@mistriwork/mistri 1.0.0-rc.12 → 1.0.0-rc.13

package/dist/ui/testing.js

@@ -29,7 +29,7 @@ var say = defineMessages({
 * would have asked for; the query is the server's to judge, so the rows a
 * fixture gives are the rows it answered.
 */
-registerPageBlocks(() => import("./shared-C-J32eBn.js").then((n) => n.t));
+registerPageBlocks(() => import("./shared-CL3RLKDA.js").then((n) => n.t));
 /** Typed fixture rows — `fixtures<Rows>({ pay_run: [{ id: 1, title: 'Aug 1–15', … }] })` — and, by `resource.column`, the display rules the App would dress them with. */
 function fixtures(tables, options = {}) {
 	return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mistriwork/mistri",
-  "version": "1.0.0-rc.12",
+  "version": "1.0.0-rc.13",
   "description": "The App framework: a few lines of TypeScript, a complete App, served from your own database.",
   "homepage": "https://mistriwork.dev",
   "bugs": {
@@ -105,9 +105,9 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@mistriwork/engine": "1.0.0-rc.12",
-    "@mistriwork/kit": "1.0.0-rc.12",
-    "@mistriwork/ui": "1.0.0-rc.12",
+    "@mistriwork/engine": "1.0.0-rc.13",
+    "@mistriwork/kit": "1.0.0-rc.13",
+    "@mistriwork/ui": "1.0.0-rc.13",
     "intl-messageformat": "12.1.2",
     "marked": "^18.1.0",
     "sanitize-html": "^2.18.0",

package/dist/docs/cli-browser.md

@@ -1,232 +0,0 @@
----
-title: "Command line: database browser"
-description: "Every tablewalk command and flag, the database browser's, laid out from the help text the command prints: what each does, and where its section is."
----
-
-<!-- Generated by scripts/cli-reference.mjs from USAGE in packages/tablewalk/src/server/cli/usage.ts. Do not edit by hand. -->
-
-Every tablewalk command and flag — the database browser's — laid out from the help text the command
-prints: what each does, and where its section is. `npx tablewalk --help all`
-prints the same text, `npx tablewalk --help` the commands and common options
-on one screen, and `npx tablewalk <command> --help` one command's.
-An App is the App framework's: [its command line](/docs/cli/).
-
-The first line of the help says it: *tablewalk — browse a relational database as a graph you walk.*
-
-## Commands
-
-| Command | What it does |
-| --- | --- |
-| `tablewalk` | start with nothing; the page asks for a connection |
-| `tablewalk <sqlite-file>` | Open it in the database browser. |
-| `tablewalk postgres://user:pass@host/db` | Open it in the database browser. |
-| `tablewalk --db postgres://… --schema public --port 4111` | Open it in the database browser. |
-| `tablewalk --demo` | a throwaway sample database, opened |
-| `tablewalk <db> --mcp` | the database's tools for a coding agent, on stdio |
-| `tablewalk <db> --export md` | the schema in words; mermaid or json too |
-| `tablewalk migrate <command>` | change the schema with versioned SQL files (see below) |
-| `tablewalk seed [<db>]` | believable rows in a writable database (see below) |
-
-## Options
-
-The server's flags: where the data is, and how it is served.
-
-| Flag | What it does |
-| --- | --- |
-| `-d, --db <target>` | SQLite file path, or a postgres:// URL (or set DATABASE_URL, used when no config names connections) |
-| `-p, --port <n>` | Port to listen on (default 4111) |
-| `--host <addr>` | Interface to bind (default 127.0.0.1, loopback only) |
-| `--allowed-host <name>` | Also answer for this Host header; repeatable. Needed behind a proxy or in a container reached by name. Or set TABLEWALK_ALLOWED_HOSTS=a.example,b.example |
-| `--trust-proxy <address|CIDR>` | A proxy whose X-Forwarded-For the rate limit may believe: 172.17.0.1 or a range like fd00::/8. Repeatable or comma-separated; loopback is always trusted. Client address only: it never lets a proxy set --auth-proxy-header (that is --auth-proxy-from). Or set TABLEWALK_TRUST_PROXY=172.17.0.1 |
-| `--trust-proxy-hops <n>` | Behind a managed front end with no address to name (Cloud Run, a cloud load balancer): how many proxies append to X-Forwarded-For. The client is the address n places from the right; anything the visitor wrote left of it is ignored. Rate limiting only. Or set TABLEWALK_TRUST_PROXY_HOPS=1 |
-| `--trust-proxy-cloudflare` | Read CF-Connecting-IP as the client. Only when the server is reachable through Cloudflare alone (a tunnel or its address ranges): anyone else can write the header. Not with --trust-proxy-hops. Or set TABLEWALK_TRUST_PROXY_CLOUDFLARE=1 |
-| `--auth-proxy-header <name>` | Behind a proxy that signs people in: the header it sets with the user (X-Forwarded-User). Requests from beyond loopback must carry it; it is believed only from loopback and --auth-proxy-from peers. Every write is journaled with it. Or set TABLEWALK_AUTH_PROXY_HEADER. |
-| `--auth-proxy-from <address|CIDR>` | A peer, beside loopback, whose --auth-proxy-header value is believed: the proxy's own address (10.0.0.7). Same syntax as --trust-proxy, but a separate list; a range lets every peer in it name the signed-in user. Or set TABLEWALK_AUTH_PROXY_FROM=10.0.0.7 |
-| `--schema <name>` | Postgres only; repeatable. Defaults to all user schemas. |
-| `--read-pool <n>` | PostgreSQL connections that may read at once, per database (default 4, at most 64). A connection's "pool": { "read": n } in tablewalk.json wins. Or set TABLEWALK_READ_POOL. |
-| `--lock-timeout <s>` | Seconds a write waits for a row or table another transaction holds before it is refused (default 5, 0.1 to 30). Or set TABLEWALK_LOCK_TIMEOUT. |
-| `--pooler <mode>` | session (the default): PostgreSQL is reached directly, or through a pooler that keeps a client on one server connection. transaction: through PgBouncer in transaction mode or RDS Proxy; the read-only guard and the statement cap are then set per transaction. Or set TABLEWALK_POOLER. |
-| `--drain-delay <s>` | Seconds /readyz answers 503 before the listener closes on SIGTERM, so a balancer that probes takes this instance out first (default 0, up to 120). Or set TABLEWALK_DRAIN_DELAY. |
-| `--shutdown-grace <s>` | Seconds a response still unfinished after the drain may keep the process before it is cut (default 10, 1 to 300). Hold the drain and this inside the platform's stop timeout. Or set TABLEWALK_SHUTDOWN_GRACE. |
-| `--config <path>` | Read connections from this file; the paths in it are relative to its folder. A file that lists Apps is mistri's to serve, and is refused here. |
-| `--no-config` | Ignore any config file |
-| `--base-path <path>` | The path a reverse proxy serves this server under, like /tools: every address, asset, API call, cookie and link carries it. Or "basePath" in the config, or set TABLEWALK_BASE_PATH. |
-| `--openapi <spec.json|url>` | Serve the API a spec describes, with no config: the description is drafted in memory and the base URL is the spec's server. Plain http only to this machine. |
-| `--api-url <url>` | With --openapi: the API's base URL, when the spec's servers do not give a usable one. |
-| `--api-token-env <name>` | With --openapi: send $name as a bearer token. |
-| `--demo` | Build a throwaway sample database and open it. Nothing of yours is touched; it lives in the temp directory. |
-| `--open` | Open a browser once the server is up |
-| `--mcp` | Speak MCP on stdio for coding agents, instead of HTTP: the database browser's tools, which serve no App |
-| `--tools <name>` | Offer one job's worth of tools instead of all of them: explore, migrate, seed, or full (the default). |
-| `--output-schema` | Advertise each tool's output shape in tools/list. Off by default: it is half the listing's size, and most agents never read it. Answers carry the same fields either way. |
-| `--export <fmt>` | Print the schema as md, mermaid or json, then exit. |
-| `--lint [fmt]` | Report what the shape will cost — missing keys, unindexed references, naive timestamps — as text or json, then exit. |
-| `--fail-on <sev>` | With --lint, exit non-zero when a finding is at least this severe: high, medium or low. For CI. |
-| `--diff <conn>` | Compare the active connection's shape with this one, print the differences, then exit. Exit code 1 when they differ, the way diff(1) does. |
-| `-h, --help` | Print the short help and stop; --help all prints this |
-| `-v, --version` | Print the version and stop |
-
-## Changing the schema
-
-Versioned SQL files in Flyway's format, forward only.
-
-```text
-tablewalk migrate new <name> [--repeatable]
-tablewalk migrate status | up | validate | baseline | repair
-tablewalk migrate diff <name> | check | squash
-                [<db> | --db <target> | --config <path>]
-                [--connection <name>] [--schema <name>] [--migrations <dir>]
-                [--history-table <name>] [--dry-run] [--tool flyway]
-                [--schema-file <path>] [--dev-url <url>]
-
-V3__add_payoff_quote.sql runs once, in version order, in its own
-transaction (a failure is recorded as failed); R__views.sql runs again whenever it changes.
-up applies what is pending. status lists what is applied and pending, and
-the changes made outside migrations (drift). validate fails on a changed, missing or failed file, a pending
-one, or drift. baseline records a database that already has tables as
-version 0, touching nothing, and writes its schema beside the migrations
-(baseline.schema.json, never run). repair removes failed entries, accepts
-changed files and marks missing ones deleted.
-
-diff, check and squash read the schema you want from schema.sql beside the
-migrations (db/migrations -> db/schema.sql). diff writes the next V file
-holding what the migrations still lack to build it, for review: a rename
-comes out as a drop and an add. The first is schema.sql itself, written
-with no download. check fails (exit 2) when the migrations,
-applied to a scratch database, do not build schema.sql. squash folds the V
-files into one V1__baseline.sql, before a database worth keeping exists.
-tablewalk's own __mistri_* tables are left out. The comparison is Atlas's
-community build, pinned and checked by sha256, fetched on first use into
-.tablewalk/bin with its update check off (TABLEWALK_ATLAS names your own);
-serving never fetches it. PostgreSQL and SQLite.
-    --migrations <dir>
-                    where the files are (default: the connection's
-                    "migrations": { "dir": … } in tablewalk.json, relative
-                    to that file, else migrations/)
-    --history-table <name>
-                    the history table: Flyway's layout, named
-                    __mistri_schema_history unless this or the
-                    connection's "migrations": { "table" } says otherwise
-                    (flyway_schema_history, to take over from Flyway)
-    --connection <name>
-                    with several connections: which one
-    --dry-run       with up, baseline or repair: print what would run
-                    (the SQL, for up) and change nothing
-    --tool flyway   run the command with an installed Flyway instead (on the
-                    PATH, or TABLEWALK_FLYWAY), over the same files and history
-    --repeatable    with new: an R__ file
-    --schema-file <path>
-                    with diff, check or squash: the schema you want (default
-                    schema.sql beside the migrations directory)
-    --dev-url <url> with diff, check or squash on PostgreSQL: the server
-                    where two scratch databases are made and dropped
-                    (default: the connection's; needs CREATEDB)
-A run holds a lock — PostgreSQL: the advisory lock Flyway takes for the same
-table; SQLite: its write lock — so two deploys never migrate
-at once. Scoped to the connection's schemas, or --schema.
-Exit codes: 1 could not run, 2 files and history disagree, 3 a migration
-failed. An App's migrate (its types regenerated and checked after up, its
-stores and files) is mistri's: npx @mistriwork/mistri migrate --app <dir>.
-```
-
-## Rows to look at
-
-A draft judged on believable data, with no seed script.
-
-```text
-tablewalk seed [<db> | --db <target> | --config <path>]
-               [--connection <name>] [--rows <n>] [--seed <n>] [--append]
-
-Fills every table through its adapter, parents before children: CHECK
-vocabularies, keys, NOT NULL and unique columns hold. A status read off
-its vocabulary is spread over its states — most work open, about a third
-done, a little called off — each record with the stamps of the states it
-passed through. Dates fall across the last 90
-days, and some open work is due today or overdue. Names, emails
-(example.com) and phone numbers (555-01xx) come from a small word list.
-Writes only to a connection whose config says "writable": true.
-    --rows <n>      rows per main table (default 40); staff and lookups
-                    get fewer, lines more
-    --seed <n>      the same rows again, on the same day (default: one
-                    chosen and printed)
-    --append        add to tables that already hold rows; without it, a
-                    table with rows is refused before anything is written
-Exit codes: 1 could not run, 2 refused (read-only, or rows already there).
-An App's seed, each status the way its machine moves it, is mistri's:
-npx @mistriwork/mistri seed --app <dir>.
-```
-
-## Connections can also come from a tablewalk.json
-
-```text
-  { "connections": [ { "name": "app", "url": "postgres://localhost/app" } ] }
-
-Looked for in ./tablewalk.json, ./.tablewalk.json, then
-$XDG_CONFIG_HOME/tablewalk/connections.json.
-
-OpenTelemetry is on when the standard variables say so: set
-OTEL_EXPORTER_OTLP_ENDPOINT (and OTEL_EXPORTER_OTLP_HEADERS, OTEL_SERVICE_NAME,
-OTEL_RESOURCE_ATTRIBUTES, OTEL_TRACES_SAMPLER as your collector, Datadog or
-Dynatrace asks) and traces, metrics and logs are sent over OTLP/HTTP. Nothing
-private is in them: no bodies, row values, SQL parameters, emails or tokens.
-GET /healthz and /readyz answer an orchestrator (under --base-path, as every
-route is).
-
-Set TABLEWALK_DIAGNOSTICS=1 for best-effort HTTP JSONL diagnostics on stderr
-and generated X-Request-ID response headers. Disabled by default. These records
-omit URLs, bodies, identities, SQL and error messages; existing human CLI logs
-are separate.
-
-Browsing is read-only, held by the adapter: a read runs one statement in a
-read-only transaction. Editing is off by default, per connection: its
-"writable": true in tablewalk.json, checked by the server, not the UI.
-```
-
-## Every flag, and where it is
-
-| Flag | Said in |
-| --- | --- |
-| `--allowed-host` | [Options](#options) |
-| `--api-token-env` | [Options](#options) |
-| `--api-url` | [Options](#options) |
-| `--app` | [Changing the schema](#changing-the-schema), [Rows to look at](#rows-to-look-at) |
-| `--append` | [Rows to look at](#rows-to-look-at) |
-| `--auth-proxy-from` | [Options](#options) |
-| `--auth-proxy-header` | [Options](#options) |
-| `--base-path` | [Options](#options), [Connections can also come from a tablewalk.json](#connections-can-also-come-from-a-tablewalkjson) |
-| `--config` | [Options](#options), [Changing the schema](#changing-the-schema), [Rows to look at](#rows-to-look-at) |
-| `--connection` | [Changing the schema](#changing-the-schema), [Rows to look at](#rows-to-look-at) |
-| `--db` | [Options](#options), [Commands](#commands), [Changing the schema](#changing-the-schema), [Rows to look at](#rows-to-look-at) |
-| `--demo` | [Options](#options), [Commands](#commands) |
-| `--dev-url` | [Changing the schema](#changing-the-schema) |
-| `--diff` | [Options](#options) |
-| `--drain-delay` | [Options](#options) |
-| `--dry-run` | [Changing the schema](#changing-the-schema) |
-| `--export` | [Options](#options), [Commands](#commands) |
-| `--fail-on` | [Options](#options) |
-| `--help` | [Options](#options) |
-| `--history-table` | [Changing the schema](#changing-the-schema) |
-| `--host` | [Options](#options) |
-| `--lint` | [Options](#options) |
-| `--lock-timeout` | [Options](#options) |
-| `--mcp` | [Options](#options), [Commands](#commands) |
-| `--migrations` | [Changing the schema](#changing-the-schema) |
-| `--no-config` | [Options](#options) |
-| `--open` | [Options](#options) |
-| `--openapi` | [Options](#options) |
-| `--output-schema` | [Options](#options) |
-| `--pooler` | [Options](#options) |
-| `--port` | [Options](#options), [Commands](#commands) |
-| `--read-pool` | [Options](#options) |
-| `--repeatable` | [Changing the schema](#changing-the-schema) |
-| `--rows` | [Rows to look at](#rows-to-look-at) |
-| `--schema` | [Options](#options), [Commands](#commands), [Changing the schema](#changing-the-schema) |
-| `--schema-file` | [Changing the schema](#changing-the-schema) |
-| `--seed` | [Rows to look at](#rows-to-look-at) |
-| `--shutdown-grace` | [Options](#options) |
-| `--tool` | [Changing the schema](#changing-the-schema) |
-| `--tools` | [Options](#options) |
-| `--trust-proxy` | [Options](#options) |
-| `--trust-proxy-cloudflare` | [Options](#options) |
-| `--trust-proxy-hops` | [Options](#options) |
-| `--version` | [Options](#options) |

package/dist/docs/database-browser.md

@@ -1,115 +0,0 @@
----
-title: "tablewalk, the database browser"
-description: Open a PostgreSQL or SQLite database in the browser, follow its foreign keys both ways, and keep it read-only.
-keywords: [database browser, tablewalk, browse, walk, foreign key, read-only, sqlite, postgres, workbench]
----
-
-Open a PostgreSQL or SQLite database in the browser, follow its foreign keys both ways, and keep it read-only.
-
-```sh
-npx tablewalk postgres://reader@localhost/crm   # PostgreSQL
-npx tablewalk ./crm.sqlite                      # a SQLite file
-npx tablewalk --demo                            # no database yet: a throwaway sample
-```
-
-![A customer record in the database browser: its fields, the invoices that point at it, and a rail of every table that refers to it.](../../../assets/screens/browser-record.webp)
-
-tablewalk is a product of its own, from the same repository as mistri: a
-foreign key is a place you can go. It needs Node 24.22.1 or newer, no build step
-and no config; `npx tablewalk --version` says which one you have. It serves no
-App: `npx tablewalk --app …` is refused and names the `npx @mistriwork/mistri` command
-that runs it, and mistri, in turn, serves no database browser. Apps run on
-PostgreSQL and SQLite, like the browser; MySQL and MariaDB are not supported.
-
-## What you'll see
-
-- `Listening on http://localhost:4111`, then the database's tables. `--port`
-  picks another port, `--open` opens the browser for you.
-- A record shows its fields, then every table that points at it, each with a
-  count. A reference such as an invoice's `customer_id` is a link to that
-  customer; a table in the rail opens the rows that point here.
-- The address changes at each step (`/crm/customer/~42`), so Back, a bookmark
-  and a pasted link return to the same place.
-
-## Ask, don't click
-
-Type a question into the bar above a table, in the
-[query language](/docs/query/) Apps use too:
-
-```text
-invoice total > 500 sort total desc
-```
-
-The condition is written into the address. Every one of these is a link you
-can type, paste or send:
-
-| Address | Opens |
-| --- | --- |
-| `/demo/customer` | A table. Any query works here, URL-encoded: `/demo/invoice%20total%20%3E%20500` |
-| `/demo/customer/~42` | The customer whose key is 42 |
-| `/demo/customer/~42/~invoice:9` | Invoice 9, reached from customer 42 |
-| `/demo/customer!diagram` | A table's tab: `!rows`, `!ddl` or `!diagram` |
-| `/demo/@customer~42` | A composed page, rooted at a record |
-
-A `json` or `jsonb` column (SQLite `JSON` too) is laid out by its shape:
-objects as fields, arrays of records as tables. Documents are read-only here.
-
-## Read-only, and meant
-
-Every read runs in a read-only transaction. Writing is an opt-in for each
-connection (`"writable": true` in a config file), checked by the server in
-every route and tool that writes, not by the UI. The database role is the
-limit that always holds, so connect as one that can only read:
-
-```sql
-CREATE ROLE tablewalk_reader LOGIN PASSWORD '…';
-GRANT USAGE ON SCHEMA public TO tablewalk_reader;
-GRANT SELECT ON ALL TABLES IN SCHEMA public TO tablewalk_reader;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO tablewalk_reader;
-```
-
-tablewalk warns at startup when the role it connects as could do more than
-read. To keep several databases, or a password out of your shell history,
-name them in a config file:
-
-```json title="tablewalk.json"
-{
-  "connections": [
-    { "name": "crm", "url": "${DATABASE_URL}" },
-    { "name": "local", "url": "sqlite:./crm.sqlite" }
-  ]
-}
-```
-
-```sh
-DATABASE_URL=postgres://reader@localhost/crm npx tablewalk --config ./tablewalk.json
-```
-
-`${VAR}` reads the environment, and an unset variable is an error.
-
-## For a coding agent
-
-`npx tablewalk --mcp` gives an agent the same database as
-up to twenty-three tools: seventeen that only read, and six writes listed only
-for a writable connection. Every answer carries a link to the same rows in the browser.
-[MCP for coding agents](/docs/mcp/)
-
-## Common mistakes
-
-- `Cannot find module 'pg'` → install the driver beside
-  tablewalk: `npm install pg`.
-- A reference shows as a plain value and leads nowhere → the database has no
-  foreign key for it, and the walk follows only declared ones; add the
-  constraint.
-- The address answers nothing → another process holds port 4111; pass
-  `--port 4112`.
-- An old `#/…` link lands on the home page → the hash is not read; drop the
-  `#` and the rest is the path.
-
-## Related
-
-- [Query language](/docs/query/): the bar's whole grammar, grouping and counting.
-- [MCP for coding agents](/docs/mcp/): the tools, and how to wire them into an agent.
-- [Keyboard](/docs/keyboard/): step through records with `j` and `k`.
-- [Command line: database browser](/docs/cli-browser/): every flag.
-- [an App from your database](/docs/quickstart-app/): turn the same database into a workspace for a team, with mistri.

package/dist/docs/keyboard.md

@@ -1,63 +0,0 @@
----
-title: Keyboard
-description: Move through tables, records and the query bar without the mouse; press `?` anywhere for the keys of the room you are in.
----
-
-Move through tables, records and the query bar without the mouse; press `?` anywhere for the keys of the room you are in.
-
-```text
-/  invoice total > 500  Enter  Tab  ↓ ↓  Enter  j j  Backspace
-```
-
-That is: focus the bar, ask, step into the grid, open the third row, step
-to the next two records in that list, and walk back.
-
-<!-- no picture: the ? panel lists these same keys in the running browser. -->
-
-## Anywhere on the page
-
-Single keys work when the caret is not in a text field, and never through a
-dialog.
-
-| Key | Does |
-| --- | --- |
-| `/` | Focus the query bar |
-| `⌘/` | The query bar as a panel, with room to write in |
-| `⌘K` | The command palette: tables, pages, actions, recent queries |
-| `h` | Home: the schema, your work, the diagram |
-| `t` | The table filter in the sidebar |
-| `⌘B` | Show or hide the table list |
-| `Backspace`, `⌘[` | Back one step along the trail |
-| `?` | The keys for this room, and the query language |
-| `Esc` | Leave the field, or close what is open |
-
-## In a grid
-
-Tab into the table; the arrow keys then move a cell cursor.
-
-| Key | Does |
-| --- | --- |
-| `↑ ↓ ← →` | Move one cell (hold `⌘` to jump to the end of a row or column) |
-| `Home`, `End` | First and last column |
-| `Enter` | Open the record for that row, or the document in a JSON cell |
-| `Space` | Glance at that row's record without leaving the list |
-| `⌘C` | Copy the cell under the cursor |
-| `Esc` | Back to the query bar |
-
-## In a record
-
-A record opened from a list (its page, a glance or a dialog) steps through
-that list, in its order and filter, and past its page.
-
-| Key | Does |
-| --- | --- |
-| `j` | The next record in the list |
-| `k` | The previous record |
-| `←`, `→` | The same, with the arrows beside the record's name |
-
-An App's reader gets the grid and record keys too; `?` there lists only those.
-
-## Related
-
-- [tablewalk, the database browser](/docs/database-browser/): what `Enter` and `Backspace` move between.
-- [Query language](/docs/query/): what to type after `/`.

package/dist/docs/mcp.md

@@ -1,86 +0,0 @@
----
-title: MCP for coding agents
-description: Give a coding agent your database's schema, rows and relationships as MCP tools, read-only unless a connection says otherwise.
----
-
-Give a coding agent your database's schema, rows and relationships as MCP
-tools, read-only unless a connection says otherwise.
-
-```json title=".mcp.json"
-{
-  "mcpServers": {
-    "tablewalk": {
-      "command": "npx",
-      "args": ["tablewalk", "--mcp", "--config", "/absolute/path/tablewalk.json"]
-    }
-  }
-}
-```
-
-The config file is the same one the browser reads
-([connections](/docs/services/#connections)); `npx tablewalk --mcp <url or file>`
-works for one database.
-
-<!-- no picture: the agent's side is text; each answer carries a link a person opens in the browser. -->
-
-## What you'll see
-
-- The agent calls `schema_summary` first, then `table`, `query` and `record`
-  as it needs them.
-- Every answer carries a `link`: open it and you are on the same rows in the
-  browser.
-- 23 tools: 17 that only read, and 6 writes listed only when a connection is
-  `"writable": true`.
-
-## When to use it
-
-- Use database MCP when an agent should read your schema and data: to write a
-  migration, a query, a fixture or a first App.
-- Use [App MCP](/docs/app-api/) instead when the agent should act through an
-  App's grants and commands, as a signed-in role would.
-- Use the [agent skill](/docs/build-with-an-agent/) beside either one when the
-  agent is building an App: the skill says how; MCP shows what is there.
-
-## The tools
-
-| Task | Tools |
-| --- | --- |
-| Orient | `connections`, `schema_summary`, `tables`, `table` |
-| Locate and inspect | `find`, `query`, `record`, `profile` |
-| Summarize | `breakdown` |
-| Diagnose | `sql`, `explain`, `lint`, `change_impact`, `diff` |
-| Prepare fixtures | `order`, `fixture` |
-| Refresh | `refresh` |
-| Write (writable only) | `insert`, `update`, `delete`, `insert_graph`, `delete_graph`, `revert` |
-
-A destructive tool (`delete`, `delete_graph`) shows its impact first and, in a client that supports elicitation, asks the person every time; a `confirm: true` the model supplies does not stand in for the answer. The graph tools are not journaled: they return no `undoId`, and `revert` cannot undo them.
-
-`query` and `breakdown` take the [query language](/docs/query/) verbatim.
-
-## Options
-
-| Flag | Does | Default |
-| --- | --- | --- |
-| `--tools <profile>` | Offers one job's worth: `explore`, `migrate` or `seed`. A profile never grants writes. | `full` |
-| `--output-schema` | Advertises each tool's output shape in `tools/list`. | off |
-| `--config <path>` | The connections, each read-only unless `"writable": true`. | `tablewalk.json` in the working directory, then `~/.config/tablewalk/connections.json` |
-
-Every statement stops at 30 seconds (`sql` takes a lower `timeout_ms`) and
-when the client cancels. Counts stop at 10,000 and say so. `sql` and
-`explain` refuse the runtime's own tables (`__mistri_`) and, on PostgreSQL, the `mistri` schema.
-
-## Common mistakes
-
-- The agent sees no `insert` or `update` → the connection is read-only; add
-  `"writable": true` to it, and connect as a database role that may write.
-- `No config file at …` → a relative `--config` path resolved against the
-  agent's working directory, not yours; give an absolute path.
-- An App that signs people in, or names its sources, is refused → database
-  MCP serves no App; use [App MCP](/docs/app-api/) (`--app-mcp`) under a token.
-
-## Related
-
-- [Query language](/docs/query/): what `query` and `breakdown` accept.
-- [Build with a coding agent](/docs/build-with-an-agent/): the skill, the loop and the prompt.
-- [App API](/docs/app-api/): an App's reads and commands as MCP tools, under a token.
-- [tablewalk, the database browser](/docs/database-browser/): where a tool's `link` lands.