@tenderprompt/cli 0.1.11 → 0.1.13

package/dist/index.js

@@ -43,14 +43,24 @@ class TenderCliAnalyticsApiError extends Error {
     reasonCode;
     constructor(message, reasonCode) {
         super(message);
-        this.reasonCode = reasonCode;
         this.name = "TenderCliAnalyticsApiError";
+        this.reasonCode = reasonCode;
+    }
+}
+class TenderCliDbApiError extends Error {
+    reasonCode;
+    constructor(message, reasonCode) {
+        super(message);
+        this.name = "TenderCliDbApiError";
+        this.reasonCode = reasonCode;
     }
 }
 const DEFAULT_PROFILE_NAME = "default";
 const DEFAULT_BASE_URL = "https://app.tenderprompt.com";
 const ARTIFACT_SOURCE_EXPORT_MAX_FILES = 1000;
 const ARTIFACT_SOURCE_EXPORT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const DB_SQL_STATEMENT_MAX_BYTES = 100 * 1024;
+const DB_MAX_BOUND_PARAMETERS = 100;
 function rootHelp() {
     return `Usage: tender <command> [options]
 
@@ -89,6 +99,10 @@ Commands:
                              Run a server-validated chart spec
   tender app analytics suggestions <app-id>
                              Generate useful starter chart suggestions
+  tender app db capabilities <app-id>
+                             Describe app database query limits and policy
+  tender app db query <app-id> --sql <sql>
+                             Run one read-only app database query
   tender app context fetch <app-id>
                              Fetch managed agent context into a checkout
   tender app context status <app-id>
@@ -120,6 +134,10 @@ Examples:
   tender app analytics summary artifact_123 --range 30d --json
   tender app analytics query artifact_123 --spec chart.json --json
   tender app analytics suggestions artifact_123 --range 30d --json
+  tender app db capabilities artifact_123 --json
+  tender app db tables artifact_123 --json
+  tender app db schema artifact_123 --table votes --json
+  tender app db query artifact_123 --sql "select * from votes limit 20" --json
   tender app context fetch artifact_123 --dir ./widget --dry-run --json
   tender app context status artifact_123 --dir ./widget --json
   tender app context refresh artifact_123 --dir ./widget --dry-run --json
@@ -142,12 +160,12 @@ Examples:
   tender auth status --json`;
 }
 function authLoginHelp() {
-    return `Usage: tender auth login --device [--base-url <url>] [--profile <edit-preview|publish|create>] [--artifact <artifact-id>] [--ttl <7d|14d|30d>] [--save-profile <name>] [--no-poll] [--json]
+    return `Usage: tender auth login --device [--base-url <url>] [--profile <edit-preview|publish|create|db-read>] [--artifact <artifact-id>] [--ttl <7d|14d|30d>] [--save-profile <name>] [--no-poll] [--json]
 
 Options:
   --device                 Use the OAuth device-code flow.
   --base-url <url>         Tender base URL. Defaults to TENDER_BASE_URL or https://app.tenderprompt.com.
-  --profile <value>        Token permission profile: edit-preview, publish, or create. Defaults to edit-preview.
+  --profile <value>        Token permission profile: edit-preview, publish, create, or db-read. Defaults to edit-preview.
   --artifact <artifact-id> Scope the token to one artifact. Required for normal edit-preview agent work.
   --ttl <value>            Token lifetime: 7d, 14d, or 30d. Defaults to 7d.
   --save-profile <name>    Local config profile name. Defaults to default.
@@ -157,7 +175,8 @@ Options:
 Examples:
   tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
   tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish --json
-  tender auth login --device --profile create --ttl 7d --save-profile account`;
+  tender auth login --device --profile create --ttl 7d --save-profile account
+  tender auth login --device --profile db-read --artifact artifact_123 --ttl 7d --save-profile db`;
 }
 function authStatusHelp() {
     return `Usage: tender auth status [--profile <name>] [--json]
@@ -213,10 +232,18 @@ Commands:
                              Update a saved chart title or spec
   tender app analytics charts delete <app-id>
                              Delete a saved chart
-  tender app analytics property-slots list <app-id>
-                             List promoted property slots
-  tender app analytics property-slots activate <app-id>
-                             Activate a promoted property slot
+  tender app analytics properties list <app-id>
+                             List properties available to dashboard queries
+  tender app analytics properties activate <app-id>
+                             Make a custom event property queryable
+  tender app db capabilities <app-id>
+                             Describe app database query limits and policy
+  tender app db tables <app-id>
+                             List app database tables and views
+  tender app db schema <app-id> --table <name>
+                             Show table and index schema for one table
+  tender app db query <app-id> --sql <sql>
+                             Run one read-only app database query
   tender app context fetch <app-id>
                              Fetch AGENTS.md, skills, and Tender App scaffold files
   tender app context status <app-id>
@@ -255,8 +282,12 @@ Examples:
   tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json
   tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --spec funnel.json --dry-run --json
   tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
-  tender app analytics property-slots list artifact_123 --json
-  tender app analytics property-slots activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
+  tender app db capabilities artifact_123 --json
+  tender app db tables artifact_123 --json
+  tender app db schema artifact_123 --table votes --json
+  tender app db query artifact_123 --sql "select * from votes limit 20" --json
   tender app context fetch artifact_123 --dir ./widget --dry-run --json
   tender app context status artifact_123 --dir ./widget --json
   tender app context refresh artifact_123 --dir ./widget --dry-run --json
@@ -294,8 +325,8 @@ Commands:
   tender app analytics charts list <app-id>   List saved charts in one dashboard
   tender app analytics charts update <app-id> Update a saved chart
   tender app analytics charts delete <app-id> Delete a saved chart
-  tender app analytics property-slots list <app-id>      List promoted property slots
-  tender app analytics property-slots activate <app-id>  Activate a promoted property slot
+  tender app analytics properties list <app-id>      List queryable custom event properties
+  tender app analytics properties activate <app-id>  Make a property queryable
 
 Examples:
   tender app analytics summary artifact_123 --range 30d --json
@@ -311,8 +342,8 @@ Examples:
   tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json
   tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --spec funnel.json --dry-run --json
   tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
-  tender app analytics property-slots list artifact_123 --json
-  tender app analytics property-slots activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json`;
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json`;
 }
 function analyticsSummaryHelp() {
     return `Usage: tender app analytics summary <app-id> [--range <7d|30d|90d|YYYY-MM-DD..YYYY-MM-DD>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
@@ -388,7 +419,7 @@ Examples:
 function analyticsChartsCreateHelp() {
     return `Usage: tender app analytics charts create <app-id> --dashboard <dashboard-id> --title <title> --spec <file|-> [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
-Property charts automatically activate required promoted property slots before
+Property charts automatically make required custom event properties queryable before
 saving when the spec has an event_name = filter.
 
 Examples:
@@ -406,7 +437,7 @@ function analyticsChartsUpdateHelp() {
 
 At least one of --title or --spec is required. When one is omitted, the CLI reads
 the existing saved chart and keeps that value.
-Property charts automatically activate required promoted property slots before
+Property charts automatically make required custom event properties queryable before
 saving when the spec has an event_name = filter.
 
 Examples:
@@ -421,19 +452,70 @@ Examples:
   tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
   tender app analytics charts delete artifact_123 --chart analytics_chart_123 --json`;
 }
-function analyticsPropertySlotsListHelp() {
-    return `Usage: tender app analytics property-slots list <app-id> [--event <event-name>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+function analyticsPropertiesListHelp() {
+    return `Usage: tender app analytics properties list <app-id> [--event <event-name>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties list artifact_123 --event signup_started --json`;
+}
+function analyticsPropertiesActivateHelp() {
+    return `Usage: tender app analytics properties activate <app-id> --event <event-name> --property <property-key> --type <dimension|metric> [--label <label>] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
+  tender app analytics properties activate artifact_123 --event score_saved --property score --type metric --json`;
+}
+function dbHelp() {
+    return `Usage: tender app db <command> <app-id> [options]
+
+Commands:
+  tender app db capabilities <app-id>  Describe app database policy and limits
+  tender app db tables <app-id>        List app database tables and views
+  tender app db schema <app-id>        Show schema for one table
+  tender app db query <app-id>         Run one read-only SQL query
+
+Examples:
+  tender app db capabilities artifact_123 --json
+  tender app db tables artifact_123 --json
+  tender app db schema artifact_123 --table votes --json
+  tender app db query artifact_123 --sql "select * from votes limit 20" --json
+  tender app db query artifact_123 --file ./debug.sql --param active --limit 50 --json`;
+}
+function dbCapabilitiesHelp() {
+    return `Usage: tender app db capabilities <app-id> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db capabilities artifact_123 --json`;
+}
+function dbTablesHelp() {
+    return `Usage: tender app db tables <app-id> [--env preview] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db tables artifact_123 --json
+  tender app db tables artifact_123 --env preview --json`;
+}
+function dbSchemaHelp() {
+    return `Usage: tender app db schema <app-id> --table <name> [--env preview] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Examples:
-  tender app analytics property-slots list artifact_123 --json
-  tender app analytics property-slots list artifact_123 --event signup_started --json`;
+  tender app db schema artifact_123 --table votes --json
+  tender app db schema artifact_123 --table preference_votes --env preview --json`;
 }
-function analyticsPropertySlotsActivateHelp() {
-    return `Usage: tender app analytics property-slots activate <app-id> --event <event-name> --property <property-key> --type <dimension|metric> [--slot <slot-name>] [--label <label>] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+function dbQueryHelp() {
+    return `Usage: tender app db query <app-id> (--sql <sql> | --file <path|->) [--param <value>] [--limit <n>] [--env preview] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --sql <sql>       SQL statement. Must be one read-only statement.
+  --file <path|->   Read SQL from a file or stdin with -.
+  --param <value>   Bind one positional parameter. Repeat for multiple params. Values parse as JSON scalars, falling back to string.
+  --limit <n>       Interactive row limit. Server caps the maximum.
 
 Examples:
-  tender app analytics property-slots activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
-  tender app analytics property-slots activate artifact_123 --event score_saved --property score --type metric --json`;
+  tender app db query artifact_123 --sql "select * from votes limit 20" --json
+  tender app db query artifact_123 --sql "select * from votes where choice = ?" --param coffee --json
+  tender app db query artifact_123 --file ./debug.sql --limit 50 --json
+  tender app db query artifact_123 --file - --json < debug.sql`;
 }
 function artifactsListHelp() {
     return `Usage: tender app list [--base-url <url>] [--token <token>] [--profile <name>] [--json]
@@ -767,6 +849,7 @@ function tenderCliCapabilities() {
                 "tender auth --help",
                 "tender app --help",
                 "tender app analytics --help",
+                "tender app db --help",
                 "tender app bindings outbound --help",
             ],
         },
@@ -816,8 +899,8 @@ function tenderCliCapabilities() {
                     "tender app analytics charts templates --json",
                     "tender app analytics query <artifact-id> --spec chart.json --json",
                     "tender app analytics export query <artifact-id> --spec chart.json --format csv",
-                    "tender app analytics property-slots list <artifact-id> --json",
-                    "tender app analytics property-slots activate <artifact-id> --event <event-name> --property <property-key> --type dimension --dry-run --json",
+                    "tender app analytics properties list <artifact-id> --json",
+                    "tender app analytics properties activate <artifact-id> --event <event-name> --property <property-key> --type dimension --dry-run --json",
                     "tender app analytics dashboards <artifact-id> --create \"Agent dashboard\" --dry-run --json",
                     "tender app analytics charts create <artifact-id> --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json",
                     "tender app analytics charts list <artifact-id> --dashboard <dashboard-id> --json",
@@ -827,11 +910,28 @@ function tenderCliCapabilities() {
                 notes: [
                     "Combine CLI capabilities with local source inspection of analytics calls.",
                     "Validate chart specs with query before creating or updating saved charts.",
-                    "Property chart create/update commands automatically activate missing promoted property slots when the spec has an event_name = filter.",
-                    "Ad hoc query is read-only; if it reports a missing property slot, activate the slot first or save the chart through charts create/update.",
+                    "Property chart create/update commands automatically make missing custom event properties queryable when the spec has an event_name = filter.",
+                    "Ad hoc query is read-only; if it reports a missing dashboard-query property, activate the property first or save the chart through charts create/update.",
                     "Use list before writes so agents can avoid duplicates and explain the exact chart they are changing.",
                 ],
             },
+            {
+                name: "app_database_inspection",
+                when: "When inspecting app-local database tables from a scoped token.",
+                commands: [
+                    "tender auth login --device --profile db-read --artifact <artifact-id> --ttl 7d --save-profile db --json",
+                    "tender app db capabilities <artifact-id> --profile db --json",
+                    "tender app db tables <artifact-id> --profile db --json",
+                    "tender app db schema <artifact-id> --table <table-name> --profile db --json",
+                    "tender app db query <artifact-id> --sql \"select * from <table-name> limit 20\" --profile db --json",
+                    "tender app db query <artifact-id> --file ./debug.sql --profile db --json",
+                ],
+                notes: [
+                    "The CLI only accepts artifact ids. It never accepts tenant ids, runner names, provider account ids, or runtime storage identifiers.",
+                    "Read-only policy is enforced by the server before the runtime shim executes SQL.",
+                    "Use --file - to pipe SQL from stdin without prompts.",
+                ],
+            },
             {
                 name: "outbound_http_binding",
                 when: "When app code needs external APIs, OAuth/token exchange, webhooks, provider SDKs, or secrets.",
@@ -886,14 +986,14 @@ function tenderCliCapabilities() {
                 writes: false,
             },
             {
-                command: "tender app analytics property-slots list <artifact-id> --json",
-                purpose: "List active promoted property slots that make custom event properties queryable.",
+                command: "tender app analytics properties list <artifact-id> --json",
+                purpose: "List custom event properties available to dashboard queries.",
                 requiresAuth: true,
                 writes: false,
             },
             {
-                command: "tender app analytics property-slots activate <artifact-id> --event <event-name> --property <property-key> --type <dimension|metric> --dry-run --json",
-                purpose: "Preview or activate the promoted slot needed for a property group-by or property metric chart.",
+                command: "tender app analytics properties activate <artifact-id> --event <event-name> --property <property-key> --type <dimension|metric> --dry-run --json",
+                purpose: "Preview or activate the custom event property needed for a property group-by or property metric chart.",
                 requiresAuth: true,
                 writes: true,
                 dryRun: true,
@@ -925,6 +1025,30 @@ function tenderCliCapabilities() {
                 writes: true,
                 dryRun: true,
             },
+            {
+                command: "tender app db capabilities <artifact-id> --json",
+                purpose: "Inspect app database policy, limits, and supported capabilities for one artifact.",
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: "tender app db tables <artifact-id> --json",
+                purpose: "List app database tables and views for one artifact.",
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: "tender app db schema <artifact-id> --table <table-name> --json",
+                purpose: "Inspect table, index, and trigger schema for one app database table.",
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: "tender app db query <artifact-id> --sql \"select * from <table-name> limit 20\" --json",
+                purpose: "Run one bounded read-only app database query.",
+                requiresAuth: true,
+                writes: false,
+            },
         ],
         security: [
             "Prefer artifact-scoped device tokens.",
@@ -932,6 +1056,7 @@ function tenderCliCapabilities() {
             "Do not call Tender HTTP APIs directly from agent workflows.",
             "Do not put third-party fetch calls in src/server.ts; use outbound bindings.",
             "Do not request direct query credentials or raw SQL for analytics.",
+            "Do not use tenant ids, runner names, provider account ids, or runtime storage identifiers for app database inspection.",
         ],
     };
 }
@@ -2264,10 +2389,11 @@ function parseContextRefreshArgs(args) {
 function parseTokenProfile(value) {
     if (value === "edit-preview" ||
         value === "publish" ||
-        value === "create") {
+        value === "create" ||
+        value === "db-read") {
         return value;
     }
-    throw new TenderCliUsageError("--profile must be one of edit-preview, publish, or create.");
+    throw new TenderCliUsageError("--profile must be one of edit-preview, publish, create, or db-read.");
 }
 function parsePositiveIntegerFlag(value, flag) {
     const parsed = Number(value);
@@ -2341,6 +2467,9 @@ function parseAuthLoginArgs(args) {
     if (tokenProfile === "create" && artifactId) {
         throw new TenderCliUsageError("--profile create must be account-scoped; remove --artifact.");
     }
+    if (tokenProfile === "db-read" && !artifactId) {
+        throw new TenderCliUsageError("--profile db-read requires --artifact <artifact-id>.");
+    }
     return {
         command: "auth login",
         baseUrl,
@@ -2938,13 +3067,15 @@ function analyticsChartTemplates() {
             id: "property_breakdown",
             title: "Property breakdown",
             visualization: "bar",
-            purpose: "Compare a promoted dimension property observed in events.",
+            purpose: "Compare a queryable dimension property observed in events.",
             usableAsIs: false,
             placeholders: {
-                property: "<promoted_dimension_property>",
+                eventName: "<event_name>",
+                property: "<queryable_dimension_property>",
             },
             adaptWith: [
-                "Use a property key promoted by capabilities chartSpec.groupBy, such as property:plan.",
+                "Use a queryable property key from capabilities chartSpec.groupBy, such as property:plan.",
+                "Choose the event that owns the property and keep the event_name filter.",
                 "Choose stable categorical properties with enough observations to compare.",
             ],
             spec: {
@@ -2952,8 +3083,8 @@ function analyticsChartTemplates() {
                 dataset: "events",
                 visualization: "bar",
                 metric: { name: "custom_event_count" },
-                groupBy: [{ field: "property:<promoted_dimension_property>" }],
-                filters: [],
+                groupBy: [{ field: "property:<queryable_dimension_property>" }],
+                filters: [{ field: "event_name", op: "=", value: "<event_name>" }],
                 range: { preset: "30d" },
                 sort: [{ field: "value", direction: "desc" }],
                 limit: 10,
@@ -2966,19 +3097,21 @@ function analyticsChartTemplates() {
             purpose: "Track an observed numeric event property over time.",
             usableAsIs: false,
             placeholders: {
-                metric: "avg:<promoted_metric_property>",
+                eventName: "<event_name>",
+                metric: "avg:<queryable_metric_property>",
             },
             adaptWith: [
-                "Use a numeric property key promoted by capabilities chartSpec.metrics.",
+                "Use a queryable numeric property key from capabilities chartSpec.metrics.",
+                "Choose the event that owns the property and keep the event_name filter.",
                 "Prefer averages for scores, durations, quantities, or ordinal values.",
             ],
             spec: {
                 version: 1,
                 dataset: "events",
                 visualization: "line",
-                metric: { name: "avg:<promoted_metric_property>" },
+                metric: { name: "avg:<queryable_metric_property>" },
                 groupBy: [{ field: "day" }],
-                filters: [],
+                filters: [{ field: "event_name", op: "=", value: "<event_name>" }],
                 range: { preset: "30d" },
                 sort: [{ field: "label", direction: "asc" }],
                 limit: 30,
@@ -3019,7 +3152,7 @@ function runAnalyticsChartsTemplates(command, io) {
         templates,
         next: [
             "Run tender app analytics capabilities <artifact-id> --include-catalog --range 30d --json.",
-            "Choose a template and replace placeholders with observed events, paths, or promoted property keys.",
+            "Choose a template and replace placeholders with observed events, paths, or queryable property keys.",
             "Validate with tender app analytics query <artifact-id> --spec chart.json --json.",
             "Preview saved writes with tender app analytics dashboards ... --dry-run and charts create ... --dry-run.",
         ],
@@ -3206,13 +3339,13 @@ function parseAnalyticsChartsDeleteArgs(args) {
         ...parsed,
     };
 }
-function parseAnalyticsPropertySlotsListArgs(args) {
+function parseAnalyticsPropertiesListArgs(args) {
     if (args.includes("--help") || args.includes("-h")) {
-        return { command: "help", topic: "app analytics property-slots list" };
+        return { command: "help", topic: "app analytics properties list" };
     }
     const artifactId = args[0];
     if (!artifactId || artifactId.startsWith("-")) {
-        throw new TenderCliUsageError("app id is required. Example: tender app analytics property-slots list <app-id> --json");
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics properties list <app-id> --json");
     }
     const parsed = parseAnalyticsCommonArgs(args, 1);
     let eventName = null;
@@ -3223,28 +3356,27 @@ function parseAnalyticsPropertySlotsListArgs(args) {
             index += 1;
             continue;
         }
-        throw new TenderCliUsageError(`Unknown analytics property-slots list option: ${arg}`);
+        throw new TenderCliUsageError(`Unknown analytics properties list option: ${arg}`);
     }
     return {
-        command: "app analytics property-slots list",
+        command: "app analytics properties list",
         artifactId,
         eventName,
         ...parsed,
     };
 }
-function parseAnalyticsPropertySlotsActivateArgs(args) {
+function parseAnalyticsPropertiesActivateArgs(args) {
     if (args.includes("--help") || args.includes("-h")) {
-        return { command: "help", topic: "app analytics property-slots activate" };
+        return { command: "help", topic: "app analytics properties activate" };
     }
     const artifactId = args[0];
     if (!artifactId || artifactId.startsWith("-")) {
-        throw new TenderCliUsageError("app id is required. Example: tender app analytics property-slots activate <app-id> --event <event-name> --property <property-key> --type dimension --json");
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics properties activate <app-id> --event <event-name> --property <property-key> --type dimension --json");
     }
     const parsed = parseAnalyticsCommonArgs(args, 1);
     let eventName = null;
     let propertyKey = null;
-    let slotType = null;
-    let slotName = null;
+    let propertyType = null;
     let label = null;
     let dryRun = false;
     for (let index = 0; index < parsed.remaining.length; index += 1) {
@@ -3264,12 +3396,7 @@ function parseAnalyticsPropertySlotsActivateArgs(args) {
             if (value !== "dimension" && value !== "metric") {
                 throw new TenderCliUsageError("--type must be dimension or metric.");
             }
-            slotType = value;
-            index += 1;
-            continue;
-        }
-        if (arg === "--slot") {
-            slotName = parseRequiredFlagValue(parsed.remaining[index + 1], "--slot");
+            propertyType = value;
             index += 1;
             continue;
         }
@@ -3282,23 +3409,227 @@ function parseAnalyticsPropertySlotsActivateArgs(args) {
             dryRun = true;
             continue;
         }
-        throw new TenderCliUsageError(`Unknown analytics property-slots activate option: ${arg}`);
+        throw new TenderCliUsageError(`Unknown analytics properties activate option: ${arg}`);
     }
-    if (!eventName || !propertyKey || !slotType) {
-        throw new TenderCliUsageError("--event, --property, and --type are required. Example: tender app analytics property-slots activate artifact_123 --event signup_started --property plan --type dimension --json");
+    if (!eventName || !propertyKey || !propertyType) {
+        throw new TenderCliUsageError("--event, --property, and --type are required. Example: tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --json");
     }
     return {
-        command: "app analytics property-slots activate",
+        command: "app analytics properties activate",
         artifactId,
         eventName,
         propertyKey,
-        slotType,
-        slotName,
+        propertyType,
         label,
         dryRun,
         ...parsed,
     };
 }
+function parseDbCommonArgs(args, startIndex) {
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    const remaining = [];
+    for (let index = startIndex; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        remaining.push(arg);
+    }
+    return { baseUrl, flagToken, profileName, json, remaining };
+}
+function parseDbEnvironment(value) {
+    if (value === undefined || value === "preview") {
+        return "preview";
+    }
+    throw new TenderCliUsageError("--env must be preview.");
+}
+function parseDbFlagValue(value, flag) {
+    if (!value || value.startsWith("--")) {
+        throw new TenderCliUsageError(`${flag} requires a value.`);
+    }
+    return value;
+}
+function parseDbFilePath(value) {
+    if (!value || (value !== "-" && value.startsWith("-"))) {
+        throw new TenderCliUsageError("--file requires a SQL file path or - for stdin.");
+    }
+    return value;
+}
+function parseDbParameter(value) {
+    const raw = parseDbFlagValue(value, "--param");
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null ||
+            typeof parsed === "string" ||
+            typeof parsed === "number") {
+            return parsed;
+        }
+    }
+    catch {
+        // Fall back to a string binding.
+    }
+    return raw;
+}
+function parseDbCapabilitiesArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app db capabilities" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app db capabilities <app-id> --json");
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    if (parsed.remaining.length > 0) {
+        throw new TenderCliUsageError(`Unknown app db capabilities option: ${parsed.remaining[0]}`);
+    }
+    return { command: "app db capabilities", artifactId, ...parsed };
+}
+function parseDbTablesArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app db tables" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app db tables <app-id> --json");
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let environment = "preview";
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--env") {
+            environment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db tables option: ${arg}`);
+    }
+    return { command: "app db tables", artifactId, environment, ...parsed };
+}
+function parseDbSchemaArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app db schema" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app db schema <app-id> --table votes --json");
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let environment = "preview";
+    let tableName = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--env") {
+            environment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--table") {
+            tableName = parseRequiredFlagValue(parsed.remaining[index + 1], "--table");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db schema option: ${arg}`);
+    }
+    if (!tableName) {
+        throw new TenderCliUsageError("--table is required. Example: tender app db schema artifact_123 --table votes --json");
+    }
+    return {
+        command: "app db schema",
+        artifactId,
+        environment,
+        tableName,
+        ...parsed,
+    };
+}
+function parseDbQueryArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app db query" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app db query <app-id> --sql \"select * from votes limit 20\" --json");
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let environment = "preview";
+    let sqlSource = null;
+    const params = [];
+    let limit = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--env") {
+            environment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--sql") {
+            if (sqlSource) {
+                throw new TenderCliUsageError("--sql and --file cannot be repeated or combined.");
+            }
+            sqlSource = {
+                kind: "inline",
+                value: parseDbFlagValue(parsed.remaining[index + 1], "--sql"),
+            };
+            index += 1;
+            continue;
+        }
+        if (arg === "--file") {
+            if (sqlSource) {
+                throw new TenderCliUsageError("--sql and --file cannot be repeated or combined.");
+            }
+            sqlSource = {
+                kind: "file",
+                value: parseDbFilePath(parsed.remaining[index + 1]),
+            };
+            index += 1;
+            continue;
+        }
+        if (arg === "--param") {
+            params.push(parseDbParameter(parsed.remaining[index + 1]));
+            index += 1;
+            continue;
+        }
+        if (arg === "--limit") {
+            limit = parsePositiveIntegerFlag(parsed.remaining[index + 1], "--limit");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db query option: ${arg}`);
+    }
+    if (!sqlSource) {
+        throw new TenderCliUsageError("--sql or --file is required. Example: tender app db query artifact_123 --sql \"select * from votes limit 20\" --json");
+    }
+    if (params.length > DB_MAX_BOUND_PARAMETERS) {
+        throw new TenderCliUsageError(`App database queries are limited to ${DB_MAX_BOUND_PARAMETERS} bound parameters.`);
+    }
+    return {
+        command: "app db query",
+        artifactId,
+        environment,
+        sqlSource,
+        params,
+        limit,
+        ...parsed,
+    };
+}
 function parseTenderArgs(args) {
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
         return { command: "help", topic: "root" };
@@ -3383,21 +3714,21 @@ function parseTenderArgs(args) {
             return parseAnalyticsDashboardsArgs(resourceArgs.slice(3));
         }
         if (resourceArgs[1] === "analytics" &&
-            resourceArgs[2] === "property-slots" &&
+            resourceArgs[2] === "properties" &&
             (resourceArgs[3] === undefined ||
                 resourceArgs[3] === "--help" ||
                 resourceArgs[3] === "-h")) {
-            return { command: "help", topic: "app analytics property-slots list" };
+            return { command: "help", topic: "app analytics properties list" };
         }
         if (resourceArgs[1] === "analytics" &&
-            resourceArgs[2] === "property-slots" &&
+            resourceArgs[2] === "properties" &&
             resourceArgs[3] === "list") {
-            return parseAnalyticsPropertySlotsListArgs(resourceArgs.slice(4));
+            return parseAnalyticsPropertiesListArgs(resourceArgs.slice(4));
         }
         if (resourceArgs[1] === "analytics" &&
-            resourceArgs[2] === "property-slots" &&
+            resourceArgs[2] === "properties" &&
             resourceArgs[3] === "activate") {
-            return parseAnalyticsPropertySlotsActivateArgs(resourceArgs.slice(4));
+            return parseAnalyticsPropertiesActivateArgs(resourceArgs.slice(4));
         }
         if (resourceArgs[1] === "analytics" &&
             resourceArgs[2] === "export" &&
@@ -3448,6 +3779,27 @@ function parseTenderArgs(args) {
             resourceArgs[3] === "delete") {
             return parseAnalyticsChartsDeleteArgs(resourceArgs.slice(4));
         }
+        if (resourceArgs[1] === "db" &&
+            (resourceArgs[2] === undefined ||
+                resourceArgs[2] === "--help" ||
+                resourceArgs[2] === "-h")) {
+            return { command: "help", topic: "app db" };
+        }
+        if (resourceArgs[1] === "db" && resourceArgs[2] === "capabilities") {
+            return parseDbCapabilitiesArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === "db" && resourceArgs[2] === "tables") {
+            return parseDbTablesArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === "db" && resourceArgs[2] === "schema") {
+            return parseDbSchemaArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === "db" && resourceArgs[2] === "query") {
+            return parseDbQueryArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === "db") {
+            throw new TenderCliUsageError(`Unknown app db command: ${resourceArgs[2]}`);
+        }
         if (resourceArgs[1] === "context" &&
             (resourceArgs[2] === undefined ||
                 resourceArgs[2] === "--help" ||
@@ -3849,6 +4201,55 @@ async function requestAnalyticsApi(input) {
     }
     return payload;
 }
+function appendDbEnvironment(params, environment) {
+    params.set("env", environment);
+}
+async function requestDbApi(input) {
+    const params = new URLSearchParams();
+    if (input.environment) {
+        appendDbEnvironment(params, input.environment);
+    }
+    if (input.tableName) {
+        params.set("table", input.tableName);
+    }
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/db/${input.dbPath}${query}`, {
+        method: input.method,
+        headers: {
+            authorization: `Bearer ${input.token}`,
+            accept: "application/json",
+            ...(input.body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: input.body === undefined ? undefined : JSON.stringify(input.body),
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        const reasonCode = (typeof payload?.reasonCode === "string" && payload.reasonCode) ||
+            `http_${response.status}`;
+        const message = (typeof payload?.message === "string" && payload.message) ||
+            (typeof payload?.reasonCode === "string" && payload.reasonCode) ||
+            `App database request failed with HTTP ${response.status}.`;
+        throw new TenderCliDbApiError([
+            message,
+            `Scope: artifact ${input.artifactId}, db/${input.dbPath}.`,
+            `Reason: ${reasonCode}.`,
+            `Example: ${dbCorrectedExample(input.artifactId, input.dbPath)}.`,
+        ].join("\n"), reasonCode);
+    }
+    return payload;
+}
+function dbCorrectedExample(artifactId, dbPath) {
+    if (dbPath === "capabilities") {
+        return `tender app db capabilities ${artifactId} --json`;
+    }
+    if (dbPath === "tables") {
+        return `tender app db tables ${artifactId} --json`;
+    }
+    if (dbPath === "schema") {
+        return `tender app db schema ${artifactId} --table <table-name> --json`;
+    }
+    return `tender app db query ${artifactId} --sql "select * from <table-name> limit 20" --json`;
+}
 function analyticsCorrectedExample(artifactId, analyticsPath) {
     if (analyticsPath === "capabilities") {
         return `tender app analytics capabilities ${artifactId} --include-catalog --range 30d --json`;
@@ -3859,8 +4260,8 @@ function analyticsCorrectedExample(artifactId, analyticsPath) {
     if (analyticsPath === "suggestions") {
         return `tender app analytics suggestions ${artifactId} --range 30d --json`;
     }
-    if (analyticsPath === "property-slots") {
-        return `tender app analytics property-slots list ${artifactId} --json`;
+    if (analyticsPath === "properties") {
+        return `tender app analytics properties list ${artifactId} --json`;
     }
     if (analyticsPath === "dashboards") {
         return `tender app analytics dashboards ${artifactId} --json`;
@@ -3877,6 +4278,10 @@ function readCliStringField(record, field) {
     const value = record[field];
     return typeof value === "string" ? value : null;
 }
+function readCliBooleanField(record, field) {
+    const value = record[field];
+    return typeof value === "boolean" ? value : false;
+}
 function readAnalyticsDashboardRecords(payload) {
     return Array.isArray(payload.dashboards)
         ? payload.dashboards.filter(isCliJsonRecord)
@@ -3912,9 +4317,9 @@ function readAnalyticsChartSpec(chart) {
 function readAnalyticsChartLayout(chart) {
     return isCliJsonRecord(chart.layout) ? chart.layout : {};
 }
-function readAnalyticsPropertySlotRecords(payload) {
-    return Array.isArray(payload.propertySlots)
-        ? payload.propertySlots.filter(isCliJsonRecord)
+function readAnalyticsPropertyRecords(payload) {
+    return Array.isArray(payload.properties)
+        ? payload.properties.filter(isCliJsonRecord)
         : [];
 }
 function readAnalyticsSpecEventNameFilter(spec) {
@@ -3940,34 +4345,34 @@ function readAnalyticsSpecGroupField(spec) {
     const [group] = spec.groupBy.filter(isCliJsonRecord);
     return group ? readCliStringField(group, "field") : null;
 }
-function readRequiredAnalyticsPropertySlotsFromSpec(spec) {
+function readRequiredAnalyticsPropertiesFromSpec(spec) {
     const eventName = readAnalyticsSpecEventNameFilter(spec);
     const requirements = [];
     const groupField = readAnalyticsSpecGroupField(spec);
     if (groupField?.startsWith("property:")) {
         if (!eventName) {
-            throw new TenderCliUsageError("Property group-by chart specs require an event_name = filter so the CLI can activate the promoted property slot.");
+            throw new TenderCliUsageError("Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.");
         }
         requirements.push({
             eventName,
             propertyKey: groupField.slice("property:".length),
-            slotType: "dimension",
+            propertyType: "dimension",
         });
     }
     const metricName = readAnalyticsSpecMetricName(spec);
     if (metricName?.startsWith("sum:") || metricName?.startsWith("avg:")) {
         if (!eventName) {
-            throw new TenderCliUsageError("Property metric chart specs require an event_name = filter so the CLI can activate the promoted property slot.");
+            throw new TenderCliUsageError("Property metric chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.");
         }
         requirements.push({
             eventName,
             propertyKey: metricName.slice(metricName.indexOf(":") + 1),
-            slotType: "metric",
+            propertyType: "metric",
         });
     }
     const seen = new Set();
     return requirements.filter((requirement) => {
-        const key = `${requirement.slotType}:${requirement.eventName}:${requirement.propertyKey}`;
+        const key = `${requirement.propertyType}:${requirement.eventName}:${requirement.propertyKey}`;
         if (seen.has(key)) {
             return false;
         }
@@ -3975,107 +4380,22 @@ function readRequiredAnalyticsPropertySlotsFromSpec(spec) {
         return true;
     });
 }
-function analyticsPropertySlotNames(slotType) {
-    return slotType === "dimension"
-        ? Array.from({ length: 13 }, (_, index) => `blob${index + 8}`)
-        : Array.from({ length: 19 }, (_, index) => `double${index + 2}`);
-}
-function isValidAnalyticsPropertySlotName(input) {
-    return analyticsPropertySlotNames(input.slotType).includes(input.slotName);
-}
-function findExistingAnalyticsPropertySlot(input) {
-    return (input.propertySlots.find((slot) => readCliStringField(slot, "status") === "active" &&
-        readCliStringField(slot, "eventName") === input.requirement.eventName &&
-        readCliStringField(slot, "propertyKey") === input.requirement.propertyKey &&
-        readCliStringField(slot, "slotType") === input.requirement.slotType) ?? null);
-}
-function chooseAnalyticsPropertySlotName(input) {
-    if (input.requestedSlotName) {
-        if (!isValidAnalyticsPropertySlotName({
-            slotType: input.requirement.slotType,
-            slotName: input.requestedSlotName,
-        })) {
-            throw new TenderCliUsageError(`--slot must be a valid ${input.requirement.slotType} analytics slot.`);
-        }
-        const conflictingSlot = input.propertySlots.find((slot) => readCliStringField(slot, "status") === "active" &&
-            readCliStringField(slot, "eventName") === input.requirement.eventName &&
-            readCliStringField(slot, "slotType") === input.requirement.slotType &&
-            readCliStringField(slot, "slotName") === input.requestedSlotName &&
-            readCliStringField(slot, "propertyKey") !== input.requirement.propertyKey);
-        if (conflictingSlot) {
-            throw new TenderCliUsageError(`--slot ${input.requestedSlotName} is already active for another ${input.requirement.slotType} property on ${input.requirement.eventName}.`);
-        }
-        return input.requestedSlotName;
-    }
-    const usedSlots = new Set(input.propertySlots
-        .filter((slot) => readCliStringField(slot, "status") === "active" &&
-        readCliStringField(slot, "eventName") === input.requirement.eventName &&
-        readCliStringField(slot, "slotType") === input.requirement.slotType)
-        .map((slot) => readCliStringField(slot, "slotName"))
-        .filter((slotName) => Boolean(slotName)));
-    const slotName = analyticsPropertySlotNames(input.requirement.slotType).find((candidate) => !usedSlots.has(candidate));
-    if (!slotName) {
-        throw new Error("analytics_property_slots_full");
-    }
-    return slotName;
-}
-async function fetchAnalyticsPropertySlots(input) {
-    const payload = await requestAnalyticsApi({
-        artifactId: input.command.artifactId,
-        analyticsPath: "property-slots",
-        method: "GET",
-        baseUrl: input.credentials.baseUrl,
-        token: input.credentials.token,
-        fetcher: input.runtime.fetcher ?? fetch,
-    });
-    return { payload, propertySlots: readAnalyticsPropertySlotRecords(payload) };
-}
-async function ensureAnalyticsPropertySlots(input) {
+async function ensureAnalyticsProperties(input) {
     if (input.requirements.length === 0) {
         return [];
     }
-    const { propertySlots } = await fetchAnalyticsPropertySlots({
-        command: input.command,
-        credentials: input.credentials,
-        runtime: input.runtime,
-    });
     const plan = [];
     for (const requirement of input.requirements) {
-        const existing = findExistingAnalyticsPropertySlot({
-            propertySlots,
-            requirement,
-        });
-        if (existing) {
-            plan.push({
-                ...requirement,
-                slotName: readCliStringField(existing, "slotName") ?? "",
-                label: readCliStringField(existing, "label") ?? requirement.propertyKey,
-                status: "existing",
-                propertySlot: existing,
-            });
-            continue;
-        }
-        const slotName = chooseAnalyticsPropertySlotName({
-            propertySlots,
-            requirement,
-        });
         const body = {
             eventName: requirement.eventName,
             propertyKey: requirement.propertyKey,
-            slotType: requirement.slotType,
-            slotName,
+            propertyType: requirement.propertyType,
             label: requirement.propertyKey,
+            dryRun: input.dryRun,
         };
-        if (input.dryRun) {
-            plan.push({
-                ...body,
-                status: "planned",
-            });
-            continue;
-        }
         const payload = await requestAnalyticsApi({
             artifactId: input.command.artifactId,
-            analyticsPath: "property-slots",
+            analyticsPath: "properties",
             method: "POST",
             baseUrl: input.credentials.baseUrl,
             token: input.credentials.token,
@@ -4083,17 +4403,16 @@ async function ensureAnalyticsPropertySlots(input) {
             body,
         });
         plan.push({
-            ...body,
-            status: "activated",
-            propertySlot: payload.propertySlot,
-        });
-        propertySlots.push({
-            eventName: body.eventName,
-            propertyKey: body.propertyKey,
-            slotType: body.slotType,
-            slotName: body.slotName,
-            label: body.label,
-            status: "active",
+            eventName: requirement.eventName,
+            propertyKey: requirement.propertyKey,
+            propertyType: requirement.propertyType,
+            label: requirement.propertyKey,
+            status: readCliBooleanField(payload, "alreadyActive")
+                ? "existing"
+                : input.dryRun
+                    ? "planned"
+                    : "activated",
+            property: payload.property,
         });
     }
     return plan;
@@ -4108,12 +4427,12 @@ function analyticsCommandAuthFlags(command) {
     }
     return flags;
 }
-function analyticsPropertySlotActivationCommand(input) {
+function analyticsPropertyActivationCommand(input) {
     return [
         "tender",
         "app",
         "analytics",
-        "property-slots",
+        "properties",
         "activate",
         shellQuote(input.command.artifactId),
         "--event",
@@ -4121,16 +4440,16 @@ function analyticsPropertySlotActivationCommand(input) {
         "--property",
         shellQuote(input.requirement.propertyKey),
         "--type",
-        input.requirement.slotType,
+        input.requirement.propertyType,
         ...(input.dryRun ? ["--dry-run"] : []),
         ...analyticsCommandAuthFlags(input.command),
         "--json",
     ].join(" ");
 }
-function createAnalyticsPropertySlotGuidance(input) {
+function createAnalyticsPropertyGuidance(input) {
     let requirements;
     try {
-        requirements = readRequiredAnalyticsPropertySlotsFromSpec(input.spec);
+        requirements = readRequiredAnalyticsPropertiesFromSpec(input.spec);
     }
     catch {
         return null;
@@ -4142,11 +4461,11 @@ function createAnalyticsPropertySlotGuidance(input) {
         "To make this chart available for dashboard queries, activate the custom event property first:",
     ];
     for (const requirement of requirements) {
-        lines.push(analyticsPropertySlotActivationCommand({
+        lines.push(analyticsPropertyActivationCommand({
             command: input.command,
             requirement,
             dryRun: true,
-        }), analyticsPropertySlotActivationCommand({
+        }), analyticsPropertyActivationCommand({
             command: input.command,
             requirement,
             dryRun: false,
@@ -4172,8 +4491,8 @@ async function requestAnalyticsQueryWithPropertyGuidance(input) {
     }
     catch (error) {
         if (error instanceof TenderCliAnalyticsApiError &&
-            error.reasonCode === "analytics_property_slot_not_found") {
-            const guidance = createAnalyticsPropertySlotGuidance({
+            error.reasonCode === "analytics_property_not_queryable") {
+            const guidance = createAnalyticsPropertyGuidance({
                 command: input.command,
                 spec: input.spec,
             });
@@ -6216,6 +6535,131 @@ async function resolveAnalyticsCredentials(command, runtime) {
         env: runtime.env ?? process.env,
     });
 }
+async function resolveDbCredentials(command, runtime) {
+    return await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+}
+function validateDbSql(sql) {
+    if (!sql.trim()) {
+        throw new TenderCliUsageError("SQL statement is required.");
+    }
+    const byteLength = new TextEncoder().encode(sql).byteLength;
+    if (byteLength > DB_SQL_STATEMENT_MAX_BYTES) {
+        throw new TenderCliUsageError(`SQL statement is limited to ${DB_SQL_STATEMENT_MAX_BYTES} bytes.`);
+    }
+}
+async function readDbSql(command, runtime) {
+    const sql = command.sqlSource.kind === "inline"
+        ? command.sqlSource.value
+        : command.sqlSource.value === "-"
+            ? runtime.stdin
+            : await readFile(path.resolve(command.sqlSource.value), "utf8");
+    if (!sql) {
+        throw new TenderCliUsageError("--file - requires SQL on stdin.");
+    }
+    validateDbSql(sql);
+    return sql;
+}
+function printDbPayload(command, io, payload, fallbackLines) {
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout(fallbackLines.join("\n"));
+    }
+}
+async function runDbCapabilities(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestDbApi({
+        artifactId: command.artifactId,
+        dbPath: "capabilities",
+        method: "GET",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const limits = isCliJsonRecord(payload.limits) ? payload.limits : {};
+    const runtimeInfo = isCliJsonRecord(payload.runtime) ? payload.runtime : {};
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `backend: ${String(runtimeInfo.backend ?? "app-database")}`,
+        `default_limit: ${String(limits.defaultLimit ?? "")}`,
+        `max_limit: ${String(limits.maxInteractiveLimit ?? "")}`,
+    ]);
+    return 0;
+}
+async function runDbTables(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestDbApi({
+        artifactId: command.artifactId,
+        dbPath: "tables",
+        method: "GET",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        environment: command.environment,
+    });
+    const rows = Array.isArray(payload.rows) ? payload.rows : [];
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `environment: ${command.environment}`,
+        `tables: ${rows.length}`,
+    ]);
+    return 0;
+}
+async function runDbSchema(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestDbApi({
+        artifactId: command.artifactId,
+        dbPath: "schema",
+        method: "GET",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        environment: command.environment,
+        tableName: command.tableName,
+    });
+    const rows = Array.isArray(payload.rows) ? payload.rows : [];
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `environment: ${command.environment}`,
+        `table: ${command.tableName}`,
+        `schema_rows: ${rows.length}`,
+    ]);
+    return 0;
+}
+async function runDbQuery(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const sql = await readDbSql(command, runtime);
+    const body = {
+        environment: command.environment,
+        mode: "read",
+        sql,
+        params: command.params,
+        ...(command.limit === null ? {} : { limit: command.limit }),
+    };
+    const payload = await requestDbApi({
+        artifactId: command.artifactId,
+        dbPath: "query",
+        method: "POST",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body,
+    });
+    const rows = Array.isArray(payload.rows) ? payload.rows : [];
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `environment: ${command.environment}`,
+        `rows: ${rows.length}`,
+        `truncated: ${String(payload.truncated ?? false)}`,
+    ]);
+    return 0;
+}
 async function runAnalyticsSummary(command, io, runtime) {
     const credentials = await resolveAnalyticsCredentials(command, runtime);
     const payload = await requestAnalyticsApi({
@@ -6380,93 +6824,43 @@ async function runAnalyticsExportQuery(command, io, runtime) {
     io.stdout(JSON.stringify(payload, null, 2));
     return 0;
 }
-async function runAnalyticsPropertySlotsList(command, io, runtime) {
+async function runAnalyticsPropertiesList(command, io, runtime) {
     const credentials = await resolveAnalyticsCredentials(command, runtime);
     const payload = await requestAnalyticsApi({
         artifactId: command.artifactId,
-        analyticsPath: "property-slots",
+        analyticsPath: "properties",
         method: "GET",
         baseUrl: credentials.baseUrl,
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
     });
-    const propertySlots = readAnalyticsPropertySlotRecords(payload).filter((slot) => !command.eventName ||
-        readCliStringField(slot, "eventName") === command.eventName);
+    const properties = readAnalyticsPropertyRecords(payload).filter((property) => !command.eventName ||
+        readCliStringField(property, "eventName") === command.eventName);
     printAnalyticsPayload(command, io, {
         ok: true,
         command: command.command,
         artifactId: command.artifactId,
         eventName: command.eventName,
-        propertySlots,
+        properties,
     }, [
         `app_id: ${command.artifactId}`,
         command.eventName ? `event: ${command.eventName}` : "event: all",
-        `property_slots: ${propertySlots.length}`,
+        `properties: ${properties.length}`,
     ]);
     return 0;
 }
-async function runAnalyticsPropertySlotsActivate(command, io, runtime) {
+async function runAnalyticsPropertiesActivate(command, io, runtime) {
     const credentials = await resolveAnalyticsCredentials(command, runtime);
-    const requirement = {
-        eventName: command.eventName,
-        propertyKey: command.propertyKey,
-        slotType: command.slotType,
-    };
-    const { propertySlots } = await fetchAnalyticsPropertySlots({
-        command,
-        credentials,
-        runtime,
-    });
-    const existing = findExistingAnalyticsPropertySlot({
-        propertySlots,
-        requirement,
-    });
-    if (existing) {
-        const payload = {
-            ok: true,
-            command: command.command,
-            artifactId: command.artifactId,
-            alreadyActive: true,
-            propertySlot: existing,
-        };
-        printAnalyticsPayload(command, io, payload, [
-            `app_id: ${command.artifactId}`,
-            "already_active: true",
-            `slot_name: ${readCliStringField(existing, "slotName") ?? ""}`,
-        ]);
-        return 0;
-    }
-    const slotName = chooseAnalyticsPropertySlotName({
-        propertySlots,
-        requirement,
-        requestedSlotName: command.slotName,
-    });
     const request = {
         eventName: command.eventName,
         propertyKey: command.propertyKey,
-        slotType: command.slotType,
-        slotName,
+        propertyType: command.propertyType,
         label: command.label ?? command.propertyKey,
+        dryRun: command.dryRun,
     };
-    if (command.dryRun) {
-        printAnalyticsPayload(command, io, {
-            ok: true,
-            command: command.command,
-            dryRun: true,
-            artifactId: command.artifactId,
-            request,
-        }, [
-            `app_id: ${command.artifactId}`,
-            `event: ${command.eventName}`,
-            `property: ${command.propertyKey}`,
-            `slot_name: ${slotName}`,
-            "dry_run: true",
-        ]);
-        return 0;
-    }
     const payload = await requestAnalyticsApi({
         artifactId: command.artifactId,
-        analyticsPath: "property-slots",
+        analyticsPath: "properties",
         method: "POST",
         baseUrl: credentials.baseUrl,
         token: credentials.token,
@@ -6477,7 +6871,8 @@ async function runAnalyticsPropertySlotsActivate(command, io, runtime) {
         `app_id: ${command.artifactId}`,
         `event: ${command.eventName}`,
         `property: ${command.propertyKey}`,
-        `slot_name: ${slotName}`,
+        `type: ${command.propertyType}`,
+        ...(command.dryRun ? ["dry_run: true"] : []),
     ]);
     return 0;
 }
@@ -6492,16 +6887,16 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
         spec,
         layout: {},
     };
-    const requiredPropertySlots = readRequiredAnalyticsPropertySlotsFromSpec(spec);
-    const credentials = !command.dryRun || requiredPropertySlots.length > 0
+    const requiredProperties = readRequiredAnalyticsPropertiesFromSpec(spec);
+    const credentials = !command.dryRun || requiredProperties.length > 0
         ? await resolveAnalyticsCredentials(command, runtime)
         : null;
-    const propertySlots = credentials
-        ? await ensureAnalyticsPropertySlots({
+    const properties = credentials
+        ? await ensureAnalyticsProperties({
             command,
             credentials,
             runtime,
-            requirements: requiredPropertySlots,
+            requirements: requiredProperties,
             dryRun: command.dryRun,
         })
         : [];
@@ -6510,7 +6905,7 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
             ok: true,
             dryRun: true,
             artifactId: command.artifactId,
-            propertySlots,
+            properties,
             request: body,
         };
         printAnalyticsPayload(command, io, payload, [
@@ -6533,10 +6928,10 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
         fetcher: runtime.fetcher ?? fetch,
         body,
     });
-    printAnalyticsPayload(command, io, { ...payload, propertySlots }, [
+    printAnalyticsPayload(command, io, { ...payload, properties }, [
         `app_id: ${command.artifactId}`,
         `chart_id: ${String(payload.chart?.id ?? "")}`,
-        `property_slots: ${propertySlots.length}`,
+        `properties: ${properties.length}`,
     ]);
     return 0;
 }
@@ -6583,11 +6978,11 @@ async function runAnalyticsChartsUpdate(command, io, runtime) {
         spec,
         layout: readAnalyticsChartLayout(existing.chart),
     };
-    const propertySlots = await ensureAnalyticsPropertySlots({
+    const properties = await ensureAnalyticsProperties({
         command,
         credentials,
         runtime,
-        requirements: readRequiredAnalyticsPropertySlotsFromSpec(spec),
+        requirements: readRequiredAnalyticsPropertiesFromSpec(spec),
         dryRun: command.dryRun,
     });
     const dashboardId = readCliStringField(existing.dashboard, "id");
@@ -6599,7 +6994,7 @@ async function runAnalyticsChartsUpdate(command, io, runtime) {
             chartId: command.chartId,
             dashboardId,
             currentChart: existing.chart,
-            propertySlots,
+            properties,
             request: body,
         }, [
             `app_id: ${command.artifactId}`,
@@ -6619,11 +7014,11 @@ async function runAnalyticsChartsUpdate(command, io, runtime) {
         fetcher: runtime.fetcher ?? fetch,
         body,
     });
-    printAnalyticsPayload(command, io, { ...payload, propertySlots }, [
+    printAnalyticsPayload(command, io, { ...payload, properties }, [
         `app_id: ${command.artifactId}`,
         `chart_id: ${command.chartId}`,
         `title: ${String(payload.chart?.title ?? title)}`,
-        `property_slots: ${propertySlots.length}`,
+        `properties: ${properties.length}`,
     ]);
     return 0;
 }
@@ -6792,11 +7187,26 @@ export async function runTenderCli(args, io = {
             else if (command.topic === "app analytics charts delete") {
                 io.stdout(analyticsChartsDeleteHelp());
             }
-            else if (command.topic === "app analytics property-slots list") {
-                io.stdout(analyticsPropertySlotsListHelp());
+            else if (command.topic === "app analytics properties list") {
+                io.stdout(analyticsPropertiesListHelp());
             }
-            else if (command.topic === "app analytics property-slots activate") {
-                io.stdout(analyticsPropertySlotsActivateHelp());
+            else if (command.topic === "app analytics properties activate") {
+                io.stdout(analyticsPropertiesActivateHelp());
+            }
+            else if (command.topic === "app db") {
+                io.stdout(dbHelp());
+            }
+            else if (command.topic === "app db capabilities") {
+                io.stdout(dbCapabilitiesHelp());
+            }
+            else if (command.topic === "app db tables") {
+                io.stdout(dbTablesHelp());
+            }
+            else if (command.topic === "app db schema") {
+                io.stdout(dbSchemaHelp());
+            }
+            else if (command.topic === "app db query") {
+                io.stdout(dbQueryHelp());
             }
             else if (command.topic === "app") {
                 io.stdout(appHelp());
@@ -6908,11 +7318,23 @@ export async function runTenderCli(args, io = {
         if (command.command === "app analytics charts delete") {
             return await runAnalyticsChartsDelete(command, io, runtime);
         }
-        if (command.command === "app analytics property-slots list") {
-            return await runAnalyticsPropertySlotsList(command, io, runtime);
+        if (command.command === "app analytics properties list") {
+            return await runAnalyticsPropertiesList(command, io, runtime);
         }
-        if (command.command === "app analytics property-slots activate") {
-            return await runAnalyticsPropertySlotsActivate(command, io, runtime);
+        if (command.command === "app analytics properties activate") {
+            return await runAnalyticsPropertiesActivate(command, io, runtime);
+        }
+        if (command.command === "app db capabilities") {
+            return await runDbCapabilities(command, io, runtime);
+        }
+        if (command.command === "app db tables") {
+            return await runDbTables(command, io, runtime);
+        }
+        if (command.command === "app db schema") {
+            return await runDbSchema(command, io, runtime);
+        }
+        if (command.command === "app db query") {
+            return await runDbQuery(command, io, runtime);
         }
         if (command.command === "app git remote") {
             return await runGitRemote(command, io, runtime);
@@ -6926,10 +7348,16 @@ export async function runTenderCli(args, io = {
     }
 }
 const currentFile = fileURLToPath(import.meta.url);
+function hasFlagValue(args, flag, value) {
+    return args.some((arg, index) => arg === flag && args[index + 1] === value);
+}
 function shouldReadEntrypointStdin(args) {
     return (args[0] === "app" &&
         ((args[1] === "git" && args[2] === "credential") ||
-            (args[1] === "analytics" && args.includes("--spec") && args.includes("-"))));
+            (args[1] === "analytics" && hasFlagValue(args, "--spec", "-")) ||
+            (args[1] === "db" &&
+                args[2] === "query" &&
+                hasFlagValue(args, "--file", "-"))));
 }
 async function readEntrypointStdin() {
     if (process.stdin.isTTY) {