Database assets

Command syntax

Pass the SQL verbatim as command:

• SELECT id, name FROM users LIMIT 10
• SHOW TABLES
• DESCRIBE orders
• UPDATE users SET active = 0 WHERE id = 3

Scope

Use scope to override the default database for this call, e.g. scope: "analytics".

Notes

• Reads (SELECT / SHOW / DESCRIBE / EXPLAIN) return rows as JSON; writes return an affected-row count.
• Multi-statement input is split and each statement is policy-checked separately, so a read cannot smuggle a write past approval. Drivers may report their own statement types (e.g. MERGE); a type missing from the allow list needs confirmation unless the list contains *.
• Credentials are resolved automatically; never ask the user for a password.

Asset config (for put_asset)

For non-SQLite drivers, password and credential_id are mutually exclusive. Plaintext is write-only, encrypted in the asset, and never creates a managed credential. SQLite accepts neither password source: local SQLite must not have an SSH asset; remote_ssh_vfs requires one and uses a POSIX absolute remote path.

Examples:

put_asset(name="prod-db", type="database", config={"driver":"postgresql","host":"db.internal","username":"app","password":"..."})
put_asset(name="local-db", type="database", config={"driver":"sqlite","path":"/var/lib/app/data.db"})
put_asset(name="remote-db", type="database", config={"driver":"sqlite","sqlite_source":"remote_ssh_vfs","path":"/srv/data.db","ssh_asset_id":12})