u6599\u5EAB\u9023\u63A5\u5931\u6557",
-      config_saved: "\u914D\u7F6E\u5DF2\u4FDD\u5B58\u81F3 .dbcli",
-      config_saved_global: "\u5168\u57DF\u8A2D\u5B9A\u5DF2\u5132\u5B58\u81F3 {path}",
-      config_exists_overwrite: "\u914D\u7F6E\u6A94\u6848 .dbcli \u5DF2\u5B58\u5728\u3002\u662F\u5426\u8986\u84CB\uFF1F (y/n)\uFF1A",
-      cancelled: "\u5DF2\u53D6\u6D88\u3002\u914D\u7F6E\u672A\u66F4\u6539\u3002",
-      skip_test_env_ref: "\u8DF3\u904E\u9023\u7DDA\u6E2C\u8A66\uFF08\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u6A21\u5F0F\uFF09",
-      skip_test: "\u8DF3\u904E\u9023\u7DDA\u6E2C\u8A66\uFF08--skip-test\uFF09",
-      connection_hints: "\u63D0\u793A\uFF1A",
-      config_exists_use_force: ".dbcli \u5DF2\u5B58\u5728\u3002\u4F7F\u7528 --force \u9078\u9805\u8986\u84CB\u3002",
-      connection_added: "\u5DF2\u65B0\u589E\u9023\u7DDA '{name}'",
-      connection_removed: "\u5DF2\u79FB\u9664\u9023\u7DDA '{name}'",
-      connection_removed_default_cleared: "\u5DF2\u79FB\u9664\u9023\u7DDA '{name}'\uFF0C\u9810\u8A2D\u9023\u7DDA\u5DF2\u6E05\u7A7A\u3002\u57F7\u884C\u8CC7\u6599\u5EAB\u6307\u4EE4\u6642\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
-      connection_renamed: "\u5DF2\u5C07\u9023\u7DDA '{oldName}' \u91CD\u65B0\u547D\u540D\u70BA '{newName}'",
-      v1_migration_prompt: "\u5075\u6E2C\u5230\u820A\u683C\u5F0F\u8A2D\u5B9A\uFF0C\u5C07\u5EFA\u7ACB\u65B0\u683C\u5F0F\u4E26\u5C07\u73FE\u6709\u9023\u7DDA\u532F\u5165\u70BA 'default'\uFF0C\u662F\u5426\u7E7C\u7E8C\uFF1F",
-      config_saved_v2: "V2 \u8A2D\u5B9A\u5DF2\u5132\u5B58\u81F3 .dbcli",
-      config_not_found: "\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94",
-      requires_v2_remove: "\u79FB\u9664\u9023\u7DDA\u9700\u8981 V2 \u683C\u5F0F\u8A2D\u5B9A",
-      requires_v2_rename: "\u91CD\u65B0\u547D\u540D\u9023\u7DDA\u9700\u8981 V2 \u683C\u5F0F\u8A2D\u5B9A",
-      connection_not_found: "\u9023\u7DDA '{name}' \u4E0D\u5B58\u5728",
-      cannot_remove_last: "\u7121\u6CD5\u79FB\u9664\u6700\u5F8C\u4E00\u500B\u9023\u7DDA",
-      connection_already_exists: "\u9023\u7DDA '{name}' \u5DF2\u5B58\u5728",
-      rename_invalid_format: "\u7528\u6CD5\uFF1A--rename <\u820A\u540D\u7A31>:<\u65B0\u540D\u7A31>",
-      prompt_sqlite_file: "SQLite \u8CC7\u6599\u5EAB\u6A94\u6848\u8DEF\u5F91\uFF1A"
-    },
-    inspect: {
-      description: "\u552F\u8B80\u6AA2\u8996\uFF1A\u9023\u7DDA\u3001\u6B0A\u9650\u3001\u9ED1\u540D\u55AE\u3001\u7269\u4EF6\u3001\u7247\u6BB5\u8207\u5EFA\u8B70\u4E0B\u4E00\u6B65\u6307\u4EE4\u3002",
-      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002"
-    },
-    report: {
-      description: "\u8A3A\u65B7\u5831\u544A\uFF08health/capacity/perf\uFF09\uFF1A\u4EE5\u5167\u5EFA\u7247\u6BB5\u7522\u751F\u552F\u8B80\u3001\u6709\u754C\u7684\u8A3A\u65B7\u5FEB\u7167\u3002",
-      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002",
-      section_invalid: "\u672A\u77E5\u7684 report section '{name}'\u3002\u5141\u8A31\u503C\uFF1Ahealth\u3001capacity\u3001perf"
-    },
-    guide: {
-      description: "\u91DD\u5C0D\u56FA\u5B9A\u8CC7\u6599\u5EAB\u76EE\u6A19\u6E05\u55AE\uFF0C\u8F38\u51FA\u53EF\u9810\u6E2C\u7684\u4E0B\u4E00\u6B65\u6307\u4EE4\u8A08\u756B\u3002",
-      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002",
-      missing_goal: "\u7F3A\u5C11 goal \u53C3\u6578\u3002\u8ACB\u57F7\u884C `dbcli guide --list` \u67E5\u770B\u53EF\u7528\u76EE\u6A19\u3002",
-      goal_invalid: "\u672A\u77E5\u7684 guide goal '{name}'\u3002\u8ACB\u57F7\u884C `dbcli guide --list` \u53D6\u5F97\u6709\u6548\u76EE\u6A19 ID\u3002"
-    },
-    recovery: {
-      description: "\u67E5\u8A62\u5DF2\u77E5 dbcli \u932F\u8AA4\u78BC\u5C0D\u61C9\u7684\u7D50\u69CB\u5316\u6062\u5FA9\u65B9\u6848\uFF0C\u6216\u5217\u51FA\u6240\u6709\u652F\u63F4\u7684\u932F\u8AA4\u78BC\u3002",
-      missing_code: "\u7F3A\u5C11 --code \u53C3\u6578\u3002\u8ACB\u57F7\u884C `dbcli recovery --list` \u67E5\u770B\u53EF\u7528\u4EE3\u78BC\u3002",
-      code_invalid: "\u672A\u77E5\u7684 recovery code '{name}'\u3002\u8ACB\u57F7\u884C `dbcli recovery --list` \u53D6\u5F97\u6709\u6548\u4EE3\u78BC\u3002",
-      no_config: "\u627E\u4E0D\u5230 dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C `dbcli init`\u3002"
-    },
-    use: {
-      description: "\u5207\u63DB\u6216\u986F\u793A\u9810\u8A2D\u8CC7\u6599\u5EAB\u9023\u7DDA",
-      switched: "\u5DF2\u5207\u63DB\u9810\u8A2D\u9023\u7DDA\u70BA {name}",
-      current: "\u76EE\u524D\u7684\u9810\u8A2D\u9023\u7DDA\uFF1A{name}",
-      current_none: "\u76EE\u524D\u6C92\u6709\u9810\u8A2D\u9023\u7DDA\u3002\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
-      unset: "\u9810\u8A2D\u9023\u7DDA\u5DF2\u6E05\u7A7A\u3002\u57F7\u884C\u8CC7\u6599\u5EAB\u6307\u4EE4\u6642\u8ACB\u4F7F\u7528 --use <name> \u6216\u8A2D\u5B9A DBCLI_CONNECTION\u3002",
-      unset_conflict: "--unset \u4E0D\u53EF\u8207\u9023\u7DDA\u540D\u7A31\u3001--list\u3001--confirm-production \u6216 --format json \u540C\u6642\u4F7F\u7528",
-      requires_v2: "\u6B64\u529F\u80FD\u9700\u8981\u65B0\u683C\u5F0F\u8A2D\u5B9A\u3002\u8ACB\u4F7F\u7528 dbcli init --conn-name <\u540D\u7A31> \u5EFA\u7ACB\u591A\u9023\u7DDA\u8A2D\u5B9A",
-      available: "\u53EF\u7528\u9023\u7DDA"
-    },
-    schema: {
-      description: "\u6AA2\u7D22\u8868\u683C\u7D50\u69CB\u6216\u5217\u51FA\u6240\u6709\u8868\u683C",
-      fetching: "\u6B63\u5728\u6293\u53D6\u6A21\u5F0F...",
-      success: "\u6A21\u5F0F\u5DF2\u66F4\u65B0",
-      not_found: "\u8CC7\u6599\u5EAB\u4E2D\u627E\u4E0D\u5230\u8868\u683C",
-      refresh_prompt: "\u6A21\u5F0F\u6709\u8B8A\u66F4\u3002\u662F\u5426\u5957\u7528\uFF1F (y/n)\uFF1A",
-      columns_header: "\u6B04\u4F4D",
-      scanning_database: "\uD83D\uDD0D \u6B63\u5728\u6383\u63CF\u8CC7\u6599\u5EAB\u67B6\u69CB...",
-      tables_found: "\uD83D\uDCCD \u627E\u5230 {count} \u500B\u8868\u683C\u3002\u6B63\u5728\u7372\u53D6\u67B6\u69CB\u8A73\u60C5...",
-      processing_tables: "   \u8655\u7406\u4E86 {processed}/{total} \u500B\u8868\u683C",
-      schema_exists_warning: "\u26A0\uFE0F \u8CC7\u6599\u5EAB\u67B6\u69CB\u5DF2\u5B58\u5728\u65BC .dbcli",
-      use_force_to_override: "   \u4F7F\u7528 --force \u9032\u884C\u8986\u84CB\u800C\u7121\u9700\u78BA\u8A8D"
-    },
-    list: {
-      description: "\u5217\u51FA\u8CC7\u6599\u5EAB\u4E2D\u7684\u6240\u6709\u8868\u683C",
-      no_tables: "\u8CC7\u6599\u5EAB\u4E2D\u672A\u627E\u5230\u8868\u683C"
-    },
-    query: {
-      description: "\u57F7\u884C SQL \u67E5\u8A62",
-      executing: "\u6B63\u5728\u57F7\u884C\u67E5\u8A62...",
-      no_results: "\u672A\u8FD4\u56DE\u4EFB\u4F55\u7D50\u679C",
-      result_count: "\u7D50\u679C\uFF1A{count} \u5217"
+// src/core/config.ts
+import { join as join8 } from "path";
+import { mkdir as mkdir3 } from "fs/promises";
+function assertNoConnectionSelectorOnV1(connectionName) {
+  if (connectionName === void 0)
+    return;
+  throw new ConfigError(`\u9023\u7DDA '${connectionName}' \u4E0D\u5B58\u5728\uFF1A\u6B64\u5C08\u6848\u4F7F\u7528\u55AE\u4E00\u9023\u7DDA (v1) \u8A2D\u5B9A\uFF0C\u6C92\u6709\u5177\u540D\u9023\u7DDA\u3002` + " \u79FB\u9664 --use / DBCLI_CONNECTION\uFF0C\u6216\u6539\u7528 'dbcli init --conn-name <name>' \u5347\u7D1A\u70BA\u591A\u9023\u7DDA (v2) \u8A2D\u5B9A\u3002");
+}
+function setGlobalConnectionName(name) {
+  _globalConnectionName = name;
+}
+function getGlobalConnectionName() {
+  return _globalConnectionName;
+}
+async function getSchemaIsolationConnectionName(dbcliPath) {
+  let effectiveName = getGlobalConnectionName();
+  try {
+    let storagePath = await resolveConfigStoragePath(dbcliPath);
+    if (!((await Bun.file(storagePath).stat())?.isDirectory() ?? !1))
+      return;
+    let configJsonPath = join8(storagePath, "config.json"), configFile = Bun.file(configJsonPath);
+    if (!await configFile.exists())
+      return;
+    let raw = JSON.parse(await configFile.text());
+    if (detectConfigVersion(raw) !== 2)
+      return;
+    let v2Config = DbcliConfigV2Schema.parse(raw);
+    return resolveConnection(v2Config, effectiveName).name;
+  } catch {
+    return;
+  }
+}
+function isEnvReference(value) {
+  return typeof value === "object" && value !== null && "$env" in value && typeof value.$env === "string";
+}
+function resolveEnvReferences(config, env, parentKey) {
+  if (isEnvReference(config)) {
+    let envKey = config.$env, value = resolveEnvRef(config, parentKey ?? "<root>", env);
+    if (parentKey === "port") {
+      let portNum = parseInt(value, 10);
+      if (isNaN(portNum) || portNum < 1 || portNum > 65535)
+        throw new ConfigError(`${envKey} must be a valid port number (1-65535), got: ${value}`);
+      return portNum;
+    }
+    return value;
+  }
+  if (Array.isArray(config))
+    return config.map((item) => resolveEnvReferences(item, env, parentKey));
+  if (typeof config === "object" && config !== null) {
+    let resolved = {};
+    for (let [key, value] of Object.entries(config))
+      resolved[key] = resolveEnvReferences(value, env, key);
+    return resolved;
+  }
+  return config;
+}
+function parseEnvPassword(content) {
+  let match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
+  if (match?.[1] == null)
+    return null;
+  let raw = match[1].trim();
+  return (raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'")) && raw.length >= 2 ? raw.slice(1, -1) : raw;
+}
+var _globalConnectionName, DEFAULT_CONFIG, configModule;
+var init_config = __esm(() => {
+  init_validation();
+  init_errors3();
+  init_config_error_format();
+  init_config_v2();
+  init_config_binding();
+  init_public();
+  init_config_mutation_guard();
+  init_config_integrity();
+  DEFAULT_CONFIG = {
+    connection: {
+      system: "postgresql",
+      host: "localhost",
+      port: 5432,
+      user: "",
+      password: "",
+      database: ""
     },
-    q: {
-      description: "\u4F9D @name \u57F7\u884C\u5DF2\u4FDD\u5B58\u7684\u67E5\u8A62\u7247\u6BB5",
-      missing_param: "\u7247\u6BB5 '{name}' \u7F3A\u5C11\u5FC5\u8981\u53C3\u6578",
-      engine_mismatch: "\u7247\u6BB5 '{name}' \u5F15\u64CE\u4E0D\u7B26",
-      snippet_not_found: "\u627E\u4E0D\u5230\u7247\u6BB5\uFF1A{name}",
-      dry_run_header: "Dry-run \u9810\u89BD\uFF08\u4E0D\u6703\u57F7\u884C\uFF09\uFF1A"
+    permission: "query-only",
+    schema: {},
+    metadata: {
+      version: "1.0"
     },
+    blacklist: { tables: [], columns: {} },
     audit: {
-      description: "\u6AA2\u8996\u3001\u67E5\u8A62\u3001\u6E05\u7A7A\u6216\u6AA2\u67E5 audit log \u5065\u5EB7\u72C0\u614B",
-      tail: {
-        description: "\u986F\u793A\u6700\u8FD1\u7684 audit \u7D00\u9304\uFF08\u9810\u8A2D\uFF1A\u7576\u524D\u9023\u7DDA\u6700\u5F8C 10 \u7B46\uFF09"
-      },
-      show: {
-        description: "\u4F9D id\uFF08UUID \u524D\u7DB4 \u22654 \u78BC\uFF09\u6216 --recovery-ref \u67E5\u8A62\u55AE\u7B46 audit \u7D00\u9304"
-      },
-      clear: {
-        description: "\u522A\u9664\u7576\u524D\u9023\u7DDA\u7684 audit log \u6A94\u6848\uFF08.jsonl \u8207 .jsonl.1\uFF09",
-        prompt_header: "\u5373\u5C07\u6E05\u7A7A\u9023\u7DDA '{conn}' \u7684 audit log\uFF1A",
-        prompt_file_line: "  {file}       \u2014 {entries} \u7B46\uFF0C{size}",
-        prompt_continue: "\u78BA\u8A8D\u57F7\u884C\uFF1F[y/N] ",
-        requires_tty_or_yes: "\u975E\u4E92\u52D5 session \u7121\u6CD5\u986F\u793A\u78BA\u8A8D\u63D0\u793A\u3002\u8ACB\u4F7F\u7528 --yes \u76F4\u63A5\u6E05\u7A7A\u3002",
-        summary_cleared: "\u5DF2\u5F9E '{conn}' \u6E05\u9664 {count} \u7B46 audit \u7D00\u9304\u3002",
-        summary_nothing: "\u6C92\u6709\u53EF\u6E05\u9664\u7684\u5167\u5BB9\u3002",
-        summary_failed: "\u6E05\u9664\u5931\u6557\uFF1A{message}\u3002"
-      },
-      health: {
-        description: "\u986F\u793A AuditLogger \u5065\u5EB7\u72C0\u614B\uFF08\u6A94\u6848\u5927\u5C0F\u3001\u7B46\u6578\u3001lock \u72C0\u614B\u3001\u6700\u5F8C\u5BEB\u5165\u7D50\u679C\uFF09"
-      },
-      write_gate: {
-        description: "\u7D71\u8A08\u7B2C\u4E8C\u7D1A\u5BEB\u5165\u9598\u9580\u7684\u5224\u5B9A\uFF08ADR 0010 \u62BC\u6CE8\u7684\u90A3\u500B\u91CF\u6E2C\uFF09",
-        header: "\u5BEB\u5165\u9598\u9580\u6458\u8981 \u2014 \u9023\u7DDA\uFF1A{conn}",
-        window: "\u6383\u904E\u7684\u7A3D\u6838\u7D00\u9304\uFF1A{scanned} \u7B46\uFF0C{from} \u2192 {to}",
-        decisions: "\u7B2C\u4E8C\u7D1A\u5224\u5B9A\uFF1A{count} \u6B21\uFF0C{from} \u2192 {to}",
-        tier_one: "\u7B2C\u4E00\u7D1A\uFF0C\u5206\u958B\u8A08\u7B97\uFF1A{count} \u6B21\uFF08{outcomes}\uFF09",
-        no_decisions: "\u9019\u6BB5\u5340\u9593\u5167\u7B2C\u4E8C\u7D1A\u4E00\u6B21\u90FD\u6C92\u88AB\u89F8\u53CA\u3002\u4F9D ADR 0010\uFF0C\u9019\u63A8\u7FFB\u7684\u662F\u5224\u6E96\u800C\u4E0D\u662F\u9598\u9580\uFF1A\u5B83\u5728\u627E\u7684\u5F62\u72C0\u4E0D\u662F\u5927\u5BB6\u5BE6\u969B\u6703\u5BEB\u7684\u5F62\u72C0\u3002",
-        no_entries: "\u7A3D\u6838\u7D00\u9304\u662F\u7A7A\u7684\uFF0C\u6240\u4EE5\u9019\u5C0D\u9598\u9580\u6C92\u6709\u4EFB\u4F55\u7D50\u8AD6\u3002\u5148\u8DD1\u4E00\u4E9B\u5BEB\u5165\uFF0C\u6216\u7528 `dbcli audit health` \u6AA2\u67E5\u3002"
-      },
-      disabled_hint: "Audit \u5DF2\u505C\u7528\uFF08.dbcli \u4E2D audit.enabled = false\uFF09\u3002\u57F7\u884C `dbcli audit health` \u67E5\u770B\u8A73\u60C5\u3002",
-      no_entries: "\u6C92\u6709 audit \u7D00\u9304\u3002",
-      show_no_match: "\u627E\u4E0D\u5230\u7B26\u5408 '{prefix}' \u7684 audit \u7D00\u9304\u3002",
-      show_ambiguous: "\u524D\u7DB4 '{prefix}' \u4E0D\u5920\u7CBE\u78BA\uFF1A\u5339\u914D\u5230 {count} \u7B46\u7D00\u9304\uFF0C\u8ACB\u6539\u7528\u66F4\u9577\u7684\u524D\u7DB4\u3002",
-      show_prefix_too_short: "\u524D\u7DB4\u81F3\u5C11\u9700 4 \u500B\u5B57\u5143\u3002",
-      show_recovery_no_match: "\u6C92\u6709\u4EFB\u4F55 audit \u7D00\u9304\u7684 recovery_ref \u70BA '{ref}'\u3002",
-      show_recovery_ambiguous: "\u6709 {count} \u7B46\u7D00\u9304\u7684 recovery_ref \u70BA '{ref}'\uFF0C\u9019\u61C9\u5C6C\u7F55\u898B\u60C5\u6CC1\uFF1B\u8ACB\u76F4\u63A5\u6AA2\u8996\u6A94\u6848\u3002",
-      show_mutex_violation: "\u8ACB\u64C7\u4E00\u63D0\u4F9B <id> \u53C3\u6578\u6216 --recovery-ref\uFF0C\u5169\u8005\u4E0D\u53EF\u540C\u6642\u4F7F\u7528\u3002",
-      n_capped_warning: "--n \u503C {requested} \u8D85\u904E\u4E0A\u9650 {max}\uFF0C\u5DF2\u81EA\u52D5\u7E2E\u6E1B\u70BA {max}\u3002",
-      n_must_be_positive: "--n \u5FC5\u9808\u70BA\u6B63\u6574\u6578\u3002"
-    },
-    queries: {
-      description: "\u7BA1\u7406\u5DF2\u4FDD\u5B58\u7684\u67E5\u8A62\u7247\u6BB5",
-      list_description: "\u5217\u51FA\u6240\u6709\u7247\u6BB5",
-      show_description: "\u986F\u793A\u7247\u6BB5\u5167\u5BB9\uFF08frontmatter + SQL\uFF09",
-      new_description: "\u5EFA\u7ACB\u65B0\u7684\u7247\u6BB5\u6A94",
-      edit_description: "\u4EE5 $EDITOR \u958B\u555F\u7247\u6BB5",
-      check_description: "\u9A57\u8B49\u6240\u6709\u7247\u6BB5",
-      delete_description: "\u522A\u9664 local snippet \u6A94\u6848",
-      rename_description: "\u91CD\u65B0\u547D\u540D local snippet",
-      copy_description: "\u5C07\u4EFB\u4E00\u5C64\u7D1A\u7684 snippet \u8907\u88FD\u5230 local",
-      import_description: "\u532F\u5165\u5916\u90E8 .sql \u6A94\u6848\u5230 local",
-      export_description: "\u5C07 snippet \u539F\u59CB SQL \u8F38\u51FA\u5230 stdout \u6216\u6A94\u6848",
-      created: "\u5DF2\u5EFA\u7ACB {file}",
-      first_run_hint: "\u63D0\u793A\uFF1A\u5C07 .dbcli-shared/ commit \u9032\u7248\u63A7\u53EF\u8207\u5718\u968A\u5171\u4EAB\u7247\u6BB5\u3002",
-      no_snippets: "\u5C1A\u7121\u4EFB\u4F55\u7247\u6BB5\u3002\u57F7\u884C dbcli queries new @<name> \u5EFA\u7ACB\u3002",
-      check_ok: "\u2713 \u6210\u529F\u89E3\u6790 {count} \u500B\u7247\u6BB5",
-      check_failed: "\u2717 \u6709 {count} \u500B\u7247\u6BB5\u89E3\u6790\u5931\u6557",
-      search_description: "\u4F9D\u95DC\u9375\u5B57\u641C\u5C0B snippet\uFF08fuzzy \u6392\u5E8F\uFF09",
-      suggest_description: "\u4F9D intent prefix \u63A8\u85A6 snippet",
-      search_no_keywords: "\u81F3\u5C11\u63D0\u4F9B\u4E00\u500B\u95DC\u9375\u5B57\uFF0C\u6216\u8A66\u8A66 'queries list' / 'queries suggest'\u3002",
-      search_no_results: "\u6C92\u6709\u547D\u4E2D\u7684 snippet\u3002\u8A66\u8A66 'queries list' \u6216 'queries suggest <intent>'\u3002",
-      suggest_missing_intent: "\u8ACB\u63D0\u4F9B intent\uFF08\u6216 prefix\uFF09\u3002\u53EF\u7528\uFF1A{available}",
-      suggest_invalid_intent: "Intent '{value}' \u683C\u5F0F\u932F\u8AA4\uFF0C\u5FC5\u9808\u7B26\u5408 ^[a-z][a-z0-9.-]*$",
-      suggest_no_results: "\u6C92\u6709 intent prefix \u70BA '{intent}' \u7684 snippet\u3002\u53EF\u7528\uFF1A{available}",
-      no_active_connection_hint: "\u5C1A\u672A\u8A2D\u5B9A connection\uFF1B\u5217\u51FA\u6240\u6709\u5F15\u64CE\u7684 snippet\u3002"
-    },
-    errors: {
-      message: "\u932F\u8AA4\uFF1A{message}",
-      query_only_boundary_failed: "\u7121\u6CD5\u70BA {system} \u5EFA\u7ACB query-only \u8CC7\u6599\u5EAB\u908A\u754C\uFF1A{detail}",
-      query_only_boundary_verify: "\u8ACB\u78BA\u8A8D {system} \u652F\u63F4\u552F\u8B80\u4EA4\u6613\uFF0C\u4E14\u6B64\u5E33\u865F\u53EF\u4EE5\u555F\u52D5\u4EA4\u6613",
-      query_only_boundary_not_executed: "\u76EE\u6A19\u8A9E\u53E5\u5C1A\u672A\u57F7\u884C\uFF1B\u8ACB\u4FEE\u6B63\u8CC7\u6599\u5EAB\u8A2D\u5B9A\u6216\u9023\u7DDA\u5F8C\u518D\u8A66",
-      query_only_cleanup_completed: "query-only \u76EE\u6A19\u5DF2\u5B8C\u6210\uFF0C\u4F46 {system} \u7684\u4EA4\u6613\u6E05\u7406\u5931\u6557\uFF1A{detail}",
-      query_only_cleanup_uncertain: "query-only \u76EE\u6A19\u5931\u6557\uFF0C\u4E14 {system} \u7684\u4EA4\u6613\u6E05\u7406\u4E5F\u5931\u6557\uFF0C\u56E0\u6B64\u7D50\u679C\u4E0D\u78BA\u5B9A\uFF1A{detail}",
-      query_only_cleanup_completed_retry: "\u76EE\u6A19\u8A9E\u53E5\u5DF2\u57F7\u884C\uFF1B\u9664\u975E\u53EF\u5B89\u5168\u91CD\u8907\u5176\u5916\u90E8\u526F\u4F5C\u7528\uFF0C\u5426\u5247\u4E0D\u8981\u91CD\u8A66",
-      query_only_cleanup_uncertain_retry: "\u76EE\u6A19\u8A9E\u53E5\u53EF\u80FD\u5728\u5931\u6557\u524D\u7522\u751F\u526F\u4F5C\u7528\uFF1B\u9664\u975E\u53EF\u5B89\u5168\u91CD\u8907\u9019\u4E9B\u526F\u4F5C\u7528\uFF0C\u5426\u5247\u4E0D\u8981\u91CD\u8A66",
-      query_only_cleanup_reconnect: "\u6B64\u9023\u7DDA\u5DF2\u4E1F\u68C4\uFF1B\u57F7\u884C\u4E0B\u4E00\u53E5\u524D\u8ACB\u5148\u91CD\u65B0\u9023\u7DDA",
-      invalid_config: "\u914D\u7F6E\u7121\u6548\uFF1A{field}",
-      connection_failed: "\u7121\u6CD5\u9023\u63A5\u5230\u8CC7\u6599\u5EAB\uFF1A{message}",
-      permission_denied: "\u6B0A\u9650\u88AB\u62D2\uFF08\u9700\u8981\uFF1A{required}\uFF09",
-      permission_requires_level: "{type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
-      elasticsearch_requires_level: "Elasticsearch {type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
-      escalated_write_requires_admin: "\u6B64\u8A9E\u53E5\u8868\u9762\u4E0A\u662F\u8B80\u53D6\uFF0C\u4F46\u5BE6\u969B\u5305\u542B\u53EF\u57F7\u884C\u7684 {keyword}\u3002\u8B80\u53D6\u8A9E\u53E5\u4E2D\u96B1\u85CF\u5BEB\u5165\u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09\u3002",
-      multiple_statements_refused: "\u4F4E\u65BC admin \u6B0A\u9650\u6642\u62D2\u7D55\u57F7\u884C\u5305\u542B\u591A\u500B\u8A9E\u53E5\u7684 SQL\uFF0C\u56E0\u70BA\u6B0A\u9650\u6AA2\u67E5\u53EA\u6703\u4F9D\u64DA\u7B2C\u4E00\u500B\u8A9E\u53E5\u5224\u65B7\u3002\u8ACB\u5C07\u5404\u8A9E\u53E5\u5206\u958B\u57F7\u884C\u3002",
-      unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u9700\u8981 admin \u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
-      permission_denied_reason: "\u6B0A\u9650\u88AB\u62D2\uFF1A{reason}",
-      table_not_found: "\u627E\u4E0D\u5230\u8868\u683C\uFF1A{table}",
-      unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
-      invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
-      table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
-      redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
-      column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
-      table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
-      table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
-      column_already_blacklisted: "\u932F\u8AA4: \u6B04\u4F4D '{table}.{column}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
-      column_not_in_blacklist: "\u932F\u8AA4: \u6B04\u4F4D '{table}.{column}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
-      invalid_table_name: "\u932F\u8AA4: \u7121\u6548\u7684\u8868\u683C\u540D\u7A31: {table}",
-      invalid_column_format: "\u932F\u8AA4: \u7121\u6548\u7684\u6B04\u4F4D\u683C\u5F0F\u3002\u4F7F\u7528 'table.column'",
-      invalid_system: "\u7121\u6548\u7684\u8CC7\u6599\u5EAB\u7CFB\u7D71\uFF1A{system}",
-      invalid_permission: "\u7121\u6548\u7684\u6B0A\u9650\u7B49\u7D1A\uFF1A{permission}",
-      invalid_port: "\u7121\u6548\u7684\u57E0\u865F\uFF1A{port}",
-      require_user: "\u975E\u4E92\u52D5\u6A21\u5F0F\u9700\u8981 --user \u9078\u9805",
-      require_name: "\u975E\u4E92\u52D5\u6A21\u5F0F\u9700\u8981 --name \u9078\u9805",
-      env_refs_missing_options: `\u4F7F\u7528 --use-env-refs \u6642\uFF0C\u5FC5\u9808\u6307\u5B9A\u74B0\u5883\u8B8A\u6578\u540D\u7A31\u3002
-\u8ACB\u63D0\u4F9B\u9078\u9805\uFF1A--env-host\u3001--env-port\u3001--env-user\u3001--env-password\u3001--env-database
-\u6216\u4F7F\u7528\u4E92\u52D5\u6A21\u5F0F\uFF1A\u57F7\u884C "dbcli init --use-env-refs"\uFF08\u4E0D\u52A0 --no-interactive\uFF09`,
-      env_var_not_defined: `\u7121\u6CD5\u6E2C\u8A66\u9023\u7DDA\uFF1A\u74B0\u5883\u8B8A\u6578 {envKey} \u672A\u5B9A\u7FA9\u3002
-\u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u6578\u4E2D\u8A2D\u5B9A {envKey}\u3002
-\u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`,
-      invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json",
-      sqlite_file_required: "SQLite \u9023\u7DDA\u9700\u8981\u4E00\u500B\u6A94\u6848\u8DEF\u5F91\u3002\u8ACB\u7528 --file <path>\uFF0C\u6216\u4EE5\u4E92\u52D5\u6A21\u5F0F\u57F7\u884C init\u3002"
-    },
-    success: {
-      inserted: "\u6210\u529F\u63D2\u5165 {count} \u5217",
-      updated: "\u6210\u529F\u66F4\u65B0 {count} \u5217",
-      deleted: "\u6210\u529F\u522A\u9664 {count} \u5217",
-      no_changes: "\u6C92\u6709\u8B8A\u66F4\u8981\u5957\u7528"
-    },
-    insert: {
-      description: "\u63D2\u5165\u8CC7\u6599\u5230\u8868\u683C",
-      prompt_data: "\u8F38\u5165\u8981\u63D2\u5165\u7684 JSON \u8CC7\u6599\uFF1A",
-      confirm: "\u5C07 {count} \u5217\u63D2\u5165\u5230 {table}\uFF1F (y/n)\uFF1A",
-      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 insert \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u5BEB\u5165"
-    },
-    update: {
-      description: "\u66F4\u65B0\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
-      prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
-      prompt_set: '\u8F38\u5165 JSON \u66F4\u65B0 (\u4F8B\u5982\uFF1A{"status": "active"})\uFF1A',
-      confirm: "\u66F4\u65B0 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
-      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 update \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u66F4\u65B0"
-    },
-    delete: {
-      description: "\u522A\u9664\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
-      prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
-      confirm: "\u522A\u9664 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
-      admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650",
-      elasticsearch_unsupported: "Elasticsearch \u4E0D\u652F\u63F4 delete \u6307\u4EE4\uFF1B\u76EE\u524D\u8ACB\u4F7F\u7528\u5916\u90E8\u5DE5\u5177\uFF08\u5982 curl \u6216 Kibana DevTools\uFF09\u9032\u884C\u6587\u4EF6\u522A\u9664"
-    },
-    export: {
-      description: "\u532F\u51FA\u67E5\u8A62\u7D50\u679C",
-      formats: "\u652F\u63F4\u7684\u683C\u5F0F\uFF1Ajson\u3001csv",
-      exported: "\u5DF2\u5C07 {count} \u5217\u532F\u51FA\u81F3 {file}"
-    },
-    upgrade: {
-      description: "\u6AA2\u67E5\u66F4\u65B0\u4E26\u5C07 dbcli \u5347\u7D1A\u81F3\u6700\u65B0\u7248\u672C",
-      checking: "\u6B63\u5728\u6AA2\u67E5\u66F4\u65B0...",
-      already_up_to_date: "\u2713 \u5DF2\u7D93\u662F\u6700\u65B0\u7248\u672C (v{version})",
-      new_version_available: "\u767C\u73FE\u65B0\u7248\u672C\uFF1Av{version}",
-      current_version: "\u76EE\u524D\u7248\u672C\uFF1Av{version}",
-      latest_version: "\u6700\u65B0\u7248\u672C\uFF1Av{version}",
-      update_hint: '[\u63D0\u793A] dbcli v{version} \u5DF2\u767C\u5E03\u3002\u57F7\u884C "dbcli upgrade" \u9032\u884C\u5347\u7D1A\u3002',
-      install_hint: '\u57F7\u884C "dbcli upgrade" \u5B89\u88DD\u66F4\u65B0\u3002',
-      upgrading: "\u6B63\u5728\u5347\u7D1A...",
-      success: "\u2713 \u6210\u529F\u5347\u7D1A\u81F3 v{version}",
-      skill_recheck_hint: '\u63D0\u793A\uFF1A\u82E5\u5DF2\u5B89\u88DD AI \u6280\u80FD\uFF0C\u8ACB\u57F7\u884C "dbcli skill --install <platform>" \u78BA\u8A8D\u6280\u80FD\u70BA\u6700\u65B0\u7248\u672C\u3002',
-      failed: "\u2717 \u5347\u7D1A\u5931\u6557\u3002\u8ACB\u5617\u8A66\u624B\u52D5\u57F7\u884C\uFF1A",
-      manual_hint: "bun add -g @carllee1983/dbcli@latest",
-      network_error: "\u26A0 \u7121\u6CD5\u6AA2\u67E5\u66F4\u65B0\uFF08\u7DB2\u8DEF\u932F\u8AA4\u6216\u8A3B\u518A\u8868\u4E0D\u53EF\u7528\uFF09"
-    },
-    skill: {
-      description: "\u751F\u6210 AI \u6280\u80FD\u6587\u6A94",
-      context_description: "\u751F\u6210 AI \u5354\u4F5C\u6240\u9700\u7684\u8CC7\u6599\u5EAB\u67B6\u69CB\u8207\u67E5\u8A62\u7247\u6BB5\u4E0A\u4E0B\u6587",
-      installed: `\u6280\u80FD: {path}
-\u53C3\u8003: {referencePath}`,
-      update_available: "\u4EE5\u4E0B\u5E73\u53F0\u7684\u6280\u80FD\u9700\u8981\u66F4\u65B0\uFF1A",
-      update_hint: '\u57F7\u884C "dbcli skill --install <platform>" \u9032\u884C\u66F4\u65B0\u3002'
-    },
-    blacklist: {
-      description: "\u7BA1\u7406\u654F\u611F\u8CC7\u6599\u9ED1\u540D\u55AE\u4EE5\u9632\u6B62 AI \u5B58\u53D6",
-      list_title: "\u76EE\u524D\u9ED1\u540D\u55AE\u914D\u7F6E",
-      tables_label: "\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C",
-      columns_label: "\u5DF2\u9ED1\u540D\u55AE\u7684\u6B04\u4F4D",
-      none: "\u76EE\u524D\u6C92\u6709\u9ED1\u540D\u55AE\u8868\u683C\u6216\u6B04\u4F4D",
-      table_added: "\u2713 \u8868\u683C '{table}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
-      table_removed: "\u2713 \u8868\u683C '{table}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
-      column_added: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
-      column_removed: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
-      refuse_wildcard: "\u5DF2\u62D2\u7D55\uFF1A'{table}' \u542B\u6709\u842C\u7528\u5B57\u5143\uFF0C\u800C {system} \u4E0A\u7684\u6BD4\u5C0D\u662F\u9010\u5B57\u9032\u884C\u7684\u2014\u2014\u9019\u7B46\u8A2D\u5B9A\u6C38\u9060\u4E0D\u6703\u547D\u4E2D\u4EFB\u4F55\u6771\u897F\u3002\u8ACB\u5BEB\u51FA\u78BA\u5207\u7684\u540D\u7A31\u3002"
-    },
-    security: {
-      columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
-    },
-    warnings: {
-      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
-      redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
+      enabled: !0,
+      strict: !1,
+      rotation: { ...DEFAULT_AUDIT_ROTATION }
+    }
+  };
+  configModule = {
+    async read(path, connectionName, options = {}) {
+      let effectiveConnectionName = connectionName ?? _globalConnectionName, rawForDiagnostics;
+      try {
+        let binding = await readProjectBinding(path), storagePath = await resolveConfigStoragePath(path);
+        if (binding) {
+          if (!await Bun.file(join8(storagePath, "config.json")).exists())
+            throw new ConfigError(`Bound dbcli config not found: ${join8(storagePath, "config.json")}`);
+        }
+        let isDirectory = !1;
+        try {
+          isDirectory = (await Bun.file(storagePath).stat())?.isDirectory() ?? !1;
+        } catch {
+          isDirectory = !1;
+        }
+        if (isDirectory) {
+          let configPath = join8(storagePath, "config.json"), configFile = Bun.file(configPath);
+          if (await configFile.exists()) {
+            await assertAgentReadableFile(configPath);
+            let content = await configFile.text();
+            await assertConfigIntegrity(storagePath, content, { requireRecord: !0 });
+            let config = JSON.parse(content);
+            if (rawForDiagnostics = config, detectConfigVersion(config) === 2) {
+              let v2Config = DbcliConfigV2Schema.parse(config), resolved = resolveConnection(v2Config, effectiveConnectionName);
+              assertExplicitProductionSelection(resolved, effectiveConnectionName), await loadConnectionEnv(resolved, storagePath);
+              let envLocalPath = join8(storagePath, ".env.local"), envLocalFile = Bun.file(envLocalPath), legacyPassword = null;
+              if (await envLocalFile.exists()) {
+                let envContent = await envLocalFile.text();
+                if (legacyPassword = parseEnvPassword(envContent), legacyPassword && !process.env.DBCLI_PASSWORD)
+                  process.env.DBCLI_PASSWORD = legacyPassword;
+              }
+              let resolvedConnection = resolveEnvReferences(resolved.connection, process.env);
+              if (!resolvedConnection.password && legacyPassword)
+                resolvedConnection.password = legacyPassword;
+              let schema = (v2Config.schemas ?? {})[resolved.name] ?? v2Config.schema;
+              if (options.loadLayeredSchema !== !1)
+                try {
+                  await Promise.resolve().then(() => init_schema_loader());
+                  let loader = new SchemaLayeredLoader(storagePath, {
+                    connectionName: resolved.name
+                  }), { cache, index } = await loader.initialize();
+                  if (index && Object.keys(index.tables).length > 0) {
+                    let layeredSchema = {};
+                    for (let tableName of Object.keys(index.tables)) {
+                      let s = await cache.getTableSchema(tableName);
+                      if (s)
+                        layeredSchema[tableName] = s;
+                    }
+                    if (Object.keys(layeredSchema).length > 0)
+                      schema = layeredSchema;
+                  }
+                } catch {
+                  console.warn("Warning: Failed to load layered schema cache, falling back to config.json");
+                }
+              return {
+                ...DbcliConfigSchema.parse({
+                  connection: resolvedConnection,
+                  permission: resolved.permission,
+                  schema,
+                  metadata: v2Config.metadata,
+                  blacklist: v2Config.blacklist,
+                  audit: v2Config.audit,
+                  redis: v2Config.redis
+                }),
+                effectiveConnectionName: resolved.name,
+                ...resolved.environment && { effectiveEnvironment: resolved.environment }
+              };
+            }
+            if (assertNoConnectionSelectorOnV1(effectiveConnectionName), config.connection?.sqlTls !== void 0)
+              ConnectionConfigSchema.parse(config.connection);
+            let resolvedConfig = resolveEnvReferences(config, process.env), envPath = join8(storagePath, ".env.local"), envFile = Bun.file(envPath);
+            if (await envFile.exists()) {
+              let envContent = await envFile.text(), password = parseEnvPassword(envContent);
+              if (password && !resolvedConfig.connection.password)
+                resolvedConfig.connection.password = password;
+            }
+            return DbcliConfigSchema.parse(resolvedConfig);
+          }
+        }
+        let file = Bun.file(path);
+        if (await file.exists()) {
+          if (process.env.DBCLI_AGENT_MODE === "1")
+            throw new ConfigError(`Agent mode refuses legacy single-file config: ${path}. Run the human/admin migration workflow to move it to V2 home storage first.`);
+          assertNoConnectionSelectorOnV1(effectiveConnectionName);
+          let content = await file.text(), raw = JSON.parse(content);
+          if (rawForDiagnostics = raw, raw.connection?.sqlTls !== void 0)
+            ConnectionConfigSchema.parse(raw.connection);
+          let resolved = resolveEnvReferences(raw, process.env);
+          return DbcliConfigSchema.parse(resolved);
+        }
+        if (process.env.DBCLI_AGENT_MODE === "1")
+          throw new ConfigError(`Agent mode refuses a missing config: ${path}. Run the human/admin setup workflow to provision it.`);
+        return { ...DEFAULT_CONFIG };
+      } catch (error) {
+        if (error instanceof ConfigError)
+          throw error;
+        if (isZodError(error))
+          throw new ConfigError(`Failed to read .dbcli config: \u8A2D\u5B9A\u5167\u5BB9\u4E0D\u7B26\u5408\u7D50\u69CB
+${formatConfigValidationError(error, rawForDiagnostics)}`);
+        if (error instanceof Error && error.message.includes("JSON"))
+          throw new ConfigError(`Failed to parse .dbcli file: ${error.message}`);
+        throw new ConfigError(`Failed to read .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
+      }
     },
-    version: {
-      unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
-      doctor_pass: "{system} {version}\uFF08\u7B26\u5408 >= {minVersion}\uFF09",
-      doctor_warn: "{system} {version} \u4F4E\u65BC\u652F\u63F4\u7248\u672C >= {minVersion}"
+    validate(raw) {
+      try {
+        return DbcliConfigSchema.parse(raw);
+      } catch (error) {
+        if (isZodError(error))
+          throw new ConfigError(`Invalid .dbcli config structure:
+${formatConfigValidationError(error, raw)}`);
+        let errorMessage = error instanceof Error ? error.message : String(error);
+        throw new ConfigError(`Invalid .dbcli config structure: ${errorMessage}`);
+      }
     },
-    migrate: {
-      description: "Schema DDL \u64CD\u4F5C\uFF08CREATE/DROP/ALTER TABLE\u3001INDEX\u3001CONSTRAINT\u3001ENUM\uFF09",
-      dry_run_preview: "[\u9810\u89BD] \u7522\u751F\u7684 SQL\uFF08\u672A\u57F7\u884C\uFF09\uFF1A",
-      executing: "\u57F7\u884C DDL \u4E2D...",
-      success: "DDL \u57F7\u884C\u6210\u529F",
-      confirm_drop: "\u9019\u662F\u7834\u58DE\u6027\u64CD\u4F5C\uFF08{operation}\uFF09\uFF0C\u78BA\u5B9A\u7E7C\u7E8C\uFF1F",
-      permission_required: "DDL \u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\uFF1A{permission}\uFF09",
-      blacklist_blocked: '\u8868\u683C "{table}" \u5DF2\u88AB\u5217\u5165\u9ED1\u540D\u55AE \u2014 DDL \u64CD\u4F5C\u88AB\u963B\u64CB',
-      schema_refreshed: '\u5DF2\u66F4\u65B0\u8868\u683C "{table}" \u7684 Schema \u5FEB\u53D6',
-      no_sql_generated: "\u672A\u7522\u751F SQL\uFF08\u6B64\u64CD\u4F5C\u4E0D\u9069\u7528\u65BC\u6B64\u8CC7\u6599\u5EAB\uFF09",
-      create_description: "\u5EFA\u7ACB\u65B0\u8868\u683C",
-      drop_description: "\u522A\u9664\u8868\u683C",
-      add_column_description: "\u65B0\u589E\u6B04\u4F4D\u81F3\u8868\u683C",
-      drop_column_description: "\u522A\u9664\u8868\u683C\u6B04\u4F4D",
-      alter_column_description: "\u4FEE\u6539\u8868\u683C\u6B04\u4F4D",
-      add_index_description: "\u65B0\u589E\u7D22\u5F15\u81F3\u8868\u683C",
-      drop_index_description: "\u522A\u9664\u7D22\u5F15",
-      add_constraint_description: "\u65B0\u589E\u7D04\u675F\u81F3\u8868\u683C",
-      drop_constraint_description: "\u522A\u9664\u8868\u683C\u7D04\u675F",
-      add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
-      alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
-      drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+    merge(existing, updates) {
+      return {
+        ...existing,
+        ...updates,
+        connection: {
+          ...existing.connection,
+          ...updates.connection || {}
+        },
+        schema: {
+          ...existing.schema,
+          ...updates.schema || {}
+        },
+        metadata: {
+          ...existing.metadata,
+          ...updates.metadata || {},
+          createdAt: existing.metadata?.createdAt || (/* @__PURE__ */ new Date()).toISOString(),
+          version: existing.metadata?.version || "1.0"
+        }
+      };
     },
-    password: {
-      description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
-      arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
-      opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
-      opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
-      opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
-      prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
-      source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
-      needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
-      empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
-      updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
-      converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
-      skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
-    }
-  };
-});
+    async write(path, config) {
+      try {
+        assertConfigMutationApproved(), this.validate(config);
+        let storagePath = await resolveConfigStoragePath(path), isDirectory = !1;
+        try {
+          isDirectory = (await Bun.file(storagePath).stat())?.isDirectory() ?? !1;
+        } catch {
+          isDirectory = !1;
+        }
+        if (isDirectory || path.endsWith(".dbcli") || path === storagePath && isDirectory)
+          if (await mkdir3(storagePath, { recursive: !0 }), isEnvReference(config.connection.password)) {
+            let configJson = JSON.stringify(config, null, 2);
+            await writeConfigWithIntegrity(storagePath, configJson);
+          } else {
+            let password = config.connection.password, configWithoutPassword = {
+              ...config,
+              connection: {
+                ...config.connection,
+                password: void 0
+              }
+            };
+            delete configWithoutPassword.connection.password;
+            let configJson = JSON.stringify(configWithoutPassword, null, 2);
+            if (await writeConfigWithIntegrity(storagePath, configJson), password) {
+              let envPath = join8(storagePath, ".env.local"), envContent = `# Database Credentials - DO NOT commit to git
 
-// resources/lang/en/shell.json
-var shell_default;
-var init_shell = __esm(() => {
-  shell_default = {
-    welcome: "Connected to {system} ({database}@{host}:{port})",
-    welcome_permission: "Permission: {permission}",
-    prompt: "dbcli",
-    continuation_prompt: "   ...",
-    goodbye: "Goodbye.",
-    error_no_config: "No .dbcli config found. Run 'dbcli init' first.",
-    error_connection_failed: "Connection failed: {message}",
-    error_reconnecting: "Connection lost. Attempting to reconnect...",
-    error_reconnect_failed: "Reconnection failed: {message}",
-    error_reconnect_success: "Reconnected successfully.",
-    error_command_failed: "Command error: {message}",
-    error_sql_failed: "SQL error: {message}",
-    error_permission: "Permission denied. Required: {required} (current: {current})",
-    error_blacklisted: "Table '{table}' is blacklisted.",
-    sql_mode_hint: "SQL-only mode. Only SQL statements are accepted.",
-    multiline_cancelled: "Multiline input cancelled.",
-    timing_display: "Time: {ms}ms",
-    rows_display: "{count} row(s)",
-    unknown_command: "Unknown command: '{command}'. Type '.help' for available commands.",
-    subcommand_prefix_hint: "This line is being read as SQL and is waiting for its `;`. If you meant the dbcli subcommand, type {command} instead. Ctrl-C cancels.",
-    es: {
-      parse_empty: "Empty request",
-      parse_needs_method_path: 'Request requires a method and a path, e.g. "GET /index/_search"',
-      parse_needs_path: "Request requires a path",
-      refuse_dot_segment: "Refused: '{path}' contains a '..' segment once decoded, and dbcli cannot tell which path Elasticsearch would route it to. Write the path out without '..'.",
-      refuse_unparseable: "Refused: '{path}' is not the request the server would receive. It cannot be parsed as a path.",
-      refuse_not_canonical: "Refused: '{path}' is not the request the server would receive. Write it as '{canonical}'.",
-      refuse_source_param: "Refused: `source` in the query string is a request body by another route. Write the body as JSON.",
-      refuse_search_template: "Refused: '{path}' is a search template, whose body cannot be inspected \u2014 it is a string rendered on the cluster, or stored there. Write the query out in full.",
-      refuse_string_body: "Refused: a quoted string request body is not supported. Write the body as JSON.",
-      refuse_audit_strict: "Refused: the audit entry for this request could not be written, and audit.strict is on. Fix the audit sink (disk space, directory permissions, a stale lockfile in .dbcli/audit) or turn audit.strict off to accept unrecorded requests.",
-      blacklist_index: "index '{index}' is blacklist-protected",
-      blacklist_unscoped: "'{path}' names no index, so it cannot be checked against the blacklist. Scope the request to an index, e.g. GET /<index>/_search.",
-      blacklist_field: "field '{field}' is blacklist-protected and cannot be named in a request \u2014 sorting, aggregating or scripting on it would return its values.",
-      banner_title: "Elasticsearch shell \u2014 Kibana Dev Tools syntax",
-      banner_hint: 'Enter "<METHOD> /<path>" then an optional JSON body; submit with a blank line. Try: GET /_cat/indices',
-      banner_keys: 'Ctrl+C cancels the current block; Ctrl+D or "exit" quits.',
-      block_cancelled: "(block cancelled)",
-      goodbye: "Goodbye"
+DBCLI_PASSWORD=${password}
+`;
+              await Bun.file(envPath).write(envContent);
+            }
+          }
+        else {
+          let json = JSON.stringify(config, null, 2);
+          await Bun.file(path).write(json);
+        }
+      } catch (error) {
+        if (error instanceof ConfigError)
+          throw error;
+        throw new ConfigError(`Failed to write .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
+      }
     }
   };
 });
 
-// resources/lang/zh-TW/shell.json
-var shell_default2;
-var init_shell2 = __esm(() => {
-  shell_default2 = {
-    welcome: "\u5DF2\u9023\u7DDA\u81F3 {system}\uFF08{database}@{host}:{port}\uFF09",
-    welcome_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF1A{permission}",
-    prompt: "dbcli",
-    continuation_prompt: "   ...",
-    goodbye: "\u518D\u898B\u3002",
-    error_no_config: "\u627E\u4E0D\u5230 .dbcli \u8A2D\u5B9A\u6A94\u3002\u8ACB\u5148\u57F7\u884C 'dbcli init'\u3002",
-    error_connection_failed: "\u9023\u7DDA\u5931\u6557\uFF1A{message}",
-    error_reconnecting: "\u9023\u7DDA\u5DF2\u4E2D\u65B7\uFF0C\u5617\u8A66\u91CD\u65B0\u9023\u7DDA...",
-    error_reconnect_failed: "\u91CD\u65B0\u9023\u7DDA\u5931\u6557\uFF1A{message}",
-    error_reconnect_success: "\u91CD\u65B0\u9023\u7DDA\u6210\u529F\u3002",
-    error_command_failed: "\u6307\u4EE4\u932F\u8AA4\uFF1A{message}",
-    error_sql_failed: "SQL \u932F\u8AA4\uFF1A{message}",
-    error_permission: "\u6B0A\u9650\u4E0D\u8DB3\u3002\u9700\u8981\uFF1A{required}\uFF08\u76EE\u524D\uFF1A{current}\uFF09",
-    error_blacklisted: "\u8868\u683C '{table}' \u5DF2\u88AB\u5217\u5165\u9ED1\u540D\u55AE\u3002",
-    sql_mode_hint: "\u7D14 SQL \u6A21\u5F0F\u3002\u50C5\u63A5\u53D7 SQL \u8A9E\u53E5\u3002",
-    multiline_cancelled: "\u5DF2\u53D6\u6D88\u591A\u884C\u8F38\u5165\u3002",
-    timing_display: "\u8017\u6642\uFF1A{ms}ms",
-    rows_display: "{count} \u7B46\u8CC7\u6599",
-    unknown_command: "\u672A\u77E5\u6307\u4EE4\uFF1A'{command}'\u3002\u8F38\u5165 '.help' \u67E5\u770B\u53EF\u7528\u6307\u4EE4\u3002",
-    subcommand_prefix_hint: "\u9019\u4E00\u884C\u88AB\u7576\u6210 SQL\uFF0C\u6B63\u5728\u7B49\u5206\u865F\u3002\u5982\u679C\u4F60\u8981\u7684\u662F dbcli \u5B50\u6307\u4EE4\uFF0C\u8ACB\u6539\u6253 {command}\u3002Ctrl-C \u53EF\u53D6\u6D88\u3002",
-    es: {
-      parse_empty: "\u7A7A\u7684\u8ACB\u6C42",
-      parse_needs_method_path: '\u8ACB\u6C42\u9700\u8981\u4E00\u500B method \u8207\u4E00\u500B path\uFF0C\u4F8B\u5982 "GET /index/_search"',
-      parse_needs_path: "\u8ACB\u6C42\u9700\u8981\u4E00\u500B path",
-      refuse_dot_segment: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u89E3\u78BC\u5F8C\u542B\u6709 '..' \u5340\u6BB5\uFF0Cdbcli \u7121\u6CD5\u5224\u65B7 Elasticsearch \u6703\u628A\u5B83\u8DEF\u7531\u5230\u54EA\u500B\u8DEF\u5F91\u3002\u8ACB\u628A\u8DEF\u5F91\u5BEB\u6210\u4E0D\u542B '..' \u7684\u5F62\u5F0F\u3002",
-      refuse_unparseable: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u5B83\u7121\u6CD5\u88AB\u89E3\u6790\u6210\u4E00\u500B\u8DEF\u5F91\u3002",
-      refuse_not_canonical: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u8ACB\u5BEB\u6210 '{canonical}'\u3002",
-      refuse_source_param: "\u5DF2\u62D2\u7D55\uFF1Aquery string \u88E1\u7684 `source` \u662F\u53E6\u4E00\u689D\u8DEF\u5F91\u4E0A\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
-      refuse_search_template: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u662F search template\uFF0C\u5B83\u7684 body \u7121\u6CD5\u6AA2\u67E5\u2014\u2014\u90A3\u662F\u4E00\u500B\u5728\u53E2\u96C6\u4E0A\u7B97\u51FA\u4F86\u7684\u5B57\u4E32\uFF0C\u6216\u8005\u6839\u672C\u5B58\u5728\u53E2\u96C6\u88E1\u3002\u8ACB\u628A\u67E5\u8A62\u5B8C\u6574\u5BEB\u51FA\u4F86\u3002",
-      refuse_string_body: "\u5DF2\u62D2\u7D55\uFF1A\u4E0D\u652F\u63F4\u4EE5\u5F15\u865F\u5B57\u4E32\u5F62\u5F0F\u5BEB\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
-      refuse_audit_strict: "\u5DF2\u62D2\u7D55\uFF1A\u9019\u500B\u8ACB\u6C42\u7684\u7A3D\u6838\u7D00\u9304\u5BEB\u4E0D\u51FA\u53BB\uFF0C\u800C audit.strict \u662F\u958B\u7684\u3002\u8ACB\u4FEE\u597D\u7A3D\u6838\u8F38\u51FA\u7AEF\uFF08\u78C1\u789F\u7A7A\u9593\u3001\u76EE\u9304\u6B0A\u9650\u3001.dbcli/audit \u88E1\u6B98\u7559\u7684 lockfile\uFF09\uFF0C\u6216\u95DC\u6389 audit.strict \u4EE5\u63A5\u53D7\u6C92\u6709\u7D00\u9304\u7684\u8ACB\u6C42\u3002",
-      blacklist_index: "\u7D22\u5F15 '{index}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77",
-      blacklist_unscoped: "'{path}' \u6307\u4E0D\u51FA\u4EFB\u4F55\u7D22\u5F15\uFF0C\u56E0\u6B64\u7121\u6CD5\u5C0D\u7167\u9ED1\u540D\u55AE\u6AA2\u67E5\u3002\u8ACB\u628A\u8ACB\u6C42\u9650\u5B9A\u5230\u67D0\u500B\u7D22\u5F15\uFF0C\u4F8B\u5982 GET /<index>/_search\u3002",
-      blacklist_field: "\u6B04\u4F4D '{field}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77\uFF0C\u4E0D\u80FD\u51FA\u73FE\u5728\u8ACB\u6C42\u88E1\u2014\u2014\u5C0D\u5B83\u6392\u5E8F\u3001\u805A\u5408\u6216\u8DD1 script \u90FD\u6703\u628A\u5B83\u7684\u503C\u53D6\u56DE\u4F86\u3002",
-      banner_title: "Elasticsearch shell \u2014\u2014 Kibana Dev Tools \u8A9E\u6CD5",
-      banner_hint: '\u8F38\u5165 "<METHOD> /<path>"\uFF0C\u63A5\u8457\u5BEB\u53EF\u9078\u7684 JSON body\uFF1B\u7A7A\u4E00\u884C\u9001\u51FA\u3002\u53EF\u4EE5\u5148\u8A66\uFF1AGET /_cat/indices',
-      banner_keys: 'Ctrl+C \u53D6\u6D88\u76EE\u524D\u9019\u500B block\uFF1BCtrl+D \u6216 "exit" \u96E2\u958B\u3002',
-      block_cancelled: "\uFF08block \u5DF2\u53D6\u6D88\uFF09",
-      goodbye: "\u518D\u898B"
-    }
-  };
+// src/core/correlation-id.ts
+function isCorrelationId(value) {
+  return typeof value === "string" && CORRELATION_ID_PATTERN.test(value);
+}
+function setGlobalCorrelationId(value) {
+  if (value !== void 0 && !isCorrelationId(value))
+    throw Error("Invalid correlation ID");
+  globalCorrelationId = value;
+}
+function getGlobalCorrelationId() {
+  return globalCorrelationId;
+}
+var CORRELATION_ID_PATTERN, globalCorrelationId;
+var init_correlation_id = __esm(() => {
+  CORRELATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
 });
 
-// resources/lang/en/ceremony.json
-var ceremony_default;
-var init_ceremony = __esm(() => {
-  ceremony_default = {
-    updated: "Updated {count} row(s) in {table}",
-    deleted: "Deleted {count} row(s) from {table}",
-    inserted: "Inserted {count} row(s) into {table}",
-    matched_nothing: "No rows matched in {table} \u2014 nothing changed",
-    cancelled: "Cancelled. {table} was not changed",
-    dry_run: "Preview only. {table} was not changed",
-    elapsed: "Took {seconds}s",
-    failed: "Failed: {reason}",
-    unknown_error: "unknown error",
-    confirm_sql: "Generated SQL:",
-    confirm_command: "Command to run:",
-    confirm_params: "Parameters:",
-    confirm_destructive_warning: "\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!",
-    confirm_destructive_prompt: "Are you sure you want to execute this DELETE operation? This cannot be undone.",
-    confirm_destructive_warning_ddl: "\u26A0\uFE0F  Warning: this schema change is destructive and cannot be undone!",
-    confirm_ddl_prompt: "Are you sure you want to run this {operation}? This cannot be undone.",
-    confirm_prompt: "Proceed with this operation?",
-    gate_summary: "This will {operation} rows in {table}.",
-    gate_summary_untargeted: "This will run a {operation} statement.",
-    gate_statement: "Statement:",
-    gate_cancelled: "Cancelled. Nothing was run.",
-    gate_full_table_warning: "\u26A0\uFE0F  This affects EVERY row in {table} and cannot be undone.",
-    gate_ddl_warning: "\u26A0\uFE0F  This destroys {table} and cannot be undone.",
-    gate_ddl_warning_untargeted: "\u26A0\uFE0F  This is a destructive schema change and cannot be undone.",
-    gate_unparseable_warning: "\u26A0\uFE0F  dbcli could not parse this statement, so it is treated as affecting everything.",
-    gate_multiple_statements_warning: "\u26A0\uFE0F  This is more than one statement, and dbcli will not judge them one at a time.",
-    gate_multi_table_warning: "This write joins another table. How many rows of the target it touches depends on the data, not on the statement, so it cannot be checked before it runs.",
-    gate_nested_write_warning: "\u26A0\uFE0F  This statement carries a second write inside it, and dbcli will not read the tier of that write off this one.",
-    gate_typed_prompt: "Type {phrase} to run it",
-    gate_typed_mismatch: "That did not match {phrase}. Nothing was run.",
-    gate_refused: "Refused: this statement is not limited to specific rows and nobody is here to confirm it (reason={reason}).",
-    gate_refused_in_shell: "Refused: a dbcli subcommand started from the shell has no way to ask you, even though you are right here (reason={reason}).",
-    gate_remedy_no_where: "Add a WHERE clause \u2014 WHERE 1=1 if you really do mean every row \u2014 or a LIMIT, then run it again.",
-    gate_remedy_ddl_destruction: "No flag skips this. Run it from an interactive terminal, or apply the schema change through a reviewed migration.",
-    gate_remedy_unparseable: "dbcli could not parse this statement and will not guess. Simplify it, or run it from an interactive terminal.",
-    gate_remedy_multiple_statements: "Run one statement per command.",
-    gate_remedy_multi_table: "Rewrite it as a single-table statement \u2014 move the other table into a subquery in the WHERE \u2014 or run it where someone can confirm it.",
-    gate_remedy_nested_write: "Run the nested write as its own statement, or run this one where someone can confirm it.",
-    gate_remedy_non_unique_where: "Match on a primary key or a uniquely indexed column, or run it from an interactive terminal.",
-    gate_remedy_in_shell: "Type the statement at the dbcli> prompt instead \u2014 there the shell asks you to type the target table name.",
-    recovery_none: "This cannot be undone automatically \u2014 restore from a backup to get the previous values back.",
-    recovery_retry: "Re-run with --recovery to write a recovery plan, then read it with: dbcli recover",
-    blacklist_hint: "Run `dbcli blacklist list` to see what is protected"
-  };
-});
+// src/utils/connection-timeout.ts
+function setGlobalConnectionTimeout(timeout) {
+  _globalConnectionTimeout = timeout;
+}
+function setGlobalStatementTimeout(timeout) {
+  _globalStatementTimeout = timeout;
+}
+function resolveConnectionTimeout(configured) {
+  return _globalConnectionTimeout ?? configured;
+}
+function resolveStatementTimeout(configured) {
+  return _globalStatementTimeout ?? configured;
+}
+function withResolvedTimeout(options) {
+  let timeout = resolveConnectionTimeout(options.timeout), statementTimeout = resolveStatementTimeout(options.statementTimeout);
+  if (timeout === options.timeout && statementTimeout === options.statementTimeout)
+    return options;
+  return { ...options, timeout, statementTimeout };
+}
+var _globalConnectionTimeout, _globalStatementTimeout;
 
-// resources/lang/zh-TW/ceremony.json
-var ceremony_default2;
-var init_ceremony2 = __esm(() => {
-  ceremony_default2 = {
-    updated: "\u5DF2\u66F4\u65B0 {table} \u7684 {count} \u5217",
-    deleted: "\u5DF2\u5F9E {table} \u522A\u9664 {count} \u5217",
-    inserted: "\u5DF2\u5BEB\u5165 {count} \u5217\u5230 {table}",
-    matched_nothing: "{table} \u6C92\u6709\u4EFB\u4F55\u5217\u7B26\u5408\u689D\u4EF6\uFF0C\u8CC7\u6599\u672A\u8B8A\u52D5",
-    cancelled: "\u5DF2\u53D6\u6D88\uFF0C{table} \u672A\u8B8A\u52D5",
-    dry_run: "\u50C5\u9810\u89BD\uFF0C{table} \u672A\u8B8A\u52D5",
-    elapsed: "\u8017\u6642 {seconds} \u79D2",
-    failed: "\u5931\u6557\uFF1A{reason}",
-    unknown_error: "\u672A\u77E5\u7684\u932F\u8AA4",
-    confirm_sql: "\u7522\u751F\u7684 SQL\uFF1A",
-    confirm_command: "\u5373\u5C07\u57F7\u884C\u7684\u6307\u4EE4\uFF1A",
-    confirm_params: "\u53C3\u6578\uFF1A",
-    confirm_destructive_warning: "\u26A0\uFE0F  \u8B66\u544A\uFF1ADELETE \u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
-    confirm_destructive_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B DELETE \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
-    confirm_destructive_warning_ddl: "\u26A0\uFE0F  \u8B66\u544A\uFF1A\u9019\u500B schema \u8B8A\u66F4\u5177\u7834\u58DE\u6027\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\uFF01",
-    confirm_ddl_prompt: "\u78BA\u5B9A\u8981\u57F7\u884C\u9019\u500B {operation} \u55CE\uFF1F\u6B64\u64CD\u4F5C\u7121\u6CD5\u5FA9\u539F\u3002",
-    confirm_prompt: "\u8981\u7E7C\u7E8C\u57F7\u884C\u9019\u500B\u64CD\u4F5C\u55CE\uFF1F",
-    gate_summary: "\u9019\u53E5\u6703\u5C0D {table} \u57F7\u884C {operation}\u3002",
-    gate_summary_untargeted: "\u9019\u53E5\u6703\u57F7\u884C {operation}\u3002",
-    gate_statement: "\u8A9E\u53E5\uFF1A",
-    gate_cancelled: "\u5DF2\u53D6\u6D88\uFF0C\u6C92\u6709\u57F7\u884C\u4EFB\u4F55\u8A9E\u53E5\u3002",
-    gate_full_table_warning: "\u26A0\uFE0F  \u9019\u53E5\u6703\u5F71\u97FF {table} \u7684\u6BCF\u4E00\u5217\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
-    gate_ddl_warning: "\u26A0\uFE0F  \u9019\u53E5\u6703\u6467\u6BC0 {table}\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
-    gate_ddl_warning_untargeted: "\u26A0\uFE0F  \u9019\u662F\u7834\u58DE\u6027\u7684 schema \u8B8A\u66F4\uFF0C\u57F7\u884C\u5F8C\u7121\u6CD5\u5FA9\u539F\u3002",
-    gate_unparseable_warning: "\u26A0\uFE0F  dbcli \u7121\u6CD5\u89E3\u6790\u9019\u53E5\uFF0C\u56E0\u6B64\u4E00\u5F8B\u8996\u70BA\u6703\u5F71\u97FF\u5168\u90E8\u8CC7\u6599\u3002",
-    gate_multiple_statements_warning: "\u26A0\uFE0F  \u9019\u88E1\u4E0D\u53EA\u4E00\u53E5\u8A9E\u53E5\uFF0Cdbcli \u4E0D\u6703\u9010\u53E5\u5224\u65B7\u3002",
-    gate_multi_table_warning: "\u9019\u500B\u5BEB\u5165\u63A5\u4E86\u53E6\u4E00\u5F35\u8868\u3002\u5B83\u6703\u52D5\u5230\u76EE\u6A19\u8868\u5E7E\u5217\u53D6\u6C7A\u65BC\u8CC7\u6599\u800C\u4E0D\u662F\u8A9E\u53E5\u672C\u8EAB\uFF0C\u57F7\u884C\u524D\u7121\u6CD5\u6AA2\u67E5\u3002",
-    gate_nested_write_warning: "\u26A0\uFE0F  \u9019\u53E5\u88E1\u9762\u9084\u593E\u8457\u53E6\u4E00\u500B\u5BEB\u5165\uFF0Cdbcli \u4E0D\u6703\u62FF\u9019\u53E5\u7684\u5C64\u7D1A\u4EE3\u66FF\u90A3\u500B\u5BEB\u5165\u7684\u5C64\u7D1A\u3002",
-    gate_typed_prompt: "\u8F38\u5165 {phrase} \u624D\u6703\u57F7\u884C",
-    gate_typed_mismatch: "\u8F38\u5165\u7684\u5167\u5BB9\u8207 {phrase} \u4E0D\u7B26\uFF0C\u6C92\u6709\u57F7\u884C\u4EFB\u4F55\u8A9E\u53E5\u3002",
-    gate_refused: "\u5DF2\u62D2\u7D55\uFF1A\u9019\u53E5\u6C92\u6709\u9650\u5B9A\u8981\u52D5\u54EA\u4E9B\u5217\uFF0C\u800C\u73FE\u5728\u6C92\u6709\u4EBA\u80FD\u78BA\u8A8D\uFF08reason={reason}\uFF09\u3002",
-    gate_refused_in_shell: "\u5DF2\u62D2\u7D55\uFF1A\u5F9E shell \u555F\u52D5\u7684 dbcli \u5B50\u6307\u4EE4\u6C92\u6709\u8FA6\u6CD5\u5411\u4F60\u63D0\u554F\uFF0C\u5373\u4F7F\u4F60\u4EBA\u5C31\u5728\u9019\u88E1\uFF08reason={reason}\uFF09\u3002",
-    gate_remedy_no_where: "\u88DC\u4E0A WHERE\uFF08\u771F\u7684\u8981\u5168\u8868\u5C31\u5BEB WHERE 1=1\uFF09\u6216 LIMIT\uFF0C\u7136\u5F8C\u91CD\u8DD1\u3002",
-    gate_remedy_ddl_destruction: "\u6C92\u6709\u4EFB\u4F55\u65D7\u6A19\u53EF\u4EE5\u8DF3\u904E\u9019\u4E00\u95DC\u3002\u8ACB\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\uFF0C\u6216\u6539\u8D70\u7D93\u904E\u5BE9\u67E5\u7684 migration\u3002",
-    gate_remedy_unparseable: "dbcli \u7121\u6CD5\u89E3\u6790\u9019\u53E5\uFF0C\u4E5F\u4E0D\u6703\u7528\u731C\u7684\u3002\u8ACB\u7C21\u5316\u8A9E\u53E5\uFF0C\u6216\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\u3002",
-    gate_remedy_multiple_statements: "\u4E00\u6B21\u53EA\u57F7\u884C\u4E00\u53E5\u8A9E\u53E5\u3002",
-    gate_remedy_multi_table: "\u6539\u5BEB\u6210\u55AE\u8868\u8A9E\u53E5\u2014\u2014\u628A\u53E6\u4E00\u5F35\u8868\u79FB\u9032 WHERE \u7684\u5B50\u67E5\u8A62\u88E1\u2014\u2014\u6216\u6539\u5728\u6709\u4EBA\u53EF\u4EE5\u78BA\u8A8D\u7684\u5730\u65B9\u57F7\u884C\u3002",
-    gate_remedy_nested_write: "\u628A\u88E1\u9762\u90A3\u500B\u5BEB\u5165\u62C6\u6210\u7368\u7ACB\u7684\u4E00\u53E5\u4F86\u57F7\u884C\uFF0C\u6216\u6539\u5728\u6709\u4EBA\u53EF\u4EE5\u78BA\u8A8D\u7684\u5730\u65B9\u57F7\u884C\u3002",
-    gate_remedy_non_unique_where: "\u6539\u7528\u4E3B\u9375\u6216\u552F\u4E00\u7D22\u5F15\u6B04\u4F4D\u7576\u689D\u4EF6\uFF0C\u6216\u5728\u4E92\u52D5\u7D42\u7AEF\u4E0B\u57F7\u884C\u3002",
-    gate_remedy_in_shell: "\u8ACB\u76F4\u63A5\u5728 dbcli> \u63D0\u793A\u7B26\u6253\u9019\u53E5\u8A9E\u53E5\u2014\u2014\u5728\u90A3\u88E1 dbcli \u6703\u8ACB\u4F60\u6253\u51FA\u76EE\u6A19\u8CC7\u6599\u8868\u7684\u540D\u7A31\u4F86\u78BA\u8A8D\u3002",
-    recovery_none: "\u6B64\u64CD\u4F5C\u7121\u6CD5\u81EA\u52D5\u9084\u539F\uFF0C\u8981\u53D6\u56DE\u5148\u524D\u7684\u8CC7\u6599\u8ACB\u5F9E\u5099\u4EFD\u56DE\u5FA9\u3002",
-    recovery_retry: "\u52A0\u4E0A --recovery \u91CD\u8DD1\u53EF\u7522\u751F\u56DE\u5FA9\u8A08\u756B\uFF0C\u518D\u7528 dbcli recover \u8B80\u53D6",
-    blacklist_hint: "\u57F7\u884C `dbcli blacklist list` \u67E5\u770B\u53D7\u4FDD\u8B77\u7684\u9805\u76EE"
-  };
+// src/core/connection-selector.ts
+function createConnectionSelectorOption() {
+  return new Option2("--use <connection>", CONNECTION_SELECTOR_DESCRIPTION);
+}
+var CONNECTION_SELECTOR_DESCRIPTION = "Use a specific named connection for this invocation (v2 config)";
+var init_connection_selector = __esm(() => {
+  init_esm();
 });
 
-// src/i18n/message-loader.ts
-class MessageLoader {
-  static instance = null;
-  messages = {};
-  fallbackMessages = {};
-  currentLang;
-  constructor() {
-    this.currentLang = Bun.env.DBCLI_LANG || "en", this.loadMessages();
-  }
-  static getInstance() {
-    if (!MessageLoader.instance)
-      MessageLoader.instance = new MessageLoader;
-    return MessageLoader.instance;
-  }
-  loadMessages() {
-    if (this.currentLang !== "en")
-      this.messages = BUNDLED_MESSAGES[this.currentLang] || {};
-    this.fallbackMessages = BUNDLED_MESSAGES.en || {};
-  }
-  t(key) {
-    let parts = key.split("."), value = this.messages;
-    for (let part of parts)
-      if (value && typeof value === "object")
-        value = value[part];
-      else {
-        value = void 0;
-        break;
-      }
-    if (typeof value === "string")
-      return value;
-    value = this.fallbackMessages;
-    for (let part of parts)
-      if (value && typeof value === "object")
-        value = value[part];
-      else {
-        value = void 0;
-        break;
-      }
-    if (typeof value === "string")
-      return value;
-    return key;
+// src/utils/config-path.ts
+function resolveConfigPath(command, options, fallback = ".dbcli") {
+  for (let current = command;current; current = current.parent ?? void 0) {
+    let source = current.getOptionValueSource("config");
+    if (source && source !== "default") {
+      let currentOptions = current.opts();
+      if (typeof currentOptions.config === "string" && currentOptions.config.length > 0)
+        return currentOptions.config;
+    }
   }
-  setLanguage(lang) {
-    this.currentLang = lang, this.messages = {}, this.loadMessages();
+  if (typeof options?.config === "string" && options.config.length > 0 && options.config !== fallback)
+    return options.config;
+  for (let current = command;current; current = current.parent ?? void 0) {
+    let source = current.getOptionValueSource("global");
+    if (source && source !== "default" && current.opts().global === !0)
+      return getGlobalConfigPath();
   }
-  interpolate(key, vars) {
-    return this.t(key).replace(/\{([^{}]+)\}/g, (match, name) => Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : match);
+  if (options?.global === !0)
+    return getGlobalConfigPath();
+  if (typeof options?.config === "string" && options.config.length > 0)
+    return options.config;
+  return fallback;
+}
+var init_config_path = __esm(() => {
+  init_config_binding();
+});
+
+// src/utils/config-sidecar-path.ts
+import { dirname as dirname2, extname, join as join9 } from "path";
+function configSidecarPath(configPath, fileName) {
+  let directory = extname(configPath) !== "" && !configPath.endsWith(".dbcli") ? dirname2(configPath) : configPath;
+  return join9(directory, fileName);
+}
+var init_config_sidecar_path = () => {};
+
+// src/utils/skill-check-cache.ts
+import { mkdir as mkdir5, rename as rename3, unlink as unlink4, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname4 } from "path";
+function cachePath(configPath) {
+  return configSidecarPath(configPath, CACHE_FILE_NAME);
+}
+async function readSkillCheckCache(configPath, dbcliVersion, options = {}) {
+  try {
+    let file = Bun.file(cachePath(configPath));
+    if (!await file.exists())
+      return null;
+    let raw = await file.json();
+    if (raw.version !== 1 || !Array.isArray(raw.outdated))
+      return null;
+    if (raw.dbcliVersion !== dbcliVersion)
+      return null;
+    if (typeof raw.checkedAt !== "number")
+      return null;
+    let age = (options.now ?? Date.now()) - raw.checkedAt;
+    if (age < 0 || age > SKILL_CHECK_TTL_MS)
+      return null;
+    return raw.outdated;
+  } catch {
+    return null;
   }
 }
-var BUNDLED_MESSAGES, messageLoader, t = (key) => messageLoader.t(key), t_vars = (key, vars) => messageLoader.interpolate(key, vars);
-var init_message_loader = __esm(() => {
-  init_messages();
-  init_messages2();
-  init_shell();
-  init_shell2();
-  init_ceremony();
-  init_ceremony2();
-  BUNDLED_MESSAGES = {
-    en: { ...messages_default, shell: shell_default, ceremony: ceremony_default },
-    "zh-TW": {
-      ...messages_default2,
-      shell: shell_default2,
-      ceremony: ceremony_default2
+async function writeSkillCheckCache(configPath, dbcliVersion, outdated, options = {}) {
+  let path = cachePath(configPath), payload = {
+    version: 1,
+    dbcliVersion,
+    checkedAt: options.now ?? Date.now(),
+    outdated
+  };
+  try {
+    await mkdir5(dirname4(path), { recursive: !0 });
+    let temporary = `${path}.tmp-${process.pid}`;
+    await writeFile2(temporary, JSON.stringify(payload), "utf8"), await rename3(temporary, path);
+  } catch {}
+}
+async function invalidateSkillCheckCache(configPath) {
+  await unlink4(cachePath(configPath)).catch(() => {
+    return;
+  });
+}
+var SKILL_CHECK_TTL_MS = 86400000, CACHE_FILE_NAME = "skill-check.json";
+var init_skill_check_cache = __esm(() => {
+  init_config_sidecar_path();
+});
+
+// src/core/slow-query-advisory.ts
+function slowQueryThresholdFor(options) {
+  if (options.recovery === !0)
+    return 0;
+  let threshold = options.slowMs ?? 1000;
+  return assertValidSlowQueryThreshold(threshold), threshold;
+}
+function assertValidSlowQueryThreshold(value) {
+  if (value === void 0)
+    return;
+  if (!Number.isSafeInteger(value) || value < 0)
+    throw Error("slow-ms must be a non-negative integer");
+}
+function parseSlowQueryThreshold(value) {
+  if (!/^\d+$/.test(value))
+    throw Error("slow-ms must be a non-negative integer");
+  let parsed = Number(value);
+  return assertValidSlowQueryThreshold(parsed), parsed;
+}
+function recommendationFor(system) {
+  return system === void 0 || GUIDE_SLOW_QUERY_SYSTEMS.includes(system) ? "Review safely with: dbcli guide slow-query --format markdown. This hint runs no additional database diagnostics." : `Re-check the query shape and the filters it scans; dbcli ships no slow-query diagnostics for ${system}. This hint runs no additional database diagnostics.`;
+}
+function buildSlowQueryAdvisory(executionTimeMs, options) {
+  let thresholdMs = slowQueryThresholdFor(options);
+  if (thresholdMs === 0 || executionTimeMs === void 0 || executionTimeMs < thresholdMs)
+    return;
+  return {
+    code: "SLOW_QUERY",
+    executionTimeMs,
+    thresholdMs,
+    recommendation: recommendationFor(options.system)
+  };
+}
+function attachSlowQueryAdvisory(result, options) {
+  let advisory = buildSlowQueryAdvisory(result.executionTimeMs, options);
+  if (!advisory)
+    return result;
+  return {
+    ...result,
+    metadata: {
+      statement: result.metadata?.statement ?? "UNKNOWN",
+      ...result.metadata,
+      performanceAdvisory: advisory
     }
   };
-  messageLoader = MessageLoader.getInstance();
+}
+var GUIDE_SLOW_QUERY_SYSTEMS;
+var init_slow_query_advisory = __esm(() => {
+  GUIDE_SLOW_QUERY_SYSTEMS = ["mariadb", "mysql", "postgresql", "redis"];
 });
 
 // src/program-root.ts
@@ -8460,6 +8777,8 @@ function removeConnection(config, name) {
   return updated;
 }
 var init_config_v2_mutations = __esm(() => {
+  init_message_loader();
+  init_capabilities();
   init_validation();
 });
 
@@ -8792,250 +9111,6 @@ var init_types2 = __esm(() => {
   };
 });
 
-// src/adapters/capabilities.ts
-function cap(status, tier, note) {
-  return Object.freeze({ status, tier, note });
-}
-function getEngineCapabilities(system) {
-  return Object.freeze({ ...ENGINE_CAPABILITIES[system] });
-}
-function getEngineCapability(system, key) {
-  return ENGINE_CAPABILITIES[system][key];
-}
-var COMMAND_CAPABILITY_KEYS, ENGINE_INDEPENDENT, SQL_BASE, SQL_ONLY_UNSUPPORTED, SQL_MODE_LIMITED, ENGINE_CAPABILITIES;
-var init_capabilities = __esm(() => {
-  COMMAND_CAPABILITY_KEYS = Object.freeze([
-    "init",
-    "use",
-    "list",
-    "schema",
-    "schemaSingle",
-    "schemaFullScan",
-    "query",
-    "lint",
-    "queryOutput",
-    "queryLimitGuard",
-    "q",
-    "queries",
-    "insert",
-    "update",
-    "delete",
-    "export",
-    "blacklistRead",
-    "blacklist",
-    "check",
-    "diff",
-    "migrate",
-    "shell",
-    "status",
-    "doctor",
-    "inspect",
-    "report",
-    "guide",
-    "completion",
-    "upgrade",
-    "recover",
-    "skill",
-    "auditTail",
-    "auditShow",
-    "auditClear",
-    "auditHealth",
-    "explain",
-    "plan",
-    "impactAssess",
-    "assert",
-    "snapshot",
-    "verify",
-    "semantic",
-    "design",
-    "proxy",
-    "proxyAnalyze",
-    "verification",
-    "verificationPrune",
-    "evidence",
-    "contract",
-    "recovery",
-    "backfillArtifact",
-    "password",
-    "capabilityDiscover",
-    "capabilityCheck"
-  ]);
-  ENGINE_INDEPENDENT = {
-    completion: cap("not-applicable", "none", "Shell completion is engine-independent."),
-    upgrade: cap("not-applicable", "local-write", "Package update checks are engine-independent."),
-    recover: cap("not-applicable", "dry-run", "Recovery operates on saved envelopes and gated command steps."),
-    skill: cap("not-applicable", "local-write", "Skill and task-pack generation are engine-independent."),
-    auditTail: cap("supported", "readonly", "Reads JSONL audit entries; never writes to engines."),
-    auditShow: cap("supported", "readonly", "Looks up a single audit entry by id prefix or recovery_ref."),
-    auditHealth: cap("supported", "readonly", "Renders AuditLogger.getHealth() snapshot."),
-    auditClear: cap("supported", "local-write", "Removes <conn>.jsonl + .jsonl.1 from local disk; never touches DB.")
-  }, SQL_BASE = {
-    init: cap("supported", "interactive", "SQL connection initialization is supported."),
-    use: cap("supported", "local-write", "V2 config supports named SQL connections."),
-    list: cap("supported", "readonly", "Lists relational tables."),
-    schema: cap("supported", "readonly", "Unified schema command (single-table or full scan)."),
-    schemaSingle: cap("supported", "readonly", "Reads a single table schema."),
-    schemaFullScan: cap("supported", "readonly", "Full scan, refresh, and reset are supported."),
-    query: cap("supported", "readonly", "Runs SQL through permission and blacklist guards."),
-    lint: cap("supported", "readonly", "Statically analyzes SQL without connecting to the database."),
-    queryOutput: cap("supported", "readonly", "table/json/csv output is supported."),
-    queryLimitGuard: cap("supported", "readonly", "Query-only auto-limit and size guard are supported."),
-    q: cap("supported", "readonly", "Saved SQL snippets allow SELECT/WITH only."),
-    queries: cap("supported", "local-write", "Snippet management is available regardless of active connection."),
-    insert: cap("supported", "db-write", "Dedicated INSERT command is supported."),
-    update: cap("supported", "db-write", "Dedicated UPDATE command is supported."),
-    delete: cap("supported", "db-write", "Dedicated DELETE command is supported."),
-    export: cap("supported", "readonly", "SQL export is supported."),
-    blacklistRead: cap("supported", "readonly", "Reads the configured blacklist rules."),
-    blacklist: cap("supported", "local-write", "Blacklist management and enforcement are supported."),
-    check: cap("supported", "readonly", "Data health checks are SQL-only."),
-    diff: cap("supported", "readonly", "Relational schema snapshots are supported."),
-    migrate: cap("supported", "db-write", "DDL migrations are supported for SQL engines."),
-    shell: cap("supported", "interactive", "Interactive SQL shell is supported."),
-    status: cap("supported", "readonly", "Safe config summary is supported."),
-    doctor: cap("supported", "readonly", "Engine-specific diagnostics are supported."),
-    inspect: cap("supported", "readonly", "Agent context snapshot is supported."),
-    report: cap("supported", "readonly", "Diagnostic report is supported."),
-    guide: cap("supported", "readonly", "Deterministic next-command planner is supported."),
-    explain: cap("supported", "readonly", "EXPLAIN plans are read from SQL engines."),
-    plan: cap("supported", "readonly", "Offline write-risk analysis of SQL against the schema cache."),
-    impactAssess: cap("supported", "local-write", "Offline impact assessment of a SQL schema change; writes its report locally."),
-    assert: cap("supported", "local-write", "Data assertions over SQL results; optionally writes a verification artifact."),
-    snapshot: cap("supported", "local-write", "Captures a SQL result fingerprint under .dbcli/snapshots/."),
-    verify: cap("supported", "local-write", "Scenario verification over SQL; writes a verification artifact."),
-    semantic: cap("supported", "readonly", "Governed semantic context and drift over a SQL schema cache."),
-    design: cap("supported", "local-write", "Schema design authoring and comparison for SQL dialects; init writes a template."),
-    proxy: cap("supported", "interactive", "Local observing proxy for the MySQL, MariaDB and PostgreSQL wire protocols."),
-    password: cap("supported", "interactive", "Rotates the stored connection credential; refused under agent mode."),
-    proxyAnalyze: cap("not-applicable", "readonly", "Reads locally recorded proxy events; never contacts an engine."),
-    verification: cap("not-applicable", "readonly", "Inspects verification artifacts under .dbcli/verification/."),
-    verificationPrune: cap("not-applicable", "local-write", "Deletes local verification artifacts; dry-run unless --execute --force."),
-    evidence: cap("not-applicable", "local-write", "Composes, validates and renders evidence packs from local artifacts."),
-    contract: cap("not-applicable", "readonly", "Validates and inspects governed semantic contracts offline."),
-    recovery: cap("not-applicable", "readonly", "Renders recovery codes and their remediation steps from a static table."),
-    backfillArtifact: cap("not-applicable", "local-write", "Builds a backfill artifact from a source manifest and v2 connection identity."),
-    capabilityDiscover: cap("not-applicable", "readonly", "Emits the static capability catalog; opens no connection."),
-    capabilityCheck: cap("not-applicable", "readonly", "Evaluates required capability ids against the local configuration only."),
-    ...ENGINE_INDEPENDENT
-  }, SQL_ONLY_UNSUPPORTED = {
-    explain: cap("unsupported", "none", "src/commands/explain.ts refuses a non-SQL connection."),
-    plan: cap("unsupported", "none", "Risk analysis is SQL-dialect based; toSqlDialect resolves no dialect here."),
-    assert: cap("unsupported", "none", "src/commands/assert.ts refuses a non-SQL connection."),
-    snapshot: cap("unsupported", "none", "src/commands/snapshot.ts refuses a non-SQL connection."),
-    verify: cap("unsupported", "none", "src/commands/verify.ts refuses a non-SQL connection."),
-    proxy: cap("unsupported", "none", "The proxy speaks the MySQL and PostgreSQL wire protocols only.")
-  }, SQL_MODE_LIMITED = {
-    impactAssess: cap("limited", "local-write", "Runs against an ORM artifact; --against-cache needs a SQL connection."),
-    semantic: cap("limited", "readonly", "Governed context, search and drift work; draft validate needs a SQL connection."),
-    design: cap("limited", "local-write", "Authoring and ORM comparison work; --against-cache needs a SQL connection.")
-  }, ENGINE_CAPABILITIES = Object.freeze({
-    postgresql: Object.freeze({
-      ...SQL_BASE,
-      check: cap("limited", "readonly", "SQL-only and strongest on MySQL/MariaDB.")
-    }),
-    sqlite: Object.freeze({
-      ...SQL_BASE,
-      init: cap("supported", "local-write", "Asks for a file path and a permission; the file must already exist."),
-      use: cap("supported", "local-write", "Switches connections and displays the file path."),
-      schemaFullScan: cap("unsupported", "none", "Full schema cache scan is not implemented for SQLite."),
-      lint: cap("unsupported", "none", "Static lint is not enabled for the SQLite dialect yet."),
-      queries: cap("supported", "local-write", "Snippets may declare `engine: sqlite` and bind with `?` placeholders."),
-      insert: cap("supported", "db-write", "Row insert through the shared data-executor path."),
-      update: cap("supported", "db-write", "Row update with a mandatory --where clause."),
-      delete: cap("supported", "db-write", "Row delete with a mandatory --where clause."),
-      export: cap("supported", "local-write", "Exports SELECT results to json, csv or html through the shared query path."),
-      check: cap("unsupported", "none", "Data health check is not enabled for SQLite."),
-      diff: cap("unsupported", "none", "Schema snapshots are not enabled for SQLite."),
-      migrate: cap("unsupported", "none", "SQLite ALTER TABLE covers few operations and a column change is a table rebuild; no DDL generator exists."),
-      shell: cap("unsupported", "none", "The REPL is not enabled for SQLite."),
-      doctor: cap("supported", "readonly", "Checks the file exists, is readable, and is writable when the permission allows writes."),
-      inspect: cap("unsupported", "none", "Inspection collectors are not enabled for SQLite."),
-      report: cap("unsupported", "none", "Report diagnostics query engine-specific statistics views."),
-      guide: cap("unsupported", "none", "Guides depend on engine-specific EXPLAIN output."),
-      explain: cap("unsupported", "none", "EXPLAIN handling is not enabled for SQLite."),
-      plan: cap("unsupported", "none", "Plan capture is not enabled for SQLite."),
-      impactAssess: cap("unsupported", "none", "Impact assessment is not enabled for SQLite."),
-      assert: cap("unsupported", "none", "Assertions are not enabled for SQLite."),
-      snapshot: cap("unsupported", "none", "Result snapshots are not enabled for SQLite."),
-      verify: cap("unsupported", "none", "Write verification is not enabled for SQLite."),
-      semantic: cap("unsupported", "none", "Semantic context work is not enabled for SQLite."),
-      design: cap("unsupported", "none", "Schema design work is not enabled for SQLite."),
-      proxy: cap("not-applicable", "none", "SQLite has no network protocol to proxy."),
-      proxyAnalyze: cap("not-applicable", "none", "There are no SQLite proxy events to analyse."),
-      password: cap("not-applicable", "none", "A SQLite connection has no credential to store or rotate."),
-      queryLimitGuard: cap("limited", "readonly", "Applies the same LIMIT rewrite as the other SQL engines; under query-only the handle is opened read-only, which a database with an unreplayed WAL cannot satisfy.")
-    }),
-    mysql: Object.freeze(SQL_BASE),
-    mariadb: Object.freeze(SQL_BASE),
-    mongodb: Object.freeze({
-      ...SQL_BASE,
-      ...SQL_ONLY_UNSUPPORTED,
-      ...SQL_MODE_LIMITED,
-      ...SQL_MODE_LIMITED,
-      ...SQL_MODE_LIMITED,
-      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
-      schemaSingle: cap("limited", "readonly", "MongoDB schema is sampled from documents."),
-      schemaFullScan: cap("limited", "readonly", "Full scan is sampled and document-oriented."),
-      query: cap("limited", "readonly", "Uses JSON filter or aggregation syntax, not SQL."),
-      queryLimitGuard: cap("limited", "readonly", "Applies result limits and collection size guard."),
-      queries: cap("limited", "local-write", "Snippet management works with MongoDB-specific saved-query limitations."),
-      q: cap("limited", "readonly", "Saved MongoDB snippets require collection frontmatter, accept JSON find/aggregate bodies, and JSON-encode parameter substitutions."),
-      insert: cap("limited", "db-write", "Document insert is supported with Mongo-specific behavior."),
-      update: cap("limited", "db-write", "Document update is supported with Mongo-specific behavior."),
-      delete: cap("limited", "db-write", "Document delete is supported with Mongo-specific behavior."),
-      export: cap("limited", "readonly", "MongoDB export is supported with document-query syntax."),
-      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
-      blacklist: cap("limited", "local-write", "Rule management works; enforcement differs from SQL column enforcement."),
-      check: cap("unsupported", "none", "Data health check is SQL-only."),
-      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
-      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
-      shell: cap("limited", "interactive", "MongoDB shell support is narrower than SQL shell support.")
-    }),
-    redis: Object.freeze({
-      ...SQL_BASE,
-      ...SQL_ONLY_UNSUPPORTED,
-      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
-      schemaSingle: cap("limited", "readonly", "Per-key synthetic schema only."),
-      schemaFullScan: cap("unsupported", "none", "Redis has no full schema cache scan."),
-      query: cap("limited", "readonly", "Runs allow-listed Redis commands."),
-      queryLimitGuard: cap("limited", "readonly", "SCAN/LRANGE/ZRANGE COUNT/stop rewrite; HGETALL/SMEMBERS/KEYS truncate at 1000; --no-limit bypasses."),
-      q: cap("limited", "readonly", "Saved Redis snippets use a read-only allowlist and range guards."),
-      queries: cap("limited", "local-write", "Snippet management works with Redis-specific saved-query limitations."),
-      insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
-      export: cap("unsupported", "none", "Redis export is not supported."),
-      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
-      blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
-      check: cap("unsupported", "none", "Data health check is SQL-only."),
-      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
-      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
-      shell: cap("limited", "interactive", "Single-line Redis REPL (no trailing semicolon needed) with auto-limit and key-glob blacklist; narrower than SQL shell.")
-    }),
-    elasticsearch: Object.freeze({
-      ...SQL_BASE,
-      ...SQL_ONLY_UNSUPPORTED,
-      lint: cap("unsupported", "none", "Static lint accepts SQL connections only."),
-      schemaSingle: cap("limited", "readonly", "Schema flattens index mappings."),
-      schemaFullScan: cap("supported", "readonly", "Full scan iterates non-system indices."),
-      query: cap("limited", "readonly", "Uses JSON DSL or Lucene query strings with an index."),
-      queryLimitGuard: cap("limited", "readonly", "Applies Elasticsearch size guard."),
-      q: cap("limited", "readonly", "Saved ES snippets require index frontmatter and reject scripts."),
-      queries: cap("limited", "local-write", "Snippet management works with Elasticsearch-specific saved-query limitations."),
-      insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      export: cap("limited", "readonly", "Exports DSL hits or a full index via scroll, capped at 1000 rows (use --no-limit)."),
-      blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
-      blacklist: cap("limited", "local-write", "Index-level and flattened-column enforcement differ from SQL."),
-      check: cap("unsupported", "none", "Data health check is SQL-only."),
-      diff: cap("unsupported", "none", "Schema snapshots are relational only."),
-      migrate: cap("unsupported", "none", "DDL migrations are SQL-only."),
-      shell: cap("limited", "interactive", "Dedicated Kibana Dev Tools-style REPL (method/path + JSON body, blank-line submit); read-focused.")
-    })
-  });
-});
-
 // src/adapters/error-mapper.ts
 function isTransportDriverCode(code) {
   return TLS_CODE_PREFIX.test(code) || TRANSPORT_CODES[code] !== void 0;
@@ -9115,6 +9190,12 @@ function mapError(error, system, options) {
         `Confirm the address is the one you meant: ${options.host}:${options.port}`
       ]);
     case "TLS_ERROR":
+      if (options.sqlTls !== void 0)
+        return new ConnectionError("TLS_ERROR", t_vars("errors.sql_tls_handshake", { detail: errMsg }), [
+          t("errors.sql_tls_ca_hint"),
+          t_vars("errors.sql_tls_identity_hint", { host: options.host }),
+          t("errors.sql_tls_no_downgrade")
+        ]);
       return new ConnectionError("TLS_ERROR", `TLS handshake failed: ${errMsg}`, [
         'Point the connection at the right CA bundle: set "caPath" in .dbcli',
         'For a self-signed certificate in a trusted network, set "rejectUnauthorized": false',
@@ -9180,8 +9261,11 @@ function mapError(error, system, options) {
 }
 var TRANSPORT_CODES, TLS_CODE_PREFIX, MYSQL_CODES, MYSQL_ERRNOS, SQLSTATES, REDIS_PREFIXES, FALLBACK_PATTERNS, PG_CANCEL_BY_TIMEOUT, SYSTEM_FACTS;
 var init_error_mapper = __esm(() => {
+  init_message_loader();
   init_types2();
   TRANSPORT_CODES = {
+    HANDSHAKE_SSL_ERROR: "TLS_ERROR",
+    HANDSHAKE_NO_SSL_SUPPORT: "TLS_ERROR",
     ECONNREFUSED: "ECONNREFUSED",
     ETIMEDOUT: "ETIMEDOUT",
     ESOCKETTIMEDOUT: "ETIMEDOUT",
@@ -9249,6 +9333,7 @@ var init_error_mapper = __esm(() => {
     NOAUTH: "AUTH_FAILED",
     WRONGPASS: "AUTH_FAILED"
   }, FALLBACK_PATTERNS = [
+    [/server does not support SSL connections/i, "TLS_ERROR"],
     [/connection refused/i, "ECONNREFUSED"],
     [/\bECONNREFUSED\b/, "ECONNREFUSED"],
     [/connect(?:ion)? time(?:d )?out/i, "ETIMEDOUT"],
@@ -9495,6 +9580,51 @@ function statementTimeoutSql(system, ms) {
   return `SET SESSION max_execution_time = ${Math.round(ms)}`;
 }
 
+// src/adapters/sql-tls.ts
+import { X509Certificate } from "crypto";
+async function sqlTlsCa(options) {
+  if (options.sqlTls === void 0)
+    return;
+  let config = SqlTlsConfigSchema.parse(options.sqlTls);
+  if (!options.host || options.host.startsWith("/"))
+    throw new ConnectionError("TLS_ERROR", t("errors.sql_tls_network_host"), []);
+  try {
+    let ca = await Bun.file(config.caPath).text(), certificates = ca.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+    if (!certificates?.length)
+      throw Error(t("errors.sql_tls_ca_empty"));
+    for (let pem of certificates)
+      new X509Certificate(pem);
+    return ca;
+  } catch (cause) {
+    throw new ConnectionError("TLS_ERROR", t_vars("errors.sql_tls_ca_load", {
+      detail: cause instanceof Error ? cause.message : String(cause)
+    }), [t("errors.sql_tls_ca_restore")]);
+  }
+}
+var init_sql_tls = __esm(() => {
+  init_message_loader();
+  init_validation();
+  init_types2();
+});
+
+// src/adapters/postgresql-tls.ts
+import { isIP } from "net";
+import { checkServerIdentity } from "tls";
+async function postgresqlTlsOptions(options) {
+  let ca = await sqlTlsCa(options);
+  if (ca === void 0)
+    return;
+  return {
+    ca,
+    rejectUnauthorized: !0,
+    ...isIP(options.host) === 0 && { servername: options.host },
+    checkServerIdentity: (_hostname, certificate) => checkServerIdentity(options.host, certificate)
+  };
+}
+var init_postgresql_tls = __esm(() => {
+  init_sql_tls();
+});
+
 // src/utils/connection-error-message.ts
 function isTransportFailure(error) {
   if (error instanceof ConnectionError)
@@ -9547,7 +9677,7 @@ class PostgreSQLAdapter {
   }
   async connect() {
     await withMappedConnectionError("postgresql", this.options, async () => {
-      let timeouts = resolveTimeoutPolicy(this.options), { Pool } = await import("pg");
+      let timeouts = resolveTimeoutPolicy(this.options), ssl = await postgresqlTlsOptions(this.options), { Pool } = await import("pg");
       this.pool = new Pool({
         host: this.options.host,
         port: this.options.port,
@@ -9555,6 +9685,7 @@ class PostgreSQLAdapter {
         password: this.options.password,
         database: this.options.database,
         connectionTimeoutMillis: timeouts.connectMs,
+        ...ssl && { ssl },
         ...timeouts.statementMs !== void 0 && { statement_timeout: timeouts.statementMs }
       }), await this.testConnection();
       try {
@@ -9861,6 +9992,7 @@ var init_postgresql_adapter = __esm(() => {
   init_error_mapper();
   init_db_version_check();
   init_encoding();
+  init_postgresql_tls();
   init_connection_error_message();
 });
 
@@ -10189,6 +10321,59 @@ var init_grant_redaction = __esm(() => {
   ]);
 });
 
+// src/adapters/mysql-tls.ts
+import { checkServerIdentity as checkServerIdentity2, TLSSocket } from "tls";
+async function connectVerifiedMysql(options, ca, host) {
+  let { default: driver } = await import("mysql2"), connection = driver.createConnection({
+    ...options,
+    ssl: {
+      ca,
+      rejectUnauthorized: !0,
+      verifyIdentity: !1
+    }
+  });
+  return guardMysqlIdentity(connection, host), new Promise((resolve, reject) => {
+    connection.connect((error) => {
+      if (error)
+        connection.destroy(), reject(error);
+      else
+        resolve(connection.promise());
+    });
+  });
+}
+function guardMysqlIdentity(connection, host) {
+  let startTLS = connection.startTLS;
+  if (typeof startTLS !== "function")
+    throw connection.destroy(), new ConnectionError("TLS_ERROR", t("errors.sql_tls_driver_identity"), []);
+  connection.startTLS = (onSecure) => {
+    let completed = !1;
+    startTLS.call(connection, (error) => {
+      if (completed)
+        return;
+      completed = !0;
+      let failure = error;
+      if (!failure)
+        try {
+          let socket = connection.stream;
+          if (!(socket instanceof TLSSocket) || !socket.encrypted || !socket.authorized)
+            throw Error(t("errors.sql_tls_peer_unverified"));
+          let certificate = socket.getPeerCertificate(!0);
+          if (!certificate.raw?.length)
+            throw Error(t("errors.sql_tls_peer_missing"));
+          failure = checkServerIdentity2(host, certificate);
+        } catch (cause) {
+          failure = cause instanceof Error ? cause : Error(String(cause));
+        }
+      if (onSecure(failure), failure)
+        connection.destroy();
+    });
+  };
+}
+var init_mysql_tls = __esm(() => {
+  init_types2();
+  init_message_loader();
+});
+
 // src/adapters/mysql-adapter.ts
 function parseEnumValues(columnType) {
   let match = columnType.match(/^enum\((.+)\)$/i);
@@ -10209,8 +10394,7 @@ class MySQLAdapter {
   }
   async connect() {
     this.serverVersion = void 0, await withMappedConnectionError(this.system, this.options, async () => {
-      let timeouts = resolveTimeoutPolicy(this.options), { default: driver } = await import("mysql2/promise");
-      if (this.db = await driver.createConnection({
+      let timeouts = resolveTimeoutPolicy(this.options), ca = await sqlTlsCa(this.options), connectionOptions = {
         host: this.options.host,
         port: this.options.port,
         user: this.options.user,
@@ -10218,7 +10402,14 @@ class MySQLAdapter {
         database: this.options.database,
         charset: "utf8mb4",
         connectTimeout: timeouts.connectMs
-      }), await this.db.execute("SET NAMES utf8mb4"), timeouts.statementMs !== void 0)
+      };
+      if (ca !== void 0)
+        this.db = await connectVerifiedMysql(connectionOptions, ca, this.options.host);
+      else {
+        let { default: driver } = await import("mysql2/promise");
+        this.db = await driver.createConnection(connectionOptions);
+      }
+      if (await this.db.execute("SET NAMES utf8mb4"), timeouts.statementMs !== void 0)
         try {
           await this.db.query(statementTimeoutSql(this.system, timeouts.statementMs));
         } catch {}
@@ -10453,6 +10644,8 @@ var init_mysql_adapter = __esm(() => {
   init_connection_error_message();
   init_grant_query();
   init_grant_redaction();
+  init_sql_tls();
+  init_mysql_tls();
 });
 
 // src/adapters/sqlite-adapter.ts
@@ -12946,8 +13139,14 @@ var init_blacklist_manager = __esm(() => {
 });
 
 // src/adapters/factory.ts
+function assertSqlTlsEngine(options) {
+  if (options.sqlTls !== void 0 && !supportsSqlTls(options.system))
+    throw Error(t("errors.sql_tls_unsupported"));
+}
+
 class AdapterFactory {
   static createSqlAdapter(rawOptions) {
+    assertSqlTlsEngine(rawOptions);
     let options = withResolvedTimeout(rawOptions);
     switch (options.system) {
       case "postgresql":
@@ -12962,6 +13161,7 @@ class AdapterFactory {
     }
   }
   static createQueryableAdapterWithoutRules(rawOptions) {
+    assertSqlTlsEngine(rawOptions);
     let options = withResolvedTimeout(rawOptions);
     switch (options.system) {
       case "mongodb":
@@ -13016,7 +13216,7 @@ class AdapterFactory {
   }
   static createRedisAdapter(config) {
     let rawOptions = config.connection;
-    if (rawOptions.system !== "redis")
+    if (assertSqlTlsEngine(rawOptions), rawOptions.system !== "redis")
       throw Error("createRedisAdapter requires system: redis");
     let options = withResolvedTimeout(rawOptions), adapter = new RedisAdapter(options), blacklistRules = config.blacklist?.tables ?? [], overrideEnabled = isBlacklistOverrideEnabled();
     if (overrideEnabled && blacklistRules.length > 0)
@@ -13038,6 +13238,7 @@ var init_factory = __esm(() => {
   init_elasticsearch_adapter();
   init_blacklist_manager();
   init_message_loader();
+  init_capabilities();
 });
 
 // src/adapters/index.ts
@@ -13067,6 +13268,11 @@ async function checkOverwrite(configPath, shouldPrompt, force) {
 async function assertV2InitImportSupported(configPath) {
   if (isGlobalConfigPath(configPath))
     return;
+  let legacyFile = Bun.file(configPath);
+  if ((await legacyFile.stat().catch(() => null))?.isFile()) {
+    if ((await legacyFile.json()).connection?.sqlTls !== void 0)
+      throw Error(t("errors.sql_tls_legacy_import"));
+  }
   let projectConfig = Bun.file(join10(configPath, "config.json"));
   if (!await projectConfig.exists())
     return;
@@ -16624,7 +16830,7 @@ var init_init_sqlite = __esm(() => {
 });
 
 // src/commands/init.ts
-import { join as join11 } from "path";
+import { join as join11, resolve as resolve3 } from "path";
 import { mkdir as mkdir8 } from "fs/promises";
 async function handleRemove(configPath, name) {
   let storagePath = await resolveConfigStoragePath(configPath), configFile = Bun.file(join11(storagePath, "config.json"));
@@ -16710,6 +16916,25 @@ async function initCommandHandler(options, command) {
     system = await promptUser.select(t("init.select_system"), [...INIT_SYSTEM_CHOICES]);
   if (!DATABASE_SYSTEMS.includes(system))
     throw Error(t_vars("errors.invalid_system", { system }));
+  let hasSqlTls = options.sqlTls !== void 0 || options.sqlTlsCa !== void 0, sqlTls;
+  if (hasSqlTls) {
+    if (!supportsSqlTls(system))
+      throw Error(t("errors.sql_tls_unsupported"));
+    if (options.sqlTls !== "verify-full" || typeof options.sqlTlsCa !== "string" || !options.sqlTlsCa.trim())
+      throw Error(t("errors.sql_tls_options_required"));
+    sqlTls = SqlTlsConfigSchema.parse({ mode: options.sqlTls, caPath: resolve3(options.sqlTlsCa) });
+  }
+  let existingStorage = await resolveConfigStoragePath(configPath), existingDocument = Bun.file(join11(existingStorage, "config.json"));
+  if (await existingDocument.exists()) {
+    if (detectConfigVersion(await existingDocument.json()) === 2) {
+      let prior = (await readV2Config(existingStorage)).connections[connectionName];
+      if (prior && "sqlTls" in prior)
+        sqlTls ??= prior.sqlTls;
+    } else if (connectionName === "default" && existingConfig && "sqlTls" in existingConfig.connection)
+      sqlTls ??= existingConfig.connection.sqlTls;
+  }
+  if (sqlTls && !supportsSqlTls(system))
+    throw Error(t("errors.sql_tls_change_engine"));
   if (system === "sqlite") {
     await handleSQLiteInit({
       options,
@@ -16734,7 +16959,8 @@ async function initCommandHandler(options, command) {
     return;
   }
   let connection = {
-    system
+    system,
+    ...sqlTls && { sqlTls }
   }, configForWrite;
   if (options.useEnvRefs && shouldPrompt) {
     let envHost = options.envHost || await promptUser.text(t("init.prompt_host"), "DB_HOST"), envPort = options.envPort || await promptUser.text(t("init.prompt_port"), "DB_PORT"), envUser = options.envUser || await promptUser.text(t("init.prompt_user"), "DB_USER"), envPassword = options.envPassword || await promptUser.text(t("init.prompt_password"), "DB_PASSWORD"), envDatabase = options.envDatabase || await promptUser.text(t("init.prompt_name"), "DB_DATABASE");
@@ -16744,7 +16970,8 @@ async function initCommandHandler(options, command) {
       port: { $env: envPort },
       user: { $env: envUser },
       password: { $env: envPassword },
-      database: { $env: envDatabase }
+      database: { $env: envDatabase },
+      ...sqlTls && { sqlTls }
     };
     let permission = (typeof options.permission === "string" ? options.permission : void 0) ?? "query-only";
     if (!options.permission)
@@ -16803,7 +17030,8 @@ async function initCommandHandler(options, command) {
       port: { $env: envPort },
       user: { $env: envUser },
       password: { $env: envPassword },
-      database: { $env: envDatabase }
+      database: { $env: envDatabase },
+      ...sqlTls && { sqlTls }
     };
   }
   let updates = {
@@ -16828,7 +17056,8 @@ async function initCommandHandler(options, command) {
       port: parseInt(String(resolveValue(newConfig.connection.port, "port")), 10) || 5432,
       user: String(resolveValue(newConfig.connection.user, "user")),
       password: String(resolveValue(newConfig.connection.password, "password")) || "",
-      database: String(resolveValue(newConfig.connection.database, "database"))
+      database: String(resolveValue(newConfig.connection.database, "database")),
+      ...sqlTls && { sqlTls }
     }, adapter = AdapterFactory.createAdapterWithoutRules(testConnection);
     try {
       if (await adapter.connect(), await adapter.testConnection())
@@ -16862,17 +17091,19 @@ var init_init = __esm(() => {
   init_config();
   init_config_v2();
   init_config_v2_mutations();
+  init_capabilities();
   init_prompts();
   init_redaction();
   init_adapters();
   init_types2();
+  init_validation();
   init_config_path();
   init_config_binding();
   init_init_shared();
   init_init_mongodb();
   init_init_sqlite();
   INIT_SYSTEM_CHOICES = DATABASE_SYSTEMS, VALID_PERMISSIONS3 = ["query-only", "read-write", "data-admin", "admin"];
-  initCommand = new Command2("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb, mongodb, redis, elasticsearch)").option("--file <path>", "SQLite database file path (the database must already exist)").option("--cloud-id <id>", "Elasticsearch Cloud ID").option("--api-key <key>", "Elasticsearch API Key").option("--uri <uri>", "MongoDB connection string, decomposed into fields on write (mongodb://user:pass@host:27017/db?authSource=admin)").option("--auth-source <authSource>", "MongoDB auth database (default: admin when user/password are set)").option("--replica-set <name>", "MongoDB replica set name").option("--srv", "MongoDB: connect via a mongodb+srv:// DNS SRV domain (port is not written)").option("--tls", "MongoDB: enable TLS (omit both --tls and --no-tls to use the driver default)").option("--no-tls", "MongoDB: disable TLS").option("--permission <permission>", "Permission level (query-only, read-write, data-admin, admin)", "query-only").option("--use-env-refs", "Store env var references in config instead of actual values (for CI/CD or multi-env)", !1).option("--env-host <var>", "Env var name for host (with --use-env-refs)").option("--env-port <var>", "Env var name for port (with --use-env-refs)").option("--env-user <var>", "Env var name for user (with --use-env-refs)").option("--env-password <var>", "Env var name for password (with --use-env-refs)").option("--env-database <var>", "Env var name for database (with --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").option("--conn-name <name>", "Connection name (required in non-interactive mode)").option("--env-file <path>", "Path to env file for this connection").option("--remove <name>", "Remove a named connection").option("--rename <names>", "Rename a connection (format: old:new)").action(async (options) => {
+  initCommand = new Command2("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb, mongodb, redis, elasticsearch)").option("--sql-tls <mode>", t("init.sql_tls_help")).option("--sql-tls-ca <path>", t("init.sql_tls_ca_help")).option("--file <path>", "SQLite database file path (the database must already exist)").option("--cloud-id <id>", "Elasticsearch Cloud ID").option("--api-key <key>", "Elasticsearch API Key").option("--uri <uri>", "MongoDB connection string, decomposed into fields on write (mongodb://user:pass@host:27017/db?authSource=admin)").option("--auth-source <authSource>", "MongoDB auth database (default: admin when user/password are set)").option("--replica-set <name>", "MongoDB replica set name").option("--srv", "MongoDB: connect via a mongodb+srv:// DNS SRV domain (port is not written)").option("--tls", "MongoDB: enable TLS (omit both --tls and --no-tls to use the driver default)").option("--no-tls", "MongoDB: disable TLS").option("--permission <permission>", "Permission level (query-only, read-write, data-admin, admin)", "query-only").option("--use-env-refs", "Store env var references in config instead of actual values (for CI/CD or multi-env)", !1).option("--env-host <var>", "Env var name for host (with --use-env-refs)").option("--env-port <var>", "Env var name for port (with --use-env-refs)").option("--env-user <var>", "Env var name for user (with --use-env-refs)").option("--env-password <var>", "Env var name for password (with --use-env-refs)").option("--env-database <var>", "Env var name for database (with --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").option("--conn-name <name>", "Connection name (required in non-interactive mode)").option("--env-file <path>", "Path to env file for this connection").option("--remove <name>", "Remove a named connection").option("--rename <names>", "Rename a connection (format: old:new)").action(async (options) => {
     try {
       await initCommandHandler(options, initCommand);
     } catch (error) {
@@ -18917,7 +19148,7 @@ var init_assert_artifact = __esm(() => {
 
 // src/core/verification/reader.ts
 import { lstat as lstat2, readdir, readFile as readFile2 } from "fs/promises";
-import { join as join13, isAbsolute, resolve as resolve3, sep } from "path";
+import { join as join13, isAbsolute as isAbsolute2, resolve as resolve4, sep } from "path";
 function isArtifactFilename(name) {
   return /^verification-.*\.json$/.test(name);
 }
@@ -19058,17 +19289,17 @@ function summarizeVerificationArtifacts(input, filters) {
   return { storageDir: input.storageDir, latest, counts, subjects };
 }
 function looksLikePath(selector) {
-  return selector.includes("/") || selector.includes("\\") || isAbsolute(selector);
+  return selector.includes("/") || selector.includes("\\") || isAbsolute2(selector);
 }
 function findVerificationArtifact(input, selector) {
   if (looksLikePath(selector)) {
-    let resolved = resolve3(selector), root = resolve3(input.storageDir);
+    let resolved = resolve4(selector), root = resolve4(input.storageDir);
     if (resolved !== root && !resolved.startsWith(root + sep))
       throw new VerificationArtifactSelectionError(`Path is outside the verification directory: ${resolved}`);
-    let hit = input.artifacts.find((r) => resolve3(r.path) === resolved);
+    let hit = input.artifacts.find((r) => resolve4(r.path) === resolved);
     if (hit)
       return hit;
-    let bad = input.invalid.find((r) => resolve3(r.path) === resolved);
+    let bad = input.invalid.find((r) => resolve4(r.path) === resolved);
     if (bad)
       throw new VerificationArtifactSelectionError(`Artifact at ${bad.filename} is invalid: ${bad.error}`);
     throw new VerificationArtifactSelectionError(`No artifact found at path: ${resolved}`);
@@ -19104,7 +19335,7 @@ var init_reader = __esm(() => {
 
 // src/core/verification/retention.ts
 import { lstat as lstat3, unlink as unlink6 } from "fs/promises";
-import { basename as basename2, resolve as resolve4, sep as sep2 } from "path";
+import { basename as basename2, resolve as resolve5, sep as sep2 } from "path";
 function parseOlderThanDays(raw) {
   let match = /^(\d+)d$/.exec(raw);
   if (!match)
@@ -19153,14 +19384,14 @@ function boundError2(message) {
   return single.length <= 200 ? single : single.slice(0, 199) + "\u2026";
 }
 function isInsideStorageDir(storageDir, candidatePath) {
-  let base = resolve4(storageDir), resolved = resolve4(candidatePath);
+  let base = resolve5(storageDir), resolved = resolve5(candidatePath);
   return resolved === base || resolved.startsWith(base + sep2);
 }
 function hasArtifactFilename(candidatePath) {
   return /^verification-.*\.json$/.test(basename2(candidatePath));
 }
 async function safeDeleteCandidate(storageDir, candidate) {
-  let resolved = resolve4(candidate.path);
+  let resolved = resolve5(candidate.path);
   if (!isInsideStorageDir(storageDir, resolved))
     return { ok: !1, reason: "outside-storage-dir" };
   if (!hasArtifactFilename(resolved))
@@ -19306,7 +19537,7 @@ var init_legacy = __esm(() => {
 // src/core/evidence-receipt/index.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 import { link as link2, lstat as lstat4, mkdir as mkdir10, readFile as readFile3, realpath, unlink as unlink7, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename3, dirname as dirname5, relative, resolve as resolve5, sep as sep3 } from "path";
+import { basename as basename3, dirname as dirname5, relative, resolve as resolve6, sep as sep3 } from "path";
 function exact(value, keys, label) {
   if (Object.keys(value).length !== keys.length || Object.keys(value).some((key) => !keys.includes(key)))
     throw new EvidenceReceiptValidationError(`${label} contains an unknown field`);
@@ -19546,7 +19777,7 @@ async function existingAncestor(path) {
 }
 async function writeEvidenceReceipt(workspaceRoot, outputPath, receipt) {
   parseEvidenceReceipt(receipt);
-  let workspace = await realpath(workspaceRoot), requested = resolve5(workspace, outputPath);
+  let workspace = await realpath(workspaceRoot), requested = resolve6(workspace, outputPath);
   if (!inside(workspace, requested))
     throw new EvidenceReceiptValidationError("output path must stay inside the workspace");
   let parent = dirname5(requested);
@@ -19556,7 +19787,7 @@ async function writeEvidenceReceipt(workspaceRoot, outputPath, receipt) {
   let realParent = await realpath(parent);
   if (!inside(workspace, realParent))
     throw new EvidenceReceiptValidationError("output path resolves outside the workspace");
-  let target = resolve5(realParent, basename3(requested));
+  let target = resolve6(realParent, basename3(requested));
   try {
     throw await lstat4(target), new EvidenceReceiptValidationError("evidence receipt output already exists");
   } catch (error) {
@@ -19565,7 +19796,7 @@ async function writeEvidenceReceipt(workspaceRoot, outputPath, receipt) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  let temp = resolve5(realParent, `.${basename3(target)}.${process.pid}.${randomUUID2()}.tmp`);
+  let temp = resolve6(realParent, `.${basename3(target)}.${process.pid}.${randomUUID2()}.tmp`);
   try {
     await writeFile4(temp, `${JSON.stringify(receipt, null, 2)}
 `, "utf8");
@@ -25777,8 +26008,16 @@ var init_apply_gate = __esm(() => {
 });
 
 // src/core/recovery/apply-exec.ts
+import { fileURLToPath } from "url";
 async function executeStep(argv, opts) {
-  let stdoutCap = opts.stdoutCap ?? 65536, stderrCap = opts.stderrCap ?? 65536, startedAt = performance.now(), proc = Bun.spawn(argv, {
+  let stdoutCap = opts.stdoutCap ?? DEFAULT_CAP, stderrCap = opts.stderrCap ?? DEFAULT_CAP, startedAt = performance.now(), command = argv[0] === "dbcli" ? [
+    process.execPath,
+    "--no-env-file",
+    CLI_ENTRY,
+    ...opts.target ? ["--config", opts.target.configPath] : [],
+    ...opts.target?.connectionName ? ["--use", opts.target.connectionName] : [],
+    ...argv.slice(1)
+  ] : argv, proc = Bun.spawn(command, {
     cwd: opts.cwd,
     env: opts.env,
     stdin: "ignore",
@@ -25826,6 +26065,10 @@ async function capStream(stream, cap) {
   } catch {}
   return { text, truncated };
 }
+var CLI_ENTRY, DEFAULT_CAP = 65536;
+var init_apply_exec = __esm(() => {
+  CLI_ENTRY = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "../../cli.ts" : "./cli.mjs", import.meta.url));
+});
 
 // src/core/recovery/verify-heuristic.ts
 function evaluateVerify(code, outcome) {
@@ -25894,7 +26137,8 @@ async function runVerifyStep(step, ctx) {
     env: ctx.env,
     timeoutMs: ctx.timeoutMs ?? DEFAULT_TIMEOUT_MS,
     stdoutCap: ctx.stdoutCap,
-    stderrCap: ctx.stderrCap
+    stderrCap: ctx.stderrCap,
+    target: ctx.target
   }), ok = outcome.exitCode === 0 && !outcome.timedOut, result = {
     order: VERIFY_ORDER_SENTINEL,
     command: step.command,
@@ -25915,6 +26159,7 @@ async function runVerifyStep(step, ctx) {
 var executor, DEFAULT_TIMEOUT_MS = 60000, VERIFY_ORDER_SENTINEL = 0;
 var init_apply_verify = __esm(() => {
   init_apply_gate();
+  init_apply_exec();
   init_verification();
   executor = executeStep;
 });
@@ -25923,6 +26168,15 @@ var init_apply_verify = __esm(() => {
 async function runApply(input, opts) {
   let startedAt = (/* @__PURE__ */ new Date()).toISOString(), results = [], finalStatus = "skipped-only", stoppedAt = null;
   for (let step of input.envelope.recovery) {
+    if (input.envelope.error.details?.connectionCode === "TLS_ERROR" && !opts.target) {
+      results.push({
+        order: step.order,
+        command: step.command,
+        status: "skipped:unsafe-command",
+        reason: t("errors.sql_tls_recovery_target")
+      });
+      continue;
+    }
     let decision = classifyStep(step, opts.allowWrite, input.envelope.error.code);
     if (decision.kind !== "run") {
       results.push({
@@ -25938,7 +26192,8 @@ async function runApply(input, opts) {
       env: process.env,
       timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
       stdoutCap: opts.stdoutCap,
-      stderrCap: opts.stderrCap
+      stderrCap: opts.stderrCap,
+      target: opts.target
     }), ok = outcome.exitCode === 0 && !outcome.timedOut;
     if (results.push({
       order: step.order,
@@ -25963,7 +26218,8 @@ async function runApply(input, opts) {
       env: process.env,
       timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
       stdoutCap: opts.stdoutCap,
-      stderrCap: opts.stderrCap
+      stderrCap: opts.stderrCap,
+      target: opts.target
     });
     verifyResult = v.result, verifyStatus = v.status, verificationStatus = v.contractStatus, verificationBlockedReason = v.blockedReason;
   }
@@ -25984,7 +26240,9 @@ async function runApply(input, opts) {
 }
 var executor2, DEFAULT_TIMEOUT_MS2 = 60000;
 var init_apply = __esm(() => {
+  init_message_loader();
   init_apply_gate();
+  init_apply_exec();
   init_apply_verify();
   init_apply_types();
   executor2 = executeStep;
@@ -26030,7 +26288,7 @@ var NEXT_SCHEMA_VERSION = 1, STEP_RESULT_SUMMARY_FIELD_CAP = 4096;
 
 // src/core/recovery/next-step-schema.ts
 import { stat as stat5 } from "fs/promises";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 function summarizeZodError(err) {
   return err.issues.map((iss) => `${iss.path.join(".") || "<root>"}: ${iss.message}`).join("; ");
 }
@@ -26045,7 +26303,7 @@ async function loadStepResultSummary(arg, cwd) {
     return { ok: !1, reason: "empty --result value" };
   let raw;
   if (arg.startsWith("@")) {
-    let path = resolve7(cwd, arg.slice(1));
+    let path = resolve8(cwd, arg.slice(1));
     try {
       await stat5(path);
     } catch {
@@ -31556,12 +31814,12 @@ function escapeXml(str) {
 
 // src/core/data-access/index.ts
 import { lstat as lstat5, realpath as realpath2 } from "fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve8, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve9, sep as sep5 } from "path";
 function hasDataAccessReferenceIssue(issues) {
   return issues.some(({ message }) => REFERENCE_MESSAGES3.has(message));
 }
 async function loadDataAccessManifest(input) {
-  let workspace = await safeWorkspace(input.workspaceRoot, []), requested = resolve8(workspace, input.filePath ?? defaultDataAccessManifestFile(workspace));
+  let workspace = await safeWorkspace(input.workspaceRoot, []), requested = resolve9(workspace, input.filePath ?? defaultDataAccessManifestFile(workspace));
   if (!inside2(workspace, requested))
     throw new DataAccessManifestValidationError([
       { path: "$", message: "file must stay inside the workspace" }
@@ -31655,16 +31913,16 @@ async function safeWorkspace(workspaceRoot, issues) {
   try {
     return await realpath2(workspaceRoot);
   } catch {
-    return issue3(issues, "$", "workspace is unavailable"), resolve8(workspaceRoot);
+    return issue3(issues, "$", "workspace is unavailable"), resolve9(workspaceRoot);
   }
 }
 async function normalizeSource(operation, index, workspace, issues) {
   let path = `$.operations[${index}].source`;
   if (operation.source.length === 0 || operation.source.length > MAX_NAME_LENGTH2 || /[\0\r\n]/.test(operation.source))
     return issue3(issues, path, "must be a bounded single-line source path"), operation;
-  if (isAbsolute2(operation.source))
+  if (isAbsolute3(operation.source))
     return issue3(issues, path, "must be workspace-relative"), operation;
-  let target = resolve8(workspace, operation.source);
+  let target = resolve9(workspace, operation.source);
   if (!inside2(workspace, target))
     return issue3(issues, path, "must stay inside the workspace"), operation;
   try {
@@ -31682,7 +31940,7 @@ async function normalizeSource(operation, index, workspace, issues) {
 }
 function inside2(root, target) {
   let value = relative3(root, target);
-  return value !== "" && !isAbsolute2(value) && !value.startsWith(`..${sep5}`) && value !== ".." && !value.includes(`..${sep5}`);
+  return value !== "" && !isAbsolute3(value) && !value.startsWith(`..${sep5}`) && value !== ".." && !value.includes(`..${sep5}`);
 }
 function record4(value, path, issues) {
   if (typeof value === "object" && value !== null && !Array.isArray(value))
@@ -31709,7 +31967,7 @@ function issue3(issues, path, message) {
 function codePointOrder(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
-var DATA_ACCESS_MANIFEST_VERSION = 1, MAX_FILE_BYTES3 = 524288, MAX_OPERATIONS = 500, MAX_REFERENCES = 100, MAX_NAME_LENGTH2 = 200, defaultDataAccessManifestFile = (workspaceRoot) => resolve8(workspaceRoot, "dbcli.data-access.json"), PROTECTED_REFERENCE = "must not contain a protected semantic reference", UNAVAILABLE_REFERENCE = "must reference an available semantic entity", REFERENCE_MESSAGES3, DataAccessManifestValidationError;
+var DATA_ACCESS_MANIFEST_VERSION = 1, MAX_FILE_BYTES3 = 524288, MAX_OPERATIONS = 500, MAX_REFERENCES = 100, MAX_NAME_LENGTH2 = 200, defaultDataAccessManifestFile = (workspaceRoot) => resolve9(workspaceRoot, "dbcli.data-access.json"), PROTECTED_REFERENCE = "must not contain a protected semantic reference", UNAVAILABLE_REFERENCE = "must reference an available semantic entity", REFERENCE_MESSAGES3, DataAccessManifestValidationError;
 var init_data_access = __esm(() => {
   init_semantic();
   REFERENCE_MESSAGES3 = /* @__PURE__ */ new Set([
@@ -31727,7 +31985,7 @@ var init_data_access = __esm(() => {
 
 // src/core/context/context-v2.ts
 import { lstat as lstat6, realpath as realpath3 } from "fs/promises";
-import { join as join28, resolve as resolve9 } from "path";
+import { join as join28, resolve as resolve10 } from "path";
 async function gatherContextV2(workspaceRoot, configPath) {
   await rejectUnknownConfiguredEngine(configPath);
   let config = await configModule.read(configPath), system = config.connection?.system ?? "unknown";
@@ -31887,7 +32145,7 @@ function parseElasticsearchIndex(raw, manager, blockedTerms) {
   return unique(fields.map(({ path }) => path), "INVALID_SCHEMA_CACHE"), { id, name, fields };
 }
 async function collectRedisResources(workspaceRoot, config, blockedTerms, gaps) {
-  let filePath = resolve9(workspaceRoot, "dbcli.redis-context.json"), stats;
+  let filePath = resolve10(workspaceRoot, "dbcli.redis-context.json"), stats;
   try {
     stats = await lstat6(filePath);
   } catch {
@@ -32682,6 +32940,14 @@ var init_registry = __esm(() => {
   init_types2();
   init_permission_guard();
   DECLARATIONS = [
+    {
+      id: "connection.tls",
+      key: "connectionTls",
+      command: "query",
+      description: "Use explicit verified SQL TLS from a configured profile. Availability does not validate TLS policy, CA loading or handshake, or authorize configuration changes.",
+      statementType: "SELECT",
+      requiresConnection: !0
+    },
     {
       id: "connection.init",
       key: "init",
@@ -36247,7 +36513,7 @@ var init_artifact_json = __esm(() => {
 });
 
 // src/core/orm-drift/input.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 function isDdlFormat(format) {
   return format === "ddl" || format in ORM_ALIASES;
 }
@@ -36264,7 +36530,7 @@ async function expandOrmPaths(inputs) {
   let paths = parseAgainstOrmValues(inputs), expanded = /* @__PURE__ */ new Set;
   for (let path of paths) {
     if (!hasGlobMagic(path)) {
-      expanded.add(resolve10(path));
+      expanded.add(resolve11(path));
       continue;
     }
     let matches = await Array.fromAsync(new Bun.Glob(path).scan({
@@ -36275,7 +36541,7 @@ async function expandOrmPaths(inputs) {
     if (matches.length === 0)
       throw Error(`ORM schema glob matched no files: ${path}`);
     for (let match of matches)
-      expanded.add(resolve10(match));
+      expanded.add(resolve11(match));
   }
   return [...expanded].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
 }
@@ -38844,10 +39110,32 @@ var init_envelope_schema = __esm(() => {
 
 // src/commands/recover.ts
 import { stat as stat6 } from "fs/promises";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
+async function tlsRecoveryTarget() {
+  let explicitConfig = !1;
+  for (let command = recoverCommand;command; command = command.parent)
+    for (let key of ["config", "global"]) {
+      let source = command.getOptionValueSource(key);
+      if (source && source !== "default")
+        explicitConfig = !0;
+    }
+  if (!explicitConfig)
+    throw new RecoverCliError(t("errors.sql_tls_recovery_config"), EXIT_CODE.malformed);
+  let configPath = resolve12(resolveConfigPath(recoverCommand)), connectionName = resolveConnectionSelector({
+    root: recoverCommand.optsWithGlobals().use,
+    environment: process.env.DBCLI_CONNECTION
+  });
+  await Promise.resolve().then(() => init_config());
+  let config = await configModule.read(configPath, connectionName, { loadLayeredSchema: !1 });
+  if (config?.effectiveConnectionName && !connectionName)
+    throw new RecoverCliError(t("errors.sql_tls_recovery_profile"), EXIT_CODE.malformed);
+  if (!config || !("sqlTls" in config.connection) || config.connection.sqlTls?.mode !== "verify-full")
+    throw new RecoverCliError(t("errors.sql_tls_recovery_required"), EXIT_CODE.malformed);
+  return { configPath, ...connectionName && { connectionName } };
+}
 async function resolveApplySource(opts) {
   if (opts.from !== void 0) {
-    let path = resolve11(opts.cwd, opts.from), raw;
+    let path = resolve12(opts.cwd, opts.from), raw;
     try {
       raw = await Bun.file(path).text();
     } catch {
@@ -38968,6 +39256,7 @@ async function runNext(options, source) {
 }
 var ALLOWED_FORMATS13, ALLOWED_TIERS, RecoverCliError, recoverCommand;
 var init_recover = __esm(() => {
+  init_message_loader();
   init_esm();
   init_recovery();
   init_last_envelope();
@@ -38975,6 +39264,7 @@ var init_recover = __esm(() => {
   init_next_step();
   init_next_step_schema();
   init_validation();
+  init_config_path();
   ALLOWED_FORMATS13 = ["json", "markdown"], ALLOWED_TIERS = ["readonly-cmd", "write-cmd"];
   RecoverCliError = class RecoverCliError extends Error {
     exitCode;
@@ -39026,11 +39316,11 @@ var init_recover = __esm(() => {
           console.log(JSON.stringify({ ...source.envelope, audit_recent }, null, 2));
         return;
       }
-      let noVerify = options.verify === !1, result = await runApply({
+      let noVerify = options.verify === !1, target = source.envelope.error.details?.connectionCode === "TLS_ERROR" ? await tlsRecoveryTarget() : void 0, result = await runApply({
         envelope: source.envelope,
         cwd: source.cwd,
         source: { kind: source.kind, path: source.path }
-      }, { allowWrite, noVerify }), verificationArtifactPath;
+      }, { allowWrite, noVerify, target }), verificationArtifactPath;
       if (options.writeVerificationArtifact === !0 && result.verificationStatus !== void 0)
         try {
           await Promise.resolve().then(() => init_verification());
@@ -50245,7 +50535,7 @@ var init_backfill_artifact = __esm(() => {
 });
 
 // src/commands/backfill.ts
-import { dirname as dirname18, resolve as resolve12 } from "path";
+import { dirname as dirname18, resolve as resolve13 } from "path";
 import { mkdir as mkdir21 } from "fs/promises";
 function identityFor(config, name) {
   let connection = config.connections[name];
@@ -50272,7 +50562,7 @@ var init_backfill = __esm(() => {
   init_backfill_artifact();
   backfillCommand = new Command2("backfill").description("Generate reviewable source-to-SQL backfill artifacts; never executes writes");
   backfillCommand.command("artifact").description("Build a dry-run backfill artifact from a bounded JSON source catalog and two named connections").requiredOption("--source <path>", "JSON source catalog with table, keyColumns, rows, verifyQuery, and expect").requiredOption("--source-use <name>", "Named source connection used to identify the catalog environment").requiredOption("--target-use <name>", "Named target connection for generated SQL").option("--out <path>", "Write artifact JSON to this path").option("--stdout", "Print artifact JSON instead of writing it", !1).action(async (options, command) => {
-    let configPath = resolveConfigPath(command), config = await readV2Config(configPath), sourcePath = resolve12(options.source), sourceContent = await Bun.file(sourcePath).text(), raw;
+    let configPath = resolveConfigPath(command), config = await readV2Config(configPath), sourcePath = resolve13(options.source), sourceContent = await Bun.file(sourcePath).text(), raw;
     try {
       raw = JSON.parse(sourceContent);
     } catch {
@@ -50289,7 +50579,7 @@ var init_backfill = __esm(() => {
       console.log(JSON.stringify(artifact, null, 2));
       return;
     }
-    let out = resolve12(options.out ?? `.dbcli/backfills/${artifact.source.sha256.slice(0, 12)}.json`);
+    let out = resolve13(options.out ?? `.dbcli/backfills/${artifact.source.sha256.slice(0, 12)}.json`);
     await mkdir21(dirname18(out), { recursive: !0 }), await Bun.write(out, JSON.stringify(artifact, null, 2) + `
 `), console.log(JSON.stringify({ path: out, artifact }, null, 2));
   });
@@ -50423,7 +50713,7 @@ var init_legacy2 = __esm(() => {
 // src/core/evidence-pack/index.ts
 import { createHash as createHash10, randomUUID as randomUUID5 } from "crypto";
 import { link as link3, lstat as lstat7, mkdir as mkdir22, realpath as realpath4, unlink as unlink8, writeFile as writeFile10 } from "fs/promises";
-import { basename as basename9, dirname as dirname19, relative as relative6, resolve as resolve13, sep as sep8 } from "path";
+import { basename as basename9, dirname as dirname19, relative as relative6, resolve as resolve14, sep as sep8 } from "path";
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -50662,7 +50952,7 @@ async function realExistingAncestor(path) {
     }
 }
 async function writeEvidencePack(workspaceRoot, outputPath, pack) {
-  let workspace = await realpath4(workspaceRoot), requestedTarget = resolve13(workspace, outputPath);
+  let workspace = await realpath4(workspaceRoot), requestedTarget = resolve14(workspace, outputPath);
   if (!isInside(workspace, requestedTarget))
     throw new EvidencePackValidationError("output path must stay inside the workspace");
   let parent = dirname19(requestedTarget), existingAncestor = await realExistingAncestor(parent);
@@ -50672,7 +50962,7 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   let realParent = await realpath4(parent);
   if (!isInside(workspace, realParent) && realParent !== workspace)
     throw new EvidencePackValidationError("output path resolves outside the workspace");
-  let target = resolve13(realParent, basename9(requestedTarget));
+  let target = resolve14(realParent, basename9(requestedTarget));
   try {
     throw await lstat7(target), new EvidencePackValidationError("evidence pack output already exists");
   } catch (error) {
@@ -50681,7 +50971,7 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  let temp = resolve13(realParent, `.${basename9(target)}.${process.pid}.${randomUUID5()}.tmp`);
+  let temp = resolve14(realParent, `.${basename9(target)}.${process.pid}.${randomUUID5()}.tmp`);
   try {
     await writeFile10(temp, `${JSON.stringify(pack, null, 2)}
 `, "utf8");
@@ -50761,7 +51051,7 @@ var init_evidence_pack = __esm(() => {
 });
 
 // src/commands/evidence.ts
-import { join as join45, relative as relative7, resolve as resolve14, sep as sep9 } from "path";
+import { join as join45, relative as relative7, resolve as resolve15, sep as sep9 } from "path";
 import { realpath as realpath5 } from "fs/promises";
 import { createHash as createHash11 } from "crypto";
 function safeMessage(error) {
@@ -50881,7 +51171,7 @@ async function resolveReferences(verificationSelectors, auditSelectors, receiptP
       references.push(auditReference(selectAudit(entries, selector), connectionName));
   }
   for (let receiptPath of receiptPaths) {
-    let workspace = await realpath5(process.cwd()), requested = resolve14(workspace, receiptPath), path = relative7(workspace, requested);
+    let workspace = await realpath5(process.cwd()), requested = resolve15(workspace, receiptPath), path = relative7(workspace, requested);
     if (path === "" || path.startsWith(`..${sep9}`) || path === ".." || path.includes(`..${sep9}`))
       throw new EvidencePackValidationError("receipt evidence path must be workspace-relative");
     let resolved = await realpath5(requested).catch(() => {
@@ -50920,7 +51210,7 @@ async function expiredReferences(pack, configPath, config) {
         if (!found || audits.connectionName !== reference.connectionName || !sameReference(reference, auditReference(found, audits.connectionName)))
           throw Error("missing");
       } else {
-        let workspace = await realpath5(process.cwd()), target = await realpath5(resolve14(workspace, reference.path)), safePath = relative7(workspace, target);
+        let workspace = await realpath5(process.cwd()), target = await realpath5(resolve15(workspace, reference.path)), safePath = relative7(workspace, target);
         if (safePath.startsWith(`..${sep9}`) || safePath === ".." || safePath.includes(`..${sep9}`))
           throw Error("outside");
         let receipt = await readEvidenceReceipt(target), digest = `sha256:${createHash11("sha256").update(JSON.stringify(receipt)).digest("hex")}`;
@@ -51928,7 +52218,7 @@ function escapeText2(value) {
 // src/commands/impact.ts
 import { randomUUID as randomUUID6 } from "crypto";
 import { link as link4, lstat as lstat9, mkdir as mkdir23, realpath as realpath6, unlink as unlink9, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename10, dirname as dirname20, relative as relative8, resolve as resolve15, sep as sep10 } from "path";
+import { basename as basename10, dirname as dirname20, relative as relative8, resolve as resolve16, sep as sep10 } from "path";
 function collectOption3(value, previous) {
   return [...previous, value];
 }
@@ -52094,7 +52384,7 @@ async function loadObservedWorkloadSource(path, workspaceRoot, blocked) {
       malformedLines: 0,
       issues: []
     };
-  return loadWorkloadSource({ path: resolve15(workspaceRoot, path), blockedIdentifiers: blocked });
+  return loadWorkloadSource({ path: resolve16(workspaceRoot, path), blockedIdentifiers: blocked });
 }
 function shouldFail(report, failOn) {
   if (failOn === "never")
@@ -52127,7 +52417,7 @@ async function realExistingAncestor2(path) {
     }
 }
 async function resolveOutput(workspaceRoot, outputPath) {
-  let workspace = await realpath6(workspaceRoot), target = resolve15(workspace, outputPath);
+  let workspace = await realpath6(workspaceRoot), target = resolve16(workspace, outputPath);
   if (!isInside2(workspace, target))
     throw Error("output path must stay inside the workspace");
   let parent = dirname20(target), existingAncestor = await realExistingAncestor2(parent);
@@ -52137,7 +52427,7 @@ async function resolveOutput(workspaceRoot, outputPath) {
   let realParent = await realpath6(parent);
   if (!isInside2(workspace, realParent) && realParent !== workspace)
     throw Error("output path must stay inside the workspace");
-  return resolve15(realParent, basename10(target));
+  return resolve16(realParent, basename10(target));
 }
 async function assertOutputParent(workspaceRoot, path) {
   let workspace = await realpath6(workspaceRoot), parent = await realpath6(dirname20(path));
@@ -52152,7 +52442,7 @@ async function writeOutput(workspaceRoot, path, content) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  let temp = resolve15(dirname20(path), `.${basename10(path)}.${process.pid}.${randomUUID6()}.tmp`);
+  let temp = resolve16(dirname20(path), `.${basename10(path)}.${process.pid}.${randomUUID6()}.tmp`);
   try {
     await writeFile11(temp, content, "utf8"), await assertOutputParent(workspaceRoot, path), await link4(temp, path);
   } catch (error) {
@@ -52216,7 +52506,7 @@ var init_impact2 = __esm(() => {
         observedWorkload,
         blockedIdentifiers
       }), rendered = formatImpact(report, format), output = await resolveOutput(workspaceRoot, String(options.output));
-      if (resolve15(workspaceRoot, String(options.design)) === output)
+      if (resolve16(workspaceRoot, String(options.design)) === output)
         throw Error("design and output paths must differ");
       await writeOutput(workspaceRoot, output, rendered), console.log(JSON.stringify({
         path: relative8(workspaceRoot, output),