db-mcp 3.0.2 → 5.0.0

package/dist/{chunk-NV34JSQM.js → chunk-UE7GVOBV.js}

@@ -1,10 +1,10 @@
-import { validateQuery } from './chunk-W5WQVNVX.js';
-import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, write, idempotent, destructive, VacuumOutputSchema, admin, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AppendInsightOutputSchema, AppendInsightSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-E5IESRTK.js';
-import { createModuleLogger, logger, ResourceNotFoundError, DbMcpError, formatHandlerError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess } from './chunk-L552U3QS.js';
+import { validateQuery } from './chunk-27C5EE6U.js';
+import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, sanitizeIdentifier, createColumnList, buildWhereClause, buildProgressContext, streamResultRows, write, idempotent, destructive, sanitizeWhereClause, validateJsonPath, validateAggregateFunction, VacuumOutputSchema, sendProgress, admin, assertSafeIoPath, validateSameDirPath, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-2TYICG7B.js';
+import { createModuleLogger, logger, InternalError, ResourceNotFoundError, DbMcpError, ErrorCategory, formatHandlerError, RateLimitError, TimeoutError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ConflictError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess, AuthorizationError } from './chunk-XLIYO3YA.js';
 import { z } from 'zod';
-import * as path from 'path';
-import path__default, { dirname, resolve, basename, normalize, relative } from 'path';
-import fs, { realpathSync } from 'fs';
+import * as nodePath from 'path';
+import nodePath__default from 'path';
+import fs from 'fs';
 import { createHash } from 'crypto';
 import { createClient } from 'redis';
 import * as acorn from 'acorn';
@@ -41,7 +41,10 @@ var ReadQueryOutputSchema = z.object({
   success: z.boolean(),
   rowCount: z.number().optional(),
   rows: z.array(RowRecordSchema).optional(),
-  executionTimeMs: z.number().optional()
+  nextCursor: z.string().optional(),
+  executionTimeMs: z.number().optional(),
+  streamed: z.boolean().optional(),
+  chunksEmitted: z.number().optional()
 }).extend(ErrorResponseFields.shape);
 var WriteQueryOutputSchema = z.object({
   success: z.boolean(),
@@ -122,12 +125,22 @@ var DateMathOutputSchema = z.object({
 var ReadQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("SELECT query to execute"),
   sql: z.string().max(1e5).optional().describe("Alias for query"),
-  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements")
+  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements"),
+  cursor: z.string().optional().describe("Opaque cursor for pagination"),
+  stream: z.boolean().optional().default(false).describe(
+    "Stream results row-by-row via MCP progress notifications instead of returning all rows in the response. Requires a progressToken in the request _meta. Falls back to normal behavior if unavailable. The final response contains rowCount and metadata but not the rows themselves."
+  ),
+  chunkSize: z.number().int().positive().optional().describe(
+    "When streaming, the number of rows to include in each progress notification chunk (default 10)"
+  )
 });
 var WriteQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("INSERT/UPDATE/DELETE query to execute"),
   sql: z.string().max(1e5).optional().describe("Alias for query"),
-  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements")
+  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements"),
+  expectedVersion: z.number().int().positive().optional().describe(
+    "If set and rowsAffected is 0, throws ConflictError instead of returning silently. Use with manual WHERE _version = ? guards."
+  )
 });
 var CreateTableSchema = z.object({
   table: z.string().default("").describe("Name of the table to create"),
@@ -242,7 +255,10 @@ var UpsertSchema = z.object({
   updateColumns: z.array(z.string()).optional().describe(
     "Columns to update on conflict (default: all except conflict columns). Only used if conflictColumns is provided."
   ),
-  returning: z.union([z.boolean(), z.array(z.string())]).optional().describe("Columns to return, or true for all columns")
+  returning: z.union([z.boolean(), z.array(z.string())]).optional().describe("Columns to return, or true for all columns"),
+  expectedVersion: z.number().int().positive().optional().describe(
+    "Expected _version value for optimistic concurrency control. Requires conflictColumns and a versioned table."
+  )
 });
 var BatchInsertSchema = z.object({
   table: z.string().default("").describe("Table name"),
@@ -348,9 +364,64 @@ var DropTriggerOutputSchema = z.object({
   success: z.boolean(),
   message: z.string().optional()
 }).extend(ErrorResponseFields.shape);
-function resolveAliases(params, aliasMap) {
+var EnableVersioningSchema = z.object({
+  table: z.string().describe("Name of the table to enable versioning for"),
+  tableName: z.string().optional().describe("Alias for table")
+});
+var EnableVersioningOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  sql: z.string().optional(),
+  alreadyEnabled: z.boolean().optional()
+}).extend(ErrorResponseFields.shape);
+var DisableVersioningSchema = z.object({
+  table: z.string().describe("Name of the table to disable versioning for"),
+  tableName: z.string().optional().describe("Alias for table"),
+  ifExists: z.boolean().optional().default(false)
+});
+var DisableVersioningOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  sql: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var CheckVersionSchema = z.object({
+  table: z.string().describe("Table name"),
+  tableName: z.string().optional().describe("Alias for table"),
+  rowId: z.union([z.number(), z.string()]).describe("Primary key or rowid value of the row"),
+  idColumn: z.string().optional().describe("Name of the primary key column (default: 'rowid')")
+});
+var CheckVersionOutputSchema = z.object({
+  success: z.boolean(),
+  version: z.number().optional(),
+  row: RowRecordSchema.optional()
+}).extend(ErrorResponseFields.shape);
+var ConditionalUpdateSchema = z.object({
+  table: z.string().describe("Table name"),
+  tableName: z.string().optional().describe("Alias for table"),
+  data: z.record(z.string(), z.unknown()).describe("Column-value pairs to update"),
+  conditions: z.array(WhereConditionSchema).describe("WHERE conditions to locate the row (e.g. id = 1)"),
+  expectedVersion: z.number().int().positive().describe("The _version value expected to be currently in the database")
+});
+var ConditionalUpdateOutputSchema = z.object({
+  success: z.boolean(),
+  rowsAffected: z.number().optional(),
+  currentVersion: z.number().optional(),
+  rows: z.array(RowRecordSchema).optional()
+}).extend(ErrorResponseFields.shape);
+function resolveAliases(params, aliasMap = {}) {
   if (typeof params !== "object" || params === null) return params;
-  const obj = params;
+  const obj = { ...params };
+  for (const key of Object.keys(obj)) {
+    if (key.includes("_")) {
+      const camelKey = key.replace(
+        /_([a-z])/g,
+        (_, letter) => letter.toUpperCase()
+      );
+      if (obj[camelKey] === void 0 && obj[key] !== void 0) {
+        obj[camelKey] = obj[key];
+      }
+    }
+  }
   for (const [alias, canonical] of Object.entries(aliasMap)) {
     if ((obj[canonical] === void 0 || obj[canonical] === "") && obj[alias] !== void 0) {
       obj[canonical] = obj[alias];
@@ -541,16 +612,77 @@ function createReadQueryTool(adapter) {
       }
       try {
         let finalQuery = input.query.replace(/[\s;]+$/g, "");
+        let offset = 0;
+        if (input.cursor) {
+          try {
+            const cursorData = JSON.parse(
+              Buffer.from(input.cursor, "base64").toString("utf8")
+            );
+            if (typeof cursorData["offset"] === "number") {
+              offset = cursorData["offset"];
+            }
+          } catch {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  "Invalid cursor format",
+                  "VALIDATION_ERROR",
+                  {
+                    suggestion: "Use the nextCursor value returned from a previous query.",
+                    details: {}
+                  }
+                )
+              ),
+              rowCount: 0,
+              rows: []
+            };
+          }
+        }
         const upperForLimit = finalQuery.toUpperCase();
         const isLimitable = upperForLimit.startsWith("SELECT") || upperForLimit.startsWith("WITH");
-        if (isLimitable && !/\bLIMIT\b/i.test(finalQuery)) {
-          finalQuery = `${finalQuery} LIMIT 50`;
+        const limit = 50;
+        const hasLimit = /\bLIMIT\b/i.test(finalQuery);
+        if (isLimitable && !hasLimit) {
+          finalQuery = `${finalQuery} LIMIT ${limit}`;
+          if (offset > 0) {
+            finalQuery = `${finalQuery} OFFSET ${offset}`;
+          }
+        } else if (isLimitable && hasLimit && offset > 0) {
+          if (!/\bOFFSET\b/i.test(finalQuery)) {
+            finalQuery = `${finalQuery} OFFSET ${offset}`;
+          }
         }
         const result = await adapter.executeReadQuery(finalQuery, input.params);
+        let nextCursor;
+        if (isLimitable && !hasLimit && result.rows?.length === limit) {
+          const nextOffset = offset + limit;
+          nextCursor = Buffer.from(
+            JSON.stringify({ offset: nextOffset })
+          ).toString("base64");
+        }
+        if (input.stream && !_context.isCodeMode) {
+          const progressCtx = buildProgressContext(_context);
+          if (progressCtx) {
+            const chunksEmitted = await streamResultRows(
+              progressCtx,
+              result.rows ?? [],
+              input.chunkSize
+            );
+            return {
+              success: true,
+              rowCount: result.rows?.length ?? 0,
+              nextCursor,
+              executionTimeMs: result.executionTimeMs,
+              streamed: true,
+              chunksEmitted
+            };
+          }
+        }
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
           rows: result.rows,
+          nextCursor,
           executionTimeMs: result.executionTimeMs
         };
       } catch (error) {
@@ -650,11 +782,60 @@ function createWriteQueryTool(adapter) {
           rowsAffected: 0
         };
       }
+      if (input.expectedVersion === void 0) {
+        const tables = [];
+        const tableRegex = /\b(?:UPDATE|INSERT\s+INTO|DELETE\s+FROM|REPLACE\s+INTO)\s+(?:["'`]?([a-zA-Z0-9_]+)["'`]?)\b/gi;
+        let match;
+        while ((match = tableRegex.exec(input.query)) !== null) {
+          if (match[1]) tables.push(match[1]);
+        }
+        for (const tableName of tables) {
+          try {
+            const pragmaCheck = await adapter.executeReadQuery(
+              `PRAGMA table_info(${sanitizeIdentifier(tableName)})`
+            );
+            const isVersioned = (pragmaCheck.rows ?? []).some(
+              (col) => col["name"] === "_version"
+            );
+            if (isVersioned) {
+              return {
+                ...formatHandlerError(
+                  new ConflictError(
+                    `expectedVersion is required when updating versioned table '${tableName}'`,
+                    "CONFLICT_ERROR",
+                    {
+                      conflictType: "missing_expected_version",
+                      suggestion: "Use sqlite_check_version to get the current version, then include expectedVersion in your request."
+                    }
+                  )
+                ),
+                rowsAffected: 0
+              };
+            }
+          } catch {
+          }
+        }
+      }
       try {
         const result = await adapter.executeWriteQuery(
           input.query,
           input.params
         );
+        if (result.rowsAffected === 0 && input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ConflictError(
+                `Version conflict or row not found. expectedVersion ${input.expectedVersion} was provided but 0 rows were affected.`,
+                "CONFLICT_ERROR",
+                {
+                  conflictType: "version_mismatch_or_not_found",
+                  suggestion: "Verify the row exists and the version matches."
+                }
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         return {
           success: true,
           rowsAffected: result.rowsAffected,
@@ -671,477 +852,6 @@ function createWriteQueryTool(adapter) {
   };
 }
 
-// src/utils/where-clause.ts
-var UnsafeWhereClauseError = class extends Error {
-  constructor(reason) {
-    super(`Unsafe WHERE clause: ${reason}`);
-    this.name = "UnsafeWhereClauseError";
-  }
-};
-var DANGEROUS_PATTERNS = [
-  // Statement terminators and new statements
-  // Comprehensive keyword list including statements missed in earlier versions:
-  // REPLACE, VACUUM, ANALYZE, BEGIN, COMMIT, ROLLBACK, SAVEPOINT, RELEASE
-  {
-    pattern: /;\s*(DROP|DELETE|TRUNCATE|INSERT|UPDATE|CREATE|ALTER|ATTACH|DETACH|SELECT|REPLACE|VACUUM|ANALYZE|BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE|REINDEX|EXPLAIN)\b/i,
-    reason: "contains statement terminator followed by SQL keyword"
-  },
-  // Trailing semicolons (potential statement injection)
-  {
-    pattern: /;\s*$/,
-    reason: "contains trailing semicolon"
-  },
-  // SQL comments (can be used to comment out security checks)
-  {
-    pattern: /--/,
-    reason: "contains SQL line comment"
-  },
-  {
-    pattern: /\/\*/,
-    reason: "contains SQL block comment"
-  },
-  // REGEXP and MATCH injection (blind extraction oracles)
-  {
-    pattern: /\bREGEXP\s+/i,
-    reason: "contains REGEXP (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bMATCH\s+/i,
-    reason: "contains MATCH (potential blind extraction oracle)"
-  },
-  // UNION injection (data exfiltration)
-  {
-    pattern: /\bUNION\s+(ALL\s+)?SELECT\b/i,
-    reason: "contains UNION SELECT"
-  },
-  // SQLite-specific: Extension loading (code execution)
-  {
-    pattern: /\bload_extension\s*\(/i,
-    reason: "contains load_extension (code execution)"
-  },
-  // SQLite-specific: ATTACH database (file system access)
-  {
-    pattern: /\bATTACH\s+(DATABASE\s+)?['"`]/i,
-    reason: "contains ATTACH DATABASE (file system access)"
-  },
-  // SQLite-specific: Pragma manipulation
-  {
-    pattern: /\bPRAGMA\s+/i,
-    reason: "contains PRAGMA statement"
-  },
-  // SQLite-specific: writefile/readfile (if using fileio extension)
-  {
-    pattern: /\b(writefile|readfile)\s*\(/i,
-    reason: "contains file I/O function"
-  },
-  // SQLite-specific: fts3_tokenizer (potential code execution)
-  {
-    pattern: /\bfts3_tokenizer\s*\(/i,
-    reason: "contains FTS tokenizer function"
-  },
-  // Subquery injection (data exfiltration via boolean-based blind)
-  {
-    pattern: /\(\s*SELECT\b/i,
-    reason: "contains subquery (potential data exfiltration)"
-  },
-  // Generic: Hexadecimal string injection
-  {
-    pattern: /\bX'[0-9A-Fa-f]+'/,
-    reason: "contains hex string literal (potential binary injection)"
-  },
-  // CASE WHEN (potential blind injection without subqueries)
-  {
-    pattern: /\bCASE\s+WHEN\b/i,
-    reason: "contains CASE WHEN (potential blind injection)"
-  },
-  // IIF() — conditional bypass alternative to CASE WHEN
-  {
-    pattern: /\bIIF\s*\(/i,
-    reason: "contains IIF() (potential blind injection)"
-  },
-  // GROUP_CONCAT() — data aggregation for exfiltration
-  {
-    pattern: /\bGROUP_CONCAT\s*\(/i,
-    reason: "contains GROUP_CONCAT() (potential data exfiltration)"
-  },
-  // GLOB — case-sensitive wildcard operator usable for character extraction oracles
-  {
-    pattern: /\bGLOB\b/i,
-    reason: "contains GLOB (potential case-sensitive oracle)"
-  },
-  // Conditional functions — blind injection oracles (bypass for CASE WHEN / IIF)
-  {
-    pattern: /\bCOALESCE\s*\(/i,
-    reason: "contains COALESCE() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bNULLIF\s*\(/i,
-    reason: "contains NULLIF() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bTYPEOF\s*\(/i,
-    reason: "contains TYPEOF() (potential blind injection oracle)"
-  },
-  {
-    pattern: /\bIFNULL\s*\(/i,
-    reason: "contains IFNULL() (potential blind injection oracle)"
-  },
-  // Memory allocation DoS — RANDOMBLOB(N) / ZEROBLOB(N) can allocate large blocks (CWE-400)
-  {
-    pattern: /\bRANDOMBLOB\s*\(/i,
-    reason: "contains RANDOMBLOB() (potential memory allocation DoS)"
-  },
-  {
-    pattern: /\bZEROBLOB\s*\(/i,
-    reason: "contains ZEROBLOB() (potential memory allocation DoS)"
-  },
-  // Blind extraction oracle functions — can be composed for character-by-character
-  // data extraction without subqueries or CASE WHEN (CWE-89, H-1 audit finding).
-  // Example: INSTR('abc...', SUBSTR(sqlite_version(), 1, 1)) = N
-  {
-    pattern: /\bINSTR\s*\(/i,
-    reason: "contains INSTR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bSUBSTR\s*\(/i,
-    reason: "contains SUBSTR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bSUBSTRING\s*\(/i,
-    reason: "contains SUBSTRING() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bLENGTH\s*\(/i,
-    reason: "contains LENGTH() (potential blind extraction oracle)"
-  },
-  // TRIM functions — blind extraction oracle (bypass for LIKE / SUBSTR)
-  {
-    pattern: /\b(?:L|R)?TRIM\s*\(/i,
-    reason: "contains TRIM() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bUNICODE\s*\(/i,
-    reason: "contains UNICODE() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bCHAR\s*\(/i,
-    reason: "contains CHAR() (potential blind extraction oracle)"
-  },
-  {
-    pattern: /\bREPLACE\s*\(/i,
-    reason: "contains REPLACE() (potential blind extraction oracle)"
-  },
-  // ABS() — can be combined with subtraction to create numeric oracles (CWE-89)
-  {
-    pattern: /\bABS\s*\(/i,
-    reason: "contains ABS() (potential blind extraction oracle)"
-  },
-  // HEX() — encodes values for character-by-character extraction (CWE-89)
-  {
-    pattern: /\bHEX\s*\(/i,
-    reason: "contains HEX() (potential blind extraction oracle)"
-  },
-  // QUOTE() — returns SQL-literal representation, can leak type/value info (CWE-89)
-  {
-    pattern: /\bQUOTE\s*\(/i,
-    reason: "contains QUOTE() (potential blind extraction oracle)"
-  },
-  // PRINTF() — format-string based extraction of internal values (CWE-89)
-  {
-    pattern: /\bPRINTF\s*\(/i,
-    reason: "contains PRINTF() (potential blind extraction oracle)"
-  },
-  // FORMAT() — SQLite 3.38.0+ alias for printf() (CWE-89)
-  {
-    pattern: /\bFORMAT\s*\(/i,
-    reason: "contains FORMAT() (potential blind extraction oracle)"
-  },
-  // CAST() — can be used to convert text to numeric oracles (CWE-89)
-  {
-    pattern: /\bCAST\s*\(/i,
-    reason: "contains CAST() (potential blind extraction oracle)"
-  }
-];
-var FULLWIDTH_START = 65281;
-var FULLWIDTH_END = 65374;
-var FULLWIDTH_ASCII_OFFSET = 65248;
-function normalizeForPatternMatching(input) {
-  let normalized = input.normalize("NFC");
-  let hasFullwidth = false;
-  for (let i = 0; i < normalized.length; i++) {
-    const code = normalized.charCodeAt(i);
-    if (code >= FULLWIDTH_START && code <= FULLWIDTH_END) {
-      hasFullwidth = true;
-      break;
-    }
-  }
-  if (hasFullwidth) {
-    const chars = [];
-    for (let i = 0; i < normalized.length; i++) {
-      const code = normalized.charCodeAt(i);
-      if (code >= FULLWIDTH_START && code <= FULLWIDTH_END) {
-        chars.push(String.fromCharCode(code - FULLWIDTH_ASCII_OFFSET));
-      } else {
-        chars.push(normalized.charAt(i));
-      }
-    }
-    normalized = chars.join("");
-  }
-  return normalized;
-}
-function sanitizeWhereClause(where) {
-  if (!where || typeof where !== "string") {
-    throw new UnsafeWhereClauseError("WHERE clause must be a non-empty string");
-  }
-  const MAX_WHERE_LENGTH = 10240;
-  if (where.length > MAX_WHERE_LENGTH) {
-    throw new UnsafeWhereClauseError(
-      `WHERE clause exceeds maximum length of ${String(MAX_WHERE_LENGTH)} characters`
-    );
-  }
-  const normalized = normalizeForPatternMatching(where);
-  for (const { pattern, reason } of DANGEROUS_PATTERNS) {
-    if (pattern.test(normalized)) {
-      throw new UnsafeWhereClauseError(reason);
-    }
-  }
-  return where;
-}
-function buildWhereClause(conditions, whereClause) {
-  let finalSql = "";
-  const params = [];
-  const clauses = [];
-  if (conditions !== void 0 && conditions !== null && conditions.length > 0) {
-    const allowedOperators = /* @__PURE__ */ new Set([
-      "=",
-      "!=",
-      ">",
-      ">=",
-      "<",
-      "<=",
-      "LIKE",
-      "IN",
-      "IS",
-      "IS NOT",
-      "NOT LIKE"
-    ]);
-    for (const cond of conditions) {
-      if (!allowedOperators.has(cond.operator.toUpperCase())) {
-        throw new Error(`Invalid operator: ${cond.operator}`);
-      }
-      const col = `"${cond.column.replace(/"/g, '""')}"`;
-      if (cond.operator.toUpperCase() === "IN" && Array.isArray(cond.value)) {
-        const placeholders = cond.value.map(() => "?").join(", ");
-        clauses.push(`${col} IN (${placeholders})`);
-        params.push(...cond.value);
-      } else {
-        clauses.push(`${col} ${cond.operator} ?`);
-        params.push(cond.value);
-      }
-    }
-    finalSql = clauses.join(" AND ");
-  }
-  if (whereClause) {
-    const safeWhere = sanitizeWhereClause(whereClause);
-    if (finalSql) {
-      finalSql = `${finalSql} AND ${safeWhere}`;
-    } else {
-      finalSql = safeWhere;
-    }
-  }
-  return { sql: finalSql, params };
-}
-
-// src/utils/identifiers.ts
-var IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-var MAX_IDENTIFIER_LENGTH = 255;
-var InvalidIdentifierError = class extends Error {
-  constructor(identifier, reason) {
-    super(`Invalid identifier "${identifier}": ${reason}`);
-    this.identifier = identifier;
-    this.reason = reason;
-    this.name = "InvalidIdentifierError";
-  }
-  identifier;
-  reason;
-};
-function validateIdentifier(name) {
-  if (!name || typeof name !== "string") {
-    throw new InvalidIdentifierError(
-      name,
-      "Identifier must be a non-empty string"
-    );
-  }
-  if (name.length > MAX_IDENTIFIER_LENGTH) {
-    throw new InvalidIdentifierError(
-      name,
-      `Identifier exceeds maximum length of ${String(MAX_IDENTIFIER_LENGTH)} characters`
-    );
-  }
-  if (!IDENTIFIER_PATTERN.test(name)) {
-    throw new InvalidIdentifierError(
-      name,
-      "Identifier contains invalid characters. Must start with a letter or underscore and contain only letters, digits, or underscores"
-    );
-  }
-}
-function sanitizeIdentifier(name) {
-  validateIdentifier(name);
-  const escaped = name.replace(/"/g, '""');
-  return `"${escaped}"`;
-}
-function sanitizeIdentifiers(names) {
-  return names.map(sanitizeIdentifier);
-}
-function createColumnList(columns) {
-  return sanitizeIdentifiers(columns).join(", ");
-}
-function validateSameDirPath(targetPath, dbPath) {
-  if (targetPath.includes("\0")) {
-    return {
-      valid: false,
-      error: "Security: path must not contain null bytes.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  if (targetPath.startsWith("file:") || targetPath.includes("?")) {
-    return {
-      valid: false,
-      error: "Security: SQLite URIs and query parameters are not allowed.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  const base = basename(targetPath);
-  if (base.startsWith(".")) {
-    return {
-      valid: false,
-      error: "Security: Cannot access hidden files or dotfiles.",
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  const validExtensions = [
-    ".db",
-    ".sqlite",
-    ".sqlite3",
-    ".sql",
-    ".csv",
-    ".tsv"
-  ];
-  const hasValidExt = validExtensions.some(
-    (ext) => base.toLowerCase().endsWith(ext)
-  );
-  if (!hasValidExt) {
-    return {
-      valid: false,
-      error: `Security: Invalid file extension. Allowed extensions are: ${validExtensions.join(", ")}`,
-      dbDir: dbPath === ":memory:" ? "" : dirname(resolve(dbPath))
-    };
-  }
-  if (dbPath === ":memory:") {
-    return {
-      valid: false,
-      error: "Security: Filesystem operations are not permitted for :memory: databases.",
-      dbDir: ""
-    };
-  }
-  const dbDir = dirname(resolve(dbPath));
-  let resolvedTarget = resolve(targetPath);
-  try {
-    resolvedTarget = realpathSync(resolvedTarget);
-  } catch {
-    try {
-      const parentDir = realpathSync(dirname(resolvedTarget));
-      resolvedTarget = resolve(parentDir, basename(resolvedTarget));
-    } catch {
-      return {
-        valid: false,
-        error: "Security: Target parent directory must exist.",
-        dbDir
-      };
-    }
-  }
-  let resolvedDbDir;
-  try {
-    resolvedDbDir = realpathSync(dbDir);
-  } catch {
-    return {
-      valid: false,
-      error: "Security: Database directory must exist.",
-      dbDir
-    };
-  }
-  const normalizedTarget = normalize(resolvedTarget);
-  const normalizedDir = normalize(resolvedDbDir);
-  const targetDir = normalize(dirname(resolvedTarget));
-  if (relative(normalizedDir, targetDir) !== "") {
-    return {
-      valid: false,
-      error: `Security: path must be within the database directory. Path traversal is not allowed.`,
-      dbDir
-    };
-  }
-  return { valid: true, resolvedPath: normalizedTarget };
-}
-
-// src/utils/validate-json-path.ts
-var VALID_JSON_PATH_PATTERN = /^\$(\.[a-zA-Z_][a-zA-Z0-9_ -]*|\[\d+\]|\[#\]|\[\*\])*$/;
-var MAX_JSON_PATH_LENGTH = 500;
-function validateJsonPath(path3, param = "path") {
-  if (!path3.startsWith("$")) {
-    throw new ValidationError(
-      `JSON ${param} must start with $`,
-      "INVALID_JSON_PATH",
-      {
-        suggestion: "Use a valid JSON path starting with $. For example: $.key or $[0]"
-      }
-    );
-  }
-  if (path3.length > MAX_JSON_PATH_LENGTH) {
-    throw new ValidationError(
-      `JSON ${param} exceeds maximum length of ${MAX_JSON_PATH_LENGTH} characters`,
-      "INVALID_JSON_PATH"
-    );
-  }
-  if (!VALID_JSON_PATH_PATTERN.test(path3)) {
-    throw new ValidationError(
-      `Invalid JSON ${param} syntax: ${path3}`,
-      "INVALID_JSON_PATH",
-      {
-        suggestion: "Use $.key, $[0], or $[*] patterns. Member names must start with a letter or underscore."
-      }
-    );
-  }
-}
-var ALLOWED_AGGREGATE_FUNCTIONS = /* @__PURE__ */ new Set([
-  "count",
-  "sum",
-  "avg",
-  "min",
-  "max",
-  "group_concat",
-  "total"
-]);
-var AGGREGATE_FUNCTION_PATTERN = /^([A-Za-z_]+)\(\s*(\*|"[a-zA-Z_][a-zA-Z0-9_]*"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\s*,\s*'[^']*')?\s*\)$/;
-function validateAggregateFunction(fn) {
-  const match = AGGREGATE_FUNCTION_PATTERN.exec(fn.trim());
-  if (!match) {
-    throw new ValidationError(
-      `Invalid aggregate function syntax: ${fn}`,
-      "INVALID_AGGREGATE_FUNCTION",
-      {
-        suggestion: "Use a standard aggregate function like COUNT(*), SUM(column), AVG(column), MIN(column), MAX(column), GROUP_CONCAT(column), or TOTAL(column)."
-      }
-    );
-  }
-  const funcName = match[1]?.toLowerCase();
-  if (!funcName || !ALLOWED_AGGREGATE_FUNCTIONS.has(funcName)) {
-    throw new ValidationError(
-      `Disallowed aggregate function: ${match[1]}. Allowed: ${[...ALLOWED_AGGREGATE_FUNCTIONS].join(", ").toUpperCase()}`,
-      "INVALID_AGGREGATE_FUNCTION"
-    );
-  }
-}
-
 // src/adapters/sqlite/tools/core/tables.ts
 var SPATIALITE_SYSTEM_PREFIXES = [
   "geometry_columns",
@@ -1396,7 +1106,7 @@ function createDescribeTableTool(adapter) {
       try {
         const tableInfo = await adapter.describeTable(input.table);
         const rawColumns = tableInfo.columns ?? [];
-        let enrichedColumns = rawColumns.map((c) => ({
+        const enrichedColumns = rawColumns.map((c) => ({
           name: c.name,
           type: c.type,
           nullable: c.nullable,
@@ -1422,28 +1132,39 @@ function createDescribeTableTool(adapter) {
                 [input.table]
               );
               const ddl = ddlResult.rows?.[0]?.["sql"] ?? "";
-              enrichedColumns = enrichedColumns.map((col) => {
-                const hidden = xinfoMap.get(col.name);
-                if (hidden !== 2 && hidden !== 3) return col;
-                const enriched = {
-                  ...col,
-                  isGenerated: true,
-                  generatedType: hidden === 3 ? "STORED" : "VIRTUAL"
-                };
-                const escapedName = col.name.replace(
-                  /[.*+?^${}()|[\]\\]/g,
-                  "\\$&"
-                );
-                const exprPattern = new RegExp(
-                  `"?${escapedName}"?\\s+\\w+[^,]*GENERATED\\s+ALWAYS\\s+AS\\s*\\(([^)]+)\\)`,
-                  "i"
-                );
-                const match = exprPattern.exec(ddl);
-                if (match?.[1]) {
-                  enriched.generatedExpression = match[1].trim();
+              for (const row of xinfoResult.rows) {
+                const colName = row["name"];
+                const hidden = row["hidden"];
+                if (hidden === 2 || hidden === 3) {
+                  let enriched = enrichedColumns.find(
+                    (c) => c.name === colName
+                  );
+                  if (!enriched) {
+                    enriched = {
+                      name: colName,
+                      type: row["type"],
+                      nullable: row["notnull"] === 0,
+                      primaryKey: row["pk"] === 1,
+                      defaultValue: row["dflt_value"]
+                    };
+                    enrichedColumns.push(enriched);
+                  }
+                  enriched.isGenerated = true;
+                  enriched.generatedType = hidden === 3 ? "STORED" : "VIRTUAL";
+                  const escapedName = colName.replace(
+                    /[.*+?^${}()|[\]\\]/g,
+                    "\\$&"
+                  );
+                  const exprPattern = new RegExp(
+                    `"?${escapedName}"?\\s+\\w+[^,]*GENERATED\\s+ALWAYS\\s+AS\\s*\\(([^)]+)\\)`,
+                    "i"
+                  );
+                  const match = exprPattern.exec(ddl);
+                  if (match?.[1]) {
+                    enriched.generatedExpression = match[1].trim();
+                  }
                 }
-                return enriched;
-              });
+              }
             }
           }
         } catch {
@@ -1831,7 +1552,7 @@ async function validateTableExists2(adapter, table) {
       success: false,
       error: `Table or view '${table}' not found. Use sqlite_list_tables to see available tables.`,
       code: "TABLE_NOT_FOUND",
-      category: "resource" /* RESOURCE */,
+      category: ErrorCategory.RESOURCE,
       suggestion: "Table or view does not exist. Run sqlite_list_tables to see available tables.",
       details: void 0,
       recoverable: false
@@ -1866,12 +1587,38 @@ function createUpsertTool(adapter) {
           conflictColumns: parsed.conflictColumns !== void 0 ? Array.isArray(parsed.conflictColumns) ? parsed.conflictColumns : [parsed.conflictColumns] : []
         };
         if (Object.keys(input.data).length === 0)
-          throw new Error("data (or values alias) is required");
+          throw new ValidationError("data (or values alias) is required");
       } catch (error) {
         return { ...formatHandlerError(error), rowsAffected: 0 };
       }
       const validationError = await validateTableExists2(adapter, input.table);
       if (validationError) return { ...validationError, rowsAffected: 0 };
+      if (input.expectedVersion === void 0) {
+        try {
+          const pragmaCheck = await adapter.executeReadQuery(
+            `PRAGMA table_info(${sanitizeIdentifier(input.table)})`
+          );
+          const isVersioned = (pragmaCheck.rows ?? []).some(
+            (col) => col["name"] === "_version"
+          );
+          if (isVersioned) {
+            return {
+              ...formatHandlerError(
+                new ConflictError(
+                  `expectedVersion is required when updating versioned table '${input.table}'`,
+                  "CONFLICT_ERROR",
+                  {
+                    conflictType: "missing_expected_version",
+                    suggestion: "Use sqlite_check_version to get the current version, then include expectedVersion in your request."
+                  }
+                )
+              ),
+              rowsAffected: 0
+            };
+          }
+        } catch {
+        }
+      }
       const columns = Object.keys(input.data);
       const values = Object.values(input.data);
       const placeholders = columns.map(() => "?").join(", ");
@@ -1886,11 +1633,35 @@ function createUpsertTool(adapter) {
           const updateSets = colsToUpdate.map(
             (c) => `${sanitizeIdentifier(c)} = EXCLUDED.${sanitizeIdentifier(c)}`
           ).join(", ");
-          sql += ` ON CONFLICT (${conflictCols}) DO UPDATE SET ${updateSets}`;
+          let updateClause = ` ON CONFLICT (${conflictCols}) DO UPDATE SET ${updateSets}`;
+          if (input.expectedVersion !== void 0) {
+            updateClause += ` WHERE _version = ${input.expectedVersion}`;
+          }
+          sql += updateClause;
         } else {
+          if (input.expectedVersion !== void 0) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  "expectedVersion requires colsToUpdate (cannot use with DO NOTHING)"
+                )
+              ),
+              rowsAffected: 0
+            };
+          }
           sql += ` ON CONFLICT (${conflictCols}) DO NOTHING`;
         }
       } else {
+        if (input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ValidationError(
+                "expectedVersion requires explicit conflictColumns for OCC"
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         sql = `INSERT OR REPLACE INTO ${safeTable} (${safeColumns.join(", ")}) VALUES (${placeholders})`;
       }
       if (input.returning !== void 0 && input.returning !== false) {
@@ -1903,6 +1674,21 @@ function createUpsertTool(adapter) {
       }
       try {
         const result = await adapter.executeWriteQuery(sql, queryParams);
+        if (result.rowsAffected === 0 && input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ConflictError(
+                `Version conflict during upsert: expected version ${input.expectedVersion}. Re-read the row and retry.`,
+                "CONFLICT_ERROR",
+                {
+                  conflictType: "version_mismatch",
+                  suggestion: "Re-read the row to get the current version, then retry the update."
+                }
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         const response = {
           success: true,
           rowsAffected: result.rowsAffected,
@@ -2986,6 +2772,269 @@ function createAlterTableTool(adapter) {
   };
 }
 
+// src/adapters/sqlite/tools/core/versioning.ts
+function createEnableVersioningTool(adapter) {
+  return {
+    name: "sqlite_enable_versioning",
+    description: "Enable optimistic concurrency control (OCC) on a table. Adds a _version column and an auto-increment trigger.",
+    group: "core",
+    inputSchema: EnableVersioningSchema,
+    outputSchema: EnableVersioningOutputSchema,
+    requiredScopes: ["admin"],
+    annotations: write("Enable Versioning"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = EnableVersioningSchema.parse(params);
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return { ...validationError, sql: "" };
+      const safeTable = sanitizeIdentifier(input.table);
+      const triggerName = sanitizeIdentifier(`_mcp_version_${input.table}`);
+      try {
+        const pragmaCheck = await adapter.executeReadQuery(
+          `PRAGMA table_info(${safeTable})`
+        );
+        const hasVersionColumn = (pragmaCheck.rows ?? []).some(
+          (col) => col["name"] === "_version"
+        );
+        const statements = [];
+        if (!hasVersionColumn) {
+          statements.push(
+            `ALTER TABLE ${safeTable} ADD COLUMN _version INTEGER NOT NULL DEFAULT 1;`
+          );
+        }
+        const triggerSql = `
+CREATE TRIGGER IF NOT EXISTS ${triggerName}
+BEFORE UPDATE ON ${safeTable}
+FOR EACH ROW
+BEGIN
+  UPDATE ${safeTable} SET _version = OLD._version + 1 WHERE rowid = OLD.rowid;
+END;`;
+        statements.push(triggerSql.trim());
+        for (const stmt of statements) {
+          await adapter.executeWriteQuery(stmt);
+        }
+        const sql = statements.join("\n");
+        return {
+          success: true,
+          message: hasVersionColumn ? `Versioning already active on '${input.table}', trigger ensured.` : `Versioning enabled on '${input.table}'. Added _version column and trigger.`,
+          sql,
+          alreadyEnabled: hasVersionColumn
+        };
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+    }
+  };
+}
+function createDisableVersioningTool(adapter) {
+  return {
+    name: "sqlite_disable_versioning",
+    description: "Disable optimistic concurrency control (OCC) on a table. Drops the _version column and its trigger.",
+    group: "core",
+    inputSchema: DisableVersioningSchema,
+    outputSchema: DisableVersioningOutputSchema,
+    requiredScopes: ["admin"],
+    annotations: write("Disable Versioning"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = DisableVersioningSchema.parse(params);
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+      const safeTable = sanitizeIdentifier(input.table);
+      const triggerName = sanitizeIdentifier(`_mcp_version_${input.table}`);
+      const tableCheck = await adapter.executeReadQuery(
+        `SELECT 1 FROM pragma_table_list(?) WHERE type IN ('table', 'view') LIMIT 1`,
+        [input.table]
+      );
+      if (!tableCheck.rows || tableCheck.rows.length === 0) {
+        if (input.ifExists) {
+          return {
+            success: true,
+            message: `Table '${input.table}' does not exist (no changes made).`,
+            sql: ""
+          };
+        }
+        return {
+          ...formatHandlerError(
+            new ValidationError(`Table '${input.table}' does not exist.`)
+          ),
+          sql: ""
+        };
+      }
+      try {
+        const pragmaCheck = await adapter.executeReadQuery(
+          `PRAGMA table_info(${safeTable})`
+        );
+        const hasVersionColumn = (pragmaCheck.rows ?? []).some(
+          (col) => col["name"] === "_version"
+        );
+        const statements = [];
+        statements.push(`DROP TRIGGER IF EXISTS ${triggerName};`);
+        if (hasVersionColumn) {
+          statements.push(`ALTER TABLE ${safeTable} DROP COLUMN _version;`);
+        }
+        for (const stmt of statements) {
+          await adapter.executeWriteQuery(stmt);
+        }
+        const sql = statements.join("\n");
+        return {
+          success: true,
+          message: hasVersionColumn ? `Versioning disabled on '${input.table}'. Dropped _version column and trigger.` : `Versioning already disabled on '${input.table}', trigger dropped if existed.`,
+          sql
+        };
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+    }
+  };
+}
+function createCheckVersionTool(adapter) {
+  return {
+    name: "sqlite_check_version",
+    description: "Read the current _version of a specific row for optimistic concurrency control.",
+    group: "core",
+    inputSchema: CheckVersionSchema,
+    outputSchema: CheckVersionOutputSchema,
+    requiredScopes: ["read"],
+    annotations: readOnly("Check Version"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = CheckVersionSchema.parse(params);
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return validationError;
+      const safeTable = sanitizeIdentifier(input.table);
+      const safeIdCol = sanitizeIdentifier(input.idColumn ?? "rowid");
+      try {
+        const sql = `SELECT * FROM ${safeTable} WHERE ${safeIdCol} = ? LIMIT 1`;
+        const result = await adapter.executeReadQuery(sql, [input.rowId]);
+        if (!result.rows || result.rows.length === 0) {
+          return formatHandlerError(
+            new ResourceNotFoundError(
+              `Row not found in table '${input.table}' with ${safeIdCol} = ${input.rowId}`
+            )
+          );
+        }
+        const row = result.rows[0];
+        if (row && typeof row["_version"] === "number") {
+          return { success: true, version: row["_version"], row };
+        } else {
+          return formatHandlerError(
+            new ValidationError(
+              `Table '${input.table}' does not appear to have versioning enabled (missing _version column).`
+            )
+          );
+        }
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+function createConditionalUpdateTool(adapter) {
+  return {
+    name: "sqlite_conditional_update",
+    description: "Update a row only if its _version matches expectedVersion. Prevents lost updates in multi-agent environments.",
+    group: "core",
+    inputSchema: ConditionalUpdateSchema,
+    outputSchema: ConditionalUpdateOutputSchema,
+    requiredScopes: ["write"],
+    annotations: write("Conditional Update"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = ConditionalUpdateSchema.parse(params);
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return validationError;
+      const safeTable = sanitizeIdentifier(input.table);
+      const columns = Object.keys(input.data);
+      if (columns.length === 0) {
+        return formatHandlerError(
+          new ValidationError("Update data cannot be empty")
+        );
+      }
+      if (input.conditions.length === 0) {
+        return formatHandlerError(
+          new ValidationError("Conditions are required to identify the row")
+        );
+      }
+      try {
+        const queryParams = [];
+        const safeColumns = columns.map(sanitizeIdentifier);
+        const setClauses = safeColumns.map((c) => `${c} = ?`).join(", ");
+        queryParams.push(...Object.values(input.data));
+        const { sql: whereSql, params: whereParams } = buildWhereClause(
+          input.conditions
+        );
+        queryParams.push(...whereParams);
+        queryParams.push(input.expectedVersion);
+        const updateSql = `UPDATE ${safeTable} SET ${setClauses} WHERE (${whereSql}) AND _version = ? RETURNING *`;
+        const result = await adapter.executeWriteQuery(updateSql, queryParams);
+        if (result.rowsAffected === 0) {
+          const checkSql = `SELECT _version FROM ${safeTable} WHERE ${whereSql}`;
+          const checkResult = await adapter.executeReadQuery(
+            checkSql,
+            whereParams
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return formatHandlerError(
+              new ResourceNotFoundError(
+                "Row not found matching the provided conditions"
+              )
+            );
+          }
+          const currentVersionRaw = checkResult.rows[0]?.["_version"];
+          if (currentVersionRaw === void 0 || currentVersionRaw === null) {
+            return formatHandlerError(
+              new ValidationError(
+                `Table '${input.table}' does not appear to have versioning enabled (missing _version column).`
+              )
+            );
+          }
+          const currentVersion2 = Number(currentVersionRaw);
+          return formatHandlerError(
+            new ConflictError(
+              `Version conflict: expected version ${input.expectedVersion} but row has version ${currentVersion2}. Re-read the row and retry.`,
+              "CONFLICT_ERROR",
+              {
+                conflictType: "version_mismatch",
+                suggestion: "Re-read the row to get the current version, then retry the update.",
+                details: {
+                  table: input.table,
+                  expectedVersion: input.expectedVersion,
+                  currentVersion: currentVersion2
+                }
+              }
+            )
+          );
+        }
+        const newRow = result.rows?.[0];
+        const currentVersion = newRow ? newRow["_version"] : void 0;
+        return {
+          success: true,
+          rowsAffected: result.rowsAffected,
+          currentVersion,
+          rows: result.rows
+        };
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+
 // src/adapters/sqlite/tools/core/index.ts
 function getCoreTools(adapter) {
   return [
@@ -3009,7 +3058,11 @@ function getCoreTools(adapter) {
     createListConstraintsTool(adapter),
     createDateAddTool(adapter),
     createDateDiffTool(adapter),
-    createAlterTableTool(adapter)
+    createAlterTableTool(adapter),
+    createEnableVersioningTool(adapter),
+    createDisableVersioningTool(adapter),
+    createCheckVersionTool(adapter),
+    createConditionalUpdateTool(adapter)
   ];
 }
 
@@ -3129,7 +3182,7 @@ var SchemaManager = class {
       throw new DbMcpError(
         "Invalid table name",
         "INVALID_TABLE",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     const result = await this.executor.executeReadQuery(
@@ -3139,7 +3192,7 @@ var SchemaManager = class {
       throw new DbMcpError(
         `Table '${tableName}' does not exist`,
         "TABLE_NOT_FOUND",
-        "resource" /* RESOURCE */
+        ErrorCategory.RESOURCE
       );
     }
     const columns = (result.rows ?? []).map((row) => ({
@@ -3227,55 +3280,6 @@ var SchemaManager = class {
   }
 };
 
-// src/utils/insights-manager.ts
-var InsightsManager = class {
-  insights = [];
-  /**
-   * Append a new business insight
-   */
-  append(insight) {
-    if (insight.trim()) {
-      this.insights.push(insight.trim());
-    }
-  }
-  /**
-   * Get all insights
-   */
-  getAll() {
-    return [...this.insights];
-  }
-  /**
-   * Get insight count
-   */
-  count() {
-    return this.insights.length;
-  }
-  /**
-   * Clear all insights
-   */
-  clear() {
-    this.insights = [];
-  }
-  /**
-   * Synthesize insights into a formatted memo
-   */
-  synthesizeMemo() {
-    if (this.insights.length === 0) {
-      return "No business insights have been discovered yet.";
-    }
-    const insightsList = this.insights.map((insight) => `- ${insight}`).join("\n");
-    let memo = "\u{1F4CA} Business Intelligence Memo \u{1F4CA}\n\n";
-    memo += "Key Insights Discovered:\n\n";
-    memo += insightsList;
-    if (this.insights.length > 1) {
-      memo += "\n\nSummary:\n";
-      memo += `Analysis has revealed ${this.insights.length} key business insights that suggest opportunities for strategic optimization and growth.`;
-    }
-    return memo;
-  }
-};
-var insightsManager = new InsightsManager();
-
 // src/adapters/sqlite/resources.ts
 function getResourceDefinitions(adapter) {
   return [
@@ -3287,8 +3291,7 @@ function getResourceDefinitions(adapter) {
     createHealthResource(adapter),
     createMetaResource(adapter),
     createCompileOptionsResource(adapter),
-    createPragmaResource(adapter),
-    createInsightsResource()
+    createPragmaResource(adapter)
   ];
 }
 function createSchemaResource(adapter) {
@@ -3358,7 +3361,7 @@ function createTableSchemaResource(adapter) {
         throw new DbMcpError(
           "Invalid table URI format",
           "RESOURCE_INVALID_URI",
-          "validation" /* VALIDATION */
+          ErrorCategory.VALIDATION
         );
       }
       const tableName = decodeURIComponent(match[1]);
@@ -3499,36 +3502,16 @@ function createMetaResource(adapter) {
         } catch {
           meta[pragma] = null;
         }
-      }
-      return {
-        contents: [
-          {
-            uri: "sqlite://meta",
-            mimeType: "application/json",
-            text: JSON.stringify(meta, null, 2)
-          }
-        ]
-      };
-    }
-  };
-}
-function createInsightsResource() {
-  return {
-    name: "sqlite_insights",
-    uri: "memo://insights",
-    description: "Business insights memo that gets updated during database analysis",
-    mimeType: "text/plain",
-    annotations: HIGH_PRIORITY,
-    handler: () => {
-      return Promise.resolve({
+      }
+      return {
         contents: [
           {
-            uri: "memo://insights",
-            mimeType: "text/plain",
-            text: insightsManager.synthesizeMemo()
+            uri: "sqlite://meta",
+            mimeType: "application/json",
+            text: JSON.stringify(meta, null, 2)
           }
         ]
-      });
+      };
     }
   };
 }
@@ -4161,7 +4144,6 @@ You are guiding an interactive demo of the SQLite MCP Server capabilities.
 
 **Prompts**: Pre-written templates that structure AI conversations (like this one)
 **Tools**: SQL operations (read_query, write_query, create_table, etc.)
-**Resources**: Living documents like \`memo://insights\` that update during analysis
 
 ## Demo Workflow
 
@@ -4187,17 +4169,10 @@ After setup, present 3-4 natural language query choices:
 For each user selection:
 - Run the appropriate SQL query
 - Explain the results
-- Use \`sqlite_append_insight\` to capture findings
-
-### 5. Capture Insights
-Remind the user about \`memo://insights\`:
-- Each insight is automatically added to this resource
-- They can attach it to see all discoveries
 
-### 6. Wrap Up
+### 5. Wrap Up
 Summarize what was demonstrated:
 - Data creation and querying
-- Insight capture via resources
 - The power of MCP for database workflows
 
 ---
@@ -4228,6 +4203,150 @@ function getPromptDefinitions(adapter) {
     createDemoPrompt()
   ];
 }
+
+// src/adapters/sqlite/json-utils.ts
+var DEFAULT_NORMALIZATION_OPTIONS = {
+  sortKeys: true,
+  compact: true,
+  unicodeNormalize: true,
+  typeCoercion: false,
+  duplicateKeys: "last"
+};
+function normalizeJson(value, options = {}) {
+  const opts = { ...DEFAULT_NORMALIZATION_OPTIONS, ...options };
+  const changes = [];
+  let parsed;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return {
+        normalized: value,
+        wasModified: false,
+        changes: ["Input is not valid JSON"]
+      };
+    }
+  } else {
+    parsed = value;
+  }
+  const normalized = normalizeValue(parsed, opts, changes, "");
+  const normalizedStr = opts.compact ? JSON.stringify(normalized) : JSON.stringify(normalized, null, 2);
+  const originalStr = typeof value === "string" ? value : JSON.stringify(value);
+  const wasModified = normalizedStr !== originalStr;
+  return {
+    normalized: normalizedStr,
+    wasModified,
+    changes
+  };
+}
+function normalizeValue(value, options, changes, path3) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value === "string") {
+    let result = value;
+    if (options.unicodeNormalize && value !== value.normalize("NFC")) {
+      result = result.normalize("NFC");
+      changes.push(`${path3 || "$"}: Unicode normalized`);
+    }
+    if (options.typeCoercion) {
+      if (result.toLowerCase() === "true") {
+        changes.push(`${path3 || "$"}: Coerced "true" to boolean`);
+        return true;
+      }
+      if (result.toLowerCase() === "false") {
+        changes.push(`${path3 || "$"}: Coerced "false" to boolean`);
+        return false;
+      }
+      const num = Number(result);
+      if (!isNaN(num) && result.trim() !== "") {
+        changes.push(`${path3 || "$"}: Coerced "${result}" to number`);
+        return num;
+      }
+    }
+    return result;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(
+      (item, index) => normalizeValue(item, options, changes, `${path3 || "$"}[${index}]`)
+    );
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    let keys = Object.keys(obj);
+    if (options.sortKeys) {
+      const originalOrder = keys.join(",");
+      keys = keys.sort();
+      if (keys.join(",") !== originalOrder) {
+        changes.push(`${path3 || "$"}: Keys sorted`);
+      }
+    }
+    const result = {};
+    for (const key of keys) {
+      result[key] = normalizeValue(
+        obj[key],
+        options,
+        changes,
+        `${path3 || "$"}.${key}`
+      );
+    }
+    return result;
+  }
+  return value;
+}
+var jsonbSupportedCache = null;
+function isJsonbSupportedVersion(versionString) {
+  const versionRegex = /^(\d+)\.(\d+)\.?(\d+)?/;
+  const match = versionRegex.exec(versionString);
+  if (!match) return false;
+  const major = parseInt(match[1] ?? "0", 10);
+  const minor = parseInt(match[2] ?? "0", 10);
+  return major > 3 || major === 3 && minor >= 45;
+}
+function isJsonbSupported() {
+  return jsonbSupportedCache ?? false;
+}
+function setJsonbSupported(supported) {
+  jsonbSupportedCache = supported;
+}
+function detectJsonStorageFormat(value) {
+  if (value instanceof Buffer || value instanceof Uint8Array) {
+    return "jsonb";
+  }
+  if (typeof value === "string") {
+    return "text";
+  }
+  return "unknown";
+}
+function parseJsonValue(value) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value === "object" && !(value instanceof Buffer)) {
+    return value;
+  }
+  if (value instanceof Buffer || value instanceof Uint8Array) {
+    throw new DbMcpError(
+      "JSONB blob cannot be parsed directly. Use json() in SQL query.",
+      "JSON_PARSE_ERROR",
+      ErrorCategory.VALIDATION
+    );
+  }
+  if (typeof value === "string") {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value;
+    }
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  return null;
+}
 var coerceNumber2 = (val) => {
   if (typeof val === "string") {
     if (val.trim() === "") return void 0;
@@ -4702,7 +4821,7 @@ function createJsonExtractTool(adapter) {
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
-          values: result.rows?.map((r) => r["value"])
+          values: result.rows?.map((r) => parseJsonValue(r["value"]))
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -4750,6 +4869,7 @@ function createJsonSetTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Set value at ${input.path} in ${table}.${column}`,
           rowsAffected: result.rowsAffected,
           ...result.rowsAffected === 0 ? {
             warning: "No rows matched the WHERE clause \u2014 no changes were made"
@@ -4791,6 +4911,7 @@ function createJsonRemoveTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Removed value at ${input.path} from ${table}.${column}`,
           rowsAffected: result.rowsAffected,
           ...result.rowsAffected === 0 ? {
             warning: "No rows matched the WHERE clause \u2014 no changes were made"
@@ -4933,6 +5054,7 @@ function createJsonArrayAppendTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Appended to ${input.path} in ${table}.${column}`,
           rowsAffected: result.rowsAffected
         };
       } catch (error) {
@@ -5032,10 +5154,14 @@ function createJsonEachTool(adapter) {
         }
         sql += ` LIMIT ${input.limit}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedElements = result.rows?.map((row) => ({
+          ...row,
+          value: parseJsonValue(row["value"])
+        })) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          elements: result.rows
+          rowCount: parsedElements.length,
+          elements: parsedElements
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5089,10 +5215,17 @@ function createJsonGroupArrayTool(adapter) {
         }
         sql += groupByClause;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows ?? []
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5144,10 +5277,17 @@ function createJsonGroupObjectTool(adapter) {
           }
           const sql2 = `SELECT ${outerSelect} FROM (${subquery})${outerGroupBy}`;
           const result2 = await adapter.executeReadQuery(sql2, queryParams);
+          const parsedRows2 = result2.rows?.map((row) => {
+            const parsedRow = {};
+            for (const [key, value] of Object.entries(row)) {
+              parsedRow[key] = parseJsonValue(value);
+            }
+            return parsedRow;
+          }) ?? [];
           return {
             success: true,
-            rowCount: result2.rows?.length ?? 0,
-            rows: result2.rows ?? []
+            rowCount: parsedRows2.length,
+            rows: parsedRows2
           };
         }
         if (!input.valueColumn) {
@@ -5171,151 +5311,40 @@ function createJsonGroupObjectTool(adapter) {
         if (input.groupByColumn) {
           const groupByCol = input.allowExpressions ? input.groupByColumn : sanitizeIdentifier(input.groupByColumn);
           const groupAlias = input.allowExpressions ? "group_key" : input.groupByColumn;
-          selectClause = `${groupByCol} AS ${groupAlias}, ${selectClause}`;
-          groupByClause = ` GROUP BY ${groupByCol}`;
-        }
-        let sql = `SELECT ${selectClause} FROM ${table}`;
-        if (input.conditions || input.whereClause) {
-          const { sql: whereSql, params: whereParams } = buildWhereClause(
-            input.conditions,
-            input.whereClause
-          );
-          if (whereSql !== "") {
-            sql += ` WHERE ${whereSql}`;
-            queryParams.push(...whereParams);
-          }
-        }
-        sql += groupByClause;
-        const result = await adapter.executeReadQuery(sql, queryParams);
-        return {
-          success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows ?? [],
-          ...duplicateKeyWarning && { hint: duplicateKeyWarning }
-        };
-      } catch (error) {
-        return formatHandlerError(error);
-      }
-    }
-  };
-}
-
-// src/adapters/sqlite/json-utils.ts
-var DEFAULT_NORMALIZATION_OPTIONS = {
-  sortKeys: true,
-  compact: true,
-  unicodeNormalize: true,
-  typeCoercion: false,
-  duplicateKeys: "last"
-};
-function normalizeJson(value, options = {}) {
-  const opts = { ...DEFAULT_NORMALIZATION_OPTIONS, ...options };
-  const changes = [];
-  let parsed;
-  if (typeof value === "string") {
-    try {
-      parsed = JSON.parse(value);
-    } catch {
-      return {
-        normalized: value,
-        wasModified: false,
-        changes: ["Input is not valid JSON"]
-      };
-    }
-  } else {
-    parsed = value;
-  }
-  const normalized = normalizeValue(parsed, opts, changes, "");
-  const normalizedStr = opts.compact ? JSON.stringify(normalized) : JSON.stringify(normalized, null, 2);
-  const originalStr = typeof value === "string" ? value : JSON.stringify(value);
-  const wasModified = normalizedStr !== originalStr;
-  return {
-    normalized: normalizedStr,
-    wasModified,
-    changes
-  };
-}
-function normalizeValue(value, options, changes, path3) {
-  if (value === null || value === void 0) {
-    return null;
-  }
-  if (typeof value === "string") {
-    let result = value;
-    if (options.unicodeNormalize && value !== value.normalize("NFC")) {
-      result = result.normalize("NFC");
-      changes.push(`${path3 || "$"}: Unicode normalized`);
-    }
-    if (options.typeCoercion) {
-      if (result.toLowerCase() === "true") {
-        changes.push(`${path3 || "$"}: Coerced "true" to boolean`);
-        return true;
-      }
-      if (result.toLowerCase() === "false") {
-        changes.push(`${path3 || "$"}: Coerced "false" to boolean`);
-        return false;
-      }
-      const num = Number(result);
-      if (!isNaN(num) && result.trim() !== "") {
-        changes.push(`${path3 || "$"}: Coerced "${result}" to number`);
-        return num;
-      }
-    }
-    return result;
-  }
-  if (typeof value === "number" || typeof value === "boolean") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.map(
-      (item, index) => normalizeValue(item, options, changes, `${path3 || "$"}[${index}]`)
-    );
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    let keys = Object.keys(obj);
-    if (options.sortKeys) {
-      const originalOrder = keys.join(",");
-      keys = keys.sort();
-      if (keys.join(",") !== originalOrder) {
-        changes.push(`${path3 || "$"}: Keys sorted`);
+          selectClause = `${groupByCol} AS ${groupAlias}, ${selectClause}`;
+          groupByClause = ` GROUP BY ${groupByCol}`;
+        }
+        let sql = `SELECT ${selectClause} FROM ${table}`;
+        if (input.conditions || input.whereClause) {
+          const { sql: whereSql, params: whereParams } = buildWhereClause(
+            input.conditions,
+            input.whereClause
+          );
+          if (whereSql !== "") {
+            sql += ` WHERE ${whereSql}`;
+            queryParams.push(...whereParams);
+          }
+        }
+        sql += groupByClause;
+        const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
+        return {
+          success: true,
+          rowCount: parsedRows.length,
+          rows: parsedRows,
+          ...duplicateKeyWarning && { hint: duplicateKeyWarning }
+        };
+      } catch (error) {
+        return formatHandlerError(error);
       }
     }
-    const result = {};
-    for (const key of keys) {
-      result[key] = normalizeValue(
-        obj[key],
-        options,
-        changes,
-        `${path3 || "$"}.${key}`
-      );
-    }
-    return result;
-  }
-  return value;
-}
-var jsonbSupportedCache = null;
-function isJsonbSupportedVersion(versionString) {
-  const versionRegex = /^(\d+)\.(\d+)\.?(\d+)?/;
-  const match = versionRegex.exec(versionString);
-  if (!match) return false;
-  const major = parseInt(match[1] ?? "0", 10);
-  const minor = parseInt(match[2] ?? "0", 10);
-  return major > 3 || major === 3 && minor >= 45;
-}
-function isJsonbSupported() {
-  return jsonbSupportedCache ?? false;
-}
-function setJsonbSupported(supported) {
-  jsonbSupportedCache = supported;
-}
-function detectJsonStorageFormat(value) {
-  if (value instanceof Buffer || value instanceof Uint8Array) {
-    return "jsonb";
-  }
-  if (typeof value === "string") {
-    return "text";
-  }
-  return "unknown";
+  };
 }
 
 // src/adapters/sqlite/tools/json-operations/transform.ts
@@ -5616,7 +5645,7 @@ function createJsonSecurityScanTool(adapter) {
         const issueMap = /* @__PURE__ */ new Map();
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -5877,10 +5906,17 @@ function createJsonSelectTool(adapter) {
         }
         sql += ` LIMIT ${input.limit ?? 100}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -5937,10 +5973,17 @@ function createJsonQueryTool(adapter) {
         }
         sql += ` LIMIT ${input.limit ?? 100}`;
         const result = await adapter.executeReadQuery(sql, queryParams);
+        const parsedRows = result.rows?.map((row) => {
+          const parsedRow = {};
+          for (const [key, value] of Object.entries(row)) {
+            parsedRow[key] = parseJsonValue(value);
+          }
+          return parsedRow;
+        }) ?? [];
         return {
           success: true,
-          rowCount: result.rows?.length ?? 0,
-          rows: result.rows
+          rowCount: parsedRows.length,
+          rows: parsedRows
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -6010,7 +6053,7 @@ function createAnalyzeJsonSchemaTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -6354,6 +6397,18 @@ var VALID_VALIDATE_PATTERNS = [
 var VALID_PHONETIC_ALGORITHMS = ["soundex", "metaphone"];
 var VALID_TRIM_MODES = ["both", "left", "right"];
 var VALID_SEARCH_TECHNIQUES = ["exact", "fuzzy", "phonetic"];
+function sanitizeFtsQuery(query) {
+  if (!query) return "";
+  let clean = query.replace(/\s+/g, " ").trim();
+  const quoteCount = (clean.match(/"/g) ?? []).length;
+  if (quoteCount % 2 !== 0) {
+    clean = clean.replace(/"/g, "");
+  }
+  clean = clean.replace(/^(?:\s*(?:AND|OR|NOT))+(?=\s|$)/i, "");
+  clean = clean.replace(/(?:^|\s)(?:AND|OR|NOT)(?:\s+(?:AND|OR|NOT))*$/i, "");
+  clean = clean.replace(/(?:\s+(?:AND|OR|NOT)){2,}\s+/gi, " AND ");
+  return clean.trim();
+}
 var coerceNumber3 = (val) => {
   if (typeof val === "string") {
     if (val.trim() === "") return void 0;
@@ -6460,6 +6515,20 @@ var AdvancedSearchOutputSchema = z.object({
       bestScore: z.number(),
       bestType: z.string()
     })
+  ).optional(),
+  facets: z.record(z.string(), z.number()).optional()
+}).extend(ErrorResponseFields.shape);
+var HybridSearchOutputSchema = z.object({
+  success: z.boolean(),
+  query: z.string().optional(),
+  matchCount: z.number().optional(),
+  results: z.array(
+    z.object({
+      rowid: z.number().optional(),
+      rrfScore: z.number().optional(),
+      ftsRank: z.number().nullable().optional(),
+      vectorSimilarity: z.number().nullable().optional()
+    }).loose()
   ).optional()
 }).extend(ErrorResponseFields.shape);
 var SentimentResultItemSchema = z.object({
@@ -6630,7 +6699,20 @@ var AdvancedSearchSchema = z.object({
   ),
   conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE conditions"),
   whereClause: z.string().optional().describe("Deprecated: Use conditions instead"),
-  limit: z.preprocess(coerceNumber3, z.number().optional().default(100))
+  limit: z.preprocess(coerceNumber3, z.number().optional().default(100)),
+  includeFacets: z.boolean().optional().default(false).describe("Return match counts per type")
+});
+var HybridSearchSchema = z.object({
+  table: z.string().describe("Table name"),
+  query: z.string().describe("Text search query (FTS5)"),
+  vectorColumn: z.string().describe("Vector column to search"),
+  queryVector: z.array(z.number()).describe("Vector embedding of the query"),
+  limit: z.preprocess(coerceNumber3, z.number().optional().default(100)),
+  rrfK: z.preprocess(
+    coerceNumber3,
+    z.number().optional().default(60).describe("RRF k constant")
+  ),
+  metric: z.enum(["cosine", "euclidean", "dot"]).optional().default("cosine").describe("Vector similarity metric")
 });
 var TextSentimentSchema = z.object({
   table: z.string().optional().describe("Table name"),
@@ -7199,6 +7281,84 @@ var VALIDATION_PATTERNS = {
   ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/
 };
 
+// src/adapters/sqlite/tools/vector/helpers.ts
+function cosineSimilarity(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      ErrorCategory.VALIDATION
+    );
+  }
+  let dotProd = 0;
+  let normA = 0;
+  let normB = 0;
+  for (let i = 0; i < a.length; i++) {
+    const aVal = a[i] ?? 0;
+    const bVal = b[i] ?? 0;
+    dotProd += aVal * bVal;
+    normA += aVal * aVal;
+    normB += bVal * bVal;
+  }
+  const magnitude = Math.sqrt(normA) * Math.sqrt(normB);
+  return magnitude === 0 ? 0 : dotProd / magnitude;
+}
+function euclideanDistance(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      ErrorCategory.VALIDATION
+    );
+  }
+  let sum = 0;
+  for (let i = 0; i < a.length; i++) {
+    const aVal = a[i] ?? 0;
+    const bVal = b[i] ?? 0;
+    const diff = aVal - bVal;
+    sum += diff * diff;
+  }
+  return Math.sqrt(sum);
+}
+function dotProduct(a, b) {
+  if (a.length !== b.length) {
+    throw new DbMcpError(
+      "Vector dimensions must match",
+      "VECTOR_MISMATCH",
+      ErrorCategory.VALIDATION
+    );
+  }
+  let sum = 0;
+  for (let i = 0; i < a.length; i++) {
+    sum += (a[i] ?? 0) * (b[i] ?? 0);
+  }
+  return sum;
+}
+function normalizeVector(v) {
+  const norm = Math.sqrt(v.reduce((sum, x) => sum + x * x, 0));
+  if (norm === 0) return v;
+  return v.map((x) => x / norm);
+}
+function parseVector(value) {
+  if (Array.isArray(value)) {
+    return value.map(Number);
+  }
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed)) {
+        return parsed.map(Number);
+      }
+    } catch {
+    }
+  }
+  throw new DbMcpError(
+    "Invalid vector format",
+    "VECTOR_INVALID",
+    ErrorCategory.VALIDATION
+  );
+}
+
 // src/adapters/sqlite/tools/text/search.ts
 function createFuzzyMatchTool(adapter) {
   return {
@@ -7429,12 +7589,131 @@ function createAdvancedSearchTool(adapter) {
         }
         allMatches.sort((a, b) => b.bestScore - a.bestScore);
         const limited = allMatches.slice(0, input.limit);
+        const facets = {};
+        if (input.includeFacets) {
+          for (const technique of input.techniques) {
+            facets[technique] = 0;
+          }
+          for (const match of allMatches) {
+            facets[match.bestType] = (facets[match.bestType] ?? 0) + 1;
+          }
+        }
         return {
           success: true,
           searchTerm: input.searchTerm,
           techniques: input.techniques,
           matchCount: limited.length,
-          matches: limited
+          matches: limited,
+          ...input.includeFacets ? { facets } : {}
+        };
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+function createHybridSearchTool(adapter) {
+  return {
+    name: "sqlite_hybrid_search",
+    description: "Hybrid search combining full-text search and vector similarity using Reciprocal Rank Fusion (RRF).",
+    group: "text",
+    inputSchema: HybridSearchSchema,
+    outputSchema: HybridSearchOutputSchema,
+    requiredScopes: ["read"],
+    annotations: readOnly("Hybrid Search"),
+    handler: async (params, _context) => {
+      try {
+        const input = HybridSearchSchema.parse(params);
+        const table = sanitizeIdentifier(input.table);
+        const vectorColumn = sanitizeIdentifier(input.vectorColumn);
+        await validateColumnExists(adapter, input.table, input.vectorColumn);
+        let textResults = [];
+        try {
+          const sanitizedQuery = sanitizeFtsQuery(input.query);
+          if (sanitizedQuery) {
+            const queryEscaped = sanitizedQuery.replace(/'/g, "''");
+            const ftsSql = `SELECT rowid as id, rank as score FROM ${table} WHERE ${table} MATCH '${queryEscaped}' ORDER BY rank LIMIT 1000`;
+            const result = await adapter.executeReadQuery(ftsSql, []);
+            textResults = (result.rows ?? []).map((r, i) => ({
+              id: Number(r["id"] ?? r["rowid"]),
+              rank: i + 1
+            }));
+          }
+        } catch {
+        }
+        const vecSql = `SELECT rowid as id, ${vectorColumn} as vec FROM ${table} WHERE ${vectorColumn} IS NOT NULL LIMIT 10000`;
+        const vecResult = await adapter.executeReadQuery(vecSql, []);
+        const queryVector = input.queryVector;
+        const vecScored = [];
+        for (const row of vecResult.rows ?? []) {
+          try {
+            const storedVector = parseVector(row["vec"]);
+            let score;
+            switch (input.metric) {
+              case "euclidean":
+                score = 1 / (1 + euclideanDistance(queryVector, storedVector));
+                break;
+              case "dot":
+                score = dotProduct(queryVector, storedVector);
+                break;
+              case "cosine":
+              default:
+                score = cosineSimilarity(queryVector, storedVector);
+                break;
+            }
+            vecScored.push({ id: Number(row["id"] ?? row["rowid"]), score });
+          } catch {
+          }
+        }
+        vecScored.sort((a, b) => b.score - a.score);
+        const vectorResults = vecScored.map((r, i) => ({
+          id: r.id,
+          rank: i + 1,
+          score: r.score
+        }));
+        const combined = /* @__PURE__ */ new Map();
+        const k = input.rrfK;
+        for (const f of textResults) {
+          if (!combined.has(f.id)) {
+            combined.set(f.id, {
+              id: f.id,
+              rrfScore: 0,
+              ftsRank: null,
+              vectorSimilarity: null
+            });
+          }
+          const entry = combined.get(f.id);
+          if (entry) {
+            entry.ftsRank = f.rank;
+            entry.rrfScore += 1 / (k + f.rank);
+          }
+        }
+        for (const v of vectorResults) {
+          if (!combined.has(v.id)) {
+            combined.set(v.id, {
+              id: v.id,
+              rrfScore: 0,
+              ftsRank: null,
+              vectorSimilarity: null
+            });
+          }
+          const entry = combined.get(v.id);
+          if (entry) {
+            entry.vectorSimilarity = v.score;
+            entry.rrfScore += 1 / (k + v.rank);
+          }
+        }
+        const sortedCombined = Array.from(combined.values()).sort((a, b) => b.rrfScore - a.rrfScore).slice(0, input.limit).map((r) => ({
+          rowid: r.id,
+          rrfScore: Math.round(r.rrfScore * 1e4) / 1e4,
+          ftsRank: r.ftsRank,
+          vectorSimilarity: r.vectorSimilarity !== null ? Math.round(r.vectorSimilarity * 1e4) / 1e4 : null
+        }));
+        return {
+          success: true,
+          query: input.query,
+          matchCount: sortedCombined.length,
+          results: sortedCombined
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -7768,6 +8047,7 @@ function getTextTools(adapter) {
     createTextNormalizeTool(adapter),
     createTextValidateTool(adapter),
     createAdvancedSearchTool(adapter),
+    createHybridSearchTool(adapter),
     createTextSentimentTool(adapter)
   ];
 }
@@ -8196,8 +8476,8 @@ var StatsSampleSchema = z.object({
   table: z.string().describe("Table name"),
   sampleSize: z.preprocess(
     coerceNumber4,
-    z.number().optional().default(100).describe(
-      "Number of random rows to return (default: 100, max: 1000). WARNING: Uses ORDER BY RANDOM() which is O(N) \u2014 slow on very large tables."
+    z.number().optional().default(20).describe(
+      "Number of random rows to return (default: 20, max: 50). WARNING: Uses ORDER BY RANDOM() which is O(N) \u2014 slow on very large tables."
     )
   ),
   conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE conditions"),
@@ -8620,7 +8900,7 @@ function createPercentileTool(adapter) {
     }
   };
 }
-var MAX_SAMPLE_SIZE = 1e3;
+var MAX_SAMPLE_SIZE = 50;
 function createSampleTool(adapter) {
   return {
     name: "sqlite_stats_sample",
@@ -9310,7 +9590,7 @@ function matrixInverse(A) {
       throw new DbMcpError(
         "Matrix is singular, cannot compute inverse",
         "MATH_SINGULAR",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     for (let j = 0; j < 2 * n; j++) {
@@ -9377,7 +9657,7 @@ function createRegressionTool(adapter) {
           throw new DbMcpError(
             `Insufficient data in table '${input.table}' for degree ${degree} regression (need at least ${degree + 1} points, got ${pairs.length})`,
             "STATS_INSUFFICIENT_SAMPLE",
-            "validation" /* VALIDATION */
+            ErrorCategory.VALIDATION
           );
         }
         const X = pairs.map(
@@ -9486,7 +9766,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "Insufficient sample size for t-test",
               "STATS_INSUFFICIENT_SAMPLE",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const tStatistic = (mean - expectedMean) / (stdDev / Math.sqrt(n));
@@ -9494,7 +9774,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Cannot compute t-statistic: stdDev=${stdDev.toFixed(4)}, n=${n}. This may indicate zero variance, non-numeric data, or that column "${input.column}" does not exist.`,
               "STATS_COMPUTATION_FAILED",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const pValue = tDistPValue(tStatistic, df);
@@ -9517,7 +9797,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "column2 is required for two-sample t-test",
               "STATS_MISSING_COLUMN",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           await validateColumnExists(adapter, input.table, input.column2);
@@ -9544,7 +9824,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "Insufficient sample size for t-test",
               "STATS_INSUFFICIENT_SAMPLE",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const tStatistic = (mean1 - mean2) / Math.sqrt(var1 / n1 + var2 / n2);
@@ -9552,7 +9832,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Cannot compute t-statistic: var1=${var1.toFixed(4)}, var2=${var2.toFixed(4)}. This may indicate zero variance or non-numeric data.`,
               "STATS_COMPUTATION_FAILED",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const dfNum = Math.pow(var1 / n1 + var2 / n2, 2);
@@ -9576,7 +9856,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "groupColumn is required for chi-square test",
               "STATS_MISSING_COLUMN",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           await validateColumnExists(adapter, input.table, input.groupColumn);
@@ -9613,7 +9893,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Insufficient categories for chi-square test: "${input.column}" has ${rowTotals.size} category(s), "${input.groupColumn}" has ${colTotals.size} category(s). Both columns must have at least 2 distinct values.`,
               "STATS_INSUFFICIENT_CATEGORIES",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const pValue = Math.exp(-chiSquare / 2);
@@ -10280,7 +10560,7 @@ var DropViewSchema = z.object({
 });
 var DbStatSchema = z.object({
   table: z.string().optional().describe("Optional table name to filter"),
-  summarize: z.boolean().optional().default(false).describe(
+  summarize: z.boolean().optional().default(true).describe(
     "If true, return aggregated per-table stats instead of raw page-level data"
   ),
   limit: z.preprocess(
@@ -10535,34 +10815,6 @@ function createDropViewTool(adapter) {
   };
 }
 
-// src/utils/progress-utils.ts
-function buildProgressContext(ctx) {
-  if (ctx?.server === void 0 || ctx.progressToken === void 0) {
-    return void 0;
-  }
-  return {
-    server: ctx.server,
-    progressToken: ctx.progressToken
-  };
-}
-async function sendProgress(ctx, progress, total, message) {
-  if (ctx === void 0) return;
-  if (ctx.progressToken === void 0) return;
-  try {
-    const notification = {
-      method: "notifications/progress",
-      params: {
-        progressToken: ctx.progressToken,
-        progress,
-        ...total !== void 0 && { total },
-        ...message !== void 0 && message !== "" && { message }
-      }
-    };
-    await ctx.server.notification(notification);
-  } catch {
-  }
-}
-
 // src/adapters/sqlite/tools/virtual/analysis.ts
 function createDbStatTool(adapter) {
   return {
@@ -10829,7 +11081,9 @@ function createVirtualTableInfoTool(adapter) {
             module: "unknown",
             sql: "",
             error: `Virtual table '${input.tableName}' not found`,
-            code: "TABLE_NOT_FOUND"
+            code: "TABLE_NOT_FOUND",
+            category: "resource",
+            recoverable: false
           };
         }
         const sqlStr = typeof sqlResult.rows[0]?.["sql"] === "string" ? sqlResult.rows[0]["sql"] : "";
@@ -10947,10 +11201,10 @@ function createCsvTableTool(adapter) {
       try {
         const input = CreateCsvTableSchema.parse(params);
         const safeTableName = sanitizeIdentifier(input.tableName);
-        if (!path.isAbsolute(input.filePath)) {
+        if (!nodePath.isAbsolute(input.filePath)) {
           return {
             success: false,
-            error: `Relative path not supported. Please use an absolute path. Example: ${path.resolve(input.filePath)}`,
+            error: `Relative path not supported. Please use an absolute path. Example: ${nodePath.resolve(input.filePath)}`,
             code: "VALIDATION_ERROR",
             category: "validation",
             message: "",
@@ -10958,20 +11212,37 @@ function createCsvTableTool(adapter) {
             columns: []
           };
         }
-        const pathCheck = validateSameDirPath(
-          input.filePath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            success: false,
-            error: pathCheck.error,
-            code: "SECURITY_ERROR",
-            category: "security",
-            message: "",
-            sql: "",
-            columns: []
-          };
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.filePath, allowedIoRoots, false);
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR",
+              category: "security",
+              message: "",
+              sql: "",
+              columns: []
+            };
+          }
+        } else {
+          const pathCheck = validateSameDirPath(
+            input.filePath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              success: false,
+              error: pathCheck.error,
+              code: "SECURITY_ERROR",
+              category: "security",
+              message: "",
+              sql: "",
+              columns: []
+            };
+          }
         }
         const { available: csvAvailable } = await isCsvModuleAvailable(adapter);
         if (!csvAvailable) {
@@ -11054,10 +11325,10 @@ function createAnalyzeCsvSchemaTool(adapter) {
           columns: []
         };
       }
-      if (!path.isAbsolute(input.filePath)) {
+      if (!nodePath.isAbsolute(input.filePath)) {
         return {
           success: false,
-          error: `Relative path not supported. Please use an absolute path. Example: ${path.resolve(input.filePath)}`,
+          error: `Relative path not supported. Please use an absolute path. Example: ${nodePath.resolve(input.filePath)}`,
           code: "VALIDATION_ERROR",
           category: "validation",
           hasHeader: false,
@@ -11065,20 +11336,37 @@ function createAnalyzeCsvSchemaTool(adapter) {
           columns: []
         };
       }
-      const validation = validateSameDirPath(
-        input.filePath,
-        adapter.getConfiguredPath()
-      );
-      if (!validation.valid) {
-        return {
-          success: false,
-          error: validation.error || "Path validation failed",
-          code: "SECURITY_ERROR",
-          category: "validation",
-          hasHeader: false,
-          rowCount: 0,
-          columns: []
-        };
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.filePath, allowedIoRoots, false);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            category: "security",
+            hasHeader: false,
+            rowCount: 0,
+            columns: []
+          };
+        }
+      } else {
+        const validation = validateSameDirPath(
+          input.filePath,
+          adapter.getConfiguredPath()
+        );
+        if (!validation.valid) {
+          return {
+            success: false,
+            error: validation.error || "Path validation failed",
+            code: "SECURITY_ERROR",
+            category: "security",
+            hasHeader: false,
+            rowCount: 0,
+            columns: []
+          };
+        }
       }
       const tempName = `_csv_analyze_${Date.now()}`;
       try {
@@ -11509,10 +11797,7 @@ function createVectorCreateTableTool(adapter) {
       try {
         const input = VectorCreateTableSchema.parse(params);
         if (input.dimensions < 1) {
-          return {
-            success: false,
-            error: "Dimensions must be at least 1"
-          };
+          throw new ValidationError("Dimensions must be at least 1");
         }
         const tableName = sanitizeIdentifier(input.tableName);
         const columns = [
@@ -11598,15 +11883,15 @@ function createVectorStoreTool(adapter) {
       try {
         const input = VectorStoreSchema.parse(params);
         if (input.vector.length === 0) {
-          return {
-            success: false,
-            error: "vector is required and must be a non-empty array of numbers"
-          };
+          throw new ValidationError(
+            "vector is required and must be a non-empty array of numbers"
+          );
         }
         const table = sanitizeIdentifier(input.table);
         const idColumn = sanitizeIdentifier(input.idColumn);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
         let hasDimsColumn = false;
+        let expectedDims;
         try {
           const dims = await validateDimensions(
             adapter,
@@ -11615,15 +11900,15 @@ function createVectorStoreTool(adapter) {
             input.vectorColumn
           );
           hasDimsColumn = dims.hasDimsColumn;
-          if (dims.expectedDims !== void 0 && input.vector.length !== dims.expectedDims) {
-            return {
-              success: false,
-              error: `Dimension mismatch: vector has ${input.vector.length} dimensions but table expects ${dims.expectedDims}`,
-              code: "DIMENSION_MISMATCH"
-            };
-          }
+          expectedDims = dims.expectedDims;
         } catch {
         }
+        if (expectedDims !== void 0 && input.vector.length !== expectedDims) {
+          throw new ValidationError(
+            `Dimension mismatch: vector has ${input.vector.length} dimensions but table expects ${expectedDims}`,
+            "DIMENSION_MISMATCH"
+          );
+        }
         const vectorJson = JSON.stringify(input.vector);
         const updateSql = `UPDATE ${table} SET ${vectorColumn} = ? WHERE ${idColumn} = ?`;
         const updateResult = await adapter.executeWriteQuery(updateSql, [
@@ -11665,10 +11950,11 @@ function createVectorBatchStoreTool(adapter) {
             input.table
           ]);
           if (!checkResult.rows || checkResult.rows.length === 0) {
-            return {
-              success: false,
-              error: `Table '${input.table}' does not exist`
-            };
+            throw new ResourceNotFoundError(
+              `Table '${input.table}' does not exist`,
+              "TABLE_NOT_FOUND",
+              { resourceType: "table", resourceName: input.table }
+            );
           }
           return {
             success: true,
@@ -11679,6 +11965,7 @@ function createVectorBatchStoreTool(adapter) {
         const idColumn = sanitizeIdentifier(input.idColumn);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
         let hasDimsColumn = false;
+        let expectedDims;
         try {
           const dims = await validateDimensions(
             adapter,
@@ -11687,19 +11974,19 @@ function createVectorBatchStoreTool(adapter) {
             input.vectorColumn
           );
           hasDimsColumn = dims.hasDimsColumn;
-          if (dims.expectedDims !== void 0) {
-            for (let i = 0; i < input.items.length; i++) {
-              const item = input.items[i];
-              if (item && item.vector.length !== dims.expectedDims) {
-                return {
-                  success: false,
-                  error: `Dimension mismatch at item[${i}]: vector has ${item.vector.length} dimensions but table expects ${dims.expectedDims}`,
-                  code: "DIMENSION_MISMATCH"
-                };
-              }
+          expectedDims = dims.expectedDims;
+        } catch {
+        }
+        if (expectedDims !== void 0) {
+          for (let i = 0; i < input.items.length; i++) {
+            const item = input.items[i];
+            if (item && item.vector.length !== expectedDims) {
+              throw new ValidationError(
+                `Dimension mismatch at item[${i}]: vector has ${item.vector.length} dimensions but table expects ${expectedDims}`,
+                "DIMENSION_MISMATCH"
+              );
             }
           }
-        } catch {
         }
         let stored = 0;
         for (const item of input.items) {
@@ -11754,84 +12041,6 @@ function createVectorDeleteTool(adapter) {
   };
 }
 
-// src/adapters/sqlite/tools/vector/helpers.ts
-function cosineSimilarity(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let dotProd = 0;
-  let normA = 0;
-  let normB = 0;
-  for (let i = 0; i < a.length; i++) {
-    const aVal = a[i] ?? 0;
-    const bVal = b[i] ?? 0;
-    dotProd += aVal * bVal;
-    normA += aVal * aVal;
-    normB += bVal * bVal;
-  }
-  const magnitude = Math.sqrt(normA) * Math.sqrt(normB);
-  return magnitude === 0 ? 0 : dotProd / magnitude;
-}
-function euclideanDistance(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let sum = 0;
-  for (let i = 0; i < a.length; i++) {
-    const aVal = a[i] ?? 0;
-    const bVal = b[i] ?? 0;
-    const diff = aVal - bVal;
-    sum += diff * diff;
-  }
-  return Math.sqrt(sum);
-}
-function dotProduct(a, b) {
-  if (a.length !== b.length) {
-    throw new DbMcpError(
-      "Vector dimensions must match",
-      "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
-    );
-  }
-  let sum = 0;
-  for (let i = 0; i < a.length; i++) {
-    sum += (a[i] ?? 0) * (b[i] ?? 0);
-  }
-  return sum;
-}
-function normalizeVector(v) {
-  const norm = Math.sqrt(v.reduce((sum, x) => sum + x * x, 0));
-  if (norm === 0) return v;
-  return v.map((x) => x / norm);
-}
-function parseVector(value) {
-  if (Array.isArray(value)) {
-    return value.map(Number);
-  }
-  if (typeof value === "string") {
-    try {
-      const parsed = JSON.parse(value);
-      if (Array.isArray(parsed)) {
-        return parsed.map(Number);
-      }
-    } catch {
-    }
-  }
-  throw new DbMcpError(
-    "Invalid vector format",
-    "VECTOR_INVALID",
-    "validation" /* VALIDATION */
-  );
-}
-
 // src/adapters/sqlite/tools/vector/search.ts
 function createVectorSearchTool(adapter) {
   return {
@@ -11847,10 +12056,9 @@ function createVectorSearchTool(adapter) {
       try {
         const input = VectorSearchSchema.parse(params);
         if (input.queryVector.length === 0) {
-          return {
-            success: false,
-            error: "queryVector is required and must be a non-empty array of numbers"
-          };
+          throw new ValidationError(
+            "queryVector is required and must be a non-empty array of numbers"
+          );
         }
         const table = sanitizeIdentifier(input.table);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
@@ -11880,7 +12088,7 @@ function createVectorSearchTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           const row = rows[i];
           if (!row) continue;
@@ -11898,10 +12106,9 @@ function createVectorSearchTool(adapter) {
                 score = cosineSimilarity(queryVector, storedVector);
                 break;
               default:
-                return {
-                  success: false,
-                  error: `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
-                };
+                throw new ValidationError(
+                  `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
+                );
             }
             scored.push({
               ...row,
@@ -11969,26 +12176,17 @@ function createVectorGetTool(adapter) {
         const sql = `SELECT * FROM ${table} WHERE ${idColumn} = ?`;
         const result = await adapter.executeReadQuery(sql, [input.id]);
         if (!result.rows || result.rows.length === 0) {
-          return {
-            success: false,
-            error: "Vector not found",
-            code: "VECTOR_NOT_FOUND"
-          };
+          throw new ResourceNotFoundError("Vector not found", "VECTOR_NOT_FOUND", { resourceType: "vector", resourceName: String(input.id) });
         }
         const row = result.rows[0];
         if (!row) {
-          return {
-            success: false,
-            error: "Vector not found",
-            code: "VECTOR_NOT_FOUND"
-          };
+          throw new ResourceNotFoundError("Vector not found", "VECTOR_NOT_FOUND", { resourceType: "vector", resourceName: String(input.id) });
         }
         const rawVector = row[input.vectorColumn];
         if (rawVector === void 0 || rawVector === null) {
-          return {
-            success: false,
-            error: `Column '${input.vectorColumn}' not found or contains NULL. Available columns: ${Object.keys(row).join(", ")}`
-          };
+          throw new ValidationError(
+            `Column '${input.vectorColumn}' not found or contains NULL. Available columns: ${Object.keys(row).join(", ")}`
+          );
         }
         const vectorData = parseVector(rawVector);
         const metadata = Object.fromEntries(
@@ -12059,7 +12257,7 @@ function createVectorStatsTool(adapter) {
         const rows = result.rows ?? [];
         for (let i = 0; i < rows.length; i++) {
           if (i > 0 && i % 500 === 0) {
-            await new Promise((resolve4) => setTimeout(resolve4, 0));
+            await new Promise((resolve3) => setTimeout(resolve3, 0));
           }
           try {
             const row = rows[i];
@@ -12160,13 +12358,9 @@ function createVectorNormalizeTool() {
       try {
         const input = VectorNormalizeSchema.parse(params);
         if (input.vector.length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "vector is required and must be a non-empty array of numbers",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          });
+          throw new ValidationError(
+            "vector is required and must be a non-empty array of numbers"
+          );
         }
         const normalized = normalizeVector(input.vector);
         return Promise.resolve({
@@ -12196,20 +12390,12 @@ function createVectorDistanceTool() {
       try {
         const input = VectorDistanceSchema.parse(params);
         if (input.vector1.length === 0 || input.vector2.length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "vector1 and vector2 are required and must be non-empty arrays of numbers",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          });
+          throw new ValidationError(
+            "vector1 and vector2 are required and must be non-empty arrays of numbers"
+          );
         }
         if (input.vector1.length !== input.vector2.length) {
-          return Promise.resolve({
-            success: false,
-            error: "Vector dimensions must match",
-            code: "DIMENSION_MISMATCH"
-          });
+          throw new ValidationError("Vector dimensions must match", "DIMENSION_MISMATCH");
         }
         let result;
         switch (input.metric) {
@@ -12223,13 +12409,9 @@ function createVectorDistanceTool() {
             result = 1 - cosineSimilarity(input.vector1, input.vector2);
             break;
           default:
-            return Promise.resolve({
-              success: false,
-              error: `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`,
-              code: "VALIDATION_ERROR",
-              category: "validation",
-              recoverable: false
-            });
+            throw new ValidationError(
+              `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
+            );
         }
         return Promise.resolve({
           success: true,
@@ -12372,14 +12554,14 @@ function requireCoordinate(value, name, min, max) {
     throw new DbMcpError(
       `Invalid ${name}: value is not a valid number.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   if (value < min || value > max) {
     throw new DbMcpError(
       `Invalid ${name}: ${String(value)}. Must be between ${String(min)} and ${String(max)}.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   return value;
@@ -12389,7 +12571,7 @@ function requireNumber(value, name) {
     throw new DbMcpError(
       `Invalid ${name}: value is not a valid number.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   return value;
@@ -12665,19 +12847,35 @@ function createBackupTool(adapter) {
           path: ""
         };
       }
-      const pathCheck = validateSameDirPath(
-        input.targetPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.targetPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR",
-          path: input.targetPath
-        };
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.targetPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.targetPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            path: input.targetPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.targetPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.targetPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR",
+            path: input.targetPath
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
       }
-      const resolvedPath = pathCheck.resolvedPath;
       const escapedPath = resolvedPath.replace(/'/g, "''");
       const sql = `VACUUM INTO '${escapedPath}'`;
       const start = Date.now();
@@ -12687,7 +12885,7 @@ function createBackupTool(adapter) {
           progress,
           1,
           2,
-          `Creating backup at ${path__default.basename(resolvedPath)}...`
+          `Creating backup at ${nodePath__default.basename(resolvedPath)}...`
         );
         await adapter.executeQuery(sql);
         await sendProgress(progress, 2, 2, "Backup complete");
@@ -12737,18 +12935,34 @@ function createVacuumIntoTool(adapter) {
           ...formatHandlerError(new ValidationError("outputPath is required"))
         };
       }
-      const pathCheck = validateSameDirPath(
-        input.outputPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.outputPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR"
-        };
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.outputPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.outputPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            outputPath: input.outputPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.outputPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.outputPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR"
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
       }
-      const resolvedPath = pathCheck.resolvedPath;
       const escapedPath = resolvedPath.replace(/'/g, "''");
       const sql = `VACUUM INTO '${escapedPath}'`;
       const start = Date.now();
@@ -12975,26 +13189,53 @@ function createRestoreTool(adapter) {
           sourcePath: ""
         };
       }
-      const resolvedPath = path__default.resolve(input.sourcePath);
-      const pathCheck = validateSameDirPath(
-        input.sourcePath,
-        adapter.getConfiguredPath()
-      );
-      if (!pathCheck.valid) {
-        return {
-          ...formatHandlerError(new ValidationError(pathCheck.error)),
-          sourcePath: input.sourcePath
-        };
-      }
-      if (!fs.existsSync(resolvedPath)) {
-        return {
-          ...formatHandlerError(
-            new ValidationError(`Source file not found: ${input.sourcePath}`)
-          ),
-          sourcePath: input.sourcePath
-        };
+      let escapedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.sourcePath, allowedIoRoots);
+          const resolvedPath = nodePath__default.resolve(input.sourcePath);
+          if (!fs.existsSync(resolvedPath)) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  `Source file not found: ${input.sourcePath}`
+                )
+              ),
+              sourcePath: input.sourcePath
+            };
+          }
+          escapedPath = resolvedPath.replace(/'/g, "''");
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            sourcePath: input.sourcePath
+          };
+        }
+      } else {
+        const resolvedPath = nodePath__default.resolve(input.sourcePath);
+        const pathCheck = validateSameDirPath(
+          input.sourcePath,
+          adapter.getConfiguredPath()
+        );
+        if (!pathCheck.valid) {
+          return {
+            ...formatHandlerError(new ValidationError(pathCheck.error)),
+            sourcePath: input.sourcePath
+          };
+        }
+        if (!fs.existsSync(resolvedPath)) {
+          return {
+            ...formatHandlerError(
+              new ValidationError(`Source file not found: ${input.sourcePath}`)
+            ),
+            sourcePath: input.sourcePath
+          };
+        }
+        escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
       }
-      const escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
       await adapter.executeReadQuery("PRAGMA integrity_check(1)");
       await sendProgress(progress, 2, 5, "Attaching backup database...");
       try {
@@ -13203,25 +13444,41 @@ function createDumpTool(adapter) {
         };
       }
       if (!input.outputPath?.trim()) {
-        return {
-          ...formatHandlerError(new ValidationError("outputPath is required"))
-        };
-      }
-      const pathCheck = validateSameDirPath(
-        input.outputPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.outputPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR",
-          path: input.outputPath
+        return {
+          ...formatHandlerError(new ValidationError("outputPath is required"))
         };
       }
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.outputPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.outputPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            path: input.outputPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.outputPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.outputPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR",
+            path: input.outputPath
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
+      }
       const progress = buildProgressContext(context);
       const start = Date.now();
-      const resolvedPath = pathCheck.resolvedPath;
       await sendProgress(progress, 1, 4, "Preparing dump file...");
       const stream = fs.createWriteStream(resolvedPath, { encoding: "utf8" });
       try {
@@ -13273,9 +13530,9 @@ function createDumpTool(adapter) {
           }
         }
         stream.write("COMMIT;\n");
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve3, reject) => {
           stream.end(
-            (err) => err ? reject(err) : resolve4()
+            (err) => err ? reject(err) : resolve3()
           );
         });
       } catch (err) {
@@ -13327,29 +13584,57 @@ function createVerifyBackupTool(adapter) {
             backupPath: ""
           };
         }
-        const resolvedPath = path__default.resolve(input.backupPath);
-        const pathCheck = validateSameDirPath(
-          input.backupPath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            ...formatHandlerError(new ValidationError(pathCheck.error)),
-            backupPath: input.backupPath
-          };
-        }
-        if (!fs.existsSync(resolvedPath)) {
-          return {
-            ...formatHandlerError(
-              new ValidationError(
-                `Backup file not found: ${input.backupPath}`,
-                "FILE_NOT_FOUND"
-              )
-            ),
-            backupPath: input.backupPath
-          };
+        let escapedPath;
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.backupPath, allowedIoRoots);
+            const resolvedPath = nodePath__default.resolve(input.backupPath);
+            if (!fs.existsSync(resolvedPath)) {
+              return {
+                ...formatHandlerError(
+                  new ValidationError(
+                    `Backup file not found: ${input.backupPath}`,
+                    "FILE_NOT_FOUND"
+                  )
+                ),
+                backupPath: input.backupPath
+              };
+            }
+            escapedPath = resolvedPath.replace(/'/g, "''");
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR",
+              backupPath: input.backupPath
+            };
+          }
+        } else {
+          const resolvedPath = nodePath__default.resolve(input.backupPath);
+          const pathCheck = validateSameDirPath(
+            input.backupPath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              ...formatHandlerError(new ValidationError(pathCheck.error)),
+              backupPath: input.backupPath
+            };
+          }
+          if (!fs.existsSync(resolvedPath)) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  `Backup file not found: ${input.backupPath}`,
+                  "FILE_NOT_FOUND"
+                )
+              ),
+              backupPath: input.backupPath
+            };
+          }
+          escapedPath = resolvedPath.replace(/'/g, "''");
         }
-        const escapedPath = resolvedPath.replace(/'/g, "''");
         try {
           await adapter.rawQuery(
             `ATTACH DATABASE '${escapedPath}' AS backup_verify`
@@ -13521,10 +13806,10 @@ function createPragmaDatabaseListTool(adapter) {
           };
         });
         const configuredPath = adapter.getConfiguredPath();
-        const normalize2 = (p) => p.replace(/\\/g, "/");
+        const normalize = (p) => p.replace(/\\/g, "/");
         const mainDb = databases.find((db) => db.name === "main");
         const internalPathDiffers = Boolean(
-          mainDb?.file && normalize2(mainDb.file) !== normalize2(configuredPath.split(/[\\/]/).pop() ?? "")
+          mainDb?.file && normalize(mainDb.file) !== normalize(configuredPath.split(/[\\/]/).pop() ?? "")
         );
         return {
           success: true,
@@ -13702,46 +13987,6 @@ function createPragmaTableInfoTool(adapter) {
     }
   };
 }
-function createAppendInsightTool() {
-  return {
-    name: "sqlite_append_insight",
-    description: "Add a business insight to the memo://insights resource. Use this to capture key findings during data analysis.",
-    group: "admin",
-    inputSchema: AppendInsightSchema,
-    outputSchema: AppendInsightOutputSchema,
-    requiredScopes: ["write"],
-    annotations: write("Append Insight"),
-    handler: (_params, _context) => {
-      try {
-        const input = AppendInsightSchema.parse(_params);
-        let sanitizedInsight = input.insight.replace(/[<>]/g, "");
-        if (sanitizedInsight.length > 500) {
-          sanitizedInsight = sanitizedInsight.substring(0, 500) + "...";
-        }
-        if (!sanitizedInsight || sanitizedInsight.trim().length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "Insight must be a non-empty string",
-            message: "",
-            insightCount: insightsManager.count()
-          });
-        }
-        insightsManager.append(sanitizedInsight);
-        return Promise.resolve({
-          success: true,
-          message: "Insight added to memo",
-          insightCount: insightsManager.count()
-        });
-      } catch (error) {
-        return Promise.resolve({
-          ...formatHandlerError(error),
-          message: "",
-          insightCount: insightsManager.count()
-        });
-      }
-    }
-  };
-}
 function createAttachDatabaseTool(adapter) {
   return {
     name: "sqlite_attach_database",
@@ -13762,18 +14007,37 @@ function createAttachDatabaseTool(adapter) {
             code: "VALIDATION_ERROR"
           };
         }
-        const pathCheck = validateSameDirPath(
-          input.filepath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            success: false,
-            error: pathCheck.error,
-            code: "SECURITY_ERROR"
-          };
+        let escapedPath;
+        let finalResolvedPath;
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.filepath, allowedIoRoots);
+            const resolvedPath = input.filepath;
+            escapedPath = resolvedPath.replace(/'/g, "''");
+            finalResolvedPath = resolvedPath;
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR"
+            };
+          }
+        } else {
+          const pathCheck = validateSameDirPath(
+            input.filepath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              success: false,
+              error: pathCheck.error,
+              code: "SECURITY_ERROR"
+            };
+          }
+          escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
+          finalResolvedPath = pathCheck.resolvedPath;
         }
-        const escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
         await adapter.rawQuery(
           `ATTACH DATABASE '${escapedPath}' AS "${input.alias.replace(/"/g, '""')}"`
         );
@@ -13781,7 +14045,7 @@ function createAttachDatabaseTool(adapter) {
           success: true,
           message: `Database attached as '${input.alias}'`,
           alias: input.alias,
-          filepath: pathCheck.resolvedPath.split(/[\\/]/).pop() ?? ""
+          filepath: finalResolvedPath.split(/[\\/]/).pop() ?? ""
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -13990,7 +14254,6 @@ function getAdminTools(adapter) {
     createPragmaOptimizeTool(adapter),
     createPragmaSettingsTool(adapter),
     createPragmaTableInfoTool(adapter),
-    createAppendInsightTool(),
     createAttachDatabaseTool(adapter),
     createDetachDatabaseTool(adapter),
     createVacuumIntoTool(adapter),
@@ -14262,7 +14525,8 @@ var IndexAuditOutputSchema = z.object({
       type: z.enum([
         "redundant",
         "missing_fk_index",
-        "unindexed_large_table"
+        "unindexed_large_table",
+        "missing_composite_index"
       ]),
       severity: z.enum(["info", "warning", "error"]),
       table: z.string(),
@@ -14315,23 +14579,6 @@ var coerceNumber8 = (val) => {
   }
   return val;
 };
-var VALID_SECTIONS = ["tables", "views", "indexes", "triggers"];
-var coerceSections = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_SECTIONS.includes(v)
-) : val;
-var VALID_CHECKS = [
-  "missing_pk",
-  "missing_not_null",
-  "unindexed_fk",
-  "missing_fk"
-];
-var coerceChecks = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_CHECKS.includes(v)
-) : val;
-var VALID_DIRECTIONS = ["create", "drop"];
-var coerceDirection = (val) => typeof val === "string" && VALID_DIRECTIONS.includes(val) ? val : typeof val === "string" ? void 0 : val;
-var VALID_OPERATIONS = ["DELETE", "DROP", "TRUNCATE"];
-var coerceOperation = (val) => typeof val === "string" && VALID_OPERATIONS.includes(val) ? val : typeof val === "string" ? void 0 : val;
 var StorageAnalysisSchema = z.object({
   includeTableDetails: z.boolean().optional().describe("Include per-table size breakdown (default: true)"),
   excludeSystemTables: z.boolean().optional().describe(
@@ -14350,41 +14597,42 @@ var IndexAuditSchema = z.object({
   ),
   minSeverity: z.enum(["info", "warning", "error"]).optional().describe(
     "Minimum severity to include in findings (default: all). Reduces payload for large databases."
+  ),
+  recommendComposite: z.boolean().optional().default(false).describe(
+    "Analyze queriesToAnalyze to recommend composite/partial indexes"
+  ),
+  queriesToAnalyze: z.array(z.string()).optional().describe(
+    "Queries to analyze using EXPLAIN QUERY PLAN (used if recommendComposite is true)"
   )
-}).default({});
+}).default({ recommendComposite: false });
 var SchemaSnapshotSchema = z.object({
-  sections: z.preprocess(
-    coerceSections,
-    z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional()
-  ).describe("Specific sections to include (default: all)"),
-  compact: z.boolean().optional().describe(
-    "Omit column details from tables section for reduced payload (default: false)"
+  sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Specific sections to include (default: all)"),
+  compact: z.boolean().optional().default(true).describe(
+    "Omit column details from tables section for reduced payload (default: true)"
   ),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables, views, indexes, and triggers (default: true)"
   )
-}).default({});
+}).default({ compact: true });
 var MigrationRisksSchema = z.object({
   statements: z.array(z.string()).optional().default([]).describe("Array of DDL statements to analyze for risks")
 }).default({ statements: [] });
 var ConstraintAnalysisSchema = z.object({
   table: z.string().optional().describe("Analyze constraints for a specific table only"),
-  checks: z.preprocess(
-    coerceChecks,
-    z.array(
-      z.enum([
-        "missing_pk",
-        "missing_not_null",
-        "unindexed_fk",
-        "missing_fk"
-      ])
-    ).optional()
-  ).describe("Specific checks to run (default: all)"),
+  checks: z.array(
+    z.enum([
+      "missing_pk",
+      "missing_not_null",
+      "unindexed_fk",
+      "missing_fk"
+    ])
+  ).optional().describe("Specific checks to run (default: all)"),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables from constraint analysis (default: true)"
   )
 }).default({});
 var DependencyGraphSchema = z.object({
+  table: z.string().optional().describe("Optional table name to filter the graph"),
   includeRowCounts: z.boolean().optional().describe("Include row counts per table (default: true)"),
   nodesOnly: z.boolean().optional().describe(
     "Return only nodes without edges for a lightweight response (default: false)"
@@ -14394,7 +14642,7 @@ var DependencyGraphSchema = z.object({
   )
 }).default({});
 var TopologicalSortSchema = z.object({
-  direction: z.preprocess(coerceDirection, z.enum(["create", "drop"]).optional()).describe(
+  direction: z.enum(["create", "drop"]).optional().describe(
     "Sort direction: 'create' = dependencies first, 'drop' = dependents first (default: create)"
   ),
   excludeSystemTables: z.boolean().optional().describe(
@@ -14404,9 +14652,9 @@ var TopologicalSortSchema = z.object({
 var CascadeSimulatorSchema = z.object({
   table: z.string().optional().default("").describe("Table name to simulate deletion from"),
   operation: z.preprocess(
-    coerceOperation,
-    z.enum(["DELETE", "DROP", "TRUNCATE"]).optional()
-  ).describe("Operation to simulate (default: DELETE)"),
+    (val) => typeof val === "string" ? val.toUpperCase() : val,
+    z.enum(["DELETE", "DROP", "TRUNCATE"])
+  ).optional().describe("Operation to simulate (default: DELETE)"),
   compact: z.boolean().optional().describe(
     "Omit path arrays from affected entries to reduce payload (default: false)"
   )
@@ -14472,21 +14720,20 @@ var SchemaDiffOutputSchema = z.object({
   }).optional(),
   comparedAt: z.string().optional()
 }).extend(ErrorResponseFields.shape);
-var VALID_DIFF_SECTIONS = ["tables", "views", "indexes", "triggers"];
-var coerceDiffSections = (val) => Array.isArray(val) ? val.filter(
-  (v) => typeof v === "string" && VALID_DIFF_SECTIONS.includes(v)
-) : val;
 var SchemaDiffSchema = z.object({
-  baseline: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
+  baseline: z.preprocess(
+    (val) => Array.isArray(val) ? val.length === 0 ? {} : { tables: val } : val,
+    z.union([z.literal("current"), SchemaSnapshotShape])
+  ).optional().describe(
     "Baseline schema \u2014 'current' to snapshot live DB, or an inline snapshot object from a previous sqlite_schema_snapshot call"
   ),
-  target: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
+  target: z.preprocess(
+    (val) => Array.isArray(val) ? val.length === 0 ? {} : { tables: val } : val,
+    z.union([z.literal("current"), SchemaSnapshotShape])
+  ).optional().describe(
     "Target schema to compare against baseline \u2014 'current' to snapshot live DB, or an inline snapshot object"
   ),
-  sections: z.preprocess(
-    coerceDiffSections,
-    z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional()
-  ).describe("Sections to compare (default: all)"),
+  sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Sections to compare (default: all)"),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables when capturing live schema (default: true)"
   )
@@ -14505,42 +14752,80 @@ function createDependencyGraphTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = DependencyGraphSchema.parse(params);
+        if (input.table) {
+          const tableCheck = await adapter.executeReadQuery(
+            `SELECT 1 FROM sqlite_master WHERE type='table' AND name=?`,
+            [input.table]
+          );
+          if ((tableCheck.rows?.length ?? 0) === 0) {
+            return {
+              success: false,
+              error: `Table '${input.table}' does not exist`,
+              code: "TABLE_NOT_FOUND",
+              category: "resource",
+              suggestion: "Table not found. Run sqlite_list_tables to see available tables.",
+              recoverable: false
+            };
+          }
+        }
         const includeRowCounts = input.includeRowCounts !== false;
         const { nodes, edges } = await buildForeignKeyGraph(adapter, {
           excludeSystemTables: input.excludeSystemTables,
           includeRowCounts
         });
+        let finalNodes = nodes;
+        let finalEdges = edges;
+        if (input.table) {
+          const connected = /* @__PURE__ */ new Set([input.table]);
+          let added = true;
+          while (added) {
+            added = false;
+            for (const e of edges) {
+              if (connected.has(e.from) && !connected.has(e.to)) {
+                connected.add(e.to);
+                added = true;
+              } else if (connected.has(e.to) && !connected.has(e.from)) {
+                connected.add(e.from);
+                added = true;
+              }
+            }
+          }
+          finalNodes = nodes.filter((n) => connected.has(n.table));
+          finalEdges = edges.filter(
+            (e) => connected.has(e.from) && connected.has(e.to)
+          );
+        }
         const adjacency = /* @__PURE__ */ new Map();
-        for (const node of nodes) {
+        for (const node of finalNodes) {
           adjacency.set(node.table, []);
         }
-        for (const edge of edges) {
+        for (const edge of finalEdges) {
           adjacency.get(edge.from)?.push(edge.to);
         }
         const cycles = detectCycles(
           adjacency,
-          nodes.map((n) => n.table)
+          finalNodes.map((n) => n.table)
         );
-        const referencedTables = new Set(edges.map((e) => e.to));
-        const referencingTables = new Set(edges.map((e) => e.from));
-        const rootTables = nodes.filter(
+        const referencedTables = new Set(finalEdges.map((e) => e.to));
+        const referencingTables = new Set(finalEdges.map((e) => e.from));
+        const rootTables = finalNodes.filter(
           (n) => referencedTables.has(n.table) && !referencingTables.has(n.table)
         ).map((n) => n.table);
-        const leafTables = nodes.filter(
+        const leafTables = finalNodes.filter(
           (n) => referencingTables.has(n.table) && !referencedTables.has(n.table)
         ).map((n) => n.table);
         const nodesOnly = input.nodesOnly === true;
         return {
           success: true,
-          nodes: nodes.map((n) => ({
+          nodes: finalNodes.map((n) => ({
             table: n.table,
             ...includeRowCounts ? { rowCount: n.rowCount } : {}
           })),
-          ...!nodesOnly ? { edges } : {},
+          ...!nodesOnly ? { edges: finalEdges } : {},
           circularDependencies: cycles.length > 0 ? cycles : void 0,
           stats: {
-            totalTables: nodes.length,
-            totalRelationships: edges.length,
+            totalTables: finalNodes.length,
+            totalRelationships: finalEdges.length,
             rootTables,
             leafTables
           }
@@ -15845,6 +16130,35 @@ function createIndexAuditTool(adapter) {
           } catch {
           }
         }
+        if (input.recommendComposite && input.queriesToAnalyze && input.queriesToAnalyze.length > 0) {
+          for (const query of input.queriesToAnalyze) {
+            try {
+              if (/^\s*SELECT/i.test(query)) {
+                const planResult = await adapter.executeReadQuery(
+                  `EXPLAIN QUERY PLAN ${query}`
+                );
+                const planRows = planResult.rows ?? [];
+                for (const row of planRows) {
+                  const detailVal = row["detail"];
+                  const detail = typeof detailVal === "string" ? detailVal : "";
+                  if (detail.startsWith("SCAN TABLE") || detail.startsWith("SCAN ")) {
+                    const match = /SCAN (?:TABLE )?([\w_]+)/i.exec(detail);
+                    const tableName = match ? match[1] : "unknown";
+                    if (tableName && tableName !== "unknown") {
+                      findings.push({
+                        type: "missing_composite_index",
+                        severity: "warning",
+                        table: tableName,
+                        suggestion: `Query resulted in SCAN TABLE "${tableName}". Consider analyzing WHERE/JOIN clauses to add a composite index.`
+                      });
+                    }
+                  }
+                }
+              }
+            } catch {
+            }
+          }
+        }
         const redundantCount = findings.filter(
           (f) => f.type === "redundant"
         ).length;
@@ -16088,7 +16402,7 @@ var MigrationStatusOutputSchema = z.object({
   }).optional(),
   sourceSystems: z.array(z.string()).optional()
 }).extend(ErrorResponseFields.shape);
-var MigrationInitSchema = z.object({}).default({});
+var MigrationInitSchema = z.object({}).strict().default({});
 var MigrationRecordSchema = z.object({
   version: z.string().describe("Version identifier (e.g., '1.0.0', '2024-01-15-add-users')"),
   description: z.string().optional().describe("Human-readable description of the migration"),
@@ -16163,7 +16477,7 @@ var MigrationHistorySchema = z.object({
     "Omit migrationHash and sourceSystem from records to reduce payload (default: false)"
   )
 }).default({});
-var MigrationStatusSchema = z.object({}).default({});
+var MigrationStatusSchema = z.object({}).strict().default({});
 var MIGRATIONS_TABLE = "_mcp_migrations";
 function toMigrationRecord(row) {
   return {
@@ -16191,7 +16505,7 @@ function validateMigrationSql(sql) {
   const cleanSql = sql.replace(/\/\*[\s\S]*?\*\//g, "").replace(/--.*$/gm, "");
   const upperSql = cleanSql.toUpperCase();
   if (upperSql.includes("ATTACH ") || upperSql.includes("DETACH ") || upperSql.includes("PRAGMA ") || upperSql.includes("LOAD_EXTENSION(")) {
-    throw new Error(
+    throw new ValidationError(
       `Migration validation failed: unauthorized command or function call`
     );
   }
@@ -16884,6 +17198,10 @@ var POSITIONAL_PARAM_MAP = {
   listConstraints: "table",
   dateAdd: ["table", "column", "amount", "unit", "whereClause"],
   dateDiff: ["table", "column1", "column2", "unit", "whereClause"],
+  enableVersioning: "table",
+  disableVersioning: "table",
+  checkVersion: ["table", "rowId"],
+  conditionalUpdate: ["table", "data", "conditions", "expectedVersion"],
   // JSON
   extract: ["table", "column", "path", "whereClause"],
   set: ["table", "column", "path", "value", "whereClause"],
@@ -16909,6 +17227,7 @@ var POSITIONAL_PARAM_MAP = {
   jsonbConvert: ["table", "column"],
   createJsonCollection: "tableName",
   // Text
+  sentiment: "text",
   regexExtract: ["table", "column", "pattern"],
   regexMatch: ["table", "column", "pattern"],
   split: ["table", "column", "delimiter"],
@@ -16966,7 +17285,6 @@ var POSITIONAL_PARAM_MAP = {
   pragmaSettings: "pragma",
   pragmaTableInfo: "table",
   pragmaCompileOptions: "filter",
-  appendInsight: "insight",
   generateSeries: ["start", "stop", "step"],
   createView: ["viewName", "selectQuery"],
   dropView: "viewName",
@@ -17038,7 +17356,7 @@ function normalizeParams(methodName, args) {
       if (Array.isArray(paramMapping2) && paramMapping2[0] !== void 0) {
         return { [paramMapping2[0]]: arg };
       }
-      throw new Error(
+      throw new ValidationError(
         `Positional arguments are not supported for method: ${methodName}. Please use an options object.`
       );
     }
@@ -17046,7 +17364,7 @@ function normalizeParams(methodName, args) {
   }
   const paramMapping = POSITIONAL_PARAM_MAP[methodName];
   if (paramMapping === void 0) {
-    throw new Error(
+    throw new ValidationError(
       `Positional arguments are not supported for method: ${methodName}. Please use an options object.`
     );
   }
@@ -17096,7 +17414,7 @@ function createGroupApi(groupName, tools, baseContext) {
     api[methodName] = async (...args) => {
       if (baseContext?.auth !== void 0) {
         if (!scopesGrantToolAccess(baseContext.auth.scopes ?? [], tool.name)) {
-          throw new Error(
+          throw new AuthorizationError(
             `Forbidden: Required scope for tool '${tool.name}' not granted.`
           );
         }
@@ -17107,7 +17425,8 @@ function createGroupApi(groupName, tools, baseContext) {
         requestId: crypto.randomUUID(),
         ...baseContext?.server !== void 0 ? { server: baseContext.server } : {},
         ...baseContext?.progressToken !== void 0 ? { progressToken: baseContext.progressToken } : {},
-        ...baseContext?.auth !== void 0 ? { auth: baseContext.auth } : {}
+        ...baseContext?.auth !== void 0 ? { auth: baseContext.auth } : {},
+        isCodeMode: true
       };
       const result = await tool.handler(normalizedParams, context);
       return result;
@@ -17269,7 +17588,8 @@ function createSqliteApi(tools, baseContext) {
 var DEFAULT_SANDBOX_OPTIONS = {
   memoryLimitMb: 128,
   timeoutMs: 5e3,
-  cpuLimitMs: 1e4
+  cpuLimitMs: 1e4,
+  strictIsolation: true
 };
 var DEFAULT_POOL_OPTIONS = {
   minInstances: 2,
@@ -17465,7 +17785,7 @@ var CodeModeSecurityManager = class {
       const redactedResult = redactObject(result, 0, 15);
       const serialized = JSON.stringify(redactedResult);
       if (serialized === void 0) {
-        throw new Error("Not serializable");
+        throw new InternalError("Not serializable");
       }
       if (serialized.length > this.config.maxResultSize) {
         return {
@@ -17565,6 +17885,9 @@ return ${lastStmt}`;
 }
 
 // src/codemode/sandbox.ts
+var GROUP_NAME_REGEX = /^[a-zA-Z0-9_]+$/;
+var astCache = /* @__PURE__ */ new Map();
+var MAX_AST_CACHE_SIZE = 500;
 var CodeModeSandbox = class _CodeModeSandbox {
   options;
   disposed = false;
@@ -17593,9 +17916,8 @@ var CodeModeSandbox = class _CodeModeSandbox {
         metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
       };
     }
-    const groupNameRegex = /^[a-zA-Z0-9_]+$/;
     for (const groupName of Object.keys(apiBindings)) {
-      if (!groupNameRegex.test(groupName) || groupName === "__proto__" || groupName === "constructor" || groupName === "prototype") {
+      if (!GROUP_NAME_REGEX.test(groupName) || groupName === "__proto__" || groupName === "constructor" || groupName === "prototype") {
         return {
           success: false,
           error: `Security Error: Invalid tool group name '${groupName}'`,
@@ -17605,30 +17927,39 @@ var CodeModeSandbox = class _CodeModeSandbox {
     }
     try {
       const wrappedCode = `async function __wrapper() { ${code} }`;
-      const ast = acorn.parse(wrappedCode, {
-        ecmaVersion: "latest",
-        sourceType: "script"
-      });
-      const validateAst = (node) => {
-        if (node === null || node === void 0 || typeof node !== "object")
-          return;
-        const n = node;
-        if (n["type"] === "WithStatement") {
-          throw new Error("'with' statements are forbidden in sandbox code.");
-        }
-        if (n["type"] === "MemberExpression" && n["object"] !== null && n["object"] !== void 0 && typeof n["object"] === "object" && n["object"]["type"] === "Identifier") {
-          const objName = n["object"]["name"];
-          if (["process", "require", "global", "globalThis"].includes(objName)) {
-            throw new Error(`Access to '${objName}' is forbidden.`);
+      if (!astCache.has(wrappedCode)) {
+        const ast = acorn.parse(wrappedCode, {
+          ecmaVersion: "latest",
+          sourceType: "script"
+        });
+        const validateAst = (node) => {
+          if (node === null || node === void 0 || typeof node !== "object")
+            return;
+          const n = node;
+          if (n["type"] === "WithStatement") {
+            throw new ValidationError(
+              "'with' statements are forbidden in sandbox code."
+            );
           }
-        }
-        for (const key in n) {
-          if (key !== "loc" && key !== "start" && key !== "end") {
-            validateAst(n[key]);
+          if (n["type"] === "MemberExpression" && n["object"] !== null && n["object"] !== void 0 && typeof n["object"] === "object" && n["object"]["type"] === "Identifier") {
+            const objName = n["object"]["name"];
+            if (["process", "require", "global", "globalThis"].includes(objName)) {
+              throw new ValidationError(`Access to '${objName}' is forbidden.`);
+            }
           }
+          for (const key in n) {
+            if (key !== "loc" && key !== "start" && key !== "end") {
+              validateAst(n[key]);
+            }
+          }
+        };
+        validateAst(ast);
+        if (astCache.size >= MAX_AST_CACHE_SIZE) {
+          const firstKey = astCache.keys().next().value;
+          if (firstKey) astCache.delete(firstKey);
         }
-      };
-      validateAst(ast);
+        astCache.set(wrappedCode, ast);
+      }
     } catch (e) {
       return {
         success: false,
@@ -17644,6 +17975,13 @@ var CodeModeSandbox = class _CodeModeSandbox {
     } catch {
     }
     if (!ivmLib) {
+      if (this.options.strictIsolation) {
+        return {
+          success: false,
+          error: "Security Error: isolated-vm native bindings failed to load. Code Mode strict isolation is enabled and node:vm fallback is prohibited.",
+          metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
+        };
+      }
       const vm = await import('vm');
       const logs2 = [];
       const sandboxEnv = {
@@ -17670,6 +18008,28 @@ var CodeModeSandbox = class _CodeModeSandbox {
         }
       }
       const context2 = vm.createContext(sandboxEnv);
+      vm.runInContext(
+        `
+        const proxyHandler = {
+          get(target, prop, receiver) {
+            if (typeof prop === "string" && !(prop in target)) {
+              const camelProp = prop.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+              if (camelProp in target) {
+                return Reflect.get(target, camelProp, receiver);
+              }
+            }
+            return Reflect.get(target, prop, receiver);
+          }
+        };
+        sqlite = new Proxy(sqlite, proxyHandler);
+        for (const key of Object.keys(sqlite)) {
+          if (typeof sqlite[key] === "object" && sqlite[key] !== null) {
+            sqlite[key] = new Proxy(sqlite[key], proxyHandler);
+          }
+        }
+      `,
+        context2
+      );
       const startTime2 = performance.now();
       let result2;
       let success2 = true;
@@ -17699,94 +18059,125 @@ var CodeModeSandbox = class _CodeModeSandbox {
     const isolate = new ivmLib.Isolate({
       memoryLimit: this.options.memoryLimitMb
     });
-    const context = isolate.createContextSync();
-    const jail = context.global;
-    jail.setSync("global", jail.derefInto());
-    const logs = [];
-    const logRef = new ivmLib.Reference((level, ...args) => {
-      const msg = args.map(
-        (a) => typeof a === "object" && a !== null ? JSON.stringify(a) : String(a)
-      ).join(" ");
-      logs.push(level === "LOG" ? msg : `[${level}] ${msg}`);
-    });
-    context.global.setSync("logRef", logRef);
-    const setupScript = `
-      globalThis.console = {
-        log: (...args) => logRef.applyIgnored(undefined, ['LOG', ...args], { arguments: { copy: true } }),
-        error: (...args) => logRef.applyIgnored(undefined, ['ERROR', ...args], { arguments: { copy: true } }),
-        warn: (...args) => logRef.applyIgnored(undefined, ['WARN', ...args], { arguments: { copy: true } }),
-        info: (...args) => logRef.applyIgnored(undefined, ['INFO', ...args], { arguments: { copy: true } }),
-        debug: (...args) => logRef.applyIgnored(undefined, ['DEBUG', ...args], { arguments: { copy: true } })
-      };
-      globalThis.sqlite = {};
-    `;
-    context.evalSync(setupScript);
-    let rpcCount = 0;
-    const MAX_RPC_CALLS = 100;
+    let context;
+    let logRef;
+    let script;
     const refCleanup = [];
-    for (const [groupName, groupValue] of Object.entries(apiBindings)) {
-      if (typeof groupValue === "object" && groupValue !== null) {
-        context.evalSync(
-          `globalThis.sqlite[${JSON.stringify(groupName)}] = {};`
-        );
-        for (const [methodName, methodFn] of Object.entries(groupValue)) {
-          if (typeof methodFn === "function") {
-            const fnRef = new ivmLib.Reference(async (...args) => {
-              if (++rpcCount > MAX_RPC_CALLS) {
-                throw new Error(
-                  `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
-                );
-              }
-              try {
-                return await methodFn(...args);
-              } catch (e) {
-                throw new Error(e instanceof Error ? e.message : String(e), {
-                  cause: e
-                });
-              }
-            });
-            refCleanup.push(fnRef);
-            const refName = `fnRef_${groupName}_${methodName}`;
-            context.global.setSync(refName, fnRef);
-            context.evalSync(`
-              globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
-                return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
-              };
-            `);
-          }
-        }
-      } else if (typeof groupValue === "function") {
-        const fnRef = new ivmLib.Reference(async (...args) => {
-          if (++rpcCount > MAX_RPC_CALLS) {
-            throw new Error(
-              `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
-            );
-          }
-          try {
-            return await groupValue(...args);
-          } catch (e) {
-            throw new Error(e instanceof Error ? e.message : String(e), {
-              cause: e
-            });
-          }
-        });
-        refCleanup.push(fnRef);
-        const refName = `fnRef_${groupName}`;
-        context.global.setSync(refName, fnRef);
-        context.evalSync(`
-          globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
-            return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
-          };
-        `);
-      }
-    }
+    const logs = [];
     const startTime = performance.now();
     let result;
     let success = true;
     let errorMsg;
     try {
+      context = isolate.createContextSync();
+      const jail = context.global;
+      jail.setSync("global", jail.derefInto());
+      logRef = new ivmLib.Reference((level, ...args) => {
+        const msg = args.map(
+          (a) => typeof a === "object" && a !== null ? JSON.stringify(a) : String(a)
+        ).join(" ");
+        logs.push(level === "LOG" ? msg : `[${level}] ${msg}`);
+      });
+      context.global.setSync("logRef", logRef);
+      const setupScript = `
+        globalThis.console = {
+          log: (...args) => logRef.applyIgnored(undefined, ['LOG', ...args], { arguments: { copy: true } }),
+          error: (...args) => logRef.applyIgnored(undefined, ['ERROR', ...args], { arguments: { copy: true } }),
+          warn: (...args) => logRef.applyIgnored(undefined, ['WARN', ...args], { arguments: { copy: true } }),
+          info: (...args) => logRef.applyIgnored(undefined, ['INFO', ...args], { arguments: { copy: true } }),
+          debug: (...args) => logRef.applyIgnored(undefined, ['DEBUG', ...args], { arguments: { copy: true } })
+        };
+        globalThis.sqlite = {};
+      `;
+      context.evalSync(setupScript);
+      let rpcCount = 0;
+      const MAX_RPC_CALLS = 100;
+      let batchedScript = "";
+      for (const [groupName, groupValue] of Object.entries(apiBindings)) {
+        if (typeof groupValue === "object" && groupValue !== null) {
+          batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}] = {};
+`;
+          for (const [methodName, methodFn] of Object.entries(groupValue)) {
+            if (typeof methodFn === "function") {
+              const fnRef = new ivmLib.Reference(async (...args) => {
+                if (++rpcCount > MAX_RPC_CALLS) {
+                  throw new RateLimitError(
+                    `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
+                  );
+                }
+                try {
+                  return await methodFn(...args);
+                } catch (e) {
+                  throw new InternalError(
+                    e instanceof Error ? e.message : String(e),
+                    "RPC_EXECUTION_ERROR",
+                    {
+                      cause: e instanceof Error ? e : void 0
+                    }
+                  );
+                }
+              });
+              refCleanup.push(fnRef);
+              const refName = `fnRef_${groupName}_${methodName}`;
+              context.global.setSync(refName, fnRef);
+              batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
+                  return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
+                };
+`;
+            }
+          }
+        } else if (typeof groupValue === "function") {
+          const fnRef = new ivmLib.Reference(async (...args) => {
+            if (++rpcCount > MAX_RPC_CALLS) {
+              throw new RateLimitError(
+                `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
+              );
+            }
+            try {
+              return await groupValue(...args);
+            } catch (e) {
+              throw new InternalError(
+                e instanceof Error ? e.message : String(e),
+                "RPC_EXECUTION_ERROR",
+                {
+                  cause: e instanceof Error ? e : void 0
+                }
+              );
+            }
+          });
+          refCleanup.push(fnRef);
+          const refName = `fnRef_${groupName}`;
+          context.global.setSync(refName, fnRef);
+          batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
+              return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
+            };
+`;
+        }
+      }
+      if (batchedScript.length > 0) {
+        context.evalSync(batchedScript);
+      }
+      context.evalSync(`
+        const proxyHandler = {
+          get(target, prop, receiver) {
+            if (typeof prop === "string" && !(prop in target)) {
+              const camelProp = prop.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+              if (camelProp in target) {
+                return Reflect.get(target, camelProp, receiver);
+              }
+            }
+            return Reflect.get(target, prop, receiver);
+          }
+        };
+        globalThis.sqlite = new Proxy(globalThis.sqlite, proxyHandler);
+        for (const key of Object.keys(globalThis.sqlite)) {
+          if (typeof globalThis.sqlite[key] === "object" && globalThis.sqlite[key] !== null) {
+            globalThis.sqlite[key] = new Proxy(globalThis.sqlite[key], proxyHandler);
+          }
+        }
+      `);
       const wrappedCode = `(async () => { ${transformAutoReturn(code)} })()`;
-      const script = isolate.compileScriptSync(wrappedCode, {
+      script = isolate.compileScriptSync(wrappedCode, {
         filename: `code-mode.js`
       });
       result = await script.run(context, {
@@ -17799,11 +18190,27 @@ var CodeModeSandbox = class _CodeModeSandbox {
       errorMsg = error instanceof Error ? error.message : String(error);
     } finally {
       for (const ref of refCleanup) {
-        ref.release();
+        try {
+          ref.release();
+        } catch {
+        }
+      }
+      try {
+        logRef?.release();
+      } catch {
+      }
+      try {
+        script?.release();
+      } catch {
+      }
+      try {
+        context?.release();
+      } catch {
+      }
+      try {
+        isolate.dispose();
+      } catch {
       }
-      logRef.release();
-      context.release();
-      isolate.dispose();
     }
     const endTime = performance.now();
     this.accumulatedLogs.push(...logs);
@@ -17847,7 +18254,10 @@ var SandboxPool = class _SandboxPool {
   }
   static getIvmLib() {
     if (!_SandboxPool.cachedIvmLib) {
-      throw new Error("ivmLib not initialized");
+      throw new InternalError(
+        "ivmLib not initialized",
+        "IVMLIB_NOT_INITIALIZED"
+      );
     }
     return _SandboxPool.cachedIvmLib;
   }
@@ -17866,8 +18276,9 @@ var SandboxPool = class _SandboxPool {
       await _SandboxPool.initialize();
     }
     if (this.inUseCount >= this.options.maxInstances) {
-      throw new Error(
-        `Sandbox pool exhausted (max ${this.options.maxInstances})`
+      throw new InternalError(
+        `Sandbox pool exhausted (max ${this.options.maxInstances})`,
+        "POOL_EXHAUSTED"
       );
     }
     this.inUseCount++;
@@ -18004,15 +18415,14 @@ function createExecuteCodeTool(adapter) {
         }
         const clientId = _context.auth?.sub ?? _context.clientIp ?? processId;
         if (!await security.checkRateLimit(clientId)) {
-          return {
-            success: false,
-            error: `Rate limit exceeded. Maximum ${String(codemodeRateLimit)} executions per minute.`,
-            code: "CODEMODE_RATE_LIMITED",
-            category: "permission",
-            suggestion: "Wait before retrying. Combine multiple operations into fewer execute_code calls.",
-            recoverable: true,
-            metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
-          };
+          throw new RateLimitError(
+            `Rate limit exceeded. Maximum ${String(codemodeRateLimit)} executions per minute.`,
+            "CODEMODE_RATE_LIMITED",
+            {
+              suggestion: "Wait before retrying. Combine multiple operations into fewer execute_code calls.",
+              limit: codemodeRateLimit
+            }
+          );
         }
         if (!pool) {
           initializePool();
@@ -18027,7 +18437,7 @@ function createExecuteCodeTool(adapter) {
           throw new DbMcpError(
             "Sandbox pool not initialized",
             "CODEMODE_POOL_UNINITIALIZED",
-            "internal" /* INTERNAL */
+            ErrorCategory.INTERNAL
           );
         }
         const result = await pool.execute(code, bindings, timeoutMs);
@@ -18047,6 +18457,13 @@ function createExecuteCodeTool(adapter) {
           } catch {
           }
         }
+        if (!result.success && typeof result.error === "string" && /script execution timed out/i.test(result.error)) {
+          return formatHandlerError(
+            new TimeoutError("Code execution timed out", "CODEMODE_TIMEOUT", {
+              suggestion: "Reduce code complexity or increase the timeout parameter (max 30000ms). Break complex logic into smaller execute_code calls."
+            })
+          );
+        }
         return {
           success: result.success,
           result: sanitizedResult,
@@ -18064,6 +18481,14 @@ function createExecuteCodeTool(adapter) {
           operation: "executeCode",
           error: error instanceof Error ? error : void 0
         });
+        if (error instanceof Error && /script execution timed out/i.test(error.message)) {
+          return formatHandlerError(
+            new TimeoutError("Code execution timed out", "CODEMODE_TIMEOUT", {
+              suggestion: "Reduce code complexity or increase the timeout parameter (max 30000ms). Break complex logic into smaller execute_code calls.",
+              cause: error
+            })
+          );
+        }
         return formatHandlerError(error);
       }
     }
@@ -18113,7 +18538,8 @@ function initializePool() {
     operation: "initialize"
   });
   setDefaultSandboxMode(mode);
-  pool = createSandboxPool(mode, void 0, { timeoutMs: 3e4 });
+  const strictIsolation = process.env["CODE_MODE_STRICT_ISOLATION"] !== "false";
+  pool = createSandboxPool(mode, void 0, { timeoutMs: 3e4, strictIsolation });
   pool.initialize();
   logger.info(`Code Mode initialized with ${mode} sandbox`, {
     module: "CODEMODE",
@@ -18173,6 +18599,8 @@ function detectAndSetJsonbSupport(getVersion, log2) {
 }
 
 // src/adapters/sqlite/query-executor.ts
+var RETURNING_REGEX = /\bRETURNING\b/i;
+var INSERT_REGEX = /^\s*INSERT\s/i;
 var log = createModuleLogger("SQLITE");
 function translateSqliteError(error, sql, operation, overrideLog) {
   const message = error instanceof Error ? error.message : String(error);
@@ -18180,8 +18608,7 @@ function translateSqliteError(error, sql, operation, overrideLog) {
   const improvedMessage = `${operation} failed: ${message}`;
   const details = { sql };
   if (match?.code === "TABLE_NOT_FOUND") {
-    const tableMatch = /no such table[:\s]*(['"]?)([\w.]+)\1/i.exec(message);
-    const tableName = tableMatch ? tableMatch[2] : "unknown";
+    const tableName = match.match?.[2] ?? "unknown";
     throw new ResourceNotFoundError(
       `Table '${tableName}' not found`,
       "TABLE_NOT_FOUND",
@@ -18195,8 +18622,7 @@ function translateSqliteError(error, sql, operation, overrideLog) {
     );
   }
   if (match?.code === "COLUMN_NOT_FOUND") {
-    const colMatch = /no such column[:\s]*(['"]?)([\w.]+)\1/i.exec(message) ?? /has no column named[:\s]*(['"]?)([\w.]+)\1/i.exec(message);
-    const colName = colMatch ? colMatch[2] : "unknown";
+    const colName = match.match?.[2] ?? "unknown";
     throw new ResourceNotFoundError(
       `Column '${colName}' not found`,
       "COLUMN_NOT_FOUND",
@@ -18276,7 +18702,7 @@ function executeWrite(db, sql, params) {
   try {
     const normalizedParams = normalizeSqliteParams(params);
     let rows = [];
-    if (/\bRETURNING\b/i.test(sql)) {
+    if (RETURNING_REGEX.test(sql)) {
       const results = normalizedParams ? db.exec(sql, normalizedParams) : db.exec(sql);
       if (results.length > 0 && results[0]) {
         rows = rowsFromSqlJsResult(results[0]);
@@ -18291,7 +18717,7 @@ function executeWrite(db, sql, params) {
     const changes = db.getRowsModified();
     let lastInsertId;
     try {
-      if (/^\s*INSERT\s/i.test(sql) && !/\bRETURNING\b/i.test(sql)) {
+      if (INSERT_REGEX.test(sql) && !RETURNING_REGEX.test(sql)) {
         const rowidResult = db.exec("SELECT last_insert_rowid()");
         if (rowidResult[0]?.values[0]) {
           lastInsertId = Number(rowidResult[0].values[0][0]);
@@ -18340,4 +18766,4 @@ function executeGeneral(db, sql, params) {
   }
 }
 
-export { FtsHeadlineSchema, RowRecordSchema, SchemaManager, WhereConditionSchema, applyCommonPragmas, autoEnableWal, buildWhereClause, detectAndSetJsonbSupport, executeGeneral, executeRead, executeWrite, getAdminTools, getCodeModeTools, getCoreTools, getGeoTools, getIntrospectionTools, getJsonHelperTools, getJsonOperationTools, getMigrationTools, getPromptDefinitions, getResourceDefinitions, getStatsTools, getTextTools, getVectorTools, getVirtualTools, isDDL, normalizeSqliteParams, resolveAliases, sanitizeIdentifier, translateSqliteError, validateIdentifier, validateTableExists };
+export { FtsHeadlineSchema, RowRecordSchema, SchemaManager, WhereConditionSchema, applyCommonPragmas, autoEnableWal, detectAndSetJsonbSupport, executeGeneral, executeRead, executeWrite, getAdminTools, getCodeModeTools, getCoreTools, getGeoTools, getIntrospectionTools, getJsonHelperTools, getJsonOperationTools, getMigrationTools, getPromptDefinitions, getResourceDefinitions, getStatsTools, getTextTools, getVectorTools, getVirtualTools, isDDL, normalizeSqliteParams, resolveAliases, sanitizeFtsQuery, translateSqliteError, validateTableExists };