sandal-db 1.0.0

package/dist/cli.js

@@ -0,0 +1,2458 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+import chalk3 from "chalk";
+import ora2 from "ora";
+import { input as input2, select, confirm as confirm2 } from "@inquirer/prompts";
+
+// src/config/index.ts
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import dotenv from "dotenv";
+dotenv.config();
+var CONFIG_DIR_NAME = ".sandal";
+var LEGACY_CONFIG_DIR_NAME = ".db-agent";
+var CONFIG_FILE_NAME = "config.json";
+function getConfigDirPath() {
+  return path.join(os.homedir(), CONFIG_DIR_NAME);
+}
+function getConfigFilePath() {
+  return path.join(getConfigDirPath(), CONFIG_FILE_NAME);
+}
+function getLegacyConfigFilePath() {
+  return path.join(os.homedir(), LEGACY_CONFIG_DIR_NAME, CONFIG_FILE_NAME);
+}
+function readConfig() {
+  const filePath = getConfigFilePath();
+  try {
+    if (fs.existsSync(filePath)) {
+      const content = fs.readFileSync(filePath, "utf-8");
+      return JSON.parse(content);
+    }
+    const legacyPath = getLegacyConfigFilePath();
+    if (fs.existsSync(legacyPath)) {
+      const content = fs.readFileSync(legacyPath, "utf-8");
+      return JSON.parse(content);
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+function writeConfig(newConfig) {
+  const dirPath = getConfigDirPath();
+  const filePath = getConfigFilePath();
+  if (!fs.existsSync(dirPath)) {
+    fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
+  }
+  const existing = readConfig();
+  const merged = {
+    ...existing,
+    ...newConfig
+  };
+  fs.writeFileSync(filePath, JSON.stringify(merged, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function maskUrl(rawUrl) {
+  if (!rawUrl) return "";
+  try {
+    const url = new URL(rawUrl);
+    if (url.password) {
+      url.password = "***";
+    }
+    if (url.username && url.username.length > 2) {
+      url.username = url.username[0] + "***";
+    }
+    return url.toString();
+  } catch {
+    return rawUrl.replace(/(:\/\/)([^:@\s]+):([^@\s]+)@/g, "$1$2:***@");
+  }
+}
+function maskApiKey(rawKey) {
+  if (!rawKey) return "";
+  const trimmed = rawKey.trim();
+  if (trimmed.length <= 8) {
+    return "***";
+  }
+  return `${trimmed.slice(0, 4)}...${trimmed.slice(-4)}`;
+}
+function getDefaultModelForProvider(provider) {
+  switch (provider) {
+    case "google":
+      return "gemini-2.5-flash";
+    case "openai":
+      return "gpt-4o";
+    case "anthropic":
+      return "claude-3-5-sonnet-latest";
+  }
+}
+function resolveCredentials(options) {
+  const config = readConfig();
+  let dbUrl = options.cliDbUrl;
+  let dbSource = "cli";
+  if (!dbUrl) {
+    const envUrl = process.env.DATABASE_URL || process.env.DB_URL;
+    if (envUrl) {
+      dbUrl = envUrl;
+      dbSource = "env";
+    } else if (config.dbUrl) {
+      dbUrl = config.dbUrl;
+      dbSource = "config";
+    } else {
+      dbSource = "none";
+    }
+  }
+  let provider = "google";
+  if (options.cliProvider) {
+    const p = options.cliProvider.toLowerCase();
+    if (p === "openai" || p === "anthropic" || p === "google") {
+      provider = p;
+    }
+  } else if (config.defaultProvider) {
+    provider = config.defaultProvider;
+  } else if (process.env.GEMINI_API_KEY) {
+    provider = "google";
+  } else if (process.env.OPENAI_API_KEY) {
+    provider = "openai";
+  } else if (process.env.ANTHROPIC_API_KEY) {
+    provider = "anthropic";
+  }
+  let apiKey = options.cliApiKey;
+  let keySource = "cli";
+  if (!apiKey) {
+    if (provider === "google") {
+      if (process.env.GEMINI_API_KEY) {
+        apiKey = process.env.GEMINI_API_KEY;
+        keySource = "env";
+      } else if (config.geminiApiKey) {
+        apiKey = config.geminiApiKey;
+        keySource = "config";
+      }
+    } else if (provider === "openai") {
+      if (process.env.OPENAI_API_KEY) {
+        apiKey = process.env.OPENAI_API_KEY;
+        keySource = "env";
+      } else if (config.openaiApiKey) {
+        apiKey = config.openaiApiKey;
+        keySource = "config";
+      }
+    } else if (provider === "anthropic") {
+      if (process.env.ANTHROPIC_API_KEY) {
+        apiKey = process.env.ANTHROPIC_API_KEY;
+        keySource = "env";
+      } else if (config.anthropicApiKey) {
+        apiKey = config.anthropicApiKey;
+        keySource = "config";
+      }
+    }
+    if (!apiKey) {
+      if (process.env.GEMINI_API_KEY || config.geminiApiKey) {
+        provider = "google";
+        apiKey = process.env.GEMINI_API_KEY || config.geminiApiKey;
+        keySource = process.env.GEMINI_API_KEY ? "env" : "config";
+      } else if (process.env.OPENAI_API_KEY || config.openaiApiKey) {
+        provider = "openai";
+        apiKey = process.env.OPENAI_API_KEY || config.openaiApiKey;
+        keySource = process.env.OPENAI_API_KEY ? "env" : "config";
+      } else if (process.env.ANTHROPIC_API_KEY || config.anthropicApiKey) {
+        provider = "anthropic";
+        apiKey = process.env.ANTHROPIC_API_KEY || config.anthropicApiKey;
+        keySource = process.env.ANTHROPIC_API_KEY ? "env" : "config";
+      } else {
+        keySource = "none";
+      }
+    }
+  }
+  const model = options.cliModel || config.defaultModel || getDefaultModelForProvider(provider);
+  return {
+    dbUrl,
+    apiKey,
+    provider,
+    model,
+    source: {
+      dbUrl: dbSource,
+      apiKey: keySource
+    }
+  };
+}
+
+// src/db/postgres.ts
+import pg from "pg";
+var { Pool } = pg;
+var PostgresAdapter = class {
+  type = "postgres";
+  pool = null;
+  connectionUrl;
+  cachedSchema = null;
+  databaseName = "postgres";
+  constructor(connectionUrl) {
+    this.connectionUrl = connectionUrl;
+    try {
+      const parsed = new URL(connectionUrl);
+      this.databaseName = parsed.pathname.replace(/^\//, "") || "postgres";
+    } catch {
+      this.databaseName = "postgres";
+    }
+  }
+  getMaskedUrl() {
+    return maskUrl(this.connectionUrl);
+  }
+  async connect() {
+    if (this.pool) return;
+    this.pool = new Pool({
+      connectionString: this.connectionUrl,
+      connectionTimeoutMillis: 1e4,
+      idleTimeoutMillis: 3e4
+    });
+    const client = await this.pool.connect();
+    try {
+      const res = await client.query("SELECT current_database() as db_name;");
+      if (res.rows[0]?.db_name) {
+        this.databaseName = res.rows[0].db_name;
+      }
+    } finally {
+      client.release();
+    }
+  }
+  async disconnect() {
+    if (this.pool) {
+      await this.pool.end();
+      this.pool = null;
+    }
+    this.cachedSchema = null;
+  }
+  isConnected() {
+    return this.pool !== null;
+  }
+  async inspectSchema(forceRefresh = false) {
+    if (this.cachedSchema && !forceRefresh) {
+      return this.cachedSchema;
+    }
+    if (!this.pool) {
+      await this.connect();
+    }
+    const client = await this.pool.connect();
+    try {
+      const tablesResult = await client.query(`
+        SELECT table_schema, table_name
+        FROM information_schema.tables
+        WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+          AND table_type = 'BASE TABLE'
+        ORDER BY table_schema, table_name;
+      `);
+      const columnsResult = await client.query(`
+        SELECT 
+          c.table_schema,
+          c.table_name,
+          c.column_name,
+          c.data_type,
+          c.is_nullable,
+          c.column_default,
+          CASE WHEN pk.column_name IS NOT NULL THEN true ELSE false END as is_primary_key
+        FROM information_schema.columns c
+        LEFT JOIN (
+          SELECT ku.table_schema, ku.table_name, ku.column_name
+          FROM information_schema.table_constraints tc
+          JOIN information_schema.key_column_usage ku
+            ON tc.constraint_name = ku.constraint_name
+            AND tc.table_schema = ku.table_schema
+          WHERE tc.constraint_type = 'PRIMARY KEY'
+        ) pk ON c.table_schema = pk.table_schema 
+             AND c.table_name = pk.table_name 
+             AND c.column_name = pk.column_name
+        WHERE c.table_schema NOT IN ('pg_catalog', 'information_schema')
+        ORDER BY c.table_schema, c.table_name, c.ordinal_position;
+      `);
+      const indexesResult = await client.query(`
+        SELECT
+          schemaname as table_schema,
+          tablename as table_name,
+          indexname,
+          indexdef
+        FROM pg_indexes
+        WHERE schemaname NOT IN ('pg_catalog', 'information_schema')
+        ORDER BY schemaname, tablename, indexname;
+      `);
+      const foreignKeysResult = await client.query(`
+        SELECT
+          tc.constraint_name,
+          tc.table_schema,
+          tc.table_name,
+          kcu.column_name,
+          ccu.table_name AS foreign_table_name,
+          ccu.column_name AS foreign_column_name
+        FROM information_schema.table_constraints AS tc
+        JOIN information_schema.key_column_usage AS kcu
+          ON tc.constraint_name = kcu.constraint_name
+          AND tc.table_schema = kcu.table_schema
+        JOIN information_schema.constraint_column_usage AS ccu
+          ON ccu.constraint_name = tc.constraint_name
+          AND ccu.table_schema = tc.table_schema
+        WHERE tc.constraint_type = 'FOREIGN KEY'
+          AND tc.table_schema NOT IN ('pg_catalog', 'information_schema');
+      `);
+      const rowCountsResult = await client.query(`
+        SELECT
+          nspname AS table_schema,
+          relname AS table_name,
+          reltuples::bigint AS approx_row_count
+        FROM pg_class C
+        LEFT JOIN pg_namespace N ON (N.oid = C.relnamespace)
+        WHERE nspname NOT IN ('pg_catalog', 'information_schema')
+          AND relkind = 'r';
+      `);
+      const rowCountsMap = /* @__PURE__ */ new Map();
+      for (const row of rowCountsResult.rows) {
+        rowCountsMap.set(`${row.table_schema}.${row.table_name}`, Math.max(0, Number(row.approx_row_count)));
+      }
+      const columnsMap = /* @__PURE__ */ new Map();
+      for (const row of columnsResult.rows) {
+        const key = `${row.table_schema}.${row.table_name}`;
+        const list = columnsMap.get(key) || [];
+        list.push({
+          name: row.column_name,
+          dataType: row.data_type,
+          isNullable: row.is_nullable === "YES",
+          defaultValue: row.column_default,
+          isPrimaryKey: Boolean(row.is_primary_key)
+        });
+        columnsMap.set(key, list);
+      }
+      const indexesMap = /* @__PURE__ */ new Map();
+      for (const row of indexesResult.rows) {
+        const key = `${row.table_schema}.${row.table_name}`;
+        const list = indexesMap.get(key) || [];
+        const isUnique = /create\s+unique\s+index/i.test(row.indexdef);
+        const isPrimary = /_pkey$/i.test(row.indexname) || /primary key/i.test(row.indexdef);
+        list.push({
+          name: row.indexname,
+          tableName: row.table_name,
+          columnNames: [],
+          // extracted from indexdef
+          isUnique,
+          isPrimary,
+          definition: row.indexdef
+        });
+        indexesMap.set(key, list);
+      }
+      const foreignKeysMap = /* @__PURE__ */ new Map();
+      for (const row of foreignKeysResult.rows) {
+        const key = `${row.table_schema}.${row.table_name}`;
+        const list = foreignKeysMap.get(key) || [];
+        list.push({
+          constraintName: row.constraint_name,
+          columnName: row.column_name,
+          foreignTableName: row.foreign_table_name,
+          foreignColumnName: row.foreign_column_name
+        });
+        foreignKeysMap.set(key, list);
+      }
+      const tables = tablesResult.rows.map((r) => {
+        const key = `${r.table_schema}.${r.table_name}`;
+        return {
+          name: r.table_name,
+          schema: r.table_schema,
+          columns: columnsMap.get(key) || [],
+          indexes: indexesMap.get(key) || [],
+          foreignKeys: foreignKeysMap.get(key) || [],
+          approximateRowCount: rowCountsMap.get(key) ?? 0
+        };
+      });
+      this.cachedSchema = {
+        type: "postgres",
+        databaseName: this.databaseName,
+        tables,
+        inspectedAt: /* @__PURE__ */ new Date()
+      };
+      return this.cachedSchema;
+    } finally {
+      client.release();
+    }
+  }
+  async executeQuery(query) {
+    if (!this.pool) {
+      await this.connect();
+    }
+    const sql = query.sql || query.rawDisplay;
+    const startTime = Date.now();
+    const client = await this.pool.connect();
+    try {
+      const res = await client.query(sql, query.params || []);
+      const durationMs = Date.now() - startTime;
+      let rows = [];
+      let fields = [];
+      let rowCount = 0;
+      if (Array.isArray(res)) {
+        const lastResult = res[res.length - 1];
+        rows = lastResult?.rows || [];
+        fields = (lastResult?.fields || []).map((f) => f.name);
+        rowCount = lastResult?.rowCount ?? rows.length;
+      } else if (res) {
+        rows = res.rows || [];
+        fields = (res.fields || []).map((f) => f.name);
+        rowCount = res.rowCount ?? rows.length;
+      }
+      return {
+        success: true,
+        rows,
+        fields,
+        rowCount,
+        affectedRows: rowCount,
+        durationMs,
+        command: Array.isArray(res) ? res[res.length - 1]?.command : res?.command
+      };
+    } catch (err) {
+      const durationMs = Date.now() - startTime;
+      return {
+        success: false,
+        durationMs,
+        error: err.message || String(err)
+      };
+    } finally {
+      client.release();
+    }
+  }
+  async dryRunCount(query) {
+    if (!this.pool) {
+      await this.connect();
+    }
+    const sql = (query.sql || query.rawDisplay).trim();
+    const deleteMatch = sql.match(/^DELETE\s+FROM\s+([^\s;()]+)(?:\s+WHERE\s+([\s\S]+?))?(?:;)?$/i);
+    if (deleteMatch) {
+      const table = deleteMatch[1];
+      const whereClause = deleteMatch[2];
+      const countSql = whereClause ? `SELECT COUNT(*) as count FROM ${table} WHERE ${whereClause}` : `SELECT COUNT(*) as count FROM ${table}`;
+      try {
+        const client = await this.pool.connect();
+        try {
+          const res = await client.query(countSql, query.params || []);
+          return Number(res.rows[0]?.count ?? 0);
+        } finally {
+          client.release();
+        }
+      } catch {
+        return null;
+      }
+    }
+    const updateMatch = sql.match(/^UPDATE\s+([^\s;()]+)\s+SET\s+[\s\S]+?(?:\s+WHERE\s+([\s\S]+?))?(?:;)?$/i);
+    if (updateMatch) {
+      const table = updateMatch[1];
+      const whereClause = updateMatch[2];
+      const countSql = whereClause ? `SELECT COUNT(*) as count FROM ${table} WHERE ${whereClause}` : `SELECT COUNT(*) as count FROM ${table}`;
+      try {
+        const client = await this.pool.connect();
+        try {
+          const res = await client.query(countSql);
+          return Number(res.rows[0]?.count ?? 0);
+        } finally {
+          client.release();
+        }
+      } catch {
+        return null;
+      }
+    }
+    const truncateOrDropMatch = sql.match(/^(?:TRUNCATE(?:\s+TABLE)?|DROP\s+TABLE(?:\s+IF\s+EXISTS)?)\s+([^\s;()]+)/i);
+    if (truncateOrDropMatch) {
+      const table = truncateOrDropMatch[1];
+      try {
+        const client = await this.pool.connect();
+        try {
+          const res = await client.query(`SELECT COUNT(*) as count FROM ${table}`);
+          return Number(res.rows[0]?.count ?? 0);
+        } finally {
+          client.release();
+        }
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+  async explainQuery(query) {
+    if (!this.pool) {
+      await this.connect();
+    }
+    const sql = (query.sql || query.rawDisplay).trim();
+    if (!/^(SELECT|UPDATE|DELETE|INSERT)/i.test(sql)) {
+      return "";
+    }
+    const client = await this.pool.connect();
+    try {
+      const res = await client.query(`EXPLAIN ${sql}`, query.params || []);
+      return res.rows.map((r) => Object.values(r)[0]).join("\n");
+    } catch (err) {
+      return `Explain failed: ${err.message}`;
+    } finally {
+      client.release();
+    }
+  }
+};
+
+// src/db/mongo.ts
+import { MongoClient } from "mongodb";
+var MongoAdapter = class {
+  type = "mongodb";
+  client = null;
+  db = null;
+  connectionUrl;
+  cachedSchema = null;
+  databaseName = "admin";
+  constructor(connectionUrl) {
+    this.connectionUrl = connectionUrl;
+    try {
+      const parsed = new URL(connectionUrl);
+      const dbName = parsed.pathname.replace(/^\//, "");
+      if (dbName) {
+        this.databaseName = dbName;
+      }
+    } catch {
+    }
+  }
+  getMaskedUrl() {
+    return maskUrl(this.connectionUrl);
+  }
+  async connect() {
+    if (this.client) return;
+    this.client = new MongoClient(this.connectionUrl, {
+      serverSelectionTimeoutMS: 1e4,
+      connectTimeoutMS: 1e4
+    });
+    await this.client.connect();
+    this.db = this.client.db(this.databaseName === "admin" ? void 0 : this.databaseName);
+    this.databaseName = this.db.databaseName;
+  }
+  async disconnect() {
+    if (this.client) {
+      await this.client.close();
+      this.client = null;
+      this.db = null;
+    }
+    this.cachedSchema = null;
+  }
+  isConnected() {
+    return this.client !== null && this.db !== null;
+  }
+  async inspectSchema(forceRefresh = false) {
+    if (this.cachedSchema && !forceRefresh) {
+      return this.cachedSchema;
+    }
+    if (!this.isConnected()) {
+      await this.connect();
+    }
+    const db = this.db;
+    const collectionsList = await db.listCollections().toArray();
+    const collectionSchemas = [];
+    for (const colInfo of collectionsList) {
+      const colName = colInfo.name;
+      if (colName.startsWith("system.")) continue;
+      const collection = db.collection(colName);
+      let documentCount = 0;
+      try {
+        documentCount = await collection.estimatedDocumentCount();
+      } catch {
+      }
+      const sampleDocs = await collection.find({}).limit(20).toArray();
+      const fieldMap = /* @__PURE__ */ new Map();
+      let sampleDoc = sampleDocs[0];
+      for (const doc of sampleDocs) {
+        this.extractFields(doc, "", fieldMap);
+      }
+      const fields = Array.from(fieldMap.entries()).map(([name, types]) => ({
+        name,
+        types: Array.from(types)
+      }));
+      let indexes = [];
+      try {
+        const rawIndexes = await collection.indexes();
+        indexes = rawIndexes.map((idx) => ({
+          name: idx.name || "unknown",
+          tableName: colName,
+          columnNames: Object.keys(idx.key || {}),
+          isUnique: Boolean(idx.unique),
+          isPrimary: idx.name === "_id_",
+          definition: JSON.stringify(idx.key)
+        }));
+      } catch {
+      }
+      collectionSchemas.push({
+        name: colName,
+        fields,
+        indexes,
+        documentCount,
+        sampleDocument: sampleDoc
+      });
+    }
+    this.cachedSchema = {
+      type: "mongodb",
+      databaseName: this.databaseName,
+      collections: collectionSchemas,
+      inspectedAt: /* @__PURE__ */ new Date()
+    };
+    return this.cachedSchema;
+  }
+  extractFields(obj, prefix, fieldMap) {
+    if (!obj || typeof obj !== "object" || Array.isArray(obj) || obj instanceof Date) {
+      return;
+    }
+    for (const [key, value] of Object.entries(obj)) {
+      const fullKey = prefix ? `${prefix}.${key}` : key;
+      let type = typeof value;
+      if (value === null) type = "null";
+      else if (Array.isArray(value)) type = "array";
+      else if (value instanceof Date) type = "date";
+      else if (value && typeof value === "object" && value._bsontype) type = value._bsontype;
+      if (!fieldMap.has(fullKey)) {
+        fieldMap.set(fullKey, /* @__PURE__ */ new Set());
+      }
+      fieldMap.get(fullKey).add(type);
+      if (value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date) && !value._bsontype) {
+        this.extractFields(value, fullKey, fieldMap);
+      }
+    }
+  }
+  async executeQuery(query) {
+    if (!this.isConnected()) {
+      await this.connect();
+    }
+    const startTime = Date.now();
+    const db = this.db;
+    try {
+      if (query.operation === "command" || query.rawCommand) {
+        const cmd = query.rawCommand || (typeof query.rawDisplay === "string" ? JSON.parse(query.rawDisplay) : query.rawDisplay);
+        const result = await db.command(cmd);
+        const durationMs2 = Date.now() - startTime;
+        return {
+          success: true,
+          durationMs: durationMs2,
+          rawOutput: result,
+          rowCount: 1,
+          rows: [result]
+        };
+      }
+      let collectionName = query.collection;
+      let operation = query.operation;
+      let filter = query.filter || {};
+      let update = query.update || {};
+      let pipeline = query.pipeline || [];
+      let document = query.document;
+      let documents = query.documents;
+      let options = query.options || {};
+      if (!collectionName || !operation) {
+        try {
+          const parsed = JSON.parse(query.rawDisplay);
+          collectionName = parsed.collection || collectionName;
+          operation = parsed.operation || operation;
+          filter = parsed.filter || filter;
+          update = parsed.update || update;
+          pipeline = parsed.pipeline || pipeline;
+          document = parsed.document || document;
+          documents = parsed.documents || documents;
+          options = parsed.options || options;
+        } catch {
+        }
+      }
+      if (!collectionName) {
+        throw new Error("Mongo operation requires a target collection.");
+      }
+      const collection = db.collection(collectionName);
+      let rows = [];
+      let rowCount = 0;
+      let affectedRows = 0;
+      switch (operation) {
+        case "find": {
+          const limit = options.limit || 100;
+          const cursor = collection.find(filter, options).limit(limit);
+          rows = await cursor.toArray();
+          rowCount = rows.length;
+          break;
+        }
+        case "aggregate": {
+          const cursor = collection.aggregate(pipeline, options);
+          rows = await cursor.toArray();
+          rowCount = rows.length;
+          break;
+        }
+        case "countDocuments": {
+          const count = await collection.countDocuments(filter, options);
+          rows = [{ count }];
+          rowCount = 1;
+          break;
+        }
+        case "insertOne": {
+          const res = await collection.insertOne(document || filter, options);
+          rows = [{ insertedId: res.insertedId, acknowledged: res.acknowledged }];
+          rowCount = 1;
+          affectedRows = 1;
+          break;
+        }
+        case "insertMany": {
+          const docs = documents || (Array.isArray(document) ? document : [document]);
+          const res = await collection.insertMany(docs, options);
+          rows = [{ insertedCount: res.insertedCount, acknowledged: res.acknowledged }];
+          rowCount = res.insertedCount;
+          affectedRows = res.insertedCount;
+          break;
+        }
+        case "updateOne": {
+          const res = await collection.updateOne(filter, update, options);
+          rows = [{ matchedCount: res.matchedCount, modifiedCount: res.modifiedCount, upsertedId: res.upsertedId }];
+          rowCount = res.modifiedCount;
+          affectedRows = res.modifiedCount;
+          break;
+        }
+        case "updateMany": {
+          const res = await collection.updateMany(filter, update, options);
+          rows = [{ matchedCount: res.matchedCount, modifiedCount: res.modifiedCount, upsertedId: res.upsertedId }];
+          rowCount = res.modifiedCount;
+          affectedRows = res.modifiedCount;
+          break;
+        }
+        case "deleteOne": {
+          const res = await collection.deleteOne(filter, options);
+          rows = [{ deletedCount: res.deletedCount }];
+          rowCount = res.deletedCount;
+          affectedRows = res.deletedCount;
+          break;
+        }
+        case "deleteMany": {
+          const res = await collection.deleteMany(filter, options);
+          rows = [{ deletedCount: res.deletedCount }];
+          rowCount = res.deletedCount;
+          affectedRows = res.deletedCount;
+          break;
+        }
+        case "drop": {
+          const res = await collection.drop();
+          rows = [{ dropped: res }];
+          rowCount = res ? 1 : 0;
+          break;
+        }
+        case "createIndex": {
+          const keys = options.keys || filter;
+          const indexOptions = options.indexOptions || {};
+          const indexName = await collection.createIndex(keys, indexOptions);
+          rows = [{ createdIndex: indexName }];
+          rowCount = 1;
+          break;
+        }
+        case "createCollection": {
+          await db.createCollection(collectionName, options);
+          rows = [{ createdCollection: collectionName }];
+          rowCount = 1;
+          break;
+        }
+        default:
+          throw new Error(`Unsupported MongoDB operation: ${operation}`);
+      }
+      const durationMs = Date.now() - startTime;
+      const fields = rows.length > 0 && typeof rows[0] === "object" ? Object.keys(rows[0]) : [];
+      return {
+        success: true,
+        rows,
+        rowCount,
+        affectedRows,
+        fields,
+        durationMs,
+        command: operation
+      };
+    } catch (err) {
+      const durationMs = Date.now() - startTime;
+      return {
+        success: false,
+        durationMs,
+        error: err.message || String(err)
+      };
+    }
+  }
+  async dryRunCount(query) {
+    if (!this.isConnected()) {
+      await this.connect();
+    }
+    try {
+      let collectionName = query.collection;
+      let operation = query.operation;
+      let filter = query.filter || {};
+      if (!collectionName || !operation) {
+        try {
+          const parsed = JSON.parse(query.rawDisplay);
+          collectionName = parsed.collection || collectionName;
+          operation = parsed.operation || operation;
+          filter = parsed.filter || filter;
+        } catch {
+        }
+      }
+      if (!collectionName) return null;
+      const collection = this.db.collection(collectionName);
+      if (operation === "deleteOne") {
+        const count = await collection.countDocuments(filter);
+        return Math.min(1, count);
+      }
+      if (operation === "deleteMany" || operation === "updateOne" || operation === "updateMany") {
+        return await collection.countDocuments(filter);
+      }
+      if (operation === "drop") {
+        return await collection.estimatedDocumentCount();
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async explainQuery(query) {
+    if (!this.isConnected()) {
+      await this.connect();
+    }
+    try {
+      let collectionName = query.collection;
+      let operation = query.operation || "find";
+      let filter = query.filter || {};
+      let pipeline = query.pipeline || [];
+      if (!collectionName) {
+        try {
+          const parsed = JSON.parse(query.rawDisplay);
+          collectionName = parsed.collection || collectionName;
+          operation = parsed.operation || operation;
+          filter = parsed.filter || filter;
+          pipeline = parsed.pipeline || pipeline;
+        } catch {
+          return "";
+        }
+      }
+      if (!collectionName) return "";
+      const collection = this.db.collection(collectionName);
+      if (operation === "find") {
+        const explanation = await collection.find(filter).explain("executionStats");
+        return JSON.stringify(explanation, null, 2);
+      }
+      if (operation === "aggregate") {
+        const explanation = await collection.aggregate(pipeline).explain("executionStats");
+        return JSON.stringify(explanation, null, 2);
+      }
+      return "";
+    } catch (err) {
+      return `Explain failed: ${err.message}`;
+    }
+  }
+};
+
+// src/db/connection.ts
+function detectDatabaseType(url) {
+  const trimmed = url.trim().toLowerCase();
+  if (trimmed.startsWith("postgres://") || trimmed.startsWith("postgresql://")) {
+    return "postgres";
+  }
+  if (trimmed.startsWith("mongodb://") || trimmed.startsWith("mongodb+srv://")) {
+    return "mongodb";
+  }
+  throw new Error(
+    `Unsupported database URL scheme. Expected postgres://, postgresql://, mongodb://, or mongodb+srv://. Received: ${url.slice(0, 15)}...`
+  );
+}
+function createDatabaseAdapter(url) {
+  const type = detectDatabaseType(url);
+  if (type === "postgres") {
+    return new PostgresAdapter(url);
+  }
+  if (type === "mongodb") {
+    return new MongoAdapter(url);
+  }
+  throw new Error(`Unknown database type: ${type}`);
+}
+
+// src/agent/llm.ts
+import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
+import { ChatOpenAI } from "@langchain/openai";
+import { ChatAnthropic } from "@langchain/anthropic";
+function createChatModel(options) {
+  const { provider, model, apiKey, temperature = 0 } = options;
+  switch (provider) {
+    case "google":
+      return new ChatGoogleGenerativeAI({
+        model,
+        apiKey,
+        temperature,
+        maxRetries: 2
+      });
+    case "openai":
+      return new ChatOpenAI({
+        modelName: model,
+        apiKey,
+        temperature,
+        maxRetries: 2
+      });
+    case "anthropic":
+      return new ChatAnthropic({
+        modelName: model,
+        anthropicApiKey: apiKey,
+        temperature,
+        maxRetries: 2
+      });
+    default:
+      throw new Error(`Unsupported LLM provider: ${provider}`);
+  }
+}
+
+// src/repl.ts
+import readline from "node:readline";
+import chalk2 from "chalk";
+import boxen2 from "boxen";
+import ora from "ora";
+import Table from "cli-table3";
+
+// src/agent/graph.ts
+import { Annotation, StateGraph, START, END, MemorySaver } from "@langchain/langgraph";
+import { HumanMessage as HumanMessage2, SystemMessage, AIMessage } from "@langchain/core/messages";
+
+// src/safety/classifier.ts
+var DEFAULT_DANGEROUS_UPDATE_THRESHOLD = 50;
+function classifyQuery(query, dbType, options = {}) {
+  const rowThreshold = options.rowThresholdForDangerousUpdate ?? DEFAULT_DANGEROUS_UPDATE_THRESHOLD;
+  const rawText = (query.sql || query.rawDisplay || "").trim();
+  if (dbType === "postgres") {
+    return classifyPostgresQuery(rawText, query, rowThreshold, options);
+  } else {
+    return classifyMongoQuery(rawText, query, rowThreshold, options);
+  }
+}
+function classifyPostgresQuery(sql, query, rowThreshold, options) {
+  const cleanSql = sql.replace(/\/\*[\s\S]*?\*\/|--.*$/gm, "").trim();
+  const upper = cleanSql.toUpperCase();
+  const warnings = [];
+  const isDropDb = /DROP\s+DATABASE/i.test(cleanSql);
+  const isDropSchemaCascade = /DROP\s+SCHEMA\s+[\s\S]*?CASCADE/i.test(cleanSql);
+  if (isDropDb || isDropSchemaCascade) {
+    return {
+      category: "full_wipe",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: true,
+      requiresLiteralWord: true,
+      literalWord: "DROP DATABASE",
+      hasWhereClause: false,
+      warnings: ["This operation permanently deletes an entire database or schema hierarchy."],
+      explanation: "Permanently deletes database or schema cascade."
+    };
+  }
+  const isCreateIndex = /CREATE\s+(UNIQUE\s+)?INDEX/i.test(cleanSql);
+  const isCreateTable = /CREATE\s+TABLE/i.test(cleanSql);
+  const isCreateSchema = /CREATE\s+SCHEMA/i.test(cleanSql);
+  const isAlterAdd = /ALTER\s+TABLE\s+([^\s;]+)\s+ADD\s+(COLUMN|CONSTRAINT)/i.test(cleanSql);
+  const isAlterOtherSafe = /ALTER\s+TABLE\s+([^\s;]+)\s+(ALTER\s+COLUMN|RENAME)/i.test(cleanSql);
+  if (isCreateIndex) {
+    const isConcurrently = /CREATE\s+(UNIQUE\s+)?INDEX\s+CONCURRENTLY/i.test(cleanSql);
+    let suggestion;
+    if (!isConcurrently) {
+      warnings.push(
+        "Index is not being created CONCURRENTLY. This will lock write operations on the table during index creation."
+      );
+      suggestion = cleanSql.replace(/CREATE\s+(UNIQUE\s+)?INDEX/i, (m) => `${m} CONCURRENTLY`);
+    }
+    const tableMatch = cleanSql.match(/ON\s+([^\s;(]+)/i);
+    const tableName = tableMatch ? tableMatch[1] : void 0;
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Creates an index on ${tableName || "table"}${isConcurrently ? " concurrently (non-blocking)" : " (may lock table during build)"}.`,
+      warnings,
+      suggestedAlternative: suggestion
+    };
+  }
+  if (isCreateTable) {
+    const match = cleanSql.match(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([^\s;(]+)/i);
+    const tableName = match ? match[1] : void 0;
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Creates a new table "${tableName || "unknown"}".`,
+      warnings
+    };
+  }
+  if (isCreateSchema) {
+    const match = cleanSql.match(/CREATE\s+SCHEMA\s+(?:IF\s+NOT\s+EXISTS\s+)?([^\s;(]+)/i);
+    const schemaName = match ? match[1] : void 0;
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: schemaName,
+      explanation: `Creates a new schema "${schemaName || "unknown"}".`,
+      warnings
+    };
+  }
+  if (isAlterAdd || isAlterOtherSafe) {
+    const match = cleanSql.match(/ALTER\s+TABLE\s+([^\s;(]+)/i);
+    const tableName = match ? match[1] : void 0;
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Alters table "${tableName || "unknown"}" to add or modify structural attributes.`,
+      warnings
+    };
+  }
+  const isAlterDrop = /ALTER\s+TABLE\s+([^\s;]+)\s+DROP\s+COLUMN/i.test(cleanSql);
+  if (isAlterDrop) {
+    const match = cleanSql.match(/ALTER\s+TABLE\s+([^\s;(]+)/i);
+    const tableName = match ? match[1] : void 0;
+    return {
+      category: "dangerous",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Removes a column from table "${tableName || "unknown"}", permanently discarding column data.`,
+      warnings: ["Removing a column is permanent and irreversible."]
+    };
+  }
+  const isDropTable = /DROP\s+TABLE/i.test(cleanSql);
+  const isTruncate = /TRUNCATE(\s+TABLE)?/i.test(cleanSql);
+  if (isDropTable || isTruncate) {
+    const match = cleanSql.match(/(?:DROP\s+TABLE|TRUNCATE(?:\s+TABLE)?)\s+(?:IF\s+EXISTS\s+)?([^\s;(]+)/i);
+    const tableName = match ? match[1] : void 0;
+    return {
+      category: "dangerous",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: true,
+      literalWord: isDropTable ? "DROP TABLE" : "TRUNCATE",
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Permanently removes all data from table "${tableName || "unknown"}".`,
+      warnings: ["All rows will be permanently deleted."]
+    };
+  }
+  const isDelete = /^DELETE\s+FROM/i.test(cleanSql);
+  if (isDelete) {
+    const match = cleanSql.match(/^DELETE\s+FROM\s+([^\s;(]+)(?:\s+WHERE\s+([\s\S]+))?/i);
+    const tableName = match ? match[1] : void 0;
+    const hasWhere = Boolean(match && match[2] && match[2].trim().length > 0);
+    if (!hasWhere) {
+      return {
+        category: "dangerous",
+        isDestructive: true,
+        isStructural: false,
+        isFullWipe: false,
+        requiresLiteralWord: true,
+        literalWord: "DELETE ALL",
+        hasWhereClause: false,
+        tableOrCollection: tableName,
+        explanation: `Deletes ALL rows from table "${tableName || "unknown"}" (no WHERE clause present).`,
+        warnings: ["No WHERE clause specified: EVERY row in the table will be deleted!"]
+      };
+    }
+    return {
+      category: "dangerous",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: true,
+      tableOrCollection: tableName,
+      explanation: `Deletes filtered rows from table "${tableName || "unknown"}".`,
+      warnings: ["Mutates existing database records."]
+    };
+  }
+  const isUpdate = /^UPDATE\s+/i.test(cleanSql);
+  if (isUpdate) {
+    const match = cleanSql.match(/^UPDATE\s+([^\s;(]+)\s+SET\s+[\s\S]+?(?:\s+WHERE\s+([\s\S]+))?$/i);
+    const tableName = match ? match[1] : void 0;
+    const hasWhere = Boolean(match && match[2] && match[2].trim().length > 0);
+    if (!hasWhere) {
+      return {
+        category: "dangerous",
+        isDestructive: true,
+        isStructural: false,
+        isFullWipe: false,
+        requiresLiteralWord: true,
+        literalWord: "UPDATE ALL",
+        hasWhereClause: false,
+        tableOrCollection: tableName,
+        explanation: `Updates ALL rows in table "${tableName || "unknown"}" (no WHERE clause present).`,
+        warnings: ["No WHERE clause specified: EVERY row in the table will be updated!"]
+      };
+    }
+    return {
+      category: "write",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: true,
+      tableOrCollection: tableName,
+      explanation: `Updates filtered rows in table "${tableName || "unknown"}".`,
+      warnings: ["Mutates existing database records."]
+    };
+  }
+  const isInsert = /^INSERT\s+INTO/i.test(cleanSql);
+  if (isInsert) {
+    const match = cleanSql.match(/^INSERT\s+INTO\s+([^\s;(]+)/i);
+    const tableName = match ? match[1] : void 0;
+    return {
+      category: "write",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: tableName,
+      explanation: `Inserts new records into table "${tableName || "unknown"}".`,
+      warnings: []
+    };
+  }
+  if (/^(SELECT|EXPLAIN|SHOW|WITH)\b/i.test(cleanSql)) {
+    return {
+      category: "read",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: /WHERE/i.test(cleanSql),
+      explanation: "Read-only query.",
+      warnings: []
+    };
+  }
+  return {
+    category: "write",
+    isDestructive: false,
+    isStructural: false,
+    isFullWipe: false,
+    requiresLiteralWord: false,
+    hasWhereClause: false,
+    explanation: "Database operation.",
+    warnings: ["Non-standard query statement."]
+  };
+}
+function classifyMongoQuery(rawText, query, rowThreshold, options) {
+  let collectionName = query.collection;
+  let operation = query.operation;
+  let filter = query.filter;
+  if (!collectionName || !operation) {
+    try {
+      const parsed = JSON.parse(rawText);
+      collectionName = parsed.collection || collectionName;
+      operation = parsed.operation || operation;
+      filter = parsed.filter || filter;
+    } catch {
+    }
+  }
+  const warnings = [];
+  if (operation === "command" && (query.rawCommand?.dropDatabase || rawText.includes("dropDatabase"))) {
+    return {
+      category: "full_wipe",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: true,
+      requiresLiteralWord: true,
+      literalWord: "DROP DATABASE",
+      hasWhereClause: false,
+      warnings: ["This operation permanently drops the entire MongoDB database."],
+      explanation: "Drops the entire database."
+    };
+  }
+  if (operation === "createIndex") {
+    const isBackground = query.options?.background === true;
+    let suggestion;
+    if (!isBackground) {
+      warnings.push("Index is not specified with background: true. It may block other operations during build.");
+    }
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: collectionName,
+      explanation: `Creates an index on collection "${collectionName || "collection"}".`,
+      warnings,
+      suggestedAlternative: suggestion
+    };
+  }
+  if (operation === "createCollection") {
+    return {
+      category: "structural",
+      isDestructive: false,
+      isStructural: true,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: collectionName,
+      explanation: `Creates collection "${collectionName}".`,
+      warnings
+    };
+  }
+  if (operation === "drop") {
+    return {
+      category: "dangerous",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: true,
+      literalWord: "DROP COLLECTION",
+      hasWhereClause: false,
+      tableOrCollection: collectionName,
+      explanation: `Drops collection "${collectionName}", permanently deleting all documents and indexes.`,
+      warnings: ["All documents in this collection will be removed."]
+    };
+  }
+  const hasFilter = filter && Object.keys(filter).length > 0;
+  if (operation === "deleteMany" || operation === "deleteOne") {
+    if (!hasFilter) {
+      return {
+        category: "dangerous",
+        isDestructive: true,
+        isStructural: false,
+        isFullWipe: false,
+        requiresLiteralWord: true,
+        literalWord: "DELETE ALL",
+        hasWhereClause: false,
+        tableOrCollection: collectionName,
+        explanation: `Deletes documents from "${collectionName}" with an empty filter (deletes all documents).`,
+        warnings: ["No filter specified: all documents matching the empty filter will be deleted!"]
+      };
+    }
+    return {
+      category: "dangerous",
+      isDestructive: true,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: true,
+      tableOrCollection: collectionName,
+      explanation: `Deletes filtered documents from collection "${collectionName}".`,
+      warnings: ["Mutates existing database documents."]
+    };
+  }
+  if (operation === "updateMany" || operation === "updateOne") {
+    if (!hasFilter) {
+      return {
+        category: "dangerous",
+        isDestructive: true,
+        isStructural: false,
+        isFullWipe: false,
+        requiresLiteralWord: true,
+        literalWord: "UPDATE ALL",
+        hasWhereClause: false,
+        tableOrCollection: collectionName,
+        explanation: `Updates documents in "${collectionName}" with an empty filter (updates all documents).`,
+        warnings: ["No filter specified: every document in the collection will be updated!"]
+      };
+    }
+    return {
+      category: "write",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: true,
+      tableOrCollection: collectionName,
+      explanation: `Updates documents in collection "${collectionName}".`,
+      warnings: ["Mutates existing database documents."]
+    };
+  }
+  if (operation === "insertOne" || operation === "insertMany") {
+    return {
+      category: "write",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: false,
+      tableOrCollection: collectionName,
+      explanation: `Inserts document(s) into collection "${collectionName}".`,
+      warnings: []
+    };
+  }
+  if (operation === "find" || operation === "aggregate" || operation === "countDocuments") {
+    return {
+      category: "read",
+      isDestructive: false,
+      isStructural: false,
+      isFullWipe: false,
+      requiresLiteralWord: false,
+      hasWhereClause: Boolean(hasFilter),
+      tableOrCollection: collectionName,
+      explanation: "Read-only operation.",
+      warnings: []
+    };
+  }
+  return {
+    category: "read",
+    isDestructive: false,
+    isStructural: false,
+    isFullWipe: false,
+    requiresLiteralWord: false,
+    hasWhereClause: false,
+    explanation: "Database operation.",
+    warnings: []
+  };
+}
+
+// src/safety/confirm.ts
+import chalk from "chalk";
+import boxen from "boxen";
+import { confirm, input } from "@inquirer/prompts";
+async function requestUserConfirmation(query, safety, affectedRows) {
+  const queryDisplay = (query.sql || query.rawDisplay || "").trim();
+  if (safety.isFullWipe) {
+    const boxContent = [
+      chalk.bold.red("\u{1F6A8} CRITICAL: FULL DATABASE / ALL TABLES WIPE ATTEMPTED \u{1F6A8}"),
+      "",
+      chalk.yellow(queryDisplay),
+      "",
+      ...safety.warnings.length ? [chalk.red(safety.warnings.join("\n")), ""] : [],
+      chalk.bold.white(`Type ${chalk.red.underline(safety.literalWord || "DROP DATABASE")} to proceed:`)
+    ].join("\n");
+    console.log(
+      boxen(boxContent, {
+        padding: 1,
+        borderColor: "red",
+        borderStyle: "double",
+        margin: { top: 1, bottom: 1 }
+      })
+    );
+    const typed = await input({
+      message: chalk.red.bold(`Type "${safety.literalWord || "DROP DATABASE"}" to confirm full wipe:`)
+    });
+    if (typed.trim() === safety.literalWord) {
+      return { confirmed: true };
+    }
+    return {
+      confirmed: false,
+      reason: `Confirmation word mismatch (expected "${safety.literalWord}"). Operation aborted.`
+    };
+  }
+  if (safety.category === "dangerous") {
+    const lines2 = [
+      chalk.bold.hex("#FFA500")("\u26A0\uFE0F  DANGEROUS OPERATION"),
+      "",
+      chalk.white(queryDisplay),
+      ""
+    ];
+    if (affectedRows !== null) {
+      lines2.push(
+        chalk.bold.yellow(`Affected rows: ${affectedRows.toLocaleString()}`),
+        ""
+      );
+    }
+    if (safety.warnings.length > 0) {
+      for (const w of safety.warnings) {
+        lines2.push(chalk.red(`\u2022 ${w}`));
+      }
+      lines2.push("");
+    }
+    console.log(
+      boxen(lines2.join("\n"), {
+        padding: 1,
+        borderColor: "yellow",
+        borderStyle: "round",
+        margin: { top: 1, bottom: 1 }
+      })
+    );
+    if (safety.requiresLiteralWord && safety.literalWord) {
+      const typed = await input({
+        message: chalk.hex("#FFA500").bold(
+          `Destructive operation with no filter. Type "${safety.literalWord}" to confirm:`
+        )
+      });
+      if (typed.trim() === safety.literalWord) {
+        return { confirmed: true };
+      }
+      return {
+        confirmed: false,
+        reason: `Confirmation word mismatch (expected "${safety.literalWord}"). Operation cancelled.`
+      };
+    }
+    const answer2 = await confirm({
+      message: chalk.hex("#FFA500").bold("Proceed with dangerous operation?"),
+      default: false
+    });
+    return { confirmed: answer2 };
+  }
+  if (safety.isStructural) {
+    const lines2 = [
+      chalk.bold.cyan("\u{1F6E0}\uFE0F  STRUCTURAL DDL OPERATION"),
+      "",
+      chalk.white(queryDisplay),
+      "",
+      chalk.cyan(`Effect: ${safety.explanation || "Modifies database structure."}`)
+    ];
+    if (safety.suggestedAlternative) {
+      lines2.push(
+        "",
+        chalk.yellow("\u{1F4A1} Recommendation:"),
+        chalk.gray(safety.suggestedAlternative)
+      );
+    }
+    if (safety.warnings.length > 0) {
+      lines2.push("");
+      for (const w of safety.warnings) {
+        lines2.push(chalk.yellow(`\u2022 ${w}`));
+      }
+    }
+    console.log(
+      boxen(lines2.join("\n"), {
+        padding: 1,
+        borderColor: "cyan",
+        borderStyle: "round",
+        margin: { top: 1, bottom: 1 }
+      })
+    );
+    const answer2 = await confirm({
+      message: chalk.cyan.bold("Apply this structural change?"),
+      default: true
+    });
+    return { confirmed: answer2 };
+  }
+  if (safety.category === "write") {
+    const lines2 = [
+      chalk.bold.magenta("\u270F\uFE0F  DATABASE WRITE OPERATION"),
+      "",
+      chalk.white(queryDisplay)
+    ];
+    if (affectedRows !== null) {
+      lines2.push("", chalk.magenta(`Estimated affected rows: ${affectedRows.toLocaleString()}`));
+    }
+    console.log(
+      boxen(lines2.join("\n"), {
+        padding: 1,
+        borderColor: "magenta",
+        borderStyle: "round",
+        margin: { top: 1, bottom: 1 }
+      })
+    );
+    const answer2 = await confirm({
+      message: chalk.magenta.bold("Execute write query?"),
+      default: false
+    });
+    return { confirmed: answer2 };
+  }
+  const lines = [
+    chalk.bold.green("\u{1F50D} READ QUERY"),
+    "",
+    chalk.white(queryDisplay)
+  ];
+  console.log(
+    boxen(lines.join("\n"), {
+      padding: 1,
+      borderColor: "green",
+      borderStyle: "round",
+      margin: { top: 1, bottom: 1 }
+    })
+  );
+  const answer = await confirm({
+    message: chalk.green.bold("Execute read query?"),
+    default: true
+  });
+  return { confirmed: answer };
+}
+
+// src/agent/guardrails.ts
+import { HumanMessage } from "@langchain/core/messages";
+
+// src/agent/prompts.ts
+var REFUSAL_MESSAGE = "I'm scoped to database operations on your connected DB only (schema inspection, queries, CRUD, analysis). I can't help with that here.";
+function getSystemPrompt(dbType, schemaSummary) {
+  return `You are "SANDAL" (Safe Agentic Natural-language Database Access Layer), an expert, production-grade agentic database assistant.
+You are connected directly to a live ${dbType === "postgres" ? "PostgreSQL" : "MongoDB"} database.
+
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+STRICT SCOPE & SAFETY RULES
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+1. You are strictly scoped to database operations on the connected database:
+   - Schema inspection and navigation
+   - Data analysis, querying, filtering, sorting, aggregations, and statistics
+   - CRUD operations (SELECT/find, INSERT/insertOne, UPDATE/updateOne, DELETE/deleteOne)
+   - Structural DDL operations (CREATE TABLE, CREATE INDEX, ALTER TABLE ADD COLUMN, createCollection, createIndex)
+2. REFUSE ANY OUT-OF-SCOPE REQUEST:
+   - If the user asks for general programming (e.g. "write a Python script", "build a web scraper"), general Q&A, creative writing, math tutoring, or any non-database task, politely refuse immediately with:
+     "${REFUSAL_MESSAGE}"
+3. NEVER generate or suggest shell/bash commands or OS actions.
+4. NEVER expose raw credentials, passwords, or API keys in your responses.
+5. NEVER hallucinate data. Ground your answers ONLY in the actual query results returned from the database.
+
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+QUERY GENERATION RULES
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+${dbType === "postgres" ? `\u2022 Target Dialect: PostgreSQL.
+\u2022 Produce valid SQL. For queries with variables, prefer parameterized queries or clean literals when executing directly.
+\u2022 For UPDATE or DELETE queries, ALWAYS include a specific, narrow WHERE clause unless the user explicitly requested modifying all rows.
+\u2022 For index creation, prefer "CREATE INDEX CONCURRENTLY" to avoid write-locking tables.
+\u2022 Return your query formatted in a json object:
+  {
+    "type": "postgres",
+    "sql": "<the SQL statement>",
+    "params": [],
+    "targetTables": ["table1"],
+    "explanation": "<brief summary of what the query does>"
+  }` : `\u2022 Target Dialect: MongoDB.
+\u2022 Produce valid MongoDB operations in structured JSON format:
+  {
+    "type": "mongodb",
+    "collection": "<collection_name>",
+    "operation": "find" | "aggregate" | "countDocuments" | "insertOne" | "insertMany" | "updateOne" | "updateMany" | "deleteOne" | "deleteMany" | "createIndex" | "createCollection",
+    "filter": {},
+    "update": {},
+    "pipeline": [],
+    "document": {},
+    "options": {},
+    "explanation": "<brief summary of what the operation does>"
+  }
+\u2022 For UPDATE or DELETE operations, ALWAYS include a specific filter unless the user explicitly requested modifying all documents.
+\u2022 For createIndex, prefer options like {"background": true}.`}
+
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+CURRENT DATABASE SCHEMA CONTEXT
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+${schemaSummary}
+`;
+}
+function formatSchemaForPrompt(schema) {
+  if (schema.type === "postgres") {
+    if (!schema.tables || schema.tables.length === 0) {
+      return "No tables found in database.";
+    }
+    const lines = [`Database: ${schema.databaseName}`, "Tables:"];
+    for (const t of schema.tables) {
+      const colDefs = t.columns.map((c) => `${c.name} (${c.dataType}${c.isPrimaryKey ? ", PK" : ""}${c.isNullable ? "" : ", NOT NULL"})`).join(", ");
+      const idxDefs = t.indexes.map((i) => i.name).join(", ");
+      const fkDefs = t.foreignKeys.map((f) => `${f.columnName}->${f.foreignTableName}.${f.foreignColumnName}`).join(", ");
+      lines.push(`- Table: ${t.schema}.${t.name} (~${t.approximateRowCount ?? 0} rows)`);
+      lines.push(`  Columns: ${colDefs}`);
+      if (idxDefs) lines.push(`  Indexes: ${idxDefs}`);
+      if (fkDefs) lines.push(`  Foreign Keys: ${fkDefs}`);
+    }
+    return lines.join("\n");
+  } else {
+    if (!schema.collections || schema.collections.length === 0) {
+      return "No collections found in database.";
+    }
+    const lines = [`Database: ${schema.databaseName}`, "Collections:"];
+    for (const c of schema.collections) {
+      const fieldList = c.fields.map((f) => `${f.name} [${f.types.join("|")}]`).join(", ");
+      lines.push(`- Collection: ${c.name} (~${c.documentCount ?? 0} documents)`);
+      if (fieldList) lines.push(`  Fields: ${fieldList}`);
+      if (c.indexes.length) {
+        lines.push(`  Indexes: ${c.indexes.map((i) => i.name).join(", ")}`);
+      }
+    }
+    return lines.join("\n");
+  }
+}
+var INTENT_CLASSIFICATION_PROMPT = `You are a strict security and intent classifier for a dedicated DATABASE OPERATIONS assistant.
+Determine whether the following user message is a "database_task" or "out_of_scope".
+
+Definitions:
+- "database_task": The user asks about database schema, tables, collections, fields, running queries, counting rows, inserting/updating/deleting data, creating tables or indexes, filtering, grouping, aggregating, or analyzing database records, or conversational follow-ups directly relating to the database session.
+- "out_of_scope": The user asks for general coding help (e.g., "write a python script to scrape a website", "create a React app", "write a bash script"), general programming questions, creative writing, math tutoring, conversational chat unrelated to the DB, weather, philosophy, history, or anything not acting on the connected database.
+
+Respond with EXACTLY ONE JSON OBJECT and nothing else:
+{"classification": "database_task"}
+OR
+{"classification": "out_of_scope", "reason": "<brief explanation>"}
+
+User message:
+`;
+
+// src/agent/guardrails.ts
+var OBVIOUS_OUT_OF_SCOPE_PATTERNS = [
+  /write\s+(?:me\s+)?(?:a\s+)?python\s+script/i,
+  /scrape\s+(?:a\s+)?website/i,
+  /write\s+(?:me\s+)?(?:a\s+)?(?:bash|shell|sh|powershell)\s+script/i,
+  /create\s+(?:a\s+)?(?:react|vue|angular|flask|django|express)\s+app/i,
+  /write\s+(?:me\s+)?(?:a\s+)?(?:poem|essay|story|song|joke)/i,
+  /who\s+(?:was|is)\s+/i,
+  /what\s+is\s+the\s+capital\s+of/i,
+  /how\s+to\s+cook/i,
+  /solve\s+(?:this\s+)?(?:math|equation|integral)/i,
+  /help\s+me\s+with\s+(?:my\s+)?homework/i,
+  /acting\s+as\s+a\s+general\s+chatbot/i
+];
+var OBVIOUS_DATABASE_PATTERNS = [
+  /^(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|EXPLAIN|SHOW|DESCRIBE|WITH)\b/i,
+  /\b(?:table|tables|collection|collections|schema|column|columns|index|indexes|foreign key|primary key)\b/i,
+  /\b(?:find|aggregate|count|where|group by|order by|having|limit|join|left join|inner join)\b/i,
+  /\b(?:how many (?:users|rows|records|orders|items|products|documents))\b/i,
+  /\b(?:database|postgres|mongodb|mongo|pg_)\b/i
+];
+async function classifyIntent(input3, model) {
+  const trimmed = input3.trim();
+  for (const pattern of OBVIOUS_OUT_OF_SCOPE_PATTERNS) {
+    if (pattern.test(trimmed)) {
+      return {
+        isDatabaseTask: false,
+        reason: "Matched out-of-scope pattern"
+      };
+    }
+  }
+  for (const pattern of OBVIOUS_DATABASE_PATTERNS) {
+    if (pattern.test(trimmed)) {
+      return {
+        isDatabaseTask: true
+      };
+    }
+  }
+  if (/^(?:tables|collections|schema|indexes|views|stats|count|info)$/i.test(trimmed)) {
+    return { isDatabaseTask: true };
+  }
+  if (!model) {
+    return { isDatabaseTask: true };
+  }
+  try {
+    const response = await model.invoke([
+      new HumanMessage(INTENT_CLASSIFICATION_PROMPT + "\n" + trimmed)
+    ]);
+    const content = typeof response.content === "string" ? response.content : JSON.stringify(response.content);
+    const jsonMatch = content.match(/\{[\s\S]*?\}/);
+    if (jsonMatch) {
+      const parsed = JSON.parse(jsonMatch[0]);
+      if (parsed.classification === "out_of_scope") {
+        return {
+          isDatabaseTask: false,
+          reason: parsed.reason || "Classified as out of scope by intent guardrail"
+        };
+      }
+      return { isDatabaseTask: true };
+    }
+    return { isDatabaseTask: true };
+  } catch (err) {
+    return { isDatabaseTask: true };
+  }
+}
+function checkStrictWipe(classification, options = {}) {
+  const strictMode = options.strictMode !== false;
+  const allowFullWipe = options.allowFullWipe === true;
+  if (classification.isFullWipe && strictMode && !allowFullWipe) {
+    return {
+      blocked: true,
+      message: "Operation blocked by --strict mode: full database or all-table drop is prohibited. To allow this, start sandal-db with --allow-full-wipe."
+    };
+  }
+  return { blocked: false };
+}
+
+// src/agent/graph.ts
+var AgentStateAnnotation = Annotation.Root({
+  userInput: Annotation({
+    reducer: (_, update) => update,
+    default: () => ""
+  }),
+  schema: Annotation({
+    reducer: (curr, update) => update ?? curr,
+    default: () => void 0
+  }),
+  schemaSummary: Annotation({
+    reducer: (curr, update) => update ?? curr ?? "",
+    default: () => ""
+  }),
+  targetEntities: Annotation({
+    reducer: (_, update) => update ?? [],
+    default: () => []
+  }),
+  generatedQuery: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  safety: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  affectedRowCount: Annotation({
+    reducer: (_, update) => update,
+    default: () => null
+  }),
+  confirmed: Annotation({
+    reducer: (_, update) => update ?? false,
+    default: () => false
+  }),
+  cancelReason: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  queryResult: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  analysis: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  stats: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  conclusion: Annotation({
+    reducer: (_, update) => update,
+    default: () => void 0
+  }),
+  requiresSchemaRefresh: Annotation({
+    reducer: (_, update) => update ?? false,
+    default: () => false
+  }),
+  messages: Annotation({
+    reducer: (curr, update) => curr.concat(update ?? []),
+    default: () => []
+  })
+});
+function createDatabaseAgent(config) {
+  const { adapter, model, classifierOptions = {} } = config;
+  async function inspectSchemaNode(state) {
+    let schema = state.schema;
+    const forceRefresh = state.requiresSchemaRefresh || !schema;
+    if (forceRefresh) {
+      schema = await adapter.inspectSchema(true);
+    }
+    const summary = schema ? formatSchemaForPrompt(schema) : "";
+    return {
+      schema,
+      schemaSummary: summary,
+      requiresSchemaRefresh: false
+    };
+  }
+  async function identifyTargetsNode(state) {
+    const prompt = `Based on this user request: "${state.userInput}"
+And the available database schema:
+${state.schemaSummary}
+
+List the relevant table names (PostgreSQL) or collection names (MongoDB) needed to fulfill the request.
+Respond with a JSON array of string names only, e.g. ["users", "orders"]. Do not include markdown codeblocks or extra text.`;
+    try {
+      const response = await model.invoke([new HumanMessage2(prompt)]);
+      const content = typeof response.content === "string" ? response.content.trim() : "";
+      const match = content.match(/\[[\s\S]*?\]/);
+      const targets = match ? JSON.parse(match[0]) : [];
+      return { targetEntities: Array.isArray(targets) ? targets : [] };
+    } catch {
+      return { targetEntities: [] };
+    }
+  }
+  async function generateQueryNode(state) {
+    const systemPrompt = getSystemPrompt(adapter.type, state.schemaSummary);
+    const historyMessages = state.messages.slice(-6);
+    const userPrompt = `User request: "${state.userInput}"
+Target entities: ${JSON.stringify(state.targetEntities)}
+
+Generate the appropriate database query to execute.
+Ensure you return valid JSON formatted as specified in the system prompt.
+Do not wrap with markdown or code fences.`;
+    const response = await model.invoke([
+      new SystemMessage(systemPrompt),
+      ...historyMessages,
+      new HumanMessage2(userPrompt)
+    ]);
+    const content = typeof response.content === "string" ? response.content.trim() : "";
+    let parsed = null;
+    try {
+      const jsonMatch = content.match(/\{[\s\S]*\}/);
+      if (jsonMatch) {
+        parsed = JSON.parse(jsonMatch[0]);
+      }
+    } catch {
+    }
+    let query;
+    if (adapter.type === "postgres") {
+      const sql = parsed?.sql || content.replace(/```(?:sql|json)?/g, "").trim();
+      query = {
+        sql,
+        params: parsed?.params || [],
+        rawDisplay: sql
+      };
+    } else {
+      if (parsed && parsed.collection && parsed.operation) {
+        query = {
+          collection: parsed.collection,
+          operation: parsed.operation,
+          filter: parsed.filter,
+          update: parsed.update,
+          pipeline: parsed.pipeline,
+          document: parsed.document,
+          documents: parsed.documents,
+          options: parsed.options,
+          rawDisplay: JSON.stringify(parsed, null, 2)
+        };
+      } else {
+        query = {
+          rawDisplay: content
+        };
+      }
+    }
+    return { generatedQuery: query };
+  }
+  async function classifySafetyNode(state) {
+    if (!state.generatedQuery) {
+      return {
+        confirmed: false,
+        cancelReason: "No query was generated."
+      };
+    }
+    const safety = classifyQuery(state.generatedQuery, adapter.type, classifierOptions);
+    const strictCheck = checkStrictWipe(safety, classifierOptions);
+    if (strictCheck.blocked) {
+      return {
+        safety,
+        confirmed: false,
+        cancelReason: strictCheck.message
+      };
+    }
+    let affectedRows = null;
+    if (safety.isDestructive || safety.category === "write" || safety.category === "dangerous") {
+      try {
+        affectedRows = await adapter.dryRunCount(state.generatedQuery);
+      } catch {
+        affectedRows = null;
+      }
+    }
+    return {
+      safety,
+      affectedRowCount: affectedRows
+    };
+  }
+  async function requestConfirmationNode(state) {
+    if (state.cancelReason) {
+      return { confirmed: false };
+    }
+    if (!state.generatedQuery || !state.safety) {
+      return { confirmed: false, cancelReason: "Missing query or safety classification." };
+    }
+    const result = await requestUserConfirmation(
+      state.generatedQuery,
+      state.safety,
+      state.affectedRowCount ?? null
+    );
+    return {
+      confirmed: result.confirmed,
+      cancelReason: result.reason || (result.confirmed ? void 0 : "Execution cancelled by user.")
+    };
+  }
+  async function executeQueryNode(state) {
+    if (!state.confirmed || !state.generatedQuery) {
+      return {};
+    }
+    const result = await adapter.executeQuery(state.generatedQuery);
+    const isStructuralSuccess = Boolean(state.safety?.isStructural && result.success);
+    return {
+      queryResult: result,
+      requiresSchemaRefresh: isStructuralSuccess
+    };
+  }
+  async function analyzeResultsNode(state) {
+    const res = state.queryResult;
+    if (!res || !res.success || !res.rows || res.rows.length === 0) {
+      return { stats: null };
+    }
+    const firstRow = res.rows[0];
+    if (typeof firstRow !== "object" || firstRow === null) {
+      return { stats: null };
+    }
+    const numericFields = Object.keys(firstRow).filter((k) => {
+      const val = firstRow[k];
+      return typeof val === "number" || !isNaN(Number(val)) && typeof val === "string" && val.trim() !== "";
+    });
+    const stats = {
+      totalRows: res.rowCount ?? res.rows.length,
+      columns: {}
+    };
+    for (const field of numericFields) {
+      const nums = res.rows.map((r) => Number(r[field])).filter((n) => !isNaN(n));
+      if (nums.length > 0) {
+        const sum = nums.reduce((a, b) => a + b, 0);
+        const avg = sum / nums.length;
+        const min = Math.min(...nums);
+        const max = Math.max(...nums);
+        stats.columns[field] = {
+          count: nums.length,
+          sum,
+          average: Math.round(avg * 100) / 100,
+          min,
+          max
+        };
+      }
+    }
+    return { stats };
+  }
+  async function produceConclusionNode(state) {
+    if (!state.confirmed || state.cancelReason) {
+      const conclusion = state.cancelReason || "Operation was not executed.";
+      return {
+        conclusion,
+        messages: [new HumanMessage2(state.userInput), new AIMessage(conclusion)]
+      };
+    }
+    const res = state.queryResult;
+    if (!res) {
+      const conclusion = "No query was executed.";
+      return {
+        conclusion,
+        messages: [new HumanMessage2(state.userInput), new AIMessage(conclusion)]
+      };
+    }
+    if (!res.success) {
+      const conclusion = `Query failed with error: ${res.error} (took ${res.durationMs}ms)`;
+      return {
+        conclusion,
+        messages: [new HumanMessage2(state.userInput), new AIMessage(conclusion)]
+      };
+    }
+    const prompt = `User request: "${state.userInput}"
+Executed Query:
+${state.generatedQuery?.sql || state.generatedQuery?.rawDisplay}
+
+Query Results Summary:
+- Success: ${res.success}
+- Rows returned: ${res.rowCount ?? 0}
+- Affected rows: ${res.affectedRows ?? 0}
+- Execution time: ${res.durationMs}ms
+- Sample data: ${JSON.stringify((res.rows || []).slice(0, 10), null, 2)}
+- Computed statistics: ${state.stats ? JSON.stringify(state.stats, null, 2) : "None"}
+
+Provide a clear, concise, and direct natural-language response answering the user's request.
+Ground your response strictly in the query results above. Never hallucinate rows or numbers.`;
+    try {
+      const response = await model.invoke([new HumanMessage2(prompt)]);
+      const conclusion = typeof response.content === "string" ? response.content : JSON.stringify(response.content);
+      return {
+        conclusion,
+        messages: [new HumanMessage2(state.userInput), new AIMessage(conclusion)]
+      };
+    } catch (err) {
+      const conclusion = `Query executed successfully (${res.rowCount ?? 0} rows, ${res.durationMs}ms).`;
+      return {
+        conclusion,
+        messages: [new HumanMessage2(state.userInput), new AIMessage(conclusion)]
+      };
+    }
+  }
+  const workflow = new StateGraph(AgentStateAnnotation).addNode("inspect_schema", inspectSchemaNode).addNode("identify_targets", identifyTargetsNode).addNode("generate_query", generateQueryNode).addNode("classify_safety", classifySafetyNode).addNode("request_confirmation", requestConfirmationNode).addNode("execute_query", executeQueryNode).addNode("analyze_results", analyzeResultsNode).addNode("produce_conclusion", produceConclusionNode).addEdge(START, "inspect_schema").addEdge("inspect_schema", "identify_targets").addEdge("identify_targets", "generate_query").addEdge("generate_query", "classify_safety").addEdge("classify_safety", "request_confirmation").addConditionalEdges("request_confirmation", (state) => {
+    if (state.confirmed && !state.cancelReason) {
+      return "execute_query";
+    }
+    return "produce_conclusion";
+  }).addEdge("execute_query", "analyze_results").addEdge("analyze_results", "produce_conclusion").addEdge("produce_conclusion", END);
+  const checkpointer = new MemorySaver();
+  const app = workflow.compile({ checkpointer });
+  return app;
+}
+
+// src/repl.ts
+var ReplSession = class {
+  adapter;
+  model;
+  provider;
+  modelName;
+  strictMode;
+  allowFullWipe;
+  rowThreshold;
+  isRunning = true;
+  sessionId = `session-${Date.now()}`;
+  agent;
+  constructor(options) {
+    this.adapter = options.adapter;
+    this.model = options.model;
+    this.provider = options.provider;
+    this.modelName = options.modelName;
+    this.strictMode = options.strictMode;
+    this.allowFullWipe = options.allowFullWipe;
+    this.rowThreshold = options.rowThreshold ?? 50;
+    const classifierOptions = {
+      strictMode: this.strictMode,
+      allowFullWipe: this.allowFullWipe,
+      rowThresholdForDangerousUpdate: this.rowThreshold
+    };
+    this.agent = createDatabaseAgent({
+      adapter: this.adapter,
+      model: this.model,
+      classifierOptions
+    });
+  }
+  async start() {
+    this.setupSignalHandlers();
+    this.printWelcomeBanner();
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true
+    });
+    const promptText = chalk2.cyan(`sandal [${this.adapter.type}]> `);
+    const askQuestion = (query) => {
+      return new Promise((resolve) => rl.question(query, resolve));
+    };
+    while (this.isRunning) {
+      const input3 = await askQuestion(promptText);
+      const trimmed = input3.trim();
+      if (!trimmed) continue;
+      if (["exit", "quit", ".exit", ".quit"].includes(trimmed.toLowerCase())) {
+        break;
+      }
+      if (trimmed === ".clear") {
+        console.clear();
+        continue;
+      }
+      if (trimmed === ".help") {
+        this.printHelp();
+        continue;
+      }
+      if (trimmed === ".tables" || trimmed === ".collections") {
+        await this.handleListEntities();
+        continue;
+      }
+      if (trimmed.startsWith(".schema")) {
+        const entityName = trimmed.replace(/^\.schema\s*/, "").trim();
+        await this.handleShowSchema(entityName);
+        continue;
+      }
+      if (trimmed === ".refresh") {
+        const spinner = ora(chalk2.blue("Refreshing schema cache...")).start();
+        try {
+          await this.adapter.inspectSchema(true);
+          spinner.succeed(chalk2.green("Schema refreshed successfully."));
+        } catch (err) {
+          spinner.fail(chalk2.red(`Failed to refresh schema: ${err.message}`));
+        }
+        continue;
+      }
+      const intentSpinner = ora(chalk2.blue("Analyzing intent...")).start();
+      const intent = await classifyIntent(trimmed, this.model);
+      intentSpinner.stop();
+      if (!intent.isDatabaseTask) {
+        console.log(
+          boxen2(
+            `${chalk2.bold.red("\u{1F6E1}\uFE0F GUARDRAIL ENFORCEMENT")}
+
+${chalk2.yellow(REFUSAL_MESSAGE)}
+
+${chalk2.gray(
+              `Reason: ${intent.reason || "Non-database request rejected"}`
+            )}`,
+            {
+              padding: 1,
+              borderColor: "red",
+              borderStyle: "round",
+              margin: { top: 1, bottom: 1 }
+            }
+          )
+        );
+        continue;
+      }
+      const agentSpinner = ora(chalk2.cyan("Agent planning query...")).start();
+      try {
+        const result = await this.agent.invoke(
+          {
+            userInput: trimmed
+          },
+          {
+            configurable: {
+              thread_id: this.sessionId
+            }
+          }
+        );
+        agentSpinner.stop();
+        if (result.queryResult && result.queryResult.success && result.queryResult.rows) {
+          this.renderRowsTable(result.queryResult);
+        }
+        if (result.conclusion) {
+          console.log("\n" + chalk2.green("\u{1F916} Answer:"));
+          console.log(chalk2.white(result.conclusion) + "\n");
+        }
+      } catch (err) {
+        agentSpinner.fail(chalk2.red(`Execution failed: ${err.message}`));
+      }
+    }
+    rl.close();
+    await this.shutdown();
+  }
+  renderRowsTable(queryResult) {
+    const rows = queryResult.rows;
+    if (!rows || rows.length === 0) {
+      console.log(chalk2.gray("(0 rows returned)"));
+      return;
+    }
+    const fields = queryResult.fields && queryResult.fields.length > 0 ? queryResult.fields : Object.keys(rows[0] || {});
+    if (fields.length === 0) return;
+    const displayRows = rows.slice(0, 25);
+    const table = new Table({
+      head: fields.map((f) => chalk2.cyan.bold(f)),
+      style: { head: [], border: ["gray"] }
+    });
+    for (const r of displayRows) {
+      table.push(
+        fields.map((f) => {
+          const val = r[f];
+          if (val === null || val === void 0) return chalk2.gray("NULL");
+          if (typeof val === "object") {
+            try {
+              return JSON.stringify(val);
+            } catch {
+              return String(val);
+            }
+          }
+          return String(val);
+        })
+      );
+    }
+    console.log(table.toString());
+    if (rows.length > 25) {
+      console.log(chalk2.yellow(`Showing first 25 of ${rows.length.toLocaleString()} rows.`));
+    }
+    console.log(
+      chalk2.gray(
+        `Total rows: ${queryResult.rowCount ?? rows.length} | Duration: ${queryResult.durationMs ?? 0}ms`
+      )
+    );
+  }
+  async handleListEntities() {
+    const spinner = ora(chalk2.blue("Loading schema...")).start();
+    try {
+      const schema = await this.adapter.inspectSchema();
+      spinner.stop();
+      if (schema.type === "postgres") {
+        const tables = schema.tables || [];
+        if (tables.length === 0) {
+          console.log(chalk2.yellow("No tables found in public schema."));
+          return;
+        }
+        console.log(chalk2.bold.cyan(`
+Tables in "${schema.databaseName}":`));
+        for (const t of tables) {
+          console.log(
+            `  \u2022 ${chalk2.white.bold(t.schema + "." + t.name)} (~${(t.approximateRowCount ?? 0).toLocaleString()} rows, ${t.columns.length} columns)`
+          );
+        }
+        console.log("");
+      } else {
+        const collections = schema.collections || [];
+        if (collections.length === 0) {
+          console.log(chalk2.yellow("No collections found."));
+          return;
+        }
+        console.log(chalk2.bold.cyan(`
+Collections in "${schema.databaseName}":`));
+        for (const c of collections) {
+          console.log(
+            `  \u2022 ${chalk2.white.bold(c.name)} (~${(c.documentCount ?? 0).toLocaleString()} documents, ${c.fields.length} inferred fields)`
+          );
+        }
+        console.log("");
+      }
+    } catch (err) {
+      spinner.fail(chalk2.red(`Failed to fetch entities: ${err.message}`));
+    }
+  }
+  async handleShowSchema(entityName) {
+    const spinner = ora(chalk2.blue("Loading schema details...")).start();
+    try {
+      const schema = await this.adapter.inspectSchema();
+      spinner.stop();
+      if (!entityName) {
+        console.log("\n" + formatSchemaForPrompt(schema) + "\n");
+        return;
+      }
+      if (schema.type === "postgres") {
+        const table = schema.tables?.find(
+          (t) => t.name.toLowerCase() === entityName.toLowerCase() || `${t.schema}.${t.name}`.toLowerCase() === entityName.toLowerCase()
+        );
+        if (!table) {
+          console.log(chalk2.red(`Table "${entityName}" not found.`));
+          return;
+        }
+        console.log(chalk2.bold.cyan(`
+Schema for table: ${table.schema}.${table.name}`));
+        const tableDetails = new Table({
+          head: ["Column", "Type", "Nullable", "Default", "Primary Key"].map((h) => chalk2.cyan.bold(h))
+        });
+        for (const col of table.columns) {
+          tableDetails.push([
+            col.name,
+            col.dataType,
+            col.isNullable ? "YES" : "NO",
+            col.defaultValue || "-",
+            col.isPrimaryKey ? "PK" : ""
+          ]);
+        }
+        console.log(tableDetails.toString());
+      } else {
+        const collection = schema.collections?.find((c) => c.name.toLowerCase() === entityName.toLowerCase());
+        if (!collection) {
+          console.log(chalk2.red(`Collection "${entityName}" not found.`));
+          return;
+        }
+        console.log(chalk2.bold.cyan(`
+Schema for collection: ${collection.name}`));
+        const colDetails = new Table({
+          head: ["Field", "Inferred Types"].map((h) => chalk2.cyan.bold(h))
+        });
+        for (const f of collection.fields) {
+          colDetails.push([f.name, f.types.join(", ")]);
+        }
+        console.log(colDetails.toString());
+      }
+    } catch (err) {
+      spinner.fail(chalk2.red(`Failed to inspect schema: ${err.message}`));
+    }
+  }
+  printWelcomeBanner() {
+    const banner = [
+      chalk2.bold.cyan("SANDAL: Safe Agentic Natural-language Database Access Layer"),
+      chalk2.gray("LangGraph + Multi-Provider AI (Gemini, OpenAI, Anthropic)"),
+      "",
+      `${chalk2.bold("Database:")} ${chalk2.green(this.adapter.type.toUpperCase())} (${this.adapter.getMaskedUrl()})`,
+      `${chalk2.bold("LLM Provider:")} ${chalk2.blue(this.provider)} [${chalk2.white(this.modelName)}]`,
+      `${chalk2.bold("Strict Mode:")} ${this.strictMode ? chalk2.green("ON (Full wipes blocked)") : chalk2.yellow("OFF")}`,
+      `${chalk2.bold("Allow Full Wipe:")} ${this.allowFullWipe ? chalk2.red("ENABLED") : chalk2.gray("NO")}`,
+      "",
+      chalk2.gray("Type your natural language request or SQL/Mongo query."),
+      chalk2.gray("Commands: .tables, .schema [name], .refresh, .help, exit")
+    ].join("\n");
+    console.log(
+      boxen2(banner, {
+        padding: 1,
+        borderColor: "cyan",
+        borderStyle: "round",
+        margin: { top: 1, bottom: 1 }
+      })
+    );
+  }
+  printHelp() {
+    console.log(
+      boxen2(
+        [
+          chalk2.bold.cyan("SANDAL REPL Commands:"),
+          "",
+          `${chalk2.bold(".tables / .collections")}   List all tables or collections with row counts`,
+          `${chalk2.bold(".schema [name]")}           Show columns, types, and indexes for a table`,
+          `${chalk2.bold(".refresh")}                 Force refresh cached schema introspection`,
+          `${chalk2.bold(".clear")}                   Clear terminal screen`,
+          `${chalk2.bold(".help")}                    Display this command reference`,
+          `${chalk2.bold("exit / quit")}              Gracefully disconnect and exit`,
+          "",
+          chalk2.bold.yellow("Example Natural Language Requests:"),
+          '  "Show top 10 users signed up in the last 30 days"',
+          '  "Calculate total revenue grouped by product category"',
+          '  "Add a concurrent index on orders(created_at)"',
+          '  "Delete users where status is inactive"'
+        ].join("\n"),
+        {
+          padding: 1,
+          borderColor: "gray",
+          borderStyle: "single",
+          margin: { top: 0, bottom: 1 }
+        }
+      )
+    );
+  }
+  setupSignalHandlers() {
+    const handleExit = async () => {
+      this.isRunning = false;
+      await this.shutdown();
+      process.exit(0);
+    };
+    process.on("SIGINT", handleExit);
+    process.on("SIGTERM", handleExit);
+  }
+  async shutdown() {
+    if (this.adapter.isConnected()) {
+      try {
+        await this.adapter.disconnect();
+      } catch {
+      }
+    }
+    console.log(chalk2.cyan("\nDatabase connection closed. Goodbye! \u{1F44B}\n"));
+  }
+};
+
+// src/cli.ts
+var program = new Command();
+program.name("sandal-db").description("SANDAL - Safe Agentic Natural-language Database Access Layer").version("1.0.0").argument("[dbUrl]", "Database connection URL (PostgreSQL or MongoDB)").option("-p, --provider <provider>", "LLM provider: google | openai | anthropic").option("-m, --model <model>", "LLM model name (e.g. gemini-2.5-flash, gpt-4o, claude-3-5-sonnet-latest)").option("-k, --key <key>", "API key for the chosen LLM provider").option("--strict", "Strict safety mode: hard-blocks full database wipes (default: true)", true).option("--no-strict", "Disable strict safety mode").option("--allow-full-wipe", "Explicitly allow full database / all-table wipe queries with confirmation", false).option("--threshold <number>", "Row count threshold for classifying updates as dangerous", "50").action(async (cliDbUrl, options) => {
+  try {
+    await runCli({
+      cliDbUrl,
+      cliProvider: options.provider,
+      cliModel: options.model,
+      cliApiKey: options.key,
+      strictMode: options.strict !== false,
+      allowFullWipe: Boolean(options.allowFullWipe),
+      rowThreshold: parseInt(options.threshold, 10) || 50
+    });
+  } catch (err) {
+    console.error(chalk3.red(`
+Error: ${err.message}`));
+    process.exit(1);
+  }
+});
+var configCmd = program.command("config").description("Manage stored database credentials and API keys in ~/.sandal/config.json").option("--set-db <url>", "Set default database connection URL").option("--set-key <key>", "Set API key for the default provider").option("--set-gemini <key>", "Set Google Gemini API key").option("--set-openai <key>", "Set OpenAI API key").option("--set-anthropic <key>", "Set Anthropic API key").option("--set-provider <provider>", "Set default LLM provider (google | openai | anthropic)").option("--set-model <model>", "Set default model name").option("--show", "Display current stored configuration (with masked secrets)").option("--path", "Print the path to the configuration file").action((opts) => {
+  if (opts.path) {
+    console.log(getConfigFilePath());
+    return;
+  }
+  if (opts.show) {
+    const cfg = readConfig();
+    console.log(chalk3.bold.cyan("\nSaved Configuration (~/.sandal/config.json):"));
+    console.log(`  Database URL:     ${cfg.dbUrl ? chalk3.green(maskUrl(cfg.dbUrl)) : chalk3.gray("Not set")}`);
+    console.log(`  Default Provider: ${cfg.defaultProvider ? chalk3.blue(cfg.defaultProvider) : chalk3.gray("Not set (defaults to google)")}`);
+    console.log(`  Default Model:    ${cfg.defaultModel ? chalk3.white(cfg.defaultModel) : chalk3.gray("Default for provider")}`);
+    console.log(`  Gemini Key:       ${cfg.geminiApiKey ? chalk3.yellow(maskApiKey(cfg.geminiApiKey)) : chalk3.gray("Not set")}`);
+    console.log(`  OpenAI Key:       ${cfg.openaiApiKey ? chalk3.yellow(maskApiKey(cfg.openaiApiKey)) : chalk3.gray("Not set")}`);
+    console.log(`  Anthropic Key:    ${cfg.anthropicApiKey ? chalk3.yellow(maskApiKey(cfg.anthropicApiKey)) : chalk3.gray("Not set")}
+`);
+    return;
+  }
+  const updates = {};
+  if (opts.setDb) {
+    detectDatabaseType(opts.setDb);
+    updates.dbUrl = opts.setDb;
+    console.log(chalk3.green(`Updated default database URL: ${maskUrl(opts.setDb)}`));
+  }
+  if (opts.setProvider) {
+    const p = opts.setProvider.toLowerCase();
+    if (!["google", "openai", "anthropic"].includes(p)) {
+      console.error(chalk3.red("Invalid provider. Expected google, openai, or anthropic."));
+      process.exit(1);
+    }
+    updates.defaultProvider = p;
+    console.log(chalk3.green(`Updated default provider: ${p}`));
+  }
+  if (opts.setModel) {
+    updates.defaultModel = opts.setModel;
+    console.log(chalk3.green(`Updated default model: ${opts.setModel}`));
+  }
+  if (opts.setGemini) {
+    updates.geminiApiKey = opts.setGemini;
+    console.log(chalk3.green("Updated Gemini API key."));
+  }
+  if (opts.setOpenai) {
+    updates.openaiApiKey = opts.setOpenai;
+    console.log(chalk3.green("Updated OpenAI API key."));
+  }
+  if (opts.setAnthropic) {
+    updates.anthropicApiKey = opts.setAnthropic;
+    console.log(chalk3.green("Updated Anthropic API key."));
+  }
+  if (opts.setKey) {
+    const current = readConfig();
+    const prov = updates.defaultProvider || current.defaultProvider || "google";
+    if (prov === "google") updates.geminiApiKey = opts.setKey;
+    else if (prov === "openai") updates.openaiApiKey = opts.setKey;
+    else if (prov === "anthropic") updates.anthropicApiKey = opts.setKey;
+    console.log(chalk3.green(`Updated API key for provider "${prov}".`));
+  }
+  if (Object.keys(updates).length > 0) {
+    writeConfig(updates);
+    console.log(chalk3.gray(`Saved to ${getConfigFilePath()}`));
+  } else {
+    configCmd.help();
+  }
+});
+async function runCli(opts) {
+  let resolved = resolveCredentials({
+    cliDbUrl: opts.cliDbUrl,
+    cliProvider: opts.cliProvider,
+    cliModel: opts.cliModel,
+    cliApiKey: opts.cliApiKey
+  });
+  let dbUrl = resolved.dbUrl;
+  if (!dbUrl) {
+    console.log(chalk3.yellow("\nNo database connection URL found in CLI flags, environment, or config."));
+    dbUrl = await input2({
+      message: "Enter your database URL (postgres://... or mongodb://...):",
+      validate: (val) => {
+        try {
+          detectDatabaseType(val);
+          return true;
+        } catch (e) {
+          return e.message;
+        }
+      }
+    });
+    const saveDb = await confirm2({
+      message: "Save this database URL to ~/.sandal/config.json for future runs?",
+      default: true
+    });
+    if (saveDb) {
+      writeConfig({ dbUrl });
+    }
+  } else if (opts.cliDbUrl && resolved.source.dbUrl === "cli") {
+    const currentCfg = readConfig();
+    if (currentCfg.dbUrl !== opts.cliDbUrl) {
+      writeConfig({ dbUrl: opts.cliDbUrl });
+    }
+  }
+  let provider = resolved.provider;
+  let apiKey = resolved.apiKey;
+  if (!apiKey) {
+    console.log(chalk3.yellow("\nNo API key found in environment or config."));
+    provider = await select({
+      message: "Select your LLM provider:",
+      choices: [
+        { name: "Google Gemini (GEMINI_API_KEY)", value: "google" },
+        { name: "OpenAI (OPENAI_API_KEY)", value: "openai" },
+        { name: "Anthropic (ANTHROPIC_API_KEY)", value: "anthropic" }
+      ]
+    });
+    apiKey = await input2({
+      message: `Enter your ${provider.toUpperCase()} API key:`,
+      validate: (val) => val.trim().length > 0 ? true : "API key cannot be empty."
+    });
+    const saveKey = await confirm2({
+      message: "Save this API key to ~/.sandal/config.json?",
+      default: true
+    });
+    if (saveKey) {
+      if (provider === "google") writeConfig({ geminiApiKey: apiKey, defaultProvider: "google" });
+      else if (provider === "openai") writeConfig({ openaiApiKey: apiKey, defaultProvider: "openai" });
+      else if (provider === "anthropic") writeConfig({ anthropicApiKey: apiKey, defaultProvider: "anthropic" });
+    }
+  }
+  const modelName = opts.cliModel || resolved.model || getDefaultModelForProvider(provider);
+  const dbSpinner = ora2(`Connecting to database (${maskUrl(dbUrl)})...`).start();
+  const adapter = createDatabaseAdapter(dbUrl);
+  try {
+    await adapter.connect();
+    dbSpinner.succeed(chalk3.green(`Connected to ${adapter.type.toUpperCase()} database: ${adapter.databaseName}`));
+  } catch (err) {
+    dbSpinner.fail(chalk3.red(`Failed to connect to database: ${err.message}`));
+    process.exit(1);
+  }
+  const model = createChatModel({
+    provider,
+    model: modelName,
+    apiKey
+  });
+  const repl = new ReplSession({
+    adapter,
+    model,
+    provider,
+    modelName,
+    strictMode: opts.strictMode,
+    allowFullWipe: opts.allowFullWipe,
+    rowThreshold: opts.rowThreshold
+  });
+  await repl.start();
+}
+program.parse(process.argv);