@carllee1983/dbcli 9.0.0 → 9.1.1

package/dist/cli-runtime.mjs

@@ -2087,7 +2087,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "9.0.0",
+    version: "9.1.1",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -2173,9 +2173,10 @@ var init_package = __esm(() => {
       "core-stdout:check": "bun run scripts/check-core-no-stdout.ts",
       "plan:check": "bun run scripts/check-plan-acceptance.ts",
       "forgeflow:check": "bun run scripts/check-forgeflow-adoption.ts && bun run scripts/check-forgeflow-handoff.ts",
+      "forgeflow:contract": "bun run scripts/check-forgeflow-contract.ts",
       typecheck: "tsc --noEmit --pretty false",
       "typecheck:tests": "tsc --noEmit --pretty false -p tsconfig.tests.json",
-      "test:perf": "bun test ./tests/perf/*.bench.ts",
+      "test:perf": "bun test --timeout 30000 ./tests/perf/*.bench.ts",
       lint: "eslint src tests scripts --ext .ts --max-warnings=0",
       "format:check": "prettier --check .",
       format: "prettier --write .",
@@ -6406,13 +6407,27 @@ function parseStatementTimeoutOption(value) {
   }
   return parsed;
 }
+function isSqliteMemoryTarget(value) {
+  const trimmed = value.trim();
+  if (trimmed.toLowerCase() === ":memory:")
+    return true;
+  if (!trimmed.toLowerCase().startsWith("file:"))
+    return false;
+  const withoutScheme = trimmed.slice("file:".length);
+  const queryStart = withoutScheme.indexOf("?");
+  const path = queryStart === -1 ? withoutScheme : withoutScheme.slice(0, queryStart);
+  if (path.toLowerCase() === ":memory:")
+    return true;
+  const query = queryStart === -1 ? "" : withoutScheme.slice(queryStart + 1);
+  return new URLSearchParams(query).get("mode")?.toLowerCase() === "memory";
+}
 function validateFormat(value, allowedFormats, commandName) {
   if (!allowedFormats.includes(value)) {
     const allowed = allowedFormats.join(", ");
     throw new Error(`Invalid format "${value}" for ${commandName}. Allowed: ${allowed}`);
   }
 }
-var EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, DEFAULT_AUDIT_ROTATION, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
+var EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, SQLITE_MEMORY_TARGET_MESSAGE, SqliteConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, DEFAULT_AUDIT_ROTATION, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, SqliteNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
 var init_validation = __esm(() => {
   init_zod();
   EnvRefSchema = exports_external.object({
@@ -6449,6 +6464,21 @@ var init_validation = __esm(() => {
     database: StringOrEnvRef,
     ...TimeoutField
   });
+  SQLITE_MEMORY_TARGET_MESSAGE = "SQLite in-memory databases are refused: a memory target is a different database on every " + "connection, so it cannot be the connection identity the blacklist, audit log and schema " + "cache are scoped to. Point `file` at a database file on disk. See ADR-0038.";
+  SqliteConnectionConfigSchema = exports_external.object({
+    system: exports_external.literal("sqlite"),
+    file: exports_external.union([exports_external.string().min(1), EnvRefSchema]).superRefine((value, ctx) => {
+      if (typeof value === "string" && isSqliteMemoryTarget(value)) {
+        ctx.addIssue({ code: exports_external.ZodIssueCode.custom, message: SQLITE_MEMORY_TARGET_MESSAGE });
+      }
+    }),
+    host: OptStringOrEnvRef,
+    port: exports_external.union([exports_external.number().int(), EnvRefSchema]).optional().default(0),
+    user: OptStringOrEnvRef,
+    password: exports_external.union([exports_external.string(), EnvRefSchema]).optional().default(""),
+    database: OptStringOrEnvRef,
+    ...TimeoutField
+  });
   RedisConnectionConfigSchema = exports_external.object({
     system: exports_external.literal("redis"),
     host: StringOrEnvRef,
@@ -6475,6 +6505,7 @@ var init_validation = __esm(() => {
   });
   ConnectionConfigSchema = exports_external.union([
     SqlConnectionConfigSchema,
+    SqliteConnectionConfigSchema,
     MongoDBConnectionConfigSchema,
     RedisConnectionConfigSchema,
     ElasticsearchConnectionConfigSchema
@@ -6545,6 +6576,11 @@ var init_validation = __esm(() => {
     envFile: exports_external.string().optional(),
     environment: EnvironmentLabelSchema
   });
+  SqliteNamedConnectionSchema = SqliteConnectionConfigSchema.extend({
+    permission: PermissionSchema,
+    envFile: exports_external.string().optional(),
+    environment: EnvironmentLabelSchema
+  });
   MongoDBNamedConnectionSchema = MongoDBConnectionConfigSchema.extend({
     permission: PermissionSchema,
     envFile: exports_external.string().optional(),
@@ -6562,6 +6598,7 @@ var init_validation = __esm(() => {
   });
   NamedConnectionUnion = exports_external.union([
     SqlNamedConnectionSchema,
+    SqliteNamedConnectionSchema,
     MongoDBNamedConnectionSchema,
     RedisNamedConnectionSchema,
     ElasticsearchNamedConnectionSchema
@@ -8815,7 +8852,8 @@ var init_messages = __esm(() => {
       connection_not_found: "Connection '{name}' does not exist",
       cannot_remove_last: "Cannot remove the last connection",
       connection_already_exists: "Connection '{name}' already exists",
-      rename_invalid_format: "Usage: --rename <old-name>:<new-name>"
+      rename_invalid_format: "Usage: --rename <old-name>:<new-name>",
+      prompt_sqlite_file: "SQLite database file path: "
     },
     inspect: {
       description: "Read-only snapshot of connection, permission, blacklist, objects, snippets, and suggested next commands.",
@@ -8959,7 +8997,7 @@ var init_messages = __esm(() => {
       elasticsearch_requires_level: "Elasticsearch {type} operation requires {minimum} permission or higher (current level: {permission})",
       escalated_write_requires_admin: "This statement opens as a read but contains an executable {keyword}. A write hidden inside a read statement requires admin permission (current level: {permission}).",
       multiple_statements_refused: "SQL containing multiple statements is refused below admin permission, because only the first statement determines the permission check. Run each statement separately.",
-      unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires read-write+ for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
+      unknown_statement_query_only: "Unrecognised SQL statement (current level: query-only). Security policy requires admin for unknown statements. If this is a legitimate read-only statement, please open an issue at https://github.com/CarlLee1983/dbcli/issues.",
       permission_denied_reason: "Permission denied: {reason}",
       table_not_found: "Table not found: {table}",
       unsupported_lang: "Language '{lang}' not supported, using English",
@@ -8984,7 +9022,8 @@ Or use interactive mode: run "dbcli init --use-env-refs" without --no-interactiv
       env_var_not_defined: `Cannot test connection: environment variable {envKey} is not defined.
 Set {envKey} in .env or environment variables.
 Hint: run 'export {envKey}=<value>' and retry`,
-      invalid_output_format: "--format {format} is not supported here \u2014 use text or json"
+      invalid_output_format: "--format {format} is not supported here \u2014 use text or json",
+      sqlite_file_required: "A SQLite connection needs a file path. Pass --file <path> or run init interactively."
     },
     success: {
       inserted: "Successfully inserted {count} row(s)",
@@ -9149,7 +9188,8 @@ var init_messages2 = __esm(() => {
       connection_not_found: "\u9023\u7DDA '{name}' \u4E0D\u5B58\u5728",
       cannot_remove_last: "\u7121\u6CD5\u79FB\u9664\u6700\u5F8C\u4E00\u500B\u9023\u7DDA",
       connection_already_exists: "\u9023\u7DDA '{name}' \u5DF2\u5B58\u5728",
-      rename_invalid_format: "\u7528\u6CD5\uFF1A--rename <\u820A\u540D\u7A31>:<\u65B0\u540D\u7A31>"
+      rename_invalid_format: "\u7528\u6CD5\uFF1A--rename <\u820A\u540D\u7A31>:<\u65B0\u540D\u7A31>",
+      prompt_sqlite_file: "SQLite \u8CC7\u6599\u5EAB\u6A94\u6848\u8DEF\u5F91\uFF1A"
     },
     inspect: {
       description: "\u552F\u8B80\u6AA2\u8996\uFF1A\u9023\u7DDA\u3001\u6B0A\u9650\u3001\u9ED1\u540D\u55AE\u3001\u7269\u4EF6\u3001\u7247\u6BB5\u8207\u5EFA\u8B70\u4E0B\u4E00\u6B65\u6307\u4EE4\u3002",
@@ -9293,7 +9333,7 @@ var init_messages2 = __esm(() => {
       elasticsearch_requires_level: "Elasticsearch {type} \u64CD\u4F5C\u9700\u8981 {minimum} \u4EE5\u4E0A\u7684\u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09",
       escalated_write_requires_admin: "\u6B64\u8A9E\u53E5\u8868\u9762\u4E0A\u662F\u8B80\u53D6\uFF0C\u4F46\u5BE6\u969B\u5305\u542B\u53EF\u57F7\u884C\u7684 {keyword}\u3002\u8B80\u53D6\u8A9E\u53E5\u4E2D\u96B1\u85CF\u5BEB\u5165\u64CD\u4F5C\u9700\u8981 admin \u6B0A\u9650\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1A{permission}\uFF09\u3002",
       multiple_statements_refused: "\u4F4E\u65BC admin \u6B0A\u9650\u6642\u62D2\u7D55\u57F7\u884C\u5305\u542B\u591A\u500B\u8A9E\u53E5\u7684 SQL\uFF0C\u56E0\u70BA\u6B0A\u9650\u6AA2\u67E5\u53EA\u6703\u4F9D\u64DA\u7B2C\u4E00\u500B\u8A9E\u53E5\u5224\u65B7\u3002\u8ACB\u5C07\u5404\u8A9E\u53E5\u5206\u958B\u57F7\u884C\u3002",
-      unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u81F3\u5C11\u9700\u8981 read-write \u4EE5\u4E0A\u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
+      unknown_statement_query_only: "\u7121\u6CD5\u8FA8\u8B58\u7684 SQL \u8A9E\u53E5\uFF08\u76EE\u524D\u5C64\u7D1A\uFF1Aquery-only\uFF09\u3002\u5B89\u5168\u653F\u7B56\u8981\u6C42\u672A\u77E5\u8A9E\u53E5\u9700\u8981 admin \u6B0A\u9650\u3002\u82E5\u9019\u5176\u5BE6\u662F\u5408\u6CD5\u7684\u552F\u8B80\u8A9E\u53E5\uFF0C\u8ACB\u81F3 https://github.com/CarlLee1983/dbcli/issues \u63D0\u51FA\u8B70\u984C\u3002",
       permission_denied_reason: "\u6B0A\u9650\u88AB\u62D2\uFF1A{reason}",
       table_not_found: "\u627E\u4E0D\u5230\u8868\u683C\uFF1A{table}",
       unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
@@ -9318,7 +9358,8 @@ var init_messages2 = __esm(() => {
       env_var_not_defined: `\u7121\u6CD5\u6E2C\u8A66\u9023\u7DDA\uFF1A\u74B0\u5883\u8B8A\u6578 {envKey} \u672A\u5B9A\u7FA9\u3002
 \u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u6578\u4E2D\u8A2D\u5B9A {envKey}\u3002
 \u63D0\u793A\uFF1A\u57F7\u884C 'export {envKey}=<value>' \u5F8C\u91CD\u8A66`,
-      invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json"
+      invalid_output_format: "\u7121\u6CD5\u4F7F\u7528 --format {format}\uFF0C\u8ACB\u4F7F\u7528 text \u6216 json",
+      sqlite_file_required: "SQLite \u9023\u7DDA\u9700\u8981\u4E00\u500B\u6A94\u6848\u8DEF\u5F91\u3002\u8ACB\u7528 --file <path>\uFF0C\u6216\u4EE5\u4E92\u52D5\u6A21\u5F0F\u57F7\u884C init\u3002"
     },
     success: {
       inserted: "\u6210\u529F\u63D2\u5165 {count} \u5217",
@@ -10246,16 +10287,23 @@ var init_redaction = __esm(() => {
 });
 
 // src/adapters/types.ts
-var DATABASE_SYSTEMS, ConnectionError;
+var DATABASE_SYSTEMS, SQL_DATABASE_SYSTEMS, ConnectionError;
 var init_types2 = __esm(() => {
   DATABASE_SYSTEMS = Object.freeze([
     "postgresql",
     "mysql",
     "mariadb",
+    "sqlite",
     "mongodb",
     "redis",
     "elasticsearch"
   ]);
+  SQL_DATABASE_SYSTEMS = Object.freeze([
+    "postgresql",
+    "mysql",
+    "mariadb",
+    "sqlite"
+  ]);
   ConnectionError = class ConnectionError extends Error {
     code;
     hints;
@@ -10416,6 +10464,38 @@ var init_capabilities = __esm(() => {
       ...SQL_BASE,
       check: cap("limited", "readonly", "SQL-only and strongest on MySQL/MariaDB.")
     }),
+    sqlite: Object.freeze({
+      ...SQL_BASE,
+      init: cap("supported", "local-write", "Asks for a file path and a permission; the file must already exist."),
+      use: cap("supported", "local-write", "Switches connections and displays the file path."),
+      schemaFullScan: cap("unsupported", "none", "Full schema cache scan is not implemented for SQLite."),
+      lint: cap("unsupported", "none", "Static lint is not enabled for the SQLite dialect yet."),
+      queries: cap("supported", "local-write", "Snippets may declare `engine: sqlite` and bind with `?` placeholders."),
+      insert: cap("supported", "db-write", "Row insert through the shared data-executor path."),
+      update: cap("supported", "db-write", "Row update with a mandatory --where clause."),
+      delete: cap("supported", "db-write", "Row delete with a mandatory --where clause."),
+      export: cap("supported", "local-write", "Exports SELECT results to json, csv or html through the shared query path."),
+      check: cap("unsupported", "none", "Data health check is not enabled for SQLite."),
+      diff: cap("unsupported", "none", "Schema snapshots are not enabled for SQLite."),
+      migrate: cap("unsupported", "none", "SQLite ALTER TABLE covers few operations and a column change is a table rebuild; no DDL generator exists."),
+      shell: cap("unsupported", "none", "The REPL is not enabled for SQLite."),
+      doctor: cap("supported", "readonly", "Checks the file exists, is readable, and is writable when the permission allows writes."),
+      inspect: cap("unsupported", "none", "Inspection collectors are not enabled for SQLite."),
+      report: cap("unsupported", "none", "Report diagnostics query engine-specific statistics views."),
+      guide: cap("unsupported", "none", "Guides depend on engine-specific EXPLAIN output."),
+      explain: cap("unsupported", "none", "EXPLAIN handling is not enabled for SQLite."),
+      plan: cap("unsupported", "none", "Plan capture is not enabled for SQLite."),
+      impactAssess: cap("unsupported", "none", "Impact assessment is not enabled for SQLite."),
+      assert: cap("unsupported", "none", "Assertions are not enabled for SQLite."),
+      snapshot: cap("unsupported", "none", "Result snapshots are not enabled for SQLite."),
+      verify: cap("unsupported", "none", "Write verification is not enabled for SQLite."),
+      semantic: cap("unsupported", "none", "Semantic context work is not enabled for SQLite."),
+      design: cap("unsupported", "none", "Schema design work is not enabled for SQLite."),
+      proxy: cap("not-applicable", "none", "SQLite has no network protocol to proxy."),
+      proxyAnalyze: cap("not-applicable", "none", "There are no SQLite proxy events to analyse."),
+      password: cap("not-applicable", "none", "A SQLite connection has no credential to store or rotate."),
+      queryLimitGuard: cap("limited", "readonly", "Applies the same LIMIT rewrite as the other SQL engines; under query-only the handle is opened read-only, which a database with an unreplayed WAL cannot satisfy.")
+    }),
     mysql: Object.freeze(SQL_BASE),
     mariadb: Object.freeze(SQL_BASE),
     mongodb: Object.freeze({
@@ -10915,7 +10995,7 @@ var init_encoding = __esm(() => {
 
 // src/adapters/identifier-quote.ts
 function quoteCharFor(dialect) {
-  return dialect === "postgresql" ? '"' : "`";
+  return dialect === "postgresql" || dialect === "sqlite" ? '"' : "`";
 }
 function assertQuotable(name, what) {
   if (name.length === 0) {
@@ -11624,6 +11704,208 @@ var init_mysql_adapter = __esm(() => {
   init_connection_error_message();
 });
 
+// src/adapters/sqlite-adapter.ts
+import { Database } from "bun:sqlite";
+function mapSqliteError(error, file, readonly) {
+  if (error instanceof ConnectionError)
+    return error;
+  const message = error instanceof Error ? error.message : String(error);
+  const code = String(error?.code ?? "");
+  if (readonly && (code.startsWith("SQLITE_CANTOPEN") || /unable to open database/i.test(message))) {
+    return new ConnectionError("CONNECTION_REJECTED", `Cannot open '${file}' read-only: the database has an unreplayed write-ahead log, ` + `and replaying it is a write. A query-only connection cannot recover it.`, [
+      "Let the owning application close the database cleanly, which checkpoints the WAL.",
+      "Or connect with a permission above query-only, which opens the file read-write.",
+      `Original driver message: ${message}`
+    ]);
+  }
+  if (/readonly database|attempt to write a readonly/i.test(message)) {
+    return new ConnectionError("CONNECTION_REJECTED", `The SQLite connection is open read-only: ${message}`, [
+      "query-only opens the database file read-only, so no write can reach it.",
+      "Raise the connection permission if the write is intended."
+    ]);
+  }
+  if (/no such table/i.test(message)) {
+    return new ConnectionError("TABLE_NOT_FOUND", message, [
+      "Run `dbcli list` to see the tables this database holds."
+    ]);
+  }
+  if (/no such column/i.test(message)) {
+    return new ConnectionError("COLUMN_NOT_FOUND", message, [
+      "Run `dbcli schema <table>` to see the columns this table holds."
+    ]);
+  }
+  if (/syntax error/i.test(message)) {
+    return new ConnectionError("SQL_SYNTAX_ERROR", message, [
+      "Check the statement against SQLite syntax; it differs from PostgreSQL and MySQL."
+    ]);
+  }
+  return new ConnectionError("UNKNOWN", message, [`SQLite database: ${file}`]);
+}
+
+class SQLiteAdapter {
+  db = null;
+  openedReadonly = true;
+  connected = false;
+  file;
+  constructor(options) {
+    if (!options.file) {
+      throw new ConnectionError("UNKNOWN", "SQLite connection is missing its `file` path", [
+        "Set `file` in the connection configuration to the database file path."
+      ]);
+    }
+    this.file = options.file;
+  }
+  async connect() {
+    const target = Bun.file(this.file);
+    if (!await target.exists()) {
+      throw new ConnectionError("ENOTFOUND", `SQLite database file not found: ${this.file}`, [
+        "dbcli never creates a database file; point `file` at one that already exists.",
+        "Check the path in the connection configuration."
+      ]);
+    }
+    let header;
+    try {
+      header = await target.slice(0, SQLITE_HEADER.length).text();
+    } catch (error) {
+      throw new ConnectionError("CONNECTION_REJECTED", `SQLite database file is not readable: ${this.file}`, [
+        "Check the file permissions for the user running dbcli.",
+        `Original error: ${error instanceof Error ? error.message : String(error)}`
+      ]);
+    }
+    if (target.size > 0 && header !== SQLITE_HEADER) {
+      throw new ConnectionError("CONNECTION_REJECTED", `Not a SQLite database: ${this.file} does not start with the SQLite file header`, ["Point `file` at a SQLite database file."]);
+    }
+    this.connected = true;
+  }
+  async disconnect() {
+    try {
+      this.db?.close();
+    } catch {}
+    this.db = null;
+    this.connected = false;
+  }
+  handle(readonly) {
+    if (!this.connected)
+      requireConnected(null);
+    if (this.db && this.openedReadonly === readonly)
+      return this.db;
+    try {
+      this.db?.close();
+    } catch {}
+    this.db = null;
+    try {
+      this.db = readonly ? new Database(this.file, { readonly: true }) : new Database(this.file, { readwrite: true, create: false });
+    } catch (error) {
+      throw mapSqliteError(error, this.file, readonly);
+    }
+    this.openedReadonly = readonly;
+    return this.db;
+  }
+  async execute(sql, params, options) {
+    const readonly = options?.sqlMode === "native-read-only";
+    const db = this.handle(readonly);
+    try {
+      const statement = db.prepare(sql);
+      try {
+        const columnNames = statement.columnNames;
+        if (columnNames.length === 0) {
+          const changes = statement.run(...params ?? []);
+          return {
+            rows: [],
+            affectedRows: changes.changes,
+            lastInsertId: Number(changes.lastInsertRowid)
+          };
+        }
+        const rows = statement.all(...params ?? []);
+        return {
+          rows,
+          affectedRows: rows.length,
+          rowCount: rows.length,
+          columnNames: [...columnNames]
+        };
+      } finally {
+        statement.finalize();
+      }
+    } catch (error) {
+      throw mapSqliteError(error, this.file, readonly);
+    }
+  }
+  async testConnection() {
+    const result = await this.execute("SELECT 1 as ok", [], {
+      sqlMode: "native-read-only"
+    });
+    return result.rows.length > 0;
+  }
+  async getServerVersion() {
+    const result = await this.execute("SELECT sqlite_version() as version", [], {
+      sqlMode: "native-read-only"
+    });
+    return result.rows[0]?.version ?? "unknown";
+  }
+  async listTables() {
+    const result = await this.execute(`SELECT m.name AS name,
+              m.type AS type,
+              (SELECT COUNT(*) FROM pragma_table_info(m.name)) AS column_count
+         FROM sqlite_master m
+        WHERE m.type IN ('table', 'view')
+          AND m.name NOT LIKE 'sqlite\\_%' ESCAPE '\\'
+        ORDER BY m.name`, [], { sqlMode: "native-read-only" });
+    return result.rows.map((row) => ({
+      name: row.name,
+      columns: [],
+      columnCount: row.column_count,
+      rowCount: 0,
+      estimatedRowCount: 0,
+      tableType: row.type === "view" ? "view" : "table"
+    }));
+  }
+  async getTableSchema(tableName, _options) {
+    const info = await this.execute('SELECT cid, name, type, "notnull", dflt_value, pk FROM pragma_table_info(?)', [tableName], { sqlMode: "native-read-only" });
+    if (info.rows.length === 0) {
+      throw new ConnectionError("TABLE_NOT_FOUND", `Table not found: ${tableName}`, [
+        "Run `dbcli list` to see the tables this database holds."
+      ]);
+    }
+    const foreignKeys = await this.execute('SELECT "from", "table", "to" FROM pragma_foreign_key_list(?)', [tableName], { sqlMode: "native-read-only" });
+    const fkByColumn = new Map(foreignKeys.rows.map((fk) => [fk.from, { table: fk.table, column: fk.to ?? "rowid" }]));
+    const ddl = await this.execute("SELECT sql FROM sqlite_master WHERE name = ? AND type = ?", [tableName, "table"], { sqlMode: "native-read-only" });
+    const createSql = ddl.rows[0]?.sql ?? "";
+    const declaresAutoIncrement = /\bAUTOINCREMENT\b/i.test(createSql);
+    const columns = info.rows.map((row) => {
+      const isPrimaryKey = row.pk > 0;
+      const column = {
+        name: row.name,
+        type: row.type || "BLOB",
+        nullable: row.notnull === 0,
+        primaryKey: isPrimaryKey
+      };
+      if (row.dflt_value !== null)
+        column.default = row.dflt_value;
+      const fk = fkByColumn.get(row.name);
+      if (fk)
+        column.foreignKey = fk;
+      if (isPrimaryKey && declaresAutoIncrement && /^INTEGER$/i.test(row.type)) {
+        column.autoIncrement = true;
+      }
+      return column;
+    });
+    const count = await this.execute(`SELECT COUNT(*) AS n FROM ${quoteIdentifier(tableName, "sqlite")}`, [], { sqlMode: "native-read-only" });
+    return {
+      name: tableName,
+      columns,
+      columnCount: columns.length,
+      rowCount: count.rows[0]?.n ?? 0,
+      estimatedRowCount: count.rows[0]?.n ?? 0,
+      tableType: "table"
+    };
+  }
+}
+var SQLITE_HEADER = "SQLite format 3\x00";
+var init_sqlite_adapter = __esm(() => {
+  init_types2();
+  init_sql_adapter_utils();
+});
+
 // src/adapters/server-side-script.ts
 function isElasticsearchScriptKey(key, parentKey) {
   if (key === "script" || key === "script_fields")
@@ -14267,6 +14549,8 @@ class AdapterFactory {
       case "mysql":
       case "mariadb":
         return new MySQLAdapter(options);
+      case "sqlite":
+        return new SQLiteAdapter(options);
       default:
         throw new Error(`createSqlAdapter requires a SQL system, got: ${options.system}`);
     }
@@ -14290,6 +14574,7 @@ class AdapterFactory {
       case "postgresql":
       case "mysql":
       case "mariadb":
+      case "sqlite":
         return AdapterFactory.createSqlAdapter(options);
       case "redis":
         return AdapterFactory.createRedisAdapter(config);
@@ -14306,6 +14591,7 @@ class AdapterFactory {
       case "postgresql":
       case "mysql":
       case "mariadb":
+      case "sqlite":
         return AdapterFactory.createSqlAdapter(options);
       case "mongodb":
       case "redis":
@@ -14350,6 +14636,7 @@ class AdapterFactory {
 var init_factory = __esm(() => {
   init_postgresql_adapter();
   init_mysql_adapter();
+  init_sqlite_adapter();
   init_mongodb_adapter();
   init_redis_adapter();
   init_elasticsearch_adapter();
@@ -14721,13 +15008,113 @@ var init_init_mongodb = __esm(() => {
   VALID_PERMISSIONS = ["query-only", "read-write", "data-admin", "admin"];
 });
 
+// src/commands/init-sqlite.ts
+import { mkdir as mkdir7 } from "fs/promises";
+function isMemoryTarget(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed === ":memory:")
+    return true;
+  if (!trimmed.startsWith("file:"))
+    return false;
+  const withoutScheme = trimmed.slice("file:".length);
+  const [path = "", query = ""] = withoutScheme.split("?");
+  if (path === ":memory:")
+    return true;
+  return new URLSearchParams(query).get("mode") === "memory";
+}
+async function handleSQLiteInit(ctx) {
+  const { options, configPath, connectionName, isV2Init, existingConfig } = ctx;
+  const isInteractive = options.interactive !== false && process.stdin.isTTY;
+  let file = options.file?.trim();
+  while (!file && isInteractive) {
+    const input = (await promptUser.text(t("init.prompt_sqlite_file"))).trim();
+    if (!input)
+      continue;
+    if (isMemoryTarget(input)) {
+      console.error(SQLITE_MEMORY_TARGET_MESSAGE);
+      continue;
+    }
+    file = input;
+  }
+  if (!file) {
+    throw new Error(t("errors.sqlite_file_required"));
+  }
+  if (isMemoryTarget(file)) {
+    throw new Error(SQLITE_MEMORY_TARGET_MESSAGE);
+  }
+  const sqliteConfig = { system: "sqlite", file };
+  let permission = options.permission || "query-only";
+  if (isInteractive && !options.permission) {
+    permission = await promptUser.select(t("init.prompt_permission"), [
+      "query-only",
+      "read-write",
+      "data-admin",
+      "admin"
+    ]);
+  }
+  if (!VALID_PERMISSIONS2.includes(permission)) {
+    throw new Error(t_vars("errors.invalid_permission", { permission }));
+  }
+  const canProceed = await checkOverwrite(configPath, isInteractive, !!options.force);
+  if (!canProceed)
+    return;
+  if (!options.skipTest) {
+    console.log(t("init.connection_testing"));
+    const adapter = AdapterFactory.createAdapterWithoutRules(sqliteConfig);
+    try {
+      await adapter.connect();
+      await adapter.testConnection();
+      console.log(t("init.connection_success"));
+    } catch (error) {
+      if (error instanceof ConnectionError) {
+        console.error(t_vars("errors.connection_failed", { message: error.message }));
+        console.error(t("init.connection_hints"));
+        error.hints.forEach((hint) => console.error(`  \u2022 ${hint}`));
+        process.exit(1);
+      }
+      throw error;
+    } finally {
+      await adapter.disconnect();
+    }
+  }
+  if (isV2Init) {
+    await writeV2InitConfig(configPath, connectionName, sqliteConfig, permission, options.envFile);
+    return;
+  }
+  const newConfig = configModule.merge(existingConfig, {
+    connection: sqliteConfig,
+    permission
+  });
+  const globalConfig = isGlobalConfigPath(configPath);
+  const storagePath = globalConfig ? configPath : getProjectStoragePath(configPath);
+  await mkdir7(storagePath, { recursive: true });
+  await configModule.write(storagePath, newConfig);
+  if (!globalConfig) {
+    await migrateLegacyProjectEnvLocal(configPath, storagePath);
+    await writeProjectBinding(configPath, storagePath);
+  }
+  console.log(t("init.config_saved"));
+}
+var VALID_PERMISSIONS2;
+var init_init_sqlite = __esm(() => {
+  init_message_loader();
+  init_config();
+  init_prompts();
+  init_adapters();
+  init_validation();
+  init_config_binding();
+  init_init_shared();
+  VALID_PERMISSIONS2 = ["query-only", "read-write", "data-admin", "admin"];
+});
+
 // src/commands/init.ts
 var exports_init = {};
 __export(exports_init, {
-  initCommand: () => initCommand
+  initCommand: () => initCommand,
+  INIT_SYSTEM_CHOICES: () => INIT_SYSTEM_CHOICES
 });
 import { join as join11 } from "path";
-import { mkdir as mkdir7 } from "fs/promises";
+import { mkdir as mkdir8 } from "fs/promises";
 async function handleRemove(configPath, name) {
   const storagePath = await resolveConfigStoragePath(configPath);
   const configFile = Bun.file(join11(storagePath, "config.json"));
@@ -14818,18 +15205,22 @@ async function initCommandHandler(options, command) {
   const systemFromCli = typeof options.system === "string" ? options.system : undefined;
   let system = systemFromCli ?? envConfig?.system ?? "postgresql";
   if (shouldPrompt && !options.system && !envConfig?.system) {
-    system = await promptUser.select(t("init.select_system"), [
-      "postgresql",
-      "mysql",
-      "mariadb",
-      "mongodb",
-      "redis",
-      "elasticsearch"
-    ]);
+    system = await promptUser.select(t("init.select_system"), [...INIT_SYSTEM_CHOICES]);
   }
-  if (!["postgresql", "mysql", "mariadb", "mongodb", "redis", "elasticsearch"].includes(system)) {
+  if (!DATABASE_SYSTEMS.includes(system)) {
     throw new Error(t_vars("errors.invalid_system", { system }));
   }
+  if (system === "sqlite") {
+    await handleSQLiteInit({
+      options,
+      configPath,
+      connectionName,
+      isV2Init,
+      existingConfig,
+      shouldPrompt
+    });
+    return;
+  }
   const defaults = getDefaultsForSystem(system);
   if (system === "mongodb") {
     await handleMongoDBInit({
@@ -14870,7 +15261,7 @@ async function initCommandHandler(options, command) {
         "admin"
       ]);
     }
-    if (!VALID_PERMISSIONS2.includes(permission2)) {
+    if (!VALID_PERMISSIONS3.includes(permission2)) {
       throw new Error(t_vars("errors.invalid_permission", { permission: permission2 }));
     }
     const newConfig2 = configModule.merge(existingConfig, {
@@ -14886,7 +15277,7 @@ async function initCommandHandler(options, command) {
       return;
     }
     const storagePath2 = isGlobalConfig ? configPath : getProjectStoragePath(configPath);
-    await mkdir7(storagePath2, { recursive: true });
+    await mkdir8(storagePath2, { recursive: true });
     await configModule.write(storagePath2, newConfig2);
     if (!isGlobalConfig) {
       await migrateLegacyProjectEnvLocal(configPath, storagePath2);
@@ -14927,7 +15318,7 @@ async function initCommandHandler(options, command) {
       "admin"
     ]);
   }
-  if (!VALID_PERMISSIONS2.includes(permission)) {
+  if (!VALID_PERMISSIONS3.includes(permission)) {
     throw new Error(t_vars("errors.invalid_permission", { permission }));
   }
   configForWrite = connection;
@@ -15005,7 +15396,7 @@ async function initCommandHandler(options, command) {
     return;
   }
   const storagePath = isGlobalConfig ? configPath : getProjectStoragePath(configPath);
-  await mkdir7(storagePath, { recursive: true });
+  await mkdir8(storagePath, { recursive: true });
   await configModule.write(storagePath, newConfig);
   if (!isGlobalConfig) {
     await migrateLegacyProjectEnvLocal(configPath, storagePath);
@@ -15013,7 +15404,7 @@ async function initCommandHandler(options, command) {
   }
   console.log(t("init.config_saved"));
 }
-var VALID_PERMISSIONS2, initCommand;
+var INIT_SYSTEM_CHOICES, VALID_PERMISSIONS3, initCommand;
 var init_init = __esm(() => {
   init_esm();
   init_message_loader();
@@ -15023,12 +15414,15 @@ var init_init = __esm(() => {
   init_prompts();
   init_redaction();
   init_adapters();
+  init_types2();
   init_config_path();
   init_config_binding();
   init_init_shared();
   init_init_mongodb();
-  VALID_PERMISSIONS2 = ["query-only", "read-write", "data-admin", "admin"];
-  initCommand = new Command("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb, mongodb, redis, elasticsearch)").option("--cloud-id <id>", "Elasticsearch Cloud ID").option("--api-key <key>", "Elasticsearch API Key").option("--uri <uri>", "MongoDB connection URI (mongodb://user:pass@host:27017/db?authSource=admin)").option("--auth-source <authSource>", "MongoDB auth database (default: admin when user/password are set)").option("--permission <permission>", "Permission level (query-only, read-write, data-admin, admin)", "query-only").option("--use-env-refs", "Store env var references in config instead of actual values (for CI/CD or multi-env)", false).option("--env-host <var>", "Env var name for host (with --use-env-refs)").option("--env-port <var>", "Env var name for port (with --use-env-refs)").option("--env-user <var>", "Env var name for user (with --use-env-refs)").option("--env-password <var>", "Env var name for password (with --use-env-refs)").option("--env-database <var>", "Env var name for database (with --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").option("--conn-name <name>", "Connection name (creates v2 multi-connection config)").option("--env-file <path>", "Path to env file for this connection").option("--remove <name>", "Remove a named connection").option("--rename <names>", "Rename a connection (format: old:new)").action(async (options) => {
+  init_init_sqlite();
+  INIT_SYSTEM_CHOICES = DATABASE_SYSTEMS;
+  VALID_PERMISSIONS3 = ["query-only", "read-write", "data-admin", "admin"];
+  initCommand = new Command("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb, mongodb, redis, elasticsearch)").option("--file <path>", "SQLite database file path (the database must already exist)").option("--cloud-id <id>", "Elasticsearch Cloud ID").option("--api-key <key>", "Elasticsearch API Key").option("--uri <uri>", "MongoDB connection URI (mongodb://user:pass@host:27017/db?authSource=admin)").option("--auth-source <authSource>", "MongoDB auth database (default: admin when user/password are set)").option("--permission <permission>", "Permission level (query-only, read-write, data-admin, admin)", "query-only").option("--use-env-refs", "Store env var references in config instead of actual values (for CI/CD or multi-env)", false).option("--env-host <var>", "Env var name for host (with --use-env-refs)").option("--env-port <var>", "Env var name for port (with --use-env-refs)").option("--env-user <var>", "Env var name for user (with --use-env-refs)").option("--env-password <var>", "Env var name for password (with --use-env-refs)").option("--env-database <var>", "Env var name for database (with --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").option("--conn-name <name>", "Connection name (creates v2 multi-connection config)").option("--env-file <path>", "Path to env file for this connection").option("--remove <name>", "Remove a named connection").option("--rename <names>", "Rename a connection (format: old:new)").action(async (options) => {
     try {
       await initCommandHandler(options, initCommand);
     } catch (error) {
@@ -16975,17 +17369,22 @@ var init_formatters = __esm(() => {
   init_query_result_formatter();
 });
 
-// src/commands/list.ts
-var exports_list = {};
-__export(exports_list, {
-  listCommand: () => listCommand
-});
+// src/commands/require-sql-connection.ts
 function requireSqlConnection(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
+  if (!SQL_DATABASE_SYSTEMS.includes(connection.system)) {
     throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
   }
   return connection;
 }
+var init_require_sql_connection = __esm(() => {
+  init_types2();
+});
+
+// src/commands/list.ts
+var exports_list = {};
+__export(exports_list, {
+  listCommand: () => listCommand
+});
 async function listAction(options, command) {
   validateFormat(options.format, ALLOWED_FORMATS, "list");
   const config = await configModule.read(resolveConfigPath(command, options));
@@ -17135,6 +17534,7 @@ var init_list = __esm(() => {
   init_config_path();
   init_validation();
   init_connection_selector();
+  init_require_sql_connection();
   ALLOWED_FORMATS = ["table", "json"];
   listCommand = new Command().name("list").description("List all tables in the database with metadata").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).option("--include-system", "Elasticsearch only: include system indices whose names start with dot", false).action(listAction);
 });
@@ -17250,7 +17650,7 @@ var init_artifact = __esm(() => {
 });
 
 // src/core/verification/artifact-writer.ts
-import { mkdir as mkdir8, writeFile as writeFile3, link, unlink as unlink5 } from "fs/promises";
+import { mkdir as mkdir9, writeFile as writeFile3, link, unlink as unlink5 } from "fs/promises";
 import { join as join12 } from "path";
 function pad(n, len = 2) {
   return String(n).padStart(len, "0");
@@ -17269,7 +17669,7 @@ function verificationArtifactFilename(artifact) {
 }
 async function writeVerificationArtifact(storageDir, artifact) {
   const dir = join12(storageDir, VERIFICATION_DIR_RELATIVE);
-  await mkdir8(dir, { recursive: true });
+  await mkdir9(dir, { recursive: true });
   const target = join12(dir, verificationArtifactFilename(artifact));
   const tmp = `${target}.${process.pid}.tmp`;
   try {
@@ -17842,7 +18242,7 @@ var init_legacy = __esm(() => {
 
 // src/core/evidence-receipt/index.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import { link as link2, lstat as lstat4, mkdir as mkdir9, readFile as readFile3, realpath, unlink as unlink7, writeFile as writeFile4 } from "fs/promises";
+import { link as link2, lstat as lstat4, mkdir as mkdir10, readFile as readFile3, realpath, unlink as unlink7, writeFile as writeFile4 } from "fs/promises";
 import { basename as basename3, dirname as dirname5, relative, resolve as resolve5, sep as sep3 } from "path";
 function exact(value, keys, label) {
   if (Object.keys(value).length !== keys.length || Object.keys(value).some((key) => !keys.includes(key))) {
@@ -18122,7 +18522,7 @@ async function writeEvidenceReceipt(workspaceRoot, outputPath, receipt) {
   const parent = dirname5(requested);
   if (!inside(workspace, await existingAncestor(parent)))
     throw new EvidenceReceiptValidationError("output path resolves outside the workspace");
-  await mkdir9(parent, { recursive: true });
+  await mkdir10(parent, { recursive: true });
   const realParent = await realpath(parent);
   if (!inside(workspace, realParent))
     throw new EvidenceReceiptValidationError("output path resolves outside the workspace");
@@ -18216,8 +18616,16 @@ var init_evidence_receipt = __esm(() => {
 });
 
 // src/core/saved-queries/types.ts
-var SUPPORTED_CHART_TYPES, SavedQueryError;
+var ENGINE_TAGS, SUPPORTED_CHART_TYPES, SavedQueryError;
 var init_types4 = __esm(() => {
+  ENGINE_TAGS = Object.freeze([
+    "postgres",
+    "mysql",
+    "sqlite",
+    "elasticsearch",
+    "redis",
+    "mongodb"
+  ]);
   SUPPORTED_CHART_TYPES = ["line", "bar", "area", "pie"];
   SavedQueryError = class SavedQueryError extends Error {
     code;
@@ -18311,6 +18719,7 @@ function paramErr(spec, raw, expected) {
 function rewriteToBind(sqlBody, params, engine) {
   const masked = stripCommentsAndStrings(sqlBody);
   const order = [];
+  const occurrences = [];
   const indexByName = new Map;
   let m;
   NAME_RE.lastIndex = 0;
@@ -18329,19 +18738,18 @@ function rewriteToBind(sqlBody, params, engine) {
     const start = m.index;
     const end = start + m[0].length;
     outSql += sqlBody.slice(cursor, start);
-    const idx = indexByName.get(name);
-    outSql += engine === "postgres" ? `$${idx}` : "?";
+    if (engine === "postgres") {
+      outSql += `$${indexByName.get(name)}`;
+    } else {
+      outSql += "?";
+      occurrences.push(name);
+    }
     cursor = end;
   }
   outSql += sqlBody.slice(cursor);
-  const undeclared = [];
-  const values = order.map((n) => {
-    if (!Object.prototype.hasOwnProperty.call(params, n)) {
-      undeclared.push(n);
-      return null;
-    }
-    return params[n];
-  });
+  const undeclared = order.filter((n) => !Object.prototype.hasOwnProperty.call(params, n));
+  const bindOrder = engine === "postgres" ? order : occurrences;
+  const values = bindOrder.map((n) => Object.prototype.hasOwnProperty.call(params, n) ? params[n] : null);
   return { sql: outSql, values, undeclared };
 }
 var NAME_RE;
@@ -18776,7 +19184,16 @@ function stripCommentsAndStrings2(sql, options = {}) {
         continue;
       }
     }
-    if (mysqlDialect && char === "`") {
+    if (options.dialect === "sqlite" && char === "[") {
+      i++;
+      while (i < sql.length && sql[i] !== "]")
+        i++;
+      if (i < sql.length)
+        i++;
+      result += " ";
+      continue;
+    }
+    if ((mysqlDialect || options.dialect === "sqlite") && char === "`") {
       i++;
       while (i < sql.length) {
         if (sql[i] === "`") {
@@ -18849,8 +19266,13 @@ function extractFirstKeyword(sql) {
   }
   return firstKeyword;
 }
-function mapKeywordToType(keyword) {
+function isDeclaredAdminOnly(keyword) {
+  return DECLARED_ADMIN_ONLY_KEYWORDS.has(keyword.toUpperCase());
+}
+function mapKeywordToType(keyword, dialect) {
   const upper = keyword.toUpperCase();
+  if (upper === "REPLACE" && dialect === "sqlite")
+    return "REPLACE";
   if (upper === "SELECT")
     return "SELECT";
   if (upper === "SHOW")
@@ -18880,7 +19302,7 @@ function mapKeywordToType(keyword) {
   return "UNKNOWN";
 }
 function isDestructiveOperation(type) {
-  return ["DELETE", "DROP", "ALTER", "TRUNCATE", "CREATE", "GRANT"].includes(type);
+  return ["DELETE", "REPLACE", "DROP", "ALTER", "TRUNCATE", "CREATE", "GRANT"].includes(type);
 }
 function extractAllKeywords(sql) {
   const upper = sql.toUpperCase();
@@ -18947,8 +19369,10 @@ function determineConfidence(type, _keyword, _sql) {
 function removeParameterMarkers(sql) {
   return sql.replace(/\$\d+/g, "").replace(/\?/g, "");
 }
+var DECLARED_ADMIN_ONLY_KEYWORDS;
 var init_sql_analysis = __esm(() => {
   init_sql_lexical();
+  DECLARED_ADMIN_ONLY_KEYWORDS = new Set(["PRAGMA", "VACUUM", "REINDEX"]);
 });
 
 // src/core/permission/rank.ts
@@ -18983,11 +19407,12 @@ __export(exports_permission_guard, {
   SQL_WRITE_OR_DDL_KEYWORDS: () => SQL_WRITE_OR_DDL_KEYWORDS,
   SQL_LOCK_CLAUSE: () => SQL_LOCK_CLAUSE,
   SQL_DIALECTS: () => SQL_DIALECTS,
-  PermissionError: () => PermissionError
+  PermissionError: () => PermissionError,
+  ConnectionBoundaryError: () => ConnectionBoundaryError
 });
-function classifyStatement(sql) {
+function classifyStatement(sql, dialect) {
   const normalized = normalizeSQL(sql);
-  const stripped = stripCommentsAndStrings2(normalized);
+  const stripped = stripCommentsAndStrings2(normalized, { dialect });
   const upper = stripped.toUpperCase();
   if (/^\s*ANALYZE\s+SELECT\b/i.test(stripped)) {
     return {
@@ -19000,7 +19425,16 @@ function classifyStatement(sql) {
   }
   const composite = detectCompositePatterns(upper);
   const firstKeyword = extractFirstKeyword(stripped);
-  const type = mapKeywordToType(firstKeyword);
+  if (isDeclaredAdminOnly(firstKeyword)) {
+    return {
+      type: "UNKNOWN",
+      isDangerous: true,
+      keywords: extractAllKeywords(stripped),
+      isComposite: false,
+      confidence: "HIGH"
+    };
+  }
+  const type = mapKeywordToType(firstKeyword, dialect);
   return {
     type,
     isDangerous: isDestructiveOperation(type),
@@ -19045,8 +19479,21 @@ function escalateHiddenWrite(sql, classification, dialect) {
     escalatedFrom: hidden
   };
 }
+function reachesAnotherDatabase(sql, dialect) {
+  if (dialect !== "sqlite")
+    return false;
+  return stripCommentsAndStrings2(sql, { dialect }).split(";").some((statement) => SQLITE_CROSS_DATABASE.test(statement));
+}
 function checkPermission(sql, permission, dialect) {
-  const classification = escalateHiddenWrite(sql, classifyStatement(sql), dialect);
+  if (reachesAnotherDatabase(sql, dialect)) {
+    return {
+      allowed: false,
+      reason: "ATTACH and DETACH are refused on a SQLite connection: they reach a database file " + "outside the one this connection names, which the blacklist, audit log and schema " + "cache are all scoped to. Configure a second connection instead.",
+      classification: classifyStatement(sql),
+      boundary: true
+    };
+  }
+  const classification = escalateHiddenWrite(sql, classifyStatement(sql, dialect), dialect);
   if (permission !== "admin" && containsMultipleStatements(sql, dialect)) {
     return {
       allowed: false,
@@ -19101,7 +19548,7 @@ function checkPermissionForClassification(classification, permission) {
       allowed: false,
       reason: isUnknown ? t("errors.unknown_statement_query_only") : refusalReason(classification.type, permission),
       classification,
-      requiredPermission: isUnknown ? "read-write" : minimumPermissionFor(classification.type)
+      requiredPermission: minimumPermissionFor(classification.type)
     };
   }
   return {
@@ -19132,16 +19579,28 @@ function enforcePermissionForType(type, permission) {
 }
 function enforcePermission(sql, permission, dialect) {
   const result = checkPermission(sql, permission, dialect);
+  if (result.boundary) {
+    throw new ConnectionBoundaryError(result.reason, result.classification);
+  }
   if (!result.allowed) {
     throw new PermissionError(result.reason, result.classification, result.requiredPermission ?? "admin");
   }
   return result.classification;
 }
-var PermissionError, SQL_DIALECTS, SQL_WRITE_OR_DDL_KEYWORDS, SQL_LOCK_CLAUSE, ESCALATABLE_READ_TYPES, TIER_GRANTS;
+var ConnectionBoundaryError, PermissionError, SQL_DIALECTS, SQL_WRITE_OR_DDL_KEYWORDS, SQL_LOCK_CLAUSE, ESCALATABLE_READ_TYPES, SQLITE_CROSS_DATABASE, TIER_GRANTS;
 var init_permission_guard = __esm(() => {
   init_message_loader();
   init_sql_analysis();
   init_rank();
+  ConnectionBoundaryError = class ConnectionBoundaryError extends Error {
+    classification;
+    constructor(message, classification) {
+      super(message);
+      this.classification = classification;
+      this.name = "ConnectionBoundaryError";
+      Object.setPrototypeOf(this, ConnectionBoundaryError.prototype);
+    }
+  };
   PermissionError = class PermissionError extends Error {
     classification;
     requiredPermission;
@@ -19153,14 +19612,15 @@ var init_permission_guard = __esm(() => {
       Object.setPrototypeOf(this, PermissionError.prototype);
     }
   };
-  SQL_DIALECTS = ["postgresql", "mysql", "mariadb"];
+  SQL_DIALECTS = ["postgresql", "mysql", "mariadb", "sqlite"];
   SQL_WRITE_OR_DDL_KEYWORDS = /(?<![.\w])(INSERT|UPDATE|DELETE|MERGE|UPSERT|REPLACE|TRUNCATE|DROP|ALTER|CREATE|GRANT|REVOKE|RENAME|INTO)\b(?!\s*\()/i;
   SQL_LOCK_CLAUSE = /\bFOR\s+(?:NO\s+KEY\s+)?UPDATE\b|\bFOR\s+(?:KEY\s+)?SHARE\b/gi;
   ESCALATABLE_READ_TYPES = new Set(["SELECT", "EXPLAIN", "DESCRIBE"]);
+  SQLITE_CROSS_DATABASE = /^\s*(ATTACH|DETACH)\b/i;
   TIER_GRANTS = [
     { permission: "query-only", types: ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN"] },
     { permission: "read-write", types: ["INSERT", "UPDATE"] },
-    { permission: "data-admin", types: ["DELETE"] }
+    { permission: "data-admin", types: ["DELETE", "REPLACE"] }
   ];
 });
 
@@ -19310,7 +19770,7 @@ var init_mongodb = __esm(() => {
 });
 // src/core/saved-queries/strategies/index.ts
 function engineFamily(engine) {
-  if (engine === "postgres" || engine === "mysql")
+  if (engine === "postgres" || engine === "mysql" || engine === "sqlite")
     return "sql";
   if (engine === "elasticsearch")
     return "es";
@@ -19469,7 +19929,7 @@ function parseScalar(s) {
 
 // src/core/saved-queries/parser.ts
 function familyOf(engine) {
-  if (engine === "postgres" || engine === "mysql")
+  if (engine === "postgres" || engine === "mysql" || engine === "sqlite")
     return "sql";
   if (engine === "elasticsearch")
     return "es";
@@ -19795,13 +20255,14 @@ var init_parser = __esm(() => {
   init_types4();
   MAX_BYTES = 64 * 1024;
   VALID_TYPES = ["int", "string", "float", "bool", "date", "datetime"];
-  VALID_ENGINES = ["postgres", "mysql", "elasticsearch", "redis", "mongodb"];
+  VALID_ENGINES = ENGINE_TAGS;
   INTENT_RE = /^[a-z][a-z0-9.-]*$/;
   ENGINE_DIALECT = {
     postgres: "postgresql",
     postgresql: "postgresql",
     mysql: "mysql",
-    mariadb: "mariadb"
+    mariadb: "mariadb",
+    sqlite: "sqlite"
   };
 });
 
@@ -20044,7 +20505,8 @@ var init_read_only = __esm(() => {
   DIALECT = {
     postgresql: "Postgresql",
     mysql: "MySQL",
-    mariadb: "MariaDB"
+    mariadb: "MariaDB",
+    sqlite: "Sqlite"
   };
   WRITE_STATEMENT_TYPES = new Set([
     "insert",
@@ -20390,7 +20852,8 @@ var init_query_draft = __esm(() => {
   DIALECT2 = {
     postgresql: "Postgresql",
     mysql: "MySQL",
-    mariadb: "MariaDB"
+    mariadb: "MariaDB",
+    sqlite: "Sqlite"
   };
   HASH = /^[a-f0-9]{64}$/;
   IDENTIFIER = /^[a-z][a-z0-9-]*$/;
@@ -21312,6 +21775,8 @@ function mapSystemToEngine(system) {
     return "postgres";
   if (system === "mysql" || system === "mariadb")
     return "mysql";
+  if (system === "sqlite")
+    return "sqlite";
   if (system === "mongodb")
     return "mongodb";
   if (system === "elasticsearch")
@@ -22544,13 +23009,25 @@ class BlacklistValidator {
     const tables = dedupe2(tableNames);
     const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
+      return {
+        filteredRows: rows,
+        omittedColumns: [],
+        cost: NO_MASKING_COST,
+        reachesOmitted: () => false
+      };
     }
+    let rowsScanned = 0;
+    let keysScanned = 0;
+    let ruleEvaluations = 0;
+    let pathSplits = 0;
+    let nestedProbeRows = 0;
+    let nestedGlobRows = 0;
     const probeNested = blacklistedColumns.some((path2) => path2.includes("."));
     const presentColumns = new Set(columnList);
     const nestedHeads = new Set;
     const collect2 = (record4) => {
       for (const key of Object.getOwnPropertyNames(record4)) {
+        keysScanned += 1;
         presentColumns.add(key);
         if (!probeNested)
           continue;
@@ -22560,6 +23037,7 @@ class BlacklistValidator {
       }
     };
     for (const row of rows) {
+      rowsScanned += 1;
       if (row === null || typeof row !== "object")
         continue;
       if (Array.isArray(row)) {
@@ -22582,6 +23060,7 @@ class BlacklistValidator {
     }
     const omitted = new Set;
     for (const path2 of blacklistedColumns) {
+      ruleEvaluations += 1;
       const present = presentByFolded.get(foldFieldPath(path2));
       if (present !== undefined) {
         for (const name of present)
@@ -22593,8 +23072,17 @@ class BlacklistValidator {
         continue;
       if (!nestedHeads.has(foldFieldPath(path2.slice(0, dot))))
         continue;
+      pathSplits += 1;
       const segments = path2.split(".").map(foldFieldPath);
-      if (rows.some((row) => hasFieldPath(row, segments, PRE_FOLDED)))
+      let found = false;
+      for (const row of rows) {
+        nestedProbeRows += 1;
+        if (hasFieldPath(row, segments, PRE_FOLDED)) {
+          found = true;
+          break;
+        }
+      }
+      if (found)
         omitted.add(path2);
     }
     const nestedGlobs = globRules.filter((pattern) => pattern.segments.length > 1);
@@ -22605,6 +23093,7 @@ class BlacklistValidator {
       for (const row of rows) {
         if (pending.size === 0)
           break;
+        nestedGlobRows += 1;
         if (row === null || typeof row !== "object")
           continue;
         collectNestedMatches(row, states, pending, (pattern) => {
@@ -22642,13 +23131,35 @@ class BlacklistValidator {
     }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
+      return {
+        filteredRows: rows,
+        omittedColumns: [],
+        cost: Object.freeze({
+          rowsScanned,
+          keysScanned,
+          ruleEvaluations,
+          pathSplits,
+          nestedProbeRows,
+          nestedGlobRows,
+          nestedGlobMatches: matchedNested.length
+        }),
+        reachesOmitted: () => false
+      };
     }
     const removalPaths = matchedNested.length === 0 ? omittedColumns : omittedColumns.filter((path2) => !matchedNested.some((p) => p.raw === path2));
     const filteredRows = omitFieldPaths(rows, removalPaths, matchedNested.length > 0 ? { ...FOLD_CASE2, patterns: matchedNested } : FOLD_CASE2);
     return {
       filteredRows,
       omittedColumns,
+      cost: Object.freeze({
+        rowsScanned,
+        keysScanned,
+        ruleEvaluations,
+        pathSplits,
+        nestedProbeRows,
+        nestedGlobRows,
+        nestedGlobMatches: matchedNested.length
+      }),
       reachesOmitted: (path2) => {
         if (omittedByName(removalPaths, path2))
           return true;
@@ -22676,7 +23187,7 @@ class BlacklistValidator {
     });
   }
 }
-var FOLD_CASE2, PRE_FOLDED;
+var FOLD_CASE2, PRE_FOLDED, NO_MASKING_COST;
 var init_blacklist_validator = __esm(() => {
   init_glob();
   init_blacklist();
@@ -22687,6 +23198,15 @@ var init_blacklist_validator = __esm(() => {
   init_es_index_target();
   FOLD_CASE2 = { caseInsensitive: true };
   PRE_FOLDED = { caseInsensitive: true, alreadyFolded: true };
+  NO_MASKING_COST = Object.freeze({
+    rowsScanned: 0,
+    keysScanned: 0,
+    ruleEvaluations: 0,
+    pathSplits: 0,
+    nestedProbeRows: 0,
+    nestedGlobRows: 0,
+    nestedGlobMatches: 0
+  });
 });
 
 // src/core/health-checker.ts
@@ -22839,7 +23359,7 @@ var init_core = __esm(() => {
 // src/core/audit/lock.ts
 import { hostname } from "os";
 import { dirname as dirname7 } from "path";
-import { mkdir as mkdir10, open as open2, rm } from "fs/promises";
+import { mkdir as mkdir11, open as open2, rm } from "fs/promises";
 
 class AuditLockManager {
   auditFilePath;
@@ -22897,7 +23417,7 @@ class AuditLockManager {
   }
   async tryAcquireLock(operationName) {
     try {
-      await mkdir10(dirname7(this.lockPath), { recursive: true });
+      await mkdir11(dirname7(this.lockPath), { recursive: true });
       const lockFile = Bun.file(this.lockPath);
       if (await lockFile.exists()) {
         const lockContent = await lockFile.json();
@@ -22950,7 +23470,7 @@ var init_rotation = __esm(() => {
 });
 
 // src/core/audit/logger.ts
-import { appendFile, mkdir as mkdir11, readFile as readFile4, stat as stat2 } from "fs/promises";
+import { appendFile, mkdir as mkdir12, readFile as readFile4, stat as stat2 } from "fs/promises";
 import { join as join21 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 
@@ -22999,7 +23519,7 @@ class AuditLogger {
     try {
       const sessionId = await this.sessionIdService.resolve();
       this.cachedSessionId = sessionId;
-      await mkdir11(this.auditDir, { recursive: true });
+      await mkdir12(this.auditDir, { recursive: true });
       if (!this.writerInitialized) {
         await this.syncCountersFromDisk();
         this.writerInitialized = true;
@@ -23104,7 +23624,7 @@ var init_logger2 = __esm(() => {
 });
 
 // src/core/audit/session-id.ts
-import { mkdir as mkdir12, readFile as readFile5, rename as rename5, stat as stat3, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile5, rename as rename5, stat as stat3, writeFile as writeFile5 } from "fs/promises";
 import { randomBytes as randomBytes2 } from "crypto";
 import { dirname as dirname8, join as join22 } from "path";
 function generateSessionId(pid, nowMs) {
@@ -23137,7 +23657,7 @@ async function writeSessionIdFile(storagePath, payload) {
   const target = join22(storagePath, LAST_SESSION_ID_RELATIVE);
   const tmp = `${target}.tmp`;
   try {
-    await mkdir12(dirname8(target), { recursive: true });
+    await mkdir13(dirname8(target), { recursive: true });
     await writeFile5(tmp, JSON.stringify(payload, null, 2), "utf8");
     await rename5(tmp, target);
   } catch {}
@@ -23258,6 +23778,18 @@ function tokenize2(sql, dialect, backslashEscapes) {
       }
       continue;
     }
+    if (dialect === "sqlite" && char === "[") {
+      i++;
+      let value = "";
+      while (i < sql.length && sql[i] !== "]") {
+        value += sql[i];
+        i++;
+      }
+      if (i < sql.length)
+        i++;
+      tokens.push({ kind: "identifier", value, quoted: true });
+      continue;
+    }
     if (char === '"' || char === "`") {
       const quote = char;
       i++;
@@ -24808,7 +25340,7 @@ var init_render_markdown = __esm(() => {
 });
 
 // src/core/recovery/last-envelope.ts
-import { writeFile as writeFile6, readFile as readFile6, rename as rename6, mkdir as mkdir13, stat as stat4 } from "fs/promises";
+import { writeFile as writeFile6, readFile as readFile6, rename as rename6, mkdir as mkdir14, stat as stat4 } from "fs/promises";
 import { dirname as dirname9, join as join23 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 function sanitizeCommandSummary(argv) {
@@ -24827,7 +25359,7 @@ async function writeLastEnvelope(cwd, envelope, argv, now = () => new Date, id =
     envelope
   };
   try {
-    await mkdir13(dirname9(target), { recursive: true });
+    await mkdir14(dirname9(target), { recursive: true });
     await writeFile6(tmp, JSON.stringify(payload, null, 2), "utf8");
     await rename6(tmp, target);
   } catch {}
@@ -27770,7 +28302,8 @@ var init_write_gate = __esm(() => {
   PARSER_DIALECTS = {
     mysql: "MySQL",
     mariadb: "MariaDB",
-    postgresql: "Postgresql"
+    postgresql: "Postgresql",
+    sqlite: "Sqlite"
   };
   WRITE_TYPES = new Set([
     "INSERT",
@@ -28080,12 +28613,6 @@ function mongoCollectionRefs(query) {
     return [];
   }
 }
-function requireSqlConnection2(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
 async function queryCommand(sql, options, command) {
   return executeQueryCommand(sql, options, command);
 }
@@ -28437,7 +28964,7 @@ function queryAuditTarget(system, query, options) {
 async function sqlQueryBranch(query, options, context, fieldSelection) {
   const { config } = context;
   const effectivePermission = context.effectivePermission ?? config.permission;
-  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection2(config.connection));
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
   let executionError;
   try {
     await adapter.connect();
@@ -28704,6 +29231,7 @@ var init_query = __esm(() => {
   init_query_fanout();
   init_elasticsearch2();
   init_slow_query_advisory();
+  init_require_sql_connection();
   ALLOWED_FORMATS3 = ["table", "json", "csv"];
   defaultQueryCommandRuntime = {
     loadConfig: (configPath, connectionName) => configModule.read(configPath, connectionName, { loadLayeredSchema: false }),
@@ -29856,7 +30384,7 @@ class DataExecutor {
     return this.dbSystem;
   }
   getQuoteChar() {
-    return this.dbSystem === "mysql" ? "`" : '"';
+    return this.dbSystem === "mysql" || this.dbSystem === "mariadb" ? "`" : '"';
   }
   checkBlacklist(operation, tableName2) {
     this.blacklistValidator?.checkTableBlacklist(operation, tableName2, []);
@@ -30846,12 +31374,6 @@ __export(exports_insert, {
   insertCommand: () => insertCommand
 });
 import crypto5 from "crypto";
-function requireSqlConnection3(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
 async function readStdinJSON() {
   try {
     if (typeof Bun !== "undefined" && Bun.stdin) {
@@ -31033,11 +31555,11 @@ async function insertCommand(table, options, command) {
         await adapter2.disconnect();
       }
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection3(config.connection));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
     await adapter.connect();
     try {
       const schema = await adapter.getTableSchema(table);
-      const dbSystem = config.connection.system === "postgresql" ? "postgresql" : "mysql";
+      const dbSystem = config.connection.system;
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
@@ -31114,6 +31636,7 @@ var init_insert = __esm(() => {
   init_dml_plan();
   init_dml_plan4();
   init_integration_helper();
+  init_require_sql_connection();
 });
 
 // src/commands/update.ts
@@ -31122,12 +31645,6 @@ __export(exports_update, {
   updateCommand: () => updateCommand
 });
 import crypto6 from "crypto";
-function requireSqlConnection4(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
 async function updateCommand(table, options, command) {
   let config;
   try {
@@ -31341,7 +31858,7 @@ async function updateCommand(table, options, command) {
     } catch (error) {
       throw new Error(`WHERE clause parsing failed: ${error.message}`);
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection4(config.connection));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
     await adapter.connect();
     try {
       const schema = await adapter.getTableSchema(table);
@@ -31359,7 +31876,7 @@ async function updateCommand(table, options, command) {
         await writeAuditEntry(config, "update", options, auditOutcomeForMutation(cancelled, table));
         return;
       }
-      const dbSystem = config.connection.system === "postgresql" ? "postgresql" : "mysql";
+      const dbSystem = config.connection.system;
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
@@ -31440,6 +31957,7 @@ var init_update = __esm(() => {
   init_config_path();
   init_dml_plan4();
   init_integration_helper();
+  init_require_sql_connection();
 });
 
 // src/commands/delete.ts
@@ -31448,12 +31966,6 @@ __export(exports_delete, {
   deleteCommand: () => deleteCommand
 });
 import crypto7 from "crypto";
-function requireSqlConnection5(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
 async function deleteCommand(table, options, command) {
   let config;
   try {
@@ -31641,7 +32153,7 @@ async function deleteCommand(table, options, command) {
     } catch (error) {
       throw new Error(`WHERE clause parsing failed: ${error.message}`);
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection5(config.connection));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
     await adapter.connect();
     try {
       const schema = await adapter.getTableSchema(table);
@@ -31659,7 +32171,7 @@ async function deleteCommand(table, options, command) {
         await writeAuditEntry(config, "delete", options, auditOutcomeForMutation(cancelled, table));
         return;
       }
-      const dbSystem = config.connection.system === "postgresql" ? "postgresql" : "mysql";
+      const dbSystem = config.connection.system;
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       const executor3 = new DataExecutor(adapter, config.permission, dbSystem, blacklistValidator);
@@ -31740,6 +32252,7 @@ var init_delete = __esm(() => {
   init_config_path();
   init_dml_plan4();
   init_integration_helper();
+  init_require_sql_connection();
 });
 
 // src/adapters/elasticsearch/scroll-reader.ts
@@ -31782,12 +32295,6 @@ __export(exports_export, {
   buildEsExportRows: () => buildEsExportRows
 });
 import crypto8 from "crypto";
-function requireSqlConnection6(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
 async function exportCommand(sql, options, command) {
   let config;
   try {
@@ -31818,7 +32325,7 @@ async function exportCommand(sql, options, command) {
     if (options.format === "jsonl") {
       throw new Error("--format jsonl is only supported on MongoDB connections");
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection6(config.connection));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
     await adapter.connect();
     const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
     const executor3 = new QueryExecutor(adapter, config.permission, blacklistValidator, config, {
@@ -32178,6 +32685,7 @@ var init_export = __esm(() => {
   init_field_masker();
   init_scroll_reader();
   init_collection_references();
+  init_require_sql_connection();
   SQL_PATTERN = /^\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER|SHOW|DESCRIBE)\b/i;
 });
 
@@ -33516,8 +34024,8 @@ async function ensureDir(dirPath) {
     await $`mkdir -p ${dirPath}`.quiet();
   } catch {
     try {
-      const { mkdir: mkdir14 } = await import("fs/promises");
-      await mkdir14(dirPath, { recursive: true });
+      const { mkdir: mkdir15 } = await import("fs/promises");
+      await mkdir15(dirPath, { recursive: true });
     } catch {
       throw new Error(`Cannot create directory: ${dirPath}`);
     }
@@ -35355,7 +35863,7 @@ var exports_check = {};
 __export(exports_check, {
   checkCommand: () => checkCommand
 });
-function requireSqlConnection7(connection) {
+function requireSqlConnection2(connection) {
   if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
     throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
   }
@@ -35367,7 +35875,7 @@ async function checkAction(table, options) {
   if (!config.connection) {
     throw new Error("Database not configured. Run: dbcli init");
   }
-  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection7(config.connection));
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection2(config.connection));
   await adapter.connect();
   try {
     const checker = new HealthChecker(adapter);
@@ -37197,7 +37705,8 @@ var init_ddl = __esm(() => {
   DIALECT3 = {
     mysql: "MySQL",
     mariadb: "MariaDB",
-    postgresql: "Postgresql"
+    postgresql: "Postgresql",
+    sqlite: "Sqlite"
   };
 });
 
@@ -37900,7 +38409,7 @@ __export(exports_diff, {
   ORM_ALIASES: () => ORM_ALIASES
 });
 import crypto9 from "crypto";
-function requireSqlConnection8(connection) {
+function requireSqlConnection3(connection) {
   if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
     throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
   }
@@ -38067,7 +38576,7 @@ async function diffAction(options) {
       console.error("Elasticsearch \u4E0D\u652F\u63F4 diff \u6307\u4EE4\uFF1B\u5982\u9700\u8FFD\u8E64 mapping \u8B8A\u5316\uFF0C\u8ACB\u6539\u7528 schema \u4E26\u81EA\u884C\u7248\u672C\u5316 mapping JSON");
       process.exit(1);
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection8(config.connection));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection3(config.connection));
     await adapter.connect();
     try {
       const tables = await adapter.listTables();
@@ -38193,9 +38702,11 @@ var init_status2 = __esm(() => {
       const blacklistTables = config.blacklist?.tables ?? [];
       const blacklistColumns = config.blacklist?.columns ?? {};
       const columnCount = Object.values(blacklistColumns).reduce((sum, cols) => sum + cols.length, 0);
+      const file = config.connection.file;
       const status2 = {
         permission: config.permission,
         system: config.connection.system,
+        ...file !== undefined && { file },
         blacklist: {
           tables: blacklistTables.length,
           columns: columnCount
@@ -38205,6 +38716,8 @@ var init_status2 = __esm(() => {
       if (options.format === "text") {
         console.log(`Permission: ${status2.permission}`);
         console.log(`System:     ${status2.system}`);
+        if (file !== undefined)
+          console.log(`File:       ${file}`);
         console.log(`Blacklist:  ${status2.blacklist.tables} table(s), ${status2.blacklist.columns} column(s)`);
         console.log(`Version:    ${status2.version}`);
       } else {
@@ -39941,7 +40454,8 @@ var init_parse_sql = __esm(() => {
   DIALECT4 = {
     mysql: "MySQL",
     mariadb: "MariaDB",
-    postgresql: "Postgresql"
+    postgresql: "Postgresql",
+    sqlite: "Sqlite"
   };
 });
 
@@ -41821,18 +42335,14 @@ __export(exports_doctor, {
   resolveSchemaLastUpdated: () => resolveSchemaLastUpdated,
   renderMongoSamplingLine: () => renderMongoSamplingLine,
   doctorCommand: () => doctorCommand,
+  collectSQLiteDoctorResults: () => collectSQLiteDoctorResults,
   collectMongoDoctorResults: () => collectMongoDoctorResults,
   collectElasticsearchDoctorResults: () => collectElasticsearchDoctorResults,
   buildDoctorRemediationPlan: () => buildDoctorRemediationPlan
 });
 import { join as join37 } from "path";
 import { resolveSrv as resolveSrv2 } from "dns/promises";
-function requireSqlConnection9(connection) {
-  if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
-    throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
-  }
-  return connection;
-}
+import { access, constants } from "fs/promises";
 function renderMongoSamplingLine(meta) {
   if (!meta.sampleMethod)
     return "";
@@ -42072,6 +42582,46 @@ async function collectElasticsearchDoctorResults(config, runtimeOverrides = {})
   }
   return results;
 }
+async function collectSQLiteDoctorResults(config, runtimeOverrides = {}) {
+  const results = [];
+  const file = config.connection.file ?? "";
+  const fileResults = await runDoctorChecks.checkSQLiteFile(file, config.permission ?? "query-only");
+  results.push(...fileResults);
+  if (fileResults.some((r) => r.status === "error"))
+    return results;
+  const adapter = AdapterFactory.createSqlAdapter(config.connection);
+  try {
+    await adapter.connect();
+    results.push({
+      group: "Connection & Data",
+      label: "Connection",
+      status: "pass",
+      message: `Connected to sqlite ${file}`
+    });
+    try {
+      const tables = await adapter.listTables();
+      const tableColumns = new Map;
+      for (const t2 of tables) {
+        tableColumns.set(t2.name, t2.columns.map((c) => c.name));
+      }
+      if (config.blacklistedColumns) {
+        results.push(runDoctorChecks.checkBlacklistCompleteness(tableColumns, config.blacklistedColumns));
+      }
+      results.push(runDoctorChecks.checkLargeTables(tables, "sqlite"));
+    } catch {}
+    results.push(runDoctorChecks.checkSchemaCacheFreshness(config.metadata?.schemaLastUpdated ?? null));
+  } catch (error) {
+    results.push({
+      group: "Connection & Data",
+      label: "Connection",
+      status: "error",
+      message: `Connection failed: ${error.message}`
+    });
+  } finally {
+    await adapter.disconnect();
+  }
+  return results;
+}
 var ALLOWED_FORMATS15, SENSITIVE_PATTERNS, runDoctorChecks, defaultDoctorCollectorRuntime, doctorCommand;
 var init_doctor = __esm(() => {
   init_esm();
@@ -42091,6 +42641,7 @@ var init_doctor = __esm(() => {
   init_runtime_info();
   init_config();
   init_integration_helper();
+  init_require_sql_connection();
   ALLOWED_FORMATS15 = ["text", "json"];
   SENSITIVE_PATTERNS = [
     "password",
@@ -42324,6 +42875,83 @@ var init_doctor = __esm(() => {
         }
       }
     },
+    async checkSQLiteFile(file, permission) {
+      const group = "Connection & Data";
+      if (!file) {
+        return [
+          {
+            group,
+            label: "Database file",
+            status: "error",
+            message: 'Connection has no file path \u2014 run "dbcli init --system sqlite"'
+          }
+        ];
+      }
+      try {
+        await access(file, constants.F_OK);
+      } catch {
+        return [
+          {
+            group,
+            label: "Database file",
+            status: "error",
+            message: `Database file not found: ${file}`,
+            details: { file }
+          }
+        ];
+      }
+      try {
+        await access(file, constants.R_OK);
+      } catch {
+        return [
+          {
+            group,
+            label: "Database file",
+            status: "error",
+            message: `Database file is not readable: ${file}`,
+            details: { file }
+          }
+        ];
+      }
+      const results = [
+        {
+          group,
+          label: "Database file",
+          status: "pass",
+          message: `Readable: ${file}`,
+          details: { file }
+        }
+      ];
+      if (permission === "query-only") {
+        results.push({
+          group,
+          label: "Database file writable",
+          status: "pass",
+          message: "Not required \u2014 the connection is query-only",
+          details: { file, permission }
+        });
+        return results;
+      }
+      try {
+        await access(file, constants.W_OK);
+        results.push({
+          group,
+          label: "Database file writable",
+          status: "pass",
+          message: `Writable: ${file}`,
+          details: { file, permission }
+        });
+      } catch {
+        results.push({
+          group,
+          label: "Database file writable",
+          status: "error",
+          message: `Database file is not writable, but permission '${permission}' allows writes: ${file}`,
+          details: { file, permission }
+        });
+      }
+      return results;
+    },
     checkLargeTables(tables, system = "postgresql") {
       const large = tables.filter((t2) => (t2.estimatedRowCount ?? 0) > 1e6);
       if (large.length === 0) {
@@ -42470,13 +43098,18 @@ var init_doctor = __esm(() => {
               ...config,
               blacklistedColumns
             }));
+          } else if (config.connection.system === "sqlite") {
+            results.push(...await collectSQLiteDoctorResults({
+              ...config,
+              blacklistedColumns
+            }));
           } else if (config.connection.system === "elasticsearch") {
             results.push(...await collectElasticsearchDoctorResults({
               ...config,
               blacklistedColumns
             }));
           } else {
-            const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection9(config.connection));
+            const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection(config.connection));
             await adapter.connect();
             results.push({
               group: "Connection & Data",
@@ -42792,7 +43425,7 @@ var exports_queries_rename = {};
 __export(exports_queries_rename, {
   queriesRename: () => queriesRename
 });
-import { rename as rename7, mkdir as mkdir14 } from "fs/promises";
+import { rename as rename7, mkdir as mkdir15 } from "fs/promises";
 import { dirname as dirname12 } from "path";
 async function queriesRename(oldName, newName, options = {}) {
   if (!oldName.startsWith("@") || !newName.startsWith("@")) {
@@ -42814,7 +43447,7 @@ async function queriesRename(oldName, newName, options = {}) {
   for (const v of local) {
     const dst = snippetKeyToFile(cwd, newName, "local");
     const dstWithSuffix = preserveEngineSuffix(v.query.file, dst);
-    await mkdir14(dirname12(dstWithSuffix), { recursive: true });
+    await mkdir15(dirname12(dstWithSuffix), { recursive: true });
     await rename7(v.query.file, dstWithSuffix);
     await rewriteFrontmatterName(dstWithSuffix, newName.slice(1));
     console.log(`renamed ${v.query.file} \u2192 ${dstWithSuffix}`);
@@ -42840,7 +43473,7 @@ var exports_queries_copy = {};
 __export(exports_queries_copy, {
   queriesCopy: () => queriesCopy
 });
-import { mkdir as mkdir15, copyFile } from "fs/promises";
+import { mkdir as mkdir16, copyFile } from "fs/promises";
 import { dirname as dirname13, basename as basename5 } from "path";
 async function queriesCopy(src, dst, options = {}) {
   if (!src.startsWith("@") || !dst.startsWith("@")) {
@@ -42859,7 +43492,7 @@ async function queriesCopy(src, dst, options = {}) {
   }
   for (const v of variants) {
     const dstFile = mapEngineSuffix(v.query.file, snippetKeyToFile(cwd, dst, "local"));
-    await mkdir15(dirname13(dstFile), { recursive: true });
+    await mkdir16(dirname13(dstFile), { recursive: true });
     await copyFile(v.query.file, dstFile);
     console.log(`copied ${v.query.file} \u2192 ${dstFile}`);
   }
@@ -42877,7 +43510,7 @@ var exports_queries_import = {};
 __export(exports_queries_import, {
   queriesImport: () => queriesImport
 });
-import { stat as stat8, mkdir as mkdir16, copyFile as copyFile2 } from "fs/promises";
+import { stat as stat8, mkdir as mkdir17, copyFile as copyFile2 } from "fs/promises";
 import { basename as basename6, join as join38, extname as extname2 } from "path";
 import { confirm as confirm3 } from "@inquirer/prompts";
 async function queriesImport(filePath, options = {}) {
@@ -42891,7 +43524,7 @@ async function queriesImport(filePath, options = {}) {
   const key = "@" + baseName;
   parseSavedQuery({ key, file: filePath, source: "local", text: text4 });
   const targetDir = join38(cwd, ".dbcli/queries");
-  await mkdir16(targetDir, { recursive: true });
+  await mkdir17(targetDir, { recursive: true });
   const target = join38(targetDir, basename6(filePath));
   if (await Bun.file(target).exists()) {
     if (!options.force) {
@@ -42956,7 +43589,7 @@ __export(exports_queries, {
   queriesCheck: () => queriesCheck,
   listSnippetsForEngine: () => listSnippetsForEngine
 });
-import { mkdir as mkdir17, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir18, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname14 } from "path";
 import { spawn } from "child_process";
 async function deriveEngine(command) {
@@ -43077,7 +43710,7 @@ async function queriesNew(name, options) {
     process.exit(1);
     return;
   }
-  await mkdir17(dirname14(file), { recursive: true });
+  await mkdir18(dirname14(file), { recursive: true });
   await writeFile8(file, scaffold(name), "utf8");
   console.log(`Created ${file}`);
   if (source === "shared")
@@ -43153,7 +43786,7 @@ async function queriesSearch(keywords, options, command) {
     process.exit(2);
     return;
   }
-  const allowed = ["postgres", "mysql", "redis", "elasticsearch", "mongodb", "all"];
+  const allowed = [...ENGINE_TAGS, "all"];
   if (options.engine && !allowed.includes(options.engine)) {
     console.error(`Unknown engine '${options.engine}'. Allowed: ${allowed.join(", ")}.`);
     process.exit(2);
@@ -43245,7 +43878,7 @@ async function queriesSuggest(intent, options, command) {
     process.exit(2);
     return;
   }
-  const allowed = ["postgres", "mysql", "redis", "elasticsearch", "mongodb", "all"];
+  const allowed = [...ENGINE_TAGS, "all"];
   if (options.engine && !allowed.includes(options.engine)) {
     console.error(`Unknown engine '${options.engine}'. Allowed: ${allowed.join(", ")}.`);
     process.exit(2);
@@ -43854,7 +44487,8 @@ var init_parse = __esm(() => {
   DIALECT5 = {
     mysql: "MySQL",
     mariadb: "MariaDB",
-    postgresql: "Postgresql"
+    postgresql: "Postgresql",
+    sqlite: "Sqlite"
   };
 });
 
@@ -44986,12 +45620,14 @@ var init_not_in_nullable = __esm(() => {
       "VARIANCE",
       "VAR_POP",
       "VAR_SAMP"
-    ])
+    ]),
+    sqlite: new Set([...COMMON_NULL_ON_EMPTY_AGGREGATES, "GROUP_CONCAT", "STRING_AGG"])
   };
   NON_NULL_AGGREGATES = {
     postgresql: new Set(["COUNT", "REGR_COUNT"]),
     mysql: new Set(["COUNT", "BIT_AND", "BIT_OR", "BIT_XOR"]),
-    mariadb: new Set(["COUNT", "BIT_AND", "BIT_OR", "BIT_XOR"])
+    mariadb: new Set(["COUNT", "BIT_AND", "BIT_OR", "BIT_XOR"]),
+    sqlite: new Set(["COUNT", "TOTAL"])
   };
   notInNullableRule = {
     name: "not-in-nullable",
@@ -45854,7 +46490,7 @@ __export(exports_snapshot, {
   snapshotCommand: () => snapshotCommand
 });
 import { join as join39 } from "path";
-function requireSqlConnection10(connection) {
+function requireSqlConnection4(connection) {
   if (!SQL_SYSTEMS6.includes(connection.system)) {
     throw new Error(`snapshot currently supports SQL engines only, got: ${connection.system}`);
   }
@@ -45902,7 +46538,7 @@ var init_snapshot = __esm(() => {
         const snippets = await loadSnippets(dirs);
         sql = resolveByName(snippets, query.slice(1), engine).query.sqlBody;
       }
-      const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection10(config.connection));
+      const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection4(config.connection));
       await adapter.connect();
       try {
         const blacklistManager = new BlacklistManager(config);
@@ -46138,7 +46774,7 @@ __export(exports_assert, {
   assertCommand: () => assertCommand
 });
 import { basename as basename7 } from "path";
-function requireSqlConnection11(connection) {
+function requireSqlConnection5(connection) {
   if (!SQL_SYSTEMS7.includes(connection.system)) {
     throw new Error(`assert currently supports SQL engines only, got: ${connection.system}`);
   }
@@ -46193,7 +46829,7 @@ var init_assert = __esm(() => {
         console.error("Database not configured. Run: dbcli init");
         process.exit(1);
       }
-      const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection11(config.connection));
+      const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection5(config.connection));
       await adapter.connect();
       let auditRef = null;
       let verdict2;
@@ -47578,7 +48214,7 @@ __export(exports_verify, {
   verifyCommand: () => verifyCommand,
   BUILTIN_VERIFY_SCENARIOS: () => BUILTIN_VERIFY_SCENARIOS
 });
-function requireSqlConnection12(connection, scenario2) {
+function requireSqlConnection6(connection, scenario2) {
   if (!SQL_SYSTEMS8.includes(connection.system)) {
     throw new Error(`verify ${scenario2} currently supports SQL engines only, got: ${connection.system}`);
   }
@@ -48264,7 +48900,7 @@ async function executeScenario(def, options, command) {
       console.error("Database not configured. Run: dbcli init");
       process.exit(1);
     }
-    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection12(config.connection, def.name));
+    const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection6(config.connection, def.name));
     await adapter.connect();
     const runners = def.createRunners({ adapter, config, options, targetTable: input.table }, input);
     if (!input.afterWrite) {
@@ -50139,7 +50775,7 @@ __export(exports_shell, {
 import { createInterface as createInterface2 } from "readline";
 import { join as join40 } from "path";
 import { homedir as homedir3 } from "os";
-function requireSqlConnection13(connection) {
+function requireSqlConnection7(connection) {
   if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
     throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
   }
@@ -50184,7 +50820,7 @@ async function runShell(options, configPath) {
   const connectionOpts = config.connection;
   const mongoInner = isMongoDB ? AdapterFactory.createMongoDBAdapter(config) : null;
   const redisInner = isRedis ? AdapterFactory.createRedisAdapter(config) : null;
-  const adapter = isMongoDB ? new MongoShellAdapter(mongoInner) : isRedis ? new RedisShellAdapter(redisInner) : AdapterFactory.createSqlAdapter(requireSqlConnection13(connectionOpts));
+  const adapter = isMongoDB ? new MongoShellAdapter(mongoInner) : isRedis ? new RedisShellAdapter(redisInner) : AdapterFactory.createSqlAdapter(requireSqlConnection7(connectionOpts));
   try {
     await adapter.connect();
   } catch (error) {
@@ -50999,7 +51635,7 @@ __export(exports_migrate, {
   runDDL: () => runDDL,
   migrateCommand: () => migrateCommand
 });
-function requireSqlConnection14(connection) {
+function requireSqlConnection8(connection) {
   if (!["postgresql", "mysql", "mariadb"].includes(connection.system)) {
     throw new Error(`This command requires a SQL connection, got: ${connection.system}`);
   }
@@ -51023,7 +51659,7 @@ async function runDDL(operation, opts, command) {
     console.error("\u6B64\u547D\u4EE4\u76EE\u524D\u4E0D\u652F\u63F4 Elasticsearch\uFF1B\u5982\u9700\u5EFA\u7ACB\u7D22\u5F15\u6216\u8ABF\u6574 mapping\uFF0C\u8ACB\u6539\u7528\u5916\u90E8\u5DE5\u5177");
     process.exit(1);
   }
-  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection14(config.connection));
+  const adapter = AdapterFactory.createSqlAdapter(requireSqlConnection8(config.connection));
   const isDryRun = !opts.execute;
   if (!isDryRun) {
     await adapter.connect();
@@ -51265,17 +51901,23 @@ async function switchDefault(configPath, name, config, options = {}) {
 function listConnectionsForDisplay(config) {
   return Object.entries(config.connections).map(([name, conn]) => {
     const marker = name === config.default ? "*" : " ";
+    const environmentLabel = conn.environment ? ` [${conn.environment}]` : "";
+    const file = conn.file;
+    if (file !== undefined) {
+      const rendered = typeof file === "object" ? `\${${file.$env}}` : file;
+      return `${marker} ${name.padEnd(12)}${environmentLabel} ${conn.system.padEnd(12)} ${rendered}`;
+    }
     const host = typeof conn.host === "object" ? `\${${conn.host.$env}}` : conn.host;
     const port = typeof conn.port === "object" ? `\${${conn.port.$env}}` : conn.port;
     const db = typeof conn.database === "object" ? `\${${conn.database.$env}}` : conn.database;
-    const environment = conn.environment ? ` [${conn.environment}]` : "";
-    return `${marker} ${name.padEnd(12)}${environment} ${conn.system.padEnd(12)} ${host}:${port}/${db}`;
+    return `${marker} ${name.padEnd(12)}${environmentLabel} ${conn.system.padEnd(12)} ${host}:${port}/${db}`;
   });
 }
 function listConnectionIdentities(config) {
   return Object.entries(config.connections).map(([name, conn]) => {
     const host = typeof conn.host === "string" && conn.host.length > 0 ? conn.host : null;
     const database = typeof conn.database === "string" && conn.database.length > 0 ? conn.database : null;
+    const file = conn.file;
     return {
       name,
       environment: conn.environment ?? null,
@@ -51286,6 +51928,7 @@ function listConnectionIdentities(config) {
         port: host !== null && typeof conn.port === "number" ? conn.port : null
       },
       database,
+      ...typeof file === "string" && { file },
       isDefault: name === config.default
     };
   });
@@ -51386,7 +52029,7 @@ var init_config_v2_mutations = __esm(() => {
 });
 
 // src/core/env-file-writer.ts
-import { chmod as chmod2, mkdir as mkdir18, readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
+import { chmod as chmod2, mkdir as mkdir19, readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
 import { dirname as dirname16 } from "path";
 function escapeForRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -51399,7 +52042,7 @@ async function upsertEnvVar(envPath, varName, value) {
     const code = cause.code;
     if (code !== "ENOENT")
       throw cause;
-    await mkdir18(dirname16(envPath), { recursive: true });
+    await mkdir19(dirname16(envPath), { recursive: true });
   }
   const line = `${varName}="${value}"`;
   const existing = new RegExp(`^${escapeForRegExp(varName)}=.*$`, "m");
@@ -51704,7 +52347,7 @@ var init_sql_metadata = __esm(() => {
 });
 
 // src/proxy/events.ts
-import { appendFile as appendFile2, mkdir as mkdir19, readFile as readFile10, stat as stat9 } from "fs/promises";
+import { appendFile as appendFile2, mkdir as mkdir20, readFile as readFile10, stat as stat9 } from "fs/promises";
 import { dirname as dirname17 } from "path";
 function hasSql(e) {
   return e.type === "query_observed" || e.type === "query_completed" || e.type === "query_errored";
@@ -51744,7 +52387,7 @@ class EventWriter {
   }
   async writeInternal(event) {
     if (!this.dirEnsured) {
-      await mkdir19(dirname17(this.path), { recursive: true });
+      await mkdir20(dirname17(this.path), { recursive: true });
       this.dirEnsured = true;
     }
     if (!this.initialized) {
@@ -54156,7 +54799,7 @@ __export(exports_backfill, {
   backfillCommand: () => backfillCommand
 });
 import { dirname as dirname18, resolve as resolve12 } from "path";
-import { mkdir as mkdir20 } from "fs/promises";
+import { mkdir as mkdir21 } from "fs/promises";
 function identityFor(config, name) {
   const connection = config.connections[name];
   if (!connection) {
@@ -54206,7 +54849,7 @@ var init_backfill = __esm(() => {
       return;
     }
     const out = resolve12(options.out ?? `.dbcli/backfills/${artifact2.source.sha256.slice(0, 12)}.json`);
-    await mkdir20(dirname18(out), { recursive: true });
+    await mkdir21(dirname18(out), { recursive: true });
     await Bun.write(out, JSON.stringify(artifact2, null, 2) + `
 `);
     console.log(JSON.stringify({ path: out, artifact: artifact2 }, null, 2));
@@ -54349,7 +54992,7 @@ var init_legacy2 = __esm(() => {
 
 // src/core/evidence-pack/index.ts
 import { createHash as createHash10, randomUUID as randomUUID6 } from "crypto";
-import { link as link3, lstat as lstat7, mkdir as mkdir21, realpath as realpath4, unlink as unlink8, writeFile as writeFile10 } from "fs/promises";
+import { link as link3, lstat as lstat7, mkdir as mkdir22, realpath as realpath4, unlink as unlink8, writeFile as writeFile10 } from "fs/promises";
 import { basename as basename9, dirname as dirname19, relative as relative6, resolve as resolve13, sep as sep8 } from "path";
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -54633,7 +55276,7 @@ async function writeEvidencePack(workspaceRoot, outputPath, pack) {
   if (!isInside(workspace, existingAncestor2) && existingAncestor2 !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
   }
-  await mkdir21(parent, { recursive: true });
+  await mkdir22(parent, { recursive: true });
   const realParent = await realpath4(parent);
   if (!isInside(workspace, realParent) && realParent !== workspace) {
     throw new EvidencePackValidationError("output path resolves outside the workspace");
@@ -55278,9 +55921,9 @@ function assessImpact(input) {
         ...nodes.map((node) => node.reference),
         ...contractResult.metrics.map((metric) => `metric:${metric.name}`)
       ]);
-      const access = dataAccessFindings(change, references, input.dataAccess.value, input.blockedIdentifiers);
-      findings.push(...access.findings);
-      if (access.redacted)
+      const access2 = dataAccessFindings(change, references, input.dataAccess.value, input.blockedIdentifiers);
+      findings.push(...access2.findings);
+      if (access2.redacted)
         addGap(gaps, "REDACTED_PROTECTED_SUBJECT");
     }
   }
@@ -56075,7 +56718,7 @@ __export(exports_impact, {
   impactCommand: () => impactCommand
 });
 import { randomUUID as randomUUID7 } from "crypto";
-import { link as link4, lstat as lstat9, mkdir as mkdir22, realpath as realpath6, unlink as unlink9, writeFile as writeFile11 } from "fs/promises";
+import { link as link4, lstat as lstat9, mkdir as mkdir23, realpath as realpath6, unlink as unlink9, writeFile as writeFile11 } from "fs/promises";
 import { basename as basename10, dirname as dirname20, relative as relative8, resolve as resolve15, sep as sep10 } from "path";
 function collectOption3(value, previous) {
   return [...previous, value];
@@ -56296,7 +56939,7 @@ async function resolveOutput(workspaceRoot, outputPath) {
   const existingAncestor2 = await realExistingAncestor2(parent);
   if (!isInside2(workspace, existingAncestor2) && existingAncestor2 !== workspace)
     throw new Error("output path must stay inside the workspace");
-  await mkdir22(parent, { recursive: true });
+  await mkdir23(parent, { recursive: true });
   const realParent = await realpath6(parent);
   if (!isInside2(workspace, realParent) && realParent !== workspace)
     throw new Error("output path must stay inside the workspace");
@@ -57166,7 +57809,7 @@ __export(exports_completion, {
 });
 import { join as join46 } from "path";
 import { homedir as homedir4 } from "os";
-import { mkdir as mkdir23 } from "fs/promises";
+import { mkdir as mkdir24 } from "fs/promises";
 function resolveHome() {
   return process.env.HOME ?? homedir4();
 }
@@ -57439,7 +58082,7 @@ async function installCompletion(shell, script) {
   const targetPath = getInstallPath2(shell);
   if (shell === "fish") {
     const dir = join46(resolveHome(), ".config", "fish", "completions");
-    await mkdir23(dir, { recursive: true });
+    await mkdir24(dir, { recursive: true });
     await Bun.file(targetPath).write(script);
     console.log(colors.success(`\u2713 Fish completion installed to ${targetPath}`));
     return;