admindb 1.0.3 → 1.2.0

package/dist/cli.js

@@ -5,50 +5,120 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = __importDefault(require("express"));
+const node_path_1 = __importDefault(require("node:path"));
 const app_1 = require("./app");
 const config_1 = require("./config");
 const logger_1 = require("./logger");
 const manager_1 = require("./db/manager");
+const args_1 = require("./args");
 /**
  * Standalone CLI / server entry point. Run `npm start` (or `npx admindb`).
- * Configure via PORT, HOST, DB_PATH, DB_DIR, DB_FILES, BASE_PATH and LOG_LEVEL
- * env vars. Set DB_DIR and/or DB_FILES to enable multi-database mode.
  *
- * SECURITY: this server exposes full, unauthenticated database access. It must
- * NOT be exposed to the public internet — protect it yourself (bind to
- * localhost, put it behind an authenticated reverse proxy, a VPN, etc.).
+ * Everything can be set with CLI flags (see `--help`) or environment variables
+ * (PORT, HOST, DB_PATH, DB_DIR, DB_FILES, BASE_PATH, READONLY, LOG_LEVEL); flags
+ * win over the environment.
+ *
+ * By default the server runs in "manager" mode: the landing page lets you
+ * browse the filesystem and open any SQLite database file, or create new ones.
+ * `--open <file>` (or a file path / DB_PATH) opens a single database directly.
+ *
+ * SECURITY: this server exposes full, unauthenticated database AND filesystem
+ * access. It must NOT be exposed to the public internet — protect it yourself
+ * (bind to localhost, put it behind an authenticated reverse proxy, a VPN,
+ * etc.).
  */
-const config = (0, config_1.loadConfig)();
+const env = (0, config_1.loadConfig)();
+const parsed = (0, args_1.parseArgs)(process.argv.slice(2));
+if (parsed.error) {
+    console.error(parsed.error);
+    console.error();
+    console.error((0, args_1.helpText)());
+    process.exit(1);
+}
+const args = parsed.args;
+if (args.help) {
+    console.log((0, args_1.helpText)());
+    process.exit(0);
+}
+if (args.version) {
+    console.log((0, args_1.versionText)());
+    process.exit(0);
+}
+// Merge CLI flags over environment variables.
+const config = {
+    host: args.host ?? env.host,
+    port: args.port ?? env.port,
+    dbPath: args.dbPath ?? env.dbPath,
+    dbDir: args.dbDir ?? env.dbDir,
+    dbFiles: args.dbFiles ?? env.dbFiles,
+    basePath: (args.basePath ?? env.basePath).replace(/\/+$/, ''),
+    logLevel: args.logLevel ?? env.logLevel,
+    readonly: args.readonly || env.readonly,
+};
 const logger = (0, logger_1.createLogger)(config.logLevel, 'admindb');
 const app = (0, express_1.default)();
 app.disable('x-powered-by');
-const multiDb = Boolean(config.dbDir || (config.dbFiles && config.dbFiles.length > 0));
-const router = multiDb
+// Mode selection:
+//  - A specific single file was requested (`--open`, a file path argument, or
+//    DB_PATH) and no folder/files were configured → single-database mode.
+//  - Otherwise → manager mode with a landing page where you can browse the
+//    filesystem and open database files, or create new ones.
+const hasDir = Boolean(config.dbDir);
+const hasFiles = Boolean(config.dbFiles && config.dbFiles.length > 0);
+const explicitFile = args.dbPath ?? (process.env.DB_PATH ? process.env.DB_PATH : undefined);
+const singleFileOnly = Boolean(explicitFile) && !hasDir && !hasFiles;
+const useManager = !singleFileOnly;
+const managerFiles = [...(config.dbFiles ?? [])];
+if (useManager && explicitFile)
+    managerFiles.push(explicitFile);
+// File-browser policy for manager mode:
+//  - a folder was requested → browsing is allowed but limited to that folder;
+//  - specific files were requested (no folder) → browsing is disabled entirely;
+//  - nothing requested → browsing is allowed (free); the folder defaults to the
+//    current directory so new/created databases land there.
+const managerDir = hasDir ? config.dbDir : hasFiles || explicitFile ? undefined : process.cwd();
+const allowBrowse = useManager && (hasDir || (!hasFiles && !explicitFile));
+const browseRoot = hasDir ? node_path_1.default.resolve(config.dbDir) : undefined;
+const router = useManager
     ? (0, app_1.createRouter)({
-        manager: new manager_1.DbManager({ dir: config.dbDir, files: config.dbFiles, readonly: config.readonly }, logger),
+        manager: new manager_1.DbManager({ dir: managerDir, files: managerFiles, readonly: config.readonly }, logger),
         basePath: config.basePath,
         logger,
         readonly: config.readonly,
+        allowBrowse,
+        browseRoot,
     })
-    : (0, app_1.createRouter)({ dbPath: config.dbPath, basePath: config.basePath, logger, readonly: config.readonly });
+    : (0, app_1.createRouter)({ dbPath: explicitFile, basePath: config.basePath, logger, readonly: config.readonly });
 app.use(config.basePath || '/', router);
 const server = app.listen(config.port, config.host, () => {
     const url = `http://${config.host}:${config.port}${config.basePath}/`;
     logger.info(`AdminDB listening on ${url}`);
-    if (multiDb) {
-        const sources = [config.dbDir ? `dir:${config.dbDir}` : null, config.dbFiles?.length ? `files:[${config.dbFiles.join(', ')}]` : null]
+    if (useManager) {
+        const sources = [
+            managerDir ? `dir:${managerDir}` : null,
+            managerFiles.length ? `files:[${managerFiles.join(', ')}]` : null,
+        ]
             .filter(Boolean)
             .join(' · ');
-        logger.info(`Multi-database mode — ${sources}`);
+        logger.info(`Manager mode — ${sources}`);
+        if (!allowBrowse) {
+            logger.info('File browsing disabled — only the configured database files are listed.');
+        }
+        else if (browseRoot) {
+            logger.info(`File browsing is limited to: ${browseRoot}`);
+        }
+        else {
+            logger.info('Open the URL above in your browser to browse and open database files.');
+        }
     }
     else {
-        logger.info(`Database file: ${config.dbPath}`);
+        logger.info(`Database file: ${explicitFile}`);
     }
     if (config.readonly) {
         logger.info('Read-only mode enabled — all writes are disabled.');
     }
     if (config.host === '0.0.0.0') {
-        logger.warn('Listening on 0.0.0.0 — this admin tool has NO authentication. Do not expose it to untrusted networks.');
+        logger.warn('Listening on 0.0.0.0 — this admin tool has NO authentication and exposes filesystem access. Do not expose it to untrusted networks.');
     }
 });
 const shutdown = (signal) => {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AACA,sDAA8B;AAC9B,+BAAqC;AACrC,qCAAsC;AACtC,qCAAwC;AACxC,0CAAyC;AAEzC;;;;;;;;GAQG;AACH,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAC;AAC5B,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;AACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,MAAM,GAAG,OAAO;IACpB,CAAC,CAAC,IAAA,kBAAY,EAAC;QACX,OAAO,EAAE,IAAI,mBAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;QACvG,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;IACJ,CAAC,CAAC,IAAA,kBAAY,EAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1G,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;AAExC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACvD,MAAM,GAAG,GAAG,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;aAClI,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;IACvH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;IACxC,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,kBAAkB,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AACA,sDAA8B;AAC9B,0DAA6B;AAC7B,+BAAqC;AACrC,qCAAsC;AACtC,qCAAwC;AACxC,0CAAyC;AACzC,iCAA0D;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;AACzB,MAAM,MAAM,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,KAAK,CAAC,IAAA,eAAQ,GAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;AACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,IAAA,eAAQ,GAAE,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,IAAA,kBAAW,GAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,8CAA8C;AAC9C,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI;IAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI;IAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;IACjC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK;IAC9B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;IACpC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;IACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;CACxC,CAAC;AAEF,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;AACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAE5B,kBAAkB;AAClB,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC;AACrE,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC;AAEnC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AACjD,IAAI,UAAU,IAAI,YAAY;IAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAEhE,wCAAwC;AACxC,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAChG,MAAM,WAAW,GAAG,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAEpE,MAAM,MAAM,GAAG,UAAU;IACvB,CAAC,CAAC,IAAA,kBAAY,EAAC;QACX,OAAO,EAAE,IAAI,mBAAS,CACpB,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EACnE,MAAM,CACP;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW;QACX,UAAU;KACX,CAAC;IACJ,CAAC,CAAC,IAAA,kBAAY,EAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACzG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;AAExC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACvD,MAAM,GAAG,GAAG,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG;YACd,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;YACvC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SAClE;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,qIAAqI,CAAC,CAAC;IACrJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;IACxC,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,kBAAkB,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC"}

package/dist/db/database.d.ts

@@ -1,5 +1,8 @@
 import type { Logger } from '../logger';
-import { type ColumnDef, type IndexDef, type TriggerDef } from '../sql/generator';
+import { type ColumnDef, type IndexDef } from '../sql/generator';
+import { type FilterValue } from '../util';
+/** Structured filter types are shared with the API layer. */
+export type { FilterCondition, FilterValue } from '../util';
 /** SQLite-compatible bind value accepted by better-sqlite3 statements. */
 export type SQLInputValue = null | number | bigint | string | Uint8Array;
 export interface Result<T = unknown> {
@@ -53,20 +56,8 @@ export interface IndexInfo {
     /** The `CREATE INDEX` statement from sqlite_master, when available. */
     sql?: string | null;
 }
-export interface ViewInfo {
-    name: string;
-    /** The `CREATE VIEW …` statement from sqlite_master. */
-    sql: string | null;
-}
-export interface TriggerInfo {
-    name: string;
-    /** The table (or view) the trigger fires on. */
-    table: string;
-    /** The `CREATE TRIGGER …` statement from sqlite_master. */
-    sql: string | null;
-}
 export interface RowFilters {
-    [column: string]: string;
+    [column: string]: FilterValue;
 }
 export interface ColumnDetail extends ColumnInfo {
     unique: boolean;
@@ -93,16 +84,19 @@ export interface SchemaInfo {
         to: string;
     }[];
 }
+export interface ReferencingTableInfo {
+    table: string;
+    /** FK columns in `table` that point at this table (`from` → `to`). */
+    refs: {
+        from: string;
+        to: string;
+    }[];
+    /** Rows in `table` whose FK column(s) actually reference this table. */
+    refCount: number;
+}
 export declare const INTERNAL_TABLES: {
     readonly savedQueries: "_saved_queries";
 };
-/**
- * Build a parameterized WHERE clause from per-column filters.
- * Supported syntax in a filter value:
- *   - `=value` exact match, `!=value` not-equal, `>value`, `>=value`, `<value`, `<=value`
- *   - `value*`  prefix match
- *   - anything else → case-insensitive substring (LIKE '%value%')
- */
 export declare function buildFilterClause(filters: RowFilters | undefined, availableCols: string[]): {
     where: string;
     params: SQLInputValue[];
@@ -137,6 +131,12 @@ export declare class SqliteDatabase {
     execResult(sql: string): Promise<Result<{
         changes?: number;
     }>>;
+    /**
+     * True when `sql` contains more than one statement. Detection is delegated to
+     * SQLite itself via `prepare()` (which refuses multi-statement strings), so
+     * comments, string literals and quoted identifiers are handled correctly.
+     */
+    hasMultipleStatements(sql: string): boolean;
     /** Run a write statement, reporting row changes when it is a single statement. */
     runWrite(sql: string): Promise<Result<{
         changes?: number;
@@ -166,10 +166,33 @@ export declare class SqliteDatabase {
         changes: number;
         lastInsertRowid: number | null;
     }>>;
+    /**
+     * Apply many row updates (each with its own SET fields + primary-key WHERE
+     * clause) inside a single transaction. Used by the bulk "apply changes"
+     * flow of inline grid editing. Rolls everything back if any row fails.
+     */
+    updateRows(table: string, rows: {
+        fields: WhereClause[];
+        where: WhereClause[];
+    }[]): Promise<Result<{
+        updated: number;
+    }>>;
     deleteRow(table: string, where: WhereClause[]): Promise<Result<{
         changes: number;
         lastInsertRowid: number | null;
     }>>;
+    /**
+     * Delete many rows (each identified by its primary-key WHERE clause) inside a
+     * single transaction. Used by bulk delete.
+     */
+    deleteRows(table: string, rows: WhereClause[][]): Promise<Result<{
+        deleted: number;
+    }>>;
+    /**
+     * Fetch the rows matching the given primary-key WHERE clauses in one query
+     * (`(a = ? AND b = ?) OR …`). Used by bulk export and FK-impact checks.
+     */
+    getRowsByPks(table: string, pks: WhereClause[][]): Promise<Result<Record<string, unknown>[]>>;
     getCreateStatement(table: string): Promise<Result<string | null>>;
     listSavedQueries(): Promise<Result<SavedQuery[]>>;
     saveQuery(name: string, sql: string): Promise<Result<{
@@ -185,6 +208,20 @@ export declare class SqliteDatabase {
      * foreign keys, and which other tables reference it.
      */
     getSchema(table: string): Promise<Result<SchemaInfo>>;
+    /**
+     * Other tables with foreign keys pointing at `table`, grouped by table, each
+     * with the FK column mapping and a count of rows that actually reference it.
+     */
+    getReferencingTables(table: string): Promise<Result<ReferencingTableInfo[]>>;
+    /**
+     * Rows in `table` whose `column` equals `value` — used to show which rows in
+     * a referencing table point at a specific row via a foreign key — with the
+     * total matching count.
+     */
+    getRowsByFk(table: string, column: string, value: unknown, limit?: number): Promise<Result<{
+        rows: Record<string, unknown>[];
+        total: number;
+    }>>;
     renameTable(oldName: string, newName: string): Promise<Result<{
         changes?: number;
     }>>;
@@ -206,21 +243,5 @@ export declare class SqliteDatabase {
     dropIndex(indexName: string): Promise<Result<{
         changes?: number;
     }>>;
-    listViews(): Promise<Result<ViewInfo[]>>;
-    /** Preview the first `limit` rows of a view (browse). */
-    getViewRows(viewName: string, limit?: number): Promise<Result<Record<string, unknown>[]>>;
-    createView(name: string, selectSql: string): Promise<Result<{
-        changes?: number;
-    }>>;
-    dropView(name: string): Promise<Result<{
-        changes?: number;
-    }>>;
-    listTriggers(): Promise<Result<TriggerInfo[]>>;
-    createTrigger(def: TriggerDef): Promise<Result<{
-        changes?: number;
-    }>>;
-    dropTrigger(name: string): Promise<Result<{
-        changes?: number;
-    }>>;
     private getTableInfoSync;
 }

package/dist/db/database.js

@@ -17,20 +17,87 @@ function escapeLike(s) {
 }
 /**
  * Build a parameterized WHERE clause from per-column filters.
- * Supported syntax in a filter value:
- *   - `=value` exact match, `!=value` not-equal, `>value`, `>=value`, `<value`, `<=value`
- *   - `value*`  prefix match
- *   - anything else → case-insensitive substring (LIKE '%value%')
+ *
+ * A filter value is either:
+ *   - the legacy string syntax: `=value` exact, `!=value`, `>value`, `>=value`,
+ *     `<value`, `<=value`, `value*` prefix, anything else → substring match; or
+ *   - a structured `FilterCondition` (or array of them) produced by the
+ *     type-aware filter form (FK dropdowns, boolean toggles, date/number ranges).
  */
+function pushFilterCondition(conds, params, quotedCol, c) {
+    const value = String(c.value ?? '');
+    switch (c.op) {
+        case 'eq':
+            conds.push(`${quotedCol} = ?`);
+            params.push(value);
+            break;
+        case 'neq':
+            conds.push(`${quotedCol} != ?`);
+            params.push(value);
+            break;
+        case 'gt':
+            conds.push(`${quotedCol} > ?`);
+            params.push(value);
+            break;
+        case 'gte':
+            conds.push(`${quotedCol} >= ?`);
+            params.push(value);
+            break;
+        case 'lt':
+            conds.push(`${quotedCol} < ?`);
+            params.push(value);
+            break;
+        case 'lte':
+            conds.push(`${quotedCol} <= ?`);
+            params.push(value);
+            break;
+        case 'like':
+            conds.push(`${quotedCol} LIKE ? ESCAPE '\\'`);
+            params.push('%' + escapeLike(value) + '%');
+            break;
+        case 'prefix':
+            conds.push(`${quotedCol} LIKE ? ESCAPE '\\'`);
+            params.push(escapeLike(value) + '%');
+            break;
+        case 'between':
+            conds.push(`${quotedCol} >= ?`);
+            params.push(value);
+            conds.push(`${quotedCol} <= ?`);
+            params.push(String(c.max ?? ''));
+            break;
+        case 'null':
+            conds.push(`${quotedCol} IS NULL`);
+            break;
+        case 'notnull':
+            conds.push(`${quotedCol} IS NOT NULL`);
+            break;
+        default:
+            break;
+    }
+}
 function buildFilterClause(filters, availableCols) {
     const conds = [];
     const params = [];
     const colSet = new Set(availableCols);
     for (const [col, raw] of Object.entries(filters ?? {})) {
-        const value = String(raw ?? '').trim();
-        if (value === '' || !colSet.has(col))
+        if (!colSet.has(col))
             continue;
         const q = (0, generator_1.quoteIdentifier)(col);
+        if (Array.isArray(raw)) {
+            for (const c of raw) {
+                if (c && typeof c === 'object')
+                    pushFilterCondition(conds, params, q, c);
+            }
+            continue;
+        }
+        if (raw && typeof raw === 'object') {
+            pushFilterCondition(conds, params, q, raw);
+            continue;
+        }
+        // Legacy string syntax.
+        const value = String(raw ?? '').trim();
+        if (value === '')
+            continue;
         if (value.startsWith('>=')) {
             conds.push(`${q} >= ?`);
             params.push(value.slice(2).trim());
@@ -153,6 +220,23 @@ class SqliteDatabase {
             return { changes: undefined };
         });
     }
+    /**
+     * True when `sql` contains more than one statement. Detection is delegated to
+     * SQLite itself via `prepare()` (which refuses multi-statement strings), so
+     * comments, string literals and quoted identifiers are handled correctly.
+     */
+    hasMultipleStatements(sql) {
+        const s = String(sql ?? '').trim();
+        if (!s)
+            return false;
+        try {
+            this.db.prepare(s);
+            return false;
+        }
+        catch (err) {
+            return /more than one statement/i.test((0, util_1.errorMessage)(err));
+        }
+    }
     /** Run a write statement, reporting row changes when it is a single statement. */
     async runWrite(sql) {
         if (this.isReadOnly)
@@ -294,11 +378,99 @@ class SqliteDatabase {
         const sql = `UPDATE ${(0, generator_1.quoteIdentifier)(table)} SET ${sets.join(', ')} WHERE ${conds.join(' AND ')}`;
         return this.run(sql, [...fields.map((f) => this.toBind(f.value)), ...where.map((w) => this.toBind(w.value))]);
     }
+    /**
+     * Apply many row updates (each with its own SET fields + primary-key WHERE
+     * clause) inside a single transaction. Used by the bulk "apply changes"
+     * flow of inline grid editing. Rolls everything back if any row fails.
+     */
+    async updateRows(table, rows) {
+        if (this.isReadOnly)
+            return this.readonlyBlocked();
+        return this.tryRun(() => {
+            this.db.exec('BEGIN');
+            try {
+                let updated = 0;
+                for (const { fields, where } of rows) {
+                    if (!fields.length || !where.length)
+                        continue;
+                    const sets = fields.map((f) => `${(0, generator_1.quoteIdentifier)(f.column)} = ?`);
+                    const conds = where.map((w) => `${(0, generator_1.quoteIdentifier)(w.column)} = ?`);
+                    const sql = `UPDATE ${(0, generator_1.quoteIdentifier)(table)} SET ${sets.join(', ')} WHERE ${conds.join(' AND ')}`;
+                    const info = this.db.prepare(sql).run(...[...fields.map((f) => this.toBind(f.value)), ...where.map((w) => this.toBind(w.value))]);
+                    updated += Number(info.changes);
+                }
+                this.db.exec('COMMIT');
+                return { updated };
+            }
+            catch (err) {
+                try {
+                    this.db.exec('ROLLBACK');
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+        });
+    }
     async deleteRow(table, where) {
         const conds = where.map((w) => `${(0, generator_1.quoteIdentifier)(w.column)} = ?`);
         const sql = `DELETE FROM ${(0, generator_1.quoteIdentifier)(table)} WHERE ${conds.join(' AND ')}`;
         return this.run(sql, where.map((w) => this.toBind(w.value)));
     }
+    /**
+     * Delete many rows (each identified by its primary-key WHERE clause) inside a
+     * single transaction. Used by bulk delete.
+     */
+    async deleteRows(table, rows) {
+        if (this.isReadOnly)
+            return this.readonlyBlocked();
+        return this.tryRun(() => {
+            this.db.exec('BEGIN');
+            try {
+                let deleted = 0;
+                for (const where of rows) {
+                    if (!where.length)
+                        continue;
+                    const conds = where.map((w) => `${(0, generator_1.quoteIdentifier)(w.column)} = ?`);
+                    const sql = `DELETE FROM ${(0, generator_1.quoteIdentifier)(table)} WHERE ${conds.join(' AND ')}`;
+                    const info = this.db.prepare(sql).run(...where.map((w) => this.toBind(w.value)));
+                    deleted += Number(info.changes);
+                }
+                this.db.exec('COMMIT');
+                return { deleted };
+            }
+            catch (err) {
+                try {
+                    this.db.exec('ROLLBACK');
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+        });
+    }
+    /**
+     * Fetch the rows matching the given primary-key WHERE clauses in one query
+     * (`(a = ? AND b = ?) OR …`). Used by bulk export and FK-impact checks.
+     */
+    async getRowsByPks(table, pks) {
+        return this.tryRun(() => {
+            const groups = [];
+            const params = [];
+            for (const where of pks) {
+                if (!where.length)
+                    continue;
+                groups.push(where.map((w) => `${(0, generator_1.quoteIdentifier)(w.column)} = ?`).join(' AND '));
+                params.push(...where.map((w) => this.toBind(w.value)));
+            }
+            if (!groups.length)
+                return [];
+            const sql = `SELECT * FROM ${(0, generator_1.quoteIdentifier)(table)} WHERE ${groups.map((g) => `(${g})`).join(' OR ')}`;
+            return this.db.prepare(sql).all(...params);
+        });
+    }
     async getCreateStatement(table) {
         return this.tryRun(() => {
             const row = this.db
@@ -426,6 +598,67 @@ class SqliteDatabase {
             };
         });
     }
+    /**
+     * Other tables with foreign keys pointing at `table`, grouped by table, each
+     * with the FK column mapping and a count of rows that actually reference it.
+     */
+    async getReferencingTables(table) {
+        return this.tryRun(() => {
+            const allTables = this.db
+                .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'")
+                .all().map((r) => r.name);
+            const byTable = new Map();
+            for (const t of allTables) {
+                if (t === table)
+                    continue;
+                try {
+                    const fks = this.db.prepare(`PRAGMA foreign_key_list(${(0, generator_1.quoteIdentifier)(t)})`).all();
+                    for (const fk of fks) {
+                        if (fk.table === table) {
+                            const arr = byTable.get(t) ?? [];
+                            arr.push({ from: fk.from, to: fk.to ?? '' });
+                            byTable.set(t, arr);
+                        }
+                    }
+                }
+                catch {
+                    /* ignore unreadable tables */
+                }
+            }
+            const result = [];
+            for (const [t, refs] of byTable) {
+                let refCount = 0;
+                try {
+                    const conds = refs.map((r) => `${(0, generator_1.quoteIdentifier)(r.from)} IS NOT NULL`);
+                    const row = this.db.prepare(`SELECT COUNT(*) AS c FROM ${(0, generator_1.quoteIdentifier)(t)} WHERE ${conds.join(' OR ')}`).get();
+                    refCount = Number(row.c);
+                }
+                catch {
+                    /* count is best-effort */
+                }
+                result.push({ table: t, refs, refCount });
+            }
+            result.sort((a, b) => a.table.localeCompare(b.table));
+            return result;
+        });
+    }
+    /**
+     * Rows in `table` whose `column` equals `value` — used to show which rows in
+     * a referencing table point at a specific row via a foreign key — with the
+     * total matching count.
+     */
+    async getRowsByFk(table, column, value, limit = 50) {
+        return this.tryRun(() => {
+            const n = Math.max(1, Math.min(500, Number(limit) || 50));
+            const countRow = this.db
+                .prepare(`SELECT COUNT(*) AS c FROM ${(0, generator_1.quoteIdentifier)(table)} WHERE ${(0, generator_1.quoteIdentifier)(column)} = ?`)
+                .get(value);
+            const rows = this.db
+                .prepare(`SELECT * FROM ${(0, generator_1.quoteIdentifier)(table)} WHERE ${(0, generator_1.quoteIdentifier)(column)} = ? LIMIT ${n}`)
+                .all(value);
+            return { rows, total: Number(countRow.c) };
+        });
+    }
     async renameTable(oldName, newName) {
         return this.execResult((0, generator_1.generateRenameTable)(oldName, newName));
     }
@@ -447,42 +680,6 @@ class SqliteDatabase {
     async dropIndex(indexName) {
         return this.execResult((0, generator_1.generateDropIndex)(indexName));
     }
-    // ---- Views & triggers -------------------------------------------------
-    async listViews() {
-        return this.tryRun(() => {
-            const rows = this.db
-                .prepare("SELECT name, sql FROM sqlite_master WHERE type = 'view' AND name NOT LIKE 'sqlite_%' ORDER BY name")
-                .all();
-            return rows.map((r) => ({ name: r.name, sql: r.sql ?? null }));
-        });
-    }
-    /** Preview the first `limit` rows of a view (browse). */
-    async getViewRows(viewName, limit = 200) {
-        return this.tryRun(() => {
-            const n = Math.max(1, Math.min(1000, Number(limit) || 200));
-            return this.db.prepare(`SELECT * FROM ${(0, generator_1.quoteIdentifier)(viewName)} LIMIT ${n}`).all();
-        });
-    }
-    async createView(name, selectSql) {
-        return this.execResult((0, generator_1.generateCreateView)(name, selectSql));
-    }
-    async dropView(name) {
-        return this.execResult((0, generator_1.generateDropView)(name));
-    }
-    async listTriggers() {
-        return this.tryRun(() => {
-            const rows = this.db
-                .prepare('SELECT name, tbl_name AS "table", sql FROM sqlite_master WHERE type = \'trigger\' AND name NOT LIKE \'sqlite_%\' ORDER BY name')
-                .all();
-            return rows.map((r) => ({ name: r.name, table: r.table, sql: r.sql ?? null }));
-        });
-    }
-    async createTrigger(def) {
-        return this.execResult((0, generator_1.generateCreateTrigger)(def));
-    }
-    async dropTrigger(name) {
-        return this.execResult((0, generator_1.generateDropTrigger)(name));
-    }
     getTableInfoSync(table) {
         try {
             const cols = this.db.prepare(`PRAGMA table_info(${(0, generator_1.quoteIdentifier)(table)})`).all();