db-mcp 1.1.1 → 3.0.0

package/dist/{sqlite-native-5O7FZJGB.js → sqlite-native-ZSSWCTYC.js}

@@ -1,41 +1,49 @@
-import { TransactionBeginOutputSchema, TransactionCommitOutputSchema, TransactionRollbackOutputSchema, TransactionSavepointOutputSchema, TransactionReleaseOutputSchema, TransactionRollbackToOutputSchema, TransactionExecuteOutputSchema, WindowRowNumberOutputSchema, validateWhereClause, WindowRankOutputSchema, WindowLagLeadOutputSchema, WindowRunningTotalOutputSchema, resolveAliases, WindowMovingAvgOutputSchema, WindowNtileOutputSchema, autoEnableWal, detectAndSetJsonbSupport, SchemaManager, applyCommonPragmas, isDDL, getResourceDefinitions, getPromptDefinitions, SpatialiteLoadOutputSchema, SpatialiteCreateTableOutputSchema, SpatialiteQueryOutputSchema, SpatialiteAnalyzeOutputSchema, SpatialiteIndexOutputSchema, SpatialiteTransformOutputSchema, SpatialiteImportOutputSchema, normalizeSqliteParams, getCoreTools, getJsonOperationTools, getJsonHelperTools, getTextTools, getStatsTools, getVirtualTools, getVectorTools, getGeoTools, getAdminTools, getIntrospectionTools, getMigrationTools, getCodeModeTools, FtsCreateOutputSchema, sanitizeIdentifier, FtsSearchOutputSchema, validateTableExists, FtsRebuildOutputSchema } from './chunk-TVIZ3XJH.js';
-import { DatabaseAdapter } from './chunk-Z2GFQU3G.js';
-import { write, readOnly, VERSION, admin, getToolGroupIcon, idempotent } from './chunk-FW7UCRLN.js';
-import { formatHandlerError, ValidationError, ConfigurationError, ConnectionError, ResourceNotFoundError, QueryError } from './chunk-4IA3DB5C.js';
-import { logger, ERROR_CODES, DbMcpError } from './chunk-AOUL5SHS.js';
+import { RowRecordSchema, WhereConditionSchema, sanitizeIdentifier, buildWhereClause, resolveAliases, autoEnableWal, detectAndSetJsonbSupport, SchemaManager, applyCommonPragmas, isDDL, getResourceDefinitions, getPromptDefinitions, validateIdentifier, normalizeSqliteParams, translateSqliteError, getCoreTools, getJsonOperationTools, getJsonHelperTools, getTextTools, getStatsTools, getVirtualTools, getVectorTools, getGeoTools, getAdminTools, getIntrospectionTools, getMigrationTools, getCodeModeTools, validateTableExists, FtsHeadlineSchema } from './chunk-FR65YPAH.js';
+import { DatabaseAdapter } from './chunk-W5WQVNVX.js';
+import { ErrorResponseFields, write, readOnly, VERSION, admin, writeFs, getToolGroupIcon, idempotent } from './chunk-E5IESRTK.js';
+import { logger, formatHandlerError, ValidationError, ConfigurationError, ERROR_CODES, ConnectionError, DbMcpError, ResourceNotFoundError, ExtensionNotAvailableError } from './chunk-L552U3QS.js';
 import Database from 'better-sqlite3';
 import { z } from 'zod';
-import path from 'path';
-import fs from 'fs';
+import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
+import path2 from 'path';
+import fs from 'fs';
 
-function buildFts5UnavailableError(tableName) {
-  return {
-    success: false,
-    message: "FTS5 module unavailable",
-    tableName: tableName ?? "",
-    error: "FTS5 module unavailable",
-    hint: "FTS5 requires native SQLite backend (--sqlite-native). WASM mode (sql.js) does not include this module."
-  };
-}
-function isFts5UnavailableError(error) {
-  return error instanceof Error && error.message.toLowerCase().includes("no such module: fts5");
-}
-function isFts5Available(adapter) {
-  return adapter.isNativeBackend();
-}
-function buildFts5SearchUnavailableError() {
-  return {
-    success: false,
-    rowCount: 0,
-    results: [],
-    error: "FTS5 module unavailable",
-    hint: "FTS5 requires native SQLite backend (--sqlite-native). WASM mode (sql.js) does not include this module."
-  };
-}
+var FtsCreateOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  tableName: z.string().optional(),
+  triggersCreated: z.array(z.string()).optional()
+}).extend(ErrorResponseFields.shape);
+var FtsResultSchema = z.object({
+  rank: z.number().nullable().optional(),
+  bm25: z.number().nullable().optional()
+}).loose();
+var FtsSearchOutputSchema = z.object({
+  success: z.boolean(),
+  rowCount: z.number().optional(),
+  results: z.array(FtsResultSchema).optional()
+}).extend(ErrorResponseFields.shape);
+var FtsRebuildOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  tableName: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var FtsHeadlineOutputSchema = z.object({
+  success: z.boolean(),
+  rowCount: z.number().optional(),
+  results: z.array(
+    z.object({
+      headline: z.string().optional(),
+      snippet: z.string().optional(),
+      rank: z.number().nullable().optional()
+    }).loose()
+  ).optional()
+}).extend(ErrorResponseFields.shape);
 var coerceEnumValues = (allowed) => (val) => typeof val === "string" && allowed.includes(val) ? val : void 0;
 var FtsCreateSchema = z.object({
-  tableName: z.string().describe("Name of the FTS table to create"),
+  tableName: z.string().optional().describe("Name of the FTS table to create"),
+  ftsTable: z.string().optional().describe("Name of the FTS table to create (alias)"),
   sourceTable: z.string().describe("Source table to index"),
   columns: z.array(z.string()).describe("Columns to include in the index"),
   contentTable: z.string().optional().describe("Content table for external content FTS"),
@@ -43,19 +51,21 @@ var FtsCreateSchema = z.object({
     coerceEnumValues(["unicode61", "ascii", "porter"]),
     z.enum(["unicode61", "ascii", "porter"]).optional().default("unicode61")
   ),
-  createTriggers: z.boolean().optional().default(true).describe(
-    "Create INSERT/UPDATE/DELETE triggers for auto-sync (only for external content tables)"
-  )
+  createTriggers: z.boolean().optional().default(true).describe("Create triggers")
 });
 var FtsSearchSchema = z.object({
   table: z.string().describe("FTS table name"),
   query: z.string().describe("Full-text search query"),
   columns: z.array(z.string()).optional().describe("Specific columns to search"),
-  limit: z.preprocess(
-    (val) => typeof val === "string" ? isNaN(Number(val)) ? void 0 : Number(val) : val,
-    z.number().optional().default(100)
-  ),
-  highlight: z.boolean().optional().default(false).describe("Include highlighted snippets")
+  limit: z.preprocess((val) => {
+    if (typeof val === "string") {
+      const parsed = Number(val);
+      return isNaN(parsed) ? val : parsed;
+    }
+    return val;
+  }, z.number().optional().default(100)),
+  highlight: z.boolean().optional().default(false).describe("Include highlighted snippets"),
+  includeRowData: z.boolean().optional().default(true).describe("Include full row data in results")
 });
 var FtsRebuildSchema = z.object({
   table: z.string().describe("FTS table name to rebuild")
@@ -66,14 +76,42 @@ var FtsMatchInfoSchema = z.object({
   format: z.preprocess(
     coerceEnumValues(["bm25", "rank"]),
     z.enum(["bm25", "rank"]).optional().default("bm25")
-  )
+  ),
+  includeRowData: z.boolean().optional().default(true).describe("Include full row data in results")
 });
+
+// src/adapters/sqlite/tools/fts.ts
+function buildFts5UnavailableError(tableName) {
+  return {
+    success: false,
+    message: "FTS5 module unavailable",
+    tableName: tableName ?? "",
+    error: "FTS5 module unavailable",
+    hint: "FTS5 requires native SQLite backend (--sqlite-native). WASM mode (sql.js) does not include this module."
+  };
+}
+function isFts5UnavailableError(error) {
+  return error instanceof Error && error.message.toLowerCase().includes("no such module: fts5");
+}
+function isFts5Available(adapter) {
+  return adapter.isNativeBackend();
+}
+function buildFts5SearchUnavailableError() {
+  return {
+    success: false,
+    rowCount: 0,
+    results: [],
+    error: "FTS5 module unavailable",
+    hint: "FTS5 requires native SQLite backend (--sqlite-native). WASM mode (sql.js) does not include this module."
+  };
+}
 function getFtsTools(adapter) {
   return [
     createFtsCreateTool(adapter),
     createFtsSearchTool(adapter),
     createFtsRebuildTool(adapter),
-    createFtsMatchInfoTool(adapter)
+    createFtsMatchInfoTool(adapter),
+    createFtsHeadlineTool(adapter)
   ];
 }
 function createFtsCreateTool(adapter) {
@@ -88,7 +126,13 @@ function createFtsCreateTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsCreateSchema.parse(params);
-        sanitizeIdentifier(input.tableName);
+        const targetTableName = input.tableName || input.ftsTable;
+        if (!targetTableName) {
+          throw new ValidationError(
+            "Must provide either tableName or ftsTable"
+          );
+        }
+        sanitizeIdentifier(targetTableName);
         sanitizeIdentifier(input.sourceTable);
         for (const col of input.columns) {
           sanitizeIdentifier(col);
@@ -98,31 +142,31 @@ function createFtsCreateTool(adapter) {
         const effectiveContentTable = input.contentTable ?? input.sourceTable;
         sanitizeIdentifier(effectiveContentTable);
         options += `, content="${effectiveContentTable}"`;
-        const sql = `CREATE VIRTUAL TABLE IF NOT EXISTS "${input.tableName}" USING fts5(${columnList}, ${options})`;
+        const sql = `CREATE VIRTUAL TABLE IF NOT EXISTS "${targetTableName}" USING fts5(${columnList}, ${options})`;
         await adapter.executeQuery(sql);
         let triggersCreated = [];
         if (input.createTriggers) {
           triggersCreated = await createSyncTriggers(
             adapter,
-            input.tableName,
+            targetTableName,
             effectiveContentTable,
             input.columns
           );
         }
         await adapter.executeQuery(
-          `INSERT INTO "${input.tableName}"("${input.tableName}") VALUES('rebuild')`
+          `INSERT INTO "${targetTableName}"("${targetTableName}") VALUES('rebuild')`
         );
-        const message = triggersCreated.length ? `FTS5 table '${input.tableName}' created with ${triggersCreated.length} sync triggers` : `FTS5 table '${input.tableName}' created`;
+        const message = triggersCreated.length ? `FTS5 table '${targetTableName}' created with ${triggersCreated.length} sync triggers` : `FTS5 table '${targetTableName}' created`;
         return {
           success: true,
           message,
-          tableName: input.tableName,
+          tableName: targetTableName,
           triggersCreated: triggersCreated.length ? triggersCreated : void 0
         };
       } catch (error) {
         if (isFts5UnavailableError(error)) {
           return buildFts5UnavailableError(
-            params?.tableName
+            params?.tableName || params?.ftsTable
           );
         }
         return formatHandlerError(error);
@@ -141,7 +185,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"(rowid, ${colList}) VALUES (NEW.rowid, ${newColList});
     END;
   `;
-  await adapter.executeQuery(insertTrigger);
+  await adapter.rawQuery(insertTrigger, void 0);
   triggersCreated.push(insertTriggerName);
   const deleteTriggerName = `${ftsTable}_ad`;
   const deleteTrigger = `
@@ -149,7 +193,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"("${ftsTable}", rowid, ${colList}) VALUES('delete', OLD.rowid, ${oldColList});
     END;
   `;
-  await adapter.executeQuery(deleteTrigger);
+  await adapter.rawQuery(deleteTrigger, void 0);
   triggersCreated.push(deleteTriggerName);
   const updateTriggerName = `${ftsTable}_au`;
   const updateTrigger = `
@@ -158,7 +202,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"(rowid, ${colList}) VALUES (NEW.rowid, ${newColList});
     END;
   `;
-  await adapter.executeQuery(updateTrigger);
+  await adapter.rawQuery(updateTrigger, void 0);
   triggersCreated.push(updateTriggerName);
   return triggersCreated;
 }
@@ -174,18 +218,19 @@ function createFtsSearchTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsSearchSchema.parse(params);
+        const queryParams = [];
         if (!isFts5Available(adapter)) {
           return buildFts5SearchUnavailableError();
         }
         sanitizeIdentifier(input.table);
         await validateTableExists(adapter, input.table);
-        let selectClause = "*";
+        let selectClause = input.includeRowData ? "*" : "rowid";
         if (input.highlight) {
-          selectClause = `*, highlight("${input.table}", 0, '<b>', '</b>') as snippet`;
+          selectClause += `, highlight("${input.table}", 0, '<b>', '</b>') as snippet`;
         }
         if (input.query === "*" || input.query.trim() === "") {
           const sql2 = `SELECT ${selectClause}, NULL as rank FROM "${input.table}" ORDER BY rowid LIMIT ${input.limit}`;
-          const result2 = await adapter.executeReadQuery(sql2);
+          const result2 = await adapter.executeReadQuery(sql2, queryParams);
           return {
             success: true,
             rowCount: result2.rows?.length ?? 0,
@@ -202,7 +247,7 @@ function createFtsSearchTool(adapter) {
           matchExpr = `"${input.table}" MATCH '${colFilter}'`;
         }
         const sql = `SELECT ${selectClause}, rank FROM "${input.table}" WHERE ${matchExpr} ORDER BY rank LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -264,6 +309,7 @@ function createFtsMatchInfoTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsMatchInfoSchema.parse(params);
+        const queryParams = [];
         if (!isFts5Available(adapter)) {
           return buildFts5SearchUnavailableError();
         }
@@ -276,8 +322,71 @@ function createFtsMatchInfoTool(adapter) {
         } else {
           rankExpr = "rank";
         }
-        const sql = `SELECT *, ${rankExpr} as score FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY score`;
-        const result = await adapter.executeReadQuery(sql);
+        const selectCols = input.includeRowData ? "*" : "rowid";
+        const sql = `SELECT ${selectCols}, ${rankExpr} as score FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY score`;
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        return {
+          success: true,
+          rowCount: result.rows?.length ?? 0,
+          results: result.rows
+        };
+      } catch (error) {
+        if (isFts5UnavailableError(error)) {
+          return buildFts5SearchUnavailableError();
+        }
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+function createFtsHeadlineTool(adapter) {
+  return {
+    name: "sqlite_fts_headline",
+    description: "Generate highlighted snippets from FTS5 full-text search results. Returns headline (highlight) and snippet (context window) for each match.",
+    group: "text",
+    inputSchema: FtsHeadlineSchema,
+    outputSchema: FtsHeadlineOutputSchema,
+    requiredScopes: ["read"],
+    annotations: readOnly("FTS Headline"),
+    handler: async (params, _context) => {
+      try {
+        const input = FtsHeadlineSchema.parse(params);
+        const queryParams = [];
+        if (!isFts5Available(adapter)) {
+          return buildFts5SearchUnavailableError();
+        }
+        sanitizeIdentifier(input.table);
+        await validateTableExists(adapter, input.table);
+        const queryEscaped = input.query.replace(/'/g, "''");
+        let columnIndex = 0;
+        if (input.column) {
+          const colResult = await adapter.executeReadQuery(
+            `PRAGMA table_info("${input.table}")`,
+            queryParams
+          );
+          const colRows = colResult.rows ?? [];
+          const found = colRows.findIndex(
+            (r) => String(r["name"]) === input.column
+          );
+          if (found >= 0) {
+            columnIndex = found;
+          }
+        }
+        const startSel = input.startSel.replace(/'/g, "''");
+        const stopSel = input.stopSel.replace(/'/g, "''");
+        const highlightExpr = `highlight("${input.table}", ${String(columnIndex)}, '${startSel}', '${stopSel}')`;
+        const snippetExpr = `snippet("${input.table}", ${String(columnIndex)}, '${startSel}', '${stopSel}', '...', ${String(input.snippetWords)})`;
+        if (input.query === "*" || input.query.trim() === "") {
+          const sql2 = `SELECT *, NULL as headline, NULL as snippet, NULL as rank FROM "${input.table}" ORDER BY rowid LIMIT ${String(input.limit)}`;
+          const result2 = await adapter.executeReadQuery(sql2, queryParams);
+          return {
+            success: true,
+            rowCount: result2.rows?.length ?? 0,
+            results: result2.rows
+          };
+        }
+        const sql = `SELECT ${highlightExpr} as headline, ${snippetExpr} as snippet, rank FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY rank LIMIT ${String(input.limit)}`;
+        const result = await adapter.executeReadQuery(sql, queryParams);
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -292,17 +401,166 @@ function createFtsMatchInfoTool(adapter) {
     }
   };
 }
-var VALID_MODES = ["deferred", "immediate", "exclusive"];
+var TransactionBeginOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  mode: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionCommitOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionRollbackOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionSavepointOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  name: z.string().optional(),
+  savepoint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionReleaseOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  name: z.string().optional(),
+  savepoint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionRollbackToOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  name: z.string().optional(),
+  savepoint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionExecuteOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  statementsExecuted: z.number().optional(),
+  results: z.array(z.unknown()).optional()
+}).extend(ErrorResponseFields.shape);
+var TransactionStatusOutputSchema = z.object({
+  success: z.boolean(),
+  status: z.enum(["active", "none"]).optional().describe(
+    'Transaction state: "active" (transaction in progress) or "none" (no active transaction)'
+  ),
+  active: z.boolean().optional().describe("Whether a transaction is currently in progress"),
+  message: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var RowNumberResultSchema = z.object({
+  row_number: z.number()
+}).loose();
+var WindowRowNumberOutputSchema = z.object({
+  success: z.boolean(),
+  rowCount: z.number().optional(),
+  rows: z.array(RowNumberResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var RankResultSchema = z.object({
+  rank: z.number().optional(),
+  dense_rank: z.number().optional(),
+  percent_rank: z.number().optional()
+}).loose();
+var WindowRankOutputSchema = z.object({
+  success: z.boolean(),
+  rankType: z.string().optional(),
+  rowCount: z.number().optional(),
+  rows: z.array(RankResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var LagLeadResultSchema = z.object({
+  lag_value: z.unknown().optional(),
+  lead_value: z.unknown().optional()
+}).loose();
+var WindowLagLeadOutputSchema = z.object({
+  success: z.boolean(),
+  direction: z.string().optional(),
+  offset: z.number().optional(),
+  rowCount: z.number().optional(),
+  rows: z.array(LagLeadResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var RunningTotalResultSchema = z.object({
+  running_total: z.number()
+}).loose();
+var WindowRunningTotalOutputSchema = z.object({
+  success: z.boolean(),
+  valueColumn: z.string().optional(),
+  rowCount: z.number().optional(),
+  rows: z.array(RunningTotalResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var MovingAvgResultSchema = z.object({
+  moving_avg: z.number()
+}).loose();
+var WindowMovingAvgOutputSchema = z.object({
+  success: z.boolean(),
+  valueColumn: z.string().optional(),
+  windowSize: z.number().optional(),
+  rowCount: z.number().optional(),
+  rows: z.array(MovingAvgResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var NtileResultSchema = z.object({
+  ntile: z.number()
+}).loose();
+var WindowNtileOutputSchema = z.object({
+  success: z.boolean(),
+  buckets: z.number().optional(),
+  rowCount: z.number().optional(),
+  rows: z.array(NtileResultSchema).optional(),
+  hint: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteLoadOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  alreadyLoaded: z.boolean().optional(),
+  extensionPath: z.string().optional(),
+  searchedPaths: z.array(z.string()).optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteCreateTableOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  tableName: z.string().optional(),
+  alreadyExists: z.boolean().optional(),
+  geometryColumn: z.string().optional(),
+  geometryType: z.string().optional(),
+  srid: z.number().optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteQueryOutputSchema = z.object({
+  success: z.boolean(),
+  rowCount: z.number().optional(),
+  rows: z.array(RowRecordSchema).optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteIndexOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  action: z.string().optional(),
+  alreadyExists: z.boolean().optional(),
+  alreadyDropped: z.boolean().optional(),
+  indexed: z.boolean().optional(),
+  valid: z.boolean().nullable().optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteAnalyzeOutputSchema = z.object({
+  success: z.boolean(),
+  analysisType: z.string().optional(),
+  rowCount: z.number().optional(),
+  results: z.array(RowRecordSchema).optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteTransformOutputSchema = z.object({
+  success: z.boolean(),
+  operation: z.string().optional(),
+  result: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var SpatialiteImportOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  rowsAffected: z.number().optional()
+}).extend(ErrorResponseFields.shape);
+
+// src/adapters/sqlite-native/tools/transactions.ts
 var BeginTransactionSchema = z.object({
-  mode: z.preprocess(
-    (val) => {
-      if (typeof val !== "string") return void 0;
-      const normalized = val.toLowerCase();
-      return VALID_MODES.includes(normalized) ? normalized : void 0;
-    },
-    z.enum(["deferred", "immediate", "exclusive"]).optional().default("deferred").describe(
-      "Transaction mode: deferred waits for first write, immediate acquires lock immediately, exclusive blocks all access"
-    )
+  mode: z.enum(["deferred", "immediate", "exclusive"]).optional().default("deferred").describe(
+    "Transaction mode: deferred waits for first write, immediate acquires lock immediately, exclusive blocks all access"
   )
 });
 var SavepointSchema = z.object({
@@ -315,6 +573,7 @@ var ExecuteInTransactionSchema = z.object({
 function getTransactionTools(adapter) {
   return [
     createBeginTransactionTool(adapter),
+    createTransactionStatusTool(adapter),
     createCommitTransactionTool(adapter),
     createRollbackTransactionTool(adapter),
     createSavepointTool(adapter),
@@ -327,7 +586,7 @@ function createBeginTransactionTool(adapter) {
   return {
     name: "sqlite_transaction_begin",
     description: "Begin a new transaction. Use immediate or exclusive mode for write-heavy operations.",
-    group: "admin",
+    group: "transactions",
     inputSchema: BeginTransactionSchema,
     outputSchema: TransactionBeginOutputSchema,
     annotations: write("Begin Transaction"),
@@ -348,11 +607,36 @@ function createBeginTransactionTool(adapter) {
     }
   };
 }
+function createTransactionStatusTool(adapter) {
+  return {
+    name: "sqlite_transaction_status",
+    description: "Check whether a transaction is currently active. Returns status and a boolean flag. Read-only \u2014 does not alter transaction state.",
+    group: "transactions",
+    inputSchema: z.object({}),
+    outputSchema: TransactionStatusOutputSchema,
+    annotations: readOnly("Transaction Status"),
+    requiredScopes: ["read"],
+    handler: (_params, _context) => {
+      try {
+        const db = adapter.getDatabase();
+        const active = db.inTransaction;
+        return Promise.resolve({
+          success: true,
+          status: active ? "active" : "none",
+          active,
+          message: active ? "A transaction is currently active." : "No transaction is active."
+        });
+      } catch (error) {
+        return Promise.resolve(formatHandlerError(error));
+      }
+    }
+  };
+}
 function createCommitTransactionTool(adapter) {
   return {
     name: "sqlite_transaction_commit",
     description: "Commit the current transaction, making all changes permanent.",
-    group: "admin",
+    group: "transactions",
     inputSchema: z.object({}),
     outputSchema: TransactionCommitOutputSchema,
     annotations: write("Commit Transaction"),
@@ -374,7 +658,7 @@ function createRollbackTransactionTool(adapter) {
   return {
     name: "sqlite_transaction_rollback",
     description: "Rollback the current transaction, discarding all changes.",
-    group: "admin",
+    group: "transactions",
     outputSchema: TransactionRollbackOutputSchema,
     inputSchema: z.object({}),
     annotations: write("Rollback Transaction"),
@@ -396,7 +680,7 @@ function createSavepointTool(adapter) {
   return {
     name: "sqlite_transaction_savepoint",
     description: "Create a savepoint within the current transaction for partial rollback.",
-    group: "admin",
+    group: "transactions",
     outputSchema: TransactionSavepointOutputSchema,
     inputSchema: SavepointSchema,
     annotations: write("Create Savepoint"),
@@ -429,7 +713,7 @@ function createReleaseSavepointTool(adapter) {
   return {
     name: "sqlite_transaction_release",
     description: "Release a savepoint, keeping the changes made since it was created.",
-    group: "admin",
+    group: "transactions",
     inputSchema: SavepointSchema,
     outputSchema: TransactionReleaseOutputSchema,
     annotations: write("Release Savepoint"),
@@ -462,7 +746,7 @@ function createRollbackToSavepointTool(adapter) {
   return {
     name: "sqlite_transaction_rollback_to",
     description: "Rollback to a savepoint, discarding changes made after it was created.",
-    group: "admin",
+    group: "transactions",
     inputSchema: SavepointSchema,
     outputSchema: TransactionRollbackToOutputSchema,
     annotations: write("Rollback to Savepoint"),
@@ -495,43 +779,65 @@ function createExecuteInTransactionTool(adapter) {
   return {
     name: "sqlite_transaction_execute",
     description: "Execute multiple SQL statements in a single transaction. Automatically commits on success or rolls back on error.",
-    group: "admin",
+    group: "transactions",
     outputSchema: TransactionExecuteOutputSchema,
     inputSchema: ExecuteInTransactionSchema,
     annotations: write("Execute in Transaction"),
     requiredScopes: ["write"],
     handler: async (params, _context) => {
+      const queryParams = [];
       let input;
       try {
         input = ExecuteInTransactionSchema.parse(params);
+        if (input.statements.length === 0) {
+          throw new ValidationError("Must provide at least one SQL statement");
+        }
       } catch (error) {
+        const errObj = formatHandlerError(error);
         return {
-          ...formatHandlerError(error),
-          message: "",
+          ...errObj,
+          message: errObj.error || "Transaction execution failed",
           statementsExecuted: 0,
           results: []
         };
       }
       const results = [];
       let success = true;
+      let transactionStarted = false;
+      const db = adapter.getDatabase();
+      const originallyInTransaction = db.inTransaction;
       try {
-        adapter.beginTransaction();
+        if (!originallyInTransaction) {
+          adapter.beginTransaction();
+          transactionStarted = true;
+        }
         for (const statement of input.statements) {
           try {
             const isSelect = statement.trim().toUpperCase().startsWith("SELECT");
             if (isSelect) {
-              const result = await adapter.executeReadQuery(statement);
+              const result = await adapter.executeReadQuery(
+                statement,
+                queryParams
+              );
               const rowCount = result.rows?.length ?? 0;
               const statementResult = {
                 statement: statement.substring(0, 100) + (statement.length > 100 ? "..." : ""),
                 rowCount
               };
               if (result.rows) {
-                statementResult.rows = result.rows;
+                if (result.rows.length > 50) {
+                  statementResult.rows = result.rows.slice(0, 50);
+                  statementResult.error = "Result truncated to 50 rows. Use sqlite_read_query with LIMIT for larger datasets.";
+                } else {
+                  statementResult.rows = result.rows;
+                }
               }
               results.push(statementResult);
             } else {
-              const result = await adapter.executeWriteQuery(statement);
+              const result = await adapter.executeWriteQuery(
+                statement,
+                queryParams
+              );
               results.push({
                 statement: statement.substring(0, 100) + (statement.length > 100 ? "..." : ""),
                 rowsAffected: result.rowsAffected ?? 0
@@ -549,25 +855,38 @@ function createExecuteInTransactionTool(adapter) {
             success = false;
           }
         }
-        adapter.commitTransaction();
+        if (transactionStarted) {
+          adapter.commitTransaction();
+        }
         return {
           success,
+          error: success ? void 0 : "Transaction completed with errors",
           message: success ? "Transaction completed successfully" : "Transaction completed with errors",
           statementsExecuted: input.statements.length,
           results
         };
       } catch (error) {
         let rollbackFailure;
-        try {
-          adapter.rollbackTransaction();
-        } catch (rbError) {
-          rollbackFailure = rbError instanceof Error ? rbError.message : String(rbError);
+        if (transactionStarted) {
+          try {
+            adapter.rollbackTransaction();
+          } catch (rbError) {
+            rollbackFailure = rbError instanceof Error ? rbError.message : String(rbError);
+          }
+        } else if (originallyInTransaction && input.rollbackOnError) {
+          try {
+            adapter.rollbackTransaction();
+          } catch (rbError) {
+            rollbackFailure = rbError instanceof Error ? rbError.message : String(rbError);
+          }
         }
         const message = error instanceof Error ? error.message : String(error);
         const formatted = formatHandlerError(error);
         let rollbackMessage = `Transaction rolled back: ${message}`;
         if (rollbackFailure) {
           rollbackMessage += ` (rollback error: ${rollbackFailure})`;
+        } else if (!transactionStarted && !originallyInTransaction) {
+          rollbackMessage = `Transaction failed to start: ${message}`;
         }
         return {
           ...formatted,
@@ -580,7 +899,14 @@ function createExecuteInTransactionTool(adapter) {
     }
   };
 }
-var coerceNumber = (val) => typeof val === "string" ? isNaN(Number(val)) ? void 0 : Number(val) : val;
+var coerceNumber = (val) => {
+  if (typeof val === "string") {
+    if (val.trim() === "") return void 0;
+    const num = Number(val);
+    return isNaN(num) ? val : num;
+  }
+  return val;
+};
 var coerceEnumValues2 = (allowed) => (val) => typeof val === "string" && allowed.includes(val) ? val : void 0;
 var VALID_DIRECTIONS = ["lag", "lead"];
 var RowNumberSchema = z.object({
@@ -588,10 +914,10 @@ var RowNumberSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 var RankSchema = z.object({
@@ -603,10 +929,10 @@ var RankSchema = z.object({
     coerceEnumValues2(["rank", "dense_rank", "percent_rank"]),
     z.enum(["rank", "dense_rank", "percent_rank"]).optional().default("rank").describe("Rank function type")
   ),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 var LagLeadSchema = z.object({
@@ -621,10 +947,10 @@ var LagLeadSchema = z.object({
   defaultValue: z.string().optional().describe("Default value if no row exists"),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 var RunningTotalSchema = z.object({
@@ -633,10 +959,10 @@ var RunningTotalSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   partitionBy: z.string().optional().describe("Reset running total for each partition"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 var MovingAverageSchema = z.object({
@@ -645,14 +971,14 @@ var MovingAverageSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   windowSize: z.preprocess(
     coerceNumber,
-    z.number().optional().describe("Number of rows in the moving window")
+    z.number().describe("Number of rows in the moving window")
   ),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 var NtileSchema = z.object({
@@ -660,24 +986,18 @@ var NtileSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   buckets: z.preprocess(
     coerceNumber,
-    z.number().optional().describe("Number of buckets (e.g., 4 for quartiles)")
+    z.number().describe("Number of buckets (e.g., 4 for quartiles)")
   ),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
-    z.number().optional().default(100).describe("Maximum rows to return")
+    z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 async function validateTableExists2(adapter, table) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table)) {
-    throw new DbMcpError(
-      "Invalid table name",
-      "NATIVE_WINDOW_INVALID_TABLE",
-      "validation" /* VALIDATION */
-    );
-  }
+  validateIdentifier(table);
   const result = await adapter.executeReadQuery(
     `SELECT 1 FROM sqlite_master WHERE type IN ('table', 'view') AND name='${table}'`
   );
@@ -694,13 +1014,7 @@ async function validateTableExists2(adapter, table) {
   }
 }
 async function validateColumnInTable(adapter, table, column) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(column)) {
-    throw new DbMcpError(
-      "Invalid column name",
-      "NATIVE_WINDOW_INVALID_COLUMN",
-      "validation" /* VALIDATION */
-    );
-  }
+  validateIdentifier(column);
   const tableInfo = await adapter.executeReadQuery(
     `SELECT name FROM pragma_table_info('${table}') WHERE name='${column}'`
   );
@@ -723,16 +1037,128 @@ async function validateOrderByColumns(adapter, table, orderBy) {
     const firstToken = tokens[0];
     if (!firstToken) continue;
     const colName = firstToken.replace(/^"|"$/g, "");
-    if (/[.()+*/]/.test(colName)) continue;
+    if (/[;()+*/]/.test(colName)) {
+      throw new DbMcpError(
+        `Invalid ORDER BY expression: '${colName}' contains disallowed characters. Only column names with optional ASC/DESC are permitted.`,
+        "NATIVE_WINDOW_INVALID_ORDERBY",
+        "validation" /* VALIDATION */
+      );
+    }
     if (/^(ASC|DESC)$/i.test(colName)) continue;
+    if (colName.includes(".")) {
+      for (const segment of colName.split(".")) {
+        validateIdentifier(segment);
+      }
+      continue;
+    }
     await validateColumnInTable(adapter, table, colName);
   }
 }
-function formatColumns(selectColumns) {
-  if (selectColumns === void 0 || selectColumns.length === 0) {
-    return "*";
+async function resolveSelectColumns(adapter, table, selectColumns, rankCol) {
+  if (selectColumns && selectColumns.length > 0) {
+    return {
+      columnList: selectColumns.map((c) => sanitizeIdentifier(c)).join(", ")
+    };
+  }
+  const tableInfo = await adapter.executeReadQuery(
+    `PRAGMA table_info('${table}')`
+  );
+  const TEXT_TYPES = /* @__PURE__ */ new Set([
+    "text",
+    "blob",
+    "clob",
+    "varchar",
+    "nvarchar",
+    "char"
+  ]);
+  const LONG_CONTENT_PATTERNS = [
+    "description",
+    "body",
+    "bio",
+    "content",
+    "notes",
+    "summary",
+    "comment",
+    "details",
+    "html",
+    "markdown",
+    "text",
+    "message",
+    "payload",
+    "raw",
+    "data",
+    "log",
+    "blob"
+  ];
+  const excluded = [];
+  const included = [];
+  for (const c of tableInfo.rows ?? []) {
+    const colName = c["name"];
+    const colType = (c["type"] ?? "").toLowerCase();
+    const nameLower = colName.toLowerCase();
+    const isText = [...TEXT_TYPES].some(
+      (t) => colType === t || colType.startsWith(t)
+    );
+    const isRankCol = rankCol ? nameLower === rankCol.toLowerCase() : false;
+    const isLongContent = LONG_CONTENT_PATTERNS.some(
+      (p) => nameLower === p || nameLower.endsWith(`_${p}`) || nameLower.startsWith(`${p}_`)
+    );
+    if (isText && !isRankCol && isLongContent) {
+      excluded.push(colName);
+    } else {
+      included.push(colName);
+    }
   }
-  return selectColumns.map((c) => `"${c}"`).join(", ");
+  if (included.length > 10) {
+    throw new ValidationError(
+      `Table '${table}' has too many columns (${included.length} remaining after text filtering). You must explicitly provide 'selectColumns' to prevent context window bloat.`,
+      "INVALID_INPUT"
+    );
+  }
+  if (excluded.length > 0 && included.length > 0) {
+    return {
+      columnList: included.map((c) => sanitizeIdentifier(c)).join(", "),
+      hint: `Excluded ${excluded.length} long-content column(s) (${excluded.join(", ")}) to reduce payload. Use selectColumns to override.`
+    };
+  }
+  return { columnList: "*" };
+}
+function sanitizePartitionBy(partitionBy) {
+  const columns = partitionBy.split(",").map((c) => c.trim()).filter(Boolean);
+  for (const col of columns) {
+    validateIdentifier(col);
+  }
+  return columns.map((c) => sanitizeIdentifier(c)).join(", ");
+}
+function sanitizeOrderByExpr(orderBy) {
+  const parts = orderBy.split(",");
+  const sanitized = [];
+  for (const part of parts) {
+    const tokens = part.trim().split(/\s+/);
+    const colToken = tokens[0];
+    if (!colToken) continue;
+    const colName = colToken.replace(/^"|"$/g, "");
+    validateIdentifier(colName);
+    const direction = tokens[1];
+    if (direction && /^(ASC|DESC)$/i.test(direction)) {
+      sanitized.push(
+        `${sanitizeIdentifier(colName)} ${direction.toUpperCase()}`
+      );
+    } else {
+      sanitized.push(sanitizeIdentifier(colName));
+    }
+  }
+  return sanitized.join(", ");
+}
+function validateDefaultValue(value) {
+  if (/^-?\d+(\.\d+)?$/.test(value)) return;
+  if (/^'[^']*'$/.test(value)) return;
+  if (/^NULL$/i.test(value)) return;
+  throw new DbMcpError(
+    `Invalid default value: '${value}'. Only numeric literals, single-quoted strings, or NULL are permitted.`,
+    "NATIVE_WINDOW_INVALID_DEFAULT",
+    "validation" /* VALIDATION */
+  );
 }
 function getWindowTools(adapter) {
   return [
@@ -754,28 +1180,41 @@ function createRowNumberTool(adapter) {
     annotations: readOnly("Window Row Number"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = RowNumberSchema.parse(params);
         await validateTableExists2(adapter, input.table);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ROW_NUMBER() OVER (${partition} ORDER BY ${input.orderBy}) as row_number
-                FROM "${input.table}"
+                    ROW_NUMBER() OVER (${partition} ORDER BY ${orderByExpr}) as row_number
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
@@ -794,28 +1233,41 @@ function createRankTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = RankSchema.parse(params);
+        const queryParams = [];
         await validateTableExists2(adapter, input.table);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const rankFunc = input.rankType.toUpperCase();
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ${rankFunc}() OVER (${partition} ORDER BY ${input.orderBy}) as ${input.rankType}
-                FROM "${input.table}"
+                    ${rankFunc}() OVER (${partition} ORDER BY ${orderByExpr}) as ${input.rankType}
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           rankType: input.rankType,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
@@ -833,7 +1285,10 @@ function createLagLeadTool(adapter) {
     requiredScopes: ["read"],
     handler: async (params, _context) => {
       try {
-        const input = LagLeadSchema.parse(params);
+        const input = LagLeadSchema.parse(
+          resolveAliases(params, { valueColumn: "column" })
+        );
+        const queryParams = [];
         const normalizedDirection = input.direction.toLowerCase();
         if (!VALID_DIRECTIONS.includes(
           normalizedDirection
@@ -849,28 +1304,45 @@ function createLagLeadTool(adapter) {
         await validateTableExists2(adapter, input.table);
         await validateColumnInTable(adapter, input.table, input.column);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns,
+          input.column
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const func = normalizedDirection.toUpperCase();
-        const defaultVal = input.defaultValue !== void 0 ? `, ${input.defaultValue}` : "";
+        let defaultVal = "";
+        if (input.defaultValue !== void 0) {
+          validateDefaultValue(input.defaultValue);
+          defaultVal = `, ${input.defaultValue}`;
+        }
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ${func}("${input.column}", ${input.offset}${defaultVal}) OVER (${partition} ORDER BY ${input.orderBy}) as ${normalizedDirection}_value
-                FROM "${input.table}"
+                    ${func}(${sanitizeIdentifier(input.column)}, ${input.offset}${defaultVal}) OVER (${partition} ORDER BY ${orderByExpr}) as ${normalizedDirection}_value
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           direction: normalizedDirection,
           offset: input.offset,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
@@ -887,6 +1359,7 @@ function createRunningTotalTool(adapter) {
     annotations: readOnly("Window Running Total"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = RunningTotalSchema.parse(
           resolveAliases(params, { valueColumn: "column" })
@@ -894,25 +1367,38 @@ function createRunningTotalTool(adapter) {
         await validateTableExists2(adapter, input.table);
         await validateColumnInTable(adapter, input.table, input.column);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns,
+          input.column
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    SUM("${input.column}") OVER (${partition} ORDER BY ${input.orderBy} ROWS UNBOUNDED PRECEDING) as running_total
-                FROM "${input.table}"
+                    SUM(${sanitizeIdentifier(input.column)}) OVER (${partition} ORDER BY ${orderByExpr} ROWS UNBOUNDED PRECEDING) as running_total
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           valueColumn: input.column,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
@@ -929,43 +1415,48 @@ function createMovingAverageTool(adapter) {
     annotations: readOnly("Window Moving Average"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = MovingAverageSchema.parse(
           resolveAliases(params, { valueColumn: "column" })
         );
-        if (input.windowSize === void 0) {
-          return {
-            success: false,
-            error: "'windowSize' is required",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          };
-        }
         await validateTableExists2(adapter, input.table);
         await validateColumnInTable(adapter, input.table, input.column);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns,
+          input.column
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const preceding = input.windowSize - 1;
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    AVG("${input.column}") OVER (${partition} ORDER BY ${input.orderBy} ROWS BETWEEN ${preceding} PRECEDING AND CURRENT ROW) as moving_avg
-                FROM "${input.table}"
+                    AVG(${sanitizeIdentifier(input.column)}) OVER (${partition} ORDER BY ${orderByExpr} ROWS BETWEEN ${preceding} PRECEDING AND CURRENT ROW) as moving_avg
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           valueColumn: input.column,
           windowSize: input.windowSize,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
@@ -984,43 +1475,54 @@ function createNtileTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = NtileSchema.parse(params);
-        if (input.buckets === void 0) {
-          return {
-            success: false,
-            error: "'buckets' is required",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          };
-        }
+        const queryParams = [];
         await validateTableExists2(adapter, input.table);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
-        const columns = formatColumns(input.selectColumns);
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const { columnList: columns, hint } = await resolveSelectColumns(
+          adapter,
+          input.table,
+          input.selectColumns
+        );
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    NTILE(${input.buckets}) OVER (${partition} ORDER BY ${input.orderBy}) as ntile
-                FROM "${input.table}"
+                    NTILE(${input.buckets}) OVER (${partition} ORDER BY ${orderByExpr}) as ntile
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
-        return {
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const response = {
           success: true,
           buckets: input.buckets,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows
         };
+        if (hint) response["hint"] = hint;
+        return response;
       } catch (error) {
         return formatHandlerError(error);
       }
     }
   };
 }
-var coerceNumber2 = (val) => typeof val === "string" ? isNaN(Number(val)) ? void 0 : Number(val) : val;
+var coerceNumber2 = (val) => {
+  if (typeof val === "string") {
+    if (val.trim() === "") return void 0;
+    const num = Number(val);
+    return isNaN(num) ? val : num;
+  }
+  return val;
+};
 var coerceBoolean = (val) => typeof val === "string" ? val === "true" ? true : val === "false" ? false : void 0 : val;
 function createEnumCoercer(validValues) {
   return (val) => typeof val === "string" && validValues.includes(val) ? val : typeof val === "string" ? void 0 : val;
@@ -1051,9 +1553,20 @@ var VALID_OPERATIONS = [
   "envelope",
   "simplify"
 ];
+var VALID_COLUMN_TYPES = [
+  "TEXT",
+  "INTEGER",
+  "REAL",
+  "BLOB",
+  "NUMERIC",
+  "VARCHAR",
+  "BOOLEAN",
+  "DATE",
+  "DATETIME",
+  "TIMESTAMP"
+];
 var coerceGeometryType = createEnumCoercer(VALID_GEOMETRY_TYPES);
 var LoadSpatialiteSchema = z.object({
-  extensionPath: z.string().optional().describe("Custom path to mod_spatialite extension"),
   forceReload: z.preprocess(
     coerceBoolean,
     z.boolean().optional().default(false).describe("Force reload if already loaded")
@@ -1081,7 +1594,7 @@ var CreateSpatialTableSchema = z.object({
   additionalColumns: z.array(
     z.object({
       name: z.string(),
-      type: z.string()
+      type: z.enum(VALID_COLUMN_TYPES).optional().default("TEXT")
     })
   ).optional().default([]).describe("Additional non-spatial columns")
 });
@@ -1151,8 +1664,9 @@ var SpatialImportSchema = z.object({
   ),
   additionalData: z.record(z.string(), z.unknown()).optional().describe("Additional column values")
 });
-
-// src/adapters/sqlite-native/tools/spatialite/loader.ts
+var require2 = createRequire(import.meta.url);
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path2.dirname(__filename$1);
 var SPATIALITE_PATHS = [
   process.env["SPATIALITE_PATH"],
   "mod_spatialite",
@@ -1163,20 +1677,27 @@ var SPATIALITE_PATHS = [
   "/usr/local/lib/mod_spatialite.dylib"
 ].filter((p) => Boolean(p));
 var loadedDatabases = /* @__PURE__ */ new WeakSet();
-function tryLoadSpatialite(adapter, customPath) {
+function tryLoadSpatialite(adapter) {
   const db = adapter.getDatabase();
   if (db === null) {
     return { success: false, error: "Database not connected" };
   }
-  const paths = customPath ? [customPath, ...SPATIALITE_PATHS] : SPATIALITE_PATHS;
-  const chosenPathForEnv = customPath ?? process.env["SPATIALITE_PATH"];
+  const paths = SPATIALITE_PATHS;
+  const chosenPathForEnv = process.env["SPATIALITE_PATH"];
+  let dllCookie = null;
+  let win32Dll = null;
   if (process.platform === "win32" && chosenPathForEnv) {
     const looksLikeFsPath = chosenPathForEnv.includes("/") || chosenPathForEnv.includes("\\");
     if (looksLikeFsPath) {
       const extensionDir = chosenPathForEnv.replace(/[/\\][^/\\]+$/, "");
-      const currentPath = process.env["PATH"] ?? "";
-      if (!currentPath.includes(extensionDir)) {
-        process.env["PATH"] = extensionDir + ";" + currentPath;
+      try {
+        const addonPath = path2.resolve(
+          __dirname$1,
+          "../../../../../build/Release/win32_dll.node"
+        );
+        win32Dll = require2(addonPath);
+        dllCookie = win32Dll.addDllDirectory(extensionDir);
+      } catch {
       }
     }
   }
@@ -1185,10 +1706,16 @@ function tryLoadSpatialite(adapter, customPath) {
       db.loadExtension(candidatePath);
       db.exec("SELECT InitSpatialMetaData(1)");
       loadedDatabases.add(db);
+      if (win32Dll !== null && dllCookie !== null) {
+        win32Dll.removeDllDirectory(dllCookie);
+      }
       return { success: true, path: candidatePath };
     } catch {
     }
   }
+  if (win32Dll !== null && dllCookie !== null) {
+    win32Dll.removeDllDirectory(dllCookie);
+  }
   return {
     success: false,
     error: "SpatiaLite extension not found. Install mod_spatialite and set SPATIALITE_PATH environment variable."
@@ -1211,11 +1738,9 @@ function ensureSpatialite(adapter) {
   if (!isSpatialiteLoaded(adapter)) {
     const result = tryLoadSpatialite(adapter);
     if (!result.success) {
-      throw new DbMcpError(
-        result.error ?? "Failed to load SpatiaLite",
-        "SPATIALITE_LOAD_FAILED",
-        "connection" /* CONNECTION */
-      );
+      throw new ExtensionNotAvailableError("SpatiaLite", {
+        suggestion: "Install mod_spatialite and set SPATIALITE_PATH environment variable."
+      });
     }
   }
 }
@@ -1240,7 +1765,7 @@ function createLoadSpatialiteTool(adapter) {
             alreadyLoaded: true
           });
         }
-        const result = tryLoadSpatialite(adapter, input.extensionPath);
+        const result = tryLoadSpatialite(adapter);
         if (result.success) {
           return Promise.resolve({
             success: true,
@@ -1275,7 +1800,9 @@ function createSpatialTableTool(adapter) {
       try {
         const input = CreateSpatialTableSchema.parse(params);
         ensureSpatialite(adapter);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -1284,8 +1811,20 @@ function createSpatialTableTool(adapter) {
             recoverable: false
           };
         }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
+          return {
+            success: false,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
+            code: "VALIDATION_ERROR",
+            category: "validation",
+            recoverable: false
+          };
+        }
         const existsCheck = await adapter.executeReadQuery(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name='${input.tableName}'`
+          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
+          [input.tableName]
         );
         const alreadyExists = existsCheck.rows != null && existsCheck.rows.length > 0;
         if (alreadyExists) {
@@ -1298,7 +1837,9 @@ function createSpatialTableTool(adapter) {
         }
         const columns = ["id INTEGER PRIMARY KEY AUTOINCREMENT"];
         for (const col of input.additionalColumns) {
-          if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(col.name)) {
+          try {
+            validateIdentifier(col.name);
+          } catch {
             return {
               success: false,
               error: `Invalid column name: '${col.name}'`,
@@ -1307,10 +1848,10 @@ function createSpatialTableTool(adapter) {
               recoverable: false
             };
           }
-          columns.push(`"${col.name}" ${col.type}`);
+          columns.push(`${sanitizeIdentifier(col.name)} ${col.type}`);
         }
         await adapter.executeWriteQuery(
-          `CREATE TABLE "${input.tableName}" (${columns.join(", ")})`
+          `CREATE TABLE ${sanitizeIdentifier(input.tableName)} (${columns.join(", ")})`
         );
         const addResult = await adapter.executeReadQuery(
           `SELECT AddGeometryColumn('${input.tableName}', '${input.geometryColumn}', ${input.srid}, '${input.geometryType}', 'XY')`
@@ -1389,7 +1930,9 @@ function createSpatialIndexTool(adapter) {
       try {
         const input = SpatialIndexSchema.parse(params);
         ensureSpatialite(adapter);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -1407,8 +1950,20 @@ function createSpatialIndexTool(adapter) {
             recoverable: false
           };
         }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
+          return {
+            success: false,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
+            code: "VALIDATION_ERROR",
+            category: "validation",
+            recoverable: false
+          };
+        }
         const tableCheck = await adapter.executeReadQuery(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name='${input.tableName}'`
+          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
+          [input.tableName]
         );
         if (!tableCheck.rows || tableCheck.rows.length === 0) {
           return {
@@ -1422,9 +1977,10 @@ function createSpatialIndexTool(adapter) {
         }
         const indexExists = async () => {
           const idxCheck = await adapter.executeReadQuery(
-            `SELECT name FROM sqlite_master WHERE type='table' AND name='idx_${input.tableName}_${input.geometryColumn}'`
+            `SELECT spatial_index_enabled FROM geometry_columns WHERE f_table_name = '${input.tableName}' AND f_geometry_column = '${input.geometryColumn}'`
           );
-          return (idxCheck.rows?.length ?? 0) > 0;
+          const val = idxCheck.rows?.[0]?.["spatial_index_enabled"];
+          return val === 1 || val === "1";
         };
         switch (input.action) {
           case "create": {
@@ -1436,9 +1992,18 @@ function createSpatialIndexTool(adapter) {
                 action: "create"
               };
             }
-            await adapter.executeReadQuery(
-              `SELECT CreateSpatialIndex('${input.tableName}', '${input.geometryColumn}')`
+            const createRes = await adapter.executeReadQuery(
+              `SELECT CreateSpatialIndex('${input.tableName}', '${input.geometryColumn}') as res`
             );
+            if (createRes.rows?.[0]?.["res"] === 0) {
+              return {
+                success: false,
+                error: `Failed to create spatial index on ${input.tableName}.${input.geometryColumn}`,
+                code: "SPATIAL_INDEX_CREATE_FAILED",
+                category: "internal",
+                recoverable: false
+              };
+            }
             return {
               success: true,
               message: `Spatial index created on ${input.tableName}.${input.geometryColumn}`,
@@ -1454,9 +2019,18 @@ function createSpatialIndexTool(adapter) {
                 action: "drop"
               };
             }
-            await adapter.executeReadQuery(
-              `SELECT DisableSpatialIndex('${input.tableName}', '${input.geometryColumn}')`
+            const dropRes = await adapter.executeReadQuery(
+              `SELECT DisableSpatialIndex('${input.tableName}', '${input.geometryColumn}') as res`
             );
+            if (dropRes.rows?.[0]?.["res"] === 0) {
+              return {
+                success: false,
+                error: `Failed to drop spatial index on ${input.tableName}.${input.geometryColumn}`,
+                code: "SPATIAL_INDEX_DROP_FAILED",
+                category: "internal",
+                recoverable: false
+              };
+            }
             return {
               success: true,
               message: `Spatial index dropped from ${input.tableName}.${input.geometryColumn}`,
@@ -1531,6 +2105,7 @@ function createSpatialAnalysisTool(adapter) {
     requiredScopes: ["read"],
     annotations: readOnly("SpatiaLite Analyze"),
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = SpatialAnalysisSchema.parse(params);
         ensureSpatialite(adapter);
@@ -1545,7 +2120,9 @@ function createSpatialAnalysisTool(adapter) {
             recoverable: false
           };
         }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.sourceTable)) {
+        try {
+          validateIdentifier(input.sourceTable);
+        } catch {
           return {
             success: false,
             error: `Invalid source table name: '${input.sourceTable}'`,
@@ -1554,10 +2131,25 @@ function createSpatialAnalysisTool(adapter) {
             recoverable: false
           };
         }
-        if (input.targetTable && !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.targetTable)) {
+        if (input.targetTable) {
+          try {
+            validateIdentifier(input.targetTable);
+          } catch {
+            return {
+              success: false,
+              error: `Invalid target table name: '${input.targetTable}'`,
+              code: "VALIDATION_ERROR",
+              category: "validation",
+              recoverable: false
+            };
+          }
+        }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
           return {
             success: false,
-            error: `Invalid target table name: '${input.targetTable}'`,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
             code: "VALIDATION_ERROR",
             category: "validation",
             recoverable: false
@@ -1565,15 +2157,18 @@ function createSpatialAnalysisTool(adapter) {
         }
         let query;
         switch (input.analysisType) {
-          case "spatial_extent":
+          case "spatial_extent": {
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
             query = `SELECT
-              MbrMinX(Extent("${input.geometryColumn}")) as min_x,
-              MbrMinY(Extent("${input.geometryColumn}")) as min_y,
-              MbrMaxX(Extent("${input.geometryColumn}")) as max_x,
-              MbrMaxY(Extent("${input.geometryColumn}")) as max_y,
+              MbrMinX(Extent(${geomCol})) as min_x,
+              MbrMinY(Extent(${geomCol})) as min_y,
+              MbrMaxX(Extent(${geomCol})) as max_x,
+              MbrMaxY(Extent(${geomCol})) as max_y,
               COUNT(*) as feature_count
-            FROM "${input.sourceTable}"`;
+            FROM ${srcTable}`;
             break;
+          }
           case "nearest_neighbor": {
             if (!input.targetTable) {
               return {
@@ -1584,13 +2179,16 @@ function createSpatialAnalysisTool(adapter) {
                 recoverable: false
               };
             }
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const tgtTable = sanitizeIdentifier(input.targetTable);
             const sameTable = input.sourceTable === input.targetTable;
             const selfFilter = sameTable && input.excludeSelf ? "WHERE s.id != t.id" : "";
-            const geomColumns = input.includeGeometry ? `, AsText(s."${input.geometryColumn}") as source_geom, AsText(t."${input.geometryColumn}") as target_geom` : "";
+            const geomColumns = input.includeGeometry ? `, AsText(s.${geomCol}) as source_geom, AsText(t.${geomCol}) as target_geom` : "";
             query = `SELECT
               s.id as source_id, t.id as target_id,
-              ST_Distance(s."${input.geometryColumn}", t."${input.geometryColumn}") as distance${geomColumns}
-            FROM "${input.sourceTable}" s, "${input.targetTable}" t
+              ST_Distance(s.${geomCol}, t.${geomCol}) as distance${geomColumns}
+            FROM ${srcTable} s, ${tgtTable} t
             ${selfFilter}
             ORDER BY distance LIMIT ${input.limit}`;
             break;
@@ -1605,11 +2203,14 @@ function createSpatialAnalysisTool(adapter) {
                 recoverable: false
               };
             }
-            const geomCols = input.includeGeometry ? `, AsText(s."${input.geometryColumn}") as source_geom, AsText(t."${input.geometryColumn}") as target_geom` : "";
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const tgtTable = sanitizeIdentifier(input.targetTable);
+            const geomCols = input.includeGeometry ? `, AsText(s.${geomCol}) as source_geom, AsText(t.${geomCol}) as target_geom` : "";
             query = `SELECT
               s.id as source_id, t.id as target_id${geomCols}
-            FROM "${input.sourceTable}" s, "${input.targetTable}" t
-            WHERE ST_Within(s."${input.geometryColumn}", t."${input.geometryColumn}")
+            FROM ${srcTable} s, ${tgtTable} t
+            WHERE ST_Within(s.${geomCol}, t.${geomCol})
             LIMIT ${input.limit}`;
             break;
           }
@@ -1617,9 +2218,12 @@ function createSpatialAnalysisTool(adapter) {
             const dmTarget = input.targetTable ?? input.sourceTable;
             const dmSameTable = dmTarget === input.sourceTable;
             const dmFilter = dmSameTable ? "WHERE a.id < b.id" : "";
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const dmTgtTable = sanitizeIdentifier(dmTarget);
             query = `SELECT a.id as id1, b.id as id2,
-              ST_Distance(a."${input.geometryColumn}", b."${input.geometryColumn}") as distance
-            FROM "${input.sourceTable}" a, "${dmTarget}" b
+              ST_Distance(a.${geomCol}, b.${geomCol}) as distance
+            FROM ${srcTable} a, ${dmTgtTable} b
             ${dmFilter}
             ORDER BY distance LIMIT ${input.limit}`;
             break;
@@ -1627,7 +2231,7 @@ function createSpatialAnalysisTool(adapter) {
           default:
             query = "SELECT 1";
         }
-        const result = await adapter.executeReadQuery(query);
+        const result = await adapter.executeReadQuery(query, queryParams);
         return {
           success: true,
           analysisType: input.analysisType,
@@ -1650,6 +2254,7 @@ function createGeometryTransformTool(adapter) {
     requiredScopes: ["read"],
     annotations: readOnly("SpatiaLite Transform"),
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = GeometryTransformSchema.parse(params);
         ensureSpatialite(adapter);
@@ -1665,71 +2270,69 @@ function createGeometryTransformTool(adapter) {
         let query;
         switch (input.operation) {
           case "buffer": {
-            const bufferGeom = `Buffer(GeomFromText('${input.geometry1}', ${input.srid}), ${input.distance})`;
+            const bufferGeom = `Buffer(GeomFromText(?, CAST(? AS INTEGER)), ?)`;
             const defaultTolerance = Math.max(1e-4, input.distance * 0.01);
             const tolerance = input.simplifyTolerance ?? defaultTolerance;
-            const finalGeom = tolerance > 0 ? `Simplify(${bufferGeom}, ${tolerance})` : bufferGeom;
+            const finalGeom = tolerance > 0 ? `Simplify(${bufferGeom}, ${String(tolerance)})` : bufferGeom;
             query = `SELECT AsText(${finalGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid, input.distance);
             break;
           }
-          case "intersection":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for intersection",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(Intersection(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          case "intersection": {
+            const intersectionGeom = `Intersection(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${intersectionGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "union":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for union",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(GUnion(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          }
+          case "union": {
+            const unionGeom = `GUnion(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${unionGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "difference":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for difference",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(Difference(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          }
+          case "difference": {
+            const differenceGeom = `Difference(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${differenceGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "centroid":
-            query = `SELECT AsText(Centroid(GeomFromText('${input.geometry1}', ${input.srid}))) as result`;
+          }
+          case "centroid": {
+            const centroidGeom = `Centroid(GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${centroidGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid);
             break;
-          case "envelope":
-            query = `SELECT AsText(Envelope(GeomFromText('${input.geometry1}', ${input.srid}))) as result`;
+          }
+          case "envelope": {
+            const envelopeGeom = `Envelope(GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${envelopeGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid);
             break;
-          case "simplify":
-            query = `SELECT AsText(Simplify(GeomFromText('${input.geometry1}', ${input.srid}), ${input.distance})) as result`;
+          }
+          case "simplify": {
+            const simplifyGeom = `Simplify(GeomFromText(?, CAST(? AS INTEGER)), ?)`;
+            query = `SELECT AsText(${simplifyGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid, input.distance);
             break;
+          }
           default:
             query = "SELECT 1";
         }
-        const result = await adapter.executeReadQuery(query);
+        const result = await adapter.executeReadQuery(query, queryParams);
         const wktResult = result.rows?.[0]?.["result"];
         if (wktResult === null || wktResult === void 0) {
           return {
@@ -1759,7 +2362,7 @@ function createSpatialImportTool(adapter) {
     inputSchema: SpatialImportSchema,
     outputSchema: SpatialiteImportOutputSchema,
     requiredScopes: ["write"],
-    annotations: write("SpatiaLite Import"),
+    annotations: writeFs("SpatiaLite Import"),
     handler: async (params, _context) => {
       try {
         const input = SpatialImportSchema.parse(params);
@@ -1773,7 +2376,9 @@ function createSpatialImportTool(adapter) {
             recoverable: false
           };
         }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -1786,10 +2391,23 @@ function createSpatialImportTool(adapter) {
         if (input.format === "geojson") {
           try {
             JSON.parse(input.data);
+            const geojsonCheck = await adapter.executeReadQuery(
+              `SELECT ST_IsValid(GeomFromGeoJSON(?)) as valid`,
+              [input.data]
+            );
+            const isValid2 = geojsonCheck.rows?.[0]?.["valid"];
+            if (isValid2 !== 1) {
+              return {
+                success: false,
+                error: `Invalid GeoJSON geometry: could not be parsed by SpatiaLite (must be a valid Geometry object)`,
+                code: "VALIDATION_ERROR",
+                category: "validation",
+                recoverable: false
+              };
+            }
             const columns2 = ["geom"];
-            const values2 = [
-              `SetSRID(GeomFromGeoJSON('${input.data}'), ${input.srid})`
-            ];
+            const placeholders2 = [`SetSRID(GeomFromGeoJSON(?), ?)`];
+            const insertParams2 = [input.data, input.srid];
             if (input.additionalData) {
               for (const [key, value] of Object.entries(input.additionalData)) {
                 if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
@@ -1801,14 +2419,16 @@ function createSpatialImportTool(adapter) {
                     recoverable: false
                   };
                 }
-                columns2.push(`"${key}"`);
-                values2.push(
-                  typeof value === "string" ? `'${value.replace(/'/g, "''")}'` : String(value)
-                );
+                columns2.push(sanitizeIdentifier(key));
+                placeholders2.push("?");
+                insertParams2.push(value);
               }
             }
-            const sql2 = `INSERT INTO "${input.tableName}" (${columns2.join(", ")}) VALUES (${values2.join(", ")})`;
-            const insertResult2 = await adapter.executeWriteQuery(sql2);
+            const sql2 = `INSERT INTO ${sanitizeIdentifier(input.tableName)} (${columns2.join(", ")}) VALUES (${placeholders2.join(", ")})`;
+            const insertResult2 = await adapter.executeWriteQuery(
+              sql2,
+              insertParams2
+            );
             return {
               success: true,
               message: "GeoJSON geometry imported",
@@ -1827,10 +2447,11 @@ function createSpatialImportTool(adapter) {
           wkt = input.data;
         }
         const wktCheck = await adapter.executeReadQuery(
-          `SELECT GeomFromText('${wkt}', ${input.srid}) as geom`
+          `SELECT ST_IsValid(GeomFromText(?, CAST(? AS INTEGER))) as valid`,
+          [wkt, input.srid]
         );
-        const parsedGeom = wktCheck.rows?.[0]?.["geom"];
-        if (parsedGeom === null || parsedGeom === void 0) {
+        const isValid = wktCheck.rows?.[0]?.["valid"];
+        if (isValid !== 1) {
           return {
             success: false,
             error: `Invalid WKT geometry: '${wkt}' could not be parsed`,
@@ -1840,7 +2461,8 @@ function createSpatialImportTool(adapter) {
           };
         }
         const columns = ["geom"];
-        const values = [`GeomFromText('${wkt}', ${input.srid})`];
+        const placeholders = [`GeomFromText(?, CAST(? AS INTEGER))`];
+        const insertParams = [wkt, input.srid];
         if (input.additionalData) {
           for (const [key, value] of Object.entries(input.additionalData)) {
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
@@ -1852,14 +2474,13 @@ function createSpatialImportTool(adapter) {
                 recoverable: false
               };
             }
-            columns.push(`"${key}"`);
-            values.push(
-              typeof value === "string" ? `'${value.replace(/'/g, "''")}'` : String(value)
-            );
+            columns.push(sanitizeIdentifier(key));
+            placeholders.push("?");
+            insertParams.push(value);
           }
         }
-        const sql = `INSERT INTO "${input.tableName}" (${columns.join(", ")}) VALUES (${values.join(", ")})`;
-        const insertResult = await adapter.executeWriteQuery(sql);
+        const sql = `INSERT INTO ${sanitizeIdentifier(input.tableName)} (${columns.join(", ")}) VALUES (${placeholders.join(", ")})`;
+        const insertResult = await adapter.executeWriteQuery(sql, insertParams);
         return {
           success: true,
           message: "WKT geometry imported",
@@ -1920,16 +2541,16 @@ function getNativeToolDefinitions(adapter) {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 10; i++) {
-    if (fs.existsSync(path.join(dir, "package.json"))) return dir;
-    const parent = path.dirname(dir);
+    if (fs.existsSync(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return startDir;
 }
 var __moduleFilename = fileURLToPath(import.meta.url);
-var PROJECT_ROOT = findProjectRoot(path.dirname(__moduleFilename));
-var EXTENSIONS_DIR = path.join(PROJECT_ROOT, "extensions");
+var PROJECT_ROOT = findProjectRoot(path2.dirname(__moduleFilename));
+var EXTENSIONS_DIR = path2.join(PROJECT_ROOT, "extensions");
 function tryLoadExtension(db, name, envVar, candidates, log2) {
   for (const extPath of candidates) {
     try {
@@ -1949,12 +2570,12 @@ function loadSpatialite(db, log2) {
   const spatialitePaths = [
     process.env["SPATIALITE_PATH"],
     // Absolute paths to local extensions
-    path.join(
+    path2.join(
       EXTENSIONS_DIR,
       "mod_spatialite-5.1.0-win-amd64",
       "mod_spatialite"
     ),
-    path.join(
+    path2.join(
       EXTENSIONS_DIR,
       "mod_spatialite-5.1.0-win-amd64",
       "mod_spatialite.dll"
@@ -1968,7 +2589,7 @@ function loadSpatialite(db, log2) {
   ].filter((p) => Boolean(p));
   const envSpatialitePath = process.env["SPATIALITE_PATH"];
   if (envSpatialitePath && process.platform === "win32") {
-    const spatialiteExtDir = path.dirname(envSpatialitePath);
+    const spatialiteExtDir = path2.dirname(envSpatialitePath);
     const currentPath = process.env["PATH"] ?? "";
     if (!currentPath.includes(spatialiteExtDir)) {
       process.env["PATH"] = spatialiteExtDir + ";" + currentPath;
@@ -1980,8 +2601,8 @@ function loadCsvExtension(db, log2) {
   const csvPaths = [
     process.env["CSV_EXTENSION_PATH"],
     // sqlite-xsv extension with absolute paths
-    path.join(EXTENSIONS_DIR, "xsv0.dll"),
-    path.join(EXTENSIONS_DIR, "xsv0"),
+    path2.join(EXTENSIONS_DIR, "xsv0.dll"),
+    path2.join(EXTENSIONS_DIR, "xsv0"),
     // System paths
     "xsv0",
     "xsv0.dll",
@@ -2043,18 +2664,7 @@ function nativeExecuteRead(db, sql, params, log2) {
       executionTimeMs: Date.now() - start
     });
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    log2.error(`Query failed: ${message}`, {
-      code: ERROR_CODES.DB.QUERY_FAILED.full
-    });
-    throw new QueryError(
-      `Query execution failed: ${message}`,
-      "DB_QUERY_FAILED",
-      {
-        sql,
-        cause: error instanceof Error ? error : void 0
-      }
-    );
+    translateSqliteError(error, sql, "Query execution", log2);
   }
 }
 function nativeExecuteWrite(db, sql, params, log2) {
@@ -2062,21 +2672,27 @@ function nativeExecuteWrite(db, sql, params, log2) {
   try {
     const stmt = db.prepare(sql);
     const normalizedParams = normalizeSqliteParams(params);
+    if (stmt.reader) {
+      const rows = normalizedParams ? stmt.all(...normalizedParams) : stmt.all();
+      return Promise.resolve({
+        rows,
+        rowsAffected: rows.length,
+        // .all() does not return changes, but we know it's rows.length for RETURNING
+        executionTimeMs: Date.now() - start
+      });
+    }
     const info = normalizedParams ? stmt.run(...normalizedParams) : stmt.run();
-    return Promise.resolve({
+    const result = {
       rows: [],
       rowsAffected: info.changes,
       executionTimeMs: Date.now() - start
-    });
+    };
+    if (info.lastInsertRowid !== void 0) {
+      result.lastInsertId = Number(info.lastInsertRowid);
+    }
+    return Promise.resolve(result);
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    log2.error(`Write query failed: ${message}`, {
-      code: ERROR_CODES.DB.QUERY_FAILED.full
-    });
-    throw new QueryError(`Write query failed: ${message}`, "DB_WRITE_FAILED", {
-      sql,
-      cause: error instanceof Error ? error : void 0
-    });
+    translateSqliteError(error, sql, "Write query", log2);
   }
 }
 
@@ -2099,7 +2715,8 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   getConfiguredPath() {
     const config = this.config;
-    return config?.filePath ?? config?.connectionString ?? ":memory:";
+    const path3 = config?.filePath ?? config?.connectionString ?? ":memory:";
+    return path3;
   }
   db = null;
   schemaManager = null;
@@ -2137,6 +2754,17 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
         const versionResult = db.prepare("SELECT sqlite_version()").get();
         return versionResult?.["sqlite_version()"] ?? "0.0.0";
       }, log);
+      if (sqliteConfig.initializationSql && Array.isArray(sqliteConfig.initializationSql)) {
+        for (const sql of sqliteConfig.initializationSql) {
+          db.exec(sql);
+        }
+        log.info(
+          `Executed ${sqliteConfig.initializationSql.length} initialization SQL statements`,
+          {
+            code: "SQLITE_INIT_SQL"
+          }
+        );
+      }
       this.schemaManager = new SchemaManager(this);
       this.connected = true;
     } catch (error) {
@@ -2230,6 +2858,7 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeReadQuery(sql, params) {
     this.ensureConnected();
+    this.validateQuery(sql, true);
     return nativeExecuteRead(this.ensureDb(), sql, params, log);
   }
   /**
@@ -2237,6 +2866,7 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeWriteQuery(sql, params) {
     this.ensureConnected();
+    this.validateQuery(sql, false);
     const result = nativeExecuteWrite(this.ensureDb(), sql, params, log);
     if (isDDL(sql)) {
       this.clearSchemaCache();
@@ -2248,11 +2878,26 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeQuery(sql, params) {
     const trimmed = sql.trim().toUpperCase();
-    if (trimmed.startsWith("SELECT") || trimmed.startsWith("PRAGMA") || trimmed.startsWith("EXPLAIN")) {
+    if (trimmed.startsWith("PRAGMA")) {
+      if (sql.includes("=") || sql.includes("(")) {
+        return this.executeWriteQuery(sql, params);
+      }
+      return this.executeReadQuery(sql, params);
+    }
+    if (trimmed.startsWith("SELECT") || trimmed.startsWith("EXPLAIN")) {
       return this.executeReadQuery(sql, params);
     }
     return this.executeWriteQuery(sql, params);
   }
+  /**
+   * Execute a SQL script containing multiple statements
+   */
+  executeScript(sql) {
+    this.ensureConnected();
+    this.ensureDb().exec(sql);
+    this.clearSchemaCache();
+    return Promise.resolve();
+  }
   /**
    * Get schema information (cached via SchemaManager)
    */
@@ -2328,6 +2973,23 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
   listSchemas() {
     return Promise.resolve(["main"]);
   }
+  /**
+   * Get indexes, optionally for a specific table (cached via SchemaManager)
+   */
+  async getIndexes(table) {
+    this.ensureConnected();
+    if (this.schemaManager) {
+      if (table) {
+        return this.schemaManager.getTableIndexes(table);
+      }
+      return this.schemaManager.getAllIndexes();
+    }
+    const all = await this.getAllIndexes();
+    if (table) {
+      return all.filter((i) => i.tableName === table);
+    }
+    return all;
+  }
   /**
    * Get all indexes in the database (cached via SchemaManager)
    * Required by sqlite_indexes resource
@@ -2393,7 +3055,8 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
       "admin",
       "geo",
       "introspection",
-      "migration"
+      "migration",
+      "transactions"
     ];
   }
   /**
@@ -2452,7 +3115,11 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    * Execute raw SQL and return results (for tools)
    */
   rawQuery(sql, params) {
-    return this.executeQuery(sql, params);
+    const trimmed = sql.trim().toUpperCase();
+    if (trimmed.startsWith("SELECT") || trimmed.startsWith("EXPLAIN") || trimmed.startsWith("PRAGMA") && !sql.includes("=") && !sql.includes("(")) {
+      return nativeExecuteRead(this.ensureDb(), sql, params, log);
+    }
+    return nativeExecuteWrite(this.ensureDb(), sql, params, log);
   }
   /**
    * Begin a transaction