db-mcp 2.0.0 → 3.0.1

package/dist/{sqlite-native-JXMCFQBA.js → sqlite-native-IF75BB3O.js}

@@ -1,14 +1,13 @@
-import { ErrorResponseFields, RowRecordSchema, validateWhereClause, resolveAliases, autoEnableWal, detectAndSetJsonbSupport, SchemaManager, applyCommonPragmas, isDDL, getResourceDefinitions, getPromptDefinitions, normalizeSqliteParams, translateSqliteError, getCoreTools, getJsonOperationTools, getJsonHelperTools, getTextTools, getStatsTools, getVirtualTools, getVectorTools, getGeoTools, getAdminTools, getIntrospectionTools, getMigrationTools, getCodeModeTools, sanitizeIdentifier, validateTableExists, FtsHeadlineSchema } from './chunk-5Y42NPBP.js';
-import { DatabaseAdapter } from './chunk-Z7C2TM4L.js';
-import { write, readOnly, VERSION, admin, getToolGroupIcon, idempotent } from './chunk-VIDSICEL.js';
-import './chunk-OKOVZ5QE.js';
-import { formatHandlerError, ValidationError, ConfigurationError, ConnectionError, ResourceNotFoundError, ExtensionNotAvailableError } from './chunk-X3MUUOWM.js';
-import { logger, ERROR_CODES, DbMcpError } from './chunk-645ZEFLA.js';
+import { RowRecordSchema, WhereConditionSchema, sanitizeIdentifier, buildWhereClause, resolveAliases, autoEnableWal, detectAndSetJsonbSupport, SchemaManager, applyCommonPragmas, isDDL, getResourceDefinitions, getPromptDefinitions, validateIdentifier, normalizeSqliteParams, translateSqliteError, getCoreTools, getJsonOperationTools, getJsonHelperTools, getTextTools, getStatsTools, getVirtualTools, getVectorTools, getGeoTools, getAdminTools, getIntrospectionTools, getMigrationTools, getCodeModeTools, validateTableExists, FtsHeadlineSchema } from './chunk-NV34JSQM.js';
+import { DatabaseAdapter } from './chunk-W5WQVNVX.js';
+import { ErrorResponseFields, write, readOnly, VERSION, admin, writeFs, getToolGroupIcon, idempotent } from './chunk-E5IESRTK.js';
+import { logger, formatHandlerError, ValidationError, ConfigurationError, ERROR_CODES, ConnectionError, DbMcpError, ResourceNotFoundError, ExtensionNotAvailableError } from './chunk-L552U3QS.js';
 import Database from 'better-sqlite3';
 import { z } from 'zod';
-import path from 'path';
-import fs from 'fs';
+import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
+import path2 from 'path';
+import fs from 'fs';
 
 var FtsCreateOutputSchema = z.object({
   success: z.boolean(),
@@ -58,11 +57,15 @@ var FtsSearchSchema = z.object({
   table: z.string().describe("FTS table name"),
   query: z.string().describe("Full-text search query"),
   columns: z.array(z.string()).optional().describe("Specific columns to search"),
-  limit: z.preprocess(
-    (val) => typeof val === "string" ? isNaN(Number(val)) ? void 0 : Number(val) : val,
-    z.number().optional().default(100)
-  ),
-  highlight: z.boolean().optional().default(false).describe("Include highlighted snippets")
+  limit: z.preprocess((val) => {
+    if (typeof val === "string") {
+      const parsed = Number(val);
+      return isNaN(parsed) ? val : parsed;
+    }
+    return val;
+  }, z.number().optional().default(100)),
+  highlight: z.boolean().optional().default(false).describe("Include highlighted snippets"),
+  includeRowData: z.boolean().optional().default(true).describe("Include full row data in results")
 });
 var FtsRebuildSchema = z.object({
   table: z.string().describe("FTS table name to rebuild")
@@ -73,7 +76,8 @@ var FtsMatchInfoSchema = z.object({
   format: z.preprocess(
     coerceEnumValues(["bm25", "rank"]),
     z.enum(["bm25", "rank"]).optional().default("bm25")
-  )
+  ),
+  includeRowData: z.boolean().optional().default(true).describe("Include full row data in results")
 });
 
 // src/adapters/sqlite/tools/fts.ts
@@ -181,7 +185,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"(rowid, ${colList}) VALUES (NEW.rowid, ${newColList});
     END;
   `;
-  await adapter.executeQuery(insertTrigger);
+  await adapter.rawQuery(insertTrigger, void 0);
   triggersCreated.push(insertTriggerName);
   const deleteTriggerName = `${ftsTable}_ad`;
   const deleteTrigger = `
@@ -189,7 +193,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"("${ftsTable}", rowid, ${colList}) VALUES('delete', OLD.rowid, ${oldColList});
     END;
   `;
-  await adapter.executeQuery(deleteTrigger);
+  await adapter.rawQuery(deleteTrigger, void 0);
   triggersCreated.push(deleteTriggerName);
   const updateTriggerName = `${ftsTable}_au`;
   const updateTrigger = `
@@ -198,7 +202,7 @@ async function createSyncTriggers(adapter, ftsTable, contentTable, columns) {
       INSERT INTO "${ftsTable}"(rowid, ${colList}) VALUES (NEW.rowid, ${newColList});
     END;
   `;
-  await adapter.executeQuery(updateTrigger);
+  await adapter.rawQuery(updateTrigger, void 0);
   triggersCreated.push(updateTriggerName);
   return triggersCreated;
 }
@@ -214,18 +218,19 @@ function createFtsSearchTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsSearchSchema.parse(params);
+        const queryParams = [];
         if (!isFts5Available(adapter)) {
           return buildFts5SearchUnavailableError();
         }
         sanitizeIdentifier(input.table);
         await validateTableExists(adapter, input.table);
-        let selectClause = "*";
+        let selectClause = input.includeRowData ? "*" : "rowid";
         if (input.highlight) {
-          selectClause = `*, highlight("${input.table}", 0, '<b>', '</b>') as snippet`;
+          selectClause += `, highlight("${input.table}", 0, '<b>', '</b>') as snippet`;
         }
         if (input.query === "*" || input.query.trim() === "") {
           const sql2 = `SELECT ${selectClause}, NULL as rank FROM "${input.table}" ORDER BY rowid LIMIT ${input.limit}`;
-          const result2 = await adapter.executeReadQuery(sql2);
+          const result2 = await adapter.executeReadQuery(sql2, queryParams);
           return {
             success: true,
             rowCount: result2.rows?.length ?? 0,
@@ -242,7 +247,7 @@ function createFtsSearchTool(adapter) {
           matchExpr = `"${input.table}" MATCH '${colFilter}'`;
         }
         const sql = `SELECT ${selectClause}, rank FROM "${input.table}" WHERE ${matchExpr} ORDER BY rank LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -304,6 +309,7 @@ function createFtsMatchInfoTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsMatchInfoSchema.parse(params);
+        const queryParams = [];
         if (!isFts5Available(adapter)) {
           return buildFts5SearchUnavailableError();
         }
@@ -316,8 +322,9 @@ function createFtsMatchInfoTool(adapter) {
         } else {
           rankExpr = "rank";
         }
-        const sql = `SELECT *, ${rankExpr} as score FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY score`;
-        const result = await adapter.executeReadQuery(sql);
+        const selectCols = input.includeRowData ? "*" : "rowid";
+        const sql = `SELECT ${selectCols}, ${rankExpr} as score FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY score`;
+        const result = await adapter.executeReadQuery(sql, queryParams);
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -344,6 +351,7 @@ function createFtsHeadlineTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = FtsHeadlineSchema.parse(params);
+        const queryParams = [];
         if (!isFts5Available(adapter)) {
           return buildFts5SearchUnavailableError();
         }
@@ -353,7 +361,8 @@ function createFtsHeadlineTool(adapter) {
         let columnIndex = 0;
         if (input.column) {
           const colResult = await adapter.executeReadQuery(
-            `PRAGMA table_info("${input.table}")`
+            `PRAGMA table_info("${input.table}")`,
+            queryParams
           );
           const colRows = colResult.rows ?? [];
           const found = colRows.findIndex(
@@ -369,7 +378,7 @@ function createFtsHeadlineTool(adapter) {
         const snippetExpr = `snippet("${input.table}", ${String(columnIndex)}, '${startSel}', '${stopSel}', '...', ${String(input.snippetWords)})`;
         if (input.query === "*" || input.query.trim() === "") {
           const sql2 = `SELECT *, NULL as headline, NULL as snippet, NULL as rank FROM "${input.table}" ORDER BY rowid LIMIT ${String(input.limit)}`;
-          const result2 = await adapter.executeReadQuery(sql2);
+          const result2 = await adapter.executeReadQuery(sql2, queryParams);
           return {
             success: true,
             rowCount: result2.rows?.length ?? 0,
@@ -377,7 +386,7 @@ function createFtsHeadlineTool(adapter) {
           };
         }
         const sql = `SELECT ${highlightExpr} as headline, ${snippetExpr} as snippet, rank FROM "${input.table}" WHERE "${input.table}" MATCH '${queryEscaped}' ORDER BY rank LIMIT ${String(input.limit)}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -549,17 +558,9 @@ var SpatialiteImportOutputSchema = z.object({
 }).extend(ErrorResponseFields.shape);
 
 // src/adapters/sqlite-native/tools/transactions.ts
-var VALID_MODES = ["deferred", "immediate", "exclusive"];
 var BeginTransactionSchema = z.object({
-  mode: z.preprocess(
-    (val) => {
-      if (typeof val !== "string") return void 0;
-      const normalized = val.toLowerCase();
-      return VALID_MODES.includes(normalized) ? normalized : void 0;
-    },
-    z.enum(["deferred", "immediate", "exclusive"]).optional().default("deferred").describe(
-      "Transaction mode: deferred waits for first write, immediate acquires lock immediately, exclusive blocks all access"
-    )
+  mode: z.enum(["deferred", "immediate", "exclusive"]).optional().default("deferred").describe(
+    "Transaction mode: deferred waits for first write, immediate acquires lock immediately, exclusive blocks all access"
   )
 });
 var SavepointSchema = z.object({
@@ -784,6 +785,7 @@ function createExecuteInTransactionTool(adapter) {
     annotations: write("Execute in Transaction"),
     requiredScopes: ["write"],
     handler: async (params, _context) => {
+      const queryParams = [];
       let input;
       try {
         input = ExecuteInTransactionSchema.parse(params);
@@ -813,18 +815,29 @@ function createExecuteInTransactionTool(adapter) {
           try {
             const isSelect = statement.trim().toUpperCase().startsWith("SELECT");
             if (isSelect) {
-              const result = await adapter.executeReadQuery(statement);
+              const result = await adapter.executeReadQuery(
+                statement,
+                queryParams
+              );
               const rowCount = result.rows?.length ?? 0;
               const statementResult = {
                 statement: statement.substring(0, 100) + (statement.length > 100 ? "..." : ""),
                 rowCount
               };
               if (result.rows) {
-                statementResult.rows = result.rows;
+                if (result.rows.length > 50) {
+                  statementResult.rows = result.rows.slice(0, 50);
+                  statementResult.error = "Result truncated to 50 rows. Use sqlite_read_query with LIMIT for larger datasets.";
+                } else {
+                  statementResult.rows = result.rows;
+                }
               }
               results.push(statementResult);
             } else {
-              const result = await adapter.executeWriteQuery(statement);
+              const result = await adapter.executeWriteQuery(
+                statement,
+                queryParams
+              );
               results.push({
                 statement: statement.substring(0, 100) + (statement.length > 100 ? "..." : ""),
                 rowsAffected: result.rowsAffected ?? 0
@@ -888,8 +901,9 @@ function createExecuteInTransactionTool(adapter) {
 }
 var coerceNumber = (val) => {
   if (typeof val === "string") {
+    if (val.trim() === "") return void 0;
     const num = Number(val);
-    return isNaN(num) ? void 0 : num;
+    return isNaN(num) ? val : num;
   }
   return val;
 };
@@ -900,7 +914,7 @@ var RowNumberSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
@@ -915,7 +929,7 @@ var RankSchema = z.object({
     coerceEnumValues2(["rank", "dense_rank", "percent_rank"]),
     z.enum(["rank", "dense_rank", "percent_rank"]).optional().default("rank").describe("Rank function type")
   ),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
@@ -933,7 +947,7 @@ var LagLeadSchema = z.object({
   defaultValue: z.string().optional().describe("Default value if no row exists"),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
@@ -945,7 +959,7 @@ var RunningTotalSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   partitionBy: z.string().optional().describe("Reset running total for each partition"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
@@ -957,11 +971,11 @@ var MovingAverageSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   windowSize: z.preprocess(
     coerceNumber,
-    z.number().optional().describe("Number of rows in the moving window")
+    z.number().describe("Number of rows in the moving window")
   ),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
@@ -972,24 +986,18 @@ var NtileSchema = z.object({
   orderBy: z.string().describe("Column(s) to order by"),
   buckets: z.preprocess(
     coerceNumber,
-    z.number().optional().describe("Number of buckets (e.g., 4 for quartiles)")
+    z.number().describe("Number of buckets (e.g., 4 for quartiles)")
   ),
   partitionBy: z.string().optional().describe("Column(s) to partition by"),
   selectColumns: z.array(z.string()).optional().describe("Columns to include in result"),
-  whereClause: z.string().optional().describe("Optional WHERE clause"),
+  conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE clause conditions"),
   limit: z.preprocess(
     coerceNumber,
     z.number().optional().default(20).describe("Maximum rows to return")
   )
 });
 async function validateTableExists2(adapter, table) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table)) {
-    throw new DbMcpError(
-      "Invalid table name",
-      "NATIVE_WINDOW_INVALID_TABLE",
-      "validation" /* VALIDATION */
-    );
-  }
+  validateIdentifier(table);
   const result = await adapter.executeReadQuery(
     `SELECT 1 FROM sqlite_master WHERE type IN ('table', 'view') AND name='${table}'`
   );
@@ -1006,13 +1014,7 @@ async function validateTableExists2(adapter, table) {
   }
 }
 async function validateColumnInTable(adapter, table, column) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(column)) {
-    throw new DbMcpError(
-      "Invalid column name",
-      "NATIVE_WINDOW_INVALID_COLUMN",
-      "validation" /* VALIDATION */
-    );
-  }
+  validateIdentifier(column);
   const tableInfo = await adapter.executeReadQuery(
     `SELECT name FROM pragma_table_info('${table}') WHERE name='${column}'`
   );
@@ -1035,19 +1037,31 @@ async function validateOrderByColumns(adapter, table, orderBy) {
     const firstToken = tokens[0];
     if (!firstToken) continue;
     const colName = firstToken.replace(/^"|"$/g, "");
-    if (/[.()+*/]/.test(colName)) continue;
+    if (/[;()+*/]/.test(colName)) {
+      throw new DbMcpError(
+        `Invalid ORDER BY expression: '${colName}' contains disallowed characters. Only column names with optional ASC/DESC are permitted.`,
+        "NATIVE_WINDOW_INVALID_ORDERBY",
+        "validation" /* VALIDATION */
+      );
+    }
     if (/^(ASC|DESC)$/i.test(colName)) continue;
+    if (colName.includes(".")) {
+      for (const segment of colName.split(".")) {
+        validateIdentifier(segment);
+      }
+      continue;
+    }
     await validateColumnInTable(adapter, table, colName);
   }
 }
 async function resolveSelectColumns(adapter, table, selectColumns, rankCol) {
   if (selectColumns && selectColumns.length > 0) {
     return {
-      columnList: selectColumns.map((c) => `"${c}"`).join(", ")
+      columnList: selectColumns.map((c) => sanitizeIdentifier(c)).join(", ")
     };
   }
   const tableInfo = await adapter.executeReadQuery(
-    `PRAGMA table_info("${table}")`
+    `PRAGMA table_info('${table}')`
   );
   const TEXT_TYPES = /* @__PURE__ */ new Set([
     "text",
@@ -1095,14 +1109,57 @@ async function resolveSelectColumns(adapter, table, selectColumns, rankCol) {
       included.push(colName);
     }
   }
+  if (included.length > 10) {
+    throw new ValidationError(
+      `Table '${table}' has too many columns (${included.length} remaining after text filtering). You must explicitly provide 'selectColumns' to prevent context window bloat.`,
+      "INVALID_INPUT"
+    );
+  }
   if (excluded.length > 0 && included.length > 0) {
     return {
-      columnList: included.map((c) => `"${c}"`).join(", "),
+      columnList: included.map((c) => sanitizeIdentifier(c)).join(", "),
       hint: `Excluded ${excluded.length} long-content column(s) (${excluded.join(", ")}) to reduce payload. Use selectColumns to override.`
     };
   }
   return { columnList: "*" };
 }
+function sanitizePartitionBy(partitionBy) {
+  const columns = partitionBy.split(",").map((c) => c.trim()).filter(Boolean);
+  for (const col of columns) {
+    validateIdentifier(col);
+  }
+  return columns.map((c) => sanitizeIdentifier(c)).join(", ");
+}
+function sanitizeOrderByExpr(orderBy) {
+  const parts = orderBy.split(",");
+  const sanitized = [];
+  for (const part of parts) {
+    const tokens = part.trim().split(/\s+/);
+    const colToken = tokens[0];
+    if (!colToken) continue;
+    const colName = colToken.replace(/^"|"$/g, "");
+    validateIdentifier(colName);
+    const direction = tokens[1];
+    if (direction && /^(ASC|DESC)$/i.test(direction)) {
+      sanitized.push(
+        `${sanitizeIdentifier(colName)} ${direction.toUpperCase()}`
+      );
+    } else {
+      sanitized.push(sanitizeIdentifier(colName));
+    }
+  }
+  return sanitized.join(", ");
+}
+function validateDefaultValue(value) {
+  if (/^-?\d+(\.\d+)?$/.test(value)) return;
+  if (/^'[^']*'$/.test(value)) return;
+  if (/^NULL$/i.test(value)) return;
+  throw new DbMcpError(
+    `Invalid default value: '${value}'. Only numeric literals, single-quoted strings, or NULL are permitted.`,
+    "NATIVE_WINDOW_INVALID_DEFAULT",
+    "validation" /* VALIDATION */
+  );
+}
 function getWindowTools(adapter) {
   return [
     createRowNumberTool(adapter),
@@ -1123,6 +1180,7 @@ function createRowNumberTool(adapter) {
     annotations: readOnly("Window Row Number"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = RowNumberSchema.parse(params);
         await validateTableExists2(adapter, input.table);
@@ -1132,18 +1190,24 @@ function createRowNumberTool(adapter) {
           input.table,
           input.selectColumns
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ROW_NUMBER() OVER (${partition} ORDER BY ${input.orderBy}) as row_number
-                FROM "${input.table}"
+                    ROW_NUMBER() OVER (${partition} ORDER BY ${orderByExpr}) as row_number
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -1169,6 +1233,7 @@ function createRankTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = RankSchema.parse(params);
+        const queryParams = [];
         await validateTableExists2(adapter, input.table);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
         const { columnList: columns, hint } = await resolveSelectColumns(
@@ -1176,19 +1241,25 @@ function createRankTool(adapter) {
           input.table,
           input.selectColumns
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const rankFunc = input.rankType.toUpperCase();
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ${rankFunc}() OVER (${partition} ORDER BY ${input.orderBy}) as ${input.rankType}
-                FROM "${input.table}"
+                    ${rankFunc}() OVER (${partition} ORDER BY ${orderByExpr}) as ${input.rankType}
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           rankType: input.rankType,
@@ -1214,7 +1285,10 @@ function createLagLeadTool(adapter) {
     requiredScopes: ["read"],
     handler: async (params, _context) => {
       try {
-        const input = LagLeadSchema.parse(params);
+        const input = LagLeadSchema.parse(
+          resolveAliases(params, { valueColumn: "column" })
+        );
+        const queryParams = [];
         const normalizedDirection = input.direction.toLowerCase();
         if (!VALID_DIRECTIONS.includes(
           normalizedDirection
@@ -1236,20 +1310,30 @@ function createLagLeadTool(adapter) {
           input.selectColumns,
           input.column
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const func = normalizedDirection.toUpperCase();
-        const defaultVal = input.defaultValue !== void 0 ? `, ${input.defaultValue}` : "";
+        let defaultVal = "";
+        if (input.defaultValue !== void 0) {
+          validateDefaultValue(input.defaultValue);
+          defaultVal = `, ${input.defaultValue}`;
+        }
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    ${func}("${input.column}", ${input.offset}${defaultVal}) OVER (${partition} ORDER BY ${input.orderBy}) as ${normalizedDirection}_value
-                FROM "${input.table}"
+                    ${func}(${sanitizeIdentifier(input.column)}, ${input.offset}${defaultVal}) OVER (${partition} ORDER BY ${orderByExpr}) as ${normalizedDirection}_value
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           direction: normalizedDirection,
@@ -1275,6 +1359,7 @@ function createRunningTotalTool(adapter) {
     annotations: readOnly("Window Running Total"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = RunningTotalSchema.parse(
           resolveAliases(params, { valueColumn: "column" })
@@ -1288,18 +1373,24 @@ function createRunningTotalTool(adapter) {
           input.selectColumns,
           input.column
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    SUM("${input.column}") OVER (${partition} ORDER BY ${input.orderBy} ROWS UNBOUNDED PRECEDING) as running_total
-                FROM "${input.table}"
+                    SUM(${sanitizeIdentifier(input.column)}) OVER (${partition} ORDER BY ${orderByExpr} ROWS UNBOUNDED PRECEDING) as running_total
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           valueColumn: input.column,
@@ -1324,19 +1415,11 @@ function createMovingAverageTool(adapter) {
     annotations: readOnly("Window Moving Average"),
     requiredScopes: ["read"],
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = MovingAverageSchema.parse(
           resolveAliases(params, { valueColumn: "column" })
         );
-        if (input.windowSize === void 0) {
-          return {
-            success: false,
-            error: "'windowSize' is required",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          };
-        }
         await validateTableExists2(adapter, input.table);
         await validateColumnInTable(adapter, input.table, input.column);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
@@ -1346,19 +1429,25 @@ function createMovingAverageTool(adapter) {
           input.selectColumns,
           input.column
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
         const preceding = input.windowSize - 1;
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    AVG("${input.column}") OVER (${partition} ORDER BY ${input.orderBy} ROWS BETWEEN ${preceding} PRECEDING AND CURRENT ROW) as moving_avg
-                FROM "${input.table}"
+                    AVG(${sanitizeIdentifier(input.column)}) OVER (${partition} ORDER BY ${orderByExpr} ROWS BETWEEN ${preceding} PRECEDING AND CURRENT ROW) as moving_avg
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           valueColumn: input.column,
@@ -1386,15 +1475,7 @@ function createNtileTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = NtileSchema.parse(params);
-        if (input.buckets === void 0) {
-          return {
-            success: false,
-            error: "'buckets' is required",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          };
-        }
+        const queryParams = [];
         await validateTableExists2(adapter, input.table);
         await validateOrderByColumns(adapter, input.table, input.orderBy);
         const { columnList: columns, hint } = await resolveSelectColumns(
@@ -1402,18 +1483,24 @@ function createNtileTool(adapter) {
           input.table,
           input.selectColumns
         );
-        const partition = input.partitionBy ? `PARTITION BY ${input.partitionBy}` : "";
+        const partition = input.partitionBy ? `PARTITION BY ${sanitizePartitionBy(input.partitionBy)}` : "";
+        const orderByExpr = sanitizeOrderByExpr(input.orderBy);
         let sql = `
                 SELECT ${columns},
-                    NTILE(${input.buckets}) OVER (${partition} ORDER BY ${input.orderBy}) as ntile
-                FROM "${input.table}"
+                    NTILE(${input.buckets}) OVER (${partition} ORDER BY ${orderByExpr}) as ntile
+                FROM ${sanitizeIdentifier(input.table)}
             `;
-        if (input.whereClause) {
-          validateWhereClause(input.whereClause);
-          sql += ` WHERE ${input.whereClause}`;
+        if (input.conditions) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
         }
         sql += ` LIMIT ${input.limit}`;
-        const result = await adapter.executeReadQuery(sql);
+        const result = await adapter.executeReadQuery(sql, queryParams);
         const response = {
           success: true,
           buckets: input.buckets,
@@ -1428,7 +1515,14 @@ function createNtileTool(adapter) {
     }
   };
 }
-var coerceNumber2 = (val) => typeof val === "string" ? isNaN(Number(val)) ? void 0 : Number(val) : val;
+var coerceNumber2 = (val) => {
+  if (typeof val === "string") {
+    if (val.trim() === "") return void 0;
+    const num = Number(val);
+    return isNaN(num) ? val : num;
+  }
+  return val;
+};
 var coerceBoolean = (val) => typeof val === "string" ? val === "true" ? true : val === "false" ? false : void 0 : val;
 function createEnumCoercer(validValues) {
   return (val) => typeof val === "string" && validValues.includes(val) ? val : typeof val === "string" ? void 0 : val;
@@ -1459,9 +1553,20 @@ var VALID_OPERATIONS = [
   "envelope",
   "simplify"
 ];
+var VALID_COLUMN_TYPES = [
+  "TEXT",
+  "INTEGER",
+  "REAL",
+  "BLOB",
+  "NUMERIC",
+  "VARCHAR",
+  "BOOLEAN",
+  "DATE",
+  "DATETIME",
+  "TIMESTAMP"
+];
 var coerceGeometryType = createEnumCoercer(VALID_GEOMETRY_TYPES);
 var LoadSpatialiteSchema = z.object({
-  extensionPath: z.string().optional().describe("Custom path to mod_spatialite extension"),
   forceReload: z.preprocess(
     coerceBoolean,
     z.boolean().optional().default(false).describe("Force reload if already loaded")
@@ -1489,7 +1594,7 @@ var CreateSpatialTableSchema = z.object({
   additionalColumns: z.array(
     z.object({
       name: z.string(),
-      type: z.string()
+      type: z.enum(VALID_COLUMN_TYPES).optional().default("TEXT")
     })
   ).optional().default([]).describe("Additional non-spatial columns")
 });
@@ -1559,8 +1664,9 @@ var SpatialImportSchema = z.object({
   ),
   additionalData: z.record(z.string(), z.unknown()).optional().describe("Additional column values")
 });
-
-// src/adapters/sqlite-native/tools/spatialite/loader.ts
+var require2 = createRequire(import.meta.url);
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path2.dirname(__filename$1);
 var SPATIALITE_PATHS = [
   process.env["SPATIALITE_PATH"],
   "mod_spatialite",
@@ -1571,20 +1677,27 @@ var SPATIALITE_PATHS = [
   "/usr/local/lib/mod_spatialite.dylib"
 ].filter((p) => Boolean(p));
 var loadedDatabases = /* @__PURE__ */ new WeakSet();
-function tryLoadSpatialite(adapter, customPath) {
+function tryLoadSpatialite(adapter) {
   const db = adapter.getDatabase();
   if (db === null) {
     return { success: false, error: "Database not connected" };
   }
-  const paths = customPath ? [customPath, ...SPATIALITE_PATHS] : SPATIALITE_PATHS;
-  const chosenPathForEnv = customPath ?? process.env["SPATIALITE_PATH"];
+  const paths = SPATIALITE_PATHS;
+  const chosenPathForEnv = process.env["SPATIALITE_PATH"];
+  let dllCookie = null;
+  let win32Dll = null;
   if (process.platform === "win32" && chosenPathForEnv) {
     const looksLikeFsPath = chosenPathForEnv.includes("/") || chosenPathForEnv.includes("\\");
     if (looksLikeFsPath) {
       const extensionDir = chosenPathForEnv.replace(/[/\\][^/\\]+$/, "");
-      const currentPath = process.env["PATH"] ?? "";
-      if (!currentPath.includes(extensionDir)) {
-        process.env["PATH"] = extensionDir + ";" + currentPath;
+      try {
+        const addonPath = path2.resolve(
+          __dirname$1,
+          "../../../../../build/Release/win32_dll.node"
+        );
+        win32Dll = require2(addonPath);
+        dllCookie = win32Dll.addDllDirectory(extensionDir);
+      } catch {
       }
     }
   }
@@ -1593,10 +1706,16 @@ function tryLoadSpatialite(adapter, customPath) {
       db.loadExtension(candidatePath);
       db.exec("SELECT InitSpatialMetaData(1)");
       loadedDatabases.add(db);
+      if (win32Dll !== null && dllCookie !== null) {
+        win32Dll.removeDllDirectory(dllCookie);
+      }
       return { success: true, path: candidatePath };
     } catch {
     }
   }
+  if (win32Dll !== null && dllCookie !== null) {
+    win32Dll.removeDllDirectory(dllCookie);
+  }
   return {
     success: false,
     error: "SpatiaLite extension not found. Install mod_spatialite and set SPATIALITE_PATH environment variable."
@@ -1646,7 +1765,7 @@ function createLoadSpatialiteTool(adapter) {
             alreadyLoaded: true
           });
         }
-        const result = tryLoadSpatialite(adapter, input.extensionPath);
+        const result = tryLoadSpatialite(adapter);
         if (result.success) {
           return Promise.resolve({
             success: true,
@@ -1681,7 +1800,9 @@ function createSpatialTableTool(adapter) {
       try {
         const input = CreateSpatialTableSchema.parse(params);
         ensureSpatialite(adapter);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -1690,8 +1811,20 @@ function createSpatialTableTool(adapter) {
             recoverable: false
           };
         }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
+          return {
+            success: false,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
+            code: "VALIDATION_ERROR",
+            category: "validation",
+            recoverable: false
+          };
+        }
         const existsCheck = await adapter.executeReadQuery(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name='${input.tableName}'`
+          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
+          [input.tableName]
         );
         const alreadyExists = existsCheck.rows != null && existsCheck.rows.length > 0;
         if (alreadyExists) {
@@ -1704,7 +1837,9 @@ function createSpatialTableTool(adapter) {
         }
         const columns = ["id INTEGER PRIMARY KEY AUTOINCREMENT"];
         for (const col of input.additionalColumns) {
-          if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(col.name)) {
+          try {
+            validateIdentifier(col.name);
+          } catch {
             return {
               success: false,
               error: `Invalid column name: '${col.name}'`,
@@ -1713,10 +1848,10 @@ function createSpatialTableTool(adapter) {
               recoverable: false
             };
           }
-          columns.push(`"${col.name}" ${col.type}`);
+          columns.push(`${sanitizeIdentifier(col.name)} ${col.type}`);
         }
         await adapter.executeWriteQuery(
-          `CREATE TABLE "${input.tableName}" (${columns.join(", ")})`
+          `CREATE TABLE ${sanitizeIdentifier(input.tableName)} (${columns.join(", ")})`
         );
         const addResult = await adapter.executeReadQuery(
           `SELECT AddGeometryColumn('${input.tableName}', '${input.geometryColumn}', ${input.srid}, '${input.geometryType}', 'XY')`
@@ -1795,7 +1930,9 @@ function createSpatialIndexTool(adapter) {
       try {
         const input = SpatialIndexSchema.parse(params);
         ensureSpatialite(adapter);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -1813,8 +1950,20 @@ function createSpatialIndexTool(adapter) {
             recoverable: false
           };
         }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
+          return {
+            success: false,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
+            code: "VALIDATION_ERROR",
+            category: "validation",
+            recoverable: false
+          };
+        }
         const tableCheck = await adapter.executeReadQuery(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name='${input.tableName}'`
+          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
+          [input.tableName]
         );
         if (!tableCheck.rows || tableCheck.rows.length === 0) {
           return {
@@ -1956,6 +2105,7 @@ function createSpatialAnalysisTool(adapter) {
     requiredScopes: ["read"],
     annotations: readOnly("SpatiaLite Analyze"),
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = SpatialAnalysisSchema.parse(params);
         ensureSpatialite(adapter);
@@ -1970,7 +2120,9 @@ function createSpatialAnalysisTool(adapter) {
             recoverable: false
           };
         }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.sourceTable)) {
+        try {
+          validateIdentifier(input.sourceTable);
+        } catch {
           return {
             success: false,
             error: `Invalid source table name: '${input.sourceTable}'`,
@@ -1979,10 +2131,25 @@ function createSpatialAnalysisTool(adapter) {
             recoverable: false
           };
         }
-        if (input.targetTable && !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.targetTable)) {
+        if (input.targetTable) {
+          try {
+            validateIdentifier(input.targetTable);
+          } catch {
+            return {
+              success: false,
+              error: `Invalid target table name: '${input.targetTable}'`,
+              code: "VALIDATION_ERROR",
+              category: "validation",
+              recoverable: false
+            };
+          }
+        }
+        try {
+          validateIdentifier(input.geometryColumn);
+        } catch {
           return {
             success: false,
-            error: `Invalid target table name: '${input.targetTable}'`,
+            error: `Invalid geometry column name: '${input.geometryColumn}'`,
             code: "VALIDATION_ERROR",
             category: "validation",
             recoverable: false
@@ -1990,15 +2157,18 @@ function createSpatialAnalysisTool(adapter) {
         }
         let query;
         switch (input.analysisType) {
-          case "spatial_extent":
+          case "spatial_extent": {
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
             query = `SELECT
-              MbrMinX(Extent("${input.geometryColumn}")) as min_x,
-              MbrMinY(Extent("${input.geometryColumn}")) as min_y,
-              MbrMaxX(Extent("${input.geometryColumn}")) as max_x,
-              MbrMaxY(Extent("${input.geometryColumn}")) as max_y,
+              MbrMinX(Extent(${geomCol})) as min_x,
+              MbrMinY(Extent(${geomCol})) as min_y,
+              MbrMaxX(Extent(${geomCol})) as max_x,
+              MbrMaxY(Extent(${geomCol})) as max_y,
               COUNT(*) as feature_count
-            FROM "${input.sourceTable}"`;
+            FROM ${srcTable}`;
             break;
+          }
           case "nearest_neighbor": {
             if (!input.targetTable) {
               return {
@@ -2009,13 +2179,16 @@ function createSpatialAnalysisTool(adapter) {
                 recoverable: false
               };
             }
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const tgtTable = sanitizeIdentifier(input.targetTable);
             const sameTable = input.sourceTable === input.targetTable;
             const selfFilter = sameTable && input.excludeSelf ? "WHERE s.id != t.id" : "";
-            const geomColumns = input.includeGeometry ? `, AsText(s."${input.geometryColumn}") as source_geom, AsText(t."${input.geometryColumn}") as target_geom` : "";
+            const geomColumns = input.includeGeometry ? `, AsText(s.${geomCol}) as source_geom, AsText(t.${geomCol}) as target_geom` : "";
             query = `SELECT
               s.id as source_id, t.id as target_id,
-              ST_Distance(s."${input.geometryColumn}", t."${input.geometryColumn}") as distance${geomColumns}
-            FROM "${input.sourceTable}" s, "${input.targetTable}" t
+              ST_Distance(s.${geomCol}, t.${geomCol}) as distance${geomColumns}
+            FROM ${srcTable} s, ${tgtTable} t
             ${selfFilter}
             ORDER BY distance LIMIT ${input.limit}`;
             break;
@@ -2030,11 +2203,14 @@ function createSpatialAnalysisTool(adapter) {
                 recoverable: false
               };
             }
-            const geomCols = input.includeGeometry ? `, AsText(s."${input.geometryColumn}") as source_geom, AsText(t."${input.geometryColumn}") as target_geom` : "";
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const tgtTable = sanitizeIdentifier(input.targetTable);
+            const geomCols = input.includeGeometry ? `, AsText(s.${geomCol}) as source_geom, AsText(t.${geomCol}) as target_geom` : "";
             query = `SELECT
               s.id as source_id, t.id as target_id${geomCols}
-            FROM "${input.sourceTable}" s, "${input.targetTable}" t
-            WHERE ST_Within(s."${input.geometryColumn}", t."${input.geometryColumn}")
+            FROM ${srcTable} s, ${tgtTable} t
+            WHERE ST_Within(s.${geomCol}, t.${geomCol})
             LIMIT ${input.limit}`;
             break;
           }
@@ -2042,9 +2218,12 @@ function createSpatialAnalysisTool(adapter) {
             const dmTarget = input.targetTable ?? input.sourceTable;
             const dmSameTable = dmTarget === input.sourceTable;
             const dmFilter = dmSameTable ? "WHERE a.id < b.id" : "";
+            const geomCol = sanitizeIdentifier(input.geometryColumn);
+            const srcTable = sanitizeIdentifier(input.sourceTable);
+            const dmTgtTable = sanitizeIdentifier(dmTarget);
             query = `SELECT a.id as id1, b.id as id2,
-              ST_Distance(a."${input.geometryColumn}", b."${input.geometryColumn}") as distance
-            FROM "${input.sourceTable}" a, "${dmTarget}" b
+              ST_Distance(a.${geomCol}, b.${geomCol}) as distance
+            FROM ${srcTable} a, ${dmTgtTable} b
             ${dmFilter}
             ORDER BY distance LIMIT ${input.limit}`;
             break;
@@ -2052,7 +2231,7 @@ function createSpatialAnalysisTool(adapter) {
           default:
             query = "SELECT 1";
         }
-        const result = await adapter.executeReadQuery(query);
+        const result = await adapter.executeReadQuery(query, queryParams);
         return {
           success: true,
           analysisType: input.analysisType,
@@ -2075,6 +2254,7 @@ function createGeometryTransformTool(adapter) {
     requiredScopes: ["read"],
     annotations: readOnly("SpatiaLite Transform"),
     handler: async (params, _context) => {
+      const queryParams = [];
       try {
         const input = GeometryTransformSchema.parse(params);
         ensureSpatialite(adapter);
@@ -2090,71 +2270,69 @@ function createGeometryTransformTool(adapter) {
         let query;
         switch (input.operation) {
           case "buffer": {
-            const bufferGeom = `Buffer(GeomFromText('${input.geometry1}', ${input.srid}), ${input.distance})`;
+            const bufferGeom = `Buffer(GeomFromText(?, CAST(? AS INTEGER)), ?)`;
             const defaultTolerance = Math.max(1e-4, input.distance * 0.01);
             const tolerance = input.simplifyTolerance ?? defaultTolerance;
-            const finalGeom = tolerance > 0 ? `Simplify(${bufferGeom}, ${tolerance})` : bufferGeom;
+            const finalGeom = tolerance > 0 ? `Simplify(${bufferGeom}, ${String(tolerance)})` : bufferGeom;
             query = `SELECT AsText(${finalGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid, input.distance);
             break;
           }
-          case "intersection":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for intersection",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(Intersection(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          case "intersection": {
+            const intersectionGeom = `Intersection(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${intersectionGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "union":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for union",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(GUnion(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          }
+          case "union": {
+            const unionGeom = `GUnion(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${unionGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "difference":
-            if (!input.geometry2) {
-              return {
-                success: false,
-                error: "Second geometry required for difference",
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                recoverable: false
-              };
-            }
-            query = `SELECT AsText(Difference(
-              GeomFromText('${input.geometry1}', ${input.srid}),
-              GeomFromText('${input.geometry2}', ${input.srid})
-            )) as result`;
+          }
+          case "difference": {
+            const differenceGeom = `Difference(GeomFromText(?, CAST(? AS INTEGER)), GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${differenceGeom}) as result`;
+            queryParams.push(
+              input.geometry1,
+              input.srid,
+              input.geometry2,
+              input.srid
+            );
             break;
-          case "centroid":
-            query = `SELECT AsText(Centroid(GeomFromText('${input.geometry1}', ${input.srid}))) as result`;
+          }
+          case "centroid": {
+            const centroidGeom = `Centroid(GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${centroidGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid);
             break;
-          case "envelope":
-            query = `SELECT AsText(Envelope(GeomFromText('${input.geometry1}', ${input.srid}))) as result`;
+          }
+          case "envelope": {
+            const envelopeGeom = `Envelope(GeomFromText(?, CAST(? AS INTEGER)))`;
+            query = `SELECT AsText(${envelopeGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid);
             break;
-          case "simplify":
-            query = `SELECT AsText(Simplify(GeomFromText('${input.geometry1}', ${input.srid}), ${input.distance})) as result`;
+          }
+          case "simplify": {
+            const simplifyGeom = `Simplify(GeomFromText(?, CAST(? AS INTEGER)), ?)`;
+            query = `SELECT AsText(${simplifyGeom}) as result`;
+            queryParams.push(input.geometry1, input.srid, input.distance);
             break;
+          }
           default:
             query = "SELECT 1";
         }
-        const result = await adapter.executeReadQuery(query);
+        const result = await adapter.executeReadQuery(query, queryParams);
         const wktResult = result.rows?.[0]?.["result"];
         if (wktResult === null || wktResult === void 0) {
           return {
@@ -2184,7 +2362,7 @@ function createSpatialImportTool(adapter) {
     inputSchema: SpatialImportSchema,
     outputSchema: SpatialiteImportOutputSchema,
     requiredScopes: ["write"],
-    annotations: write("SpatiaLite Import"),
+    annotations: writeFs("SpatiaLite Import"),
     handler: async (params, _context) => {
       try {
         const input = SpatialImportSchema.parse(params);
@@ -2198,7 +2376,9 @@ function createSpatialImportTool(adapter) {
             recoverable: false
           };
         }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(input.tableName)) {
+        try {
+          validateIdentifier(input.tableName);
+        } catch {
           return {
             success: false,
             error: `Invalid table name: '${input.tableName}'`,
@@ -2212,10 +2392,11 @@ function createSpatialImportTool(adapter) {
           try {
             JSON.parse(input.data);
             const geojsonCheck = await adapter.executeReadQuery(
-              `SELECT GeomFromGeoJSON('${input.data}') as geom`
+              `SELECT ST_IsValid(GeomFromGeoJSON(?)) as valid`,
+              [input.data]
             );
-            const parsedGeom2 = geojsonCheck.rows?.[0]?.["geom"];
-            if (parsedGeom2 === null || parsedGeom2 === void 0) {
+            const isValid2 = geojsonCheck.rows?.[0]?.["valid"];
+            if (isValid2 !== 1) {
               return {
                 success: false,
                 error: `Invalid GeoJSON geometry: could not be parsed by SpatiaLite (must be a valid Geometry object)`,
@@ -2225,9 +2406,8 @@ function createSpatialImportTool(adapter) {
               };
             }
             const columns2 = ["geom"];
-            const values2 = [
-              `SetSRID(GeomFromGeoJSON('${input.data}'), ${input.srid})`
-            ];
+            const placeholders2 = [`SetSRID(GeomFromGeoJSON(?), ?)`];
+            const insertParams2 = [input.data, input.srid];
             if (input.additionalData) {
               for (const [key, value] of Object.entries(input.additionalData)) {
                 if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
@@ -2239,14 +2419,16 @@ function createSpatialImportTool(adapter) {
                     recoverable: false
                   };
                 }
-                columns2.push(`"${key}"`);
-                values2.push(
-                  typeof value === "string" ? `'${value.replace(/'/g, "''")}'` : String(value)
-                );
+                columns2.push(sanitizeIdentifier(key));
+                placeholders2.push("?");
+                insertParams2.push(value);
               }
             }
-            const sql2 = `INSERT INTO "${input.tableName}" (${columns2.join(", ")}) VALUES (${values2.join(", ")})`;
-            const insertResult2 = await adapter.executeWriteQuery(sql2);
+            const sql2 = `INSERT INTO ${sanitizeIdentifier(input.tableName)} (${columns2.join(", ")}) VALUES (${placeholders2.join(", ")})`;
+            const insertResult2 = await adapter.executeWriteQuery(
+              sql2,
+              insertParams2
+            );
             return {
               success: true,
               message: "GeoJSON geometry imported",
@@ -2265,10 +2447,11 @@ function createSpatialImportTool(adapter) {
           wkt = input.data;
         }
         const wktCheck = await adapter.executeReadQuery(
-          `SELECT GeomFromText('${wkt}', ${input.srid}) as geom`
+          `SELECT ST_IsValid(GeomFromText(?, CAST(? AS INTEGER))) as valid`,
+          [wkt, input.srid]
         );
-        const parsedGeom = wktCheck.rows?.[0]?.["geom"];
-        if (parsedGeom === null || parsedGeom === void 0) {
+        const isValid = wktCheck.rows?.[0]?.["valid"];
+        if (isValid !== 1) {
           return {
             success: false,
             error: `Invalid WKT geometry: '${wkt}' could not be parsed`,
@@ -2278,7 +2461,8 @@ function createSpatialImportTool(adapter) {
           };
         }
         const columns = ["geom"];
-        const values = [`GeomFromText('${wkt}', ${input.srid})`];
+        const placeholders = [`GeomFromText(?, CAST(? AS INTEGER))`];
+        const insertParams = [wkt, input.srid];
         if (input.additionalData) {
           for (const [key, value] of Object.entries(input.additionalData)) {
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
@@ -2290,14 +2474,13 @@ function createSpatialImportTool(adapter) {
                 recoverable: false
               };
             }
-            columns.push(`"${key}"`);
-            values.push(
-              typeof value === "string" ? `'${value.replace(/'/g, "''")}'` : String(value)
-            );
+            columns.push(sanitizeIdentifier(key));
+            placeholders.push("?");
+            insertParams.push(value);
           }
         }
-        const sql = `INSERT INTO "${input.tableName}" (${columns.join(", ")}) VALUES (${values.join(", ")})`;
-        const insertResult = await adapter.executeWriteQuery(sql);
+        const sql = `INSERT INTO ${sanitizeIdentifier(input.tableName)} (${columns.join(", ")}) VALUES (${placeholders.join(", ")})`;
+        const insertResult = await adapter.executeWriteQuery(sql, insertParams);
         return {
           success: true,
           message: "WKT geometry imported",
@@ -2358,16 +2541,16 @@ function getNativeToolDefinitions(adapter) {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 10; i++) {
-    if (fs.existsSync(path.join(dir, "package.json"))) return dir;
-    const parent = path.dirname(dir);
+    if (fs.existsSync(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return startDir;
 }
 var __moduleFilename = fileURLToPath(import.meta.url);
-var PROJECT_ROOT = findProjectRoot(path.dirname(__moduleFilename));
-var EXTENSIONS_DIR = path.join(PROJECT_ROOT, "extensions");
+var PROJECT_ROOT = findProjectRoot(path2.dirname(__moduleFilename));
+var EXTENSIONS_DIR = path2.join(PROJECT_ROOT, "extensions");
 function tryLoadExtension(db, name, envVar, candidates, log2) {
   for (const extPath of candidates) {
     try {
@@ -2387,12 +2570,12 @@ function loadSpatialite(db, log2) {
   const spatialitePaths = [
     process.env["SPATIALITE_PATH"],
     // Absolute paths to local extensions
-    path.join(
+    path2.join(
       EXTENSIONS_DIR,
       "mod_spatialite-5.1.0-win-amd64",
       "mod_spatialite"
     ),
-    path.join(
+    path2.join(
       EXTENSIONS_DIR,
       "mod_spatialite-5.1.0-win-amd64",
       "mod_spatialite.dll"
@@ -2406,7 +2589,7 @@ function loadSpatialite(db, log2) {
   ].filter((p) => Boolean(p));
   const envSpatialitePath = process.env["SPATIALITE_PATH"];
   if (envSpatialitePath && process.platform === "win32") {
-    const spatialiteExtDir = path.dirname(envSpatialitePath);
+    const spatialiteExtDir = path2.dirname(envSpatialitePath);
     const currentPath = process.env["PATH"] ?? "";
     if (!currentPath.includes(spatialiteExtDir)) {
       process.env["PATH"] = spatialiteExtDir + ";" + currentPath;
@@ -2418,8 +2601,8 @@ function loadCsvExtension(db, log2) {
   const csvPaths = [
     process.env["CSV_EXTENSION_PATH"],
     // sqlite-xsv extension with absolute paths
-    path.join(EXTENSIONS_DIR, "xsv0.dll"),
-    path.join(EXTENSIONS_DIR, "xsv0"),
+    path2.join(EXTENSIONS_DIR, "xsv0.dll"),
+    path2.join(EXTENSIONS_DIR, "xsv0"),
     // System paths
     "xsv0",
     "xsv0.dll",
@@ -2532,8 +2715,8 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   getConfiguredPath() {
     const config = this.config;
-    const path2 = config?.filePath ?? config?.connectionString ?? ":memory:";
-    return path2;
+    const path3 = config?.filePath ?? config?.connectionString ?? ":memory:";
+    return path3;
   }
   db = null;
   schemaManager = null;
@@ -2675,6 +2858,7 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeReadQuery(sql, params) {
     this.ensureConnected();
+    this.validateQuery(sql, true);
     return nativeExecuteRead(this.ensureDb(), sql, params, log);
   }
   /**
@@ -2682,6 +2866,7 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeWriteQuery(sql, params) {
     this.ensureConnected();
+    this.validateQuery(sql, false);
     const result = nativeExecuteWrite(this.ensureDb(), sql, params, log);
     if (isDDL(sql)) {
       this.clearSchemaCache();
@@ -2693,11 +2878,26 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    */
   executeQuery(sql, params) {
     const trimmed = sql.trim().toUpperCase();
-    if (trimmed.startsWith("SELECT") || trimmed.startsWith("PRAGMA") || trimmed.startsWith("EXPLAIN")) {
+    if (trimmed.startsWith("PRAGMA")) {
+      if (sql.includes("=") || sql.includes("(")) {
+        return this.executeWriteQuery(sql, params);
+      }
+      return this.executeReadQuery(sql, params);
+    }
+    if (trimmed.startsWith("SELECT") || trimmed.startsWith("EXPLAIN")) {
       return this.executeReadQuery(sql, params);
     }
     return this.executeWriteQuery(sql, params);
   }
+  /**
+   * Execute a SQL script containing multiple statements
+   */
+  executeScript(sql) {
+    this.ensureConnected();
+    this.ensureDb().exec(sql);
+    this.clearSchemaCache();
+    return Promise.resolve();
+  }
   /**
    * Get schema information (cached via SchemaManager)
    */
@@ -2855,7 +3055,8 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
       "admin",
       "geo",
       "introspection",
-      "migration"
+      "migration",
+      "transactions"
     ];
   }
   /**
@@ -2914,7 +3115,11 @@ var NativeSqliteAdapter = class extends DatabaseAdapter {
    * Execute raw SQL and return results (for tools)
    */
   rawQuery(sql, params) {
-    return this.executeQuery(sql, params);
+    const trimmed = sql.trim().toUpperCase();
+    if (trimmed.startsWith("SELECT") || trimmed.startsWith("EXPLAIN") || trimmed.startsWith("PRAGMA") && !sql.includes("=") && !sql.includes("(")) {
+      return nativeExecuteRead(this.ensureDb(), sql, params, log);
+    }
+    return nativeExecuteWrite(this.ensureDb(), sql, params, log);
   }
   /**
    * Begin a transaction