database_clientlisted

# database_client Run queries against databases. ## Operations - `db.connect(dsn_ref)` — DSN retrieved via `secrets_manager`. - `db.query(conn, sql, params?)` — returns rows + metadata. - `db.execute(conn, sql, params?)` — write queries (at least mid-risk). - `db.schema(conn, object?)` — introspect. - `db.migrations.status(dir)` — checked against detected migration tool. ## I/O Contract ```yaml io_contract: input: { op, args } output: { rows_or_meta } idempotent: for_SELECT side_effects: [network, "state_mutation?"] ``` ## Safety - Destructive SQL (`DROP`, `TRUNCATE`, `DELETE` without WHERE on prod) → critical. - `db.execute` on production connection → Council + user. - All queries logged (with parameter values redacted if they match secret patterns).