@saptools/cf-hana 0.5.0 → 0.5.2

package/dist/cli.js

@@ -3,9 +3,14 @@
 // src/cli.ts
 import { Command } from "commander";
 
+// src/backup.ts
+import { mkdir, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
 // src/config.ts
 var CLI_NAME = "cf-hana";
-var CLI_VERSION = "0.5.0";
+var CLI_VERSION = "0.5.2";
 var ENV_PREFIX = "CF_HANA";
 var DEFAULT_QUERY_TIMEOUT_MS = 6e4;
 var DEFAULT_CONNECT_TIMEOUT_MS = 6e4;
@@ -140,1404 +145,1041 @@ function errorMessage(error) {
   return String(error);
 }
 
-// src/metadata-cache.ts
-import { createHash } from "crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
-var METADATA_CACHE_TTL_MS = 30 * 6e4;
-function metadataCacheRoot(saptoolsRoot) {
-  return join(saptoolsRoot ?? join(homedir(), ".saptools"), "cf-hana", "metadata");
-}
-function toMetadataCacheScope(info) {
-  return {
-    selector: info.selector,
-    appName: info.appName,
-    host: info.host,
-    schema: info.schema,
-    role: info.role,
-    driver: info.driver,
-    ...info.bindingName === void 0 ? {} : { bindingName: info.bindingName },
-    ...info.bindingIndex === void 0 ? {} : { bindingIndex: info.bindingIndex }
-  };
-}
-function metadataCacheKey(scope) {
-  return createHash("sha256").update(JSON.stringify(scope)).digest("hex");
-}
-function metadataCachePath(scope, saptoolsRoot) {
-  return join(metadataCacheRoot(saptoolsRoot), `${metadataCacheKey(scope)}.json`);
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isCatalogObject(value) {
-  return isRecord(value) && typeof value["schema"] === "string" && typeof value["name"] === "string" && (value["type"] === "TABLE" || value["type"] === "VIEW");
-}
-function hasRequiredScopeFields(value) {
-  return typeof value["selector"] === "string" && typeof value["appName"] === "string" && typeof value["host"] === "string" && typeof value["schema"] === "string" && typeof value["role"] === "string" && typeof value["driver"] === "string";
-}
-function hasOptionalScopeFields(value) {
-  return (value["bindingName"] === void 0 || typeof value["bindingName"] === "string") && (value["bindingIndex"] === void 0 || typeof value["bindingIndex"] === "number");
-}
-function isScope(value) {
-  return isRecord(value) && hasRequiredScopeFields(value) && hasOptionalScopeFields(value);
+// src/lob.ts
+var TEXT_LOB_TYPES = /* @__PURE__ */ new Set(["CLOB", "NCLOB"]);
+function normalizeTypeName(typeName2) {
+  return typeName2?.trim().toUpperCase() ?? "";
 }
-function scopesEqual(left, right) {
-  return metadataCacheKey(left) === metadataCacheKey(right);
+function isTextLobType(typeName2) {
+  return TEXT_LOB_TYPES.has(normalizeTypeName(typeName2));
 }
-function isStored(value) {
-  return isRecord(value) && value["version"] === 1 && typeof value["createdAt"] === "string" && isScope(value["scope"]) && Array.isArray(value["objects"]) && value["objects"].every(isCatalogObject);
+
+// src/result-preview.ts
+function normalizePreviewChar(value) {
+  return value === "\r" || value === "\n" || value === "	" ? " " : value;
 }
-async function readMetadataCache(scope, options = {}) {
-  try {
-    const parsed = JSON.parse(
-      await readFile(metadataCachePath(scope, options.saptoolsRoot), "utf8")
-    );
-    if (!isStored(parsed) || !scopesEqual(parsed.scope, scope)) {
-      return void 0;
-    }
-    const createdAt = Date.parse(parsed.createdAt);
-    const now = options.now?.() ?? /* @__PURE__ */ new Date();
-    const ageMs = now.getTime() - createdAt;
-    if (!Number.isFinite(createdAt) || ageMs < 0 || ageMs >= METADATA_CACHE_TTL_MS) {
-      return void 0;
+function previewText(value, limit) {
+  let originalLength = 0;
+  let text = "";
+  for (const char of value) {
+    if (originalLength < limit) {
+      text += normalizePreviewChar(char);
     }
-    return parsed.objects;
-  } catch {
-    return void 0;
+    originalLength += 1;
   }
+  return {
+    text,
+    truncated: originalLength > limit,
+    originalLength,
+    unit: "chars"
+  };
 }
-async function writeMetadataCache(scope, objects, options = {}) {
-  const root = metadataCacheRoot(options.saptoolsRoot);
-  const path = metadataCachePath(scope, options.saptoolsRoot);
-  const tempPath = `${path}.tmp-${process.pid.toString()}`;
-  const stored = {
-    version: 1,
-    createdAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
-    scope,
-    objects
+function previewBuffer(value, limit) {
+  const fullLength = 2 + value.length * 2;
+  const visibleBytes = Math.max(0, Math.floor((limit - 2) / 2));
+  const hex = value.subarray(0, visibleBytes).toString("hex");
+  return {
+    text: `0x${hex}`.slice(0, limit),
+    truncated: fullLength > limit,
+    originalLength: value.length,
+    unit: "bytes"
   };
-  await mkdir(root, { recursive: true, mode: 448 });
-  await rm(tempPath, { force: true });
-  await writeFile(tempPath, `${JSON.stringify(stored)}
-`, { encoding: "utf8", mode: 384 });
-  await rename(tempPath, path);
 }
-async function loadCatalogObjectsWithCache(scope, refresh, loader, options = {}) {
-  if (!refresh) {
-    const cached = await readMetadataCache(scope, options);
-    if (cached !== void 0) {
-      return cached;
-    }
+function scalarText(value) {
+  if (value instanceof Date) {
+    return value.toISOString();
   }
-  const objects = await loader();
-  try {
-    await writeMetadataCache(scope, objects, options);
-  } catch {
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
   }
-  return objects;
+  return value.toString();
 }
-
-// src/suggestions.ts
-var INVALID_OBJECT_PATTERNS = [
-  /invalid\s+(?:table|view|object)\s+name/i,
-  /(?:table|view|object)\s+[^\n]*does\s+not\s+exist/i,
-  /could\s+not\s+find\s+(?:table|view|object)/i
-];
-var REF_KEYWORDS = /* @__PURE__ */ new Set(["FROM", "JOIN", "UPDATE", "INTO", "TABLE"]);
-var STOP_WORDS = /* @__PURE__ */ new Set([
-  "AS",
-  "ON",
-  "WHERE",
-  "SET",
-  "VALUES",
-  "USING",
-  "WHEN",
-  "INNER",
-  "LEFT",
-  "RIGHT",
-  "FULL",
-  "OUTER",
-  "CROSS",
-  "JOIN"
-]);
-var CTE_FOLLOWERS = /* @__PURE__ */ new Set(["AS"]);
-function isInvalidCatalogObjectError(error) {
-  if (!(error instanceof QueryError)) {
-    return false;
+function previewCell(value, limit, typeName2) {
+  if (value === null) {
+    return { text: "", truncated: false, originalLength: 0, unit: "chars" };
   }
-  if (error.sqlState === "42S02" || error.sqlState === "42S01") {
-    return true;
+  if (Buffer.isBuffer(value)) {
+    return isTextLobType(typeName2) ? previewText(value.toString("utf8"), limit) : previewBuffer(value, limit);
   }
-  return INVALID_OBJECT_PATTERNS.some((pattern) => pattern.test(error.message));
-}
-function skipLineComment(sql, index) {
-  let cursor = index + 2;
-  while (cursor < sql.length && sql[cursor] !== "\n") {
-    cursor += 1;
+  if (typeof value === "string") {
+    return previewText(value, limit);
   }
-  return cursor;
+  return previewText(scalarText(value), limit);
 }
-function skipBlockComment(sql, index) {
-  let cursor = index + 2;
-  while (cursor < sql.length && !(sql[cursor] === "*" && sql[cursor + 1] === "/")) {
-    cursor += 1;
+
+// src/format.ts
+function cellText(value, nullText, column) {
+  if (value === null) {
+    return nullText;
   }
-  return Math.min(cursor + 2, sql.length);
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Buffer.isBuffer(value)) {
+    return isTextLobType(column?.typeName) ? value.toString("utf8") : `0x${value.toString("hex")}`;
+  }
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  return typeof value === "number" ? value.toString() : value;
 }
-function skipStringLiteral(sql, index) {
-  let cursor = index + 1;
-  while (cursor < sql.length) {
-    if (sql[cursor] === "'" && sql[cursor + 1] === "'") {
-      cursor += 2;
-      continue;
-    }
-    if (sql[cursor] === "'") {
-      return cursor + 1;
-    }
-    cursor += 1;
+function serializeCell(value, column) {
+  if (value === null) {
+    return null;
   }
-  return cursor;
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Buffer.isBuffer(value)) {
+    return isTextLobType(column?.typeName) ? value.toString("utf8") : `0x${value.toString("hex")}`;
+  }
+  return value;
 }
-function readQuotedIdentifier(sql, index) {
-  let cursor = index + 1;
-  let text = "";
-  while (cursor < sql.length) {
-    if (sql[cursor] === '"' && sql[cursor + 1] === '"') {
-      text += '"';
-      cursor += 2;
-      continue;
-    }
-    if (sql[cursor] === '"') {
-      return { text, next: cursor + 1 };
-    }
-    text += sql.charAt(cursor);
-    cursor += 1;
+function csvEscape(text) {
+  if (/[",\r\n]/.test(text)) {
+    return `"${text.replace(/"/g, '""')}"`;
   }
-  return { text, next: cursor };
+  return text;
 }
-function readBareWord(sql, index) {
-  let cursor = index;
-  let text = "";
-  while (cursor < sql.length && /[A-Za-z0-9_#$]/.test(sql.charAt(cursor))) {
-    text += sql.charAt(cursor);
-    cursor += 1;
+function formatTable(result) {
+  if (result.columns.length === 0) {
+    return `(${String(result.rowCount)} row(s) affected)`;
   }
-  return { text, next: cursor };
+  const headers = result.columns.map((column) => column.name);
+  const rows = result.rows.map(
+    (row) => result.columns.map((column) => cellText(row[column.name] ?? null, "NULL", column))
+  );
+  const widths = headers.map((header, index) => {
+    const widest = rows.reduce(
+      (max, cells) => Math.max(max, (cells[index] ?? "").length),
+      header.length
+    );
+    return widest;
+  });
+  const renderRow = (cells) => cells.map((cell, index) => cell.padEnd(widths[index] ?? 0)).join(" | ");
+  const separator = widths.map((width) => "-".repeat(width)).join("-+-");
+  const body = rows.map((cells) => renderRow(cells));
+  return [renderRow(headers), separator, ...body].join("\n");
 }
-function tokenize(sql) {
-  const tokens = [];
-  let index = 0;
-  while (index < sql.length) {
-    const char = sql.charAt(index);
-    if (/\s/.test(char)) {
-      index += 1;
-      continue;
-    }
-    if (char === "-" && sql[index + 1] === "-") {
-      index = skipLineComment(sql, index);
-      continue;
-    }
-    if (char === "/" && sql[index + 1] === "*") {
-      index = skipBlockComment(sql, index);
-      continue;
-    }
-    if (char === "'") {
-      index = skipStringLiteral(sql, index);
-      continue;
-    }
-    if (char === '"') {
-      const quoted = readQuotedIdentifier(sql, index);
-      tokens.push({ kind: "quoted", text: quoted.text });
-      index = quoted.next;
-      continue;
-    }
-    if (/[A-Za-z_#$]/.test(char)) {
-      const word = readBareWord(sql, index);
-      tokens.push({ kind: "word", text: word.text });
-      index = word.next;
-      continue;
+function formatJson(result) {
+  const rows = result.rows.map((row) => {
+    const serialized = {};
+    for (const [key, value] of Object.entries(row)) {
+      const column = result.columns.find((item) => item.name === key);
+      serialized[key] = serializeCell(value, column);
     }
-    if (char === ".") {
-      tokens.push({ kind: "dot", text: char });
-    } else if (char === ",") {
-      tokens.push({ kind: "comma", text: char });
-    } else if (char === "(") {
-      tokens.push({ kind: "open", text: char });
-    } else if (char === ")") {
-      tokens.push({ kind: "close", text: char });
-    } else {
-      tokens.push({ kind: "other", text: char });
+    return serialized;
+  });
+  return JSON.stringify(rows, null, 2);
+}
+function formatJsonCompact(result, preferredColumn) {
+  const singleColumn = result.columns.length === 1 ? result.columns[0]?.name : void 0;
+  const columnName = preferredColumn ?? singleColumn;
+  if (columnName === void 0) {
+    return formatJson(result);
+  }
+  const column = result.columns.find((item) => item.name === columnName);
+  const values = result.rows.map((row) => serializeCell(row[columnName] ?? null, column));
+  return JSON.stringify(values, null, 2);
+}
+function formatCsv(result) {
+  const headers = result.columns.map((column) => column.name);
+  const lines = [headers.map((header) => csvEscape(header)).join(",")];
+  for (const row of result.rows) {
+    lines.push(
+      result.columns.map((column) => csvEscape(cellText(row[column.name] ?? null, "", column))).join(",")
+    );
+  }
+  return lines.join("\r\n");
+}
+function formatCompactCsv(result, cellLimit) {
+  const headers = result.columns.map((column) => column.name);
+  const lines = [headers.map((header) => csvEscape(header)).join(",")];
+  let truncatedCells = 0;
+  for (const row of result.rows) {
+    const cells = result.columns.map((column) => {
+      const preview = previewCell(row[column.name] ?? null, cellLimit, column.typeName);
+      if (preview.truncated) {
+        truncatedCells += 1;
+      }
+      return csvEscape(preview.text);
+    });
+    lines.push(cells.join(","));
+  }
+  return { text: lines.join("\r\n"), truncatedCells };
+}
+function formatResult(result, format, compactColumn) {
+  switch (format) {
+    case "table":
+      return formatTable(result);
+    case "json":
+      return formatJson(result);
+    case "json-compact":
+      return formatJsonCompact(result, compactColumn);
+    case "csv":
+      return formatCsv(result);
+  }
+}
+
+// src/backup-sql-parser.ts
+function isIdentifierChar(char) {
+  return char !== void 0 && /[A-Za-z0-9_$#]/.test(char);
+}
+function skipQuotedText(sql, index) {
+  const quote = sql[index];
+  let cursor = index + 1;
+  while (cursor < sql.length) {
+    if (sql[cursor] === quote) {
+      if (sql[cursor + 1] === quote) {
+        cursor += 2;
+        continue;
+      }
+      return cursor + 1;
     }
-    index += 1;
+    cursor += 1;
   }
-  return tokens;
+  return cursor;
 }
-function upper(token) {
-  return token?.text.toUpperCase() ?? "";
+function skipLineComment(sql, index) {
+  let cursor = index + 2;
+  while (cursor < sql.length && sql[cursor] !== "\n") {
+    cursor += 1;
+  }
+  return cursor;
 }
-function isIdentifier(token) {
-  return token?.kind === "word" || token?.kind === "quoted";
+function skipBlockComment(sql, index) {
+  let cursor = index + 2;
+  while (cursor < sql.length && !(sql[cursor] === "*" && sql[cursor + 1] === "/")) {
+    cursor += 1;
+  }
+  return Math.min(cursor + 2, sql.length);
 }
-function readName(tokens, start, allowFollowingParens = false) {
-  const first = tokens[start];
-  if (!isIdentifier(first)) {
-    return void 0;
+function skipNonCode(sql, index) {
+  const char = sql[index];
+  if (char === "'" || char === '"') {
+    return skipQuotedText(sql, index);
   }
-  let next = start + 1;
-  let schema;
-  let name = first.text;
-  const maybeObject = tokens[next + 1];
-  if (tokens[next]?.kind === "dot" && isIdentifier(maybeObject)) {
-    schema = name;
-    name = maybeObject.text;
-    next += 2;
+  if (char === "-" && sql[index + 1] === "-") {
+    return skipLineComment(sql, index);
   }
-  if (!allowFollowingParens && tokens[next]?.kind === "open") {
-    return void 0;
+  if (char === "/" && sql[index + 1] === "*") {
+    return skipBlockComment(sql, index);
   }
-  return { name: schema === void 0 ? { name } : { schema, name }, next };
+  return void 0;
 }
-function firstNameFromText(text) {
-  const tokens = tokenize(text);
-  for (let index = 0; index < tokens.length; index += 1) {
-    const read = readName(tokens, index, true);
-    if (read !== void 0) {
-      return read.name;
+function skipTrivia(sql, start, end) {
+  let index = start;
+  while (index < end) {
+    if (/\s/.test(sql.charAt(index))) {
+      index += 1;
+      continue;
+    }
+    if (sql[index] === "-" && sql[index + 1] === "-") {
+      index = skipLineComment(sql, index);
+      continue;
+    }
+    if (sql[index] === "/" && sql[index + 1] === "*") {
+      index = skipBlockComment(sql, index);
+      continue;
     }
+    break;
   }
-  return void 0;
+  return index;
 }
-function extractMissingObjectNameFromError(error) {
-  if (!(error instanceof QueryError)) {
-    return void 0;
+function readIdentifierPart(sql, start, end) {
+  const index = skipTrivia(sql, start, end);
+  if (sql[index] === '"') {
+    const next2 = skipQuotedText(sql, index);
+    return next2 <= end && sql[next2 - 1] === '"' ? { sql: sql.slice(index, next2), end: next2 } : void 0;
   }
-  const message = error.message;
-  const invalidName = /invalid\s+(?:table|view|object)\s+name\s*:?\s*(.+)$/i.exec(message);
-  if (invalidName?.[1] !== void 0) {
-    return firstNameFromText(invalidName[1]);
+  if (!/[A-Za-z_#$]/.test(sql.charAt(index))) {
+    return void 0;
   }
-  const missingObject = /(?:table|view|object)\s+(.+?)\s+(?:does\s+not\s+exist|not\s+found)/i.exec(message);
-  if (missingObject?.[1] !== void 0) {
-    return firstNameFromText(missingObject[1]);
+  let next = index + 1;
+  while (next < end && /[A-Za-z0-9_#$]/.test(sql.charAt(next))) {
+    next += 1;
   }
-  return void 0;
+  return { sql: sql.slice(index, next), end: next };
 }
-function cteNames(tokens) {
-  const names = /* @__PURE__ */ new Set();
-  if (upper(tokens[0]) !== "WITH") {
-    return names;
+function readQualifiedTarget(sql, start, end) {
+  const first = readIdentifierPart(sql, start, end);
+  if (first === void 0) {
+    return void 0;
   }
-  let depth = 0;
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (depth === 0 && upper(token) === "SELECT") {
+  const parts = [first.sql];
+  let cursor = first.end;
+  while (parts.length < 3) {
+    const dot = skipTrivia(sql, cursor, end);
+    if (sql[dot] !== ".") {
       break;
     }
-    if (depth === 0 && isIdentifier(token) && CTE_FOLLOWERS.has(upper(tokens[index + 1]))) {
-      names.add(token.text.toUpperCase());
-    }
-    if (token?.kind === "open") {
-      depth += 1;
-    } else if (token?.kind === "close" && depth > 0) {
-      depth -= 1;
+    const part = readIdentifierPart(sql, dot + 1, end);
+    if (part === void 0) {
+      return void 0;
     }
+    parts.push(part.sql);
+    cursor = part.end;
   }
-  return names;
+  return { sql: parts.join("."), reference: parts.at(-1) ?? first.sql, end: cursor };
 }
-function extractMissingObjectName(sql) {
-  const tokens = tokenize(sql.replace(/^;+|;+$/g, ""));
-  const ctes = cteNames(tokens);
-  let candidate;
-  for (let index = 0; index < tokens.length; index += 1) {
-    const word = upper(tokens[index]);
-    if (!REF_KEYWORDS.has(word)) {
+function topLevelTokens(sql) {
+  const tokens = [];
+  let index = 0;
+  let depth = 0;
+  while (index < sql.length) {
+    const skipped = skipNonCode(sql, index);
+    if (skipped !== void 0) {
+      index = skipped;
       continue;
     }
-    if (word === "TABLE" && upper(tokens[index - 1]) !== "TRUNCATE") {
+    const char = sql.charAt(index);
+    if (char === "(") {
+      depth += 1;
+      index += 1;
       continue;
     }
-    if (word === "INTO" && !(upper(tokens[index - 1]) === "INSERT" || upper(tokens[index - 1]) === "MERGE")) {
+    if (char === ")") {
+      depth = Math.max(0, depth - 1);
+      index += 1;
       continue;
     }
-    const read = readName(tokens, index + 1, word === "INTO");
-    if (read === void 0) {
+    if (!/[A-Za-z_#$]/.test(char)) {
+      index += 1;
       continue;
     }
-    if (read.name.schema === void 0 && ctes.has(read.name.name.toUpperCase())) {
-      continue;
+    let end = index + 1;
+    while (end < sql.length && /[A-Za-z0-9_#$]/.test(sql.charAt(end))) {
+      end += 1;
     }
-    if (STOP_WORDS.has(read.name.name.toUpperCase())) {
-      continue;
-    }
-    candidate = read.name;
-    let next = read.next;
-    if (isIdentifier(tokens[next]) && !STOP_WORDS.has(upper(tokens[next]))) {
-      next += 1;
-    }
-    while (tokens[next]?.kind === "comma") {
-      const commaRead = readName(tokens, next + 1);
-      if (commaRead === void 0) {
-        break;
-      }
-      if (!(commaRead.name.schema === void 0 && ctes.has(commaRead.name.name.toUpperCase()))) {
-        candidate = commaRead.name;
-      }
-      next = commaRead.next;
-      if (isIdentifier(tokens[next]) && !STOP_WORDS.has(upper(tokens[next]))) {
-        next += 1;
-      }
+    if (depth === 0) {
+      tokens.push({ keyword: sql.slice(index, end).toUpperCase(), start: index, end });
     }
+    index = end;
   }
-  return candidate;
+  return tokens;
 }
-function singular(value) {
-  if (value.endsWith("ES")) {
-    return value.slice(0, -2);
-  }
-  if (value.endsWith("S")) {
-    return value.slice(0, -1);
+function findToken(tokens, keyword, start = 0) {
+  for (let index = start; index < tokens.length; index += 1) {
+    if (tokens[index]?.keyword === keyword) {
+      return index;
+    }
   }
-  return value;
+  return void 0;
 }
-function norm(value) {
-  return value.toUpperCase().replace(/[^A-Z0-9]+/g, "");
+function keywordMatches(sql, index, keyword) {
+  const end = index + keyword.length;
+  return sql.slice(index, end).toUpperCase() === keyword && !isIdentifierChar(sql[index - 1]) && !isIdentifierChar(sql[end]);
 }
-function distance(a, b) {
-  const previous = Array.from({ length: b.length + 1 }, (_value, index) => index);
-  for (let leftIndex = 1; leftIndex <= a.length; leftIndex += 1) {
-    let last = leftIndex - 1;
-    previous[0] = leftIndex;
-    for (let rightIndex = 1; rightIndex <= b.length; rightIndex += 1) {
-      const old = previous[rightIndex] ?? 0;
-      previous[rightIndex] = Math.min(
-        (previous[rightIndex] ?? 0) + 1,
-        (previous[rightIndex - 1] ?? 0) + 1,
-        last + (a.charAt(leftIndex - 1) === b.charAt(rightIndex - 1) ? 0 : 1)
-      );
-      last = old;
+function findTopLevelKeyword(sql, keyword, startIndex = 0) {
+  let index = startIndex;
+  let depth = 0;
+  while (index < sql.length) {
+    const skipped = skipNonCode(sql, index);
+    if (skipped !== void 0) {
+      index = skipped;
+      continue;
     }
+    const char = sql[index];
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")" && depth > 0) {
+      depth -= 1;
+    } else if (depth === 0 && keywordMatches(sql, index, keyword)) {
+      return index;
+    }
+    index += 1;
   }
-  return previous[b.length] ?? 0;
+  return void 0;
 }
-function score(requested, candidate) {
-  const requestedName = norm(requested.name);
-  const candidateName = norm(candidate.name);
-  if (requested.schema !== void 0 && norm(requested.schema) !== norm(candidate.schema)) {
-    return 0;
-  }
-  if (requestedName === candidateName) {
-    return 100;
+function findTopLevelChar(sql, target, startIndex, endIndex) {
+  let index = startIndex;
+  let depth = 0;
+  while (index < endIndex) {
+    const skipped = skipNonCode(sql, index);
+    if (skipped !== void 0) {
+      index = skipped;
+      continue;
+    }
+    const char = sql[index];
+    if (char === target && depth === 0) {
+      return index;
+    }
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")" && depth > 0) {
+      depth -= 1;
+    }
+    index += 1;
   }
-  if (singular(requestedName) === singular(candidateName)) {
-    return 92;
+  return void 0;
+}
+
+// src/statements.ts
+var SELECT_KEYWORDS = /* @__PURE__ */ new Set(["SELECT"]);
+var DML_KEYWORDS = /* @__PURE__ */ new Set(["INSERT", "UPDATE", "DELETE", "MERGE", "UPSERT", "REPLACE"]);
+var DDL_KEYWORDS = /* @__PURE__ */ new Set(["CREATE", "DROP", "ALTER", "TRUNCATE", "RENAME", "COMMENT"]);
+function firstKeyword(sql) {
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql.charAt(index);
+    if (char.trim().length === 0) {
+      index += 1;
+      continue;
+    }
+    if (char === "-" && sql[index + 1] === "-") {
+      index += 2;
+      while (index < sql.length && sql[index] !== "\n") {
+        index += 1;
+      }
+      continue;
+    }
+    if (char === "/" && sql[index + 1] === "*") {
+      const commentEnd = sql.indexOf("*/", index + 2);
+      if (commentEnd === -1) {
+        return "";
+      }
+      index = commentEnd + 2;
+      continue;
+    }
+    break;
   }
-  let value = 0;
-  if (candidateName.startsWith(requestedName) || requestedName.startsWith(candidateName)) {
-    value = Math.max(value, 80 - Math.abs(candidateName.length - requestedName.length));
+  let keywordEnd = index;
+  while (keywordEnd < sql.length) {
+    const code = sql.charCodeAt(keywordEnd);
+    const isUpperCase = code >= 65 && code <= 90;
+    const isLowerCase = code >= 97 && code <= 122;
+    if (!isUpperCase && !isLowerCase) {
+      break;
+    }
+    keywordEnd += 1;
   }
-  if (candidateName.endsWith(requestedName) || requestedName.endsWith(candidateName)) {
-    value = Math.max(value, 70 - Math.abs(candidateName.length - requestedName.length));
+  return sql.slice(index, keywordEnd).toUpperCase();
+}
+function skipQuotedText2(sql, start) {
+  const quote = sql[start];
+  let index = start + 1;
+  while (index < sql.length) {
+    if (sql[index] === quote) {
+      if (sql[index + 1] === quote) {
+        index += 2;
+        continue;
+      }
+      index += 1;
+      break;
+    }
+    index += 1;
   }
-  const editDistance = distance(requestedName, candidateName);
-  const max = Math.max(requestedName.length, candidateName.length, 1);
-  if (editDistance <= Math.max(3, Math.floor(max * 0.35))) {
-    value = Math.max(value, Math.round(75 * (1 - editDistance / max)));
+  return index;
+}
+function skipLineComment2(sql, start) {
+  let index = start + 2;
+  while (index < sql.length && sql[index] !== "\n") {
+    index += 1;
   }
-  return value;
+  return index;
 }
-function extractInvalidColumnNameFromError(error) {
-  if (!(error instanceof QueryError)) {
-    return void 0;
+function skipBlockComment2(sql, start) {
+  let index = start + 2;
+  while (index < sql.length && !(sql[index] === "*" && sql[index + 1] === "/")) {
+    index += 1;
   }
-  const match = /invalid column name:\s*([^:]+)/i.exec(error.message);
-  const name = match?.[1]?.trim();
-  return name === void 0 || name.length === 0 ? void 0 : name;
+  return Math.min(index + 2, sql.length);
 }
-function rankCatalogSuggestions(requested, candidates, limit = 5) {
-  return candidates.map((candidate) => ({ candidate, score: score(requested, candidate) })).filter((item) => item.score >= 45).sort(
-    (left, right) => right.score - left.score || left.candidate.schema.localeCompare(right.candidate.schema) || (left.candidate.type === right.candidate.type ? 0 : left.candidate.type === "TABLE" ? -1 : 1) || left.candidate.name.localeCompare(right.candidate.name)
-  ).slice(0, limit).map((item) => item.candidate);
+function maskIgnoredSqlText(sql) {
+  let masked = "";
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql[index];
+    if (char === "'" || char === '"') {
+      const end = skipQuotedText2(sql, index);
+      masked += " ".repeat(end - index);
+      index = end;
+      continue;
+    }
+    if (char === "-" && sql[index + 1] === "-") {
+      const end = skipLineComment2(sql, index);
+      masked += " ".repeat(end - index);
+      index = end;
+      continue;
+    }
+    if (char === "/" && sql[index + 1] === "*") {
+      const end = skipBlockComment2(sql, index);
+      masked += " ".repeat(end - index);
+      index = end;
+      continue;
+    }
+    masked += char ?? "";
+    index += 1;
+  }
+  return masked;
 }
-function formatSuggestions(suggestions) {
-  if (suggestions.length === 0) {
-    return void 0;
+function topLevelKeywordIndex(sql, keyword) {
+  const masked = maskIgnoredSqlText(sql);
+  let depth = 0;
+  for (let index = 0; index < masked.length; index += 1) {
+    const char = masked[index];
+    if (char === "(") {
+      depth += 1;
+      continue;
+    }
+    if (char === ")") {
+      depth = Math.max(0, depth - 1);
+      continue;
+    }
+    if (depth === 0 && masked.slice(index, index + keyword.length).toUpperCase() === keyword && !/[A-Za-z0-9_$#]/.test(masked.charAt(index - 1)) && !/[A-Za-z0-9_$#]/.test(masked.charAt(index + keyword.length))) {
+      return index;
+    }
   }
-  return [
-    "Did you mean:",
-    ...suggestions.map((item) => `  ${item.schema}.${item.name} (${item.type})`)
-  ].join("\n");
+  return void 0;
 }
-function rankNameSuggestions(requested, candidates, limit = 5) {
-  const requestedName = { name: requested };
-  return candidates.map((candidate) => ({
-    candidate,
-    score: score(requestedName, { schema: "", name: candidate.name, type: "TABLE" })
-  })).filter((item) => item.score >= 45).sort(
-    (left, right) => right.score - left.score || left.candidate.name.localeCompare(right.candidate.name)
-  ).slice(0, limit).map((item) => item.candidate);
+function hasTopLevelKeyword(sql, keyword) {
+  return topLevelKeywordIndex(sql, keyword) !== void 0;
 }
-function formatColumnSuggestions(suggestions) {
-  if (suggestions.length === 0) {
-    return void 0;
+function isIdentifierChar2(char) {
+  return /[A-Za-z0-9_$#]/.test(char);
+}
+function skipWhitespace(masked, start) {
+  let index = start;
+  while (index < masked.length && /\s/.test(masked.charAt(index))) {
+    index += 1;
   }
-  return [
-    "Did you mean column:",
-    ...suggestions.map((item) => `  ${item.name}`)
-  ].join("\n");
+  return index;
 }
-
-// src/002-cli-query-hints.ts
-async function loadSuggestionCatalogObjects(client, refresh) {
-  try {
-    return await loadCatalogObjectsWithCache(
-      toMetadataCacheScope(client.info),
-      refresh,
-      async () => await client.listCatalogObjects(client.info.schema)
-    );
-  } catch {
-    return await client.listCatalogObjects(client.info.schema);
-  }
-}
-function isLobSortOrGroupError(error) {
-  const code = databaseCode(error);
-  if (code !== 266 && code !== 274) {
-    return false;
-  }
-  return error instanceof QueryError && /LOB type is not allowed in (?:ORDER BY|GROUP BY) clause/i.test(error.message);
-}
-function printLobSortOrGroupHint() {
-  const lines = [
-    `${CLI_NAME}: HANA cannot ORDER BY or GROUP BY NCLOB/CLOB/BLOB columns directly.`,
-    `${CLI_NAME}: Remove the LOB column from ORDER BY/GROUP BY or wrap it as TO_VARCHAR(<column>).`
-  ];
-  process.stderr.write(`${lines.join("\n")}
-`);
-}
-function isInsufficientPrivilegeError(error) {
-  return databaseCode(error) === 258 || /\binsufficient privilege\b/i.test(errorMessage(error));
-}
-function printInsufficientPrivilegeHint(client, schema) {
-  const binding = client.info.bindingName ?? (client.info.bindingIndex === void 0 ? "unknown" : `#${String(client.info.bindingIndex)}`);
-  const otherBindings = (client.info.availableBindingNames ?? []).filter(
-    (name) => name !== client.info.bindingName
-  );
-  const retryBinding = otherBindings[0];
-  const lines = [
-    `${CLI_NAME}: insufficient privilege for schema ${schema} as database user ${client.databaseUser || "unknown"} (current binding: ${binding}).`
-  ];
-  if (retryBinding !== void 0) {
-    lines.push(
-      `${CLI_NAME}: other HANA bindings on this app: ${otherBindings.join(", ")}; retry with --binding ${retryBinding}.`
-    );
+function matchingCloseParenIndex(masked, openIndex) {
+  let depth = 0;
+  for (let index = openIndex; index < masked.length; index += 1) {
+    const char = masked.charAt(index);
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        return index;
+      }
+    }
   }
-  lines.push(
-    `${CLI_NAME}: try another app or full selector whose binding has the grant; no automatic retry was attempted.`
-  );
-  process.stderr.write(`${lines.join("\n")}
-`);
+  return void 0;
 }
-function rethrowWithPrivilegeHint(error, client, schema) {
-  if (isInsufficientPrivilegeError(error)) {
-    printInsufficientPrivilegeHint(client, schema);
-  }
-  throw error;
+function isAsKeywordAt(masked, index) {
+  return masked.slice(index, index + 2).toUpperCase() === "AS" && !isIdentifierChar2(masked.charAt(index - 1)) && !isIdentifierChar2(masked.charAt(index + 2));
 }
-async function printColumnSuggestions(error, client, sql) {
-  if (databaseCode(error) !== 260) {
-    return;
-  }
-  const columnName = extractInvalidColumnNameFromError(error);
-  const tableName = extractMissingObjectName(sql);
-  if (columnName === void 0 || tableName === void 0) {
-    return;
-  }
-  try {
-    const columns = await client.listColumns(
-      tableName.schema ?? client.info.schema,
-      tableName.name
-    );
-    const text = formatColumnSuggestions(rankNameSuggestions(columnName, columns));
-    if (text !== void 0) {
-      process.stderr.write(`${text}
-`);
+function skipCteName(sql, masked, start) {
+  let index = start;
+  while (index < sql.length) {
+    const char = sql.charAt(index);
+    if (char.trim().length === 0) {
+      index += 1;
+      continue;
     }
-  } catch {
-  }
-}
-async function printCatalogObjectSuggestions(error, client, sql, refresh) {
-  if (!isInvalidCatalogObjectError(error)) {
-    return;
-  }
-  const requested = extractMissingObjectNameFromError(error) ?? extractMissingObjectName(sql);
-  if (requested === void 0) {
-    return;
-  }
-  try {
-    const objects = await loadSuggestionCatalogObjects(client, refresh);
-    const text = formatSuggestions(rankCatalogSuggestions(requested, objects));
-    if (text !== void 0) {
-      process.stderr.write(`${text}
-`);
+    if (char === "-" && sql.charAt(index + 1) === "-") {
+      index = skipLineComment2(sql, index);
+      continue;
     }
-  } catch {
+    if (char === "/" && sql.charAt(index + 1) === "*") {
+      index = skipBlockComment2(sql, index);
+      continue;
+    }
+    break;
   }
-}
-async function enrichAndRethrowQueryError(error, client, sql, refresh) {
-  if (isInsufficientPrivilegeError(error)) {
-    const schema = extractMissingObjectName(sql)?.schema ?? client.info.schema;
-    printInsufficientPrivilegeHint(client, schema);
-    throw error;
+  if (sql.charAt(index) === "'" || sql.charAt(index) === '"') {
+    return skipQuotedText2(sql, index);
   }
-  if (isLobSortOrGroupError(error)) {
-    printLobSortOrGroupHint();
-    throw error;
+  let end = index;
+  while (end < masked.length && isIdentifierChar2(masked.charAt(end))) {
+    end += 1;
   }
-  await printColumnSuggestions(error, client, sql);
-  await printCatalogObjectSuggestions(error, client, sql, refresh);
-  throw error;
-}
-
-// src/backup.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-
-// src/lob.ts
-var TEXT_LOB_TYPES = /* @__PURE__ */ new Set(["CLOB", "NCLOB"]);
-function normalizeTypeName(typeName2) {
-  return typeName2?.trim().toUpperCase() ?? "";
-}
-function isTextLobType(typeName2) {
-  return TEXT_LOB_TYPES.has(normalizeTypeName(typeName2));
-}
-
-// src/result-preview.ts
-function normalizePreviewChar(value) {
-  return value === "\r" || value === "\n" || value === "	" ? " " : value;
+  return end;
 }
-function previewText(value, limit) {
-  let originalLength = 0;
-  let text = "";
-  for (const char of value) {
-    if (originalLength < limit) {
-      text += normalizePreviewChar(char);
+function cteListEndIndex(sql, masked, afterWith) {
+  let index = afterWith;
+  for (; ; ) {
+    index = skipCteName(sql, masked, index);
+    index = skipWhitespace(masked, index);
+    if (masked.charAt(index) === "(") {
+      const columnListEnd = matchingCloseParenIndex(masked, index);
+      if (columnListEnd === void 0) {
+        return void 0;
+      }
+      index = skipWhitespace(masked, columnListEnd + 1);
     }
-    originalLength += 1;
-  }
-  return {
-    text,
-    truncated: originalLength > limit,
-    originalLength,
-    unit: "chars"
-  };
-}
-function previewBuffer(value, limit) {
-  const fullLength = 2 + value.length * 2;
-  const visibleBytes = Math.max(0, Math.floor((limit - 2) / 2));
-  const hex = value.subarray(0, visibleBytes).toString("hex");
-  return {
-    text: `0x${hex}`.slice(0, limit),
-    truncated: fullLength > limit,
-    originalLength: value.length,
-    unit: "bytes"
-  };
-}
-function scalarText(value) {
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  if (typeof value === "boolean") {
-    return value ? "true" : "false";
+    if (!isAsKeywordAt(masked, index)) {
+      return void 0;
+    }
+    index = skipWhitespace(masked, index + 2);
+    if (masked.charAt(index) !== "(") {
+      return void 0;
+    }
+    const closeIndex = matchingCloseParenIndex(masked, index);
+    if (closeIndex === void 0) {
+      return void 0;
+    }
+    index = skipWhitespace(masked, closeIndex + 1);
+    if (masked.charAt(index) === ",") {
+      index += 1;
+      continue;
+    }
+    return index;
   }
-  return value.toString();
 }
-function previewCell(value, limit, typeName2) {
-  if (value === null) {
-    return { text: "", truncated: false, originalLength: 0, unit: "chars" };
+function resolveWithStatement(sql) {
+  const withIndex = topLevelKeywordIndex(sql, "WITH");
+  if (withIndex === void 0) {
+    return void 0;
   }
-  if (Buffer.isBuffer(value)) {
-    return isTextLobType(typeName2) ? previewText(value.toString("utf8"), limit) : previewBuffer(value, limit);
+  const masked = maskIgnoredSqlText(sql);
+  const trailingIndex = cteListEndIndex(sql, masked, withIndex + "WITH".length);
+  if (trailingIndex === void 0) {
+    return void 0;
   }
-  if (typeof value === "string") {
-    return previewText(value, limit);
+  let keywordEnd = trailingIndex;
+  while (keywordEnd < masked.length && isIdentifierChar2(masked.charAt(keywordEnd))) {
+    keywordEnd += 1;
   }
-  return previewText(scalarText(value), limit);
+  return { keyword: masked.slice(trailingIndex, keywordEnd).toUpperCase(), index: trailingIndex };
 }
-
-// src/format.ts
-function cellText(value, nullText, column) {
-  if (value === null) {
-    return nullText;
-  }
-  if (value instanceof Date) {
-    return value.toISOString();
+function classifyByKeyword(keyword) {
+  if (SELECT_KEYWORDS.has(keyword)) {
+    return "select";
   }
-  if (Buffer.isBuffer(value)) {
-    return isTextLobType(column?.typeName) ? value.toString("utf8") : `0x${value.toString("hex")}`;
+  if (DML_KEYWORDS.has(keyword)) {
+    return "dml";
   }
-  if (typeof value === "boolean") {
-    return value ? "true" : "false";
+  if (DDL_KEYWORDS.has(keyword)) {
+    return "ddl";
   }
-  return typeof value === "number" ? value.toString() : value;
+  return "unknown";
 }
-function serializeCell(value, column) {
-  if (value === null) {
-    return null;
+function classifyStatement(sql) {
+  const keyword = firstKeyword(sql);
+  if (keyword === "WITH") {
+    const resolved = resolveWithStatement(sql);
+    return resolved === void 0 ? "unknown" : classifyByKeyword(resolved.keyword);
   }
-  if (value instanceof Date) {
-    return value.toISOString();
+  return classifyByKeyword(keyword);
+}
+function quoteIdentifier(identifier) {
+  if (identifier.length === 0) {
+    throw new QueryError("A SQL identifier must not be empty");
   }
-  if (Buffer.isBuffer(value)) {
-    return isTextLobType(column?.typeName) ? value.toString("utf8") : `0x${value.toString("hex")}`;
+  if (identifier.includes("\0")) {
+    throw new QueryError("A SQL identifier must not contain a NUL character");
   }
-  return value;
+  return `"${identifier.replace(/"/g, '""')}"`;
 }
-function csvEscape(text) {
-  if (/[",\r\n]/.test(text)) {
-    return `"${text.replace(/"/g, '""')}"`;
-  }
-  return text;
+function qualifiedName(schema, table) {
+  return `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
 }
-function formatTable(result) {
-  if (result.columns.length === 0) {
-    return `(${String(result.rowCount)} row(s) affected)`;
-  }
-  const headers = result.columns.map((column) => column.name);
-  const rows = result.rows.map(
-    (row) => result.columns.map((column) => cellText(row[column.name] ?? null, "NULL", column))
-  );
-  const widths = headers.map((header, index) => {
-    const widest = rows.reduce(
-      (max, cells) => Math.max(max, (cells[index] ?? "").length),
-      header.length
-    );
-    return widest;
-  });
-  const renderRow = (cells) => cells.map((cell, index) => cell.padEnd(widths[index] ?? 0)).join(" | ");
-  const separator = widths.map((width) => "-".repeat(width)).join("-+-");
-  const body = rows.map((cells) => renderRow(cells));
-  return [renderRow(headers), separator, ...body].join("\n");
-}
-function formatJson(result) {
-  const rows = result.rows.map((row) => {
-    const serialized = {};
-    for (const [key, value] of Object.entries(row)) {
-      const column = result.columns.find((item) => item.name === key);
-      serialized[key] = serializeCell(value, column);
+function countPlaceholders(sql) {
+  let count = 0;
+  let index = 0;
+  const length = sql.length;
+  while (index < length) {
+    const char = sql[index];
+    if (char === "'" || char === '"') {
+      const quote = char;
+      index += 1;
+      while (index < length) {
+        if (sql[index] === quote) {
+          if (sql[index + 1] === quote) {
+            index += 2;
+            continue;
+          }
+          index += 1;
+          break;
+        }
+        index += 1;
+      }
+      continue;
     }
-    return serialized;
-  });
-  return JSON.stringify(rows, null, 2);
-}
-function formatJsonCompact(result, preferredColumn) {
-  const singleColumn = result.columns.length === 1 ? result.columns[0]?.name : void 0;
-  const columnName = preferredColumn ?? singleColumn;
-  if (columnName === void 0) {
-    return formatJson(result);
+    if (char === "-" && sql[index + 1] === "-") {
+      index += 2;
+      while (index < length && sql[index] !== "\n") {
+        index += 1;
+      }
+      continue;
+    }
+    if (char === "/" && sql[index + 1] === "*") {
+      index += 2;
+      while (index < length && !(sql[index] === "*" && sql[index + 1] === "/")) {
+        index += 1;
+      }
+      index += 2;
+      continue;
+    }
+    if (char === "?") {
+      count += 1;
+    }
+    index += 1;
   }
-  const column = result.columns.find((item) => item.name === columnName);
-  const values = result.rows.map((row) => serializeCell(row[columnName] ?? null, column));
-  return JSON.stringify(values, null, 2);
+  return count;
 }
-function formatCsv(result) {
-  const headers = result.columns.map((column) => column.name);
-  const lines = [headers.map((header) => csvEscape(header)).join(",")];
-  for (const row of result.rows) {
-    lines.push(
-      result.columns.map((column) => csvEscape(cellText(row[column.name] ?? null, "", column))).join(",")
+function assertParamArity(sql, params) {
+  const expected = countPlaceholders(sql);
+  if (expected !== params.length) {
+    throw new QueryError(
+      `SQL expects ${String(expected)} bound parameter(s) but received ${String(params.length)} value(s)`
     );
   }
-  return lines.join("\r\n");
 }
-function formatCompactCsv(result, cellLimit) {
-  const headers = result.columns.map((column) => column.name);
-  const lines = [headers.map((header) => csvEscape(header)).join(",")];
-  let truncatedCells = 0;
-  for (const row of result.rows) {
-    const cells = result.columns.map((column) => {
-      const preview = previewCell(row[column.name] ?? null, cellLimit, column.typeName);
-      if (preview.truncated) {
-        truncatedCells += 1;
-      }
-      return csvEscape(preview.text);
-    });
-    lines.push(cells.join(","));
+
+// src/backup-planner.ts
+var WRITE_KEYWORDS = /* @__PURE__ */ new Set([
+  "UPDATE",
+  "UPSERT",
+  "REPLACE",
+  "MERGE",
+  "DELETE"
+]);
+var MERGE_MODIFY_ACTIONS = /* @__PURE__ */ new Set(["UPDATE", "DELETE"]);
+function trimStatementSql(sql) {
+  const trimmed = sql.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charAt(end - 1) === ";") {
+    end -= 1;
   }
-  return { text: lines.join("\r\n"), truncatedCells };
+  return trimmed.slice(0, end).trim();
 }
-function formatResult(result, format, compactColumn) {
-  switch (format) {
-    case "table":
-      return formatTable(result);
-    case "json":
-      return formatJson(result);
-    case "json-compact":
-      return formatJsonCompact(result, compactColumn);
-    case "csv":
-      return formatCsv(result);
+function isMergeClauseStart(tokens, index) {
+  if (tokens[index]?.keyword !== "WHEN") {
+    return false;
   }
+  return tokens[index + 1]?.keyword === "MATCHED" || tokens[index + 1]?.keyword === "NOT" && tokens[index + 2]?.keyword === "MATCHED";
 }
-
-// src/003-backup-sql-parser.ts
-function isIdentifierChar(char) {
-  return char !== void 0 && /[A-Za-z0-9_$#]/.test(char);
-}
-function skipQuotedText(sql, index) {
-  const quote = sql[index];
-  let cursor = index + 1;
-  while (cursor < sql.length) {
-    if (sql[cursor] === quote) {
-      if (sql[cursor + 1] === quote) {
-        cursor += 2;
-        continue;
-      }
-      return cursor + 1;
+function mergeClauseIndexes(tokens, start) {
+  const indexes = [];
+  for (let index = start; index < tokens.length; index += 1) {
+    if (isMergeClauseStart(tokens, index)) {
+      indexes.push(index);
     }
-    cursor += 1;
   }
-  return cursor;
+  return indexes;
 }
-function skipLineComment2(sql, index) {
-  let cursor = index + 2;
-  while (cursor < sql.length && sql[cursor] !== "\n") {
-    cursor += 1;
-  }
-  return cursor;
+function selectParamsAfterWhere(statementSql, whereIndex, params) {
+  return params.slice(countPlaceholders(statementSql.slice(0, whereIndex)));
 }
-function skipBlockComment2(sql, index) {
-  let cursor = index + 2;
-  while (cursor < sql.length && !(sql[cursor] === "*" && sql[cursor + 1] === "/")) {
-    cursor += 1;
+function buildSelectPlan(operation, statementSql, targetSql, whereIndex, params) {
+  const target = targetSql.trim();
+  if (target.length === 0) {
+    throw new QueryError(`${operation.toUpperCase()} backup requires a target table`);
   }
-  return Math.min(cursor + 2, sql.length);
+  if (whereIndex === void 0) {
+    return { operation, statementSql, selectSql: `SELECT * FROM ${target}`, selectParams: [] };
+  }
+  const whereSql = statementSql.slice(whereIndex + "WHERE".length).trim();
+  if (whereSql.length === 0) {
+    throw new QueryError(`${operation.toUpperCase()} backup requires a non-empty WHERE clause`);
+  }
+  return {
+    operation,
+    statementSql,
+    selectSql: `SELECT * FROM ${target} WHERE ${whereSql}`,
+    selectParams: selectParamsAfterWhere(statementSql, whereIndex, params)
+  };
 }
-function skipNonCode(sql, index) {
-  const char = sql[index];
-  if (char === "'" || char === '"') {
-    return skipQuotedText(sql, index);
+function buildUpdateBackupPlan(statementSql, params) {
+  const updateIndex = findTopLevelKeyword(statementSql, "UPDATE");
+  const setIndex = updateIndex === void 0 ? void 0 : findTopLevelKeyword(statementSql, "SET", updateIndex + "UPDATE".length);
+  if (updateIndex === void 0 || setIndex === void 0) {
+    throw new QueryError("UPDATE backup requires UPDATE <target> SET syntax");
   }
-  if (char === "-" && sql[index + 1] === "-") {
-    return skipLineComment2(sql, index);
+  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", setIndex + "SET".length);
+  return buildSelectPlan(
+    "update",
+    statementSql,
+    statementSql.slice(updateIndex + "UPDATE".length, setIndex),
+    whereIndex,
+    params
+  );
+}
+function buildUpsertBackupPlan(statementSql, params, keyword) {
+  const operation = keyword === "UPSERT" ? "upsert" : "replace";
+  const keywordIndex = findTopLevelKeyword(statementSql, keyword);
+  const target = keywordIndex === void 0 ? void 0 : readQualifiedTarget(statementSql, keywordIndex + keyword.length, statementSql.length);
+  if (keywordIndex === void 0 || target === void 0) {
+    throw new BackupRequiredError(
+      `${keyword} write refused: cannot derive a trustworthy backup target`
+    );
   }
-  if (char === "/" && sql[index + 1] === "*") {
-    return skipBlockComment2(sql, index);
+  const valuesIndex = findTopLevelKeyword(statementSql, "VALUES", target.end);
+  if (valuesIndex === void 0) {
+    const selectIndex = findTopLevelKeyword(statementSql, "SELECT", target.end);
+    const withIndex = findTopLevelKeyword(statementSql, "WITH", target.end);
+    if (selectIndex === void 0 && withIndex === void 0) {
+      throw new BackupRequiredError(
+        `${keyword} write refused: expected VALUES, WITH PRIMARY KEY, or a subquery`
+      );
+    }
+    return buildSelectPlan(operation, statementSql, target.sql, void 0, params);
   }
-  return void 0;
+  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", valuesIndex + "VALUES".length);
+  return buildSelectPlan(operation, statementSql, target.sql, whereIndex, params);
 }
-function skipTrivia(sql, start, end) {
-  let index = start;
-  while (index < end) {
-    if (/\s/.test(sql.charAt(index))) {
-      index += 1;
-      continue;
+function mergeTargetReference(statementSql, target, usingStart) {
+  let suffix = statementSql.slice(target.end, usingStart).trim();
+  if (suffix.length === 0) {
+    return target.reference;
+  }
+  if (/^PARTITION\b/i.test(suffix)) {
+    const open2 = suffix.indexOf("(");
+    if (open2 === -1) {
+      return void 0;
     }
-    if (sql[index] === "-" && sql[index + 1] === "-") {
-      index = skipLineComment2(sql, index);
-      continue;
+    const close = findTopLevelChar(suffix, ")", open2 + 1, suffix.length);
+    if (close === void 0) {
+      return void 0;
     }
-    if (sql[index] === "/" && sql[index + 1] === "*") {
-      index = skipBlockComment2(sql, index);
-      continue;
+    suffix = suffix.slice(close + 1).trim();
+    if (suffix.length === 0) {
+      return target.reference;
     }
-    break;
-  }
-  return index;
-}
-function readIdentifierPart(sql, start, end) {
-  const index = skipTrivia(sql, start, end);
-  if (sql[index] === '"') {
-    const next2 = skipQuotedText(sql, index);
-    return next2 <= end && sql[next2 - 1] === '"' ? { sql: sql.slice(index, next2), end: next2 } : void 0;
   }
-  if (!/[A-Za-z_#$]/.test(sql.charAt(index))) {
+  suffix = suffix.replace(/^AS\b/i, "").trim();
+  const alias = readIdentifierPart(suffix, 0, suffix.length);
+  if (alias === void 0 || skipTrivia(suffix, alias.end, suffix.length) !== suffix.length) {
     return void 0;
   }
-  let next = index + 1;
-  while (next < end && /[A-Za-z0-9_#$]/.test(sql.charAt(next))) {
-    next += 1;
-  }
-  return { sql: sql.slice(index, next), end: next };
+  return alias.sql;
 }
-function readQualifiedTarget(sql, start, end) {
-  const first = readIdentifierPart(sql, start, end);
-  if (first === void 0) {
-    return void 0;
-  }
-  const parts = [first.sql];
-  let cursor = first.end;
-  while (parts.length < 3) {
-    const dot = skipTrivia(sql, cursor, end);
-    if (sql[dot] !== ".") {
-      break;
-    }
-    const part = readIdentifierPart(sql, dot + 1, end);
-    if (part === void 0) {
-      return void 0;
-    }
-    parts.push(part.sql);
-    cursor = part.end;
-  }
-  return { sql: parts.join("."), reference: parts.at(-1) ?? first.sql, end: cursor };
+function paramsInRange(sql, params, start, end) {
+  const offset = countPlaceholders(sql.slice(0, start));
+  const length = countPlaceholders(sql.slice(start, end));
+  return params.slice(offset, offset + length);
 }
-function topLevelTokens(sql) {
-  const tokens = [];
-  let index = 0;
-  let depth = 0;
-  while (index < sql.length) {
-    const skipped = skipNonCode(sql, index);
-    if (skipped !== void 0) {
-      index = skipped;
-      continue;
-    }
-    const char = sql.charAt(index);
-    if (char === "(") {
-      depth += 1;
-      index += 1;
-      continue;
-    }
-    if (char === ")") {
-      depth = Math.max(0, depth - 1);
-      index += 1;
-      continue;
-    }
-    if (!/[A-Za-z_#$]/.test(char)) {
-      index += 1;
-      continue;
-    }
-    let end = index + 1;
-    while (end < sql.length && /[A-Za-z0-9_#$]/.test(sql.charAt(end))) {
-      end += 1;
-    }
-    if (depth === 0) {
-      tokens.push({ keyword: sql.slice(index, end).toUpperCase(), start: index, end });
-    }
-    index = end;
-  }
-  return tokens;
+function wholeTargetPlan(operation, statementSql, target) {
+  return buildSelectPlan(operation, statementSql, target.sql, void 0, []);
 }
-function findToken(tokens, keyword, start = 0) {
-  for (let index = start; index < tokens.length; index += 1) {
-    if (tokens[index]?.keyword === keyword) {
-      return index;
-    }
+function readRequiredMergeToken(tokens, keyword, start) {
+  const index = findToken(tokens, keyword, start);
+  const token = index === void 0 ? void 0 : tokens[index];
+  if (index === void 0 || token === void 0) {
+    throw new BackupRequiredError(
+      "MERGE write refused: cannot derive a trustworthy backup target"
+    );
   }
-  return void 0;
-}
-function keywordMatches(sql, index, keyword) {
-  const end = index + keyword.length;
-  return sql.slice(index, end).toUpperCase() === keyword && !isIdentifierChar(sql[index - 1]) && !isIdentifierChar(sql[end]);
+  return { index, token };
 }
-function findTopLevelKeyword(sql, keyword, startIndex = 0) {
-  let index = startIndex;
-  let depth = 0;
-  while (index < sql.length) {
-    const skipped = skipNonCode(sql, index);
-    if (skipped !== void 0) {
-      index = skipped;
-      continue;
-    }
-    const char = sql[index];
-    if (char === "(") {
-      depth += 1;
-    } else if (char === ")" && depth > 0) {
-      depth -= 1;
-    } else if (depth === 0 && keywordMatches(sql, index, keyword)) {
-      return index;
-    }
-    index += 1;
+function parseMerge(statementSql) {
+  const tokens = topLevelTokens(statementSql);
+  const into = readRequiredMergeToken(tokens, "INTO", 1);
+  const using = readRequiredMergeToken(tokens, "USING", into.index + 1);
+  const on = readRequiredMergeToken(tokens, "ON", using.index + 1);
+  const target = readQualifiedTarget(statementSql, into.token.end, using.token.start);
+  if (target === void 0) {
+    throw new BackupRequiredError(
+      "MERGE write refused: cannot derive a trustworthy backup target"
+    );
   }
-  return void 0;
-}
-function findTopLevelChar(sql, target, startIndex, endIndex) {
-  let index = startIndex;
-  let depth = 0;
-  while (index < endIndex) {
-    const skipped = skipNonCode(sql, index);
-    if (skipped !== void 0) {
-      index = skipped;
-      continue;
-    }
-    const char = sql[index];
-    if (char === target && depth === 0) {
-      return index;
-    }
-    if (char === "(") {
-      depth += 1;
-    } else if (char === ")" && depth > 0) {
-      depth -= 1;
-    }
-    index += 1;
+  const clauseIndexes = mergeClauseIndexes(tokens, on.index + 1);
+  if (clauseIndexes.length === 0) {
+    throw new BackupRequiredError("MERGE write refused: no supported WHEN clause was found");
   }
-  return void 0;
+  const firstClause = tokens[clauseIndexes[0] ?? 0];
+  return {
+    tokens,
+    into: into.token,
+    using: using.token,
+    on: on.token,
+    target,
+    clauseIndexes,
+    matchedIndexes: clauseIndexes.filter((index) => tokens[index + 1]?.keyword === "MATCHED"),
+    targetClause: statementSql.slice(into.token.end, using.token.start).trim(),
+    sourceClause: statementSql.slice(using.token.end, on.token.start).trim(),
+    onCondition: statementSql.slice(on.token.end, firstClause?.start).trim()
+  };
 }
-
-// src/statements.ts
-var SELECT_KEYWORDS = /* @__PURE__ */ new Set(["SELECT", "WITH"]);
-var DML_KEYWORDS = /* @__PURE__ */ new Set(["INSERT", "UPDATE", "DELETE", "MERGE", "UPSERT", "REPLACE"]);
-var DDL_KEYWORDS = /* @__PURE__ */ new Set(["CREATE", "DROP", "ALTER", "TRUNCATE", "RENAME", "COMMENT"]);
-function firstKeyword(sql) {
-  let index = 0;
-  while (index < sql.length) {
-    const char = sql.charAt(index);
-    if (char.trim().length === 0) {
-      index += 1;
-      continue;
-    }
-    if (char === "-" && sql[index + 1] === "-") {
-      index += 2;
-      while (index < sql.length && sql[index] !== "\n") {
-        index += 1;
-      }
-      continue;
-    }
-    if (char === "/" && sql[index + 1] === "*") {
-      const commentEnd = sql.indexOf("*/", index + 2);
-      if (commentEnd === -1) {
-        return "";
-      }
-      index = commentEnd + 2;
-      continue;
-    }
-    break;
+function readMatchedActionTokens(tokens, matchedIndex) {
+  const thenIndex = findToken(tokens, "THEN", matchedIndex + 2);
+  if (thenIndex === void 0) {
+    return void 0;
   }
-  let keywordEnd = index;
-  while (keywordEnd < sql.length) {
-    const code = sql.charCodeAt(keywordEnd);
-    const isUpperCase = code >= 65 && code <= 90;
-    const isLowerCase = code >= 97 && code <= 122;
-    if (!isUpperCase && !isLowerCase) {
-      break;
-    }
-    keywordEnd += 1;
+  const thenToken = tokens[thenIndex];
+  const actionToken = tokens[thenIndex + 1];
+  const matchedToken = tokens[matchedIndex + 1];
+  if (thenToken === void 0 || actionToken === void 0 || matchedToken === void 0) {
+    return void 0;
   }
-  return sql.slice(index, keywordEnd).toUpperCase();
+  if (!MERGE_MODIFY_ACTIONS.has(actionToken.keyword)) {
+    return void 0;
+  }
+  const clauseToken = tokens[matchedIndex];
+  return {
+    thenToken,
+    conditionToken: tokens[matchedIndex + 2],
+    clauseStart: clauseToken === void 0 ? 0 : clauseToken.start
+  };
 }
-function classifyStatement(sql) {
-  const keyword = firstKeyword(sql);
-  if (SELECT_KEYWORDS.has(keyword)) {
-    return "select";
+function parseMatchedClause(statementSql, params, tokens, matchedIndex) {
+  const action = readMatchedActionTokens(tokens, matchedIndex);
+  if (action?.conditionToken === void 0) {
+    return void 0;
   }
-  if (DML_KEYWORDS.has(keyword)) {
-    return "dml";
+  if (action.conditionToken.keyword === "THEN") {
+    return { clauseStart: action.clauseStart, matchedCondition: "", conditionParams: [] };
   }
-  if (DDL_KEYWORDS.has(keyword)) {
-    return "ddl";
+  if (action.conditionToken.keyword !== "AND") {
+    return void 0;
   }
-  return "unknown";
+  return {
+    clauseStart: action.clauseStart,
+    matchedCondition: statementSql.slice(action.conditionToken.end, action.thenToken.start).trim(),
+    conditionParams: paramsInRange(
+      statementSql,
+      params,
+      action.conditionToken.end,
+      action.thenToken.start
+    )
+  };
 }
-function quoteIdentifier(identifier) {
-  if (identifier.length === 0) {
-    throw new QueryError("A SQL identifier must not be empty");
-  }
-  if (identifier.includes("\0")) {
-    throw new QueryError("A SQL identifier must not contain a NUL character");
+function buildExactMergePlan(statementSql, params, merge, matchedIndex) {
+  const targetReference = mergeTargetReference(statementSql, merge.target, merge.using.start);
+  const matchedClause = parseMatchedClause(statementSql, params, merge.tokens, matchedIndex);
+  if (targetReference === void 0 || matchedClause === void 0) {
+    return void 0;
   }
-  return `"${identifier.replace(/"/g, '""')}"`;
-}
-function qualifiedName(schema, table) {
-  return `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
+  const sourceParams = paramsInRange(
+    statementSql,
+    params,
+    merge.using.end,
+    matchedClause.clauseStart
+  );
+  const conditionSql = matchedClause.matchedCondition.length === 0 ? "" : ` AND (${matchedClause.matchedCondition})`;
+  return {
+    operation: "merge",
+    statementSql,
+    selectSql: `SELECT ${targetReference}.* FROM ${merge.targetClause} WHERE EXISTS (SELECT 1 FROM ${merge.sourceClause} WHERE (${merge.onCondition})${conditionSql})`,
+    selectParams: [...sourceParams, ...matchedClause.conditionParams]
+  };
 }
-function countPlaceholders(sql) {
-  let count = 0;
-  let index = 0;
-  const length = sql.length;
-  while (index < length) {
-    const char = sql[index];
-    if (char === "'" || char === '"') {
-      const quote = char;
-      index += 1;
-      while (index < length) {
-        if (sql[index] === quote) {
-          if (sql[index + 1] === quote) {
-            index += 2;
-            continue;
-          }
-          index += 1;
-          break;
-        }
-        index += 1;
-      }
-      continue;
-    }
-    if (char === "-" && sql[index + 1] === "-") {
-      index += 2;
-      while (index < length && sql[index] !== "\n") {
-        index += 1;
-      }
-      continue;
-    }
-    if (char === "/" && sql[index + 1] === "*") {
-      index += 2;
-      while (index < length && !(sql[index] === "*" && sql[index + 1] === "/")) {
-        index += 1;
-      }
-      index += 2;
-      continue;
-    }
-    if (char === "?") {
-      count += 1;
-    }
-    index += 1;
-  }
-  return count;
-}
-function assertParamArity(sql, params) {
-  const expected = countPlaceholders(sql);
-  if (expected !== params.length) {
-    throw new QueryError(
-      `SQL expects ${String(expected)} bound parameter(s) but received ${String(params.length)} value(s)`
-    );
-  }
-}
-
-// src/001-backup-planner.ts
-var WRITE_KEYWORDS = /* @__PURE__ */ new Set([
-  "UPDATE",
-  "UPSERT",
-  "REPLACE",
-  "MERGE",
-  "DELETE"
-]);
-var MERGE_MODIFY_ACTIONS = /* @__PURE__ */ new Set(["UPDATE", "DELETE"]);
-function trimStatementSql(sql) {
-  const trimmed = sql.trim();
-  let end = trimmed.length;
-  while (end > 0 && trimmed.charAt(end - 1) === ";") {
-    end -= 1;
-  }
-  return trimmed.slice(0, end).trim();
-}
-function isMergeClauseStart(tokens, index) {
-  if (tokens[index]?.keyword !== "WHEN") {
-    return false;
-  }
-  return tokens[index + 1]?.keyword === "MATCHED" || tokens[index + 1]?.keyword === "NOT" && tokens[index + 2]?.keyword === "MATCHED";
-}
-function mergeClauseIndexes(tokens, start) {
-  const indexes = [];
-  for (let index = start; index < tokens.length; index += 1) {
-    if (isMergeClauseStart(tokens, index)) {
-      indexes.push(index);
-    }
-  }
-  return indexes;
-}
-function selectParamsAfterWhere(statementSql, whereIndex, params) {
-  return params.slice(countPlaceholders(statementSql.slice(0, whereIndex)));
-}
-function buildSelectPlan(operation, statementSql, targetSql, whereIndex, params) {
-  const target = targetSql.trim();
-  if (target.length === 0) {
-    throw new QueryError(`${operation.toUpperCase()} backup requires a target table`);
+function buildMergeBackupPlan(statementSql, params) {
+  const merge = parseMerge(statementSql);
+  if (merge.matchedIndexes.length === 0) {
+    return void 0;
   }
-  if (whereIndex === void 0) {
-    return { operation, statementSql, selectSql: `SELECT * FROM ${target}`, selectParams: [] };
+  if (merge.matchedIndexes.length > 1) {
+    return wholeTargetPlan("merge", statementSql, merge.target);
   }
-  const whereSql = statementSql.slice(whereIndex + "WHERE".length).trim();
-  if (whereSql.length === 0) {
-    throw new QueryError(`${operation.toUpperCase()} backup requires a non-empty WHERE clause`);
+  if (merge.sourceClause.length === 0 || merge.onCondition.length === 0) {
+    return wholeTargetPlan("merge", statementSql, merge.target);
   }
-  return {
-    operation,
-    statementSql,
-    selectSql: `SELECT * FROM ${target} WHERE ${whereSql}`,
-    selectParams: selectParamsAfterWhere(statementSql, whereIndex, params)
-  };
+  const matchedIndex = merge.matchedIndexes[0] ?? 0;
+  return buildExactMergePlan(statementSql, params, merge, matchedIndex) ?? wholeTargetPlan("merge", statementSql, merge.target);
 }
-function buildUpdateBackupPlan(statementSql, params) {
-  const updateIndex = findTopLevelKeyword(statementSql, "UPDATE");
-  const setIndex = updateIndex === void 0 ? void 0 : findTopLevelKeyword(statementSql, "SET", updateIndex + "UPDATE".length);
-  if (updateIndex === void 0 || setIndex === void 0) {
-    throw new QueryError("UPDATE backup requires UPDATE <target> SET syntax");
+function buildDeleteBackupPlan(statementSql, params) {
+  const deleteIndex = findTopLevelKeyword(statementSql, "DELETE");
+  const fromIndex = deleteIndex === void 0 ? void 0 : findTopLevelKeyword(statementSql, "FROM", deleteIndex + "DELETE".length);
+  if (deleteIndex === void 0 || fromIndex === void 0) {
+    throw new QueryError("DELETE backup requires DELETE FROM <target> syntax");
   }
-  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", setIndex + "SET".length);
+  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", fromIndex + "FROM".length);
+  const targetEnd = whereIndex ?? statementSql.length;
   return buildSelectPlan(
-    "update",
+    "delete",
     statementSql,
-    statementSql.slice(updateIndex + "UPDATE".length, setIndex),
+    statementSql.slice(fromIndex + "FROM".length, targetEnd),
     whereIndex,
     params
   );
 }
-function buildUpsertBackupPlan(statementSql, params, keyword) {
-  const operation = keyword === "UPSERT" ? "upsert" : "replace";
-  const keywordIndex = findTopLevelKeyword(statementSql, keyword);
-  const target = keywordIndex === void 0 ? void 0 : readQualifiedTarget(statementSql, keywordIndex + keyword.length, statementSql.length);
-  if (keywordIndex === void 0 || target === void 0) {
-    throw new BackupRequiredError(
-      `${keyword} write refused: cannot derive a trustworthy backup target`
-    );
+function isWriteKeyword(keyword) {
+  return WRITE_KEYWORDS.has(keyword);
+}
+function buildMergeWriteBackupPlan(statementSql, params) {
+  const secondKeyword = topLevelTokens(statementSql)[1]?.keyword;
+  if (secondKeyword === "DELTA") {
+    return void 0;
   }
-  const valuesIndex = findTopLevelKeyword(statementSql, "VALUES", target.end);
-  if (valuesIndex === void 0) {
-    const selectIndex = findTopLevelKeyword(statementSql, "SELECT", target.end);
-    const withIndex = findTopLevelKeyword(statementSql, "WITH", target.end);
-    if (selectIndex === void 0 && withIndex === void 0) {
-      throw new BackupRequiredError(
-        `${keyword} write refused: expected VALUES, WITH PRIMARY KEY, or a subquery`
-      );
-    }
-    return buildSelectPlan(operation, statementSql, target.sql, void 0, params);
+  if (secondKeyword !== "INTO") {
+    throw new BackupRequiredError("MERGE write refused: expected MERGE INTO syntax");
   }
-  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", valuesIndex + "VALUES".length);
-  return buildSelectPlan(operation, statementSql, target.sql, whereIndex, params);
+  return buildMergeBackupPlan(statementSql, params);
 }
-function mergeTargetReference(statementSql, target, usingStart) {
-  let suffix = statementSql.slice(target.end, usingStart).trim();
-  if (suffix.length === 0) {
-    return target.reference;
+function dispatchWriteBackupPlan(keyword, statementSql, params) {
+  switch (keyword) {
+    case "UPDATE":
+      return buildUpdateBackupPlan(statementSql, params);
+    case "UPSERT":
+    case "REPLACE":
+      return buildUpsertBackupPlan(statementSql, params, keyword);
+    case "MERGE":
+      return buildMergeWriteBackupPlan(statementSql, params);
+    case "DELETE":
+      return buildDeleteBackupPlan(statementSql, params);
   }
-  if (/^PARTITION\b/i.test(suffix)) {
-    const open = suffix.indexOf("(");
-    if (open === -1) {
-      return void 0;
-    }
-    const close = findTopLevelChar(suffix, ")", open + 1, suffix.length);
-    if (close === void 0) {
-      return void 0;
-    }
-    suffix = suffix.slice(close + 1).trim();
-    if (suffix.length === 0) {
-      return target.reference;
-    }
+}
+function buildWriteBackupPlan(sql, params = []) {
+  const trimmed = trimStatementSql(sql);
+  const leading = firstKeyword(trimmed);
+  const withResolved = leading === "WITH" ? resolveWithStatement(trimmed) : void 0;
+  if (leading === "WITH" && withResolved === void 0) {
+    throw new BackupRequiredError(
+      "WITH write refused: cannot determine the statement's real trailing keyword"
+    );
   }
-  suffix = suffix.replace(/^AS\b/i, "").trim();
-  const alias = readIdentifierPart(suffix, 0, suffix.length);
-  if (alias === void 0 || skipTrivia(suffix, alias.end, suffix.length) !== suffix.length) {
+  const keyword = withResolved?.keyword ?? leading;
+  if (!isWriteKeyword(keyword)) {
     return void 0;
   }
-  return alias.sql;
+  const startIndex = withResolved?.index ?? 0;
+  const statementSql = trimmed.slice(startIndex);
+  const slicedParams = params.slice(countPlaceholders(trimmed.slice(0, startIndex)));
+  assertParamArity(statementSql, slicedParams);
+  const plan = dispatchWriteBackupPlan(keyword, statementSql, slicedParams);
+  return plan === void 0 ? void 0 : { ...plan, statementSql: trimmed };
 }
-function paramsInRange(sql, params, start, end) {
-  const offset = countPlaceholders(sql.slice(0, start));
-  const length = countPlaceholders(sql.slice(start, end));
-  return params.slice(offset, offset + length);
+
+// src/backup.ts
+var SAPTOOLS_DIR_NAME = ".saptools";
+var CF_HANA_DIR_NAME = "cf-hana";
+var BACKUPS_DIR_NAME = "backups";
+function defaultSaptoolsRoot() {
+  return join(homedir(), SAPTOOLS_DIR_NAME);
 }
-function wholeTargetPlan(operation, statementSql, target) {
-  return buildSelectPlan(operation, statementSql, target.sql, void 0, []);
+function backupTimestamp(now) {
+  return now.toISOString().replace(/:/g, "").replace(".", "");
 }
-function readRequiredMergeToken(tokens, keyword, start) {
-  const index = findToken(tokens, keyword, start);
-  const token = index === void 0 ? void 0 : tokens[index];
-  if (index === void 0 || token === void 0) {
-    throw new BackupRequiredError(
-      "MERGE write refused: cannot derive a trustworthy backup target"
-    );
-  }
-  return { index, token };
+function backupMonth(now) {
+  const year = String(now.getUTCFullYear());
+  const month = String(now.getUTCMonth() + 1).padStart(2, "0");
+  return `${year}${month}`;
 }
-function parseMerge(statementSql) {
-  const tokens = topLevelTokens(statementSql);
-  const into = readRequiredMergeToken(tokens, "INTO", 1);
-  const using = readRequiredMergeToken(tokens, "USING", into.index + 1);
-  const on = readRequiredMergeToken(tokens, "ON", using.index + 1);
-  const target = readQualifiedTarget(statementSql, into.token.end, using.token.start);
-  if (target === void 0) {
+function sanitizePathPart(value) {
+  const trimmed = value?.trim() ?? "";
+  const normalized = trimmed.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return normalized.length > 0 ? normalized : "unknown-target";
+}
+function backupBaseName(input, now) {
+  return [sanitizePathPart(input.selector), input.operation, backupTimestamp(now)].join("-");
+}
+function cfHanaBackupRoot(saptoolsRoot) {
+  return join(saptoolsRoot ?? defaultSaptoolsRoot(), CF_HANA_DIR_NAME, BACKUPS_DIR_NAME);
+}
+async function writeSqlBackup(input, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const directory = join(cfHanaBackupRoot(options.saptoolsRoot), backupMonth(now));
+  const baseName = backupBaseName(input, now);
+  const statementPath = join(directory, `${baseName}.statement.sql`);
+  const backupPath = join(directory, `${baseName}.sql`);
+  const metadataPath = join(directory, `${baseName}.json`);
+  const metadata = {
+    selector: input.selector ?? null,
+    operation: input.operation,
+    statementPath,
+    backupPath,
+    rowCount: input.result.rowCount,
+    createdAt: now.toISOString()
+  };
+  const csv2 = formatCsv(input.result);
+  if (Buffer.byteLength(csv2) > (options.maxBytes ?? MAX_RESULT_STORE_BYTES)) {
     throw new BackupRequiredError(
-      "MERGE write refused: cannot derive a trustworthy backup target"
+      "Write backup exceeds the storage limit; the write was refused"
     );
   }
-  const clauseIndexes = mergeClauseIndexes(tokens, on.index + 1);
-  if (clauseIndexes.length === 0) {
-    throw new BackupRequiredError("MERGE write refused: no supported WHEN clause was found");
-  }
-  const firstClause = tokens[clauseIndexes[0] ?? 0];
-  return {
-    tokens,
-    into: into.token,
-    using: using.token,
-    on: on.token,
-    target,
-    clauseIndexes,
-    matchedIndexes: clauseIndexes.filter((index) => tokens[index + 1]?.keyword === "MATCHED"),
-    targetClause: statementSql.slice(into.token.end, using.token.start).trim(),
-    sourceClause: statementSql.slice(using.token.end, on.token.start).trim(),
-    onCondition: statementSql.slice(on.token.end, firstClause?.start).trim()
-  };
-}
-function readMatchedActionTokens(tokens, matchedIndex) {
-  const thenIndex = findToken(tokens, "THEN", matchedIndex + 2);
-  if (thenIndex === void 0) {
-    return void 0;
-  }
-  const thenToken = tokens[thenIndex];
-  const actionToken = tokens[thenIndex + 1];
-  const matchedToken = tokens[matchedIndex + 1];
-  if (thenToken === void 0 || actionToken === void 0 || matchedToken === void 0) {
-    return void 0;
-  }
-  if (!MERGE_MODIFY_ACTIONS.has(actionToken.keyword)) {
-    return void 0;
-  }
-  const clauseToken = tokens[matchedIndex];
-  return {
-    thenToken,
-    conditionToken: tokens[matchedIndex + 2],
-    clauseStart: clauseToken === void 0 ? 0 : clauseToken.start
-  };
-}
-function parseMatchedClause(statementSql, params, tokens, matchedIndex) {
-  const action = readMatchedActionTokens(tokens, matchedIndex);
-  if (action?.conditionToken === void 0) {
-    return void 0;
-  }
-  if (action.conditionToken.keyword === "THEN") {
-    return { clauseStart: action.clauseStart, matchedCondition: "", conditionParams: [] };
-  }
-  if (action.conditionToken.keyword !== "AND") {
-    return void 0;
-  }
-  return {
-    clauseStart: action.clauseStart,
-    matchedCondition: statementSql.slice(action.conditionToken.end, action.thenToken.start).trim(),
-    conditionParams: paramsInRange(
-      statementSql,
-      params,
-      action.conditionToken.end,
-      action.thenToken.start
-    )
-  };
-}
-function buildExactMergePlan(statementSql, params, merge, matchedIndex) {
-  const targetReference = mergeTargetReference(statementSql, merge.target, merge.using.start);
-  const matchedClause = parseMatchedClause(statementSql, params, merge.tokens, matchedIndex);
-  if (targetReference === void 0 || matchedClause === void 0) {
-    return void 0;
-  }
-  const sourceParams = paramsInRange(
-    statementSql,
-    params,
-    merge.using.end,
-    matchedClause.clauseStart
-  );
-  const conditionSql = matchedClause.matchedCondition.length === 0 ? "" : ` AND (${matchedClause.matchedCondition})`;
-  return {
-    operation: "merge",
-    statementSql,
-    selectSql: `SELECT ${targetReference}.* FROM ${merge.targetClause} WHERE EXISTS (SELECT 1 FROM ${merge.sourceClause} WHERE (${merge.onCondition})${conditionSql})`,
-    selectParams: [...sourceParams, ...matchedClause.conditionParams]
-  };
-}
-function buildMergeBackupPlan(statementSql, params) {
-  const merge = parseMerge(statementSql);
-  if (merge.matchedIndexes.length === 0) {
-    return void 0;
-  }
-  if (merge.matchedIndexes.length > 1) {
-    return wholeTargetPlan("merge", statementSql, merge.target);
-  }
-  if (merge.sourceClause.length === 0 || merge.onCondition.length === 0) {
-    return wholeTargetPlan("merge", statementSql, merge.target);
-  }
-  const matchedIndex = merge.matchedIndexes[0] ?? 0;
-  return buildExactMergePlan(statementSql, params, merge, matchedIndex) ?? wholeTargetPlan("merge", statementSql, merge.target);
-}
-function buildDeleteBackupPlan(statementSql, params) {
-  const deleteIndex = findTopLevelKeyword(statementSql, "DELETE");
-  const fromIndex = deleteIndex === void 0 ? void 0 : findTopLevelKeyword(statementSql, "FROM", deleteIndex + "DELETE".length);
-  if (deleteIndex === void 0 || fromIndex === void 0) {
-    throw new QueryError("DELETE backup requires DELETE FROM <target> syntax");
-  }
-  const whereIndex = findTopLevelKeyword(statementSql, "WHERE", fromIndex + "FROM".length);
-  const targetEnd = whereIndex ?? statementSql.length;
-  return buildSelectPlan(
-    "delete",
-    statementSql,
-    statementSql.slice(fromIndex + "FROM".length, targetEnd),
-    whereIndex,
-    params
-  );
-}
-function isWriteKeyword(keyword) {
-  return WRITE_KEYWORDS.has(keyword);
-}
-function buildMergeWriteBackupPlan(statementSql, params) {
-  const secondKeyword = topLevelTokens(statementSql)[1]?.keyword;
-  if (secondKeyword === "DELTA") {
-    return void 0;
-  }
-  if (secondKeyword !== "INTO") {
-    throw new BackupRequiredError("MERGE write refused: expected MERGE INTO syntax");
-  }
-  return buildMergeBackupPlan(statementSql, params);
-}
-function dispatchWriteBackupPlan(keyword, statementSql, params) {
-  switch (keyword) {
-    case "UPDATE":
-      return buildUpdateBackupPlan(statementSql, params);
-    case "UPSERT":
-    case "REPLACE":
-      return buildUpsertBackupPlan(statementSql, params, keyword);
-    case "MERGE":
-      return buildMergeWriteBackupPlan(statementSql, params);
-    case "DELETE":
-      return buildDeleteBackupPlan(statementSql, params);
-  }
-}
-function buildWriteBackupPlan(sql, params = []) {
-  const statementSql = trimStatementSql(sql);
-  const keyword = firstKeyword(statementSql);
-  if (!isWriteKeyword(keyword)) {
-    return void 0;
-  }
-  assertParamArity(statementSql, params);
-  return dispatchWriteBackupPlan(keyword, statementSql, params);
-}
-
-// src/backup.ts
-var SAPTOOLS_DIR_NAME = ".saptools";
-var CF_HANA_DIR_NAME = "cf-hana";
-var BACKUPS_DIR_NAME = "backups";
-function defaultSaptoolsRoot() {
-  return join2(homedir2(), SAPTOOLS_DIR_NAME);
-}
-function backupTimestamp(now) {
-  return now.toISOString().replace(/:/g, "").replace(".", "");
-}
-function backupMonth(now) {
-  const year = String(now.getUTCFullYear());
-  const month = String(now.getUTCMonth() + 1).padStart(2, "0");
-  return `${year}${month}`;
-}
-function sanitizePathPart(value) {
-  const trimmed = value?.trim() ?? "";
-  const normalized = trimmed.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-  return normalized.length > 0 ? normalized : "unknown-target";
-}
-function backupBaseName(input, now) {
-  return [sanitizePathPart(input.selector), input.operation, backupTimestamp(now)].join("-");
-}
-function cfHanaBackupRoot(saptoolsRoot) {
-  return join2(saptoolsRoot ?? defaultSaptoolsRoot(), CF_HANA_DIR_NAME, BACKUPS_DIR_NAME);
-}
-async function writeSqlBackup(input, options = {}) {
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const directory = join2(cfHanaBackupRoot(options.saptoolsRoot), backupMonth(now));
-  const baseName = backupBaseName(input, now);
-  const statementPath = join2(directory, `${baseName}.statement.sql`);
-  const backupPath = join2(directory, `${baseName}.sql`);
-  const metadataPath = join2(directory, `${baseName}.json`);
-  const metadata = {
-    selector: input.selector ?? null,
-    operation: input.operation,
-    statementPath,
-    backupPath,
-    rowCount: input.result.rowCount,
-    createdAt: now.toISOString()
-  };
-  const csv2 = formatCsv(input.result);
-  if (Buffer.byteLength(csv2) > (options.maxBytes ?? MAX_RESULT_STORE_BYTES)) {
-    throw new BackupRequiredError(
-      "Write backup exceeds the storage limit; the write was refused"
-    );
-  }
-  await mkdir2(directory, { recursive: true, mode: 448 });
+  await mkdir(directory, { recursive: true, mode: 448 });
   await Promise.all([
-    writeFile2(statementPath, `${input.statementSql}
+    writeFile(statementPath, `${input.statementSql}
 `, { encoding: "utf8", mode: 384 }),
-    writeFile2(backupPath, csv2, { encoding: "utf8", mode: 384 }),
-    writeFile2(metadataPath, `${JSON.stringify(metadata, null, 2)}
+    writeFile(backupPath, csv2, { encoding: "utf8", mode: 384 }),
+    writeFile(metadataPath, `${JSON.stringify(metadata, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384
@@ -1681,9 +1323,9 @@ async function listColumns(connection, schema, table) {
 
 // src/cf.ts
 import { execFile } from "child_process";
-import { mkdtemp, rm as rm2 } from "fs/promises";
+import { mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var MAX_BUFFER = 16 * 1024 * 1024;
@@ -1789,12 +1431,12 @@ function getRegionKeyForApi(apiEndpoint) {
   return /^https:\/\/api\.cf\.([a-z]{2}\d{2}(?:-\d{3})?)\.hana\.ondemand\.com$/.exec(normalized)?.[1];
 }
 async function withCfSession(work) {
-  const cfHome = await mkdtemp(join3(tmpdir(), "saptools-cf-hana-"));
+  const cfHome = await mkdtemp(join2(tmpdir(), "saptools-cf-hana-"));
   const ctx = { cfHome };
   try {
     return await work(ctx);
   } finally {
-    await rm2(cfHome, { recursive: true, force: true });
+    await rm(cfHome, { recursive: true, force: true });
   }
 }
 function resolveCfBin() {
@@ -1811,9 +1453,9 @@ function buildEnv(ctx, overrides = {}) {
   env["CF_HOME"] = ctx.cfHome;
   return env;
 }
-async function execWithRetries(bin, args, env, timeoutMs = DEFAULT_TIMEOUT_MS) {
+async function execWithRetries(bin, args, env, timeoutMs = DEFAULT_TIMEOUT_MS, maxAttempts = CF_RETRY_ATTEMPTS) {
   let lastErr;
-  for (let attempt = 0; attempt < CF_RETRY_ATTEMPTS; attempt++) {
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
     try {
       const { stdout } = await execFileAsync(bin, args, {
         env,
@@ -1832,18 +1474,24 @@ async function execWithRetries(bin, args, env, timeoutMs = DEFAULT_TIMEOUT_MS) {
       if (isEnoent || !isTimeout && !isNetworkFlake) {
         throw err;
       }
-      if (attempt < CF_RETRY_ATTEMPTS - 1) {
+      if (attempt < maxAttempts - 1) {
         await new Promise((r) => setTimeout(r, CF_RETRY_BASE_DELAY_MS * (attempt + 1)));
       }
     }
   }
   throw lastErr;
 }
-async function runCf(args, ctx, overrides = {}) {
+async function runCf(args, ctx, overrides = {}, execOptions = {}) {
   const { bin, argsPrefix } = resolveCfBin();
   const env = buildEnv(ctx, overrides);
   try {
-    return await execWithRetries(bin, [...argsPrefix, ...args], env);
+    return await execWithRetries(
+      bin,
+      [...argsPrefix, ...args],
+      env,
+      execOptions.timeoutMs,
+      execOptions.maxAttempts
+    );
   } catch (lastErr) {
     const e = lastErr;
     const detail = e?.stderr ? String(e.stderr) : e?.message ?? "";
@@ -1873,15 +1521,26 @@ async function cfEnvDirect(appName) {
   delete env["SAP_PASSWORD"];
   return await execWithRetries(bin, [...argsPrefix, "env", appName], env);
 }
-async function cfApps(ctx) {
-  return await runCf(["apps"], ctx);
+async function cfApps(ctx, timeoutMs) {
+  return await runCf(
+    ["apps"],
+    ctx,
+    {},
+    timeoutMs === void 0 ? {} : { timeoutMs, maxAttempts: 1 }
+  );
 }
-async function cfAppsDirect() {
+async function cfAppsDirect(timeoutMs) {
   const { bin, argsPrefix } = resolveCfBin();
   const env = { ...process.env };
   delete env["SAP_EMAIL"];
   delete env["SAP_PASSWORD"];
-  return await execWithRetries(bin, [...argsPrefix, "apps"], env);
+  return await execWithRetries(
+    bin,
+    [...argsPrefix, "apps"],
+    env,
+    timeoutMs,
+    timeoutMs === void 0 ? void 0 : 1
+  );
 }
 async function readCurrentCfTarget() {
   const { bin, argsPrefix } = resolveCfBin();
@@ -2025,7 +1684,7 @@ function extractCfEnvApplicationIdentity(stdout) {
     }
     throw error;
   }
-  if (!isRecord2(application)) {
+  if (!isRecord(application)) {
     throw new Error("VCAP_APPLICATION must be an object");
   }
   return {
@@ -2045,11 +1704,11 @@ function extractVcapSection(stdout) {
   const block = end === -1 ? after : after.slice(0, end);
   return block.trim();
 }
-function isRecord2(v) {
+function isRecord(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function assertCreds(raw) {
-  if (!isRecord2(raw)) {
+  if (!isRecord(raw)) {
     throw new Error("HANA credentials must be an object");
   }
   const req = ["host", "port", "user", "password", "schema", "hdi_user", "hdi_password", "url", "database_id", "certificate"];
@@ -2082,7 +1741,7 @@ function extractHanaBindingsFromCfEnv(stdout) {
   } catch {
     throw new Error("VCAP_SERVICES is not valid JSON");
   }
-  if (!isRecord2(vcap)) {
+  if (!isRecord(vcap)) {
     throw new Error("VCAP_SERVICES must be an object");
   }
   const hana = vcap["hana"];
@@ -2093,7 +1752,7 @@ function extractHanaBindingsFromCfEnv(stdout) {
     throw new Error("VCAP_SERVICES.hana must be an array when present");
   }
   return hana.map((b) => {
-    if (!isRecord2(b)) {
+    if (!isRecord(b)) {
       throw new Error("HANA binding must be an object");
     }
     const credsRaw = assertCreds(b["credentials"]);
@@ -2788,6 +2447,13 @@ async function connectHdb(params) {
     password: params.password,
     ca: params.certificate,
     useTLS: true,
+    // HANA Cloud can reactively redirect a connection mid-auth to an
+    // internal per-node hostname (pod-locality routing). That target is
+    // often unreachable outside SAP's own network, and for a tunneled
+    // connection it would silently abandon the SSH forward for a fresh,
+    // untunneled socket. The original bound host is always a real, working
+    // endpoint, so disabling the redirect is safe on the direct path too.
+    disableCloudRedirect: true,
     ...params.servername === void 0 ? {} : { servername: params.servername }
   });
   await openClient(client, params.connectTimeoutMs);
@@ -2820,16 +2486,16 @@ function createDriver(name) {
 }
 
 // src/history.ts
-import { appendFile as appendFile2, mkdir as mkdir3, readdir, rm as rm3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { appendFile as appendFile2, mkdir as mkdir2, readdir, rm as rm2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
 var SAPTOOLS_DIR_NAME2 = ".saptools";
 var CF_HANA_DIR_NAME2 = "cf-hana";
 var HISTORIES_DIR_NAME = "histories";
 var HISTORY_RETENTION_DAYS = 5;
 var HISTORY_FILE_PATTERN = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
 function defaultSaptoolsRoot2() {
-  return join4(homedir3(), SAPTOOLS_DIR_NAME2);
+  return join3(homedir2(), SAPTOOLS_DIR_NAME2);
 }
 function padDatePart(value) {
   return value.toString().padStart(2, "0");
@@ -2851,10 +2517,10 @@ function resolveSaptoolsRoot(root) {
   return root ?? defaultSaptoolsRoot2();
 }
 function cfHanaHistoryDirectory(saptoolsRoot) {
-  return join4(resolveSaptoolsRoot(saptoolsRoot), CF_HANA_DIR_NAME2, HISTORIES_DIR_NAME);
+  return join3(resolveSaptoolsRoot(saptoolsRoot), CF_HANA_DIR_NAME2, HISTORIES_DIR_NAME);
 }
 function sqlHistoryFilePath(now = /* @__PURE__ */ new Date(), saptoolsRoot) {
-  return join4(cfHanaHistoryDirectory(saptoolsRoot), `${dateKey(now)}.jsonl`);
+  return join3(cfHanaHistoryDirectory(saptoolsRoot), `${dateKey(now)}.jsonl`);
 }
 async function pruneSqlHistory(now, saptoolsRoot) {
   const historyDir = cfHanaHistoryDirectory(saptoolsRoot);
@@ -2870,7 +2536,7 @@ async function pruneSqlHistory(now, saptoolsRoot) {
   const cutoffKey = retentionCutoffKey(now);
   await Promise.all(
     files.filter((file) => HISTORY_FILE_PATTERN.test(file)).filter((file) => file.slice(0, 10) < cutoffKey).map(async (file) => {
-      await rm3(join4(historyDir, file), { force: true });
+      await rm2(join3(historyDir, file), { force: true });
     })
   );
 }
@@ -2881,7 +2547,7 @@ async function appendSqlHistory(input, options = {}) {
     at: now.toISOString(),
     ...input
   };
-  await mkdir3(historyDir, { recursive: true, mode: 448 });
+  await mkdir2(historyDir, { recursive: true, mode: 448 });
   await appendFile2(sqlHistoryFilePath(now, options.saptoolsRoot), `${JSON.stringify(entry)}
 `, {
     encoding: "utf8",
@@ -2897,112 +2563,35 @@ async function appendSqlHistory(input, options = {}) {
 // src/safety.ts
 var DESTRUCTIVE_DDL_KEYWORDS = /* @__PURE__ */ new Set(["DROP", "TRUNCATE", "ALTER"]);
 var UNSCOPED_WRITE_KEYWORDS = /* @__PURE__ */ new Set(["UPDATE", "DELETE"]);
-function skipQuotedText2(sql, start) {
-  const quote = sql[start];
-  let index = start + 1;
-  while (index < sql.length) {
-    if (sql[index] === quote) {
-      if (sql[index + 1] === quote) {
-        index += 2;
-        continue;
-      }
-      index += 1;
-      break;
-    }
-    index += 1;
-  }
-  return index;
-}
-function skipLineComment3(sql, start) {
-  let index = start + 2;
-  while (index < sql.length && sql[index] !== "\n") {
-    index += 1;
-  }
-  return index;
+function isUnconditionalMergeDelete(sql) {
+  return /\bWHEN\s+MATCHED\s+THEN\s+DELETE\b/i.test(maskIgnoredSqlText(sql));
 }
-function skipBlockComment3(sql, start) {
-  let index = start + 2;
-  while (index < sql.length && !(sql[index] === "*" && sql[index + 1] === "/")) {
-    index += 1;
-  }
-  return Math.min(index + 2, sql.length);
+function isMalformedReplace(sql) {
+  return !hasTopLevelKeyword(sql, "VALUES") && !hasTopLevelKeyword(sql, "SELECT") && !hasTopLevelKeyword(sql, "WITH");
 }
-function maskIgnoredSqlText(sql) {
-  let masked = "";
+function trailingLineCommentIndex(sql) {
   let index = 0;
   while (index < sql.length) {
     const char = sql[index];
     if (char === "'" || char === '"') {
-      const end = skipQuotedText2(sql, index);
-      masked += " ".repeat(end - index);
-      index = end;
+      index = skipQuotedText2(sql, index);
       continue;
     }
-    if (char === "-" && sql[index + 1] === "-") {
-      const end = skipLineComment3(sql, index);
-      masked += " ".repeat(end - index);
-      index = end;
+    if (char === "/" && sql[index + 1] === "*") {
+      index = skipBlockComment2(sql, index);
       continue;
     }
-    if (char === "/" && sql[index + 1] === "*") {
-      const end = skipBlockComment3(sql, index);
-      masked += " ".repeat(end - index);
-      index = end;
+    if (char === "-" && sql[index + 1] === "-") {
+      const lineEnd = sql.indexOf("\n", index + 2);
+      if (lineEnd === -1 || sql.slice(lineEnd + 1).trim().length === 0) {
+        return index;
+      }
+      index = lineEnd + 1;
       continue;
     }
-    masked += char ?? "";
     index += 1;
   }
-  return masked;
-}
-function hasTopLevelKeyword(sql, keyword) {
-  const masked = maskIgnoredSqlText(sql);
-  let depth = 0;
-  for (let index = 0; index < masked.length; index += 1) {
-    const char = masked[index];
-    if (char === "(") {
-      depth += 1;
-      continue;
-    }
-    if (char === ")") {
-      depth = Math.max(0, depth - 1);
-      continue;
-    }
-    if (depth === 0 && masked.slice(index, index + keyword.length).toUpperCase() === keyword && !/[A-Za-z0-9_$#]/.test(masked.charAt(index - 1)) && !/[A-Za-z0-9_$#]/.test(masked.charAt(index + keyword.length))) {
-      return true;
-    }
-  }
-  return false;
-}
-function isUnconditionalMergeDelete(sql) {
-  return /\bWHEN\s+MATCHED\s+THEN\s+DELETE\b/i.test(maskIgnoredSqlText(sql));
-}
-function isMalformedReplace(sql) {
-  return !hasTopLevelKeyword(sql, "VALUES") && !hasTopLevelKeyword(sql, "SELECT") && !hasTopLevelKeyword(sql, "WITH");
-}
-function trailingLineCommentIndex(sql) {
-  let index = 0;
-  while (index < sql.length) {
-    const char = sql[index];
-    if (char === "'" || char === '"') {
-      index = skipQuotedText2(sql, index);
-      continue;
-    }
-    if (char === "/" && sql[index + 1] === "*") {
-      index = skipBlockComment3(sql, index);
-      continue;
-    }
-    if (char === "-" && sql[index + 1] === "-") {
-      const lineEnd = sql.indexOf("\n", index + 2);
-      if (lineEnd === -1 || sql.slice(lineEnd + 1).trim().length === 0) {
-        return index;
-      }
-      index = lineEnd + 1;
-      continue;
-    }
-    index += 1;
-  }
-  return void 0;
+  return void 0;
 }
 function appendLimit(sql, limit) {
   const trimmed = sql.replace(/(?<![\s;])[\s;]+$/, "");
@@ -3016,17 +2605,24 @@ function appendLimit(sql, limit) {
 }
 function inspectStatement(sql) {
   const kind = classifyStatement(sql);
-  const keyword = firstKeyword(sql);
+  const leading = firstKeyword(sql);
+  const withResolved = leading === "WITH" ? resolveWithStatement(sql) : void 0;
+  const keyword = withResolved?.keyword ?? leading;
+  const tail = withResolved === void 0 ? sql : sql.slice(withResolved.index);
   if (kind === "ddl") {
     return { kind, destructive: DESTRUCTIVE_DDL_KEYWORDS.has(keyword) };
   }
   if (kind === "dml") {
-    const destructive = UNSCOPED_WRITE_KEYWORDS.has(keyword) && !hasTopLevelKeyword(sql, "WHERE") || keyword === "MERGE" && isUnconditionalMergeDelete(sql) || keyword === "REPLACE" && isMalformedReplace(sql);
+    const destructive = UNSCOPED_WRITE_KEYWORDS.has(keyword) && !hasTopLevelKeyword(tail, "WHERE") || keyword === "MERGE" && isUnconditionalMergeDelete(tail) || keyword === "REPLACE" && isMalformedReplace(tail);
     return {
       kind,
       destructive
     };
   }
+  if (kind === "unknown") {
+    const unresolvedWith = leading === "WITH" && withResolved === void 0;
+    return { kind, destructive: keyword === "CALL" || unresolvedWith };
+  }
   return { kind, destructive: false };
 }
 function evaluateGuard(sql, config) {
@@ -3070,17 +2666,17 @@ function applyAutoLimit(sql, limit) {
 }
 
 // src/tunnel/cache.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir4, readdir as readdir2, readFile as readFile2, rename as rename2, rm as rm5, writeFile as writeFile3 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { createHash } from "crypto";
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile2, rename, rm as rm4, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
 
 // src/tunnel/process.ts
 import { spawn } from "child_process";
-import { mkdtemp as mkdtemp2, rm as rm4 } from "fs/promises";
+import { mkdtemp as mkdtemp2, open, readFile, rm as rm3 } from "fs/promises";
 import { connect as netConnect, createServer } from "net";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 var PORT_POLL_INTERVAL_MS = 100;
 var DEFAULT_PORT_PROBE_TIMEOUT_MS = 500;
 function assertPositiveSafeInteger(label, value) {
@@ -3147,7 +2743,7 @@ async function withScopedCfSession(selectorSource, target, sapCredentials, work)
       "SAP credentials are required to open a tunnel session for an explicit selector"
     );
   }
-  const cfHome = await mkdtemp2(join5(tmpdir2(), "saptools-cf-hana-tunnel-"));
+  const cfHome = await mkdtemp2(join4(tmpdir2(), "saptools-cf-hana-tunnel-"));
   try {
     const ctx = { cfHome };
     await cfApi(target.apiEndpoint, ctx);
@@ -3155,7 +2751,7 @@ async function withScopedCfSession(selectorSource, target, sapCredentials, work)
     await cfTargetSpace(target.orgName, target.spaceName, ctx);
     return await work(ctx);
   } finally {
-    await rm4(cfHome, { recursive: true, force: true });
+    await rm3(cfHome, { recursive: true, force: true });
   }
 }
 function raceTunnelReadiness(child, localPort, boundMs, probePort, killProcess) {
@@ -3184,8 +2780,8 @@ function raceTunnelReadiness(child, localPort, boundMs, probePort, killProcess)
     child.on("exit", onAbort);
     child.on("error", onAbort);
     timers.poll = setInterval(() => {
-      void probePort(localPort).then((open) => {
-        if (open && child.pid !== void 0) {
+      void probePort(localPort).then((open2) => {
+        if (open2 && child.pid !== void 0) {
           finish({ localPort, pid: child.pid });
         }
       });
@@ -3193,6 +2789,36 @@ function raceTunnelReadiness(child, localPort, boundMs, probePort, killProcess)
     timers.deadline = setTimeout(finish, boundMs);
   });
 }
+var STDERR_TAIL_MAX_CHARS = 4096;
+async function openStderrCapture() {
+  try {
+    const dir = await mkdtemp2(join4(tmpdir2(), "saptools-cf-hana-tunnel-log-"));
+    const path = join4(dir, "stderr.log");
+    const handle = await open(path, "w");
+    return {
+      path,
+      fd: handle.fd,
+      close: async () => {
+        await handle.close().catch(() => {
+        });
+        await rm3(dir, { recursive: true, force: true });
+      }
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function readStderrTail(path) {
+  try {
+    const content = (await readFile(path, "utf8")).trim().replace(/\s+/g, " ");
+    if (content.length === 0) {
+      return void 0;
+    }
+    return content.length > STDERR_TAIL_MAX_CHARS ? content.slice(-STDERR_TAIL_MAX_CHARS) : content;
+  } catch {
+    return void 0;
+  }
+}
 async function spawnTunnel(params, deps = {}) {
   assertPositiveSafeInteger("tunnel keepalive seconds", params.keepaliveSeconds);
   const remainingMs = params.deadline - Date.now();
@@ -3217,14 +2843,30 @@ async function spawnTunnel(params, deps = {}) {
     `sleep ${String(params.keepaliveSeconds)}`
   ];
   const env = params.cfHome === void 0 ? { ...process.env } : { ...process.env, CF_HOME: params.cfHome };
-  const child = spawnProcess(bin, args, { detached: true, stdio: "ignore", env });
-  return await raceTunnelReadiness(child, localPort, boundMs, probePort, killProcess);
+  const openCapture = deps.openStderrCapture ?? openStderrCapture;
+  const capture = await openCapture();
+  const stdio = capture === void 0 ? "ignore" : ["ignore", "ignore", capture.fd];
+  const child = spawnProcess(bin, args, { detached: true, stdio, env });
+  const result = await raceTunnelReadiness(child, localPort, boundMs, probePort, killProcess);
+  if (capture !== void 0) {
+    if (result === void 0) {
+      try {
+        const tail = await readStderrTail(capture.path);
+        if (tail !== void 0) {
+          deps.onFailureDiagnostic?.(tail);
+        }
+      } catch {
+      }
+    }
+    await capture.close();
+  }
+  return result;
 }
 
 // src/tunnel/cache.ts
 var DEFAULT_ESTABLISHING_STALE_MS = 2 * DEFAULT_TUNNEL_FALLBACK_BUDGET_MS;
 var DEFAULT_POLL_INTERVAL_MS = 300;
-function isRecord3(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null;
 }
 function defaultIsProcessAlive(pid) {
@@ -3232,7 +2874,7 @@ function defaultIsProcessAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (error) {
-    return isRecord3(error) && error["code"] !== "ESRCH";
+    return isRecord2(error) && error["code"] !== "ESRCH";
   }
 }
 function sleep(ms) {
@@ -3241,16 +2883,16 @@ function sleep(ms) {
   });
 }
 function tunnelCacheRoot(saptoolsRoot) {
-  return join6(saptoolsRoot ?? join6(homedir4(), ".saptools"), "cf-hana", "tunnel");
+  return join5(saptoolsRoot ?? join5(homedir3(), ".saptools"), "cf-hana", "tunnel");
 }
 function tunnelCacheKey(host) {
-  return createHash2("sha256").update(host).digest("hex");
+  return createHash("sha256").update(host).digest("hex");
 }
 function tunnelCachePath(host, saptoolsRoot) {
-  return join6(tunnelCacheRoot(saptoolsRoot), `${tunnelCacheKey(host)}.json`);
+  return join5(tunnelCacheRoot(saptoolsRoot), `${tunnelCacheKey(host)}.json`);
 }
 function isOrgKey(value) {
-  return isRecord3(value) && typeof value["apiEndpoint"] === "string" && typeof value["orgName"] === "string";
+  return isRecord2(value) && typeof value["apiEndpoint"] === "string" && typeof value["orgName"] === "string";
 }
 function hasEstablishingFields(value) {
   return value["status"] === "establishing" && typeof value["host"] === "string" && typeof value["startedAt"] === "string" && typeof value["ownerPid"] === "number" && isOrgKey(value["orgKey"]);
@@ -3259,7 +2901,7 @@ function hasReadyFields(value) {
   return value["status"] === "ready" && typeof value["host"] === "string" && typeof value["localPort"] === "number" && typeof value["pid"] === "number" && typeof value["app"] === "string" && typeof value["expiresAt"] === "string" && isOrgKey(value["orgKey"]);
 }
 function isTunnelCacheRecord(value) {
-  return isRecord3(value) && value["version"] === 1 && (hasEstablishingFields(value) || hasReadyFields(value));
+  return isRecord2(value) && value["version"] === 1 && (hasEstablishingFields(value) || hasReadyFields(value));
 }
 async function parseTunnelCacheFile(path) {
   try {
@@ -3303,7 +2945,7 @@ function isEstablishingStale(entry, options) {
 }
 async function writeEstablishingMarker(host, ownerPid, orgKey, options) {
   const root = tunnelCacheRoot(options.saptoolsRoot);
-  await mkdir4(root, { recursive: true, mode: 448 });
+  await mkdir3(root, { recursive: true, mode: 448 });
   const record = {
     version: 1,
     status: "establishing",
@@ -3313,7 +2955,7 @@ async function writeEstablishingMarker(host, ownerPid, orgKey, options) {
     orgKey
   };
   try {
-    await writeFile3(tunnelCachePath(host, options.saptoolsRoot), `${JSON.stringify(record)}
+    await writeFile2(tunnelCachePath(host, options.saptoolsRoot), `${JSON.stringify(record)}
 `, {
       encoding: "utf8",
       mode: 384,
@@ -3321,7 +2963,7 @@ async function writeEstablishingMarker(host, ownerPid, orgKey, options) {
     });
     return true;
   } catch (error) {
-    if (isRecord3(error) && error["code"] === "EEXIST") {
+    if (isRecord2(error) && error["code"] === "EEXIST") {
       return false;
     }
     throw error;
@@ -3341,7 +2983,7 @@ async function claimEstablishing(host, ownerPid, orgKey, options = {}) {
   if (!isEstablishingStale(existing, options)) {
     return { outcome: "wait" };
   }
-  await rm5(tunnelCachePath(host, options.saptoolsRoot), { force: true });
+  await rm4(tunnelCachePath(host, options.saptoolsRoot), { force: true });
   return await writeEstablishingMarker(host, ownerPid, orgKey, options) ? { outcome: "claimed" } : { outcome: "wait" };
 }
 async function waitForEstablishment(host, deadline, pollIntervalMs = DEFAULT_POLL_INTERVAL_MS, options = {}) {
@@ -3365,17 +3007,17 @@ async function finalizeEstablishingReady(host, record, options = {}) {
   const path = tunnelCachePath(host, options.saptoolsRoot);
   const tempPath = `${path}.tmp-${String(process.pid)}`;
   const stored = { version: 1, status: "ready", host, ...record };
-  await mkdir4(root, { recursive: true, mode: 448 });
-  await rm5(tempPath, { force: true });
-  await writeFile3(tempPath, `${JSON.stringify(stored)}
+  await mkdir3(root, { recursive: true, mode: 448 });
+  await rm4(tempPath, { force: true });
+  await writeFile2(tempPath, `${JSON.stringify(stored)}
 `, { encoding: "utf8", mode: 384 });
-  await rename2(tempPath, path);
+  await rename(tempPath, path);
 }
 async function finalizeEstablishingFailed(host, options = {}) {
-  await rm5(tunnelCachePath(host, options.saptoolsRoot), { force: true });
+  await rm4(tunnelCachePath(host, options.saptoolsRoot), { force: true });
 }
 async function evictTunnelCache(host, options = {}) {
-  await rm5(tunnelCachePath(host, options.saptoolsRoot), { force: true });
+  await rm4(tunnelCachePath(host, options.saptoolsRoot), { force: true });
 }
 function sameOrg(a, b) {
   return a.apiEndpoint === b.apiEndpoint && a.orgName === b.orgName;
@@ -3388,19 +3030,19 @@ async function reapOneFile(path, currentOrgKey, options) {
   const killProcess = options.killProcess ?? killTunnelProcess;
   if (entry.status === "establishing") {
     if (isEstablishingStale(entry, options)) {
-      await rm5(path, { force: true });
+      await rm4(path, { force: true });
     }
     return;
   }
   const isAlive = options.isProcessAlive ?? defaultIsProcessAlive;
   if (!isAlive(entry.pid)) {
-    await rm5(path, { force: true });
+    await rm4(path, { force: true });
     return;
   }
   const now = options.now?.() ?? /* @__PURE__ */ new Date();
   if (isExpired(entry, now) || !sameOrg(entry.orgKey, currentOrgKey)) {
     killProcess(entry.pid);
-    await rm5(path, { force: true });
+    await rm4(path, { force: true });
   }
 }
 async function reapStaleAndCrossOrgTunnels(currentOrgKey, options = {}) {
@@ -3413,7 +3055,7 @@ async function reapStaleAndCrossOrgTunnels(currentOrgKey, options = {}) {
   }
   await Promise.all(
     files.filter((file) => file.endsWith(".json")).map(async (file) => {
-      await reapOneFile(join6(root, file), currentOrgKey, options);
+      await reapOneFile(join5(root, file), currentOrgKey, options);
     })
   );
 }
@@ -3481,6 +3123,9 @@ function isConnectivityFailure(error) {
   }
   return hasOpenConnectionCause(error.cause, 0);
 }
+function isUnattributedQueryFailure(error) {
+  return error instanceof QueryError && error.databaseCode === void 0 && error.sqlState === void 0;
+}
 
 // src/tunnel/fallback.ts
 var EXPIRY_SAFETY_MARGIN_MS = 3e4;
@@ -3510,30 +3155,40 @@ async function discardQuietly(work) {
   await work.catch(() => {
   });
 }
+function shouldDiscardTunnel(error) {
+  return isConnectivityFailure(error) || isUnattributedQueryFailure(error);
+}
 async function tryReadyRecord(record, driver, config, directParams, cacheOptions) {
   try {
     const connection = await driver.connect(tunneledParams(directParams, record.localPort));
     config.onTunnelStatus?.(`connected via SSH tunnel through ${record.app}`);
     return connection;
   } catch (error) {
-    if (isConnectivityFailure(error)) {
+    if (shouldDiscardTunnel(error)) {
       await discardQuietly(evictTunnelCache(config.host, cacheOptions));
       return void 0;
     }
     throw error;
   }
 }
-async function discoverAppsStdout(ctx) {
+function knownCandidates(targetAppName, hintApp) {
+  return hintApp === void 0 || hintApp === targetAppName ? [targetAppName] : [targetAppName, hintApp];
+}
+async function discoverAppsStdout(ctx, timeoutMs) {
   try {
-    return ctx === void 0 ? await cfAppsDirect() : await cfApps(ctx);
+    return ctx === void 0 ? await cfAppsDirect(timeoutMs) : await cfApps(ctx, timeoutMs);
   } catch {
     return;
   }
 }
-async function buildCandidates(config, ctx, hintApp) {
-  const stdout = await discoverAppsStdout(ctx);
+async function discoverExtraCandidates(config, ctx, alreadyTried, deadline) {
+  const remainingMs = deadline - Date.now();
+  if (remainingMs <= 0) {
+    return [];
+  }
+  const stdout = await discoverAppsStdout(ctx, remainingMs);
   const base = buildCandidateList(config.appName, stdout, DEFAULT_TUNNEL_MAX_CANDIDATES);
-  return hintApp === void 0 || base.includes(hintApp) ? base : [hintApp, ...base];
+  return base.filter((app) => !alreadyTried.includes(app));
 }
 async function finalizeCandidateConnection(app, spawned, driver, config, directParams, cacheOptions) {
   const readyRecord = {
@@ -3549,7 +3204,7 @@ async function finalizeCandidateConnection(app, spawned, driver, config, directP
     config.onTunnelStatus?.(`connected via SSH tunnel through ${app}`);
     return connection;
   } catch (error) {
-    if (isConnectivityFailure(error)) {
+    if (shouldDiscardTunnel(error)) {
       await discardQuietly(finalizeEstablishingFailed(config.host, cacheOptions));
       killTunnelProcess(spawned.pid);
       return void 0;
@@ -3566,7 +3221,8 @@ async function tryCandidate(app, ctx, driver, config, directParams, deadline, ov
     return await tryReadyRecord(claim.record, driver, config, directParams, cacheOptions);
   }
   if (claim.outcome === "wait") {
-    const ready = await waitForEstablishment(config.host, deadline, void 0, cacheOptions);
+    const waitDeadline = Math.min(deadline, Date.now() + DEFAULT_TUNNEL_CANDIDATE_TIMEOUT_MS);
+    const ready = await waitForEstablishment(config.host, waitDeadline, void 0, cacheOptions);
     return ready === void 0 ? void 0 : await tryReadyRecord(ready, driver, config, directParams, cacheOptions);
   }
   const spawned = await spawnTunnel(
@@ -3579,7 +3235,12 @@ async function tryCandidate(app, ctx, driver, config, directParams, deadline, ov
       deadline,
       candidateTimeoutMs: DEFAULT_TUNNEL_CANDIDATE_TIMEOUT_MS
     },
-    overrides.process ?? {}
+    {
+      ...overrides.process,
+      onFailureDiagnostic: (message) => {
+        config.onTunnelStatus?.(`tunnel via ${app} failed: ${message}`);
+      }
+    }
   );
   if (spawned === void 0) {
     await discardQuietly(finalizeEstablishingFailed(config.host, cacheOptions));
@@ -3589,7 +3250,11 @@ async function tryCandidate(app, ctx, driver, config, directParams, deadline, ov
 }
 async function tryCachedTunnel(driver, config, directParams, cacheOptions) {
   if (config.refreshTunnel) {
+    const superseded = await readTunnelCacheEntry(config.host, cacheOptions);
     await discardQuietly(evictTunnelCache(config.host, cacheOptions));
+    if (superseded?.status === "ready") {
+      (cacheOptions.killProcess ?? killTunnelProcess)(superseded.pid);
+    }
     return { connection: void 0, hintApp: void 0 };
   }
   const entry = await readTunnelCacheEntry(config.host, cacheOptions);
@@ -3607,8 +3272,12 @@ async function tryDirectConnect(driver, config, directParams) {
   if (config.tunnelMode !== "auto") {
     return { connection: void 0, directError: void 0 };
   }
+  const boundedDirectParams = {
+    ...directParams,
+    connectTimeoutMs: Math.min(directParams.connectTimeoutMs, DEFAULT_TUNNEL_CANDIDATE_TIMEOUT_MS)
+  };
   try {
-    return { connection: await driver.connect(directParams), directError: void 0 };
+    return { connection: await driver.connect(boundedDirectParams), directError: void 0 };
   } catch (error) {
     if (!isConnectivityFailure(error)) {
       throw error;
@@ -3625,18 +3294,47 @@ function buildExhaustionError(host, directError, candidates) {
     `Could not establish an SSH tunnel to ${host} through any candidate app (tried: ${candidates.length > 0 ? candidates.join(", ") : "none"})`
   );
 }
-async function runCandidateLoop(ctx, driver, config, directParams, deadline, hintApp, overrides) {
-  const candidatesTried = await buildCandidates(config, ctx, hintApp);
-  for (const app of candidatesTried) {
+async function tryCandidateList(apps, ctx, driver, config, directParams, deadline, overrides, tried) {
+  for (const app of apps) {
     if (Date.now() >= deadline) {
-      break;
+      return void 0;
     }
+    tried.push(app);
     const connection = await tryCandidate(app, ctx, driver, config, directParams, deadline, overrides);
     if (connection !== void 0) {
-      return { connection, candidatesTried };
+      return connection;
     }
   }
-  return { connection: void 0, candidatesTried };
+  return void 0;
+}
+async function runCandidateLoop(ctx, driver, config, directParams, deadline, hintApp, overrides) {
+  const tried = [];
+  const known = knownCandidates(config.appName, hintApp);
+  const knownConnection = await tryCandidateList(
+    known,
+    ctx,
+    driver,
+    config,
+    directParams,
+    deadline,
+    overrides,
+    tried
+  );
+  if (knownConnection !== void 0) {
+    return { connection: knownConnection, candidatesTried: tried };
+  }
+  const discovered = await discoverExtraCandidates(config, ctx, tried, deadline);
+  const discoveredConnection = await tryCandidateList(
+    discovered,
+    ctx,
+    driver,
+    config,
+    directParams,
+    deadline,
+    overrides,
+    tried
+  );
+  return { connection: discoveredConnection, candidatesTried: tried };
 }
 async function connectWithTunnelFallback(driver, config, overrides = {}) {
   const directParams = directParamsOf(config);
@@ -4164,131 +3862,689 @@ var HanaClient = class _HanaClient {
     const built = buildInsert(schema, table, values);
     return await this.runExecute(built.sql, built.params);
   }
-  /** Update rows matching a non-empty `where` filter. */
-  async update(schema, table, values, where) {
-    const built = buildUpdate(schema, table, values, where);
-    return await this.runExecute(built.sql, built.params);
+  /** Update rows matching a non-empty `where` filter. */
+  async update(schema, table, values, where) {
+    const built = buildUpdate(schema, table, values, where);
+    return await this.runExecute(built.sql, built.params);
+  }
+  /** Delete rows matching a non-empty `where` filter. */
+  async deleteFrom(schema, table, where) {
+    const built = buildDelete(schema, table, where);
+    return await this.runExecute(built.sql, built.params);
+  }
+  /** Run `work` inside a transaction, auto-committing on success. */
+  async transaction(work) {
+    return await this.pool.withConnection(async (connection) => {
+      await connection.setAutoCommit(false);
+      const tx = new Transaction(connection);
+      try {
+        const result = await work(tx);
+        if (!tx.isFinished) {
+          await tx.commit();
+        }
+        return result;
+      } catch (error) {
+        if (!tx.isFinished) {
+          try {
+            await tx.rollback();
+          } catch {
+          }
+        }
+        throw error;
+      } finally {
+        await connection.setAutoCommit(true);
+      }
+    });
+  }
+  /** List every schema visible to the connected user. */
+  async listSchemas() {
+    return await this.pool.withConnection((connection) => listSchemas(connection));
+  }
+  /** List the tables in a schema. */
+  async listTables(schema) {
+    return await this.pool.withConnection((connection) => listTables(connection, schema));
+  }
+  /** List table and view names in a schema for typo suggestions. */
+  async listCatalogObjects(schema) {
+    return await this.pool.withConnection((connection) => listCatalogObjects(connection, schema));
+  }
+  /** List the columns of a table. */
+  async listColumns(schema, table) {
+    return await this.pool.withConnection(
+      (connection) => listColumns(connection, schema, table)
+    );
+  }
+  /** Return the HANA execution plan for a statement. */
+  async explain(sql, params) {
+    return await this.pool.withConnection(async (connection) => {
+      connection.assertAllowed(sql);
+      const statementName = nextExplainStatementName();
+      await connection.executeInternal(
+        `EXPLAIN PLAN SET STATEMENT_NAME = '${statementName}' FOR ${sql}`,
+        params
+      );
+      const cleanup = async () => {
+        await connection.executeInternal(
+          "DELETE FROM EXPLAIN_PLAN_TABLE WHERE STATEMENT_NAME = ?",
+          [statementName]
+        );
+      };
+      let queryCompleted = false;
+      try {
+        const result = await connection.query(
+          "SELECT OPERATOR_NAME, TABLE_NAME, TABLE_TYPE, EXECUTION_ENGINE FROM EXPLAIN_PLAN_TABLE WHERE STATEMENT_NAME = ? ORDER BY OPERATOR_ID",
+          [statementName]
+        );
+        queryCompleted = true;
+        await cleanup();
+        return result;
+      } catch (error) {
+        if (!queryCompleted) {
+          try {
+            await cleanup();
+          } catch {
+          }
+        }
+        throw error;
+      }
+    });
+  }
+  /** Close every pooled connection. The client must not be used afterwards. */
+  async close() {
+    await this.pool.drain();
+  }
+  async runQuery(sql, params, options) {
+    return await this.pool.withConnection(
+      (connection) => connection.query(sql, params, options)
+    );
+  }
+  async runExecute(sql, params, options) {
+    return await this.pool.withConnection(
+      (connection) => connection.execute(sql, params, options)
+    );
+  }
+  async recordSqlHistory(operation, sql, params, result) {
+    try {
+      await appendSqlHistory({
+        version: CLI_VERSION,
+        operation,
+        selector: this.info.selector,
+        appName: this.info.appName,
+        schema: this.info.schema,
+        role: this.info.role,
+        statement: result.statement,
+        sql,
+        paramCount: params.length,
+        rowCount: result.rowCount,
+        truncated: result.truncated,
+        elapsedMs: result.elapsedMs
+      });
+    } catch {
+    }
+  }
+};
+
+// src/api.ts
+async function connect(selector, options) {
+  return await HanaClient.connect(selector, options);
+}
+
+// src/metadata-cache.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir4, readFile as readFile3, rename as rename2, rm as rm5, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
+var METADATA_CACHE_TTL_MS = 30 * 6e4;
+function metadataCacheRoot(saptoolsRoot) {
+  return join6(saptoolsRoot ?? join6(homedir4(), ".saptools"), "cf-hana", "metadata");
+}
+function toMetadataCacheScope(info) {
+  return {
+    selector: info.selector,
+    appName: info.appName,
+    host: info.host,
+    schema: info.schema,
+    role: info.role,
+    driver: info.driver,
+    ...info.bindingName === void 0 ? {} : { bindingName: info.bindingName },
+    ...info.bindingIndex === void 0 ? {} : { bindingIndex: info.bindingIndex }
+  };
+}
+function metadataCacheKey(scope) {
+  return createHash2("sha256").update(JSON.stringify(scope)).digest("hex");
+}
+function metadataCachePath(scope, saptoolsRoot) {
+  return join6(metadataCacheRoot(saptoolsRoot), `${metadataCacheKey(scope)}.json`);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isCatalogObject(value) {
+  return isRecord3(value) && typeof value["schema"] === "string" && typeof value["name"] === "string" && (value["type"] === "TABLE" || value["type"] === "VIEW");
+}
+function hasRequiredScopeFields(value) {
+  return typeof value["selector"] === "string" && typeof value["appName"] === "string" && typeof value["host"] === "string" && typeof value["schema"] === "string" && typeof value["role"] === "string" && typeof value["driver"] === "string";
+}
+function hasOptionalScopeFields(value) {
+  return (value["bindingName"] === void 0 || typeof value["bindingName"] === "string") && (value["bindingIndex"] === void 0 || typeof value["bindingIndex"] === "number");
+}
+function isScope(value) {
+  return isRecord3(value) && hasRequiredScopeFields(value) && hasOptionalScopeFields(value);
+}
+function scopesEqual(left, right) {
+  return metadataCacheKey(left) === metadataCacheKey(right);
+}
+function isStored(value) {
+  return isRecord3(value) && value["version"] === 1 && typeof value["createdAt"] === "string" && isScope(value["scope"]) && Array.isArray(value["objects"]) && value["objects"].every(isCatalogObject);
+}
+async function readMetadataCache(scope, options = {}) {
+  try {
+    const parsed = JSON.parse(
+      await readFile3(metadataCachePath(scope, options.saptoolsRoot), "utf8")
+    );
+    if (!isStored(parsed) || !scopesEqual(parsed.scope, scope)) {
+      return void 0;
+    }
+    const createdAt = Date.parse(parsed.createdAt);
+    const now = options.now?.() ?? /* @__PURE__ */ new Date();
+    const ageMs = now.getTime() - createdAt;
+    if (!Number.isFinite(createdAt) || ageMs < 0 || ageMs >= METADATA_CACHE_TTL_MS) {
+      return void 0;
+    }
+    return parsed.objects;
+  } catch {
+    return void 0;
+  }
+}
+async function writeMetadataCache(scope, objects, options = {}) {
+  const root = metadataCacheRoot(options.saptoolsRoot);
+  const path = metadataCachePath(scope, options.saptoolsRoot);
+  const tempPath = `${path}.tmp-${process.pid.toString()}`;
+  const stored = {
+    version: 1,
+    createdAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+    scope,
+    objects
+  };
+  await mkdir4(root, { recursive: true, mode: 448 });
+  await rm5(tempPath, { force: true });
+  await writeFile3(tempPath, `${JSON.stringify(stored)}
+`, { encoding: "utf8", mode: 384 });
+  await rename2(tempPath, path);
+}
+async function loadCatalogObjectsWithCache(scope, refresh, loader, options = {}) {
+  if (!refresh) {
+    const cached = await readMetadataCache(scope, options);
+    if (cached !== void 0) {
+      return cached;
+    }
+  }
+  const objects = await loader();
+  try {
+    await writeMetadataCache(scope, objects, options);
+  } catch {
+  }
+  return objects;
+}
+
+// src/suggestions.ts
+var INVALID_OBJECT_PATTERNS = [
+  /invalid\s+(?:table|view|object)\s+name/i,
+  /(?:table|view|object)\s+[^\n]*does\s+not\s+exist/i,
+  /could\s+not\s+find\s+(?:table|view|object)/i
+];
+var REF_KEYWORDS = /* @__PURE__ */ new Set(["FROM", "JOIN", "UPDATE", "INTO", "TABLE"]);
+var STOP_WORDS = /* @__PURE__ */ new Set([
+  "AS",
+  "ON",
+  "WHERE",
+  "SET",
+  "VALUES",
+  "USING",
+  "WHEN",
+  "INNER",
+  "LEFT",
+  "RIGHT",
+  "FULL",
+  "OUTER",
+  "CROSS",
+  "JOIN"
+]);
+var CTE_FOLLOWERS = /* @__PURE__ */ new Set(["AS"]);
+function isInvalidCatalogObjectError(error) {
+  if (!(error instanceof QueryError)) {
+    return false;
+  }
+  if (error.sqlState === "42S02" || error.sqlState === "42S01") {
+    return true;
+  }
+  return INVALID_OBJECT_PATTERNS.some((pattern) => pattern.test(error.message));
+}
+function skipLineComment3(sql, index) {
+  let cursor = index + 2;
+  while (cursor < sql.length && sql[cursor] !== "\n") {
+    cursor += 1;
+  }
+  return cursor;
+}
+function skipBlockComment3(sql, index) {
+  let cursor = index + 2;
+  while (cursor < sql.length && !(sql[cursor] === "*" && sql[cursor + 1] === "/")) {
+    cursor += 1;
+  }
+  return Math.min(cursor + 2, sql.length);
+}
+function skipStringLiteral(sql, index) {
+  let cursor = index + 1;
+  while (cursor < sql.length) {
+    if (sql[cursor] === "'" && sql[cursor + 1] === "'") {
+      cursor += 2;
+      continue;
+    }
+    if (sql[cursor] === "'") {
+      return cursor + 1;
+    }
+    cursor += 1;
+  }
+  return cursor;
+}
+function readQuotedIdentifier(sql, index) {
+  let cursor = index + 1;
+  let text = "";
+  while (cursor < sql.length) {
+    if (sql[cursor] === '"' && sql[cursor + 1] === '"') {
+      text += '"';
+      cursor += 2;
+      continue;
+    }
+    if (sql[cursor] === '"') {
+      return { text, next: cursor + 1 };
+    }
+    text += sql.charAt(cursor);
+    cursor += 1;
+  }
+  return { text, next: cursor };
+}
+function readBareWord(sql, index) {
+  let cursor = index;
+  let text = "";
+  while (cursor < sql.length && /[A-Za-z0-9_#$]/.test(sql.charAt(cursor))) {
+    text += sql.charAt(cursor);
+    cursor += 1;
+  }
+  return { text, next: cursor };
+}
+function tokenize(sql) {
+  const tokens = [];
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql.charAt(index);
+    if (/\s/.test(char)) {
+      index += 1;
+      continue;
+    }
+    if (char === "-" && sql[index + 1] === "-") {
+      index = skipLineComment3(sql, index);
+      continue;
+    }
+    if (char === "/" && sql[index + 1] === "*") {
+      index = skipBlockComment3(sql, index);
+      continue;
+    }
+    if (char === "'") {
+      index = skipStringLiteral(sql, index);
+      continue;
+    }
+    if (char === '"') {
+      const quoted = readQuotedIdentifier(sql, index);
+      tokens.push({ kind: "quoted", text: quoted.text });
+      index = quoted.next;
+      continue;
+    }
+    if (/[A-Za-z_#$]/.test(char)) {
+      const word = readBareWord(sql, index);
+      tokens.push({ kind: "word", text: word.text });
+      index = word.next;
+      continue;
+    }
+    if (char === ".") {
+      tokens.push({ kind: "dot", text: char });
+    } else if (char === ",") {
+      tokens.push({ kind: "comma", text: char });
+    } else if (char === "(") {
+      tokens.push({ kind: "open", text: char });
+    } else if (char === ")") {
+      tokens.push({ kind: "close", text: char });
+    } else {
+      tokens.push({ kind: "other", text: char });
+    }
+    index += 1;
+  }
+  return tokens;
+}
+function upper(token) {
+  return token?.text.toUpperCase() ?? "";
+}
+function isIdentifier(token) {
+  return token?.kind === "word" || token?.kind === "quoted";
+}
+function readName(tokens, start, allowFollowingParens = false) {
+  const first = tokens[start];
+  if (!isIdentifier(first)) {
+    return void 0;
+  }
+  let next = start + 1;
+  let schema;
+  let name = first.text;
+  const maybeObject = tokens[next + 1];
+  if (tokens[next]?.kind === "dot" && isIdentifier(maybeObject)) {
+    schema = name;
+    name = maybeObject.text;
+    next += 2;
+  }
+  if (!allowFollowingParens && tokens[next]?.kind === "open") {
+    return void 0;
+  }
+  return { name: schema === void 0 ? { name } : { schema, name }, next };
+}
+function firstNameFromText(text) {
+  const tokens = tokenize(text);
+  for (let index = 0; index < tokens.length; index += 1) {
+    const read = readName(tokens, index, true);
+    if (read !== void 0) {
+      return read.name;
+    }
+  }
+  return void 0;
+}
+function extractMissingObjectNameFromError(error) {
+  if (!(error instanceof QueryError)) {
+    return void 0;
+  }
+  const message = error.message;
+  const invalidName = /invalid\s+(?:table|view|object)\s+name\s*:?\s*(.+)$/i.exec(message);
+  if (invalidName?.[1] !== void 0) {
+    return firstNameFromText(invalidName[1]);
+  }
+  const missingObject = /(?:table|view|object)\s+(.+?)\s+(?:does\s+not\s+exist|not\s+found)/i.exec(message);
+  if (missingObject?.[1] !== void 0) {
+    return firstNameFromText(missingObject[1]);
+  }
+  return void 0;
+}
+function cteNames(tokens) {
+  const names = /* @__PURE__ */ new Set();
+  if (upper(tokens[0]) !== "WITH") {
+    return names;
+  }
+  let depth = 0;
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (depth === 0 && upper(token) === "SELECT") {
+      break;
+    }
+    if (depth === 0 && isIdentifier(token) && CTE_FOLLOWERS.has(upper(tokens[index + 1]))) {
+      names.add(token.text.toUpperCase());
+    }
+    if (token?.kind === "open") {
+      depth += 1;
+    } else if (token?.kind === "close" && depth > 0) {
+      depth -= 1;
+    }
+  }
+  return names;
+}
+function extractMissingObjectName(sql) {
+  const tokens = tokenize(sql.replace(/^;+|;+$/g, ""));
+  const ctes = cteNames(tokens);
+  let candidate;
+  for (let index = 0; index < tokens.length; index += 1) {
+    const word = upper(tokens[index]);
+    if (!REF_KEYWORDS.has(word)) {
+      continue;
+    }
+    if (word === "TABLE" && upper(tokens[index - 1]) !== "TRUNCATE") {
+      continue;
+    }
+    if (word === "INTO" && !(upper(tokens[index - 1]) === "INSERT" || upper(tokens[index - 1]) === "MERGE")) {
+      continue;
+    }
+    const read = readName(tokens, index + 1, word === "INTO");
+    if (read === void 0) {
+      continue;
+    }
+    if (read.name.schema === void 0 && ctes.has(read.name.name.toUpperCase())) {
+      continue;
+    }
+    if (STOP_WORDS.has(read.name.name.toUpperCase())) {
+      continue;
+    }
+    candidate = read.name;
+    let next = read.next;
+    if (isIdentifier(tokens[next]) && !STOP_WORDS.has(upper(tokens[next]))) {
+      next += 1;
+    }
+    while (tokens[next]?.kind === "comma") {
+      const commaRead = readName(tokens, next + 1);
+      if (commaRead === void 0) {
+        break;
+      }
+      if (!(commaRead.name.schema === void 0 && ctes.has(commaRead.name.name.toUpperCase()))) {
+        candidate = commaRead.name;
+      }
+      next = commaRead.next;
+      if (isIdentifier(tokens[next]) && !STOP_WORDS.has(upper(tokens[next]))) {
+        next += 1;
+      }
+    }
+  }
+  return candidate;
+}
+function singular(value) {
+  if (value.endsWith("ES")) {
+    return value.slice(0, -2);
+  }
+  if (value.endsWith("S")) {
+    return value.slice(0, -1);
+  }
+  return value;
+}
+function norm(value) {
+  return value.toUpperCase().replace(/[^A-Z0-9]+/g, "");
+}
+function distance(a, b) {
+  const previous = Array.from({ length: b.length + 1 }, (_value, index) => index);
+  for (let leftIndex = 1; leftIndex <= a.length; leftIndex += 1) {
+    let last = leftIndex - 1;
+    previous[0] = leftIndex;
+    for (let rightIndex = 1; rightIndex <= b.length; rightIndex += 1) {
+      const old = previous[rightIndex] ?? 0;
+      previous[rightIndex] = Math.min(
+        (previous[rightIndex] ?? 0) + 1,
+        (previous[rightIndex - 1] ?? 0) + 1,
+        last + (a.charAt(leftIndex - 1) === b.charAt(rightIndex - 1) ? 0 : 1)
+      );
+      last = old;
+    }
+  }
+  return previous[b.length] ?? 0;
+}
+function score(requested, candidate) {
+  const requestedName = norm(requested.name);
+  const candidateName = norm(candidate.name);
+  if (requested.schema !== void 0 && norm(requested.schema) !== norm(candidate.schema)) {
+    return 0;
+  }
+  if (requestedName === candidateName) {
+    return 100;
+  }
+  if (singular(requestedName) === singular(candidateName)) {
+    return 92;
+  }
+  let value = 0;
+  if (candidateName.startsWith(requestedName) || requestedName.startsWith(candidateName)) {
+    value = Math.max(value, 80 - Math.abs(candidateName.length - requestedName.length));
+  }
+  if (candidateName.endsWith(requestedName) || requestedName.endsWith(candidateName)) {
+    value = Math.max(value, 70 - Math.abs(candidateName.length - requestedName.length));
   }
-  /** Delete rows matching a non-empty `where` filter. */
-  async deleteFrom(schema, table, where) {
-    const built = buildDelete(schema, table, where);
-    return await this.runExecute(built.sql, built.params);
+  const editDistance = distance(requestedName, candidateName);
+  const max = Math.max(requestedName.length, candidateName.length, 1);
+  if (editDistance <= Math.max(3, Math.floor(max * 0.35))) {
+    value = Math.max(value, Math.round(75 * (1 - editDistance / max)));
   }
-  /** Run `work` inside a transaction, auto-committing on success. */
-  async transaction(work) {
-    return await this.pool.withConnection(async (connection) => {
-      await connection.setAutoCommit(false);
-      const tx = new Transaction(connection);
-      try {
-        const result = await work(tx);
-        if (!tx.isFinished) {
-          await tx.commit();
-        }
-        return result;
-      } catch (error) {
-        if (!tx.isFinished) {
-          try {
-            await tx.rollback();
-          } catch {
-          }
-        }
-        throw error;
-      } finally {
-        await connection.setAutoCommit(true);
-      }
-    });
+  return value;
+}
+function extractInvalidColumnNameFromError(error) {
+  if (!(error instanceof QueryError)) {
+    return void 0;
   }
-  /** List every schema visible to the connected user. */
-  async listSchemas() {
-    return await this.pool.withConnection((connection) => listSchemas(connection));
+  const match = /invalid column name:\s*([^:]+)/i.exec(error.message);
+  const name = match?.[1]?.trim();
+  return name === void 0 || name.length === 0 ? void 0 : name;
+}
+function rankCatalogSuggestions(requested, candidates, limit = 5) {
+  return candidates.map((candidate) => ({ candidate, score: score(requested, candidate) })).filter((item) => item.score >= 45).sort(
+    (left, right) => right.score - left.score || left.candidate.schema.localeCompare(right.candidate.schema) || (left.candidate.type === right.candidate.type ? 0 : left.candidate.type === "TABLE" ? -1 : 1) || left.candidate.name.localeCompare(right.candidate.name)
+  ).slice(0, limit).map((item) => item.candidate);
+}
+function formatSuggestions(suggestions) {
+  if (suggestions.length === 0) {
+    return void 0;
   }
-  /** List the tables in a schema. */
-  async listTables(schema) {
-    return await this.pool.withConnection((connection) => listTables(connection, schema));
+  return [
+    "Did you mean:",
+    ...suggestions.map((item) => `  ${item.schema}.${item.name} (${item.type})`)
+  ].join("\n");
+}
+function rankNameSuggestions(requested, candidates, limit = 5) {
+  const requestedName = { name: requested };
+  return candidates.map((candidate) => ({
+    candidate,
+    score: score(requestedName, { schema: "", name: candidate.name, type: "TABLE" })
+  })).filter((item) => item.score >= 45).sort(
+    (left, right) => right.score - left.score || left.candidate.name.localeCompare(right.candidate.name)
+  ).slice(0, limit).map((item) => item.candidate);
+}
+function formatColumnSuggestions(suggestions) {
+  if (suggestions.length === 0) {
+    return void 0;
   }
-  /** List table and view names in a schema for typo suggestions. */
-  async listCatalogObjects(schema) {
-    return await this.pool.withConnection((connection) => listCatalogObjects(connection, schema));
+  return [
+    "Did you mean column:",
+    ...suggestions.map((item) => `  ${item.name}`)
+  ].join("\n");
+}
+
+// src/cli-query-hints.ts
+async function loadSuggestionCatalogObjects(client, refresh) {
+  try {
+    return await loadCatalogObjectsWithCache(
+      toMetadataCacheScope(client.info),
+      refresh,
+      async () => await client.listCatalogObjects(client.info.schema)
+    );
+  } catch {
+    return await client.listCatalogObjects(client.info.schema);
   }
-  /** List the columns of a table. */
-  async listColumns(schema, table) {
-    return await this.pool.withConnection(
-      (connection) => listColumns(connection, schema, table)
+}
+function isLobSortOrGroupError(error) {
+  const code = databaseCode(error);
+  if (code !== 266 && code !== 274) {
+    return false;
+  }
+  return error instanceof QueryError && /LOB type is not allowed in (?:ORDER BY|GROUP BY) clause/i.test(error.message);
+}
+function printLobSortOrGroupHint() {
+  const lines = [
+    `${CLI_NAME}: HANA cannot ORDER BY or GROUP BY NCLOB/CLOB/BLOB columns directly.`,
+    `${CLI_NAME}: Remove the LOB column from ORDER BY/GROUP BY or wrap it as TO_VARCHAR(<column>).`
+  ];
+  process.stderr.write(`${lines.join("\n")}
+`);
+}
+function isInsufficientPrivilegeError(error) {
+  return databaseCode(error) === 258 || /\binsufficient privilege\b/i.test(errorMessage(error));
+}
+function printInsufficientPrivilegeHint(client, schema) {
+  const binding = client.info.bindingName ?? (client.info.bindingIndex === void 0 ? "unknown" : `#${String(client.info.bindingIndex)}`);
+  const otherBindings = (client.info.availableBindingNames ?? []).filter(
+    (name) => name !== client.info.bindingName
+  );
+  const retryBinding = otherBindings[0];
+  const lines = [
+    `${CLI_NAME}: insufficient privilege for schema ${schema} as database user ${client.databaseUser || "unknown"} (current binding: ${binding}).`
+  ];
+  if (retryBinding !== void 0) {
+    lines.push(
+      `${CLI_NAME}: other HANA bindings on this app: ${otherBindings.join(", ")}; retry with --binding ${retryBinding}.`
     );
   }
-  /** Return the HANA execution plan for a statement. */
-  async explain(sql, params) {
-    return await this.pool.withConnection(async (connection) => {
-      connection.assertAllowed(sql);
-      const statementName = nextExplainStatementName();
-      await connection.executeInternal(
-        `EXPLAIN PLAN SET STATEMENT_NAME = '${statementName}' FOR ${sql}`,
-        params
-      );
-      const cleanup = async () => {
-        await connection.executeInternal(
-          "DELETE FROM EXPLAIN_PLAN_TABLE WHERE STATEMENT_NAME = ?",
-          [statementName]
-        );
-      };
-      let queryCompleted = false;
-      try {
-        const result = await connection.query(
-          "SELECT OPERATOR_NAME, TABLE_NAME, TABLE_TYPE, EXECUTION_ENGINE FROM EXPLAIN_PLAN_TABLE WHERE STATEMENT_NAME = ? ORDER BY OPERATOR_ID",
-          [statementName]
-        );
-        queryCompleted = true;
-        await cleanup();
-        return result;
-      } catch (error) {
-        if (!queryCompleted) {
-          try {
-            await cleanup();
-          } catch {
-          }
-        }
-        throw error;
-      }
-    });
+  lines.push(
+    `${CLI_NAME}: try another app or full selector whose binding has the grant; no automatic retry was attempted.`
+  );
+  process.stderr.write(`${lines.join("\n")}
+`);
+}
+function rethrowWithPrivilegeHint(error, client, schema) {
+  if (isInsufficientPrivilegeError(error)) {
+    printInsufficientPrivilegeHint(client, schema);
   }
-  /** Close every pooled connection. The client must not be used afterwards. */
-  async close() {
-    await this.pool.drain();
+  throw error;
+}
+async function printColumnSuggestions(error, client, sql) {
+  if (databaseCode(error) !== 260) {
+    return;
   }
-  async runQuery(sql, params, options) {
-    return await this.pool.withConnection(
-      (connection) => connection.query(sql, params, options)
-    );
+  const columnName = extractInvalidColumnNameFromError(error);
+  const tableName = extractMissingObjectName(sql);
+  if (columnName === void 0 || tableName === void 0) {
+    return;
   }
-  async runExecute(sql, params, options) {
-    return await this.pool.withConnection(
-      (connection) => connection.execute(sql, params, options)
+  try {
+    const columns = await client.listColumns(
+      tableName.schema ?? client.info.schema,
+      tableName.name
     );
+    const text = formatColumnSuggestions(rankNameSuggestions(columnName, columns));
+    if (text !== void 0) {
+      process.stderr.write(`${text}
+`);
+    }
+  } catch {
   }
-  async recordSqlHistory(operation, sql, params, result) {
-    try {
-      await appendSqlHistory({
-        version: CLI_VERSION,
-        operation,
-        selector: this.info.selector,
-        appName: this.info.appName,
-        schema: this.info.schema,
-        role: this.info.role,
-        statement: result.statement,
-        sql,
-        paramCount: params.length,
-        rowCount: result.rowCount,
-        truncated: result.truncated,
-        elapsedMs: result.elapsedMs
-      });
-    } catch {
+}
+async function printCatalogObjectSuggestions(error, client, sql, refresh) {
+  if (!isInvalidCatalogObjectError(error)) {
+    return;
+  }
+  const requested = extractMissingObjectNameFromError(error) ?? extractMissingObjectName(sql);
+  if (requested === void 0) {
+    return;
+  }
+  try {
+    const objects = await loadSuggestionCatalogObjects(client, refresh);
+    const text = formatSuggestions(rankCatalogSuggestions(requested, objects));
+    if (text !== void 0) {
+      process.stderr.write(`${text}
+`);
     }
+  } catch {
   }
-};
-
-// src/api.ts
-async function connect(selector, options) {
-  return await HanaClient.connect(selector, options);
+}
+async function enrichAndRethrowQueryError(error, client, sql, refresh) {
+  if (isInsufficientPrivilegeError(error)) {
+    const schema = extractMissingObjectName(sql)?.schema ?? client.info.schema;
+    printInsufficientPrivilegeHint(client, schema);
+    throw error;
+  }
+  if (isLobSortOrGroupError(error)) {
+    printLobSortOrGroupHint();
+    throw error;
+  }
+  await printColumnSuggestions(error, client, sql);
+  await printCatalogObjectSuggestions(error, client, sql, refresh);
+  throw error;
 }
 
 // src/cli-results.ts
@@ -4564,7 +4820,7 @@ function searchResultSession(session, searchTerm, options) {
 
 // src/result-store.ts
 import { randomBytes } from "crypto";
-import { mkdir as mkdir5, readFile as readFile3, readdir as readdir3, rename as rename3, rm as rm6, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile4, readdir as readdir3, rename as rename3, rm as rm6, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
 var RESULT_REF_PATTERN = /^q[0-9a-f]{8}$/;
@@ -4687,7 +4943,7 @@ function isStoredSession(value) {
 }
 async function readStoredSession(path) {
   try {
-    const parsed = JSON.parse(await readFile3(path, "utf8"));
+    const parsed = JSON.parse(await readFile4(path, "utf8"));
     return isStoredSession(parsed) ? parsed : void 0;
   } catch (error) {
     if (error.code === "ENOENT") {