db-mcp 4.0.0 → 5.0.0

package/dist/{chunk-Y57WFKAP.js → chunk-XLIYO3YA.js}

@@ -36,7 +36,11 @@ var TOOL_GROUPS = {
     "list_constraints",
     "date_add",
     "date_diff",
-    "alter_table"
+    "alter_table",
+    "enable_versioning",
+    "disable_versioning",
+    "check_version",
+    "conditional_update"
   ],
   json: [
     // CRUD + Query + Collection (8: crud.ts, query.ts, write.ts)
@@ -223,19 +227,19 @@ var TOOL_GROUPS = {
   codemode: ["execute_code"]
 };
 var META_GROUPS = {
-  // General development - Core + JSON + Text (61 WASM / 66 Native)
+  // General development - Core + JSON + Text (65 WASM / 70 Native)
   starter: ["core", "json", "text", "codemode"],
-  // Data analysis - Core + JSON + Stats (63 WASM / 69 Native)
+  // Data analysis - Core + JSON + Stats (67 WASM / 73 Native)
   analytics: ["core", "json", "stats", "codemode"],
-  // Search workloads - Core + Text + Vector (47 WASM / 52 Native)
+  // Search workloads - Core + Text + Vector (51 WASM / 56 Native)
   search: ["core", "text", "vector", "codemode"],
-  // Geospatial workloads - Core + Geo + Vector (36 WASM / 43 Native)
+  // Geospatial workloads - Core + Geo + Vector (40 WASM / 47 Native)
   spatial: ["core", "geo", "vector", "codemode"],
-  // Schema development - Core + Introspection + Migration (37 tools)
+  // Schema development - Core + Introspection + Migration (41 tools)
   "dev-schema": ["core", "introspection", "migration", "codemode"],
-  // Bare minimum - Core (21 tools)
+  // Bare minimum - Core (25 tools)
   minimal: ["core", "codemode"],
-  // All group tools enabled (167 Native / 140 WASM — see TOOL COUNT TAXONOMY above)
+  // All group tools enabled (171 Native / 144 WASM — see TOOL COUNT TAXONOMY above)
   full: [
     "core",
     "json",
@@ -742,227 +746,270 @@ if (envLevel && envLevel in LEVEL_PRIORITY_CHECK) {
   logger.setLevel(envLevel);
 }
 
+// src/utils/errors/categories.ts
+var ErrorCategory = {
+  /** Input validation failures (invalid names, paths, types) */
+  VALIDATION: "validation",
+  /** Database connection issues */
+  CONNECTION: "connection",
+  /** SQL execution errors */
+  QUERY: "query",
+  /** Authorization/permission failures */
+  PERMISSION: "permission",
+  /** Configuration/setup issues */
+  CONFIGURATION: "config",
+  /** Missing resources (tables, columns, views) */
+  RESOURCE: "resource",
+  /** Authentication failures (invalid credentials, expired tokens) */
+  AUTHENTICATION: "authentication",
+  /** Authorization failures (insufficient scope/permissions) */
+  AUTHORIZATION: "authorization",
+  /** Unexpected internal errors */
+  INTERNAL: "internal",
+  /** Execution timeout errors */
+  TIMEOUT: "timeout",
+  /** Rate limit enforcement errors */
+  RATE_LIMIT: "rate_limit"
+};
+
 // src/utils/errors/suggestions.ts
 var ERROR_SUGGESTIONS = [
   // Validation errors
   {
     pattern: /invalid table name/i,
     suggestion: "Table names must start with a letter or underscore, followed by letters, numbers, or underscores only.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /invalid column name/i,
     suggestion: "Column names must start with a letter or underscore, followed by letters, numbers, or underscores only.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /invalid (view|index) name/i,
     suggestion: "Names must start with a letter or underscore, followed by alphanumeric characters only.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /json path must start with \$/i,
     suggestion: "JSON paths use $ as the root. Example: $.name, $.items[0], $.nested.property",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /vector dimensions must match/i,
     suggestion: "All vectors in comparison must have the same number of dimensions.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /insufficient data/i,
     suggestion: "Not enough data points for the requested analysis. Add more data or reduce the degree.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   // Resource errors — specific codes for table/column not found
   {
     pattern: /no such table[:\s]*(['"]?)([\w.]+)\1/i,
     suggestion: "Table not found. Run sqlite_list_tables to see available tables.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "TABLE_NOT_FOUND"
   },
   {
     pattern: /no such column[:\s]*(['"]?)([\w.]+)\1/i,
     suggestion: "Column not found. Use sqlite_describe_table to see available columns.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "COLUMN_NOT_FOUND"
   },
   {
-    pattern: /has no column named/i,
+    pattern: /has no column named\s+(['"]?)([\w.]+)\1/i,
     suggestion: "Column not found in target table. Use sqlite_describe_table to verify column names before INSERT or UPDATE.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "COLUMN_NOT_FOUND"
   },
   {
     pattern: /no such view[:\s]*(['"]?)([\w.]+)\1/i,
     suggestion: "View not found. Run sqlite_list_views to see available views.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "VIEW_NOT_FOUND"
   },
   {
     pattern: /filename.*does not exist/i,
     suggestion: "File not found. Verify the absolute path exists and is readable.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "FILE_NOT_FOUND"
   },
   {
     pattern: /table .* already exists/i,
     suggestion: "Table already exists. Use CREATE TABLE IF NOT EXISTS or drop the existing table first.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "TABLE_ALREADY_EXISTS"
   },
   {
     pattern: /index .* already exists/i,
     suggestion: "Index already exists. Use CREATE INDEX IF NOT EXISTS or drop the existing index first.",
-    category: "resource" /* RESOURCE */,
+    category: ErrorCategory.RESOURCE,
     code: "INDEX_ALREADY_EXISTS"
   },
   // JSON-specific errors — often caused by wrong column name
   {
     pattern: /malformed JSON/i,
     suggestion: "The JSON data is malformed. This commonly occurs when the column name is incorrect \u2014 SQLite treats the unresolved identifier as a literal string. Verify the column exists with sqlite_describe_table.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "MALFORMED_JSON"
   },
   // Query errors
   {
     pattern: /syntax error/i,
     suggestion: "Check SQL syntax. Common issues: missing quotes, commas, parentheses, or reserved word conflicts.",
-    category: "query" /* QUERY */
+    category: ErrorCategory.QUERY
   },
   {
     pattern: /UNIQUE constraint failed/i,
     suggestion: "A row with this value already exists. Use UPDATE to modify existing data or check for duplicates.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "CONSTRAINT_VIOLATION"
   },
   {
     pattern: /FOREIGN KEY constraint failed/i,
     suggestion: "The referenced row does not exist. Ensure the parent record exists before inserting.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "CONSTRAINT_VIOLATION"
   },
   {
     pattern: /NOT NULL constraint failed/i,
     suggestion: "A required column is missing a value. Provide a value or set a default.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "CONSTRAINT_VIOLATION"
   },
   {
     pattern: /CHECK constraint failed/i,
     suggestion: "The value does not meet the column's check constraint requirements.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "CONSTRAINT_VIOLATION"
   },
   {
     pattern: /incomplete input/i,
     suggestion: "SQL statement is incomplete. Check for missing clauses, closing parentheses, or semicolons.",
-    category: "query" /* QUERY */
+    category: ErrorCategory.QUERY
   },
   {
     pattern: /more than one statement/i,
     suggestion: "Only one SQL statement per call is allowed. Split multiple statements into separate calls or use sqlite_execute_code for multi-step operations.",
-    category: "query" /* QUERY */
+    category: ErrorCategory.QUERY
   },
   {
     pattern: /too few parameter/i,
     suggestion: "Not enough parameter values provided for the prepared statement placeholders (?). Ensure params array matches the number of ? placeholders in the query.",
-    category: "query" /* QUERY */
+    category: ErrorCategory.QUERY
   },
   // Connection errors
   {
     pattern: /not connected/i,
     suggestion: "Database connection not established. Ensure the database is configured and connected.",
-    category: "connection" /* CONNECTION */
+    category: ErrorCategory.CONNECTION
   },
   {
     pattern: /cannot start a transaction within a transaction/i,
     suggestion: "A transaction is already active. Commit or rollback the current transaction first, or use sqlite_transaction_execute for atomic multi-statement operations.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "TRANSACTION_CONFLICT"
   },
   {
     pattern: /no transaction is active/i,
     suggestion: "No transaction is active. Start a transaction using sqlite_transaction_begin first.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "TRANSACTION_NOT_ACTIVE"
   },
   {
     pattern: /no such savepoint/i,
     suggestion: "The specified savepoint does not exist. Verify the savepoint name and ensure it hasn't already been released or rolled back.",
-    category: "query" /* QUERY */,
+    category: ErrorCategory.QUERY,
     code: "SAVEPOINT_NOT_FOUND"
   },
   {
     pattern: /database is locked/i,
     suggestion: "Database is being used by another process. Wait and retry, or check for long-running transactions.",
-    category: "connection" /* CONNECTION */
+    category: ErrorCategory.CONNECTION
   },
   // Permission errors
   {
     pattern: /readonly database/i,
     suggestion: "Database is in read-only mode. Check file permissions or connection settings.",
-    category: "permission" /* PERMISSION */
+    category: ErrorCategory.PERMISSION
   },
   {
     pattern: /attempt to write a readonly/i,
     suggestion: "Write operations are not allowed. Check database configuration.",
-    category: "permission" /* PERMISSION */
+    category: ErrorCategory.PERMISSION
   },
   // Codemode errors
   {
     pattern: /code validation failed/i,
     suggestion: "Check for blocked patterns: require(), process., eval(), Function(), import(). Use sqlite.* API instead.",
-    category: "validation" /* VALIDATION */
+    category: ErrorCategory.VALIDATION
   },
   {
     pattern: /rate limit exceeded/i,
     suggestion: "Wait before retrying. Combine multiple operations into fewer execute_code calls.",
-    category: "permission" /* PERMISSION */
+    category: ErrorCategory.RATE_LIMIT
   },
   {
     pattern: /execution timed out/i,
     suggestion: "Reduce code complexity or increase timeout (max 30s). Break into smaller operations.",
-    category: "query" /* QUERY */
+    category: ErrorCategory.TIMEOUT
   },
   {
     pattern: /sandbox.*not initialized/i,
     suggestion: "Internal sandbox error. Retry the operation.",
-    category: "internal" /* INTERNAL */
+    category: ErrorCategory.INTERNAL
   },
   // Extension errors
   {
     pattern: /extension.*not (available|installed|loaded|found)/i,
     suggestion: "Extension is not available. Check CLI flags, environment variables, or platform compatibility.",
-    category: "config" /* CONFIGURATION */,
+    category: ErrorCategory.CONFIGURATION,
     code: "EXTENSION_MISSING"
   },
   // Custom JS errors mapped from tools
   {
     pattern: /invalid identifier/i,
     suggestion: "Identifiers must start with a letter or underscore and contain only alphanumeric characters or underscores. Ensure the name follows SQLite identifier rules.",
-    category: "validation" /* VALIDATION */,
+    category: ErrorCategory.VALIDATION,
     code: "INVALID_IDENTIFIER"
   },
   {
     pattern: /(expected property name|unexpected token|in JSON at position|Expected double-quoted property name)/i,
     suggestion: "The JSON data provided is malformed. Ensure the input string is valid JSON.",
-    category: "validation" /* VALIDATION */,
+    category: ErrorCategory.VALIDATION,
     code: "MALFORMED_JSON"
   }
 ];
+var suggestionCache = /* @__PURE__ */ new Map();
+var MAX_CACHE_SIZE = 1e3;
 function findSuggestion(message) {
+  const cached = suggestionCache.get(message);
+  if (cached) {
+    suggestionCache.delete(message);
+    suggestionCache.set(message, cached);
+    return cached;
+  }
+  let result = null;
   for (const entry of ERROR_SUGGESTIONS) {
-    if (entry.pattern.test(message)) {
-      return {
+    const match = entry.pattern.exec(message);
+    if (match) {
+      result = {
         suggestion: entry.suggestion,
         category: entry.category,
-        code: entry.code
+        code: entry.code,
+        match
       };
+      break;
     }
   }
-  return null;
+  if (suggestionCache.size >= MAX_CACHE_SIZE) {
+    const firstKey = suggestionCache.keys().next().value;
+    if (firstKey) suggestionCache.delete(firstKey);
+  }
+  suggestionCache.set(message, result);
+  return result;
 }
 
 // src/utils/errors/base.ts
@@ -1014,7 +1061,7 @@ var DbMcpError = class extends Error {
 // src/utils/errors/classes.ts
 var ValidationError = class extends DbMcpError {
   constructor(message, code = "VALIDATION_ERROR", options) {
-    super(message, code, "validation" /* VALIDATION */, {
+    super(message, code, ErrorCategory.VALIDATION, {
       ...options,
       recoverable: false
     });
@@ -1022,7 +1069,7 @@ var ValidationError = class extends DbMcpError {
 };
 var ConnectionError = class extends DbMcpError {
   constructor(message, code = "CONNECTION_ERROR", options) {
-    super(message, code, "connection" /* CONNECTION */, {
+    super(message, code, ErrorCategory.CONNECTION, {
       ...options,
       recoverable: true
       // Connection errors are often transient
@@ -1031,7 +1078,7 @@ var ConnectionError = class extends DbMcpError {
 };
 var QueryError = class extends DbMcpError {
   constructor(message, code = "QUERY_ERROR", options) {
-    super(message, code, "query" /* QUERY */, {
+    super(message, code, ErrorCategory.QUERY, {
       ...options,
       details: {
         ...options?.details,
@@ -1043,7 +1090,7 @@ var QueryError = class extends DbMcpError {
 };
 var ResourceNotFoundError = class extends DbMcpError {
   constructor(message, code = "RESOURCE_NOT_FOUND", options) {
-    super(message, code, "resource" /* RESOURCE */, {
+    super(message, code, ErrorCategory.RESOURCE, {
       ...options,
       details: {
         ...options?.details,
@@ -1056,7 +1103,15 @@ var ResourceNotFoundError = class extends DbMcpError {
 };
 var ConfigurationError = class extends DbMcpError {
   constructor(message, code = "CONFIG_ERROR", options) {
-    super(message, code, "config" /* CONFIGURATION */, {
+    super(message, code, ErrorCategory.CONFIGURATION, {
+      ...options,
+      recoverable: false
+    });
+  }
+};
+var InternalError = class extends DbMcpError {
+  constructor(message, code = "INTERNAL_ERROR", options) {
+    super(message, code, ErrorCategory.INTERNAL, {
       ...options,
       recoverable: false
     });
@@ -1064,7 +1119,7 @@ var ConfigurationError = class extends DbMcpError {
 };
 var AuthenticationError = class extends DbMcpError {
   constructor(message, code = "AUTHENTICATION_ERROR", options) {
-    super(message, code, "authentication" /* AUTHENTICATION */, {
+    super(message, code, ErrorCategory.AUTHENTICATION, {
       ...options,
       recoverable: false
     });
@@ -1072,7 +1127,7 @@ var AuthenticationError = class extends DbMcpError {
 };
 var AuthorizationError = class extends DbMcpError {
   constructor(message, code = "AUTHORIZATION_ERROR", options) {
-    super(message, code, "authorization" /* AUTHORIZATION */, {
+    super(message, code, ErrorCategory.AUTHORIZATION, {
       ...options,
       recoverable: false
     });
@@ -1083,7 +1138,7 @@ var ExtensionNotAvailableError = class extends DbMcpError {
     const isWasm = options?.wasmLimitation ?? options?.details?.["wasmLimitation"] ?? false;
     const baseMessage = `Extension '${extensionName}' is not installed or available`;
     const message = isWasm === true ? `${baseMessage} in WASM mode` : baseMessage;
-    super(message, "EXTENSION_MISSING", "config" /* CONFIGURATION */, {
+    super(message, "EXTENSION_MISSING", ErrorCategory.CONFIGURATION, {
       suggestion: options?.suggestion ?? `Install or enable the '${extensionName}' extension. Check environment variable or CLI flag configuration.`,
       details: {
         extension: extensionName,
@@ -1095,10 +1150,53 @@ var ExtensionNotAvailableError = class extends DbMcpError {
     });
   }
 };
+var TimeoutError = class extends DbMcpError {
+  constructor(message, code = "TIMEOUT_ERROR", options) {
+    super(message, code, ErrorCategory.TIMEOUT, {
+      ...options,
+      details: {
+        ...options?.details,
+        timeoutMs: options?.timeoutMs
+      },
+      recoverable: true
+      // Timeouts are retriable with increased timeout or simplified logic
+    });
+  }
+};
+var RateLimitError = class extends DbMcpError {
+  constructor(message, code = "RATE_LIMIT_ERROR", options) {
+    super(message, code, ErrorCategory.RATE_LIMIT, {
+      ...options,
+      details: {
+        ...options?.details,
+        retryAfterMs: options?.retryAfterMs,
+        limit: options?.limit
+      },
+      recoverable: true
+      // Rate limits are transient — retry after backoff
+    });
+  }
+};
+var ConflictError = class extends DbMcpError {
+  constructor(message, code = "CONFLICT_ERROR", options) {
+    super(message, code, ErrorCategory.QUERY, {
+      ...options,
+      details: {
+        ...options?.details,
+        conflictType: options?.conflictType
+      },
+      recoverable: true
+      // Conflicts are retriable after re-reading current state
+    });
+  }
+};
 
 // src/utils/errors/format.ts
 function sanitizeErrorMessage(msg) {
   if (!msg || typeof msg !== "string") return msg;
+  if (!msg.includes(":") && !msg.includes("/") && !msg.includes("\\") && !msg.includes("=")) {
+    return msg;
+  }
   return msg.replace(/[a-zA-Z]:\\[^:\n]*\\/g, "<redacted_path>\\").replace(/(file:|sqlite:|\/)[^:\s]+(\/[^:\s]*)/g, "<redacted_path>").replace(
     /([a-zA-Z0-9+.-]+:\/\/[^:]+:)[^@\s]+(@)/g,
     "$1<redacted_credential>$2"
@@ -1111,15 +1209,17 @@ function sanitizeErrorMessage(msg) {
   );
 }
 var CATEGORY_DEFAULT_CODES = {
-  ["validation" /* VALIDATION */]: "VALIDATION_ERROR",
-  ["connection" /* CONNECTION */]: "CONNECTION_ERROR",
-  ["query" /* QUERY */]: "QUERY_ERROR",
-  ["permission" /* PERMISSION */]: "PERMISSION_ERROR",
-  ["config" /* CONFIGURATION */]: "CONFIG_ERROR",
-  ["resource" /* RESOURCE */]: "RESOURCE_ERROR",
-  ["authentication" /* AUTHENTICATION */]: "AUTHENTICATION_ERROR",
-  ["authorization" /* AUTHORIZATION */]: "AUTHORIZATION_ERROR",
-  ["internal" /* INTERNAL */]: "UNKNOWN_ERROR"
+  [ErrorCategory.VALIDATION]: "VALIDATION_ERROR",
+  [ErrorCategory.CONNECTION]: "CONNECTION_ERROR",
+  [ErrorCategory.QUERY]: "QUERY_ERROR",
+  [ErrorCategory.PERMISSION]: "PERMISSION_ERROR",
+  [ErrorCategory.CONFIGURATION]: "CONFIG_ERROR",
+  [ErrorCategory.RESOURCE]: "RESOURCE_ERROR",
+  [ErrorCategory.AUTHENTICATION]: "AUTHENTICATION_ERROR",
+  [ErrorCategory.AUTHORIZATION]: "AUTHORIZATION_ERROR",
+  [ErrorCategory.INTERNAL]: "UNKNOWN_ERROR",
+  [ErrorCategory.TIMEOUT]: "TIMEOUT_ERROR",
+  [ErrorCategory.RATE_LIMIT]: "RATE_LIMIT_ERROR"
 };
 function formatZodError(error) {
   if (!("issues" in error) || !Array.isArray(error["issues"])) {
@@ -1144,7 +1244,7 @@ function formatHandlerError(error, _context) {
         success: false,
         error: sanitizeErrorMessage(zodMessage),
         code: "VALIDATION_ERROR",
-        category: "validation" /* VALIDATION */,
+        category: ErrorCategory.VALIDATION,
         suggestion: void 0,
         recoverable: false,
         details: void 0
@@ -1153,7 +1253,7 @@ function formatHandlerError(error, _context) {
   }
   if (error instanceof Error) {
     const match = findSuggestion(error.message);
-    const category = match?.category ?? "internal" /* INTERNAL */;
+    const category = match?.category ?? ErrorCategory.INTERNAL;
     return {
       success: false,
       error: sanitizeErrorMessage(error.message),
@@ -1168,7 +1268,7 @@ function formatHandlerError(error, _context) {
     success: false,
     error: sanitizeErrorMessage(String(error)),
     code: "UNKNOWN_ERROR",
-    category: "internal" /* INTERNAL */,
+    category: ErrorCategory.INTERNAL,
     suggestion: void 0,
     recoverable: false,
     details: void 0
@@ -1465,8 +1565,12 @@ adminToolNames.push(
   "sqlite_audit_cleanup",
   "sqlite_audit_diff_backup",
   "sqlite_audit_restore_backup",
-  "drop_table"
+  "drop_table",
   // explicitly admin since it is destructive, despite being in core
+  "enable_versioning",
+  // admin scope needed for DDL
+  "disable_versioning"
+  // admin scope needed for DDL
 );
 withSqlitePrefix(adminToolNames);
 var READ_ONLY_TOOLS = withSqlitePrefix([
@@ -1481,6 +1585,7 @@ var READ_ONLY_TOOLS = withSqlitePrefix([
   "list_constraints",
   "date_add",
   "date_diff",
+  "check_version",
   // JSON read operations
   "json_valid",
   "json_extract",
@@ -1577,6 +1682,7 @@ var WRITE_TOOLS = withSqlitePrefix([
   "create_trigger",
   "drop_trigger",
   "alter_table",
+  "conditional_update",
   // JSON write operations
   "json_insert",
   "json_update",
@@ -1675,7 +1781,7 @@ var OAuthError = class extends DbMcpError {
   /** WWW-Authenticate header value */
   wwwAuthenticate;
   constructor(message, code, httpStatus, details, wwwAuthenticate) {
-    super(message, code, "authentication" /* AUTHENTICATION */, { details });
+    super(message, code, ErrorCategory.AUTHENTICATION, { details });
     this.name = "OAuthError";
     this.httpStatus = httpStatus;
     this.wwwAuthenticate = wwwAuthenticate;
@@ -1773,4 +1879,4 @@ function isOAuthError(error) {
   return error instanceof OAuthError;
 }
 
-export { ALL_TOOL_GROUPS, AuthServerDiscoveryError, AuthenticationError, AuthorizationError, BASE_SCOPES, ConfigurationError, ConnectionError, DbMcpError, ERROR_CODES, ExtensionNotAvailableError, InsufficientScopeError, InvalidSignatureError, InvalidTokenError, JwksFetchError, META_GROUPS, QueryError, ResourceNotFoundError, SCOPES, SUPPORTED_SCOPES, TOOL_GROUPS, TokenExpiredError, TokenMissingError, ValidationError, createModuleLogger, filterTools, findSuggestion, formatHandlerError, getAuthContext, getFilterSummary, getToolFilterFromEnv, hasAdminScope, hasReadScope, isOAuthError, isToolEnabled, logger, metrics, parseScopes, parseToolFilter, registerToolScopes, runWithAuthContext, sanitizeErrorMessage, scopesGrantToolAccess };
+export { ALL_TOOL_GROUPS, AuthServerDiscoveryError, AuthenticationError, AuthorizationError, BASE_SCOPES, ConfigurationError, ConflictError, ConnectionError, DbMcpError, ERROR_CODES, ErrorCategory, ExtensionNotAvailableError, InsufficientScopeError, InternalError, InvalidSignatureError, InvalidTokenError, JwksFetchError, META_GROUPS, QueryError, RateLimitError, ResourceNotFoundError, SCOPES, SUPPORTED_SCOPES, TOOL_GROUPS, TimeoutError, TokenExpiredError, TokenMissingError, ValidationError, createModuleLogger, filterTools, findSuggestion, formatHandlerError, getAuthContext, getFilterSummary, getToolFilterFromEnv, hasAdminScope, hasReadScope, isOAuthError, isToolEnabled, logger, metrics, parseScopes, parseToolFilter, registerToolScopes, runWithAuthContext, sanitizeErrorMessage, scopesGrantToolAccess };

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG, createServer } from './chunk-NIC5Z2CA.js';
-import { VERSION } from './chunk-R5M4WKDM.js';
-import { logger } from './chunk-Y57WFKAP.js';
+import { DEFAULT_CONFIG, createServer } from './chunk-LLIAIJPO.js';
+import { parseAllowedIoRoots, VERSION } from './chunk-2TYICG7B.js';
+import { logger } from './chunk-XLIYO3YA.js';
 import fs from 'fs';
 import yaml from 'yaml';
 
@@ -159,6 +159,11 @@ function parseArgs() {
       if (metricsValue === "prometheus") {
         metricsExport = "prometheus";
       }
+    } else if (arg === "--allowed-io-roots") {
+      const rootsValue = args[++i];
+      if (rootsValue) {
+        config.allowedIoRoots = parseAllowedIoRoots(rootsValue);
+      }
     } else if (arg === "--config" || arg === "-c") {
       const pathValue = args[++i];
       if (pathValue) {
@@ -240,6 +245,9 @@ Audit Options:
   --audit-backup            Enable pre-mutation DDL snapshots
   --audit-backup-data       Include sample data rows in snapshots
 
+Security Options:
+  --allowed-io-roots <paths> Allowlisted filesystem roots for IO operations (comma-separated or JSON array)
+
 Server Options:
   --config, -c <path>       Load configuration from YAML/JSON file
   --dump-config             Print the resolved configuration and exit
@@ -248,7 +256,7 @@ Server Options:
   --metrics-export <type>   Export metrics at HTTP /metrics (e.g., prometheus)
   --tool-filter <filter>    Tool filter string. Supports:
                               Shortcuts: starter, analytics, search, spatial, minimal, full
-                              Groups: core, json, text, fts5, stats, vector, geo, ...
+                              Groups: core, json, text, stats, vector, geo, ...
                               Mixed: core,json,-text (whitelist with exclusions)
                               Legacy: -vector,-geo (exclusion from all)
 
@@ -350,6 +358,10 @@ function loadEnvConfig() {
   if (process.env["METRICS_EXPORT"] === "prometheus") {
     config.metricsExport = "prometheus";
   }
+  const allowedIoRoots = process.env["ALLOWED_IO_ROOTS"];
+  if (allowedIoRoots) {
+    config.allowedIoRoots = parseAllowedIoRoots(allowedIoRoots);
+  }
   if (databases.length > 0) {
     config.databases = databases;
   }
@@ -437,11 +449,11 @@ async function main() {
           process.exit(1);
         }
         if (options.backend === "better-sqlite3") {
-          const { NativeSqliteAdapter } = await import('./sqlite-native-DLVS2T52.js');
+          const { NativeSqliteAdapter } = await import('./sqlite-native-5GQ3WKCZ.js');
           const adapter = new NativeSqliteAdapter();
           await server.registerAdapter(adapter, dbConfig);
         } else {
-          const { SqliteAdapter } = await import('./sqlite-D4WCNPU4.js');
+          const { SqliteAdapter } = await import('./sqlite-XWZPEZJO.js');
           const adapter = new SqliteAdapter();
           await server.registerAdapter(adapter, dbConfig);
         }

package/dist/codemode/api-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-constants.d.ts","sourceRoot":"","sources":["../../src/codemode/api-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsEjE,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAwDnD,CAAC;AAMF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAkIlE,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAA2C,CAAC"}
+{"version":3,"file":"api-constants.d.ts","sourceRoot":"","sources":["../../src/codemode/api-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsEjE,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAwDnD,CAAC;AAMF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAsIlE,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAA2C,CAAC"}

package/dist/codemode/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/codemode/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACf,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR;AA6GD,sCAAsC;AACtC,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AA8E/E;;;GAGG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE7C,KAAK,EAAE,cAAc,EAAE,EAAE,WAAW,CAAC,EAAE,cAAc;IAkEjE;;OAEG;IACH,SAAS,IAAI,MAAM,EAAE;IAIrB;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,EAAE;IAU3C;;;;OAIG;IACH,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuDjD;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EAAE,EACvB,WAAW,CAAC,EAAE,cAAc,GAC3B,SAAS,CAEX"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/codemode/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACf,MAAM,mBAAmB,CAAC;AAe3B;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR;AA6GD,sCAAsC;AACtC,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AA+E/E;;;GAGG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE7C,KAAK,EAAE,cAAc,EAAE,EAAE,WAAW,CAAC,EAAE,cAAc;IAkEjE;;OAEG;IACH,SAAS,IAAI,MAAM,EAAE;IAIrB;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,EAAE;IAU3C;;;;OAIG;IACH,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuDjD;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EAAE,EACvB,WAAW,CAAC,EAAE,cAAc,GAC3B,SAAS,CAEX"}