db-mcp 4.0.0 → 5.0.1

package/dist/{chunk-TGE7LFAR.js → chunk-UE7GVOBV.js}

@@ -1,9 +1,9 @@
-import { validateQuery } from './chunk-EQF3WZHX.js';
-import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, sanitizeIdentifier, createColumnList, buildWhereClause, write, idempotent, destructive, sanitizeWhereClause, validateJsonPath, validateAggregateFunction, VacuumOutputSchema, admin, validateSameDirPath, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-R5M4WKDM.js';
-import { createModuleLogger, logger, ResourceNotFoundError, DbMcpError, formatHandlerError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess } from './chunk-Y57WFKAP.js';
+import { validateQuery } from './chunk-27C5EE6U.js';
+import { ErrorResponseFields, redactObject, SENSITIVE_KEY_PATTERN, HIGH_PRIORITY, MEDIUM_PRIORITY, LOW_PRIORITY, ASSISTANT_FOCUSED, readOnly, sanitizeIdentifier, createColumnList, buildWhereClause, buildProgressContext, streamResultRows, write, idempotent, destructive, sanitizeWhereClause, validateJsonPath, validateAggregateFunction, VacuumOutputSchema, sendProgress, admin, assertSafeIoPath, validateSameDirPath, adminFs, BackupOutputSchema, BackupSchema, AnalyzeOutputSchema, AnalyzeSchema, IntegrityCheckOutputSchema, IntegrityCheckSchema, OptimizeOutputSchema, OptimizeSchema, RestoreOutputSchema, RestoreSchema, VerifyBackupOutputSchema, VerifyBackupSchema, IndexStatsOutputSchema, IndexStatsSchema, PragmaCompileOptionsOutputSchema, PragmaCompileOptionsSchema, PragmaDatabaseListOutputSchema, PragmaDatabaseListSchema, PragmaOptimizeOutputSchema, PragmaOptimizeSchema, PragmaSettingsOutputSchema, PragmaSettingsSchema, PragmaTableInfoOutputSchema, PragmaTableInfoSchema, AttachDatabaseOutputSchema, AttachDatabaseSchema, DetachDatabaseOutputSchema, DetachDatabaseSchema, VacuumIntoCopyOutputSchema, VacuumIntoCopySchema, SqlDumpOutputSchema, SqlDumpSchema, ReindexOutputSchema, ReindexSchema, WalOutputSchema, WalSchema } from './chunk-2TYICG7B.js';
+import { createModuleLogger, logger, InternalError, ResourceNotFoundError, DbMcpError, ErrorCategory, formatHandlerError, RateLimitError, TimeoutError, findSuggestion, ERROR_CODES, QueryError, ValidationError, ConflictError, ExtensionNotAvailableError, getAuthContext, scopesGrantToolAccess, AuthorizationError } from './chunk-XLIYO3YA.js';
 import { z } from 'zod';
-import * as path from 'path';
-import path__default from 'path';
+import * as nodePath from 'path';
+import nodePath__default from 'path';
 import fs from 'fs';
 import { createHash } from 'crypto';
 import { createClient } from 'redis';
@@ -42,7 +42,9 @@ var ReadQueryOutputSchema = z.object({
   rowCount: z.number().optional(),
   rows: z.array(RowRecordSchema).optional(),
   nextCursor: z.string().optional(),
-  executionTimeMs: z.number().optional()
+  executionTimeMs: z.number().optional(),
+  streamed: z.boolean().optional(),
+  chunksEmitted: z.number().optional()
 }).extend(ErrorResponseFields.shape);
 var WriteQueryOutputSchema = z.object({
   success: z.boolean(),
@@ -124,12 +126,21 @@ var ReadQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("SELECT query to execute"),
   sql: z.string().max(1e5).optional().describe("Alias for query"),
   params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements"),
-  cursor: z.string().optional().describe("Opaque cursor for pagination")
+  cursor: z.string().optional().describe("Opaque cursor for pagination"),
+  stream: z.boolean().optional().default(false).describe(
+    "Stream results row-by-row via MCP progress notifications instead of returning all rows in the response. Requires a progressToken in the request _meta. Falls back to normal behavior if unavailable. The final response contains rowCount and metadata but not the rows themselves."
+  ),
+  chunkSize: z.number().int().positive().optional().describe(
+    "When streaming, the number of rows to include in each progress notification chunk (default 10)"
+  )
 });
 var WriteQuerySchema = z.object({
   query: z.string().max(1e5).default("").describe("INSERT/UPDATE/DELETE query to execute"),
   sql: z.string().max(1e5).optional().describe("Alias for query"),
-  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements")
+  params: z.array(z.unknown()).optional().describe("Query parameters for prepared statements"),
+  expectedVersion: z.number().int().positive().optional().describe(
+    "If set and rowsAffected is 0, throws ConflictError instead of returning silently. Use with manual WHERE _version = ? guards."
+  )
 });
 var CreateTableSchema = z.object({
   table: z.string().default("").describe("Name of the table to create"),
@@ -244,7 +255,10 @@ var UpsertSchema = z.object({
   updateColumns: z.array(z.string()).optional().describe(
     "Columns to update on conflict (default: all except conflict columns). Only used if conflictColumns is provided."
   ),
-  returning: z.union([z.boolean(), z.array(z.string())]).optional().describe("Columns to return, or true for all columns")
+  returning: z.union([z.boolean(), z.array(z.string())]).optional().describe("Columns to return, or true for all columns"),
+  expectedVersion: z.number().int().positive().optional().describe(
+    "Expected _version value for optimistic concurrency control. Requires conflictColumns and a versioned table."
+  )
 });
 var BatchInsertSchema = z.object({
   table: z.string().default("").describe("Table name"),
@@ -350,9 +364,64 @@ var DropTriggerOutputSchema = z.object({
   success: z.boolean(),
   message: z.string().optional()
 }).extend(ErrorResponseFields.shape);
-function resolveAliases(params, aliasMap) {
+var EnableVersioningSchema = z.object({
+  table: z.string().describe("Name of the table to enable versioning for"),
+  tableName: z.string().optional().describe("Alias for table")
+});
+var EnableVersioningOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  sql: z.string().optional(),
+  alreadyEnabled: z.boolean().optional()
+}).extend(ErrorResponseFields.shape);
+var DisableVersioningSchema = z.object({
+  table: z.string().describe("Name of the table to disable versioning for"),
+  tableName: z.string().optional().describe("Alias for table"),
+  ifExists: z.boolean().optional().default(false)
+});
+var DisableVersioningOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string().optional(),
+  sql: z.string().optional()
+}).extend(ErrorResponseFields.shape);
+var CheckVersionSchema = z.object({
+  table: z.string().describe("Table name"),
+  tableName: z.string().optional().describe("Alias for table"),
+  rowId: z.union([z.number(), z.string()]).describe("Primary key or rowid value of the row"),
+  idColumn: z.string().optional().describe("Name of the primary key column (default: 'rowid')")
+});
+var CheckVersionOutputSchema = z.object({
+  success: z.boolean(),
+  version: z.number().optional(),
+  row: RowRecordSchema.optional()
+}).extend(ErrorResponseFields.shape);
+var ConditionalUpdateSchema = z.object({
+  table: z.string().describe("Table name"),
+  tableName: z.string().optional().describe("Alias for table"),
+  data: z.record(z.string(), z.unknown()).describe("Column-value pairs to update"),
+  conditions: z.array(WhereConditionSchema).describe("WHERE conditions to locate the row (e.g. id = 1)"),
+  expectedVersion: z.number().int().positive().describe("The _version value expected to be currently in the database")
+});
+var ConditionalUpdateOutputSchema = z.object({
+  success: z.boolean(),
+  rowsAffected: z.number().optional(),
+  currentVersion: z.number().optional(),
+  rows: z.array(RowRecordSchema).optional()
+}).extend(ErrorResponseFields.shape);
+function resolveAliases(params, aliasMap = {}) {
   if (typeof params !== "object" || params === null) return params;
-  const obj = params;
+  const obj = { ...params };
+  for (const key of Object.keys(obj)) {
+    if (key.includes("_")) {
+      const camelKey = key.replace(
+        /_([a-z])/g,
+        (_, letter) => letter.toUpperCase()
+      );
+      if (obj[camelKey] === void 0 && obj[key] !== void 0) {
+        obj[camelKey] = obj[key];
+      }
+    }
+  }
   for (const [alias, canonical] of Object.entries(aliasMap)) {
     if ((obj[canonical] === void 0 || obj[canonical] === "") && obj[alias] !== void 0) {
       obj[canonical] = obj[alias];
@@ -591,6 +660,24 @@ function createReadQueryTool(adapter) {
             JSON.stringify({ offset: nextOffset })
           ).toString("base64");
         }
+        if (input.stream && !_context.isCodeMode) {
+          const progressCtx = buildProgressContext(_context);
+          if (progressCtx) {
+            const chunksEmitted = await streamResultRows(
+              progressCtx,
+              result.rows ?? [],
+              input.chunkSize
+            );
+            return {
+              success: true,
+              rowCount: result.rows?.length ?? 0,
+              nextCursor,
+              executionTimeMs: result.executionTimeMs,
+              streamed: true,
+              chunksEmitted
+            };
+          }
+        }
         return {
           success: true,
           rowCount: result.rows?.length ?? 0,
@@ -695,11 +782,60 @@ function createWriteQueryTool(adapter) {
           rowsAffected: 0
         };
       }
+      if (input.expectedVersion === void 0) {
+        const tables = [];
+        const tableRegex = /\b(?:UPDATE|INSERT\s+INTO|DELETE\s+FROM|REPLACE\s+INTO)\s+(?:["'`]?([a-zA-Z0-9_]+)["'`]?)\b/gi;
+        let match;
+        while ((match = tableRegex.exec(input.query)) !== null) {
+          if (match[1]) tables.push(match[1]);
+        }
+        for (const tableName of tables) {
+          try {
+            const pragmaCheck = await adapter.executeReadQuery(
+              `PRAGMA table_info(${sanitizeIdentifier(tableName)})`
+            );
+            const isVersioned = (pragmaCheck.rows ?? []).some(
+              (col) => col["name"] === "_version"
+            );
+            if (isVersioned) {
+              return {
+                ...formatHandlerError(
+                  new ConflictError(
+                    `expectedVersion is required when updating versioned table '${tableName}'`,
+                    "CONFLICT_ERROR",
+                    {
+                      conflictType: "missing_expected_version",
+                      suggestion: "Use sqlite_check_version to get the current version, then include expectedVersion in your request."
+                    }
+                  )
+                ),
+                rowsAffected: 0
+              };
+            }
+          } catch {
+          }
+        }
+      }
       try {
         const result = await adapter.executeWriteQuery(
           input.query,
           input.params
         );
+        if (result.rowsAffected === 0 && input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ConflictError(
+                `Version conflict or row not found. expectedVersion ${input.expectedVersion} was provided but 0 rows were affected.`,
+                "CONFLICT_ERROR",
+                {
+                  conflictType: "version_mismatch_or_not_found",
+                  suggestion: "Verify the row exists and the version matches."
+                }
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         return {
           success: true,
           rowsAffected: result.rowsAffected,
@@ -1416,7 +1552,7 @@ async function validateTableExists2(adapter, table) {
       success: false,
       error: `Table or view '${table}' not found. Use sqlite_list_tables to see available tables.`,
       code: "TABLE_NOT_FOUND",
-      category: "resource" /* RESOURCE */,
+      category: ErrorCategory.RESOURCE,
       suggestion: "Table or view does not exist. Run sqlite_list_tables to see available tables.",
       details: void 0,
       recoverable: false
@@ -1451,12 +1587,38 @@ function createUpsertTool(adapter) {
           conflictColumns: parsed.conflictColumns !== void 0 ? Array.isArray(parsed.conflictColumns) ? parsed.conflictColumns : [parsed.conflictColumns] : []
         };
         if (Object.keys(input.data).length === 0)
-          throw new Error("data (or values alias) is required");
+          throw new ValidationError("data (or values alias) is required");
       } catch (error) {
         return { ...formatHandlerError(error), rowsAffected: 0 };
       }
       const validationError = await validateTableExists2(adapter, input.table);
       if (validationError) return { ...validationError, rowsAffected: 0 };
+      if (input.expectedVersion === void 0) {
+        try {
+          const pragmaCheck = await adapter.executeReadQuery(
+            `PRAGMA table_info(${sanitizeIdentifier(input.table)})`
+          );
+          const isVersioned = (pragmaCheck.rows ?? []).some(
+            (col) => col["name"] === "_version"
+          );
+          if (isVersioned) {
+            return {
+              ...formatHandlerError(
+                new ConflictError(
+                  `expectedVersion is required when updating versioned table '${input.table}'`,
+                  "CONFLICT_ERROR",
+                  {
+                    conflictType: "missing_expected_version",
+                    suggestion: "Use sqlite_check_version to get the current version, then include expectedVersion in your request."
+                  }
+                )
+              ),
+              rowsAffected: 0
+            };
+          }
+        } catch {
+        }
+      }
       const columns = Object.keys(input.data);
       const values = Object.values(input.data);
       const placeholders = columns.map(() => "?").join(", ");
@@ -1471,11 +1633,35 @@ function createUpsertTool(adapter) {
           const updateSets = colsToUpdate.map(
             (c) => `${sanitizeIdentifier(c)} = EXCLUDED.${sanitizeIdentifier(c)}`
           ).join(", ");
-          sql += ` ON CONFLICT (${conflictCols}) DO UPDATE SET ${updateSets}`;
+          let updateClause = ` ON CONFLICT (${conflictCols}) DO UPDATE SET ${updateSets}`;
+          if (input.expectedVersion !== void 0) {
+            updateClause += ` WHERE _version = ${input.expectedVersion}`;
+          }
+          sql += updateClause;
         } else {
+          if (input.expectedVersion !== void 0) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  "expectedVersion requires colsToUpdate (cannot use with DO NOTHING)"
+                )
+              ),
+              rowsAffected: 0
+            };
+          }
           sql += ` ON CONFLICT (${conflictCols}) DO NOTHING`;
         }
       } else {
+        if (input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ValidationError(
+                "expectedVersion requires explicit conflictColumns for OCC"
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         sql = `INSERT OR REPLACE INTO ${safeTable} (${safeColumns.join(", ")}) VALUES (${placeholders})`;
       }
       if (input.returning !== void 0 && input.returning !== false) {
@@ -1488,6 +1674,21 @@ function createUpsertTool(adapter) {
       }
       try {
         const result = await adapter.executeWriteQuery(sql, queryParams);
+        if (result.rowsAffected === 0 && input.expectedVersion !== void 0) {
+          return {
+            ...formatHandlerError(
+              new ConflictError(
+                `Version conflict during upsert: expected version ${input.expectedVersion}. Re-read the row and retry.`,
+                "CONFLICT_ERROR",
+                {
+                  conflictType: "version_mismatch",
+                  suggestion: "Re-read the row to get the current version, then retry the update."
+                }
+              )
+            ),
+            rowsAffected: 0
+          };
+        }
         const response = {
           success: true,
           rowsAffected: result.rowsAffected,
@@ -2571,6 +2772,269 @@ function createAlterTableTool(adapter) {
   };
 }
 
+// src/adapters/sqlite/tools/core/versioning.ts
+function createEnableVersioningTool(adapter) {
+  return {
+    name: "sqlite_enable_versioning",
+    description: "Enable optimistic concurrency control (OCC) on a table. Adds a _version column and an auto-increment trigger.",
+    group: "core",
+    inputSchema: EnableVersioningSchema,
+    outputSchema: EnableVersioningOutputSchema,
+    requiredScopes: ["admin"],
+    annotations: write("Enable Versioning"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = EnableVersioningSchema.parse(params);
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return { ...validationError, sql: "" };
+      const safeTable = sanitizeIdentifier(input.table);
+      const triggerName = sanitizeIdentifier(`_mcp_version_${input.table}`);
+      try {
+        const pragmaCheck = await adapter.executeReadQuery(
+          `PRAGMA table_info(${safeTable})`
+        );
+        const hasVersionColumn = (pragmaCheck.rows ?? []).some(
+          (col) => col["name"] === "_version"
+        );
+        const statements = [];
+        if (!hasVersionColumn) {
+          statements.push(
+            `ALTER TABLE ${safeTable} ADD COLUMN _version INTEGER NOT NULL DEFAULT 1;`
+          );
+        }
+        const triggerSql = `
+CREATE TRIGGER IF NOT EXISTS ${triggerName}
+BEFORE UPDATE ON ${safeTable}
+FOR EACH ROW
+BEGIN
+  UPDATE ${safeTable} SET _version = OLD._version + 1 WHERE rowid = OLD.rowid;
+END;`;
+        statements.push(triggerSql.trim());
+        for (const stmt of statements) {
+          await adapter.executeWriteQuery(stmt);
+        }
+        const sql = statements.join("\n");
+        return {
+          success: true,
+          message: hasVersionColumn ? `Versioning already active on '${input.table}', trigger ensured.` : `Versioning enabled on '${input.table}'. Added _version column and trigger.`,
+          sql,
+          alreadyEnabled: hasVersionColumn
+        };
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+    }
+  };
+}
+function createDisableVersioningTool(adapter) {
+  return {
+    name: "sqlite_disable_versioning",
+    description: "Disable optimistic concurrency control (OCC) on a table. Drops the _version column and its trigger.",
+    group: "core",
+    inputSchema: DisableVersioningSchema,
+    outputSchema: DisableVersioningOutputSchema,
+    requiredScopes: ["admin"],
+    annotations: write("Disable Versioning"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = DisableVersioningSchema.parse(params);
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+      const safeTable = sanitizeIdentifier(input.table);
+      const triggerName = sanitizeIdentifier(`_mcp_version_${input.table}`);
+      const tableCheck = await adapter.executeReadQuery(
+        `SELECT 1 FROM pragma_table_list(?) WHERE type IN ('table', 'view') LIMIT 1`,
+        [input.table]
+      );
+      if (!tableCheck.rows || tableCheck.rows.length === 0) {
+        if (input.ifExists) {
+          return {
+            success: true,
+            message: `Table '${input.table}' does not exist (no changes made).`,
+            sql: ""
+          };
+        }
+        return {
+          ...formatHandlerError(
+            new ValidationError(`Table '${input.table}' does not exist.`)
+          ),
+          sql: ""
+        };
+      }
+      try {
+        const pragmaCheck = await adapter.executeReadQuery(
+          `PRAGMA table_info(${safeTable})`
+        );
+        const hasVersionColumn = (pragmaCheck.rows ?? []).some(
+          (col) => col["name"] === "_version"
+        );
+        const statements = [];
+        statements.push(`DROP TRIGGER IF EXISTS ${triggerName};`);
+        if (hasVersionColumn) {
+          statements.push(`ALTER TABLE ${safeTable} DROP COLUMN _version;`);
+        }
+        for (const stmt of statements) {
+          await adapter.executeWriteQuery(stmt);
+        }
+        const sql = statements.join("\n");
+        return {
+          success: true,
+          message: hasVersionColumn ? `Versioning disabled on '${input.table}'. Dropped _version column and trigger.` : `Versioning already disabled on '${input.table}', trigger dropped if existed.`,
+          sql
+        };
+      } catch (error) {
+        return { ...formatHandlerError(error), sql: "" };
+      }
+    }
+  };
+}
+function createCheckVersionTool(adapter) {
+  return {
+    name: "sqlite_check_version",
+    description: "Read the current _version of a specific row for optimistic concurrency control.",
+    group: "core",
+    inputSchema: CheckVersionSchema,
+    outputSchema: CheckVersionOutputSchema,
+    requiredScopes: ["read"],
+    annotations: readOnly("Check Version"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = CheckVersionSchema.parse(params);
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return validationError;
+      const safeTable = sanitizeIdentifier(input.table);
+      const safeIdCol = sanitizeIdentifier(input.idColumn ?? "rowid");
+      try {
+        const sql = `SELECT * FROM ${safeTable} WHERE ${safeIdCol} = ? LIMIT 1`;
+        const result = await adapter.executeReadQuery(sql, [input.rowId]);
+        if (!result.rows || result.rows.length === 0) {
+          return formatHandlerError(
+            new ResourceNotFoundError(
+              `Row not found in table '${input.table}' with ${safeIdCol} = ${input.rowId}`
+            )
+          );
+        }
+        const row = result.rows[0];
+        if (row && typeof row["_version"] === "number") {
+          return { success: true, version: row["_version"], row };
+        } else {
+          return formatHandlerError(
+            new ValidationError(
+              `Table '${input.table}' does not appear to have versioning enabled (missing _version column).`
+            )
+          );
+        }
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+function createConditionalUpdateTool(adapter) {
+  return {
+    name: "sqlite_conditional_update",
+    description: "Update a row only if its _version matches expectedVersion. Prevents lost updates in multi-agent environments.",
+    group: "core",
+    inputSchema: ConditionalUpdateSchema,
+    outputSchema: ConditionalUpdateOutputSchema,
+    requiredScopes: ["write"],
+    annotations: write("Conditional Update"),
+    handler: async (params, _context) => {
+      let input;
+      try {
+        input = ConditionalUpdateSchema.parse(params);
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+      const validationError = await validateTableExists2(adapter, input.table);
+      if (validationError) return validationError;
+      const safeTable = sanitizeIdentifier(input.table);
+      const columns = Object.keys(input.data);
+      if (columns.length === 0) {
+        return formatHandlerError(
+          new ValidationError("Update data cannot be empty")
+        );
+      }
+      if (input.conditions.length === 0) {
+        return formatHandlerError(
+          new ValidationError("Conditions are required to identify the row")
+        );
+      }
+      try {
+        const queryParams = [];
+        const safeColumns = columns.map(sanitizeIdentifier);
+        const setClauses = safeColumns.map((c) => `${c} = ?`).join(", ");
+        queryParams.push(...Object.values(input.data));
+        const { sql: whereSql, params: whereParams } = buildWhereClause(
+          input.conditions
+        );
+        queryParams.push(...whereParams);
+        queryParams.push(input.expectedVersion);
+        const updateSql = `UPDATE ${safeTable} SET ${setClauses} WHERE (${whereSql}) AND _version = ? RETURNING *`;
+        const result = await adapter.executeWriteQuery(updateSql, queryParams);
+        if (result.rowsAffected === 0) {
+          const checkSql = `SELECT _version FROM ${safeTable} WHERE ${whereSql}`;
+          const checkResult = await adapter.executeReadQuery(
+            checkSql,
+            whereParams
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return formatHandlerError(
+              new ResourceNotFoundError(
+                "Row not found matching the provided conditions"
+              )
+            );
+          }
+          const currentVersionRaw = checkResult.rows[0]?.["_version"];
+          if (currentVersionRaw === void 0 || currentVersionRaw === null) {
+            return formatHandlerError(
+              new ValidationError(
+                `Table '${input.table}' does not appear to have versioning enabled (missing _version column).`
+              )
+            );
+          }
+          const currentVersion2 = Number(currentVersionRaw);
+          return formatHandlerError(
+            new ConflictError(
+              `Version conflict: expected version ${input.expectedVersion} but row has version ${currentVersion2}. Re-read the row and retry.`,
+              "CONFLICT_ERROR",
+              {
+                conflictType: "version_mismatch",
+                suggestion: "Re-read the row to get the current version, then retry the update.",
+                details: {
+                  table: input.table,
+                  expectedVersion: input.expectedVersion,
+                  currentVersion: currentVersion2
+                }
+              }
+            )
+          );
+        }
+        const newRow = result.rows?.[0];
+        const currentVersion = newRow ? newRow["_version"] : void 0;
+        return {
+          success: true,
+          rowsAffected: result.rowsAffected,
+          currentVersion,
+          rows: result.rows
+        };
+      } catch (error) {
+        return formatHandlerError(error);
+      }
+    }
+  };
+}
+
 // src/adapters/sqlite/tools/core/index.ts
 function getCoreTools(adapter) {
   return [
@@ -2594,7 +3058,11 @@ function getCoreTools(adapter) {
     createListConstraintsTool(adapter),
     createDateAddTool(adapter),
     createDateDiffTool(adapter),
-    createAlterTableTool(adapter)
+    createAlterTableTool(adapter),
+    createEnableVersioningTool(adapter),
+    createDisableVersioningTool(adapter),
+    createCheckVersionTool(adapter),
+    createConditionalUpdateTool(adapter)
   ];
 }
 
@@ -2714,7 +3182,7 @@ var SchemaManager = class {
       throw new DbMcpError(
         "Invalid table name",
         "INVALID_TABLE",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     const result = await this.executor.executeReadQuery(
@@ -2724,7 +3192,7 @@ var SchemaManager = class {
       throw new DbMcpError(
         `Table '${tableName}' does not exist`,
         "TABLE_NOT_FOUND",
-        "resource" /* RESOURCE */
+        ErrorCategory.RESOURCE
       );
     }
     const columns = (result.rows ?? []).map((row) => ({
@@ -2893,7 +3361,7 @@ function createTableSchemaResource(adapter) {
         throw new DbMcpError(
           "Invalid table URI format",
           "RESOURCE_INVALID_URI",
-          "validation" /* VALIDATION */
+          ErrorCategory.VALIDATION
         );
       }
       const tableName = decodeURIComponent(match[1]);
@@ -3864,7 +4332,7 @@ function parseJsonValue(value) {
     throw new DbMcpError(
       "JSONB blob cannot be parsed directly. Use json() in SQL query.",
       "JSON_PARSE_ERROR",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   if (typeof value === "string") {
@@ -4401,6 +4869,7 @@ function createJsonSetTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Set value at ${input.path} in ${table}.${column}`,
           rowsAffected: result.rowsAffected,
           ...result.rowsAffected === 0 ? {
             warning: "No rows matched the WHERE clause \u2014 no changes were made"
@@ -4442,6 +4911,7 @@ function createJsonRemoveTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Removed value at ${input.path} from ${table}.${column}`,
           rowsAffected: result.rowsAffected,
           ...result.rowsAffected === 0 ? {
             warning: "No rows matched the WHERE clause \u2014 no changes were made"
@@ -4584,6 +5054,7 @@ function createJsonArrayAppendTool(adapter) {
         const result = await adapter.executeWriteQuery(sql, queryParams);
         return {
           success: true,
+          message: `Appended to ${input.path} in ${table}.${column}`,
           rowsAffected: result.rowsAffected
         };
       } catch (error) {
@@ -6816,7 +7287,7 @@ function cosineSimilarity(a, b) {
     throw new DbMcpError(
       "Vector dimensions must match",
       "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   let dotProd = 0;
@@ -6837,7 +7308,7 @@ function euclideanDistance(a, b) {
     throw new DbMcpError(
       "Vector dimensions must match",
       "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   let sum = 0;
@@ -6854,7 +7325,7 @@ function dotProduct(a, b) {
     throw new DbMcpError(
       "Vector dimensions must match",
       "VECTOR_MISMATCH",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   let sum = 0;
@@ -6884,7 +7355,7 @@ function parseVector(value) {
   throw new DbMcpError(
     "Invalid vector format",
     "VECTOR_INVALID",
-    "validation" /* VALIDATION */
+    ErrorCategory.VALIDATION
   );
 }
 
@@ -8005,8 +8476,8 @@ var StatsSampleSchema = z.object({
   table: z.string().describe("Table name"),
   sampleSize: z.preprocess(
     coerceNumber4,
-    z.number().optional().default(100).describe(
-      "Number of random rows to return (default: 100, max: 1000). WARNING: Uses ORDER BY RANDOM() which is O(N) \u2014 slow on very large tables."
+    z.number().optional().default(20).describe(
+      "Number of random rows to return (default: 20, max: 50). WARNING: Uses ORDER BY RANDOM() which is O(N) \u2014 slow on very large tables."
     )
   ),
   conditions: z.array(WhereConditionSchema).optional().describe("Optional WHERE conditions"),
@@ -8429,7 +8900,7 @@ function createPercentileTool(adapter) {
     }
   };
 }
-var MAX_SAMPLE_SIZE = 1e3;
+var MAX_SAMPLE_SIZE = 50;
 function createSampleTool(adapter) {
   return {
     name: "sqlite_stats_sample",
@@ -9119,7 +9590,7 @@ function matrixInverse(A) {
       throw new DbMcpError(
         "Matrix is singular, cannot compute inverse",
         "MATH_SINGULAR",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     for (let j = 0; j < 2 * n; j++) {
@@ -9186,7 +9657,7 @@ function createRegressionTool(adapter) {
           throw new DbMcpError(
             `Insufficient data in table '${input.table}' for degree ${degree} regression (need at least ${degree + 1} points, got ${pairs.length})`,
             "STATS_INSUFFICIENT_SAMPLE",
-            "validation" /* VALIDATION */
+            ErrorCategory.VALIDATION
           );
         }
         const X = pairs.map(
@@ -9295,7 +9766,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "Insufficient sample size for t-test",
               "STATS_INSUFFICIENT_SAMPLE",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const tStatistic = (mean - expectedMean) / (stdDev / Math.sqrt(n));
@@ -9303,7 +9774,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Cannot compute t-statistic: stdDev=${stdDev.toFixed(4)}, n=${n}. This may indicate zero variance, non-numeric data, or that column "${input.column}" does not exist.`,
               "STATS_COMPUTATION_FAILED",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const pValue = tDistPValue(tStatistic, df);
@@ -9326,7 +9797,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "column2 is required for two-sample t-test",
               "STATS_MISSING_COLUMN",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           await validateColumnExists(adapter, input.table, input.column2);
@@ -9353,7 +9824,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "Insufficient sample size for t-test",
               "STATS_INSUFFICIENT_SAMPLE",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const tStatistic = (mean1 - mean2) / Math.sqrt(var1 / n1 + var2 / n2);
@@ -9361,7 +9832,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Cannot compute t-statistic: var1=${var1.toFixed(4)}, var2=${var2.toFixed(4)}. This may indicate zero variance or non-numeric data.`,
               "STATS_COMPUTATION_FAILED",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const dfNum = Math.pow(var1 / n1 + var2 / n2, 2);
@@ -9385,7 +9856,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               "groupColumn is required for chi-square test",
               "STATS_MISSING_COLUMN",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           await validateColumnExists(adapter, input.table, input.groupColumn);
@@ -9422,7 +9893,7 @@ function createHypothesisTool(adapter) {
             throw new DbMcpError(
               `Insufficient categories for chi-square test: "${input.column}" has ${rowTotals.size} category(s), "${input.groupColumn}" has ${colTotals.size} category(s). Both columns must have at least 2 distinct values.`,
               "STATS_INSUFFICIENT_CATEGORIES",
-              "validation" /* VALIDATION */
+              ErrorCategory.VALIDATION
             );
           }
           const pValue = Math.exp(-chiSquare / 2);
@@ -10089,7 +10560,7 @@ var DropViewSchema = z.object({
 });
 var DbStatSchema = z.object({
   table: z.string().optional().describe("Optional table name to filter"),
-  summarize: z.boolean().optional().default(false).describe(
+  summarize: z.boolean().optional().default(true).describe(
     "If true, return aggregated per-table stats instead of raw page-level data"
   ),
   limit: z.preprocess(
@@ -10344,34 +10815,6 @@ function createDropViewTool(adapter) {
   };
 }
 
-// src/utils/progress-utils.ts
-function buildProgressContext(ctx) {
-  if (ctx?.server === void 0 || ctx.progressToken === void 0) {
-    return void 0;
-  }
-  return {
-    server: ctx.server,
-    progressToken: ctx.progressToken
-  };
-}
-async function sendProgress(ctx, progress, total, message) {
-  if (ctx === void 0) return;
-  if (ctx.progressToken === void 0) return;
-  try {
-    const notification = {
-      method: "notifications/progress",
-      params: {
-        progressToken: ctx.progressToken,
-        progress,
-        ...total !== void 0 && { total },
-        ...message !== void 0 && message !== "" && { message }
-      }
-    };
-    await ctx.server.notification(notification);
-  } catch {
-  }
-}
-
 // src/adapters/sqlite/tools/virtual/analysis.ts
 function createDbStatTool(adapter) {
   return {
@@ -10638,7 +11081,9 @@ function createVirtualTableInfoTool(adapter) {
             module: "unknown",
             sql: "",
             error: `Virtual table '${input.tableName}' not found`,
-            code: "TABLE_NOT_FOUND"
+            code: "TABLE_NOT_FOUND",
+            category: "resource",
+            recoverable: false
           };
         }
         const sqlStr = typeof sqlResult.rows[0]?.["sql"] === "string" ? sqlResult.rows[0]["sql"] : "";
@@ -10756,10 +11201,10 @@ function createCsvTableTool(adapter) {
       try {
         const input = CreateCsvTableSchema.parse(params);
         const safeTableName = sanitizeIdentifier(input.tableName);
-        if (!path.isAbsolute(input.filePath)) {
+        if (!nodePath.isAbsolute(input.filePath)) {
           return {
             success: false,
-            error: `Relative path not supported. Please use an absolute path. Example: ${path.resolve(input.filePath)}`,
+            error: `Relative path not supported. Please use an absolute path. Example: ${nodePath.resolve(input.filePath)}`,
             code: "VALIDATION_ERROR",
             category: "validation",
             message: "",
@@ -10767,20 +11212,37 @@ function createCsvTableTool(adapter) {
             columns: []
           };
         }
-        const pathCheck = validateSameDirPath(
-          input.filePath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            success: false,
-            error: pathCheck.error,
-            code: "SECURITY_ERROR",
-            category: "security",
-            message: "",
-            sql: "",
-            columns: []
-          };
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.filePath, allowedIoRoots, false);
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR",
+              category: "security",
+              message: "",
+              sql: "",
+              columns: []
+            };
+          }
+        } else {
+          const pathCheck = validateSameDirPath(
+            input.filePath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              success: false,
+              error: pathCheck.error,
+              code: "SECURITY_ERROR",
+              category: "security",
+              message: "",
+              sql: "",
+              columns: []
+            };
+          }
         }
         const { available: csvAvailable } = await isCsvModuleAvailable(adapter);
         if (!csvAvailable) {
@@ -10863,10 +11325,10 @@ function createAnalyzeCsvSchemaTool(adapter) {
           columns: []
         };
       }
-      if (!path.isAbsolute(input.filePath)) {
+      if (!nodePath.isAbsolute(input.filePath)) {
         return {
           success: false,
-          error: `Relative path not supported. Please use an absolute path. Example: ${path.resolve(input.filePath)}`,
+          error: `Relative path not supported. Please use an absolute path. Example: ${nodePath.resolve(input.filePath)}`,
           code: "VALIDATION_ERROR",
           category: "validation",
           hasHeader: false,
@@ -10874,20 +11336,37 @@ function createAnalyzeCsvSchemaTool(adapter) {
           columns: []
         };
       }
-      const validation = validateSameDirPath(
-        input.filePath,
-        adapter.getConfiguredPath()
-      );
-      if (!validation.valid) {
-        return {
-          success: false,
-          error: validation.error || "Path validation failed",
-          code: "SECURITY_ERROR",
-          category: "validation",
-          hasHeader: false,
-          rowCount: 0,
-          columns: []
-        };
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.filePath, allowedIoRoots, false);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            category: "security",
+            hasHeader: false,
+            rowCount: 0,
+            columns: []
+          };
+        }
+      } else {
+        const validation = validateSameDirPath(
+          input.filePath,
+          adapter.getConfiguredPath()
+        );
+        if (!validation.valid) {
+          return {
+            success: false,
+            error: validation.error || "Path validation failed",
+            code: "SECURITY_ERROR",
+            category: "security",
+            hasHeader: false,
+            rowCount: 0,
+            columns: []
+          };
+        }
       }
       const tempName = `_csv_analyze_${Date.now()}`;
       try {
@@ -11318,10 +11797,7 @@ function createVectorCreateTableTool(adapter) {
       try {
         const input = VectorCreateTableSchema.parse(params);
         if (input.dimensions < 1) {
-          return {
-            success: false,
-            error: "Dimensions must be at least 1"
-          };
+          throw new ValidationError("Dimensions must be at least 1");
         }
         const tableName = sanitizeIdentifier(input.tableName);
         const columns = [
@@ -11407,15 +11883,15 @@ function createVectorStoreTool(adapter) {
       try {
         const input = VectorStoreSchema.parse(params);
         if (input.vector.length === 0) {
-          return {
-            success: false,
-            error: "vector is required and must be a non-empty array of numbers"
-          };
+          throw new ValidationError(
+            "vector is required and must be a non-empty array of numbers"
+          );
         }
         const table = sanitizeIdentifier(input.table);
         const idColumn = sanitizeIdentifier(input.idColumn);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
         let hasDimsColumn = false;
+        let expectedDims;
         try {
           const dims = await validateDimensions(
             adapter,
@@ -11424,15 +11900,15 @@ function createVectorStoreTool(adapter) {
             input.vectorColumn
           );
           hasDimsColumn = dims.hasDimsColumn;
-          if (dims.expectedDims !== void 0 && input.vector.length !== dims.expectedDims) {
-            return {
-              success: false,
-              error: `Dimension mismatch: vector has ${input.vector.length} dimensions but table expects ${dims.expectedDims}`,
-              code: "DIMENSION_MISMATCH"
-            };
-          }
+          expectedDims = dims.expectedDims;
         } catch {
         }
+        if (expectedDims !== void 0 && input.vector.length !== expectedDims) {
+          throw new ValidationError(
+            `Dimension mismatch: vector has ${input.vector.length} dimensions but table expects ${expectedDims}`,
+            "DIMENSION_MISMATCH"
+          );
+        }
         const vectorJson = JSON.stringify(input.vector);
         const updateSql = `UPDATE ${table} SET ${vectorColumn} = ? WHERE ${idColumn} = ?`;
         const updateResult = await adapter.executeWriteQuery(updateSql, [
@@ -11474,10 +11950,11 @@ function createVectorBatchStoreTool(adapter) {
             input.table
           ]);
           if (!checkResult.rows || checkResult.rows.length === 0) {
-            return {
-              success: false,
-              error: `Table '${input.table}' does not exist`
-            };
+            throw new ResourceNotFoundError(
+              `Table '${input.table}' does not exist`,
+              "TABLE_NOT_FOUND",
+              { resourceType: "table", resourceName: input.table }
+            );
           }
           return {
             success: true,
@@ -11488,6 +11965,7 @@ function createVectorBatchStoreTool(adapter) {
         const idColumn = sanitizeIdentifier(input.idColumn);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
         let hasDimsColumn = false;
+        let expectedDims;
         try {
           const dims = await validateDimensions(
             adapter,
@@ -11496,19 +11974,19 @@ function createVectorBatchStoreTool(adapter) {
             input.vectorColumn
           );
           hasDimsColumn = dims.hasDimsColumn;
-          if (dims.expectedDims !== void 0) {
-            for (let i = 0; i < input.items.length; i++) {
-              const item = input.items[i];
-              if (item && item.vector.length !== dims.expectedDims) {
-                return {
-                  success: false,
-                  error: `Dimension mismatch at item[${i}]: vector has ${item.vector.length} dimensions but table expects ${dims.expectedDims}`,
-                  code: "DIMENSION_MISMATCH"
-                };
-              }
+          expectedDims = dims.expectedDims;
+        } catch {
+        }
+        if (expectedDims !== void 0) {
+          for (let i = 0; i < input.items.length; i++) {
+            const item = input.items[i];
+            if (item && item.vector.length !== expectedDims) {
+              throw new ValidationError(
+                `Dimension mismatch at item[${i}]: vector has ${item.vector.length} dimensions but table expects ${expectedDims}`,
+                "DIMENSION_MISMATCH"
+              );
             }
           }
-        } catch {
         }
         let stored = 0;
         for (const item of input.items) {
@@ -11578,10 +12056,9 @@ function createVectorSearchTool(adapter) {
       try {
         const input = VectorSearchSchema.parse(params);
         if (input.queryVector.length === 0) {
-          return {
-            success: false,
-            error: "queryVector is required and must be a non-empty array of numbers"
-          };
+          throw new ValidationError(
+            "queryVector is required and must be a non-empty array of numbers"
+          );
         }
         const table = sanitizeIdentifier(input.table);
         const vectorColumn = sanitizeIdentifier(input.vectorColumn);
@@ -11629,10 +12106,9 @@ function createVectorSearchTool(adapter) {
                 score = cosineSimilarity(queryVector, storedVector);
                 break;
               default:
-                return {
-                  success: false,
-                  error: `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
-                };
+                throw new ValidationError(
+                  `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
+                );
             }
             scored.push({
               ...row,
@@ -11700,26 +12176,17 @@ function createVectorGetTool(adapter) {
         const sql = `SELECT * FROM ${table} WHERE ${idColumn} = ?`;
         const result = await adapter.executeReadQuery(sql, [input.id]);
         if (!result.rows || result.rows.length === 0) {
-          return {
-            success: false,
-            error: "Vector not found",
-            code: "VECTOR_NOT_FOUND"
-          };
+          throw new ResourceNotFoundError("Vector not found", "VECTOR_NOT_FOUND", { resourceType: "vector", resourceName: String(input.id) });
         }
         const row = result.rows[0];
         if (!row) {
-          return {
-            success: false,
-            error: "Vector not found",
-            code: "VECTOR_NOT_FOUND"
-          };
+          throw new ResourceNotFoundError("Vector not found", "VECTOR_NOT_FOUND", { resourceType: "vector", resourceName: String(input.id) });
         }
         const rawVector = row[input.vectorColumn];
         if (rawVector === void 0 || rawVector === null) {
-          return {
-            success: false,
-            error: `Column '${input.vectorColumn}' not found or contains NULL. Available columns: ${Object.keys(row).join(", ")}`
-          };
+          throw new ValidationError(
+            `Column '${input.vectorColumn}' not found or contains NULL. Available columns: ${Object.keys(row).join(", ")}`
+          );
         }
         const vectorData = parseVector(rawVector);
         const metadata = Object.fromEntries(
@@ -11891,13 +12358,9 @@ function createVectorNormalizeTool() {
       try {
         const input = VectorNormalizeSchema.parse(params);
         if (input.vector.length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "vector is required and must be a non-empty array of numbers",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          });
+          throw new ValidationError(
+            "vector is required and must be a non-empty array of numbers"
+          );
         }
         const normalized = normalizeVector(input.vector);
         return Promise.resolve({
@@ -11925,22 +12388,14 @@ function createVectorDistanceTool() {
     annotations: readOnly("Vector Distance"),
     handler: (params, _context) => {
       try {
-        const input = VectorDistanceSchema.parse(params);
-        if (input.vector1.length === 0 || input.vector2.length === 0) {
-          return Promise.resolve({
-            success: false,
-            error: "vector1 and vector2 are required and must be non-empty arrays of numbers",
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            recoverable: false
-          });
+        const input = VectorDistanceSchema.parse(params);
+        if (input.vector1.length === 0 || input.vector2.length === 0) {
+          throw new ValidationError(
+            "vector1 and vector2 are required and must be non-empty arrays of numbers"
+          );
         }
         if (input.vector1.length !== input.vector2.length) {
-          return Promise.resolve({
-            success: false,
-            error: "Vector dimensions must match",
-            code: "DIMENSION_MISMATCH"
-          });
+          throw new ValidationError("Vector dimensions must match", "DIMENSION_MISMATCH");
         }
         let result;
         switch (input.metric) {
@@ -11954,13 +12409,9 @@ function createVectorDistanceTool() {
             result = 1 - cosineSimilarity(input.vector1, input.vector2);
             break;
           default:
-            return Promise.resolve({
-              success: false,
-              error: `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`,
-              code: "VALIDATION_ERROR",
-              category: "validation",
-              recoverable: false
-            });
+            throw new ValidationError(
+              `Invalid metric '${input.metric}'. Valid values: cosine, euclidean, dot`
+            );
         }
         return Promise.resolve({
           success: true,
@@ -12103,14 +12554,14 @@ function requireCoordinate(value, name, min, max) {
     throw new DbMcpError(
       `Invalid ${name}: value is not a valid number.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   if (value < min || value > max) {
     throw new DbMcpError(
       `Invalid ${name}: ${String(value)}. Must be between ${String(min)} and ${String(max)}.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   return value;
@@ -12120,7 +12571,7 @@ function requireNumber(value, name) {
     throw new DbMcpError(
       `Invalid ${name}: value is not a valid number.`,
       "GEO_INVALID_COORDINATES",
-      "validation" /* VALIDATION */
+      ErrorCategory.VALIDATION
     );
   }
   return value;
@@ -12396,19 +12847,35 @@ function createBackupTool(adapter) {
           path: ""
         };
       }
-      const pathCheck = validateSameDirPath(
-        input.targetPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.targetPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR",
-          path: input.targetPath
-        };
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.targetPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.targetPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            path: input.targetPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.targetPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.targetPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR",
+            path: input.targetPath
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
       }
-      const resolvedPath = pathCheck.resolvedPath;
       const escapedPath = resolvedPath.replace(/'/g, "''");
       const sql = `VACUUM INTO '${escapedPath}'`;
       const start = Date.now();
@@ -12418,7 +12885,7 @@ function createBackupTool(adapter) {
           progress,
           1,
           2,
-          `Creating backup at ${path__default.basename(resolvedPath)}...`
+          `Creating backup at ${nodePath__default.basename(resolvedPath)}...`
         );
         await adapter.executeQuery(sql);
         await sendProgress(progress, 2, 2, "Backup complete");
@@ -12468,18 +12935,34 @@ function createVacuumIntoTool(adapter) {
           ...formatHandlerError(new ValidationError("outputPath is required"))
         };
       }
-      const pathCheck = validateSameDirPath(
-        input.outputPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.outputPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR"
-        };
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.outputPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.outputPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            outputPath: input.outputPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.outputPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.outputPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR"
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
       }
-      const resolvedPath = pathCheck.resolvedPath;
       const escapedPath = resolvedPath.replace(/'/g, "''");
       const sql = `VACUUM INTO '${escapedPath}'`;
       const start = Date.now();
@@ -12706,26 +13189,53 @@ function createRestoreTool(adapter) {
           sourcePath: ""
         };
       }
-      const resolvedPath = path__default.resolve(input.sourcePath);
-      const pathCheck = validateSameDirPath(
-        input.sourcePath,
-        adapter.getConfiguredPath()
-      );
-      if (!pathCheck.valid) {
-        return {
-          ...formatHandlerError(new ValidationError(pathCheck.error)),
-          sourcePath: input.sourcePath
-        };
-      }
-      if (!fs.existsSync(resolvedPath)) {
-        return {
-          ...formatHandlerError(
-            new ValidationError(`Source file not found: ${input.sourcePath}`)
-          ),
-          sourcePath: input.sourcePath
-        };
+      let escapedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.sourcePath, allowedIoRoots);
+          const resolvedPath = nodePath__default.resolve(input.sourcePath);
+          if (!fs.existsSync(resolvedPath)) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  `Source file not found: ${input.sourcePath}`
+                )
+              ),
+              sourcePath: input.sourcePath
+            };
+          }
+          escapedPath = resolvedPath.replace(/'/g, "''");
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            sourcePath: input.sourcePath
+          };
+        }
+      } else {
+        const resolvedPath = nodePath__default.resolve(input.sourcePath);
+        const pathCheck = validateSameDirPath(
+          input.sourcePath,
+          adapter.getConfiguredPath()
+        );
+        if (!pathCheck.valid) {
+          return {
+            ...formatHandlerError(new ValidationError(pathCheck.error)),
+            sourcePath: input.sourcePath
+          };
+        }
+        if (!fs.existsSync(resolvedPath)) {
+          return {
+            ...formatHandlerError(
+              new ValidationError(`Source file not found: ${input.sourcePath}`)
+            ),
+            sourcePath: input.sourcePath
+          };
+        }
+        escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
       }
-      const escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
       await adapter.executeReadQuery("PRAGMA integrity_check(1)");
       await sendProgress(progress, 2, 5, "Attaching backup database...");
       try {
@@ -12938,21 +13448,37 @@ function createDumpTool(adapter) {
           ...formatHandlerError(new ValidationError("outputPath is required"))
         };
       }
-      const pathCheck = validateSameDirPath(
-        input.outputPath,
-        adapter.getConfiguredPath()
-      );
-      if (input.outputPath.includes("..") || !pathCheck.valid) {
-        return {
-          success: false,
-          error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
-          code: "SECURITY_ERROR",
-          path: input.outputPath
-        };
+      let resolvedPath;
+      const allowedIoRoots = adapter.getAllowedIoRoots();
+      if (allowedIoRoots !== void 0) {
+        try {
+          assertSafeIoPath(input.outputPath, allowedIoRoots);
+          resolvedPath = nodePath__default.resolve(input.outputPath);
+        } catch (error) {
+          return {
+            success: false,
+            error: error instanceof Error ? error.message : "Security error",
+            code: "SECURITY_ERROR",
+            path: input.outputPath
+          };
+        }
+      } else {
+        const pathCheck = validateSameDirPath(
+          input.outputPath,
+          adapter.getConfiguredPath()
+        );
+        if (input.outputPath.includes("..") || !pathCheck.valid) {
+          return {
+            success: false,
+            error: !pathCheck.valid ? pathCheck.error : "Invalid path: must not contain '..'",
+            code: "SECURITY_ERROR",
+            path: input.outputPath
+          };
+        }
+        resolvedPath = pathCheck.resolvedPath;
       }
       const progress = buildProgressContext(context);
       const start = Date.now();
-      const resolvedPath = pathCheck.resolvedPath;
       await sendProgress(progress, 1, 4, "Preparing dump file...");
       const stream = fs.createWriteStream(resolvedPath, { encoding: "utf8" });
       try {
@@ -13058,29 +13584,57 @@ function createVerifyBackupTool(adapter) {
             backupPath: ""
           };
         }
-        const resolvedPath = path__default.resolve(input.backupPath);
-        const pathCheck = validateSameDirPath(
-          input.backupPath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            ...formatHandlerError(new ValidationError(pathCheck.error)),
-            backupPath: input.backupPath
-          };
-        }
-        if (!fs.existsSync(resolvedPath)) {
-          return {
-            ...formatHandlerError(
-              new ValidationError(
-                `Backup file not found: ${input.backupPath}`,
-                "FILE_NOT_FOUND"
-              )
-            ),
-            backupPath: input.backupPath
-          };
+        let escapedPath;
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.backupPath, allowedIoRoots);
+            const resolvedPath = nodePath__default.resolve(input.backupPath);
+            if (!fs.existsSync(resolvedPath)) {
+              return {
+                ...formatHandlerError(
+                  new ValidationError(
+                    `Backup file not found: ${input.backupPath}`,
+                    "FILE_NOT_FOUND"
+                  )
+                ),
+                backupPath: input.backupPath
+              };
+            }
+            escapedPath = resolvedPath.replace(/'/g, "''");
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR",
+              backupPath: input.backupPath
+            };
+          }
+        } else {
+          const resolvedPath = nodePath__default.resolve(input.backupPath);
+          const pathCheck = validateSameDirPath(
+            input.backupPath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              ...formatHandlerError(new ValidationError(pathCheck.error)),
+              backupPath: input.backupPath
+            };
+          }
+          if (!fs.existsSync(resolvedPath)) {
+            return {
+              ...formatHandlerError(
+                new ValidationError(
+                  `Backup file not found: ${input.backupPath}`,
+                  "FILE_NOT_FOUND"
+                )
+              ),
+              backupPath: input.backupPath
+            };
+          }
+          escapedPath = resolvedPath.replace(/'/g, "''");
         }
-        const escapedPath = resolvedPath.replace(/'/g, "''");
         try {
           await adapter.rawQuery(
             `ATTACH DATABASE '${escapedPath}' AS backup_verify`
@@ -13453,18 +14007,37 @@ function createAttachDatabaseTool(adapter) {
             code: "VALIDATION_ERROR"
           };
         }
-        const pathCheck = validateSameDirPath(
-          input.filepath,
-          adapter.getConfiguredPath()
-        );
-        if (!pathCheck.valid) {
-          return {
-            success: false,
-            error: pathCheck.error,
-            code: "SECURITY_ERROR"
-          };
+        let escapedPath;
+        let finalResolvedPath;
+        const allowedIoRoots = adapter.getAllowedIoRoots();
+        if (allowedIoRoots !== void 0) {
+          try {
+            assertSafeIoPath(input.filepath, allowedIoRoots);
+            const resolvedPath = input.filepath;
+            escapedPath = resolvedPath.replace(/'/g, "''");
+            finalResolvedPath = resolvedPath;
+          } catch (error) {
+            return {
+              success: false,
+              error: error instanceof Error ? error.message : "Security error",
+              code: "SECURITY_ERROR"
+            };
+          }
+        } else {
+          const pathCheck = validateSameDirPath(
+            input.filepath,
+            adapter.getConfiguredPath()
+          );
+          if (!pathCheck.valid) {
+            return {
+              success: false,
+              error: pathCheck.error,
+              code: "SECURITY_ERROR"
+            };
+          }
+          escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
+          finalResolvedPath = pathCheck.resolvedPath;
         }
-        const escapedPath = pathCheck.resolvedPath.replace(/'/g, "''");
         await adapter.rawQuery(
           `ATTACH DATABASE '${escapedPath}' AS "${input.alias.replace(/"/g, '""')}"`
         );
@@ -13472,7 +14045,7 @@ function createAttachDatabaseTool(adapter) {
           success: true,
           message: `Database attached as '${input.alias}'`,
           alias: input.alias,
-          filepath: pathCheck.resolvedPath.split(/[\\/]/).pop() ?? ""
+          filepath: finalResolvedPath.split(/[\\/]/).pop() ?? ""
         };
       } catch (error) {
         return formatHandlerError(error);
@@ -14034,13 +14607,13 @@ var IndexAuditSchema = z.object({
 }).default({ recommendComposite: false });
 var SchemaSnapshotSchema = z.object({
   sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Specific sections to include (default: all)"),
-  compact: z.boolean().optional().describe(
-    "Omit column details from tables section for reduced payload (default: false)"
+  compact: z.boolean().optional().default(true).describe(
+    "Omit column details from tables section for reduced payload (default: true)"
   ),
   excludeSystemTables: z.boolean().optional().describe(
     "Exclude SpatiaLite system tables, views, indexes, and triggers (default: true)"
   )
-}).default({});
+}).default({ compact: true });
 var MigrationRisksSchema = z.object({
   statements: z.array(z.string()).optional().default([]).describe("Array of DDL statements to analyze for risks")
 }).default({ statements: [] });
@@ -14059,6 +14632,7 @@ var ConstraintAnalysisSchema = z.object({
   )
 }).default({});
 var DependencyGraphSchema = z.object({
+  table: z.string().optional().describe("Optional table name to filter the graph"),
   includeRowCounts: z.boolean().optional().describe("Include row counts per table (default: true)"),
   nodesOnly: z.boolean().optional().describe(
     "Return only nodes without edges for a lightweight response (default: false)"
@@ -14077,7 +14651,10 @@ var TopologicalSortSchema = z.object({
 }).default({});
 var CascadeSimulatorSchema = z.object({
   table: z.string().optional().default("").describe("Table name to simulate deletion from"),
-  operation: z.enum(["DELETE", "DROP", "TRUNCATE"]).optional().describe("Operation to simulate (default: DELETE)"),
+  operation: z.preprocess(
+    (val) => typeof val === "string" ? val.toUpperCase() : val,
+    z.enum(["DELETE", "DROP", "TRUNCATE"])
+  ).optional().describe("Operation to simulate (default: DELETE)"),
   compact: z.boolean().optional().describe(
     "Omit path arrays from affected entries to reduce payload (default: false)"
   )
@@ -14144,10 +14721,16 @@ var SchemaDiffOutputSchema = z.object({
   comparedAt: z.string().optional()
 }).extend(ErrorResponseFields.shape);
 var SchemaDiffSchema = z.object({
-  baseline: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
+  baseline: z.preprocess(
+    (val) => Array.isArray(val) ? val.length === 0 ? {} : { tables: val } : val,
+    z.union([z.literal("current"), SchemaSnapshotShape])
+  ).optional().describe(
     "Baseline schema \u2014 'current' to snapshot live DB, or an inline snapshot object from a previous sqlite_schema_snapshot call"
   ),
-  target: z.union([z.literal("current"), SchemaSnapshotShape]).optional().describe(
+  target: z.preprocess(
+    (val) => Array.isArray(val) ? val.length === 0 ? {} : { tables: val } : val,
+    z.union([z.literal("current"), SchemaSnapshotShape])
+  ).optional().describe(
     "Target schema to compare against baseline \u2014 'current' to snapshot live DB, or an inline snapshot object"
   ),
   sections: z.array(z.enum(["tables", "views", "indexes", "triggers"])).optional().describe("Sections to compare (default: all)"),
@@ -14169,42 +14752,80 @@ function createDependencyGraphTool(adapter) {
     handler: async (params, _context) => {
       try {
         const input = DependencyGraphSchema.parse(params);
+        if (input.table) {
+          const tableCheck = await adapter.executeReadQuery(
+            `SELECT 1 FROM sqlite_master WHERE type='table' AND name=?`,
+            [input.table]
+          );
+          if ((tableCheck.rows?.length ?? 0) === 0) {
+            return {
+              success: false,
+              error: `Table '${input.table}' does not exist`,
+              code: "TABLE_NOT_FOUND",
+              category: "resource",
+              suggestion: "Table not found. Run sqlite_list_tables to see available tables.",
+              recoverable: false
+            };
+          }
+        }
         const includeRowCounts = input.includeRowCounts !== false;
         const { nodes, edges } = await buildForeignKeyGraph(adapter, {
           excludeSystemTables: input.excludeSystemTables,
           includeRowCounts
         });
+        let finalNodes = nodes;
+        let finalEdges = edges;
+        if (input.table) {
+          const connected = /* @__PURE__ */ new Set([input.table]);
+          let added = true;
+          while (added) {
+            added = false;
+            for (const e of edges) {
+              if (connected.has(e.from) && !connected.has(e.to)) {
+                connected.add(e.to);
+                added = true;
+              } else if (connected.has(e.to) && !connected.has(e.from)) {
+                connected.add(e.from);
+                added = true;
+              }
+            }
+          }
+          finalNodes = nodes.filter((n) => connected.has(n.table));
+          finalEdges = edges.filter(
+            (e) => connected.has(e.from) && connected.has(e.to)
+          );
+        }
         const adjacency = /* @__PURE__ */ new Map();
-        for (const node of nodes) {
+        for (const node of finalNodes) {
           adjacency.set(node.table, []);
         }
-        for (const edge of edges) {
+        for (const edge of finalEdges) {
           adjacency.get(edge.from)?.push(edge.to);
         }
         const cycles = detectCycles(
           adjacency,
-          nodes.map((n) => n.table)
+          finalNodes.map((n) => n.table)
         );
-        const referencedTables = new Set(edges.map((e) => e.to));
-        const referencingTables = new Set(edges.map((e) => e.from));
-        const rootTables = nodes.filter(
+        const referencedTables = new Set(finalEdges.map((e) => e.to));
+        const referencingTables = new Set(finalEdges.map((e) => e.from));
+        const rootTables = finalNodes.filter(
           (n) => referencedTables.has(n.table) && !referencingTables.has(n.table)
         ).map((n) => n.table);
-        const leafTables = nodes.filter(
+        const leafTables = finalNodes.filter(
           (n) => referencingTables.has(n.table) && !referencedTables.has(n.table)
         ).map((n) => n.table);
         const nodesOnly = input.nodesOnly === true;
         return {
           success: true,
-          nodes: nodes.map((n) => ({
+          nodes: finalNodes.map((n) => ({
             table: n.table,
             ...includeRowCounts ? { rowCount: n.rowCount } : {}
           })),
-          ...!nodesOnly ? { edges } : {},
+          ...!nodesOnly ? { edges: finalEdges } : {},
           circularDependencies: cycles.length > 0 ? cycles : void 0,
           stats: {
-            totalTables: nodes.length,
-            totalRelationships: edges.length,
+            totalTables: finalNodes.length,
+            totalRelationships: finalEdges.length,
             rootTables,
             leafTables
           }
@@ -15781,7 +16402,7 @@ var MigrationStatusOutputSchema = z.object({
   }).optional(),
   sourceSystems: z.array(z.string()).optional()
 }).extend(ErrorResponseFields.shape);
-var MigrationInitSchema = z.object({}).default({});
+var MigrationInitSchema = z.object({}).strict().default({});
 var MigrationRecordSchema = z.object({
   version: z.string().describe("Version identifier (e.g., '1.0.0', '2024-01-15-add-users')"),
   description: z.string().optional().describe("Human-readable description of the migration"),
@@ -15856,7 +16477,7 @@ var MigrationHistorySchema = z.object({
     "Omit migrationHash and sourceSystem from records to reduce payload (default: false)"
   )
 }).default({});
-var MigrationStatusSchema = z.object({}).default({});
+var MigrationStatusSchema = z.object({}).strict().default({});
 var MIGRATIONS_TABLE = "_mcp_migrations";
 function toMigrationRecord(row) {
   return {
@@ -15884,7 +16505,7 @@ function validateMigrationSql(sql) {
   const cleanSql = sql.replace(/\/\*[\s\S]*?\*\//g, "").replace(/--.*$/gm, "");
   const upperSql = cleanSql.toUpperCase();
   if (upperSql.includes("ATTACH ") || upperSql.includes("DETACH ") || upperSql.includes("PRAGMA ") || upperSql.includes("LOAD_EXTENSION(")) {
-    throw new Error(
+    throw new ValidationError(
       `Migration validation failed: unauthorized command or function call`
     );
   }
@@ -16577,6 +17198,10 @@ var POSITIONAL_PARAM_MAP = {
   listConstraints: "table",
   dateAdd: ["table", "column", "amount", "unit", "whereClause"],
   dateDiff: ["table", "column1", "column2", "unit", "whereClause"],
+  enableVersioning: "table",
+  disableVersioning: "table",
+  checkVersion: ["table", "rowId"],
+  conditionalUpdate: ["table", "data", "conditions", "expectedVersion"],
   // JSON
   extract: ["table", "column", "path", "whereClause"],
   set: ["table", "column", "path", "value", "whereClause"],
@@ -16731,7 +17356,7 @@ function normalizeParams(methodName, args) {
       if (Array.isArray(paramMapping2) && paramMapping2[0] !== void 0) {
         return { [paramMapping2[0]]: arg };
       }
-      throw new Error(
+      throw new ValidationError(
         `Positional arguments are not supported for method: ${methodName}. Please use an options object.`
       );
     }
@@ -16739,7 +17364,7 @@ function normalizeParams(methodName, args) {
   }
   const paramMapping = POSITIONAL_PARAM_MAP[methodName];
   if (paramMapping === void 0) {
-    throw new Error(
+    throw new ValidationError(
       `Positional arguments are not supported for method: ${methodName}. Please use an options object.`
     );
   }
@@ -16789,7 +17414,7 @@ function createGroupApi(groupName, tools, baseContext) {
     api[methodName] = async (...args) => {
       if (baseContext?.auth !== void 0) {
         if (!scopesGrantToolAccess(baseContext.auth.scopes ?? [], tool.name)) {
-          throw new Error(
+          throw new AuthorizationError(
             `Forbidden: Required scope for tool '${tool.name}' not granted.`
           );
         }
@@ -16800,7 +17425,8 @@ function createGroupApi(groupName, tools, baseContext) {
         requestId: crypto.randomUUID(),
         ...baseContext?.server !== void 0 ? { server: baseContext.server } : {},
         ...baseContext?.progressToken !== void 0 ? { progressToken: baseContext.progressToken } : {},
-        ...baseContext?.auth !== void 0 ? { auth: baseContext.auth } : {}
+        ...baseContext?.auth !== void 0 ? { auth: baseContext.auth } : {},
+        isCodeMode: true
       };
       const result = await tool.handler(normalizedParams, context);
       return result;
@@ -16962,7 +17588,8 @@ function createSqliteApi(tools, baseContext) {
 var DEFAULT_SANDBOX_OPTIONS = {
   memoryLimitMb: 128,
   timeoutMs: 5e3,
-  cpuLimitMs: 1e4
+  cpuLimitMs: 1e4,
+  strictIsolation: true
 };
 var DEFAULT_POOL_OPTIONS = {
   minInstances: 2,
@@ -17158,7 +17785,7 @@ var CodeModeSecurityManager = class {
       const redactedResult = redactObject(result, 0, 15);
       const serialized = JSON.stringify(redactedResult);
       if (serialized === void 0) {
-        throw new Error("Not serializable");
+        throw new InternalError("Not serializable");
       }
       if (serialized.length > this.config.maxResultSize) {
         return {
@@ -17258,6 +17885,9 @@ return ${lastStmt}`;
 }
 
 // src/codemode/sandbox.ts
+var GROUP_NAME_REGEX = /^[a-zA-Z0-9_]+$/;
+var astCache = /* @__PURE__ */ new Map();
+var MAX_AST_CACHE_SIZE = 500;
 var CodeModeSandbox = class _CodeModeSandbox {
   options;
   disposed = false;
@@ -17286,9 +17916,8 @@ var CodeModeSandbox = class _CodeModeSandbox {
         metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
       };
     }
-    const groupNameRegex = /^[a-zA-Z0-9_]+$/;
     for (const groupName of Object.keys(apiBindings)) {
-      if (!groupNameRegex.test(groupName) || groupName === "__proto__" || groupName === "constructor" || groupName === "prototype") {
+      if (!GROUP_NAME_REGEX.test(groupName) || groupName === "__proto__" || groupName === "constructor" || groupName === "prototype") {
         return {
           success: false,
           error: `Security Error: Invalid tool group name '${groupName}'`,
@@ -17298,30 +17927,39 @@ var CodeModeSandbox = class _CodeModeSandbox {
     }
     try {
       const wrappedCode = `async function __wrapper() { ${code} }`;
-      const ast = acorn.parse(wrappedCode, {
-        ecmaVersion: "latest",
-        sourceType: "script"
-      });
-      const validateAst = (node) => {
-        if (node === null || node === void 0 || typeof node !== "object")
-          return;
-        const n = node;
-        if (n["type"] === "WithStatement") {
-          throw new Error("'with' statements are forbidden in sandbox code.");
-        }
-        if (n["type"] === "MemberExpression" && n["object"] !== null && n["object"] !== void 0 && typeof n["object"] === "object" && n["object"]["type"] === "Identifier") {
-          const objName = n["object"]["name"];
-          if (["process", "require", "global", "globalThis"].includes(objName)) {
-            throw new Error(`Access to '${objName}' is forbidden.`);
+      if (!astCache.has(wrappedCode)) {
+        const ast = acorn.parse(wrappedCode, {
+          ecmaVersion: "latest",
+          sourceType: "script"
+        });
+        const validateAst = (node) => {
+          if (node === null || node === void 0 || typeof node !== "object")
+            return;
+          const n = node;
+          if (n["type"] === "WithStatement") {
+            throw new ValidationError(
+              "'with' statements are forbidden in sandbox code."
+            );
           }
-        }
-        for (const key in n) {
-          if (key !== "loc" && key !== "start" && key !== "end") {
-            validateAst(n[key]);
+          if (n["type"] === "MemberExpression" && n["object"] !== null && n["object"] !== void 0 && typeof n["object"] === "object" && n["object"]["type"] === "Identifier") {
+            const objName = n["object"]["name"];
+            if (["process", "require", "global", "globalThis"].includes(objName)) {
+              throw new ValidationError(`Access to '${objName}' is forbidden.`);
+            }
+          }
+          for (const key in n) {
+            if (key !== "loc" && key !== "start" && key !== "end") {
+              validateAst(n[key]);
+            }
           }
+        };
+        validateAst(ast);
+        if (astCache.size >= MAX_AST_CACHE_SIZE) {
+          const firstKey = astCache.keys().next().value;
+          if (firstKey) astCache.delete(firstKey);
         }
-      };
-      validateAst(ast);
+        astCache.set(wrappedCode, ast);
+      }
     } catch (e) {
       return {
         success: false,
@@ -17337,6 +17975,13 @@ var CodeModeSandbox = class _CodeModeSandbox {
     } catch {
     }
     if (!ivmLib) {
+      if (this.options.strictIsolation) {
+        return {
+          success: false,
+          error: "Security Error: isolated-vm native bindings failed to load. Code Mode strict isolation is enabled and node:vm fallback is prohibited.",
+          metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
+        };
+      }
       const vm = await import('vm');
       const logs2 = [];
       const sandboxEnv = {
@@ -17363,6 +18008,28 @@ var CodeModeSandbox = class _CodeModeSandbox {
         }
       }
       const context2 = vm.createContext(sandboxEnv);
+      vm.runInContext(
+        `
+        const proxyHandler = {
+          get(target, prop, receiver) {
+            if (typeof prop === "string" && !(prop in target)) {
+              const camelProp = prop.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+              if (camelProp in target) {
+                return Reflect.get(target, camelProp, receiver);
+              }
+            }
+            return Reflect.get(target, prop, receiver);
+          }
+        };
+        sqlite = new Proxy(sqlite, proxyHandler);
+        for (const key of Object.keys(sqlite)) {
+          if (typeof sqlite[key] === "object" && sqlite[key] !== null) {
+            sqlite[key] = new Proxy(sqlite[key], proxyHandler);
+          }
+        }
+      `,
+        context2
+      );
       const startTime2 = performance.now();
       let result2;
       let success2 = true;
@@ -17425,62 +18092,90 @@ var CodeModeSandbox = class _CodeModeSandbox {
       context.evalSync(setupScript);
       let rpcCount = 0;
       const MAX_RPC_CALLS = 100;
+      let batchedScript = "";
       for (const [groupName, groupValue] of Object.entries(apiBindings)) {
         if (typeof groupValue === "object" && groupValue !== null) {
-          context.evalSync(
-            `globalThis.sqlite[${JSON.stringify(groupName)}] = {};`
-          );
+          batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}] = {};
+`;
           for (const [methodName, methodFn] of Object.entries(groupValue)) {
             if (typeof methodFn === "function") {
               const fnRef = new ivmLib.Reference(async (...args) => {
                 if (++rpcCount > MAX_RPC_CALLS) {
-                  throw new Error(
+                  throw new RateLimitError(
                     `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
                   );
                 }
                 try {
                   return await methodFn(...args);
                 } catch (e) {
-                  throw new Error(e instanceof Error ? e.message : String(e), {
-                    cause: e
-                  });
+                  throw new InternalError(
+                    e instanceof Error ? e.message : String(e),
+                    "RPC_EXECUTION_ERROR",
+                    {
+                      cause: e instanceof Error ? e : void 0
+                    }
+                  );
                 }
               });
               refCleanup.push(fnRef);
               const refName = `fnRef_${groupName}_${methodName}`;
               context.global.setSync(refName, fnRef);
-              context.evalSync(`
-                globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
+              batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}][${JSON.stringify(methodName)}] = async (...args) => {
                   return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
                 };
-              `);
+`;
             }
           }
         } else if (typeof groupValue === "function") {
           const fnRef = new ivmLib.Reference(async (...args) => {
             if (++rpcCount > MAX_RPC_CALLS) {
-              throw new Error(
+              throw new RateLimitError(
                 `QuotaExceededError: Maximum number of host tool calls (${MAX_RPC_CALLS}) exceeded (attempted call ${rpcCount}).`
               );
             }
             try {
               return await groupValue(...args);
             } catch (e) {
-              throw new Error(e instanceof Error ? e.message : String(e), {
-                cause: e
-              });
+              throw new InternalError(
+                e instanceof Error ? e.message : String(e),
+                "RPC_EXECUTION_ERROR",
+                {
+                  cause: e instanceof Error ? e : void 0
+                }
+              );
             }
           });
           refCleanup.push(fnRef);
           const refName = `fnRef_${groupName}`;
           context.global.setSync(refName, fnRef);
-          context.evalSync(`
-            globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
+          batchedScript += `globalThis.sqlite[${JSON.stringify(groupName)}] = async (...args) => {
               return await globalThis[${JSON.stringify(refName)}].apply(undefined, args, { arguments: { copy: true }, result: { promise: true, copy: true } });
             };
-          `);
+`;
         }
       }
+      if (batchedScript.length > 0) {
+        context.evalSync(batchedScript);
+      }
+      context.evalSync(`
+        const proxyHandler = {
+          get(target, prop, receiver) {
+            if (typeof prop === "string" && !(prop in target)) {
+              const camelProp = prop.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+              if (camelProp in target) {
+                return Reflect.get(target, camelProp, receiver);
+              }
+            }
+            return Reflect.get(target, prop, receiver);
+          }
+        };
+        globalThis.sqlite = new Proxy(globalThis.sqlite, proxyHandler);
+        for (const key of Object.keys(globalThis.sqlite)) {
+          if (typeof globalThis.sqlite[key] === "object" && globalThis.sqlite[key] !== null) {
+            globalThis.sqlite[key] = new Proxy(globalThis.sqlite[key], proxyHandler);
+          }
+        }
+      `);
       const wrappedCode = `(async () => { ${transformAutoReturn(code)} })()`;
       script = isolate.compileScriptSync(wrappedCode, {
         filename: `code-mode.js`
@@ -17559,7 +18254,10 @@ var SandboxPool = class _SandboxPool {
   }
   static getIvmLib() {
     if (!_SandboxPool.cachedIvmLib) {
-      throw new Error("ivmLib not initialized");
+      throw new InternalError(
+        "ivmLib not initialized",
+        "IVMLIB_NOT_INITIALIZED"
+      );
     }
     return _SandboxPool.cachedIvmLib;
   }
@@ -17578,8 +18276,9 @@ var SandboxPool = class _SandboxPool {
       await _SandboxPool.initialize();
     }
     if (this.inUseCount >= this.options.maxInstances) {
-      throw new Error(
-        `Sandbox pool exhausted (max ${this.options.maxInstances})`
+      throw new InternalError(
+        `Sandbox pool exhausted (max ${this.options.maxInstances})`,
+        "POOL_EXHAUSTED"
       );
     }
     this.inUseCount++;
@@ -17716,15 +18415,14 @@ function createExecuteCodeTool(adapter) {
         }
         const clientId = _context.auth?.sub ?? _context.clientIp ?? processId;
         if (!await security.checkRateLimit(clientId)) {
-          return {
-            success: false,
-            error: `Rate limit exceeded. Maximum ${String(codemodeRateLimit)} executions per minute.`,
-            code: "CODEMODE_RATE_LIMITED",
-            category: "permission",
-            suggestion: "Wait before retrying. Combine multiple operations into fewer execute_code calls.",
-            recoverable: true,
-            metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 }
-          };
+          throw new RateLimitError(
+            `Rate limit exceeded. Maximum ${String(codemodeRateLimit)} executions per minute.`,
+            "CODEMODE_RATE_LIMITED",
+            {
+              suggestion: "Wait before retrying. Combine multiple operations into fewer execute_code calls.",
+              limit: codemodeRateLimit
+            }
+          );
         }
         if (!pool) {
           initializePool();
@@ -17739,7 +18437,7 @@ function createExecuteCodeTool(adapter) {
           throw new DbMcpError(
             "Sandbox pool not initialized",
             "CODEMODE_POOL_UNINITIALIZED",
-            "internal" /* INTERNAL */
+            ErrorCategory.INTERNAL
           );
         }
         const result = await pool.execute(code, bindings, timeoutMs);
@@ -17759,6 +18457,13 @@ function createExecuteCodeTool(adapter) {
           } catch {
           }
         }
+        if (!result.success && typeof result.error === "string" && /script execution timed out/i.test(result.error)) {
+          return formatHandlerError(
+            new TimeoutError("Code execution timed out", "CODEMODE_TIMEOUT", {
+              suggestion: "Reduce code complexity or increase the timeout parameter (max 30000ms). Break complex logic into smaller execute_code calls."
+            })
+          );
+        }
         return {
           success: result.success,
           result: sanitizedResult,
@@ -17776,6 +18481,14 @@ function createExecuteCodeTool(adapter) {
           operation: "executeCode",
           error: error instanceof Error ? error : void 0
         });
+        if (error instanceof Error && /script execution timed out/i.test(error.message)) {
+          return formatHandlerError(
+            new TimeoutError("Code execution timed out", "CODEMODE_TIMEOUT", {
+              suggestion: "Reduce code complexity or increase the timeout parameter (max 30000ms). Break complex logic into smaller execute_code calls.",
+              cause: error
+            })
+          );
+        }
         return formatHandlerError(error);
       }
     }
@@ -17825,7 +18538,8 @@ function initializePool() {
     operation: "initialize"
   });
   setDefaultSandboxMode(mode);
-  pool = createSandboxPool(mode, void 0, { timeoutMs: 3e4 });
+  const strictIsolation = process.env["CODE_MODE_STRICT_ISOLATION"] !== "false";
+  pool = createSandboxPool(mode, void 0, { timeoutMs: 3e4, strictIsolation });
   pool.initialize();
   logger.info(`Code Mode initialized with ${mode} sandbox`, {
     module: "CODEMODE",
@@ -17885,6 +18599,8 @@ function detectAndSetJsonbSupport(getVersion, log2) {
 }
 
 // src/adapters/sqlite/query-executor.ts
+var RETURNING_REGEX = /\bRETURNING\b/i;
+var INSERT_REGEX = /^\s*INSERT\s/i;
 var log = createModuleLogger("SQLITE");
 function translateSqliteError(error, sql, operation, overrideLog) {
   const message = error instanceof Error ? error.message : String(error);
@@ -17892,8 +18608,7 @@ function translateSqliteError(error, sql, operation, overrideLog) {
   const improvedMessage = `${operation} failed: ${message}`;
   const details = { sql };
   if (match?.code === "TABLE_NOT_FOUND") {
-    const tableMatch = /no such table[:\s]*(['"]?)([\w.]+)\1/i.exec(message);
-    const tableName = tableMatch ? tableMatch[2] : "unknown";
+    const tableName = match.match?.[2] ?? "unknown";
     throw new ResourceNotFoundError(
       `Table '${tableName}' not found`,
       "TABLE_NOT_FOUND",
@@ -17907,8 +18622,7 @@ function translateSqliteError(error, sql, operation, overrideLog) {
     );
   }
   if (match?.code === "COLUMN_NOT_FOUND") {
-    const colMatch = /no such column[:\s]*(['"]?)([\w.]+)\1/i.exec(message) ?? /has no column named[:\s]*(['"]?)([\w.]+)\1/i.exec(message);
-    const colName = colMatch ? colMatch[2] : "unknown";
+    const colName = match.match?.[2] ?? "unknown";
     throw new ResourceNotFoundError(
       `Column '${colName}' not found`,
       "COLUMN_NOT_FOUND",
@@ -17988,7 +18702,7 @@ function executeWrite(db, sql, params) {
   try {
     const normalizedParams = normalizeSqliteParams(params);
     let rows = [];
-    if (/\bRETURNING\b/i.test(sql)) {
+    if (RETURNING_REGEX.test(sql)) {
       const results = normalizedParams ? db.exec(sql, normalizedParams) : db.exec(sql);
       if (results.length > 0 && results[0]) {
         rows = rowsFromSqlJsResult(results[0]);
@@ -18003,7 +18717,7 @@ function executeWrite(db, sql, params) {
     const changes = db.getRowsModified();
     let lastInsertId;
     try {
-      if (/^\s*INSERT\s/i.test(sql) && !/\bRETURNING\b/i.test(sql)) {
+      if (INSERT_REGEX.test(sql) && !RETURNING_REGEX.test(sql)) {
         const rowidResult = db.exec("SELECT last_insert_rowid()");
         if (rowidResult[0]?.values[0]) {
           lastInsertId = Number(rowidResult[0].values[0][0]);