db-mcp 3.0.1 → 4.0.0

package/dist/{chunk-NV34JSQM.js → chunk-TGE7LFAR.js}

@@ -1,10 +1,10 @@
-import { validateQuery } from './chunk-W5WQVNVX.js';
-import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, write, idempotent, destructive, VacuumOutputSchema, admin, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AppendInsightOutputSchema, AppendInsightSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-E5IESRTK.js';
-import { createModuleLogger, logger, ResourceNotFoundError, DbMcpError, formatHandlerError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess } from './chunk-L552U3QS.js';
+import { validateQuery } from './chunk-EQF3WZHX.js';
+import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, sanitizeIdentifier, createColumnList, buildWhereClause, write, idempotent, destructive, sanitizeWhereClause, validateJsonPath, validateAggregateFunction, VacuumOutputSchema, admin, validateSameDirPath, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-R5M4WKDM.js';
+import { createModuleLogger, logger, ResourceNotFoundError, DbMcpError, formatHandlerError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess } from './chunk-Y57WFKAP.js';
 import { z } from 'zod';
 import * as path from 'path';
-import path__default, { dirname, resolve, basename, normalize, relative } from 'path';
-import fs, { realpathSync } from 'fs';
+import path__default from 'path';
+import fs from 'fs';
 import { createHash } from 'crypto';
 import { createClient } from 'redis';
 import * as acorn from 'acorn';
@@ -41,6 +41,7 @@ var ReadQueryOutputSchema = z.object({
   success: z.boolean(),
   rowCount: z.number().optional(),
   rows: z.array(RowRecordSchema).optional(),
+  nextCursor: z.string().optional(),
   executionTimeMs: z.number().optional()
 }).extend(ErrorResponseFields.shape);
 var WriteQueryOutputSchema = z.object({
@@ -122,7 +123,8 @@ var DateMathOutputSchema = z.object({
 var ReadQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("SELECT query to execute"),
   sql: z.string().max(1e5).optional().describe("Alias for query"),
-  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements")
+  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements"),
+  cursor: z.string().optional().describe("Opaque cursor for pagination")
 });
 var WriteQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("INSERT/UPDATE/DELETE query to execute"),
@@ -541,16 +543,59 @@ function createReadQueryTool(adapter) {
       }
       try {
         let finalQuery = input.query.replace(/[\s;]+$/g, "");
+        let offset = 0;
+        if (input.cursor) {
+          try {
+            const cursorData = JSON.parse(
+              Buffer.from(input.cursor, "base64").toString("utf8")
+            );
+            if (typeof cursorData["offset"] === "number") {
+              offset = cursorData["offset"];
+            }
+          } catch {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  "Invalid cursor format",
+                  "VALIDATION_ERROR",
+                  {
+                    suggestion: "Use the nextCursor value returned from a previous query.",
+                    details: {}
+                  }
+                )
+              ),
+              rowCount: 0,
+              rows: []
+            };
+          }
+        }
         const upperForLimit = finalQuery.toUpperCase();
         const isLimitable = upperForLimit.startsWith("SELECT") || upperForLimit.startsWith("WITH");
-        if (isLimitable && !/\bLIMIT\b/i.test(finalQuery)) {
-          finalQuery = `${finalQuery} LIMIT 50`;
+        const limit = 50;
+        const hasLimit = /\bLIMIT\b/i.test(finalQuery);
+        if (isLimitable && !hasLimit) {
+          finalQuery = `${finalQuery} LIMIT ${limit}`;
+          if (offset > 0) {
+            finalQuery = `${finalQuery} OFFSET ${offset}`;
+          }
+        } else if (isLimitable && hasLimit && offset > 0) {
+          if (!/\bOFFSET\b/i.test(finalQuery)) {
+            finalQuery = `${finalQuery} OFFSET ${offset}`;
+          }
         }
         const result = await adapter.executeReadQuery(finalQuery, input.params);
+        let nextCursor;
+        if (isLimitable && !hasLimit && result.rows?.length === limit) {
+          const nextOffset = offset + limit;
+          nextCursor = Buffer.from(
+            JSON.stringify({ offset: nextOffset })
+          ).toString("base64");
+        }
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows,
+          nextCursor,
           executionTimeMs: result.executionTimeMs
         };
       } catch (error) {
@@ -671,477 +716,6 @@ function createWriteQueryTool(adapter) {
   };
 }
 
-// src/utils/where-clause.ts
-var UnsafeWhereClauseError = class extends Error {
-  constructor(reason) {
-    super(`Unsafe WHERE clause: ${reason}`);
-    this.name = "UnsafeWhereClauseError";
-  }
-};
-var DANGEROUS_PATTERNS = [
-  // Statement terminators and new statements
-  // Comprehensive keyword list including statements missed in earlier versions:
-  // REPLACE, VACUUM, ANALYZE, BEGIN, COMMIT, ROLLBACK, SAVEPOINT, RELEASE
-  {
-    pattern: /;\s*(DROP|DELETE|TRUNCATE|INSERT|UPDATE|CREATE|ALTER|ATTACH|DETACH|SELECT|REPLACE|VACUUM|ANALYZE|BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE|REINDEX|EXPLAIN)\b/i,
-    reason: "contains statement terminator followed by SQL keyword"
-  },
-  // Trailing semicolons (potential statement injection)
-  {
-    pattern: /;\s*$/,
-    reason: "contains trailing semicolon"
-  },
-  // SQL comments (can be used to comment out security checks)
-  {
-    pattern: /--/,
-    reason: "contains SQL line comment"
-  },
-  {
-    pattern: /\/\*/,
-    reason: "contains SQL block comment"
-  },
-  // REGEXP and MATCH injection (blind extraction oracles)
-  {
-    pattern: /\bREGEXP\s+/i,
-    reason: "contains REGEXP (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bMATCH\s+/i,
-    reason: "contains MATCH (potential blind extraction oracle)"
-  },
-  // UNION injection (data exfiltration)
-  {
-    pattern: /\bUNION\s+(ALL\s+)?SELECT\b/i,
-    reason: "contains UNION SELECT"
-  },
-  // SQLite-specific: Extension loading (code execution)
-  {
-    pattern: /\bload_extension\s*\(/i,
-    reason: "contains load_extension (code execution)"
-  },
-  // SQLite-specific: ATTACH database (file system access)
-  {
-    pattern: /\bATTACH\s+(DATABASE\s+)?['"`]/i,
-    reason: "contains ATTACH DATABASE (file system access)"
-  },
-  // SQLite-specific: Pragma manipulation
-  {
-    pattern: /\bPRAGMA\s+/i,
-    reason: "contains PRAGMA statement"
-  },
-  // SQLite-specific: writefile/readfile (if using fileio extension)
-  {
-    pattern: /\b(writefile|readfile)\s*\(/i,
-    reason: "contains file I/O function"
-  },
-  // SQLite-specific: fts3_tokenizer (potential code execution)
-  {
-    pattern: /\bfts3_tokenizer\s*\(/i,
-    reason: "contains FTS tokenizer function"
-  },
-  // Subquery injection (data exfiltration via boolean-based blind)
-  {
-    pattern: /\(\s*SELECT\b/i,
-    reason: "contains subquery (potential data exfiltration)"
-  },
-  // Generic: Hexadecimal string injection
-  {
-    pattern: /\bX'[0-9A-Fa-f]+'/,
-    reason: "contains hex string literal (potential binary injection)"
-  },
-  // CASE WHEN (potential blind injection without subqueries)
-  {
-    pattern: /\bCASE\s+WHEN\b/i,
-    reason: "contains CASE WHEN (potential blind injection)"
-  },
-  // IIF() — conditional bypass alternative to CASE WHEN
-  {
-    pattern: /\bIIF\s*\(/i,
-    reason: "contains IIF() (potential blind injection)"
-  },
-  // GROUP_CONCAT() — data aggregation for exfiltration
-  {
-    pattern: /\bGROUP_CONCAT\s*\(/i,
-    reason: "contains GROUP_CONCAT() (potential data exfiltration)"
-  },
-  // GLOB — case-sensitive wildcard operator usable for character extraction oracles
-  {
-    pattern: /\bGLOB\b/i,
-    reason: "contains GLOB (potential case-sensitive oracle)"
-  },
-  // Conditional functions — blind injection oracles (bypass for CASE WHEN / IIF)
-  {
-    pattern: /\bCOALESCE\s*\(/i,
-    reason: "contains COALESCE() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bNULLIF\s*\(/i,
-    reason: "contains NULLIF() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bTYPEOF\s*\(/i,
-    reason: "contains TYPEOF() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bIFNULL\s*\(/i,
-    reason: "contains IFNULL() (potential blind injection oracle)"
-  },
-  // Memory allocation DoS — RANDOMBLOB(N) / ZEROBLOB(N) can allocate large blocks (CWE-400)
-  {
-    pattern: /\bRANDOMBLOB\s*\(/i,
-    reason: "contains RANDOMBLOB() (potential memory allocation DoS)"
-  },
-  {
-    pattern: /\bZEROBLOB\s*\(/i,
-    reason: "contains ZEROBLOB() (potential memory allocation DoS)"
-  },
-  // Blind extraction oracle functions — can be composed for character-by-character
-  // data extraction without subqueries or CASE WHEN (CWE-89, H-1 audit finding).
-  // Example: INSTR('abc...', SUBSTR(sqlite_version(), 1, 1)) = N
-  {
-    pattern: /\bINSTR\s*\(/i,
-    reason: "contains INSTR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bSUBSTR\s*\(/i,
-    reason: "contains SUBSTR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bSUBSTRING\s*\(/i,
-    reason: "contains SUBSTRING() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bLENGTH\s*\(/i,
-    reason: "contains LENGTH() (potential blind extraction oracle)"
-  },
-  // TRIM functions — blind extraction oracle (bypass for LIKE / SUBSTR)
-  {
-    pattern: /\b(?:L|R)?TRIM\s*\(/i,
-    reason: "contains TRIM() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bUNICODE\s*\(/i,
-    reason: "contains UNICODE() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bCHAR\s*\(/i,
-    reason: "contains CHAR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bREPLACE\s*\(/i,
-    reason: "contains REPLACE() (potential blind extraction oracle)"
-  },
-  // ABS() — can be combined with subtraction to create numeric oracles (CWE-89)
-  {
-    pattern: /\bABS\s*\(/i,
-    reason: "contains ABS() (potential blind extraction oracle)"
-  },
-  // HEX() — encodes values for character-by-character extraction (CWE-89)
-  {
-    pattern: /\bHEX\s*\(/i,
-    reason: "contains HEX() (potential blind extraction oracle)"
-  },
-  // QUOTE() — returns SQL-literal representation, can leak type/value info (CWE-89)
-  {
-    pattern: /\bQUOTE\s*\(/i,
-    reason: "contains QUOTE() (potential blind extraction oracle)"
-  },
-  // PRINTF() — format-string based extraction of internal values (CWE-89)
-  {
-    pattern: /\bPRINTF\s*\(/i,
-    reason: "contains PRINTF() (potential blind extraction oracle)"
-  },
-  // FORMAT() — SQLite 3.38.0+ alias for printf() (CWE-89)
-  {
-    pattern: /\bFORMAT\s*\(/i,
-    reason: "contains FORMAT() (potential blind extraction oracle)"
-  },
-  // CAST() — can be used to convert text to numeric oracles (CWE-89)
-  {
-    pattern: /\bCAST\s*\(/i,
-    reason: "contains CAST() (potential blind extraction oracle)"
-  }
-];
-var FULLWIDTH_START = 65281;
-var FULLWIDTH_END = 65374;
-var FULLWIDTH_ASCII_OFFSET = 65248;
-function normalizeForPatternMatching(input) {
-  let normalized = input.normalize("NFC");
-  let hasFullwidth = false;
-  for (let i = 0; i < normalized.length; i++) {
-    const code = normalized.charCodeAt(i);
-    if (code >= FULLWIDTH_START && code <= FULLWIDTH_END) {
-      hasFullwidth = true;
-      break;
-    }
-  }
-  if (hasFullwidth) {
-    const chars = [];
-    for (let i = 0; i < normalized.length; i++) {
-      const code = normalized.charCodeAt(i);
-      if (code >= FULLWIDTH_START && code <= FULLWIDTH_END) {
-        chars.push(String.fromCharCode(code - FULLWIDTH_ASCII_OFFSET));
-      } else {
-        chars.push(normalized.charAt(i));
-      }
-    }
-    normalized = chars.join("");
-  }
-  return normalized;
-}
-function sanitizeWhereClause(where) {
-  if (!where || typeof where !== "string") {
-    throw new UnsafeWhereClauseError("WHERE clause must be a non-empty string");
-  }
-  const MAX_WHERE_LENGTH = 10240;
-  if (where.length > MAX_WHERE_LENGTH) {
-    throw new UnsafeWhereClauseError(
-      `WHERE clause exceeds maximum length of ${String(MAX_WHERE_LENGTH)} characters`
-    );
-  }
-  const normalized = normalizeForPatternMatching(where);
-  for (const { pattern, reason } of DANGEROUS_PATTERNS) {
-    if (pattern.test(normalized)) {
-      throw new UnsafeWhereClauseError(reason);
-    }
-  }
-  return where;
-}
-function buildWhereClause(conditions, whereClause) {
-  let finalSql = "";
-  const params = [];
-  const clauses = [];
-  if (conditions !== void 0 && conditions !== null && conditions.length > 0) {
-    const allowedOperators = /* @__PURE__ */ new Set([
-      "=",
-      "!=",
-      ">",
-      ">=",
-      "<",
-      "<=",
-      "LIKE",
-      "IN",
-      "IS",
-      "IS NOT",
-      "NOT LIKE"
-    ]);
-    for (const cond of conditions) {
-      if (!allowedOperators.has(cond.operator.toUpperCase())) {
-        throw new Error(`Invalid operator: ${cond.operator}`);
-      }
-      const col = `"${cond.column.replace(/"/g, '""')}"`;
-      if (cond.operator.toUpperCase() === "IN" && Array.isArray(cond.value)) {
-        const placeholders = cond.value.map(() => "?").join(", ");
-        clauses.push(`${col} IN (${placeholders})`);
-        params.push(...cond.value);
-      } else {
-        clauses.push(`${col} ${cond.operator} ?`);
-        params.push(cond.value);
-      }
-    }
-    finalSql = clauses.join(" AND ");
-  }
-  if (whereClause) {
-    const safeWhere = sanitizeWhereClause(whereClause);
-    if (finalSql) {
-      finalSql = `${finalSql} AND ${safeWhere}`;
-    } else {
-      finalSql = safeWhere;
-    }
-  }
-  return { sql: finalSql, params };
-}
-
-// src/utils/identifiers.ts
-var IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-var MAX_IDENTIFIER_LENGTH = 255;
-var InvalidIdentifierError = class extends Error {
-  constructor(identifier, reason) {
-    super(`Invalid identifier "${identifier}": ${reason}`);
-    this.identifier = identifier;
-    this.reason = reason;
-    this.name = "InvalidIdentifierError";
-  }
-  identifier;
-  reason;
-};
-function validateIdentifier(name) {
-  if (!name || typeof name !== "string") {
-    throw new InvalidIdentifierError(
-      name,
-      "Identifier must be a non-empty string"
-    );
-  }
-  if (name.length > MAX_IDENTIFIER_LENGTH) {
-    throw new InvalidIdentifierError(
-      name,
-      `Identifier exceeds maximum length of ${String(MAX_IDENTIFIER_LENGTH)} characters`
-    );
-  }
-  if (!IDENTIFIER_PATTERN.test(name)) {
-    throw new InvalidIdentifierError(
-      name,
-      "Identifier contains invalid characters. Must start with a letter or underscore and contain only letters, digits, or underscores"
-    );
-  }
-}
-function sanitizeIdentifier(name) {
-  validateIdentifier(name);
-  const escaped = name.replace(/"/g, '""');
-  return `"${escaped}"`;
-}
-function sanitizeIdentifiers(names) {
-  return names.map(sanitizeIdentifier);
-}
-function createColumnList(columns) {
-  return sanitizeIdentifiers(columns).join(", ");
-}
-function validateSameDirPath(targetPath, dbPath) {
-  if (targetPath.includes("\0")) {
-    return {
-      valid: false,
-      error: "Security: path must not contain null bytes.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  if (targetPath.startsWith("file:") || targetPath.includes("?")) {
-    return {
-      valid: false,
-      error: "Security: SQLite URIs and query parameters are not allowed.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  const base = basename(targetPath);
-  if (base.startsWith(".")) {
-    return {
-      valid: false,
-      error: "Security: Cannot access hidden files or dotfiles.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  const validExtensions = [
-    ".db",
-    ".sqlite",
-    ".sqlite3",
-    ".sql",
-    ".csv",
-    ".tsv"
-  ];
-  const hasValidExt = validExtensions.some(
-    (ext) => base.toLowerCase().endsWith(ext)
-  );
-  if (!hasValidExt) {
-    return {
-      valid: false,
-      error: `Security: Invalid file extension. Allowed extensions are: ${validExtensions.join(", ")}`,
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  if (dbPath === ":memory:") {
-    return {
-      valid: false,
-      error: "Security: Filesystem operations are not permitted for :memory: databases.",
-      dbDir: ""
-    };
-  }
-  const dbDir = dirname(resolve(dbPath));
-  let resolvedTarget = resolve(targetPath);
-  try {
-    resolvedTarget = realpathSync(resolvedTarget);
-  } catch {
-    try {
-      const parentDir = realpathSync(dirname(resolvedTarget));
-      resolvedTarget = resolve(parentDir, basename(resolvedTarget));
-    } catch {
-      return {
-        valid: false,
-        error: "Security: Target parent directory must exist.",
-        dbDir
-      };
-    }
-  }
-  let resolvedDbDir;
-  try {
-    resolvedDbDir = realpathSync(dbDir);
-  } catch {
-    return {
-      valid: false,
-      error: "Security: Database directory must exist.",
-      dbDir
-    };
-  }
-  const normalizedTarget = normalize(resolvedTarget);
-  const normalizedDir = normalize(resolvedDbDir);
-  const targetDir = normalize(dirname(resolvedTarget));
-  if (relative(normalizedDir, targetDir) !== "") {
-    return {
-      valid: false,
-      error: `Security: path must be within the database directory. Path traversal is not allowed.`,
-      dbDir
-    };
-  }
-  return { valid: true, resolvedPath: normalizedTarget };
-}
-
-// src/utils/validate-json-path.ts
-var VALID_JSON_PATH_PATTERN = /^\$(\.[a-zA-Z_][a-zA-Z0-9_ -]*|\[\d+\]|\[#\]|\[\*\])*$/;
-var MAX_JSON_PATH_LENGTH = 500;
-function validateJsonPath(path3, param = "path") {
-  if (!path3.startsWith("$")) {
-    throw new ValidationError(
-      `JSON ${param} must start with $`,
-      "INVALID_JSON_PATH",
-      {
-        suggestion: "Use a valid JSON path starting with $. For example: $.key or $[0]"
-      }
-    );
-  }
-  if (path3.length > MAX_JSON_PATH_LENGTH) {
-    throw new ValidationError(
-      `JSON ${param} exceeds maximum length of ${MAX_JSON_PATH_LENGTH} characters`,
-      "INVALID_JSON_PATH"
-    );
-  }
-  if (!VALID_JSON_PATH_PATTERN.test(path3)) {
-    throw new ValidationError(
-      `Invalid JSON ${param} syntax: ${path3}`,
-      "INVALID_JSON_PATH",
-      {
-        suggestion: "Use $.key, $[0], or $[*] patterns. Member names must start with a letter or underscore."
-      }
-    );
-  }
-}
-var ALLOWED_AGGREGATE_FUNCTIONS = /* @__PURE__ */ new Set([
-  "count",
-  "sum",
-  "avg",
-  "min",
-  "max",
-  "group_concat",
-  "total"
-]);
-var AGGREGATE_FUNCTION_PATTERN = /^([A-Za-z_]+)\(\s*(\*|"[a-zA-Z_][a-zA-Z0-9_]*"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\s*,\s*'[^']*')?\s*\)$/;
-function validateAggregateFunction(fn) {
-  const match = AGGREGATE_FUNCTION_PATTERN.exec(fn.trim());
-  if (!match) {
-    throw new ValidationError(
-      `Invalid aggregate function syntax: ${fn}`,
-      "INVALID_AGGREGATE_FUNCTION",
-      {
-        suggestion: "Use a standard aggregate function like COUNT(*), SUM(column), AVG(column), MIN(column), MAX(column), GROUP_CONCAT(column), or TOTAL(column)."
-      }
-    );
-  }
-  const funcName = match[1]?.toLowerCase();
-  if (!funcName || !ALLOWED_AGGREGATE_FUNCTIONS.has(funcName)) {
-    throw new ValidationError(
-      `Disallowed aggregate function: ${match[1]}. Allowed: ${[...ALLOWED_AGGREGATE_FUNCTIONS].join(", ").toUpperCase()}`,
-      "INVALID_AGGREGATE_FUNCTION"
-    );
-  }
-}
-
 // src/adapters/sqlite/tools/core/tables.ts
 var SPATIALITE_SYSTEM_PREFIXES = [
   "geometry_columns",
@@ -1396,7 +970,7 @@ function createDescribeTableTool(adapter) {
       try {
         const tableInfo = await adapter.describeTable(input.table);
         const rawColumns = tableInfo.columns ?? [];
-        let enrichedColumns = rawColumns.map((c) => ({
+        const enrichedColumns = rawColumns.map((c) => ({
           name: c.name,
           type: c.type,
           nullable: c.nullable,
@@ -1422,28 +996,39 @@ function createDescribeTableTool(adapter) {
                 [input.table]
               );
               const ddl = ddlResult.rows?.[0]?.["sql"] ?? "";
-              enrichedColumns = enrichedColumns.map((col) => {
-                const hidden = xinfoMap.get(col.name);
-                if (hidden !== 2 && hidden !== 3) return col;
-                const enriched = {
-                  ...col,
-                  isGenerated: true,
-                  generatedType: hidden === 3 ? "STORED" : "VIRTUAL"
-                };
-                const escapedName = col.name.replace(
-                  /[.*+?^${}()|[\]\\]/g,
-                  "\\$&"
-                );
-                const exprPattern = new RegExp(
-                  `"?${escapedName}"?\\s+\\w+[^,]*GENERATED\\s+ALWAYS\\s+AS\\s*\\(([^)]+)\\)`,
-                  "i"
-                );
-                const match = exprPattern.exec(ddl);
-                if (match?.[1]) {
-                  enriched.generatedExpression = match[1].trim();
+              for (const row of xinfoResult.rows) {
+                const colName = row["name"];
+                const hidden = row["hidden"];
+                if (hidden === 2 || hidden === 3) {
+                  let enriched = enrichedColumns.find(
+                    (c) => c.name === colName
+                  );
+                  if (!enriched) {
+                    enriched = {
+                      name: colName,
+                      type: row["type"],
+                      nullable: row["notnull"] === 0,
+                      primaryKey: row["pk"] === 1,
+                      defaultValue: row["dflt_value"]
+                    };
+                    enrichedColumns.push(enriched);
+                  }
+                  enriched.isGenerated = true;
+                  enriched.generatedType = hidden === 3 ? "STORED" : "VIRTUAL";
+                  const escapedName = colName.replace(
+                    /[.*+?^${}()|[\]\\]/g,
+                    "\\$&"
+                  );
+                  const exprPattern = new RegExp(
+                    `"?${escapedName}"?\\s+\\w+[^,]*GENERATED\\s+ALWAYS\\s+AS\\s*\\(([^)]+)\\)`,
+                    "i"
+                  );
+                  const match = exprPattern.exec(ddl);
+                  if (match?.[1]) {
+                    enriched.generatedExpression = match[1].trim();
+                  }
                 }
-                return enriched;
-              });
+              }
             }
           }
         } catch {
@@ -3227,55 +2812,6 @@ var SchemaManager = class {
   }
 };
 
-// src/utils/insights-manager.ts
-var InsightsManager = class {
-  insights = [];
-  /**
-   * Append a new business insight
-   */
-  append(insight) {
-    if (insight.trim()) {
-      this.insights.push(insight.trim());
-    }
-  }
-  /**
-   * Get all insights
-   */
-  getAll() {
-    return [...this.insights];
-  }
-  /**
-   * Get insight count
-   */
-  count() {
-    return this.insights.length;
-  }
-  /**
-   * Clear all insights
-   */
-  clear() {
-    this.insights = [];
-  }
-  /**
-   * Synthesize insights into a formatted memo
-   */
-  synthesizeMemo() {
-    if (this.insights.length === 0) {
-      return "No business insights have been discovered yet.";
-    }
-    const insightsList = this.insights.map((insight) => `- ${insight}`).join("\n");
-    let memo = "\u{1F4CA} Business Intelligence Memo \u{1F4CA}\n\n";
-    memo += "Key Insights Discovered:\n\n";
-    memo += insightsList;
-    if (this.insights.length > 1) {
-      memo += "\n\nSummary:\n";
-      memo += `Analysis has revealed ${this.insights.length} key business insights that suggest opportunities for strategic optimization and growth.`;
-    }
-    return memo;
-  }
-};
-var insightsManager = new InsightsManager();
-
 // src/adapters/sqlite/resources.ts
 function getResourceDefinitions(adapter) {
   return [
@@ -3287,8 +2823,7 @@ function getResourceDefinitions(adapter) {
     createHealthResource(adapter),
     createMetaResource(adapter),
     createCompileOptionsResource(adapter),
-    createPragmaResource(adapter),
-    createInsightsResource()
+    createPragmaResource(adapter)
   ];
 }
 function createSchemaResource(adapter) {
@@ -3512,26 +3047,6 @@ function createMetaResource(adapter) {
     }
   };
 }
-function createInsightsResource() {
-  return {
-    name: "sqlite_insights",
-    uri: "memo://insights",
-    description: "Business insights memo that gets updated during database analysis",
-    mimeType: "text/plain",
-    annotations: HIGH_PRIORITY,
-    handler: () => {
-      return Promise.resolve({
-        contents: [
-          {
-            uri: "memo://insights",
-            mimeType: "text/plain",
-            text: insightsManager.synthesizeMemo()
-          }
-        ]
-      });
-    }
-  };
-}
 function createCompileOptionsResource(adapter) {
   return {
     name: "sqlite_compile_options",
@@ -4161,7 +3676,6 @@ You are guiding an interactive demo of the SQLite MCP Server capabilities.
 
 **Prompts**: Pre-written templates that structure AI conversations (like this one)
 **Tools**: SQL operations (read_query, write_query, create_table, etc.)
-**Resources**: Living documents like \`memo://insights\` that update during analysis
 
 ## Demo Workflow
 
@@ -4187,17 +3701,10 @@ After setup, present 3-4 natural language query choices:
 For each user selection:
 - Run the appropriate SQL query
 - Explain the results
-- Use \`sqlite_append_insight\` to capture findings
 
-### 5. Capture Insights
-Remind the user about \`memo://insights\`:
-- Each insight is automatically added to this resource
-- They can attach it to see all discoveries
-
-### 6. Wrap Up
+### 5. Wrap Up
 Summarize what was demonstrated:
 - Data creation and querying
-- Insight capture via resources
 - The power of MCP for database workflows
 
 ---
@@ -4228,20 +3735,164 @@ function getPromptDefinitions(adapter) {
     createDemoPrompt()
   ];
 }
-var coerceNumber2 = (val) => {
-  if (typeof val === "string") {
-    if (val.trim() === "") return void 0;
-    const num = Number(val);
-    return isNaN(num) ? val : num;
-  }
-  return val;
+
+// src/adapters/sqlite/json-utils.ts
+var DEFAULT_NORMALIZATION_OPTIONS = {
+  sortKeys: true,
+  compact: true,
+  unicodeNormalize: true,
+  typeCoercion: false,
+  duplicateKeys: "last"
 };
-var JsonInsertOutputSchema = z.object({
-  success: z.boolean(),
-  message: z.string().optional(),
-  rowsAffected: z.number().optional(),
-  warning: z.string().optional(),
-  lastInsertRowid: z.number().optional()
+function normalizeJson(value, options = {}) {
+  const opts = { ...DEFAULT_NORMALIZATION_OPTIONS, ...options };
+  const changes = [];
+  let parsed;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return {
+        normalized: value,
+        wasModified: false,
+        changes: ["Input is not valid JSON"]
+      };
+    }
+  } else {
+    parsed = value;
+  }
+  const normalized = normalizeValue(parsed, opts, changes, "");
+  const normalizedStr = opts.compact ? JSON.stringify(normalized) : JSON.stringify(normalized, null, 2);
+  const originalStr = typeof value === "string" ? value : JSON.stringify(value);
+  const wasModified = normalizedStr !== originalStr;
+  return {
+    normalized: normalizedStr,
+    wasModified,
+    changes
+  };
+}
+function normalizeValue(value, options, changes, path3) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value === "string") {
+    let result = value;
+    if (options.unicodeNormalize && value !== value.normalize("NFC")) {
+      result = result.normalize("NFC");
+      changes.push(`${path3 || "$"}: Unicode normalized`);
+    }
+    if (options.typeCoercion) {
+      if (result.toLowerCase() === "true") {
+        changes.push(`${path3 || "$"}: Coerced "true" to boolean`);
+        return true;
+      }
+      if (result.toLowerCase() === "false") {
+        changes.push(`${path3 || "$"}: Coerced "false" to boolean`);
+        return false;
+      }
+      const num = Number(result);
+      if (!isNaN(num) && result.trim() !== "") {
+        changes.push(`${path3 || "$"}: Coerced "${result}" to number`);
+        return num;
+      }
+    }
+    return result;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(
+      (item, index) => normalizeValue(item, options, changes, `${path3 || "$"}[${index}]`)
+    );
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    let keys = Object.keys(obj);
+    if (options.sortKeys) {
+      const originalOrder = keys.join(",");
+      keys = keys.sort();
+      if (keys.join(",") !== originalOrder) {
+        changes.push(`${path3 || "$"}: Keys sorted`);
+      }
+    }
+    const result = {};
+    for (const key of keys) {
+      result[key] = normalizeValue(
+        obj[key],
+        options,
+        changes,
+        `${path3 || "$"}.${key}`
+      );
+    }
+    return result;
+  }
+  return value;
+}
+var jsonbSupportedCache = null;
+function isJsonbSupportedVersion(versionString) {
+  const versionRegex = /^(\d+)\.(\d+)\.?(\d+)?/;
+  const match = versionRegex.exec(versionString);
+  if (!match) return false;
+  const major = parseInt(match[1] ?? "0", 10);
+  const minor = parseInt(match[2] ?? "0", 10);
+  return major > 3 || major === 3 && minor >= 45;
+}
+function isJsonbSupported() {
+  return jsonbSupportedCache ?? false;
+}
+function setJsonbSupported(supported) {
+  jsonbSupportedCache = supported;
+}
+function detectJsonStorageFormat(value) {
+  if (value instanceof Buffer || value instanceof Uint8Array) {
+    return "jsonb";
+  }
+  if (typeof value === "string") {
+    return "text";
+  }
+  return "unknown";
+}
+function parseJsonValue(value) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value === "object" && !(value instanceof Buffer)) {
+    return value;
+  }
+  if (value instanceof Buffer || value instanceof Uint8Array) {
+    throw new DbMcpError(
+      "JSONB blob cannot be parsed directly. Use json() in SQL query.",
+      "JSON_PARSE_ERROR",
+      "validation" /* VALIDATION */
+    );
+  }
+  if (typeof value === "string") {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value;
+    }
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  return null;
+}
+var coerceNumber2 = (val) => {
+  if (typeof val === "string") {
+    if (val.trim() === "") return void 0;
+    const num = Number(val);
+    return isNaN(num) ? val : num;
+  }
+  return val;
+};
+var JsonInsertOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  rowsAffected: z.number().optional(),
+  warning: z.string().optional(),
+  lastInsertRowid: z.number().optional()
 }).extend(ErrorResponseFields.shape);
 var JsonUpdateOutputSchema = z.object({
   success: z.boolean(),
@@ -4702,7 +4353,7 @@ function createJsonExtractTool(adapter) {
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
-          values: result.rows?.map((r) => r["value"])
+          values: result.rows?.map((r) => parseJsonValue(r["value"]))
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5032,10 +4683,14 @@ function createJsonEachTool(adapter) {
         }
         sql += ` LIMIT ${input.limit}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedElements = result.rows?.map((row) => ({
+          ...row,
+          value: parseJsonValue(row["value"])
+        })) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          elements: result.rows
+          rowCount: parsedElements.length,
+          elements: parsedElements
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5089,10 +4744,17 @@ function createJsonGroupArrayTool(adapter) {
         }
         sql += groupByClause;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows ?? []
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5144,10 +4806,17 @@ function createJsonGroupObjectTool(adapter) {
           }
           const sql2 = `SELECT ${outerSelect} FROM (${subquery})${outerGroupBy}`;
           const result2 = await adapter.executeReadQuery(sql2, queryParams);
+          const parsedRows2 = result2.rows?.map((row) => {
+            const parsedRow = {};
+            for (const [key, value] of Object.entries(row)) {
+              parsedRow[key] = parseJsonValue(value);
+            }
+            return parsedRow;
+          }) ?? [];
           return {
             success: true,
-            rowCount: result2.rows?.length ?? 0,
-            rows: result2.rows ?? []
+            rowCount: parsedRows2.length,
+            rows: parsedRows2
           };
         }
         if (!input.valueColumn) {
@@ -5187,10 +4856,17 @@ function createJsonGroupObjectTool(adapter) {
         }
         sql += groupByClause;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows ?? [],
+          rowCount: parsedRows.length,
+          rows: parsedRows,
           ...duplicateKeyWarning && { hint: duplicateKeyWarning }
         };
       } catch (error) {
@@ -5200,124 +4876,6 @@ function createJsonGroupObjectTool(adapter) {
   };
 }
 
-// src/adapters/sqlite/json-utils.ts
-var DEFAULT_NORMALIZATION_OPTIONS = {
-  sortKeys: true,
-  compact: true,
-  unicodeNormalize: true,
-  typeCoercion: false,
-  duplicateKeys: "last"
-};
-function normalizeJson(value, options = {}) {
-  const opts = { ...DEFAULT_NORMALIZATION_OPTIONS, ...options };
-  const changes = [];
-  let parsed;
-  if (typeof value === "string") {
-    try {
-      parsed = JSON.parse(value);
-    } catch {
-      return {
-        normalized: value,
-        wasModified: false,
-        changes: ["Input is not valid JSON"]
-      };
-    }
-  } else {
-    parsed = value;
-  }
-  const normalized = normalizeValue(parsed, opts, changes, "");
-  const normalizedStr = opts.compact ? JSON.stringify(normalized) : JSON.stringify(normalized, null, 2);
-  const originalStr = typeof value === "string" ? value : JSON.stringify(value);
-  const wasModified = normalizedStr !== originalStr;
-  return {
-    normalized: normalizedStr,
-    wasModified,
-    changes
-  };
-}
-function normalizeValue(value, options, changes, path3) {
-  if (value === null || value === void 0) {
-    return null;
-  }
-  if (typeof value === "string") {
-    let result = value;
-    if (options.unicodeNormalize && value !== value.normalize("NFC")) {
-      result = result.normalize("NFC");
-      changes.push(`${path3 || "$"}: Unicode normalized`);
-    }
-    if (options.typeCoercion) {
-      if (result.toLowerCase() === "true") {
-        changes.push(`${path3 || "$"}: Coerced "true" to boolean`);
-        return true;
-      }
-      if (result.toLowerCase() === "false") {
-        changes.push(`${path3 || "$"}: Coerced "false" to boolean`);
-        return false;
-      }
-      const num = Number(result);
-      if (!isNaN(num) && result.trim() !== "") {
-        changes.push(`${path3 || "$"}: Coerced "${result}" to number`);
-        return num;
-      }
-    }
-    return result;
-  }
-  if (typeof value === "number" || typeof value === "boolean") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.map(
-      (item, index) => normalizeValue(item, options, changes, `${path3 || "$"}[${index}]`)
-    );
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    let keys = Object.keys(obj);
-    if (options.sortKeys) {
-      const originalOrder = keys.join(",");
-      keys = keys.sort();
-      if (keys.join(",") !== originalOrder) {
-        changes.push(`${path3 || "$"}: Keys sorted`);
-      }
-    }
-    const result = {};
-    for (const key of keys) {
-      result[key] = normalizeValue(
-        obj[key],
-        options,
-        changes,
-        `${path3 || "$"}.${key}`
-      );
-    }
-    return result;
-  }
-  return value;
-}
-var jsonbSupportedCache = null;
-function isJsonbSupportedVersion(versionString) {
-  const versionRegex = /^(\d+)\.(\d+)\.?(\d+)?/;
-  const match = versionRegex.exec(versionString);
-  if (!match) return false;
-  const major = parseInt(match[1] ?? "0", 10);
-  const minor = parseInt(match[2] ?? "0", 10);
-  return major > 3 || major === 3 && minor >= 45;
-}
-function isJsonbSupported() {
-  return jsonbSupportedCache ?? false;
-}
-function setJsonbSupported(supported) {
-  jsonbSupportedCache = supported;
-}
-function detectJsonStorageFormat(value) {
-  if (value instanceof Buffer || value instanceof Uint8Array) {
-    return "jsonb";
-  }
-  if (typeof value === "string") {
-    return "text";
-  }
-  return "unknown";
-}
-
 // src/adapters/sqlite/tools/json-operations/transform.ts
 function createJsonPrettyTool() {
   return {
@@ -5616,7 +5174,7 @@ function createJsonSecurityScanTool(adapter) {
         const issueMap = /* @__PURE__ */ new Map();
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -5877,10 +5435,17 @@ function createJsonSelectTool(adapter) {
         }
         sql += ` LIMIT ${input.limit ?? 100}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5937,10 +5502,17 @@ function createJsonQueryTool(adapter) {
         }
         sql += ` LIMIT ${input.limit ?? 100}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -6010,7 +5582,7 @@ function createAnalyzeJsonSchemaTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -6354,6 +5926,18 @@ var VALID_VALIDATE_PATTERNS = [
 var VALID_PHONETIC_ALGORITHMS = ["soundex", "metaphone"];
 var VALID_TRIM_MODES = ["both", "left", "right"];
 var VALID_SEARCH_TECHNIQUES = ["exact", "fuzzy", "phonetic"];
+function sanitizeFtsQuery(query) {
+  if (!query) return "";
+  let clean = query.replace(/\s+/g, " ").trim();
+  const quoteCount = (clean.match(/"/g) ?? []).length;
+  if (quoteCount % 2 !== 0) {
+    clean = clean.replace(/"/g, "");
+  }
+  clean = clean.replace(/^(?:\s*(?:AND|OR|NOT))+(?=\s|$)/i, "");
+  clean = clean.replace(/(?:^|\s)(?:AND|OR|NOT)(?:\s+(?:AND|OR|NOT))*$/i, "");
+  clean = clean.replace(/(?:\s+(?:AND|OR|NOT)){2,}\s+/gi, " AND ");
+  return clean.trim();
+}
 var coerceNumber3 = (val) => {
   if (typeof val === "string") {
     if (val.trim() === "") return void 0;
@@ -6460,6 +6044,20 @@ var AdvancedSearchOutputSchema = z.object({
       bestScore: z.number(),
       bestType: z.string()
     })
+  ).optional(),
+  facets: z.record(z.string(), z.number()).optional()
+}).extend(ErrorResponseFields.shape);
+var HybridSearchOutputSchema = z.object({
+  success: z.boolean(),
+  query: z.string().optional(),
+  matchCount: z.number().optional(),
+  results: z.array(
+    z.object({
+      rowid: z.number().optional(),
+      rrfScore: z.number().optional(),
+      ftsRank: z.number().nullable().optional(),
+      vectorSimilarity: z.number().nullable().optional()
+    }).loose()
   ).optional()
 }).extend(ErrorResponseFields.shape);
 var SentimentResultItemSchema = z.object({
@@ -6630,7 +6228,20 @@ var AdvancedSearchSchema = z.object({
   ),
   conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE conditions"),
   whereClause: z.string().optional().describe("Deprecated: Use conditions instead"),
-  limit: z.preprocess(coerceNumber3, z.number().optional().default(100))
+  limit: z.preprocess(coerceNumber3, z.number().optional().default(100)),
+  includeFacets: z.boolean().optional().default(false).describe("Return match counts per type")
+});
+var HybridSearchSchema = z.object({
+  table: z.string().describe("Table name"),
+  query: z.string().describe("Text search query (FTS5)"),
+  vectorColumn: z.string().describe("Vector column to search"),
+  queryVector: z.array(z.number()).describe("Vector embedding of the query"),
+  limit: z.preprocess(coerceNumber3, z.number().optional().default(100)),
+  rrfK: z.preprocess(
+    coerceNumber3,
+    z.number().optional().default(60).describe("RRF k constant")
+  ),
+  metric: z.enum(["cosine", "euclidean", "dot"]).optional().default("cosine").describe("Vector similarity metric")
 });
 var TextSentimentSchema = z.object({
   table: z.string().optional().describe("Table name"),
@@ -7189,15 +6800,93 @@ function soundex(word) {
       }
     }
   }
-  return (result + "000").slice(0, 4);
+  return (result + "000").slice(0, 4);
+}
+var VALIDATION_PATTERNS = {
+  email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/,
+  phone: /^[+]?[(]?[0-9]{1,4}[)]?[-\s./0-9]{7,}$/,
+  url: /^https?:\/\/[^\s/$.?#].[^\s]*$/i,
+  uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
+  ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/
+};
+
+// src/adapters/sqlite/tools/vector/helpers.ts
+function cosineSimilarity(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      "validation" /* VALIDATION */
+    );
+  }
+  let dotProd = 0;
+  let normA = 0;
+  let normB = 0;
+  for (let i = 0; i < a.length; i++) {
+    const aVal = a[i] ?? 0;
+    const bVal = b[i] ?? 0;
+    dotProd += aVal * bVal;
+    normA += aVal * aVal;
+    normB += bVal * bVal;
+  }
+  const magnitude = Math.sqrt(normA) * Math.sqrt(normB);
+  return magnitude === 0 ? 0 : dotProd / magnitude;
+}
+function euclideanDistance(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      "validation" /* VALIDATION */
+    );
+  }
+  let sum = 0;
+  for (let i = 0; i < a.length; i++) {
+    const aVal = a[i] ?? 0;
+    const bVal = b[i] ?? 0;
+    const diff = aVal - bVal;
+    sum += diff * diff;
+  }
+  return Math.sqrt(sum);
+}
+function dotProduct(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      "validation" /* VALIDATION */
+    );
+  }
+  let sum = 0;
+  for (let i = 0; i < a.length; i++) {
+    sum += (a[i] ?? 0) * (b[i] ?? 0);
+  }
+  return sum;
+}
+function normalizeVector(v) {
+  const norm = Math.sqrt(v.reduce((sum, x) => sum + x * x, 0));
+  if (norm === 0) return v;
+  return v.map((x) => x / norm);
+}
+function parseVector(value) {
+  if (Array.isArray(value)) {
+    return value.map(Number);
+  }
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed)) {
+        return parsed.map(Number);
+      }
+    } catch {
+    }
+  }
+  throw new DbMcpError(
+    "Invalid vector format",
+    "VECTOR_INVALID",
+    "validation" /* VALIDATION */
+  );
 }
-var VALIDATION_PATTERNS = {
-  email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/,
-  phone: /^[+]?[(]?[0-9]{1,4}[)]?[-\s./0-9]{7,}$/,
-  url: /^https?:\/\/[^\s/$.?#].[^\s]*$/i,
-  uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
-  ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/
-};
 
 // src/adapters/sqlite/tools/text/search.ts
 function createFuzzyMatchTool(adapter) {
@@ -7429,12 +7118,131 @@ function createAdvancedSearchTool(adapter) {
         }
         allMatches.sort((a, b) => b.bestScore - a.bestScore);
         const limited = allMatches.slice(0, input.limit);
+        const facets = {};
+        if (input.includeFacets) {
+          for (const technique of input.techniques) {
+            facets[technique] = 0;
+          }
+          for (const match of allMatches) {
+            facets[match.bestType] = (facets[match.bestType] ?? 0) + 1;
+          }
+        }
         return {
           success: true,
           searchTerm: input.searchTerm,
           techniques: input.techniques,
           matchCount: limited.length,
-          matches: limited
+          matches: limited,
+          ...input.includeFacets ? { facets } : {}
+        };
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+function createHybridSearchTool(adapter) {
+  return {
+    name: "sqlite_hybrid_search",
+    description: "Hybrid search combining full-text search and vector similarity using Reciprocal Rank Fusion (RRF).",
+    group: "text",
+    inputSchema: HybridSearchSchema,
+    outputSchema: HybridSearchOutputSchema,
+    requiredScopes: ["read"],
+    annotations: readOnly("Hybrid Search"),
+    handler: async (params, _context) => {
+      try {
+        const input = HybridSearchSchema.parse(params);
+        const table = sanitizeIdentifier(input.table);
+        const vectorColumn = sanitizeIdentifier(input.vectorColumn);
+        await validateColumnExists(adapter, input.table, input.vectorColumn);
+        let textResults = [];
+        try {
+          const sanitizedQuery = sanitizeFtsQuery(input.query);
+          if (sanitizedQuery) {
+            const queryEscaped = sanitizedQuery.replace(/'/g, "''");
+            const ftsSql = `SELECT rowid as id, rank as score FROM ${table} WHERE ${table} MATCH '${queryEscaped}' ORDER BY rank LIMIT 1000`;
+            const result = await adapter.executeReadQuery(ftsSql, []);
+            textResults = (result.rows ?? []).map((r, i) => ({
+              id: Number(r["id"] ?? r["rowid"]),
+              rank: i + 1
+            }));
+          }
+        } catch {
+        }
+        const vecSql = `SELECT rowid as id, ${vectorColumn} as vec FROM ${table} WHERE ${vectorColumn} IS NOT NULL LIMIT 10000`;
+        const vecResult = await adapter.executeReadQuery(vecSql, []);
+        const queryVector = input.queryVector;
+        const vecScored = [];
+        for (const row of vecResult.rows ?? []) {
+          try {
+            const storedVector = parseVector(row["vec"]);
+            let score;
+            switch (input.metric) {
+              case "euclidean":
+                score = 1 / (1 + euclideanDistance(queryVector, storedVector));
+                break;
+              case "dot":
+                score = dotProduct(queryVector, storedVector);
+                break;
+              case "cosine":
+              default:
+                score = cosineSimilarity(queryVector, storedVector);
+                break;
+            }
+            vecScored.push({ id: Number(row["id"] ?? row["rowid"]), score });
+          } catch {
+          }
+        }
+        vecScored.sort((a, b) => b.score - a.score);
+        const vectorResults = vecScored.map((r, i) => ({
+          id: r.id,
+          rank: i + 1,
+          score: r.score
+        }));
+        const combined = /* @__PURE__ */ new Map();
+        const k = input.rrfK;
+        for (const f of textResults) {
+          if (!combined.has(f.id)) {
+            combined.set(f.id, {
+              id: f.id,
+              rrfScore: 0,
+              ftsRank: null,
+              vectorSimilarity: null
+            });
+          }
+          const entry = combined.get(f.id);
+          if (entry) {
+            entry.ftsRank = f.rank;
+            entry.rrfScore += 1 / (k + f.rank);
+          }
+        }
+        for (const v of vectorResults) {
+          if (!combined.has(v.id)) {
+            combined.set(v.id, {
+              id: v.id,
+              rrfScore: 0,
+              ftsRank: null,
+              vectorSimilarity: null
+            });
+          }
+          const entry = combined.get(v.id);
+          if (entry) {
+            entry.vectorSimilarity = v.score;
+            entry.rrfScore += 1 / (k + v.rank);
+          }
+        }
+        const sortedCombined = Array.from(combined.values()).sort((a, b) => b.rrfScore - a.rrfScore).slice(0, input.limit).map((r) => ({
+          rowid: r.id,
+          rrfScore: Math.round(r.rrfScore * 1e4) / 1e4,
+          ftsRank: r.ftsRank,
+          vectorSimilarity: r.vectorSimilarity !== null ? Math.round(r.vectorSimilarity * 1e4) / 1e4 : null
+        }));
+        return {
+          success: true,
+          query: input.query,
+          matchCount: sortedCombined.length,
+          results: sortedCombined
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -7768,6 +7576,7 @@ function getTextTools(adapter) {
     createTextNormalizeTool(adapter),
     createTextValidateTool(adapter),
     createAdvancedSearchTool(adapter),
+    createHybridSearchTool(adapter),
     createTextSentimentTool(adapter)
   ];
 }
@@ -11754,84 +11563,6 @@ function createVectorDeleteTool(adapter) {
   };
 }
 
-// src/adapters/sqlite/tools/vector/helpers.ts
-function cosineSimilarity(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let dotProd = 0;
-  let normA = 0;
-  let normB = 0;
-  for (let i = 0; i < a.length; i++) {
-    const aVal = a[i] ?? 0;
-    const bVal = b[i] ?? 0;
-    dotProd += aVal * bVal;
-    normA += aVal * aVal;
-    normB += bVal * bVal;
-  }
-  const magnitude = Math.sqrt(normA) * Math.sqrt(normB);
-  return magnitude === 0 ? 0 : dotProd / magnitude;
-}
-function euclideanDistance(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let sum = 0;
-  for (let i = 0; i < a.length; i++) {
-    const aVal = a[i] ?? 0;
-    const bVal = b[i] ?? 0;
-    const diff = aVal - bVal;
-    sum += diff * diff;
-  }
-  return Math.sqrt(sum);
-}
-function dotProduct(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let sum = 0;
-  for (let i = 0; i < a.length; i++) {
-    sum += (a[i] ?? 0) * (b[i] ?? 0);
-  }
-  return sum;
-}
-function normalizeVector(v) {
-  const norm = Math.sqrt(v.reduce((sum, x) => sum + x * x, 0));
-  if (norm === 0) return v;
-  return v.map((x) => x / norm);
-}
-function parseVector(value) {
-  if (Array.isArray(value)) {
-    return value.map(Number);
-  }
-  if (typeof value === "string") {
-    try {
-      const parsed = JSON.parse(value);
-      if (Array.isArray(parsed)) {
-        return parsed.map(Number);
-      }
-    } catch {
-    }
-  }
-  throw new DbMcpError(
-    "Invalid vector format",
-    "VECTOR_INVALID",
-    "validation" /* VALIDATION */
-  );
-}
-
 // src/adapters/sqlite/tools/vector/search.ts
 function createVectorSearchTool(adapter) {
   return {
@@ -11880,7 +11611,7 @@ function createVectorSearchTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -12059,7 +11790,7 @@ function createVectorStatsTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           try {
             const row = rows[i];
@@ -13273,9 +13004,9 @@ function createDumpTool(adapter) {
           }
         }
         stream.write("COMMIT;\n");
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve3, reject) => {
           stream.end(
-            (err) => err ? reject(err) : resolve4()
+            (err) => err ? reject(err) : resolve3()
           );
         });
       } catch (err) {
@@ -13521,10 +13252,10 @@ function createPragmaDatabaseListTool(adapter) {
           };
         });
         const configuredPath = adapter.getConfiguredPath();
-        const normalize2 = (p) => p.replace(/\\/g, "/");
+        const normalize = (p) => p.replace(/\\/g, "/");
         const mainDb = databases.find((db) => db.name === "main");
         const internalPathDiffers = Boolean(
-          mainDb?.file && normalize2(mainDb.file) !== normalize2(configuredPath.split(/[\\/]/).pop() ?? "")
+          mainDb?.file && normalize(mainDb.file) !== normalize(configuredPath.split(/[\\/]/).pop() ?? "")
         );
         return {
           success: true,
@@ -13702,46 +13433,6 @@ function createPragmaTableInfoTool(adapter) {
     }
   };
 }
-function createAppendInsightTool() {
-  return {
-    name: "sqlite_append_insight",
-    description: "Add a business insight to the memo://insights resource. Use this to capture key findings during data analysis.",
-    group: "admin",
-    inputSchema: AppendInsightSchema,
-    outputSchema: AppendInsightOutputSchema,
-    requiredScopes: ["write"],
-    annotations: write("Append Insight"),
-    handler: (_params, _context) => {
-      try {
-        const input = AppendInsightSchema.parse(_params);
-        let sanitizedInsight = input.insight.replace(/[<>]/g, "");
-        if (sanitizedInsight.length > 500) {
-          sanitizedInsight = sanitizedInsight.substring(0, 500) + "...";
-        }
-        if (!sanitizedInsight || sanitizedInsight.trim().length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "Insight must be a non-empty string",
-            message: "",
-            insightCount: insightsManager.count()
-          });
-        }
-        insightsManager.append(sanitizedInsight);
-        return Promise.resolve({
-          success: true,
-          message: "Insight added to memo",
-          insightCount: insightsManager.count()
-        });
-      } catch (error) {
-        return Promise.resolve({
-          ...formatHandlerError(error),
-          message: "",
-          insightCount: insightsManager.count()
-        });
-      }
-    }
-  };
-}
 function createAttachDatabaseTool(adapter) {
   return {
     name: "sqlite_attach_database",
@@ -13990,7 +13681,6 @@ function getAdminTools(adapter) {
     createPragmaOptimizeTool(adapter),
     createPragmaSettingsTool(adapter),
     createPragmaTableInfoTool(adapter),
-    createAppendInsightTool(),
     createAttachDatabaseTool(adapter),
     createDetachDatabaseTool(adapter),
     createVacuumIntoTool(adapter),
@@ -14262,7 +13952,8 @@ var IndexAuditOutputSchema = z.object({
       type: z.enum([
         "redundant",
         "missing_fk_index",
-        "unindexed_large_table"
+        "unindexed_large_table",
+        "missing_composite_index"
       ]),
       severity: z.enum(["info", "warning", "error"]),
       table: z.string(),
@@ -14315,23 +14006,6 @@ var coerceNumber8 = (val) => {
   }
   return val;
 };
-var VALID_SECTIONS = ["tables", "views", "indexes", "triggers"];
-var coerceSections = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_SECTIONS.includes(v)
-) : val;
-var VALID_CHECKS = [
-  "missing_pk",
-  "missing_not_null",
-  "unindexed_fk",
-  "missing_fk"
-];
-var coerceChecks = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_CHECKS.includes(v)
-) : val;
-var VALID_DIRECTIONS = ["create", "drop"];
-var coerceDirection = (val) => typeof val === "string" && VALID_DIRECTIONS.includes(val) ? val : typeof val === "string" ? void 0 : val;
-var VALID_OPERATIONS = ["DELETE", "DROP", "TRUNCATE"];
-var coerceOperation = (val) => typeof val === "string" && VALID_OPERATIONS.includes(val) ? val : typeof val === "string" ? void 0 : val;
 var StorageAnalysisSchema = z.object({
   includeTableDetails: z.boolean().optional().describe("Include per-table size breakdown (default: true)"),
   excludeSystemTables: z.boolean().optional().describe(
@@ -14350,13 +14024,16 @@ var IndexAuditSchema = z.object({
   ),
   minSeverity: z.enum(["info", "warning", "error"]).optional().describe(
     "Minimum severity to include in findings (default: all). Reduces payload for large databases."
+  ),
+  recommendComposite: z.boolean().optional().default(false).describe(
+    "Analyze queriesToAnalyze to recommend composite/partial indexes"
+  ),
+  queriesToAnalyze: z.array(z.string()).optional().describe(
+    "Queries to analyze using EXPLAIN QUERY PLAN (used if recommendComposite is true)"
   )
-}).default({});
+}).default({ recommendComposite: false });
 var SchemaSnapshotSchema = z.object({
-  sections: z.preprocess(
-    coerceSections,
-    z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional()
-  ).describe("Specific sections to include (default: all)"),
+  sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Specific sections to include (default: all)"),
   compact: z.boolean().optional().describe(
     "Omit column details from tables section for reduced payload (default: false)"
   ),
@@ -14369,17 +14046,14 @@ var MigrationRisksSchema = z.object({
 }).default({ statements: [] });
 var ConstraintAnalysisSchema = z.object({
   table: z.string().optional().describe("Analyze constraints for a specific table only"),
-  checks: z.preprocess(
-    coerceChecks,
-    z.array(
-      z.enum([
-        "missing_pk",
-        "missing_not_null",
-        "unindexed_fk",
-        "missing_fk"
-      ])
-    ).optional()
-  ).describe("Specific checks to run (default: all)"),
+  checks: z.array(
+    z.enum([
+      "missing_pk",
+      "missing_not_null",
+      "unindexed_fk",
+      "missing_fk"
+    ])
+  ).optional().describe("Specific checks to run (default: all)"),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables from constraint analysis (default: true)"
   )
@@ -14394,7 +14068,7 @@ var DependencyGraphSchema = z.object({
   )
 }).default({});
 var TopologicalSortSchema = z.object({
-  direction: z.preprocess(coerceDirection, z.enum(["create", "drop"]).optional()).describe(
+  direction: z.enum(["create", "drop"]).optional().describe(
     "Sort direction: 'create' = dependencies first, 'drop' = dependents first (default: create)"
   ),
   excludeSystemTables: z.boolean().optional().describe(
@@ -14403,10 +14077,7 @@ var TopologicalSortSchema = z.object({
 }).default({});
 var CascadeSimulatorSchema = z.object({
   table: z.string().optional().default("").describe("Table name to simulate deletion from"),
-  operation: z.preprocess(
-    coerceOperation,
-    z.enum(["DELETE", "DROP", "TRUNCATE"]).optional()
-  ).describe("Operation to simulate (default: DELETE)"),
+  operation: z.enum(["DELETE", "DROP", "TRUNCATE"]).optional().describe("Operation to simulate (default: DELETE)"),
   compact: z.boolean().optional().describe(
     "Omit path arrays from affected entries to reduce payload (default: false)"
   )
@@ -14472,10 +14143,6 @@ var SchemaDiffOutputSchema = z.object({
   }).optional(),
   comparedAt: z.string().optional()
 }).extend(ErrorResponseFields.shape);
-var VALID_DIFF_SECTIONS = ["tables", "views", "indexes", "triggers"];
-var coerceDiffSections = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_DIFF_SECTIONS.includes(v)
-) : val;
 var SchemaDiffSchema = z.object({
   baseline: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
     "Baseline schema \u2014 'current' to snapshot live DB, or an inline snapshot object from a previous sqlite_schema_snapshot call"
@@ -14483,10 +14150,7 @@ var SchemaDiffSchema = z.object({
   target: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
     "Target schema to compare against baseline \u2014 'current' to snapshot live DB, or an inline snapshot object"
   ),
-  sections: z.preprocess(
-    coerceDiffSections,
-    z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional()
-  ).describe("Sections to compare (default: all)"),
+  sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Sections to compare (default: all)"),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables when capturing live schema (default: true)"
   )
@@ -15845,6 +15509,35 @@ function createIndexAuditTool(adapter) {
           } catch {
           }
         }
+        if (input.recommendComposite && input.queriesToAnalyze && input.queriesToAnalyze.length > 0) {
+          for (const query of input.queriesToAnalyze) {
+            try {
+              if (/^\s*SELECT/i.test(query)) {
+                const planResult = await adapter.executeReadQuery(
+                  `EXPLAIN QUERY PLAN ${query}`
+                );
+                const planRows = planResult.rows ?? [];
+                for (const row of planRows) {
+                  const detailVal = row["detail"];
+                  const detail = typeof detailVal === "string" ? detailVal : "";
+                  if (detail.startsWith("SCAN TABLE") || detail.startsWith("SCAN ")) {
+                    const match = /SCAN (?:TABLE )?([\w_]+)/i.exec(detail);
+                    const tableName = match ? match[1] : "unknown";
+                    if (tableName && tableName !== "unknown") {
+                      findings.push({
+                        type: "missing_composite_index",
+                        severity: "warning",
+                        table: tableName,
+                        suggestion: `Query resulted in SCAN TABLE "${tableName}". Consider analyzing WHERE/JOIN clauses to add a composite index.`
+                      });
+                    }
+                  }
+                }
+              }
+            } catch {
+            }
+          }
+        }
         const redundantCount = findings.filter(
           (f) => f.type === "redundant"
         ).length;
@@ -16909,6 +16602,7 @@ var POSITIONAL_PARAM_MAP = {
   jsonbConvert: ["table", "column"],
   createJsonCollection: "tableName",
   // Text
+  sentiment: "text",
   regexExtract: ["table", "column", "pattern"],
   regexMatch: ["table", "column", "pattern"],
   split: ["table", "column", "delimiter"],
@@ -16966,7 +16660,6 @@ var POSITIONAL_PARAM_MAP = {
   pragmaSettings: "pragma",
   pragmaTableInfo: "table",
   pragmaCompileOptions: "filter",
-  appendInsight: "insight",
   generateSeries: ["start", "stop", "step"],
   createView: ["viewName", "selectQuery"],
   dropView: "viewName",
@@ -17699,94 +17392,97 @@ var CodeModeSandbox = class _CodeModeSandbox {
     const isolate = new ivmLib.Isolate({
       memoryLimit: this.options.memoryLimitMb
     });
-    const context = isolate.createContextSync();
-    const jail = context.global;
-    jail.setSync("global", jail.derefInto());
-    const logs = [];
-    const logRef = new ivmLib.Reference((level, ...args) => {
-      const msg = args.map(
-        (a) => typeof a === "object" && a !== null ? JSON.stringify(a) : String(a)
-      ).join(" ");
-      logs.push(level === "LOG" ? msg : `[${level}] ${msg}`);
-    });
-    context.global.setSync("logRef", logRef);
-    const setupScript = `
-      globalThis.console = {
-        log: (...args) => logRef.applyIgnored(undefined, ['LOG', ...args], { arguments: { copy: true } }),
-        error: (...args) => logRef.applyIgnored(undefined, ['ERROR', ...args], { arguments: { copy: true } }),
-        warn: (...args) => logRef.applyIgnored(undefined, ['WARN', ...args], { arguments: { copy: true } }),
-        info: (...args) => logRef.applyIgnored(undefined, ['INFO', ...args], { arguments: { copy: true } }),
-        debug: (...args) => logRef.applyIgnored(undefined, ['DEBUG', ...args], { arguments: { copy: true } })
-      };
-      globalThis.sqlite = {};
-    `;
-    context.evalSync(setupScript);
-    let rpcCount = 0;
-    const MAX_RPC_CALLS = 100;
+    let context;
+    let logRef;
+    let script;
     const refCleanup = [];
-    for (const [groupName, groupValue] of Object.entries(apiBindings)) {
-      if (typeof groupValue === "object" && groupValue !== null) {
-        context.evalSync(
-          `globalThis.sqlite[${JSON.stringify(groupName)}] = {};`
-        );
-        for (const [methodName, methodFn] of Object.entries(groupValue)) {
-          if (typeof methodFn === "function") {
-            const fnRef = new ivmLib.Reference(async (...args) => {
-              if (++rpcCount > MAX_RPC_CALLS) {
-                throw new Error(
-                  `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
-                );
-              }
-              try {
-                return await methodFn(...args);
-              } catch (e) {
-                throw new Error(e instanceof Error ? e.message : String(e), {
-                  cause: e
-                });
-              }
-            });
-            refCleanup.push(fnRef);
-            const refName = `fnRef_${groupName}_${methodName}`;
-            context.global.setSync(refName, fnRef);
-            context.evalSync(`
-              globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
-                return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
-              };
-            `);
-          }
-        }
-      } else if (typeof groupValue === "function") {
-        const fnRef = new ivmLib.Reference(async (...args) => {
-          if (++rpcCount > MAX_RPC_CALLS) {
-            throw new Error(
-              `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
-            );
-          }
-          try {
-            return await groupValue(...args);
-          } catch (e) {
-            throw new Error(e instanceof Error ? e.message : String(e), {
-              cause: e
-            });
-          }
-        });
-        refCleanup.push(fnRef);
-        const refName = `fnRef_${groupName}`;
-        context.global.setSync(refName, fnRef);
-        context.evalSync(`
-          globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
-            return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
-          };
-        `);
-      }
-    }
+    const logs = [];
     const startTime = performance.now();
     let result;
     let success = true;
     let errorMsg;
     try {
+      context = isolate.createContextSync();
+      const jail = context.global;
+      jail.setSync("global", jail.derefInto());
+      logRef = new ivmLib.Reference((level, ...args) => {
+        const msg = args.map(
+          (a) => typeof a === "object" && a !== null ? JSON.stringify(a) : String(a)
+        ).join(" ");
+        logs.push(level === "LOG" ? msg : `[${level}] ${msg}`);
+      });
+      context.global.setSync("logRef", logRef);
+      const setupScript = `
+        globalThis.console = {
+          log: (...args) => logRef.applyIgnored(undefined, ['LOG', ...args], { arguments: { copy: true } }),
+          error: (...args) => logRef.applyIgnored(undefined, ['ERROR', ...args], { arguments: { copy: true } }),
+          warn: (...args) => logRef.applyIgnored(undefined, ['WARN', ...args], { arguments: { copy: true } }),
+          info: (...args) => logRef.applyIgnored(undefined, ['INFO', ...args], { arguments: { copy: true } }),
+          debug: (...args) => logRef.applyIgnored(undefined, ['DEBUG', ...args], { arguments: { copy: true } })
+        };
+        globalThis.sqlite = {};
+      `;
+      context.evalSync(setupScript);
+      let rpcCount = 0;
+      const MAX_RPC_CALLS = 100;
+      for (const [groupName, groupValue] of Object.entries(apiBindings)) {
+        if (typeof groupValue === "object" && groupValue !== null) {
+          context.evalSync(
+            `globalThis.sqlite[${JSON.stringify(groupName)}] = {};`
+          );
+          for (const [methodName, methodFn] of Object.entries(groupValue)) {
+            if (typeof methodFn === "function") {
+              const fnRef = new ivmLib.Reference(async (...args) => {
+                if (++rpcCount > MAX_RPC_CALLS) {
+                  throw new Error(
+                    `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
+                  );
+                }
+                try {
+                  return await methodFn(...args);
+                } catch (e) {
+                  throw new Error(e instanceof Error ? e.message : String(e), {
+                    cause: e
+                  });
+                }
+              });
+              refCleanup.push(fnRef);
+              const refName = `fnRef_${groupName}_${methodName}`;
+              context.global.setSync(refName, fnRef);
+              context.evalSync(`
+                globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
+                  return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
+                };
+              `);
+            }
+          }
+        } else if (typeof groupValue === "function") {
+          const fnRef = new ivmLib.Reference(async (...args) => {
+            if (++rpcCount > MAX_RPC_CALLS) {
+              throw new Error(
+                `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
+              );
+            }
+            try {
+              return await groupValue(...args);
+            } catch (e) {
+              throw new Error(e instanceof Error ? e.message : String(e), {
+                cause: e
+              });
+            }
+          });
+          refCleanup.push(fnRef);
+          const refName = `fnRef_${groupName}`;
+          context.global.setSync(refName, fnRef);
+          context.evalSync(`
+            globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
+              return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
+            };
+          `);
+        }
+      }
       const wrappedCode = `(async () => { ${transformAutoReturn(code)} })()`;
-      const script = isolate.compileScriptSync(wrappedCode, {
+      script = isolate.compileScriptSync(wrappedCode, {
         filename: `code-mode.js`
       });
       result = await script.run(context, {
@@ -17799,11 +17495,27 @@ var CodeModeSandbox = class _CodeModeSandbox {
       errorMsg = error instanceof Error ? error.message : String(error);
     } finally {
       for (const ref of refCleanup) {
-        ref.release();
+        try {
+          ref.release();
+        } catch {
+        }
+      }
+      try {
+        logRef?.release();
+      } catch {
+      }
+      try {
+        script?.release();
+      } catch {
+      }
+      try {
+        context?.release();
+      } catch {
+      }
+      try {
+        isolate.dispose();
+      } catch {
       }
-      logRef.release();
-      context.release();
-      isolate.dispose();
     }
     const endTime = performance.now();
     this.accumulatedLogs.push(...logs);
@@ -18340,4 +18052,4 @@ function executeGeneral(db, sql, params) {
   }
 }
 
-export { FtsHeadlineSchema, RowRecordSchema, SchemaManager, WhereConditionSchema, applyCommonPragmas, autoEnableWal, buildWhereClause, detectAndSetJsonbSupport, executeGeneral, executeRead, executeWrite, getAdminTools, getCodeModeTools, getCoreTools, getGeoTools, getIntrospectionTools, getJsonHelperTools, getJsonOperationTools, getMigrationTools, getPromptDefinitions, getResourceDefinitions, getStatsTools, getTextTools, getVectorTools, getVirtualTools, isDDL, normalizeSqliteParams, resolveAliases, sanitizeIdentifier, translateSqliteError, validateIdentifier, validateTableExists };
+export { FtsHeadlineSchema, RowRecordSchema, SchemaManager, WhereConditionSchema, applyCommonPragmas, autoEnableWal, detectAndSetJsonbSupport, executeGeneral, executeRead, executeWrite, getAdminTools, getCodeModeTools, getCoreTools, getGeoTools, getIntrospectionTools, getJsonHelperTools, getJsonOperationTools, getMigrationTools, getPromptDefinitions, getResourceDefinitions, getStatsTools, getTextTools, getVectorTools, getVirtualTools, isDDL, normalizeSqliteParams, resolveAliases, sanitizeFtsQuery, translateSqliteError, validateTableExists };